memory:
  guarantee: 1G
  limit: 3G
cpu:
  guarantee: .5
  limit: 1

[E 2020-06-23 22:54:13.719 JupyterHub pages:325] Previous spawn for BStorm_(WMF) failed: (403)
    Reason: error
    HTTP response headers: HTTPHeaderDict({'Cache-Control': 'no-cache, private', 'Content-Type': 'application/json', 'Date': 'Tue, 23 Jun 2020 22:54:13 GMT', 'Content-Length': '993'})
    HTTP response body: {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"pods \"jupyter--42-53torm-5f-28-57-4d-46-29\" is forbidden: unable to validate against any pod security policy: [spec.containers[0].volumeMounts[1].readOnly: Invalid value: false: must be read-only spec.containers[0].volumeMounts[2].readOnly: Invalid value: false: must be read-only spec.containers[0].volumeMounts[3].readOnly: Invalid value: false: must be read-only spec.initContainers[0].securityContext.runAsUser: Invalid value: 0: must be in the ranges: [{52771 52771}] spec.initContainers[1].securityContext.runAsUser: Invalid value: 0: must be in the ranges: [{52771 52771}] spec.initContainers[1].securityContext.privileged: Invalid value: true: Privileged containers are not allowed spec.initContainers[1].securityContext.capabilities.add: Invalid value: \"NET_ADMIN\": capability may not be added]","reason":"Forbidden","details":{"name":"jupyter--42-53torm-5f-28-57-4d-46-29","kind":"pods"},"code":403

'init_containers': [{'args': None,
                     'command': ['iptables',
                                 '-A',
                                 'OUTPUT',
                                 '-d',
                                 '169.254.169.254',
                                 '-j',
                                 'DROP'],
                     'env': None,
                     'env_from': None,
                     'image': 'jupyterhub/k8s-network-tools:0.9.0',
                     'image_pull_policy': None,
                     'lifecycle': None,
                     'liveness_probe': None,
                     'name': 'block-cloud-metadata',
                     'ports': None,
                     'readiness_probe': None,
                     'resources': None,
                     'security_context': {'allow_privilege_escalation': None,
                                          'capabilities': {'add': ['NET_ADMIN'],
                                                           'drop': None},
                                          'privileged': True,
                                          'proc_mount': None,
                                          'read_only_root_filesystem': None,
                                          'run_as_group': None,
                                          'run_as_non_root': None,
                                          'run_as_user': 0,
                                          'se_linux_options': None},
                     'stdin': None,
                     'stdin_once': None,
                     'termination_message_path': None,
                     'termination_message_policy': None,
                     'tty': None,
                     'volume_devices': None,
                     'volume_mounts': None,
                     'working_dir': None}],

bstorm@paws-k8s-control-1:~/src/paws$ kubectl -n prod logs jupyter--42-53torm-5f-28-57-4d-46-29
[I 2020-06-24 01:50:39.889 SingleUserNotebookApp extension:158] JupyterLab extension loaded from /srv/paws/lib/python3.6/site-packages/jupyterlab
[I 2020-06-24 01:50:39.889 SingleUserNotebookApp extension:159] JupyterLab application directory is /srv/paws/share/jupyter/lab
[I 2020-06-24 01:50:39.926 SingleUserNotebookApp singleuser:561] Starting jupyterhub-singleuser server version 1.1.0
[I 2020-06-24 01:50:39.934 SingleUserNotebookApp notebookapp:1924] Serving notebooks from local directory: /home/paws
[I 2020-06-24 01:50:39.934 SingleUserNotebookApp notebookapp:1924] The Jupyter Notebook is running at:
[I 2020-06-24 01:50:39.934 SingleUserNotebookApp notebookapp:1924] http://jupyter--42-53torm-5f-28-57-4d-46-29:8888/user/BStorm_%28WMF%29/
[I 2020-06-24 01:50:39.934 SingleUserNotebookApp notebookapp:1925] Use Control-C to stop this server and shut down all kernels (twice to skip confirmation).
[I 2020-06-24 01:50:39.952 SingleUserNotebookApp singleuser:542] Updating Hub with activity every 300 seconds
[I 2020-06-24 01:50:42.143 SingleUserNotebookApp log:174] 302 GET /user/BStorm_%28WMF%29/ -> /user/BStorm_%28WMF%29/tree? (@192.168.20.180) 1.62ms

apiVersion: v1
items:
- apiVersion: extensions/v1beta1
  kind: Ingress
  metadata:
    annotations:
      kubernetes.io/tls-acme: "true"
      meta.helm.sh/release-name: paws
      meta.helm.sh/release-namespace: prod
    creationTimestamp: "2020-06-23T23:55:42Z"
    generation: 1
    labels:
      app.kubernetes.io/managed-by: Helm
    name: deploy-hook
    namespace: prod
    resourceVersion: "6173412"
    selfLink: /apis/extensions/v1beta1/namespaces/prod/ingresses/deploy-hook
    uid: d275afde-5ccc-4436-980f-248baa073f5e
  spec:
    rules:
    - host: paws-deploy-hook.tools.wmflabs.org
      http:
        paths:
        - backend:
            serviceName: deploy-hook
            servicePort: 8888
          path: /
    tls:
    - hosts:
      - paws-deploy-hook.tools.wmflabs.org
      secretName: kubelego-deploy-hook-paws
  status:
    loadBalancer: {}
- apiVersion: extensions/v1beta1
  kind: Ingress
  metadata:
    annotations:
      kubectl.kubernetes.io/last-applied-configuration: |
        {"apiVersion":"extensions/v1beta1","kind":"Ingress","metadata":{"annotations":{},"name":"hub","namespace":"prod"},"spec":{"rules":[{"host":"paws.wmcloud.org","http":{"paths":[{"backend":{"serviceName":"hub","servicePort":8081}}]}},{"host":"paws.wmflabs.org","http":{"paths":[{"backend":{"serviceName":"hub","servicePort":8081}}]}}]}}
    creationTimestamp: "2020-06-19T11:24:50Z"
    generation: 1
    name: hub
    namespace: prod
    resourceVersion: "5008699"
    selfLink: /apis/extensions/v1beta1/namespaces/prod/ingresses/hub
    uid: 6c1fed46-acdf-457e-830f-928980501429
  spec:
    rules:
    - host: paws.wmcloud.org
      http:
        paths:
        - backend:
            serviceName: hub
            servicePort: 8081
    - host: paws.wmflabs.org
      http:
        paths:
        - backend:
            serviceName: hub
            servicePort: 8081
  status:
    loadBalancer: {}
kind: List
metadata:
  resourceVersion: ""
  selfLink: ""