From 5a563b88ade79e61a720b397a985d721dc671a85 Mon Sep 17 00:00:00 2001 From: Ryan Date: Sat, 29 Nov 2025 15:15:08 +0800 Subject: [PATCH 01/13] add ray service auth test Signed-off-by: Ryan --- .../e2erayservice/rayservice_auth_test.go | 82 +++++++++++++++++++ 1 file changed, 82 insertions(+) create mode 100644 ray-operator/test/e2erayservice/rayservice_auth_test.go diff --git a/ray-operator/test/e2erayservice/rayservice_auth_test.go b/ray-operator/test/e2erayservice/rayservice_auth_test.go new file mode 100644 index 00000000000..65442f220ba --- /dev/null +++ b/ray-operator/test/e2erayservice/rayservice_auth_test.go @@ -0,0 +1,82 @@ +package e2erayservice + +import ( + "testing" + + . "github.com/onsi/gomega" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + + rayv1 "github.com/ray-project/kuberay/ray-operator/apis/ray/v1" + "github.com/ray-project/kuberay/ray-operator/controllers/ray/utils" + rayv1ac "github.com/ray-project/kuberay/ray-operator/pkg/client/applyconfiguration/ray/v1" + . "github.com/ray-project/kuberay/ray-operator/test/support" +) + +func TestRayServiceAuthToken(t *testing.T) { + test := With(t) + g := NewWithT(t) + + // Create a namespace + namespace := test.NewTestNamespace() + + // Create the RayService for testing with auth token using programmatic configuration + rayServiceName := "rayservice-auth" + rayServiceSpec := RayServiceSampleYamlApplyConfiguration() + rayServiceSpec.RayClusterSpec.WithAuthOptions(rayv1ac.AuthOptions().WithMode(rayv1.AuthModeToken)) + + rayServiceAC := rayv1ac.RayService(rayServiceName, namespace.Name).WithSpec(rayServiceSpec) + + rayService, err := test.Client().Ray().RayV1().RayServices(namespace.Name).Apply(test.Ctx(), rayServiceAC, TestApplyOptions) + g.Expect(err).NotTo(HaveOccurred()) + g.Expect(rayService).NotTo(BeNil()) + LogWithTimestamp(test.T(), "Created RayService %s/%s successfully with AuthModeToken", rayService.Namespace, rayService.Name) + + // Wait for RayService to be ready + LogWithTimestamp(test.T(), "Waiting for RayService %s/%s to be ready", rayService.Namespace, rayService.Name) + g.Eventually(RayService(test, rayService.Namespace, rayService.Name), TestTimeoutMedium). + Should(WithTransform(IsRayServiceReady, BeTrue())) + + // Get the RayService + rayService, err = GetRayService(test, namespace.Name, rayServiceName) + g.Expect(err).NotTo(HaveOccurred()) + LogWithTimestamp(test.T(), "RayService %s/%s is ready", rayService.Namespace, rayService.Name) + + // Get the underlying RayCluster of the RayService + rayClusterName := rayService.Status.ActiveServiceStatus.RayClusterName + g.Expect(rayClusterName).NotTo(BeEmpty(), "RayCluster name should be populated") + LogWithTimestamp(test.T(), "RayService %s/%s has active RayCluster %s", rayService.Namespace, rayService.Name, rayClusterName) + + // Wait for the RayCluster to become ready + LogWithTimestamp(test.T(), "Waiting for RayCluster %s/%s to become ready", namespace.Name, rayClusterName) + g.Eventually(RayCluster(test, namespace.Name, rayClusterName), TestTimeoutMedium). + Should(WithTransform(RayClusterState, Equal(rayv1.Ready))) + + rayCluster, err := GetRayCluster(test, namespace.Name, rayClusterName) + g.Expect(err).NotTo(HaveOccurred()) + + // Verify the head pod has auth token environment variables + headPod, err := GetHeadPod(test, rayCluster) + g.Expect(err).NotTo(HaveOccurred()) + g.Expect(headPod).NotTo(BeNil()) + LogWithTimestamp(test.T(), "Found head pod %s/%s", headPod.Namespace, headPod.Name) + + // Verify Ray container has auth token env vars + VerifyContainerAuthTokenEnvVars(test, rayCluster, &headPod.Spec.Containers[utils.RayContainerIndex]) + LogWithTimestamp(test.T(), "Verified auth token env vars in head pod Ray container") + + // Verify worker pods have auth token env vars + workerPods, err := GetWorkerPods(test, rayCluster) + g.Expect(err).NotTo(HaveOccurred()) + g.Expect(workerPods).ToNot(BeEmpty(), "RayCluster should have at least one worker pod") + LogWithTimestamp(test.T(), "Found %d worker pod(s)", len(workerPods)) + + for _, workerPod := range workerPods { + VerifyContainerAuthTokenEnvVars(test, rayCluster, &workerPod.Spec.Containers[utils.RayContainerIndex]) + LogWithTimestamp(test.T(), "Verified auth token env vars in worker pod %s/%s", workerPod.Namespace, workerPod.Name) + } + + // Clean up the RayService + err = test.Client().Ray().RayV1().RayServices(namespace.Name).Delete(test.Ctx(), rayService.Name, metav1.DeleteOptions{}) + g.Expect(err).NotTo(HaveOccurred()) + LogWithTimestamp(test.T(), "Deleted RayService %s/%s successfully", rayService.Namespace, rayService.Name) +} \ No newline at end of file From 4884683e0e6984b8edd1f92bbca66f969041a148 Mon Sep 17 00:00:00 2001 From: Ryan Date: Sat, 29 Nov 2025 15:34:50 +0800 Subject: [PATCH 02/13] try to fix the error Signed-off-by: Ryan --- ray-operator/test/e2erayservice/rayservice_auth_test.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ray-operator/test/e2erayservice/rayservice_auth_test.go b/ray-operator/test/e2erayservice/rayservice_auth_test.go index 65442f220ba..ec625f26f81 100644 --- a/ray-operator/test/e2erayservice/rayservice_auth_test.go +++ b/ray-operator/test/e2erayservice/rayservice_auth_test.go @@ -79,4 +79,4 @@ func TestRayServiceAuthToken(t *testing.T) { err = test.Client().Ray().RayV1().RayServices(namespace.Name).Delete(test.Ctx(), rayService.Name, metav1.DeleteOptions{}) g.Expect(err).NotTo(HaveOccurred()) LogWithTimestamp(test.T(), "Deleted RayService %s/%s successfully", rayService.Namespace, rayService.Name) -} \ No newline at end of file +} From 7a499585d17a7f34cbbb680fd94731269b3f0f0e Mon Sep 17 00:00:00 2001 From: Ryan Date: Sat, 29 Nov 2025 17:51:16 +0800 Subject: [PATCH 03/13] add worker group Signed-off-by: Ryan --- .../e2erayservice/rayservice_auth_test.go | 28 ++++++++++++++++++- 1 file changed, 27 insertions(+), 1 deletion(-) diff --git a/ray-operator/test/e2erayservice/rayservice_auth_test.go b/ray-operator/test/e2erayservice/rayservice_auth_test.go index ec625f26f81..fc1ab790500 100644 --- a/ray-operator/test/e2erayservice/rayservice_auth_test.go +++ b/ray-operator/test/e2erayservice/rayservice_auth_test.go @@ -4,7 +4,10 @@ import ( "testing" . "github.com/onsi/gomega" + corev1 "k8s.io/api/core/v1" + "k8s.io/apimachinery/pkg/api/resource" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + corev1ac "k8s.io/client-go/applyconfigurations/core/v1" rayv1 "github.com/ray-project/kuberay/ray-operator/apis/ray/v1" "github.com/ray-project/kuberay/ray-operator/controllers/ray/utils" @@ -24,6 +27,29 @@ func TestRayServiceAuthToken(t *testing.T) { rayServiceSpec := RayServiceSampleYamlApplyConfiguration() rayServiceSpec.RayClusterSpec.WithAuthOptions(rayv1ac.AuthOptions().WithMode(rayv1.AuthModeToken)) + // Add a worker group to verify auth token propagation to workers + workerGroupSpec := rayv1ac.WorkerGroupSpec(). + WithGroupName("small-group"). + WithReplicas(1). + WithMinReplicas(1). + WithMaxReplicas(1). + WithRayStartParams(map[string]string{"num-cpus": "1"}). + WithTemplate(corev1ac.PodTemplateSpec(). + WithSpec(corev1ac.PodSpec(). + WithContainers(corev1ac.Container(). + WithName("ray-worker"). + WithImage(GetRayImage()). + WithResources(corev1ac.ResourceRequirements(). + WithRequests(corev1.ResourceList{ + corev1.ResourceCPU: resource.MustParse("1"), + corev1.ResourceMemory: resource.MustParse("1Gi"), + }). + WithLimits(corev1.ResourceList{ + corev1.ResourceCPU: resource.MustParse("1"), + corev1.ResourceMemory: resource.MustParse("2Gi"), + }))))) + rayServiceSpec.RayClusterSpec.WithWorkerGroupSpecs(workerGroupSpec) + rayServiceAC := rayv1ac.RayService(rayServiceName, namespace.Name).WithSpec(rayServiceSpec) rayService, err := test.Client().Ray().RayV1().RayServices(namespace.Name).Apply(test.Ctx(), rayServiceAC, TestApplyOptions) @@ -79,4 +105,4 @@ func TestRayServiceAuthToken(t *testing.T) { err = test.Client().Ray().RayV1().RayServices(namespace.Name).Delete(test.Ctx(), rayService.Name, metav1.DeleteOptions{}) g.Expect(err).NotTo(HaveOccurred()) LogWithTimestamp(test.T(), "Deleted RayService %s/%s successfully", rayService.Namespace, rayService.Name) -} +} \ No newline at end of file From 08d7f08f4a91e4c0c8dfe21b22577aa6f05dbca7 Mon Sep 17 00:00:00 2001 From: Ryan Huang Date: Sat, 29 Nov 2025 18:55:06 +0800 Subject: [PATCH 04/13] Adjust resource requests and limits in tests Signed-off-by: Ryan Huang --- .../test/e2erayservice/rayservice_auth_test.go | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/ray-operator/test/e2erayservice/rayservice_auth_test.go b/ray-operator/test/e2erayservice/rayservice_auth_test.go index fc1ab790500..f57ed5f1bc0 100644 --- a/ray-operator/test/e2erayservice/rayservice_auth_test.go +++ b/ray-operator/test/e2erayservice/rayservice_auth_test.go @@ -41,12 +41,12 @@ func TestRayServiceAuthToken(t *testing.T) { WithImage(GetRayImage()). WithResources(corev1ac.ResourceRequirements(). WithRequests(corev1.ResourceList{ - corev1.ResourceCPU: resource.MustParse("1"), - corev1.ResourceMemory: resource.MustParse("1Gi"), + corev1.ResourceCPU: resource.MustParse("300m"), + corev1.ResourceMemory: resource.MustParse("1G"), }). WithLimits(corev1.ResourceList{ - corev1.ResourceCPU: resource.MustParse("1"), - corev1.ResourceMemory: resource.MustParse("2Gi"), + corev1.ResourceCPU: resource.MustParse("500m"), + corev1.ResourceMemory: resource.MustParse("1G"), }))))) rayServiceSpec.RayClusterSpec.WithWorkerGroupSpecs(workerGroupSpec) @@ -105,4 +105,4 @@ func TestRayServiceAuthToken(t *testing.T) { err = test.Client().Ray().RayV1().RayServices(namespace.Name).Delete(test.Ctx(), rayService.Name, metav1.DeleteOptions{}) g.Expect(err).NotTo(HaveOccurred()) LogWithTimestamp(test.T(), "Deleted RayService %s/%s successfully", rayService.Namespace, rayService.Name) -} \ No newline at end of file +} From f35a3b649685a2900c08888f4290cb5e5aee2ad6 Mon Sep 17 00:00:00 2001 From: Ryan Huang Date: Sat, 29 Nov 2025 19:20:34 +0800 Subject: [PATCH 05/13] Simplify RayService auth test by removing worker group Removed worker group spec and related verification for auth token propagation in RayService tests. Signed-off-by: Ryan Huang --- .../e2erayservice/rayservice_auth_test.go | 42 ------------------- 1 file changed, 42 deletions(-) diff --git a/ray-operator/test/e2erayservice/rayservice_auth_test.go b/ray-operator/test/e2erayservice/rayservice_auth_test.go index f57ed5f1bc0..28ef2e753cb 100644 --- a/ray-operator/test/e2erayservice/rayservice_auth_test.go +++ b/ray-operator/test/e2erayservice/rayservice_auth_test.go @@ -4,10 +4,7 @@ import ( "testing" . "github.com/onsi/gomega" - corev1 "k8s.io/api/core/v1" - "k8s.io/apimachinery/pkg/api/resource" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - corev1ac "k8s.io/client-go/applyconfigurations/core/v1" rayv1 "github.com/ray-project/kuberay/ray-operator/apis/ray/v1" "github.com/ray-project/kuberay/ray-operator/controllers/ray/utils" @@ -27,29 +24,6 @@ func TestRayServiceAuthToken(t *testing.T) { rayServiceSpec := RayServiceSampleYamlApplyConfiguration() rayServiceSpec.RayClusterSpec.WithAuthOptions(rayv1ac.AuthOptions().WithMode(rayv1.AuthModeToken)) - // Add a worker group to verify auth token propagation to workers - workerGroupSpec := rayv1ac.WorkerGroupSpec(). - WithGroupName("small-group"). - WithReplicas(1). - WithMinReplicas(1). - WithMaxReplicas(1). - WithRayStartParams(map[string]string{"num-cpus": "1"}). - WithTemplate(corev1ac.PodTemplateSpec(). - WithSpec(corev1ac.PodSpec(). - WithContainers(corev1ac.Container(). - WithName("ray-worker"). - WithImage(GetRayImage()). - WithResources(corev1ac.ResourceRequirements(). - WithRequests(corev1.ResourceList{ - corev1.ResourceCPU: resource.MustParse("300m"), - corev1.ResourceMemory: resource.MustParse("1G"), - }). - WithLimits(corev1.ResourceList{ - corev1.ResourceCPU: resource.MustParse("500m"), - corev1.ResourceMemory: resource.MustParse("1G"), - }))))) - rayServiceSpec.RayClusterSpec.WithWorkerGroupSpecs(workerGroupSpec) - rayServiceAC := rayv1ac.RayService(rayServiceName, namespace.Name).WithSpec(rayServiceSpec) rayService, err := test.Client().Ray().RayV1().RayServices(namespace.Name).Apply(test.Ctx(), rayServiceAC, TestApplyOptions) @@ -72,11 +46,6 @@ func TestRayServiceAuthToken(t *testing.T) { g.Expect(rayClusterName).NotTo(BeEmpty(), "RayCluster name should be populated") LogWithTimestamp(test.T(), "RayService %s/%s has active RayCluster %s", rayService.Namespace, rayService.Name, rayClusterName) - // Wait for the RayCluster to become ready - LogWithTimestamp(test.T(), "Waiting for RayCluster %s/%s to become ready", namespace.Name, rayClusterName) - g.Eventually(RayCluster(test, namespace.Name, rayClusterName), TestTimeoutMedium). - Should(WithTransform(RayClusterState, Equal(rayv1.Ready))) - rayCluster, err := GetRayCluster(test, namespace.Name, rayClusterName) g.Expect(err).NotTo(HaveOccurred()) @@ -90,17 +59,6 @@ func TestRayServiceAuthToken(t *testing.T) { VerifyContainerAuthTokenEnvVars(test, rayCluster, &headPod.Spec.Containers[utils.RayContainerIndex]) LogWithTimestamp(test.T(), "Verified auth token env vars in head pod Ray container") - // Verify worker pods have auth token env vars - workerPods, err := GetWorkerPods(test, rayCluster) - g.Expect(err).NotTo(HaveOccurred()) - g.Expect(workerPods).ToNot(BeEmpty(), "RayCluster should have at least one worker pod") - LogWithTimestamp(test.T(), "Found %d worker pod(s)", len(workerPods)) - - for _, workerPod := range workerPods { - VerifyContainerAuthTokenEnvVars(test, rayCluster, &workerPod.Spec.Containers[utils.RayContainerIndex]) - LogWithTimestamp(test.T(), "Verified auth token env vars in worker pod %s/%s", workerPod.Namespace, workerPod.Name) - } - // Clean up the RayService err = test.Client().Ray().RayV1().RayServices(namespace.Name).Delete(test.Ctx(), rayService.Name, metav1.DeleteOptions{}) g.Expect(err).NotTo(HaveOccurred()) From 6060d520b404f0d239f4ddc5722bf20c8b5fc764 Mon Sep 17 00:00:00 2001 From: Ryan Huang Date: Sun, 30 Nov 2025 08:47:52 +0800 Subject: [PATCH 06/13] Update rayservice_auth_test.go Signed-off-by: Ryan Huang --- .../e2erayservice/rayservice_auth_test.go | 45 +++++++++++++------ 1 file changed, 31 insertions(+), 14 deletions(-) diff --git a/ray-operator/test/e2erayservice/rayservice_auth_test.go b/ray-operator/test/e2erayservice/rayservice_auth_test.go index 28ef2e753cb..12510cdb290 100644 --- a/ray-operator/test/e2erayservice/rayservice_auth_test.go +++ b/ray-operator/test/e2erayservice/rayservice_auth_test.go @@ -4,10 +4,10 @@ import ( "testing" . "github.com/onsi/gomega" + corev1 "k8s.io/api/core/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" rayv1 "github.com/ray-project/kuberay/ray-operator/apis/ray/v1" - "github.com/ray-project/kuberay/ray-operator/controllers/ray/utils" rayv1ac "github.com/ray-project/kuberay/ray-operator/pkg/client/applyconfiguration/ray/v1" . "github.com/ray-project/kuberay/ray-operator/test/support" ) @@ -19,48 +19,65 @@ func TestRayServiceAuthToken(t *testing.T) { // Create a namespace namespace := test.NewTestNamespace() - // Create the RayService for testing with auth token using programmatic configuration + // Configuration: Define RayService with AuthModeToken rayServiceName := "rayservice-auth" rayServiceSpec := RayServiceSampleYamlApplyConfiguration() rayServiceSpec.RayClusterSpec.WithAuthOptions(rayv1ac.AuthOptions().WithMode(rayv1.AuthModeToken)) rayServiceAC := rayv1ac.RayService(rayServiceName, namespace.Name).WithSpec(rayServiceSpec) + // 1. Apply the RayService rayService, err := test.Client().Ray().RayV1().RayServices(namespace.Name).Apply(test.Ctx(), rayServiceAC, TestApplyOptions) g.Expect(err).NotTo(HaveOccurred()) g.Expect(rayService).NotTo(BeNil()) LogWithTimestamp(test.T(), "Created RayService %s/%s successfully with AuthModeToken", rayService.Namespace, rayService.Name) - // Wait for RayService to be ready + // 2. CRITICAL: Defer cleanup so it runs even if assertions below fail + defer func() { + err := test.Client().Ray().RayV1().RayServices(namespace.Name).Delete(test.Ctx(), rayService.Name, metav1.DeleteOptions{}) + if err != nil { + LogWithTimestamp(test.T(), "WARNING: Failed to delete RayService %s: %v", rayService.Name, err) + } else { + LogWithTimestamp(test.T(), "Deleted RayService %s/%s successfully", rayService.Namespace, rayService.Name) + } + }() + + // 3. Wait for RayService to be ready LogWithTimestamp(test.T(), "Waiting for RayService %s/%s to be ready", rayService.Namespace, rayService.Name) g.Eventually(RayService(test, rayService.Namespace, rayService.Name), TestTimeoutMedium). Should(WithTransform(IsRayServiceReady, BeTrue())) - // Get the RayService + // 4. Refresh the RayService object rayService, err = GetRayService(test, namespace.Name, rayServiceName) g.Expect(err).NotTo(HaveOccurred()) LogWithTimestamp(test.T(), "RayService %s/%s is ready", rayService.Namespace, rayService.Name) - // Get the underlying RayCluster of the RayService + // 5. Get the underlying RayCluster rayClusterName := rayService.Status.ActiveServiceStatus.RayClusterName - g.Expect(rayClusterName).NotTo(BeEmpty(), "RayCluster name should be populated") + g.Expect(rayClusterName).NotTo(BeEmpty(), "RayCluster name should be populated in status") LogWithTimestamp(test.T(), "RayService %s/%s has active RayCluster %s", rayService.Namespace, rayService.Name, rayClusterName) rayCluster, err := GetRayCluster(test, namespace.Name, rayClusterName) g.Expect(err).NotTo(HaveOccurred()) - // Verify the head pod has auth token environment variables + // 6. Get the Head Pod headPod, err := GetHeadPod(test, rayCluster) g.Expect(err).NotTo(HaveOccurred()) g.Expect(headPod).NotTo(BeNil()) LogWithTimestamp(test.T(), "Found head pod %s/%s", headPod.Namespace, headPod.Name) - // Verify Ray container has auth token env vars - VerifyContainerAuthTokenEnvVars(test, rayCluster, &headPod.Spec.Containers[utils.RayContainerIndex]) - LogWithTimestamp(test.T(), "Verified auth token env vars in head pod Ray container") + // 7. Safer Container Lookup: Find "ray-head" specifically rather than assuming index 0 + var rayContainer *corev1.Container + for i := range headPod.Spec.Containers { + // "ray-head" is the standard name for the head container in KubeRay + if headPod.Spec.Containers[i].Name == "ray-head" { + rayContainer = &headPod.Spec.Containers[i] + break + } + } + g.Expect(rayContainer).NotTo(BeNil(), "Could not find 'ray-head' container in Head Pod") - // Clean up the RayService - err = test.Client().Ray().RayV1().RayServices(namespace.Name).Delete(test.Ctx(), rayService.Name, metav1.DeleteOptions{}) - g.Expect(err).NotTo(HaveOccurred()) - LogWithTimestamp(test.T(), "Deleted RayService %s/%s successfully", rayService.Namespace, rayService.Name) + // 8. Verify Authentication Environment Variables + VerifyContainerAuthTokenEnvVars(test, rayCluster, rayContainer) + LogWithTimestamp(test.T(), "Verified auth token env vars in head pod Ray container") } From 757634b8e8f744b06631972971d5481022ff35c9 Mon Sep 17 00:00:00 2001 From: Ryan Huang Date: Sun, 30 Nov 2025 08:49:06 +0800 Subject: [PATCH 07/13] Refactor TestRayServiceAuthToken for clarity Refactor test for RayService authentication to improve clarity and maintainability. Signed-off-by: Ryan Huang --- .../test/e2erayservice/rayservice_auth_test.go | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/ray-operator/test/e2erayservice/rayservice_auth_test.go b/ray-operator/test/e2erayservice/rayservice_auth_test.go index 12510cdb290..218207a1292 100644 --- a/ray-operator/test/e2erayservice/rayservice_auth_test.go +++ b/ray-operator/test/e2erayservice/rayservice_auth_test.go @@ -16,23 +16,19 @@ func TestRayServiceAuthToken(t *testing.T) { test := With(t) g := NewWithT(t) - // Create a namespace namespace := test.NewTestNamespace() - // Configuration: Define RayService with AuthModeToken rayServiceName := "rayservice-auth" rayServiceSpec := RayServiceSampleYamlApplyConfiguration() rayServiceSpec.RayClusterSpec.WithAuthOptions(rayv1ac.AuthOptions().WithMode(rayv1.AuthModeToken)) rayServiceAC := rayv1ac.RayService(rayServiceName, namespace.Name).WithSpec(rayServiceSpec) - // 1. Apply the RayService rayService, err := test.Client().Ray().RayV1().RayServices(namespace.Name).Apply(test.Ctx(), rayServiceAC, TestApplyOptions) g.Expect(err).NotTo(HaveOccurred()) g.Expect(rayService).NotTo(BeNil()) LogWithTimestamp(test.T(), "Created RayService %s/%s successfully with AuthModeToken", rayService.Namespace, rayService.Name) - // 2. CRITICAL: Defer cleanup so it runs even if assertions below fail defer func() { err := test.Client().Ray().RayV1().RayServices(namespace.Name).Delete(test.Ctx(), rayService.Name, metav1.DeleteOptions{}) if err != nil { @@ -42,17 +38,14 @@ func TestRayServiceAuthToken(t *testing.T) { } }() - // 3. Wait for RayService to be ready LogWithTimestamp(test.T(), "Waiting for RayService %s/%s to be ready", rayService.Namespace, rayService.Name) g.Eventually(RayService(test, rayService.Namespace, rayService.Name), TestTimeoutMedium). Should(WithTransform(IsRayServiceReady, BeTrue())) - // 4. Refresh the RayService object rayService, err = GetRayService(test, namespace.Name, rayServiceName) g.Expect(err).NotTo(HaveOccurred()) LogWithTimestamp(test.T(), "RayService %s/%s is ready", rayService.Namespace, rayService.Name) - // 5. Get the underlying RayCluster rayClusterName := rayService.Status.ActiveServiceStatus.RayClusterName g.Expect(rayClusterName).NotTo(BeEmpty(), "RayCluster name should be populated in status") LogWithTimestamp(test.T(), "RayService %s/%s has active RayCluster %s", rayService.Namespace, rayService.Name, rayClusterName) @@ -60,16 +53,13 @@ func TestRayServiceAuthToken(t *testing.T) { rayCluster, err := GetRayCluster(test, namespace.Name, rayClusterName) g.Expect(err).NotTo(HaveOccurred()) - // 6. Get the Head Pod headPod, err := GetHeadPod(test, rayCluster) g.Expect(err).NotTo(HaveOccurred()) g.Expect(headPod).NotTo(BeNil()) LogWithTimestamp(test.T(), "Found head pod %s/%s", headPod.Namespace, headPod.Name) - // 7. Safer Container Lookup: Find "ray-head" specifically rather than assuming index 0 var rayContainer *corev1.Container for i := range headPod.Spec.Containers { - // "ray-head" is the standard name for the head container in KubeRay if headPod.Spec.Containers[i].Name == "ray-head" { rayContainer = &headPod.Spec.Containers[i] break From ea3b1cf48ad93a43856029ece26fb426ae8f13ac Mon Sep 17 00:00:00 2001 From: Ryan Huang Date: Sun, 7 Dec 2025 10:19:07 +0800 Subject: [PATCH 08/13] Update ray-operator/test/e2erayservice/rayservice_auth_test.go Co-authored-by: Han-Ju Chen (Future-Outlier) Signed-off-by: Ryan Huang --- ray-operator/test/e2erayservice/rayservice_auth_test.go | 1 - 1 file changed, 1 deletion(-) diff --git a/ray-operator/test/e2erayservice/rayservice_auth_test.go b/ray-operator/test/e2erayservice/rayservice_auth_test.go index 218207a1292..3834bcd033f 100644 --- a/ray-operator/test/e2erayservice/rayservice_auth_test.go +++ b/ray-operator/test/e2erayservice/rayservice_auth_test.go @@ -67,7 +67,6 @@ func TestRayServiceAuthToken(t *testing.T) { } g.Expect(rayContainer).NotTo(BeNil(), "Could not find 'ray-head' container in Head Pod") - // 8. Verify Authentication Environment Variables VerifyContainerAuthTokenEnvVars(test, rayCluster, rayContainer) LogWithTimestamp(test.T(), "Verified auth token env vars in head pod Ray container") } From f85180bbf0d1fe99d904e6866f2361c0119959dd Mon Sep 17 00:00:00 2001 From: Ryan Huang Date: Mon, 8 Dec 2025 01:51:01 +0800 Subject: [PATCH 09/13] Update ray-operator/test/e2erayservice/rayservice_auth_test.go Co-authored-by: Jun-Hao Wan Signed-off-by: Ryan Huang --- .../test/e2erayservice/rayservice_auth_test.go | 13 +++---------- 1 file changed, 3 insertions(+), 10 deletions(-) diff --git a/ray-operator/test/e2erayservice/rayservice_auth_test.go b/ray-operator/test/e2erayservice/rayservice_auth_test.go index 3834bcd033f..c9e06106ce6 100644 --- a/ray-operator/test/e2erayservice/rayservice_auth_test.go +++ b/ray-operator/test/e2erayservice/rayservice_auth_test.go @@ -58,15 +58,8 @@ func TestRayServiceAuthToken(t *testing.T) { g.Expect(headPod).NotTo(BeNil()) LogWithTimestamp(test.T(), "Found head pod %s/%s", headPod.Namespace, headPod.Name) - var rayContainer *corev1.Container - for i := range headPod.Spec.Containers { - if headPod.Spec.Containers[i].Name == "ray-head" { - rayContainer = &headPod.Spec.Containers[i] - break - } - } - g.Expect(rayContainer).NotTo(BeNil(), "Could not find 'ray-head' container in Head Pod") + // Verify Ray container has auth token env vars + VerifyContainerAuthTokenEnvVars(test, rayCluster, &headPod.Spec.Containers[utils.RayContainerIndex]) - VerifyContainerAuthTokenEnvVars(test, rayCluster, rayContainer) - LogWithTimestamp(test.T(), "Verified auth token env vars in head pod Ray container") + LogWithTimestamp(test.T(), "RayService %s/%s completed successfully with auth token", rayService.Namespace, rayService.Name) } From 58f1493b646373aa4fb5e18412d0b84eaa72403e Mon Sep 17 00:00:00 2001 From: ryankert01 Date: Mon, 8 Dec 2025 02:15:17 +0800 Subject: [PATCH 10/13] address comments Signed-off-by: ryankert01 --- ray-operator/test/e2erayservice/rayservice_auth_test.go | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ray-operator/test/e2erayservice/rayservice_auth_test.go b/ray-operator/test/e2erayservice/rayservice_auth_test.go index c9e06106ce6..6b51ae01981 100644 --- a/ray-operator/test/e2erayservice/rayservice_auth_test.go +++ b/ray-operator/test/e2erayservice/rayservice_auth_test.go @@ -4,12 +4,13 @@ import ( "testing" . "github.com/onsi/gomega" - corev1 "k8s.io/api/core/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" rayv1 "github.com/ray-project/kuberay/ray-operator/apis/ray/v1" rayv1ac "github.com/ray-project/kuberay/ray-operator/pkg/client/applyconfiguration/ray/v1" . "github.com/ray-project/kuberay/ray-operator/test/support" + + "github.com/ray-project/kuberay/ray-operator/controllers/ray/utils" ) func TestRayServiceAuthToken(t *testing.T) { @@ -60,6 +61,8 @@ func TestRayServiceAuthToken(t *testing.T) { // Verify Ray container has auth token env vars VerifyContainerAuthTokenEnvVars(test, rayCluster, &headPod.Spec.Containers[utils.RayContainerIndex]) + g.Expect(rayService.Status.NumServeEndpoints).To(BeNumerically(">", 0), + "RayService should have at least one serve endpoint") LogWithTimestamp(test.T(), "RayService %s/%s completed successfully with auth token", rayService.Namespace, rayService.Name) } From 5625613d961283ff44c500fe8e1933901f5be971 Mon Sep 17 00:00:00 2001 From: ryankert01 Date: Mon, 8 Dec 2025 02:57:32 +0800 Subject: [PATCH 11/13] pre-commit check Signed-off-by: ryankert01 --- ray-operator/test/e2erayservice/rayservice_auth_test.go | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/ray-operator/test/e2erayservice/rayservice_auth_test.go b/ray-operator/test/e2erayservice/rayservice_auth_test.go index 6b51ae01981..2fdd8e75a58 100644 --- a/ray-operator/test/e2erayservice/rayservice_auth_test.go +++ b/ray-operator/test/e2erayservice/rayservice_auth_test.go @@ -7,10 +7,9 @@ import ( metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" rayv1 "github.com/ray-project/kuberay/ray-operator/apis/ray/v1" + "github.com/ray-project/kuberay/ray-operator/controllers/ray/utils" rayv1ac "github.com/ray-project/kuberay/ray-operator/pkg/client/applyconfiguration/ray/v1" . "github.com/ray-project/kuberay/ray-operator/test/support" - - "github.com/ray-project/kuberay/ray-operator/controllers/ray/utils" ) func TestRayServiceAuthToken(t *testing.T) { From b680b99772c7bda4e8b5cc682711ecd47408a299 Mon Sep 17 00:00:00 2001 From: Future-Outlier Date: Mon, 8 Dec 2025 11:23:16 +0800 Subject: [PATCH 12/13] update test Signed-off-by: Future-Outlier --- ray-operator/test/e2erayservice/rayservice_auth_test.go | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/ray-operator/test/e2erayservice/rayservice_auth_test.go b/ray-operator/test/e2erayservice/rayservice_auth_test.go index 2fdd8e75a58..044648cadec 100644 --- a/ray-operator/test/e2erayservice/rayservice_auth_test.go +++ b/ray-operator/test/e2erayservice/rayservice_auth_test.go @@ -60,6 +60,14 @@ func TestRayServiceAuthToken(t *testing.T) { // Verify Ray container has auth token env vars VerifyContainerAuthTokenEnvVars(test, rayCluster, &headPod.Spec.Containers[utils.RayContainerIndex]) + + workerPods, err := GetWorkerPods(test, rayCluster) + g.Expect(err).NotTo(HaveOccurred()) + g.Expect(workerPods).ToNot(BeEmpty()) + for _, workerPod := range workerPods { + VerifyContainerAuthTokenEnvVars(test, rayCluster, &workerPod.Spec.Containers[utils.RayContainerIndex]) + } + g.Expect(rayService.Status.NumServeEndpoints).To(BeNumerically(">", 0), "RayService should have at least one serve endpoint") From 7f4d08532b4b40c9299052a0320bf3e2b4a68eba Mon Sep 17 00:00:00 2001 From: Future-Outlier Date: Mon, 8 Dec 2025 18:53:19 +0800 Subject: [PATCH 13/13] revert my update Signed-off-by: Future-Outlier --- ray-operator/test/e2erayservice/rayservice_auth_test.go | 7 ------- 1 file changed, 7 deletions(-) diff --git a/ray-operator/test/e2erayservice/rayservice_auth_test.go b/ray-operator/test/e2erayservice/rayservice_auth_test.go index 044648cadec..022a407e87e 100644 --- a/ray-operator/test/e2erayservice/rayservice_auth_test.go +++ b/ray-operator/test/e2erayservice/rayservice_auth_test.go @@ -61,13 +61,6 @@ func TestRayServiceAuthToken(t *testing.T) { // Verify Ray container has auth token env vars VerifyContainerAuthTokenEnvVars(test, rayCluster, &headPod.Spec.Containers[utils.RayContainerIndex]) - workerPods, err := GetWorkerPods(test, rayCluster) - g.Expect(err).NotTo(HaveOccurred()) - g.Expect(workerPods).ToNot(BeEmpty()) - for _, workerPod := range workerPods { - VerifyContainerAuthTokenEnvVars(test, rayCluster, &workerPod.Spec.Containers[utils.RayContainerIndex]) - } - g.Expect(rayService.Status.NumServeEndpoints).To(BeNumerically(">", 0), "RayService should have at least one serve endpoint")