Review changes

Author: Bobbins228

config/rbac/role.yaml

@@ -17,6 +17,12 @@ rules:
   - subjectaccessreviews
   verbs:
   - create
+- apiGroups:
+  - config.openshift.io
+  resources:
+  - ingresses
+  verbs:
+  - get
 - apiGroups:
   - ""
   resources:

main.go

@@ -24,7 +24,6 @@ import (
 	"strings"
 	"time"
 
-	routev1ClientSet "github.com/openshift/client-go/route/clientset/versioned"
 	rayv1 "github.com/ray-project/kuberay/ray-operator/apis/ray/v1"
 	"go.uber.org/zap/zapcore"
 
@@ -49,6 +48,7 @@ import (
 
 	routev1 "github.com/openshift/api/route/v1"
 
+	clientset "github.com/openshift/client-go/config/clientset/versioned"
 	"github.com/project-codeflare/codeflare-operator/pkg/config"
 	"github.com/project-codeflare/codeflare-operator/pkg/controllers"
 	// Import all Kubernetes client auth plugins (e.g. Azure, GCP, OIDC, etc.)
@@ -57,15 +57,12 @@ import (
 )
 
 var (
-	scheme                      = runtime.NewScheme()
-	setupLog                    = ctrl.Log.WithName("setup")
-	OperatorVersion             = "UNKNOWN"
-	McadVersion                 = "UNKNOWN"
-	InstaScaleVersion           = "UNKNOWN"
-	BuildDate                   = "UNKNOWN"
-	NameConsoleLink      string = "console"
-	NamespaceConsoleLink string = "openshift-console"
-	domain               string = ""
+	scheme            = runtime.NewScheme()
+	setupLog          = ctrl.Log.WithName("setup")
+	OperatorVersion   = "UNKNOWN"
+	McadVersion       = "UNKNOWN"
+	InstaScaleVersion = "UNKNOWN"
+	BuildDate         = "UNKNOWN"
 )
 
 func init() {
@@ -76,6 +73,8 @@ func init() {
 	utilruntime.Must(routev1.Install(scheme))
 }
 
+// +kubebuilder:rbac:groups=config.openshift.io,resources=ingresses,verbs=get;
+
 func main() {
 	var configMapName string
 	flag.StringVar(&configMapName, "config", "codeflare-operator-config",
@@ -120,6 +119,7 @@ func main() {
 		KubeRay: &config.KubeRayConfiguration{
 			RayDashboardOAuthEnabled: pointer.Bool(true),
 			IngressDomain:            "",
+			MTLSEnabled:              pointer.Bool(true),
 		},
 	}
 
@@ -155,16 +155,13 @@ func main() {
 
 	if OpenShift {
 		if cfg.KubeRay.IngressDomain == "" {
-			routeClient, err := routev1ClientSet.NewForConfig(kubeConfig)
+			configClient, err := clientset.NewForConfig(kubeConfig)
 			exitOnError(err, "unable to create Route Client Set")
-			domain, err = getOpenShiftDomainName(ctx, routeClient)
-			exitOnError(err, domain)
-		} else {
-			domain = cfg.KubeRay.IngressDomain
+			cfg.KubeRay.IngressDomain, err = getClusterDomain(ctx, configClient)
+			exitOnError(err, cfg.KubeRay.IngressDomain)
 		}
-
 		// TODO: setup the RayCluster webhook on vanilla Kubernetes
-		exitOnError(controllers.SetupRayClusterWebhookWithManager(mgr, cfg.KubeRay, domain), "error setting up RayCluster webhook")
+		exitOnError(controllers.SetupRayClusterWebhookWithManager(mgr, cfg.KubeRay), "error setting up RayCluster webhook")
 	}
 
 	ok, err := hasAPIResourceForGVK(kubeClient.DiscoveryClient, rayv1.GroupVersion.WithKind("RayCluster"))
@@ -288,12 +285,16 @@ func isOpenShift(ctx context.Context, dc discovery.DiscoveryInterface) bool {
 	return false
 }
 
-func getOpenShiftDomainName(ctx context.Context, routeClient routev1ClientSet.Interface) (string, error) {
-	route, err := routeClient.RouteV1().Routes(NamespaceConsoleLink).Get(ctx, NameConsoleLink, metav1.GetOptions{})
+func getClusterDomain(ctx context.Context, configClient *clientset.Clientset) (string, error) {
+	ingress, err := configClient.ConfigV1().Ingresses().Get(ctx, "cluster", metav1.GetOptions{})
 	if err != nil {
-		return "error getting console route URL", err
+		return "", fmt.Errorf("failed to get Ingress object: %v", err)
 	}
-	domainIndex := strings.Index(route.Spec.Host, ".")
-	consoleLinkDomain := route.Spec.Host[domainIndex+1:]
-	return consoleLinkDomain, nil
+
+	domain := ingress.Spec.Domain
+	if domain == "" {
+		return "", fmt.Errorf("domain is not set in the Ingress object")
+	}
+
+	return domain, nil
 }

pkg/config/config.go

@@ -35,6 +35,8 @@ type KubeRayConfiguration struct {
 	RayDashboardOAuthEnabled *bool `json:"rayDashboardOAuthEnabled,omitempty"`
 
 	IngressDomain string `json:"ingressDomain"`
+
+	MTLSEnabled *bool `json:"mTLSEnabled,omitempty"`
 }
 
 type ControllerManager struct {

pkg/controllers/raycluster_webhook.go

@@ -32,13 +32,9 @@ import (
 )
 
 // log is for logging in this package.
-var (
-	rayclusterlog        = logf.Log.WithName("raycluster-resource")
-	baseDomain    string = ""
-)
+var rayclusterlog = logf.Log.WithName("raycluster-resource")
 
-func SetupRayClusterWebhookWithManager(mgr ctrl.Manager, cfg *config.KubeRayConfiguration, domain string) error {
-	baseDomain = domain
+func SetupRayClusterWebhookWithManager(mgr ctrl.Manager, cfg *config.KubeRayConfiguration) error {
 	return ctrl.NewWebhookManagedBy(mgr).
 		For(&rayv1.RayCluster{}).
 		WithDefaulter(&rayClusterDefaulter{
@@ -80,19 +76,25 @@ func (r *rayClusterDefaulter) Default(ctx context.Context, obj runtime.Object) e
 		}
 	}
 
-	if !pointer.BoolDeref(r.Config.RayDashboardOAuthEnabled, true) {
-		// Still need to call init container patch even if oauth is disabled
-		mtlsPatch(raycluster, initHeadExists, initWorkerExists)
-		return nil
-	}
-
 	// Check and add OAuth proxy if it does not exist
 	for _, container := range raycluster.Spec.HeadGroupSpec.Template.Spec.Containers {
 		if container.Name == "oauth-proxy" {
 			rayclusterlog.V(2).Info("OAuth sidecar already exists, no patch needed")
 			oauthExists = true
 		}
 	}
+
+	if pointer.BoolDeref(r.Config.RayDashboardOAuthEnabled, true) {
+		oauthPatch(raycluster, oauthExists)
+	}
+	if pointer.BoolDeref(r.Config.MTLSEnabled, true) {
+		r.mTLSPatch(raycluster, initHeadExists, initWorkerExists)
+	}
+
+	return nil
+}
+
+func oauthPatch(raycluster *rayv1.RayCluster, oauthExists bool) {
 	if !oauthExists {
 		rayclusterlog.V(2).Info("Adding OAuth sidecar container")
 		// definition of the new container
@@ -157,13 +159,9 @@ func (r *rayClusterDefaulter) Default(ctx context.Context, obj runtime.Object) e
 			raycluster.Spec.HeadGroupSpec.Template.Spec.ServiceAccountName = raycluster.Name + "-oauth-proxy"
 		}
 	}
-
-	mtlsPatch(raycluster, initHeadExists, initWorkerExists)
-	return nil
 }
 
-func mtlsPatch(raycluster *rayv1.RayCluster, initHeadExists bool, initWorkerExists bool) {
-
+func (r *rayClusterDefaulter) mTLSPatch(raycluster *rayv1.RayCluster, initHeadExists bool, initWorkerExists bool) {
 	rayclusterlog.V(2).Info("creating json patch for RayCluster initContainers")
 
 	// Volume Mounts for the Init Containers
@@ -232,7 +230,7 @@ func mtlsPatch(raycluster *rayv1.RayCluster, initHeadExists bool, initWorkerExis
 	}
 
 	if !initHeadExists {
-		rayClientRoute := "rayclient-" + raycluster.Name + "-" + raycluster.Namespace + "." + baseDomain
+		rayClientRoute := "rayclient-" + raycluster.Name + "-" + raycluster.Namespace + "." + r.Config.IngressDomain
 		initContainerHead := corev1.Container{
 			Name:  "create-cert",
 			Image: "quay.io/project-codeflare/ray:latest-py39-cu118",