Add to MutatingWebhook to add SecurityContext to the head and worker containers

Author: ChristianZaccaria

pkg/controllers/raycluster_webhook.go

@@ -124,6 +124,16 @@ func (w *rayClusterWebhook) Default(ctx context.Context, obj runtime.Object) err
 		}
 	}
 
+	// Set the security context for the head container and worker containers
+	for i := range rayCluster.Spec.HeadGroupSpec.Template.Spec.Containers {
+		rayCluster.Spec.HeadGroupSpec.Template.Spec.Containers[i].SecurityContext = securityContext()
+	}
+	for i := range rayCluster.Spec.WorkerGroupSpecs {
+		for j := range rayCluster.Spec.WorkerGroupSpecs[i].Template.Spec.Containers {
+			rayCluster.Spec.WorkerGroupSpecs[i].Template.Spec.Containers[j].SecurityContext = securityContext()
+		}
+	}
+
 	return nil
 }
 

pkg/controllers/raycluster_webhook_test.go

@@ -227,6 +227,22 @@ func TestRayClusterWebhookDefault(t *testing.T) {
 		}
 	})
 
+	t.Run("Expected required SecurityContext for each head group container", func(t *testing.T) {
+		for _, container := range validRayCluster.Spec.HeadGroupSpec.Template.Spec.Containers {
+			test.Expect(container.SecurityContext).To(Equal(securityContext()), 
+				"Expected the required SecurityContext to be present in each head group container")
+		}
+	})
+
+	t.Run("Expected required SecurityContext for each worker group container", func(t *testing.T) {
+		for _, workerGroup := range validRayCluster.Spec.WorkerGroupSpecs {
+			for _, container := range workerGroup.Template.Spec.Containers {
+				test.Expect(container.SecurityContext).To(Equal(securityContext()), 
+					"Expected the required SecurityContext to be present in each worker group container")
+			}
+		}
+	})
+
 }
 
 func TestValidateCreate(t *testing.T) {