Enable MTLS by default - Webhook

[Bobbins228]

Issue link

RHOAIENG-5086

What changes have been made

Added patch for create-cert Init Containers, env variables, ca volumes, volume mounts
Added validation for created resources

Verification steps

Setup

• Ensure the Codeflare Operator is not installed on your cluster.
• Clone the repo locally and clone this branch
• Run make image-build -e IMG=quay.io/<quay-user>/<repo>:<tag>
• Run make image-push -e IMG=quay.io/<quay-user>/<repo>:<tag>
• Run make deploy IMG=quay.io/<quay-user>/<repo>:<tag> -e ENV="openshift"

Verify

You can create a Ray Cluster that is compatible with these changes (Both Oauth sidecar and mtls stuff) using this SDK PR

Once created:

• Run these in your notebook to prep for testing the new mtls functionality

ray_dashboard_uri = cluster.cluster_dashboard_uri()
ray_cluster_uri = cluster.cluster_uri()
print(ray_dashboard_uri)
print(ray_cluster_uri)

from codeflare_sdk import generate_cert
cluster_name="cluster-name"
namespace="namespace"

generate_cert.generate_tls_cert(cluster_name, namespace)
generate_cert.export_env(cluster_name, namespace)

ray.init() should work with both the cluster_uri and the ray client URL

Checks

• I've made sure the tests are passing.
• Testing Strategy
  • Unit tests
  • Manual tests
  • Testing is not required for this change

[Fiona-Waters]

This is great! I was able to run it successfully - with oauth and create-cert containers being created. I could initialise ray with both the cluster_uri and the ray client URL.
I've left a couple of comments. Thanks Mark!

[VanillaSpoon]

/lgtm

[Fiona-Waters]

Re-verified with updated changes. Works as expected.
/lgtm

[astefanutti]

@Bobbins228 could you give this a final rebase, thanks a lot and sorry for all the iterations on this.

[astefanutti]

/lgtm

[astefanutti]

/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: astefanutti, VanillaSpoon

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [astefanutti]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[astefanutti]

Closing as superseded by #537.