Add NicApp CRD template for NIC integration

.github/workflows/lint.yaml

@@ -21,10 +21,10 @@ jobs:
         run: helm dependency update
 
       - name: Lint chart
-        run: helm lint .
+        run: helm lint . --set nebariapp.enabled=false
 
       - name: Template chart
-        run: helm template test . > /dev/null
+        run: helm template test . --set nebariapp.enabled=false > /dev/null
 
       - name: Install uv
         uses: astral-sh/setup-uv@61cb8a9741eeb8a550a1b8544337180c0fc8476b  # v7.2.0

.github/workflows/test.yaml

@@ -29,7 +29,7 @@ jobs:
         run: helm dependency update
 
       - name: Deploy chart
-        run: helm install data-science-pack . --namespace default
+        run: helm install data-science-pack . --namespace default --set nebariapp.enabled=false
 
       - name: Wait for pods with progress
         run: |

Tiltfile

@@ -42,6 +42,8 @@ k8s_yaml(helm(
     name='data-science-pack',
     namespace='default',
     set=[
+        # Disable NebariApp CRD for local dev (not running on Nebari)
+        'nebariapp.enabled=false',
         # Override pinned images with local builds
         'jupyterhub.hub.image.name=nebari-data-science-pack-jupyterhub',
         'jupyterhub.hub.image.tag=latest',

templates/nebariapp.yaml

@@ -0,0 +1,24 @@
+{{- if .Values.nebariapp.enabled }}
+apiVersion: apps.nebari.dev/v1
+kind: NebariApp
+metadata:
+  name: {{ include "nebari-data-science-pack.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "nebari-data-science-pack.labels" . | nindent 4 }}
+spec:
+  hostname: {{ required "nebariapp.hostname is required when nebariapp.enabled is true" .Values.nebariapp.hostname }}
+  service:
+    name: {{ .Values.nebariapp.service.name | default "proxy-public" }}
+    port: {{ .Values.nebariapp.service.port | default 80 }}
+  {{- with .Values.nebariapp.routing }}
+  routing:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.nebariapp.auth }}
+  auth:
+    enabled: {{ .enabled | default true }}
+    provider: {{ .provider | default "keycloak" }}
+    provisionClient: {{ .provisionClient | default true }}
+  {{- end }}
+{{- end }}

values.yaml

@@ -1,6 +1,27 @@
 # Default values for nebari-data-science-pack
 # This is a YAML-formatted file.
 
+# =============================================================================
+# Nebari Integration
+# =============================================================================
+# Creates a NebariApp CRD that configures routing and auth via nebari-operator.
+# Set to false when deploying outside of Nebari.
+nebariapp:
+  enabled: true
+  # hostname: jupyter.nic.local  # Required when enabled
+  service:
+    # JupyterHub proxy service (created by jupyterhub subchart)
+    name: proxy-public
+    port: 80
+  # routing:
+  #   routes:
+  #     - pathPrefix: /
+  #       pathType: Exact
+  auth:
+    enabled: true
+    provider: keycloak
+    provisionClient: true
+
 # Shared storage configuration (disabled - requires RWX storage class)
 sharedStorage:
   enabled: false