feat(notebooks): configure proxy-to-session key secret names

[SalimKayal]

Summary

Mounts the two proxy-to-session key Secrets into every session pod via Amalthea extraVolumes/extraVolumeMounts, delivering the hop-2 keys the SSH buildpack and the proxy need. Stacked on the service-account authn branch (salimkayal/feat/ssh-proxy-service-account-authn).

Motivation and context

Hop 2 is now authenticated with static keypairs (see the renku proxy-to-session PR). Each session needs two files at fixed paths under its storage mount: the session host private key (dropbear -r) and the proxy auth public key (installed as authorized_keys by the buildpack). The Secrets are created once by the Helm keygen Job; data-services only mounts them. No per-session keys, no DB, and no hibernation/resume concern.

Behavior

• Every session gets ${RENKU_MOUNT_DIR}/.ssh/dropbear_ed25519_host_key (Secret {fullname}-ssh-session-host-key, key hostKey) and ${RENKU_MOUNT_DIR}/.ssh/proxy_auth_key.pub (Secret {fullname}-ssh-proxy-session-auth-key, key authKeyPub), both read-only subPath file mounts.
• No mounts when the chart does not provide the secret names, so existing deployments are unaffected.

Changes

• components/renku_data_services/notebooks/config/dynamic.py: proxy_host_key_secret / proxy_auth_key_secret on _SessionSshConfig (env NB_SESSIONS__SSH__PROXY_{HOST,AUTH}_KEY_SECRET).
• components/renku_data_services/notebooks/core_sessions.py: ssh_proxy_session_extras() builds the two ExtraVolume/ExtraVolumeMount pairs and is concatenated into session_extras in both start_session and patch_session. The Secrets are referenced via ExtraVolume.secret and deliberately not added to session_extras.secrets, because data-services must not create them.
• test/components/renku_data_services/notebooks/test_ssh_proxy_session_extras.py (new): asserts volume names, secret names, items, mount paths/subPaths/readOnly, and the empty case.

Notes

• Depends on the feat: ssh proxy session authn renku#4627 passing NB_SESSIONS__SSH__PROXY_{HOST,AUTH}_KEY_SECRET (session-env-secret.yaml).
• Mounted into all sessions; OCI-label capability gating is deferred.
• Two volumes cannot share a directory mountPath, hence the subPath file mounts inside .ssh.

---

PR Stack

• feat: add support for ssh pubkeys storing / validating / retrieving  #1441
  * feat(notebooks): configure proxy-to-session key secret names #1452 ◀️ this PR
  * Add frontend variant as session label #1455
  * feat(notebooks): mount proxy-to-session keys only for ssh frontends #1458

[coveralls]

Coverage Report for CI Build 36876237189

Warning

No base build found for commit 63b726b on salimkayal/feat/ssh-keys.
Coverage changes can't be calculated without a base build.
If a base build is processing, this comment will update automatically when it completes.

Coverage: 85.284%

Details

• Patch coverage: 4 uncovered changes across 2 files (23 of 27 lines covered, 85.19%).

Uncovered Changes

File	Changed	Covered	%
components/renku_data_services/notebooks/config/dynamic.py	15	13	86.67%
components/renku_data_services/notebooks/core_sessions.py	12	10	83.33%

Coverage Regressions

Requires a base build to compare against. How to fix this →

---

Coverage Stats

Relevant Lines:	34732
Covered Lines:	29621
Line Coverage:	85.28%
Coverage Strength:	1.48 hits per line

---

💛 - Coveralls