[cherry-pick][RayJob] allow create verb for services/proxy, which is required for HTTPMode (#2321) (#2337)

Signed-off-by: Andrew Sy Kim <[email protected]>
Co-authored-by: Andrew Sy Kim <[email protected]>

Author: kevin85421

helm-chart/kuberay-operator/templates/_helpers.tpl

@@ -177,6 +177,7 @@ rules:
   resources:
   - services/proxy
   verbs:
+  - create
   - get
   - patch
   - update

helm-chart/kuberay-operator/templates/deployment.yaml

@@ -82,6 +82,9 @@ spec:
             {{- $argList = append $argList "--log-file-encoder" -}}
             {{- $argList = append $argList .Values.logging.fileEncoder -}}
             {{- end -}}
+            {{- if hasKey .Values "useKubernetesProxy" -}}
+            {{- $argList = append $argList (printf "--use-kubernetes-proxy=%t" .Values.useKubernetesProxy) -}}
+            {{- end -}}
             {{- if hasKey .Values "leaderElectionEnabled" -}}
             {{- $argList = append $argList (printf "--enable-leader-election=%t" .Values.leaderElectionEnabled) -}}
             {{- end -}}

helm-chart/kuberay-operator/values.yaml

@@ -78,6 +78,9 @@ securityContext:
   seccompProfile:
     type: RuntimeDefault
 
+# if userKubernetesProxy is set to true, the KubeRay operator will be configured with the --use-kubernetes-proxy flag.
+# Using this option to configure kuberay-operator to comunitcate to Ray head pods by proxying through the Kubernetes API Server.
+# useKubernetesProxy: true
 
 # If leaderElectionEnabled is set to true, the KubeRay operator will use leader election for high availability.
 leaderElectionEnabled: true

ray-operator/config/rbac/role.yaml

@@ -105,6 +105,7 @@ rules:
   resources:
   - services/proxy
   verbs:
+  - create
   - get
   - patch
   - update

ray-operator/controllers/ray/rayjob_controller.go

@@ -63,7 +63,7 @@ func NewRayJobReconciler(_ context.Context, mgr manager.Manager, provider utils.
 // +kubebuilder:rbac:groups=core,resources=pods/status,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=core,resources=services,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=core,resources=services/status,verbs=get;update;patch
-// +kubebuilder:rbac:groups=core,resources=services/proxy,verbs=get;update;patch
+// +kubebuilder:rbac:groups=core,resources=services/proxy,verbs=get;update;patch;create
 // +kubebuilder:rbac:groups=coordination.k8s.io,resources=leases,verbs=get;list;create;update
 // +kubebuilder:rbac:groups=core,resources=serviceaccounts,verbs=get;list;watch;create;delete
 // +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=roles,verbs=get;list;watch;create;delete;update

ray-operator/controllers/ray/utils/dashboard_httpclient.go

@@ -346,6 +346,10 @@ func (r *RayDashboardClient) SubmitJobReq(ctx context.Context, request *RayJobRe
 
 	body, _ := io.ReadAll(resp.Body)
 
+	if resp.StatusCode < 200 || resp.StatusCode > 299 {
+		return "", fmt.Errorf("SubmitJob fail: %s %s", resp.Status, string(body))
+	}
+
 	var jobResp RayJobResponse
 	if err = json.Unmarshal(body, &jobResp); err != nil {
 		// Maybe body is not valid json, raise an error with the body.