Skip to content

Conversation

@seanlaii
Copy link
Contributor

@seanlaii seanlaii commented Nov 24, 2025

Why are these changes needed?

This PR adds comprehensive E2E tests for Ray authentication token mode to ensure correct auth token propagation across three RayJob submission modes:

  • RayJob K8s Job Mode: Verifies auth token in head, worker, and submitter Job pods
  • RayJob HTTP Mode: Verifies auth token in head and worker pods (operator uses HTTP client with token)
  • RayJob Sidecar Mode: Verifies auth token in head Ray container, submitter sidecar, and worker pods

Related issue number

Part of #4203

Checks

  • I've made sure the tests are passing.
  • Testing Strategy
    • Unit tests
    • Manual tests
    • This PR is not tested :(

Signed-off-by: seanlaii <qazwsx0939059006@gmail.com>
@seanlaii seanlaii marked this pull request as ready for review November 25, 2025 01:29
@seanlaii
Copy link
Contributor Author

Hi @Future-Outlier @rueian , please help review the PR when you have the chance. Thank you!

VerifyContainerAuthTokenEnvVars(test, rayCluster, &workerPod, utils.RayContainerIndex)
}

// TODO(andrewsykim): add job submission test with and without token once a Ray version with token support is released.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we open a issue to track this? I think we can find someone to pick it up.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure, I can also create a PR to add it. The supported Ray version has been released. I will create another PR to address this. WDYT?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure, thanks you!

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

+1

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Separate PR is fine. We can also probably just remove this given the submission is also exercised with RayJob

VerifyContainerAuthTokenEnvVars(test, rayCluster, &workerPod, utils.RayContainerIndex)
}

// TODO(andrewsykim): add job submission test with and without token once a Ray version with token support is released.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

+1

Copy link
Contributor

@400Ping 400Ping left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Besides needing to fix the CI, overall LGTM.

VerifyContainerAuthTokenEnvVars(test, rayCluster, &workerPod, utils.RayContainerIndex)
}

// TODO(andrewsykim): add job submission test with and without token once a Ray version with token support is released.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Separate PR is fine. We can also probably just remove this given the submission is also exercised with RayJob

t.T().Helper()
g := NewWithT(t.T())

g.Expect(len(pod.Spec.Containers)).To(BeNumerically(">", containerIndex),
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we can remove this assertion and thecontainerIndex parameter, and instead just pass in corev1.Container.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure, thanks for the review! Updated the tests accordingly.

@seanlaii
Copy link
Contributor Author

Besides needing to fix the CI, overall LGTM.

Thanks, fixed the issue.

Copy link
Member

@andrewsykim andrewsykim left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks!

@andrewsykim andrewsykim merged commit 3b42d56 into ray-project:master Nov 26, 2025
27 checks passed
@seanlaii seanlaii deleted the rayjob-auth-e2e branch November 26, 2025 19:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants