Skip to content

Commit 06efef7

Browse files
astefanuttiastefanutti
committed
Refactor RayCluster mutating webhook
1 parent 77accff commit 06efef7

File tree

8 files changed

+102
-96
lines changed

8 files changed

+102
-96
lines changed

‎PROJECT‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ projectName: codeflare-operator
1212
repo: github.com/project-codeflare/codeflare-operator
1313
resources:
1414
- controller: true
15-
domain: codeflare.dev
15+
domain: ray.io
1616
group: ray
1717
kind: RayCluster
1818
path: github.com/project-codeflare/codeflare-operator/pkg/controllers

‎config/default/kustomization.yaml‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -16,13 +16,8 @@ commonLabels:
1616
bases:
1717
- ../rbac
1818
- ../manager
19-
- ../webhook
2019
# [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'.
2120
# - ../prometheus
2221

2322
resources:
2423
- metrics_service.yaml
25-
26-
patches:
27-
- path: manager_webhook_patch.yaml
28-
- path: webhookcainjection_patch.yaml

‎config/openshift/kustomization.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Adds namespace to all resources.
2+
namespace: openshift-operators
3+
4+
# Value of this field is prepended to the
5+
# names of all resources, e.g. a deployment named
6+
# "wordpress" becomes "alices-wordpress".
7+
# Note that it should also match with the prefix (text before '-') of the namespace
8+
# field above.
9+
namePrefix: codeflare-operator-
10+
11+
# Labels to add to all resources and selectors.
12+
commonLabels:
13+
app.kubernetes.io/name: codeflare-operator
14+
app.kubernetes.io/part-of: codeflare
15+
16+
bases:
17+
- ../default
18+
- ../webhook
19+
20+
patches:
21+
- path: manager_webhook_patch.yaml
22+
- path: webhookcainjection_patch.yaml

‎config/default/manager_webhook_patch.yaml‎ renamed to ‎config/openshift/manager_webhook_patch.yaml‎

File renamed without changes.

‎config/default/webhookcainjection_patch.yaml‎ renamed to ‎config/openshift/webhookcainjection_patch.yaml‎

File renamed without changes.

‎main.go‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -147,8 +147,7 @@ func main() {
147147
})
148148
exitOnError(err, "unable to start manager")
149149

150-
rayClusterDefaulter := &controllers.RayClusterDefaulter{}
151-
exitOnError(rayClusterDefaulter.SetupWebhookWithManager(mgr), "error setting up webhook")
150+
exitOnError(controllers.SetupRayClusterWebhookWithManager(mgr, cfg.KubeRay), "error setting up RayCluster webhook")
152151

153152
ok, err := HasAPIResourceForGVK(kubeClient.DiscoveryClient, rayv1.GroupVersion.WithKind("RayCluster"))
154153
if ok {

‎pkg/controllers/raycluster_webhook.go‎

Lines changed: 78 additions & 81 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ import (
2323

2424
corev1 "k8s.io/api/core/v1"
2525
"k8s.io/apimachinery/pkg/runtime"
26+
"k8s.io/utils/pointer"
2627
ctrl "sigs.k8s.io/controller-runtime"
2728
logf "sigs.k8s.io/controller-runtime/pkg/log"
2829
"sigs.k8s.io/controller-runtime/pkg/webhook"
@@ -33,105 +34,101 @@ import (
3334
// log is for logging in this package.
3435
var rayclusterlog = logf.Log.WithName("raycluster-resource")
3536

36-
func (r *RayClusterDefaulter) SetupWebhookWithManager(mgr ctrl.Manager) error {
37+
func SetupRayClusterWebhookWithManager(mgr ctrl.Manager, cfg *config.KubeRayConfiguration) error {
3738
return ctrl.NewWebhookManagedBy(mgr).
3839
For(&rayv1.RayCluster{}).
39-
WithDefaulter(&RayClusterDefaulter{
40-
Config: r.Config,
41-
rayDashboardOauthEnabled: r.isRayDashboardOAuthEnabledWebhook(),
40+
WithDefaulter(&rayClusterDefaulter{
41+
Config: cfg,
4242
}).
4343
Complete()
4444
}
4545

46-
//+kubebuilder:webhook:path=/mutate-ray-io-v1-raycluster,mutating=true,failurePolicy=fail,sideEffects=None,groups=ray.io,resources=rayclusters,verbs=create;update,versions=v1,name=mraycluster.kb.io,admissionReviewVersions=v1
46+
// +kubebuilder:webhook:path=/mutate-ray-io-v1-raycluster,mutating=true,failurePolicy=fail,sideEffects=None,groups=ray.io,resources=rayclusters,verbs=create;update,versions=v1,name=mraycluster.kb.io,admissionReviewVersions=v1
4747

48-
type RayClusterDefaulter struct {
49-
Config *config.KubeRayConfiguration
50-
rayDashboardOauthEnabled bool
48+
type rayClusterDefaulter struct {
49+
Config *config.KubeRayConfiguration
5150
}
5251

53-
var _ webhook.CustomDefaulter = &RayClusterDefaulter{}
52+
var _ webhook.CustomDefaulter = &rayClusterDefaulter{}
5453

5554
// Default implements webhook.Defaulter so a webhook will be registered for the type
56-
func (r *RayClusterDefaulter) Default(ctx context.Context, obj runtime.Object) error {
55+
func (r *rayClusterDefaulter) Default(ctx context.Context, obj runtime.Object) error {
5756
raycluster := obj.(*rayv1.RayCluster)
5857

59-
if r.rayDashboardOauthEnabled {
60-
rayclusterlog.Info("default", "name", raycluster.Name)
61-
// Check and add OAuth proxy if it does not exist.
62-
alreadyExists := false
63-
for _, container := range raycluster.Spec.HeadGroupSpec.Template.Spec.Containers {
64-
if container.Name == "oauth-proxy" {
65-
rayclusterlog.Info("OAuth sidecar already exists, no patch needed")
66-
alreadyExists = true
67-
break // exits the for loop
68-
}
58+
if !pointer.BoolDeref(r.Config.RayDashboardOAuthEnabled, true) {
59+
return nil
60+
}
61+
62+
// Check and add OAuth proxy if it does not exist
63+
for _, container := range raycluster.Spec.HeadGroupSpec.Template.Spec.Containers {
64+
if container.Name == "oauth-proxy" {
65+
rayclusterlog.V(2).Info("OAuth sidecar already exists, no patch needed")
66+
return nil
6967
}
68+
}
7069

71-
if !alreadyExists {
72-
rayclusterlog.Info("Adding OAuth sidecar container")
73-
// definition of the new container
74-
newOAuthSidecar := corev1.Container{
75-
Name: "oauth-proxy",
76-
Image: "registry.redhat.io/openshift4/ose-oauth-proxy@sha256:1ea6a01bf3e63cdcf125c6064cbd4a4a270deaf0f157b3eabb78f60556840366",
77-
Ports: []corev1.ContainerPort{
78-
{ContainerPort: 8443, Name: "oauth-proxy"},
79-
},
80-
Args: []string{
81-
"--https-address=:8443",
82-
"--provider=openshift",
83-
"--openshift-service-account=" + raycluster.Name + "-oauth-proxy",
84-
"--upstream=http://localhost:8265",
85-
"--tls-cert=/etc/tls/private/tls.crt",
86-
"--tls-key=/etc/tls/private/tls.key",
87-
"--cookie-secret=$(COOKIE_SECRET)",
88-
"--openshift-delegate-urls={\"/\":{\"resource\":\"pods\",\"namespace\":\"default\",\"verb\":\"get\"}}",
89-
},
90-
VolumeMounts: []corev1.VolumeMount{
91-
{
92-
Name: "proxy-tls-secret",
93-
MountPath: "/etc/tls/private",
94-
ReadOnly: true,
95-
},
96-
},
97-
}
98-
99-
// Adding the new OAuth sidecar container
100-
raycluster.Spec.HeadGroupSpec.Template.Spec.Containers = append(raycluster.Spec.HeadGroupSpec.Template.Spec.Containers, newOAuthSidecar)
101-
102-
cookieSecret := corev1.EnvVar{
103-
Name: "COOKIE_SECRET",
104-
ValueFrom: &corev1.EnvVarSource{
105-
SecretKeyRef: &corev1.SecretKeySelector{
106-
LocalObjectReference: corev1.LocalObjectReference{
107-
Name: raycluster.Name + "-oauth-config",
108-
},
109-
Key: "cookie_secret",
110-
},
111-
},
112-
}
113-
114-
raycluster.Spec.HeadGroupSpec.Template.Spec.Containers[0].Env = append(
115-
raycluster.Spec.HeadGroupSpec.Template.Spec.Containers[0].Env,
116-
cookieSecret,
117-
)
118-
119-
tlsSecretVolume := corev1.Volume{
120-
Name: "proxy-tls-secret",
121-
VolumeSource: corev1.VolumeSource{
122-
Secret: &corev1.SecretVolumeSource{
123-
SecretName: raycluster.Name + "-proxy-tls-secret",
124-
},
70+
rayclusterlog.V(2).Info("Adding OAuth sidecar container")
71+
// definition of the new container
72+
newOAuthSidecar := corev1.Container{
73+
Name: "oauth-proxy",
74+
Image: "registry.redhat.io/openshift4/ose-oauth-proxy@sha256:1ea6a01bf3e63cdcf125c6064cbd4a4a270deaf0f157b3eabb78f60556840366",
75+
Ports: []corev1.ContainerPort{
76+
{ContainerPort: 8443, Name: "oauth-proxy"},
77+
},
78+
Args: []string{
79+
"--https-address=:8443",
80+
"--provider=openshift",
81+
"--openshift-service-account=" + raycluster.Name + "-oauth-proxy",
82+
"--upstream=http://localhost:8265",
83+
"--tls-cert=/etc/tls/private/tls.crt",
84+
"--tls-key=/etc/tls/private/tls.key",
85+
"--cookie-secret=$(COOKIE_SECRET)",
86+
"--openshift-delegate-urls={\"/\":{\"resource\":\"pods\",\"namespace\":\"default\",\"verb\":\"get\"}}",
87+
},
88+
VolumeMounts: []corev1.VolumeMount{
89+
{
90+
Name: "proxy-tls-secret",
91+
MountPath: "/etc/tls/private",
92+
ReadOnly: true,
93+
},
94+
},
95+
}
96+
97+
// Adding the new OAuth sidecar container
98+
raycluster.Spec.HeadGroupSpec.Template.Spec.Containers = append(raycluster.Spec.HeadGroupSpec.Template.Spec.Containers, newOAuthSidecar)
99+
100+
cookieSecret := corev1.EnvVar{
101+
Name: "COOKIE_SECRET",
102+
ValueFrom: &corev1.EnvVarSource{
103+
SecretKeyRef: &corev1.SecretKeySelector{
104+
LocalObjectReference: corev1.LocalObjectReference{
105+
Name: raycluster.Name + "-oauth-config",
125106
},
126-
}
107+
Key: "cookie_secret",
108+
},
109+
},
110+
}
127111

128-
raycluster.Spec.HeadGroupSpec.Template.Spec.Volumes = append(raycluster.Spec.HeadGroupSpec.Template.Spec.Volumes, tlsSecretVolume)
112+
raycluster.Spec.HeadGroupSpec.Template.Spec.Containers[0].Env = append(
113+
raycluster.Spec.HeadGroupSpec.Template.Spec.Containers[0].Env,
114+
cookieSecret,
115+
)
116+
117+
tlsSecretVolume := corev1.Volume{
118+
Name: "proxy-tls-secret",
119+
VolumeSource: corev1.VolumeSource{
120+
Secret: &corev1.SecretVolumeSource{
121+
SecretName: raycluster.Name + "-proxy-tls-secret",
122+
},
123+
},
124+
}
129125

130-
// Ensure the service account is set
131-
if raycluster.Spec.HeadGroupSpec.Template.Spec.ServiceAccountName == "" {
132-
raycluster.Spec.HeadGroupSpec.Template.Spec.ServiceAccountName = raycluster.Name + "-oauth-proxy"
133-
}
134-
}
126+
raycluster.Spec.HeadGroupSpec.Template.Spec.Volumes = append(raycluster.Spec.HeadGroupSpec.Template.Spec.Volumes, tlsSecretVolume)
127+
128+
// Ensure the service account is set
129+
if raycluster.Spec.HeadGroupSpec.Template.Spec.ServiceAccountName == "" {
130+
raycluster.Spec.HeadGroupSpec.Template.Spec.ServiceAccountName = raycluster.Name + "-oauth-proxy"
135131
}
132+
136133
return nil
137134
}

‎pkg/controllers/support.go‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -155,10 +155,3 @@ func (r *RayClusterReconciler) isRayDashboardOAuthEnabled() bool {
155155
}
156156
return true
157157
}
158-
159-
func (r *RayClusterDefaulter) isRayDashboardOAuthEnabledWebhook() bool {
160-
if r.Config != nil && r.Config.RayDashboardOAuthEnabled != nil {
161-
return *r.Config.RayDashboardOAuthEnabled
162-
}
163-
return true
164-
}

0 commit comments

Comments
 (0)