Non-Istio mTLS POC

[kryanbeane]

Why are these changes needed?

Related issue number

Checks

• I've made sure the tests are passing.
• Testing Strategy
  • Unit tests
  • Manual tests
  • This PR is not tested :(

[laurafitzgerald]

Verification Steps

Setup

Run make cert-manager

To ray-operator/config/manager/manager.yaml

• add ,MTLS=true to --feature-gates flag value
• image: quay.io/laurafitzgerald/kuberay:mtls

To ray-operator/config/default/kustomization.yaml

name: kuberay/operator
   newName: quay.io/laurafitzgerald/kuberay
   newTag: mtls

Run make deploy
Run oc apply -f config/samples/ray-cluster.sample.yaml

Verify Configuration

Run oc get certificate

NAME                                 READY   SECRET                                 AGE
ray-head-cert-raycluster-kuberay     True    ray-head-secret-raycluster-kuberay     34m
ray-worker-cert-raycluster-kuberay   True    ray-worker-secret-raycluster-kuberay   34m

Run oc get secret

NAME                                   TYPE                DATA   AGE
ray-head-secret-raycluster-kuberay     kubernetes.io/tls   3      100m
ray-worker-secret-raycluster-kuberay   kubernetes.io/tls   3      100m

Check the ENVS and volumemounts and volumes for the head and worker node
Expected
ENVs

- name: MY_POD_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.podIP
      - name: RAY_USE_TLS
        value: "1"
      - name: RAY_TLS_SERVER_CERT
        value: /home/ray/workspace/tls/server.crt
      - name: RAY_TLS_SERVER_KEY
        value: /home/ray/workspace/tls/server.key
      - name: RAY_TLS_CA_CERT
        value: /home/ray/workspace/tls/ca.crt

Volumes

volumes:
    - name: ca-vol
      secret:
        defaultMode: 420
        secretName: ray-head-secret-raycluster-kuberay

Volume Mounts

volumeMounts:
      - mountPath: /home/ray/workspace/tls
        name: ca-vol