From 8cd83d167614a09da930708b6c8f2e56f3154f20 Mon Sep 17 00:00:00 2001
From: Ken Foster <kfoster@openteams.com>
Date: Thu, 23 Jul 2026 16:54:10 -0400
Subject: [PATCH] Add explicit ability to disable external Nebi integration

---
 templates/_helpers.tpl                | 10 ++++++++--
 templates/hub-nebi-networkpolicy.yaml |  2 +-
 values.yaml                           | 16 +++++++++++++++-
 3 files changed, 24 insertions(+), 4 deletions(-)

diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl
index abc9bb8..5b40525 100644
--- a/templates/_helpers.tpl
+++ b/templates/_helpers.tpl
@@ -118,12 +118,14 @@ Empty when neither is available.
 {{- end -}}
 
 {{/*
-External Nebi URL. Order of precedence:
+External Nebi URL. Empty when .Values.nebi.enabled is false (master switch).
+Otherwise, order of precedence:
   1. .Values.nebi.remoteURL (explicit)
   2. https://<subdomains.nebi>.<baseDomain(keycloak.hostname)>
 Empty when neither is available.
 */}}
 {{- define "nebari-data-science-pack.nebiRemoteURL" -}}
+{{- if .Values.nebi.enabled -}}
 {{- if .Values.nebi.remoteURL -}}
 {{- .Values.nebi.remoteURL -}}
 {{- else -}}
@@ -133,19 +135,23 @@ Empty when neither is available.
 {{- end -}}
 {{- end -}}
 {{- end -}}
+{{- end -}}
 
 {{/*
-In-cluster Nebi URL. Order of precedence:
+In-cluster Nebi URL. Empty when .Values.nebi.enabled is false (master
+switch). Otherwise, order of precedence:
   1. .Values.nebi.internalURL (explicit)
   2. http://nebi-pack-nebari-nebi-pack.<nebi.namespace>.svc.cluster.local
 */}}
 {{- define "nebari-data-science-pack.nebiInternalURL" -}}
+{{- if .Values.nebi.enabled -}}
 {{- if .Values.nebi.internalURL -}}
 {{- .Values.nebi.internalURL -}}
 {{- else -}}
 {{- printf "http://nebi-pack-nebari-nebi-pack.%s.svc.cluster.local" (.Values.nebi.namespace | default "nebi") -}}
 {{- end -}}
 {{- end -}}
+{{- end -}}
 
 {{/*
 Nebi image reference (repository:tag). Empty when nebi.image.tag is not
diff --git a/templates/hub-nebi-networkpolicy.yaml b/templates/hub-nebi-networkpolicy.yaml
index 624ba95..269382e 100644
--- a/templates/hub-nebi-networkpolicy.yaml
+++ b/templates/hub-nebi-networkpolicy.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.nebi.internalURL .Values.nebi.namespace }}
+{{- if and .Values.nebi.enabled .Values.nebi.internalURL .Values.nebi.namespace }}
 # Allows the JupyterHub pod to reach the Nebi server for token exchange
 # at spawn time (pre_spawn_hook calls /api/v1/auth/session).
 # Kubernetes NetworkPolicy is additive — this rule is evaluated alongside
diff --git a/values.yaml b/values.yaml
index 2ba3062..60fa020 100644
--- a/values.yaml
+++ b/values.yaml
@@ -218,8 +218,22 @@ sharedStorage:
 # =============================================================================
 # Nebi Integration
 # =============================================================================
-# Companion service (nebari-nebi-pack) deployed in its own namespace.
+# Companion software pack for standalone Nebi (nebari-nebi-pack) deployed in its
+# own namespace and integrated with JupyterLab users' local environments.
 nebi:
+  # Master switch for integration with a *separate* nebi-pack deployment.
+  # When false, the remoteURL/internalURL helpers below return empty
+  # regardless of any explicit value, so every downstream surface that keys
+  # off them is disabled:
+  #   - the jhub-apps environment selector (config/jupyterhub/03-nebi-envs.py,
+  #     gated on a non-empty nebi-internal-url)
+  #   - the remote pre-spawn auth + "Nebi" launcher card (01-spawner.py,
+  #     gated on a non-empty nebi-remote-url)
+  #   - the hub -> nebi egress NetworkPolicy
+  # The in-pod standalone nebi binary is INDEPENDENT of this flag — it is
+  # driven solely by nebi.image.tag below and stays wired when this is false.
+  # Leave true for deployment (where nebi-pack is present).
+  enabled: true
   # Nebi binary image. An init container copies the nebi binary from this image
   # into each JupyterLab pod, so the version is controlled at deploy time
   # rather than baked into the JupyterLab image.