Create RayCluster ValidatingWebhook

Author: ChristianZaccaria

PROJECT

@@ -19,5 +19,6 @@ resources:
   version: v1
   webhooks:
     defaulting: true
+    validating: true # or might be validation: true
     webhookVersion: v1
 version: "3"

config/default/kustomization.yaml

@@ -25,4 +25,5 @@ resources:
 
 patches:
 - path: manager_webhook_patch.yaml
-- path: webhookcainjection_patch.yaml
+- path: webhookcainjection_mpatch.yaml
+- path: webhookcainjection_vpatch.yaml

config/default/webhookcainjection_patch.yaml renamed to config/default/webhookcainjection_mpatch.yaml

@@ -11,5 +11,5 @@ metadata:
     app.kubernetes.io/managed-by: kustomize
   name: mutating-webhook-configuration
   annotations:
-     service.beta.openshift.io/inject-cabundle: "true"
-     service.beta.openshift.io/serving-cert-secret-name: codeflare-operator-raycluster-webhook-cert
+    service.beta.openshift.io/inject-cabundle: "true"
+    service.beta.openshift.io/serving-cert-secret-name: codeflare-operator-raycluster-webhook-cert

config/default/webhookcainjection_vpatch.yaml

@@ -0,0 +1,15 @@
+# This patch add annotation to admission webhook config
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  labels:
+    app.kubernetes.io/name: validatingwebhookconfiguration
+    app.kubernetes.io/instance: validating-webhook-configuration
+    app.kubernetes.io/component: webhook
+    app.kubernetes.io/created-by: codeflare-operator
+    app.kubernetes.io/part-of: codeflare-operator
+    app.kubernetes.io/managed-by: kustomize
+  name: validating-webhook-configuration
+  annotations:
+    service.beta.openshift.io/inject-cabundle: "true"
+    service.beta.openshift.io/serving-cert-secret-name: codeflare-operator-raycluster-webhook-cert

config/webhook/manifests.yaml

@@ -25,3 +25,30 @@ webhooks:
     resources:
     - rayclusters
   sideEffects: None
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  creationTimestamp: null
+  name: validating-webhook-configuration
+webhooks:
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: webhook-service
+      namespace: system
+      path: /validate-ray-io-v1-raycluster
+  failurePolicy: Fail
+  name: vraycluster.kb.io
+  rules:
+  - apiGroups:
+    - ray.io
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - rayclusters
+  sideEffects: None

main.go

@@ -147,8 +147,8 @@ func main() {
 	})
 	exitOnError(err, "unable to start manager")
 
-	rayClusterDefaulter := &controllers.RayClusterDefaulter{}
-	exitOnError(rayClusterDefaulter.SetupWebhookWithManager(mgr), "error setting up webhook")
+	rayClusterWebhook := &controllers.RayClusterWebhook{}
+	exitOnError(rayClusterWebhook.SetupWebhookWithManager(mgr), "error setting up webhook")
 
 	ok, err := HasAPIResourceForGVK(kubeClient.DiscoveryClient, rayv1.GroupVersion.WithKind("RayCluster"))
 	if ok {

pkg/controllers/raycluster_webhook.go

@@ -21,26 +21,33 @@ import (
 	rayv1 "github.com/ray-project/kuberay/ray-operator/apis/ray/v1"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/util/validation/field"
 	ctrl "sigs.k8s.io/controller-runtime"
 	logf "sigs.k8s.io/controller-runtime/pkg/log"
 	"sigs.k8s.io/controller-runtime/pkg/webhook"
+	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
 )
 
 // log is for logging in this package.
 var rayclusterlog = logf.Log.WithName("raycluster-resource")
 
-func (r *RayClusterDefaulter) SetupWebhookWithManager(mgr ctrl.Manager) error {
+type RayClusterWebhook struct{}
+type RayClusterDefaulter struct{}
+type RayClusterValidator struct{}
+
+func (w *RayClusterWebhook) SetupWebhookWithManager(mgr ctrl.Manager) error {
 	return ctrl.NewWebhookManagedBy(mgr).
 		For(&rayv1.RayCluster{}).
-		WithDefaulter(r).
+		WithDefaulter(&RayClusterDefaulter{}).
+		WithValidator(&RayClusterValidator{}).
 		Complete()
 }
 
 //+kubebuilder:webhook:path=/mutate-ray-io-v1-raycluster,mutating=true,failurePolicy=fail,sideEffects=None,groups=ray.io,resources=rayclusters,verbs=create;update,versions=v1,name=mraycluster.kb.io,admissionReviewVersions=v1
-
-type RayClusterDefaulter struct{}
+//+kubebuilder:webhook:path=/validate-ray-io-v1-raycluster,mutating=false,failurePolicy=fail,sideEffects=None,groups=ray.io,resources=rayclusters,verbs=create;update,versions=v1,name=vraycluster.kb.io,admissionReviewVersions=v1
 
 var _ webhook.CustomDefaulter = &RayClusterDefaulter{}
+var _ webhook.CustomValidator = &RayClusterValidator{}
 
 // Default implements webhook.Defaulter so a webhook will be registered for the type
 func (r *RayClusterDefaulter) Default(ctx context.Context, obj runtime.Object) error {
@@ -120,3 +127,32 @@ func (r *RayClusterDefaulter) Default(ctx context.Context, obj runtime.Object) e
 	}
 	return nil
 }
+
+func (v *RayClusterValidator) ValidateCreate(ctx context.Context, obj runtime.Object) (admission.Warnings, error) {
+	raycluster := obj.(*rayv1.RayCluster)
+	var warnings admission.Warnings
+	var allErrors field.ErrorList
+	specPath := field.NewPath("spec")
+
+	if raycluster.Spec.HeadGroupSpec.EnableIngress == nil || *raycluster.Spec.HeadGroupSpec.EnableIngress {
+		rayclusterlog.Info("Creating RayCluster resources with EnableIngress set to true or unspecified is not allowed")
+		allErrors = append(allErrors, field.Invalid(specPath.Child("headGroupSpec").Child("enableIngress"), raycluster.Spec.HeadGroupSpec.EnableIngress, "creating RayCluster resources with EnableIngress set to true or unspecified is not allowed"))
+	}
+
+	return warnings, allErrors.ToAggregate()
+}
+
+func (v *RayClusterValidator) ValidateUpdate(ctx context.Context, oldObj, newObj runtime.Object) (admission.Warnings, error) {
+	newRayCluster := newObj.(*rayv1.RayCluster)
+	if !newRayCluster.DeletionTimestamp.IsZero() {
+		 // Object is being deleted, skip validations
+		return nil, nil
+	}
+	warnings, err := v.ValidateCreate(ctx, newRayCluster)
+	return warnings, err
+}
+
+func (v *RayClusterValidator) ValidateDelete(ctx context.Context, obj runtime.Object) (admission.Warnings, error) {
+	// Optional: Add delete validation logic here
+	return nil, nil
+}