[DO NOT MERGE] Add hyperpod-ray-endpoint-operator to HyperPod Helm chart

helm_chart/HyperPodHelmChart/Chart.yaml

@@ -92,3 +92,7 @@ dependencies:
     version: "0.1.0"
     repository: "file://charts/gpu-operator"
     condition: gpu-operator.enabled
+  - name: hyperpod-ray-endpoint-operator
+    version: "0.1.0"
+    repository: "file://charts/hyperpod-ray-endpoint-operator"
+    condition: hyperpod-ray-endpoint-operator.enabled

helm_chart/HyperPodHelmChart/charts/hyperpod-ray-endpoint-operator/Chart.yaml

@@ -0,0 +1,14 @@
+apiVersion: v2
+name: hyperpod-ray-endpoint-operator
+description: A Helm chart to distribute hyperpod-ray-endpoint-operator
+type: application
+
+version: 0.1.0
+appVersion: "0.1.0"
+
+keywords:
+  - kubernetes
+  - operator
+
+annotations:
+  kubebuilder.io/generated-by: kubebuilder

helm_chart/HyperPodHelmChart/charts/hyperpod-ray-endpoint-operator/crds/hyperpodrayendpointaccessstrategies.access.sagemaker.amazonaws.com.yaml

@@ -0,0 +1,99 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    "helm.sh/resource-policy": keep
+    controller-gen.kubebuilder.io/version: v0.20.1
+  name: hyperpodrayendpointaccessstrategies.access.sagemaker.amazonaws.com
+spec:
+  group: access.sagemaker.amazonaws.com
+  names:
+    kind: HyperpodRayEndpointAccessStrategy
+    listKind: HyperpodRayEndpointAccessStrategyList
+    plural: hyperpodrayendpointaccessstrategies
+    singular: hyperpodrayendpointaccessstrategy
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: HyperpodRayEndpointAccessStrategy defines how dashboard access
+          is configured for RayClusters.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: HyperpodRayEndpointAccessStrategySpec defines the desired
+              state of HyperpodRayEndpointAccessStrategy.
+            properties:
+              accessResourceTemplates:
+                description: AccessResourceTemplates defines Kubernetes resources
+                  to create per RayCluster.
+                items:
+                  description: AccessResourceTemplate defines a templated resource
+                    the controller creates per RayCluster.
+                  properties:
+                    apiVersion:
+                      description: APIVersion of the resource.
+                      type: string
+                    kind:
+                      description: Kind of the resource (e.g., IngressRoute).
+                      type: string
+                    namePrefix:
+                      description: NamePrefix is prepended to the RayCluster name
+                        to form the resource name.
+                      type: string
+                    template:
+                      description: Template is a Go template that renders the resource
+                        spec.
+                      type: string
+                  required:
+                  - apiVersion
+                  - kind
+                  - namePrefix
+                  - template
+                  type: object
+                type: array
+              accessType:
+                description: 'AccessType controls ownership checks: "ownerOnly" or
+                  "public".'
+                enum:
+                - ownerOnly
+                - public
+                type: string
+              bearerAuthURLTemplate:
+                description: |-
+                  BearerAuthURLTemplate is a Go template for generating the dashboard URL.
+                  Available variables: .RayCluster.Name, .RayCluster.Namespace, .RayCluster.EncodedNamespace, .Domain
+                type: string
+              displayName:
+                description: DisplayName is a human-readable name for this strategy.
+                type: string
+            required:
+            - accessType
+            - bearerAuthURLTemplate
+            type: object
+          status:
+            description: HyperpodRayEndpointAccessStrategyStatus defines the observed
+              state.
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}

helm_chart/HyperPodHelmChart/charts/hyperpod-ray-endpoint-operator/templates/NOTES.txt

@@ -0,0 +1,15 @@
+Thank you for installing {{ .Chart.Name }}.
+
+Your release is named {{ .Release.Name }}.
+
+The controller and CRDs have been installed in namespace {{ .Values.namespace }}.
+
+To verify the installation:
+
+  kubectl get pods -n {{ .Values.namespace }}
+  kubectl get customresourcedefinitions
+
+To learn more about the release, try:
+
+  $ helm status {{ .Release.Name }} -n {{ .Values.namespace }}
+  $ helm get all {{ .Release.Name }} -n {{ .Values.namespace }}

helm_chart/HyperPodHelmChart/charts/hyperpod-ray-endpoint-operator/templates/_helpers.tpl

@@ -0,0 +1,120 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "hyperpod-ray-endpoint-operator.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "hyperpod-ray-endpoint-operator.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Namespace for generated references.
+Defaults to "hyperpod-ray" unless overridden via values.
+*/}}
+{{- define "hyperpod-ray-endpoint-operator.namespaceName" -}}
+{{- .Values.namespace | default "hyperpod-ray" }}
+{{- end }}
+
+{{/*
+Resource name with proper truncation for Kubernetes 63-character limit.
+Takes a dict with:
+  - .suffix: Resource name suffix (e.g., "metrics", "webhook")
+  - .context: Template context (root context with .Values, .Release, etc.)
+Dynamically calculates safe truncation to ensure total name length <= 63 chars.
+*/}}
+{{- define "hyperpod-ray-endpoint-operator.resourceName" -}}
+{{- $fullname := include "hyperpod-ray-endpoint-operator.fullname" .context }}
+{{- $suffix := .suffix }}
+{{- $maxLen := sub 62 (len $suffix) | int }}
+{{- if gt (len $fullname) $maxLen }}
+{{- printf "%s-%s" (trunc $maxLen $fullname | trimSuffix "-") $suffix | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" $fullname $suffix | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+
+{{/*
+ServiceAccount name to use.
+If serviceAccount.enable is false and serviceAccount.name is set, use that name.
+Otherwise, use the standard resourceName helper with "controller-manager" suffix.
+*/}}
+{{- define "hyperpod-ray-endpoint-operator.serviceAccountName" -}}
+{{- if and (hasKey .Values.serviceAccount "enable") (not .Values.serviceAccount.enable) .Values.serviceAccount.name }}
+{{- .Values.serviceAccount.name }}
+{{- else }}
+{{- include "hyperpod-ray-endpoint-operator.resourceName" (dict "suffix" "controller-manager" "context" .) }}
+{{- end }}
+{{- end }}
+
+{{/*
+Resolve the container image URI.
+Priority for region:
+  1. .Values.region (explicit setting)
+  2. .Values.global.region (global setting from parent chart)
+  3. fail — region is required
+
+Priority for image URI:
+  1. .Values.image.override (full URI override, skips all resolution)
+  2. Constructed from region→account mapping + repository name + tag
+*/}}
+{{- define "hyperpod-ray-endpoint-operator.imageUri" -}}
+{{- if .Values.image.override -}}
+  {{- .Values.image.override -}}
+{{- else -}}
+{{- $region := "" -}}
+{{- if .Values.region -}}
+  {{- $region = .Values.region -}}
+{{- else if and .Values.global .Values.global.region -}}
+  {{- $region = .Values.global.region -}}
+{{- else -}}
+  {{- fail "region is required when image.override is not set. Set region or global.region." -}}
+{{- end -}}
+
+{{/* Region to ECR account ID mapping */}}
+{{- $regionAccountMap := dict
+  "ca-central-1" "983936648948"
+  "us-east-1" "622623004016"
+  "us-east-2" "084149021266"
+  "us-west-1" "647106553245"
+  "us-west-2" "148286033537"
+  "eu-west-1" "125579686045"
+  "eu-west-2" "391701072240"
+  "eu-central-1" "368999588123"
+  "eu-north-1" "064032700373"
+  "eu-south-2" "984149068489"
+  "ap-northeast-1" "325771561645"
+  "ap-northeast-2" "883353268341"
+  "ap-south-1" "883218392248"
+  "ap-south-2" "392424878547"
+  "ap-southeast-1" "850032337960"
+  "ap-southeast-2" "504110891989"
+  "ap-southeast-3" "772699011045"
+  "ap-southeast-4" "357229908674"
+  "sa-east-1" "126458881049"
+-}}
+
+{{- $accountId := index $regionAccountMap $region -}}
+{{- if not $accountId -}}
+  {{- fail (printf "Unsupported AWS region: %s. Set image.override explicitly for non-standard regions." $region) -}}
+{{- end -}}
+
+{{- $imageTag := .Values.image.tag | default "1.0.188.0_1.0.19.0" -}}
+{{- printf "%s.dkr.ecr.%s.amazonaws.com/hyperpod-ray-endpoint-operator:%s" $accountId $region $imageTag -}}
+{{- end -}}
+{{- end }}

helm_chart/HyperPodHelmChart/charts/hyperpod-ray-endpoint-operator/templates/cert-manager/extension-api-cert.yaml

@@ -0,0 +1,23 @@
+{{- if .Values.certManager.enable }}
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: {{ include "hyperpod-ray-endpoint-operator.resourceName" (dict "suffix" "extension-api-cert" "context" $) }}
+  namespace: {{ .Values.namespace }}
+spec:
+  commonName: extension-api
+  dnsNames:
+  - {{ include "hyperpod-ray-endpoint-operator.resourceName" (dict "suffix" "extension-api" "context" $) }}.{{ .Values.namespace }}.svc
+  - {{ include "hyperpod-ray-endpoint-operator.resourceName" (dict "suffix" "extension-api" "context" $) }}.{{ .Values.namespace }}.svc.cluster.local
+  duration: 2160h
+  issuerRef:
+    kind: Issuer
+    name: {{ include "hyperpod-ray-endpoint-operator.resourceName" (dict "suffix" "selfsigned-issuer" "context" $) }}
+  privateKey:
+    rotationPolicy: Always
+  renewBefore: 360h
+  secretName: extension-api-cert
+  subject:
+    organizations:
+    - hyperpod-ray-endpoint-operator
+{{- end }}

helm_chart/HyperPodHelmChart/charts/hyperpod-ray-endpoint-operator/templates/cert-manager/selfsigned-issuer.yaml

@@ -0,0 +1,14 @@
+{{- if .Values.certManager.enable }}
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  labels:
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/name: {{ include "hyperpod-ray-endpoint-operator.name" . }}
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+  name: {{ include "hyperpod-ray-endpoint-operator.resourceName" (dict "suffix" "selfsigned-issuer" "context" $) }}
+  namespace: {{ .Values.namespace }}
+spec:
+  selfSigned: {}
+{{- end }}

helm_chart/HyperPodHelmChart/charts/hyperpod-ray-endpoint-operator/templates/cert-manager/serving-cert.yaml

@@ -0,0 +1,20 @@
+{{- if .Values.certManager.enable }}
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  labels:
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/name: {{ include "hyperpod-ray-endpoint-operator.name" . }}
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+  name: {{ include "hyperpod-ray-endpoint-operator.resourceName" (dict "suffix" "serving-cert" "context" $) }}
+  namespace: {{ .Values.namespace }}
+spec:
+  dnsNames:
+  - {{ include "hyperpod-ray-endpoint-operator.resourceName" (dict "suffix" "webhook-service" "context" $) }}.{{ .Values.namespace }}.svc
+  - {{ include "hyperpod-ray-endpoint-operator.resourceName" (dict "suffix" "webhook-service" "context" $) }}.{{ .Values.namespace }}.svc.cluster.local
+  issuerRef:
+    kind: Issuer
+    name: {{ include "hyperpod-ray-endpoint-operator.resourceName" (dict "suffix" "selfsigned-issuer" "context" $) }}
+  secretName: webhook-server-cert
+{{- end }}