[Feature] [history server] Support token auth in the history server collector by CheyuWu · Pull Request #5078 · ray-project/kuberay

CheyuWu · 2026-08-04T16:01:06Z

Why are these changes needed?

The collector talks to the Ray Dashboard but has no token support at all, so it breaks on any
RayCluster with spec.authOptions.mode: token

Related issue number

Closes #5056

Labels

If this PR has user-facing changes that require documentation updates at release time, I have added the doc-updates-required label.
If this PR contains breaking changes, I have added the breaking-change label.

Checks

I've made sure the tests are passing.
Testing Strategy
- Unit tests
- Manual tests
- This PR is not tested :(

Manual test instructions

Basic setup

Follow the instruction to setup operator and MinIO
https://github.com/ray-project/kuberay/blob/master/historyserver/DEVELOPMENT.md#step-1-set-up-kind-and-kuberay-operator

Launch collector

make -C historyserver localimage-build
kind load docker-image collector:v0.1.0
kind load docker-image historyserver:v0.1.0

uncomment the block in `historyserver/config/raycluster.yaml`

Spec

  rayVersion: "2.52.0"
  authOptions:
    mode: token

headGroupSpec

          - name: RAY_AUTH_TOKEN
            valueFrom:
              secretKeyRef:
                name: raycluster-historyserver  # defaults to the RayCluster name
                key: auth_token

workerGroupSpecs

          - name: RAY_AUTH_TOKEN
            valueFrom:
              secretKeyRef:
                name: raycluster-historyserver  # defaults to the RayCluster name
                key: auth_token

Apply the yaml file - `historyserver/config/raycluster.yaml`

kubectl apply -f historyserver/config/raycluster.yaml
kubectl wait pod -l ray.io/cluster=raycluster-historyserver --for=condition=Ready=True --timeout=5m

Send the unauth request to ray dashboard -> 401

kubectl exec -it $(kubectl get pod -l ray.io/cluster=raycluster-historyserver,ray.io/node-type=head -o name) \
  -c ray-head -- python3 -c \
  "import urllib.request,urllib.error
try: print(urllib.request.urlopen('http://localhost:8265/api/v0/nodes?limit=1',timeout=10).status)
except urllib.error.HTTPError as e: print(e.code)"

Check the restart count is zero

kubectl get pod -l ray.io/cluster=raycluster-historyserver \
  -o custom-columns='POD:.metadata.name,C:.status.containerStatuses[*].name,RESTARTS:.status.containerStatuses[*].restartCount'

Send the request with auth to ray dashboard -> 200

kubectl exec -it $(kubectl get pod -l ray.io/cluster=raycluster-historyserver,ray.io/node-type=head -o name) \
  -c ray-head -- python3 -c \
  "import os,urllib.request,urllib.error
req=urllib.request.Request('http://localhost:8265/api/v0/nodes?limit=1',
    headers={'x-ray-authorization':'Bearer '+os.environ['RAY_AUTH_TOKEN']})
try: print(urllib.request.urlopen(req,timeout=10).status)
except urllib.error.HTTPError as e: print(e.code)"

port forward minio and check the log exists

kubectl -n minio-dev port-forward svc/minio-service 9001:9001 9000:9000

Go to http://localhost:9001/browser and login with minioadmin / minioadmin

kubernetes auth for history server raycluster

Apply the yaml

kubectl apply -f historyserver/config/raycluster-kubernetes-auth.yaml
kubectl wait pod -l ray.io/cluster=raycluster-historyserver-kubernetes-auth \
  --for=condition=Ready=True --timeout=5m

Check the status code

kubectl exec -it $(kubectl get pod -l ray.io/cluster=raycluster-historyserver-kubernetes-auth,ray.io/node-type=head -o name) \
  -c ray-head -- python3 -c \
  "import urllib.request,urllib.error
try: print('unauth:', urllib.request.urlopen('http://localhost:8265/api/v0/nodes?limit=1',timeout=10).status)
except urllib.error.HTTPError as e: print('unauth:', e.code)
tok=open('/var/run/secrets/ray.io/serviceaccount/token').read().strip()
req=urllib.request.Request('http://localhost:8265/api/v0/nodes?limit=1',headers={'x-ray-authorization':'Bearer '+tok})
try: print('auth  :', urllib.request.urlopen(req,timeout=10).status)
except urllib.error.HTTPError as e: print('auth  :', e.code)"

verify the status

# Check the restart count is zero
kubectl get pod -l ray.io/cluster=raycluster-historyserver-kubernetes-auth \
  -o custom-columns='POD:.metadata.name,C:.status.containerStatuses[*].name,RESTARTS:.status.containerStatuses[*].restartCount'

# The collector authenticates successfully and stores data
kubectl logs $(kubectl get pod -l ray.io/cluster=raycluster-historyserver-kubernetes-auth,ray.io/node-type=head -o name) \
  -c collector | grep -iE "successfully stored|collector config"

Minio log

Apply the yaml with historyServerOptions -> `ray-operator/config/samples/ray-cluster.historyserver.yaml`

Uncomment the ray token portion

  rayVersion: '2.56.0'
  authOptions:
    mode: 'token'
    enableK8sTokenAuth: true

Change the env settings to

        - name: STORAGE_BACKEND
          value: "s3"
        - name: S3_BUCKET
          value: "ray-historyserver"
        - name: S3_ENDPOINT
          value: "minio-service.minio-dev:9000"
        - name: S3_REGION
          value: "test"
        - name: S3FORCE_PATH_STYLE
          value: "true"
        - name: S3DISABLE_SSL
          value: "true"
        - name: AWS_ACCESS_KEY_ID
          value: minioadmin
        - name: AWS_SECRET_ACCESS_KEY
          value: minioadmin
        - name: AWS_SESSION_TOKEN
          value: ""
        - name: RAY_ROOT_DIR
          value: "log"

Uncomment the serviceAccountName in headGroupSpec and workerGroupSpecs

serviceAccountName: raycluster-historyserver

Update the ray image version to rayproject/ray:2.56.0 in head and worker

          image: rayproject/ray:2.56.0

Uncomment the serviceAccount portion

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: raycluster-historyserver
---
# With enableK8sTokenAuth, Ray validates incoming tokens by calling TokenReview and
# SubjectAccessReview, so the cluster's ServiceAccount needs permission to create them.
# Without this the head's GCS fails to start with InvalidAuthToken and crash loops.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: raycluster-historyserver-authenticator
rules:
- apiGroups: ["authentication.k8s.io"]
  resources:
  - 'tokenreviews'
  verbs: ["create"]
- apiGroups: ["authorization.k8s.io"]
  resources:
  - 'subjectaccessreviews'
  verbs: ["create"]
---
# Grants the caller ray:write on rayclusters, which is what the Dashboard
# authorizes the presented token against.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: raycluster-historyserver-writer
rules:
- apiGroups: ["ray.io"]
  resources:
  - 'rayclusters'
  verbs: ["ray:write"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: raycluster-historyserver-authenticator
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: raycluster-historyserver-authenticator
subjects:
- kind: ServiceAccount
  name: raycluster-historyserver
  namespace: default
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: raycluster-historyserver-writer
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: raycluster-historyserver-writer
subjects:
- kind: ServiceAccount
  name: raycluster-historyserver
  namespace: default

load the latest image

make -C historyserver localimage-collector COLLECTOR_IMG=quay.io/kuberay/collector:nightly
kind load docker-image quay.io/kuberay/collector:nightly
make -C ray-operator docker-build IMG=kuberay/operator:latest
kind load docker-image kuberay/operator:latest

Enable the feature gate

kubectl -n default patch deploy kuberay-operator --type=json -p='[{
  "op":"replace","path":"/spec/template/spec/containers/0/args","value":[
    "--log-stdout-encoder","json","--log-file-encoder","json",
    "--enable-leader-election=true","--enable-metrics=true",
    "--reconcile-concurrency=1","--qps=100","--burst=200",
    "--feature-gates=RayClusterStatusConditions=true,RayJobDeletionPolicy=true,RayMultiHostIndexing=true,RayServiceIncrementalUpgrade=false,RayCronJob=false,RayClusterMTLS=false,RayClusterNetworkPolicy=false,RayClusterHistoryServer=true"
  ]}]'
kubectl -n default rollout restart deploy/kuberay-operator
kubectl -n default rollout status deploy/kuberay-operator

Apply the yaml

kubectl apply -f ray-operator/config/samples/ray-cluster.historyserver.yaml

Verify the result

kubectl get pods -l ray.io/cluster=raycluster-historyserver

Go to MinIO console

Signed-off-by: Cheyu Wu <cheyu1220@gmail.com>

CheyuWu · 2026-08-04T17:57:47Z

@win5923 @machichima PTAL

machichima · 2026-08-05T08:22:09Z

Could you update the PR description to show:

send unauth request -> getting 401 -> collector not crash
send auth request -> ensure 200

machichima · 2026-08-05T09:14:53Z

Please correct me if I'm wrong, #4520 only supports secret-based token auth and explicitly rejects enableK8sTokenAuth:

kuberay/historyserver/pkg/historyserver/clientmanager.go

Lines 103 to 107 in a6f0035

    
           // Kubernetes-delegated token auth has no static bearer token to inject, so fail explicitly 
        
           // instead of proxying unauthenticated and surfacing a confusing dashboard error. 
        
           if utils.IsK8sAuthEnabled(rayCluster.Spec.AuthOptions) { 
        
           	return "", fmt.Errorf("cannot authenticate proxied requests to RayCluster %s/%s: Kubernetes-delegated token auth (enableK8sTokenAuth) is not supported by the history server", namespace, name) 
        
           }

Should we keep the collector consistent and focus on secret mode here

win5923 · 2026-08-05T09:35:27Z

Please correct me if I'm wrong, #4520 only supports secret-based token auth and explicitly rejects enableK8sTokenAuth:

Yes, but I think the collector should support both auth modes, since users can able to view the collected data for dead clusters.
But I don't have a strong preference here, so I'm also fine with supporting k8s token auth with history server in a follow-up.

machichima · 2026-08-05T11:41:33Z

Yes, but I think the collector should support both auth modes, since users can able to view the collected data for dead clusters. But I don't have a strong preference here, so I'm also fine with supporting k8s token auth with history server in a follow-up.

SG, let's keep it. For history server one we can do in follow-up

Signed-off-by: Cheyu Wu <cheyu1220@gmail.com>

win5923 · 2026-08-06T05:42:48Z

+func testCollectorWithTokenAuth(test Test, g *WithT, namespace *corev1.Namespace, s3Client *s3.S3) {
+	rayCluster := ApplyRayClusterWithCollectorTokenAuth(test, g, namespace)
+
+	// The operator generates the auth Secret; without it the sidecars could not resolve a token.
+	secretName := utils.CheckName(rayCluster.Name)
+	g.Eventually(func(gg Gomega) {
+		secret, err := test.Client().Core().CoreV1().Secrets(namespace.Name).Get(test.Ctx(), secretName, metav1.GetOptions{})
+		gg.Expect(err).NotTo(HaveOccurred())
+		gg.Expect(secret.Data).To(HaveKey(utils.RAY_AUTH_TOKEN_SECRET_KEY))
+		gg.Expect(secret.Data[utils.RAY_AUTH_TOKEN_SECRET_KEY]).NotTo(BeEmpty())
+	}, TestTimeoutShort).Should(Succeed())
+
+	headPod, err := GetHeadPod(test, rayCluster)
+	g.Expect(err).NotTo(HaveOccurred())
+
+	// Guard against a vacuous pass: if the Dashboard served this cluster without credentials the
+	// rest of the assertions would hold even with the fix reverted. Probed with Python because
+	// the Ray images ship no curl.
+	probe := `python3 - <<'PY'
+import urllib.error, urllib.request
+try:
+    urllib.request.urlopen("http://localhost:8265/api/v0/nodes?limit=1", timeout=10)
+    print("200")
+except urllib.error.HTTPError as err:
+    print(err.code)
+PY`
+	unauthenticated, _ := ExecPodCmd(test, headPod, "ray-head", []string{"sh", "-c", probe})
+	g.Expect(strings.TrimSpace(unauthenticated.String())).To(Equal("401"),
+		"Dashboard must reject unauthenticated requests, otherwise this test proves nothing")
+
+	// The crash loop from #5056 took ~60s to surface, so a plain Expect right after startup would
+	// pass even against the broken build. Hold the assertion open instead.
+	LogWithTimestamp(test.T(), "Verifying collector containers do not crash-loop under token auth")
+	g.Consistently(func(gg Gomega) {
+		pod, err := GetHeadPod(test, rayCluster)
+		gg.Expect(err).NotTo(HaveOccurred())
+
+		var found bool
+		for _, status := range pod.Status.ContainerStatuses {
+			if status.Name != "collector" {
+				continue
+			}
+			found = true
+			gg.Expect(status.RestartCount).To(BeZero(), "collector restarted, it is likely failing to authenticate")
+			gg.Expect(status.State.Running).NotTo(BeNil(), "collector is not running")
+		}
+		gg.Expect(found).To(BeTrue(), "collector container status not reported")
+	}, TestTimeoutShort, 5*time.Second).Should(Succeed())
+
+	// Data in storage is the real proof: reaching it requires an authenticated Dashboard call.
+	sessionID := GetSessionIDFromHeadPod(test, g, rayCluster)
+	storageKey := utils.EndpointPathToStorageKey(EndpointTimezone)
+	sessionDir := clusterlogs.SessionDir("log", "", "", rayCluster.Namespace, rayCluster.Name, sessionID)
+	timezoneKey := fmt.Sprintf("%s/%s/%s", sessionDir, utils.RAY_SESSIONDIR_FETCHED_ENDPOINTS_NAME, storageKey)
+
+	LogWithTimestamp(test.T(), "Waiting for authenticated endpoint data at S3 key: %s", timezoneKey)
+	g.Eventually(func(gg Gomega) {
+		result, err := s3Client.GetObject(&s3.GetObjectInput{
+			Bucket: aws.String(S3BucketName),
+			Key:    new(timezoneKey),
+		})
+		gg.Expect(err).NotTo(HaveOccurred())
+		defer result.Body.Close()
+
+		body, err := io.ReadAll(result.Body)
+		gg.Expect(err).NotTo(HaveOccurred())
+		gg.Expect(body).NotTo(BeEmpty())
+
+		var timezone map[string]any
+		gg.Expect(json.Unmarshal(body, &timezone)).To(Succeed())
+		gg.Expect(timezone).To(HaveKey("value"))
+	}, TestTimeoutMedium).Should(Succeed())
+
+	DeleteS3Bucket(test, g, s3Client)
+}


I think we can simplify this test:

ApplyRayClusterWithCollectorTokenAuth already waits for RayCluster Ready, which means the collector must already be up and authenticating.

FetchAndStoreTimezone hits the Dashboard at startup and writes to S3 so the S3 object is the proof that an authenticated Dashboard call succeeded. That's the assertion worth keeping. Let's extract its S3 check into a helper and reuse it here instead of duplicating.

func testCollectorWithTokenAuth(...) { rayCluster := ApplyRayClusterWithCollectorTokenAuth(test, g, namespace) // verify dashboard rejects the unauthenticated requests out, err := ExecPodCmd(test, headPod, "ray-head", []string{"sh", "-c", probe}) g.Expect(err).NotTo(HaveOccurred()) g.Expect(strings.TrimSpace(out.String())).To(Equal("401")) // resue timezone assertion from testCollectorStoresTimezone to test the S3 key assertTimezoneStored(test, g, rayCluster, s3Client) }

Signed-off-by: Cheyu Wu <cheyu1220@gmail.com>

CheyuWu · 2026-08-07T14:25:41Z

Hi @win5923 PTAL
Thanks for the pass on the comments — all applied. Sorry they were so verbose;

Few things beyond the exact suggestions:

Swept raycluster.yaml too — its head/worker comments still had the old
wording, so all four manifests now match.
Used kubernetes-auth rather than your suggested k8s-auth, to match
ray-operator/config/samples/ray-cluster.kubernetes.auth.yaml.
Added the new sample to the config/ table in historyserver/docs/README.md.

By the way, do we need to add e2e test for raycluster-kubernetes-auth.yaml or this can be a follow-up issue?

CheyuWu · 2026-08-07T14:26:28Z

Yes, but I think the collector should support both auth modes, since users can able to view the collected data for dead clusters. But I don't have a strong preference here, so I'm also fine with supporting k8s token auth with history server in a follow-up.

SG, let's keep it. For history server one we can do in follow-up

Sure, I will open the follow-up issue, since this PR has been merged

Signed-off-by: Cheyu Wu <cheyu1220@gmail.com>

CheyuWu · 2026-08-08T08:20:40Z

@win5923 PTAL

win5923 · 2026-08-08T15:02:31Z

By the way, do we need to add e2e test for raycluster-kubernetes-auth.yaml or this can be a follow-up issue?

Can be a follow-up.

win5923 · 2026-08-08T15:25:14Z

Suggested change

proxyReq.Header.Set(utils.RayAuthHeader, fmt.Sprintf("Bearer %s", authToken))

win5923 · 2026-08-08T15:27:45Z

  namespace: default
 spec:
+  # Enable Ray token authentication. Requires Ray 2.52.0+
+  # rayVersion: "2.52.0"


Suggested change

# rayVersion: "2.52.0"

# rayVersion: "2.56.0"

Follow the ray image that we use.

win5923 · 2026-08-08T15:27:58Z

  namespace: default
 spec:
+  # Enable Ray token authentication. Requires Ray 2.52.0+
+  # rayVersion: "2.52.0"


Suggested change

# rayVersion: "2.52.0"

# rayVersion: "2.56.0"

ditto

win5923 · 2026-08-08T15:28:15Z

+        containers:
+        - name: ray-head
+          imagePullPolicy: IfNotPresent
+          image: rayproject/ray:2.55.0


Use ray 2.56.0

win5923 · 2026-08-08T15:29:46Z

            value: "http://localhost:8084/v1/events"
          - name: RAY_DASHBOARD_AGGREGATOR_AGENT_EXPOSABLE_EVENT_TYPES
            value: "ALL"
          image: rayproject/ray:2.55.0


Should change to ray 2.56.0, right?

Sure, we should change to ray 2.56.0

However, there is lots of image with 2.55.0 in the repo. I think we should open an issue to update it or we can address in this pr?

NVM, there’s already a PR that will update the Ray image to 2.56.0 in the sample YAML.
#5111

win5923 · 2026-08-08T15:31:13Z

+		// The collector queries the Ray Dashboard, so it needs the same credentials as the Ray
+		// container.
+		if utils.IsAuthEnabled(&instance.Spec) {
+			SetContainerTokenAuthEnvVars(instance.Name, &collectorContainer, instance.Spec.AuthOptions)
+		}


Have you also tested the RayClusterHistoryServer feature gate with the ray-cluster.historyserver.yaml sample and token auth enabled?

I have tested the ray-cluster.historyserver.yaml and update the description.
To make sure its easier for user to use. I also add the comment in 083e8c4

win5923 · 2026-08-08T15:32:49Z

+		// Worker collectors also reach the Dashboard (via FQ_RAY_IP) to discover their Ray NodeID.
+		if utils.IsAuthEnabled(&instance.Spec) {
+			SetContainerTokenAuthEnvVars(instance.Name, &collectorContainer, instance.Spec.AuthOptions)
+		}


This comment is unrelated to the following.

Signed-off-by: Cheyu Wu <cheyu1220@gmail.com>

cursor

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{Reviewed by Cursor Bugbot for commit 6d71cbb. Configure here.}

Signed-off-by: Cheyu Wu <cheyu1220@gmail.com>

win5923

LGTM, thank you so much for the verify! cc @rueian and @andrewsykim for the final review.

win5923 · 2026-08-09T14:04:45Z

            value: "http://localhost:8084/v1/events"
          - name: RAY_DASHBOARD_AGGREGATOR_AGENT_EXPOSABLE_EVENT_TYPES
            value: "ALL"
          image: rayproject/ray:2.55.0


NVM, there’s already a PR that will update the Ray image to 2.56.0 in the sample YAML.
#5111

win5923 · 2026-08-09T14:14:03Z

+  # set at the same time.
+  # authOptions:
+  #   mode: 'token'
+  #   enableK8sTokenAuth: true


Could you remove the auth config from this YAML? I'd like to keep the file simple.
historyserver/config/raycluster-kubernetes-auth.yaml‎ is enough.

revert in 36269c0

This reverts commit 083e8c4.

CheyuWu added 4 commits August 2, 2026 19:10

feat: add auth env to operator

5e8ff25

Signed-off-by: Cheyu Wu <cheyu1220@gmail.com>

chore: bump ray-operator to v1.6.2

dd4bc4b

Signed-off-by: Cheyu Wu <cheyu1220@gmail.com>

feat: collect support ray auth token

5926232

Signed-off-by: Cheyu Wu <cheyu1220@gmail.com>

test: add e2e test

34c11ba

Signed-off-by: Cheyu Wu <cheyu1220@gmail.com>

CheyuWu requested review from MortalHappiness, andrewsykim, kevin85421 and rueian as code owners August 4, 2026 16:01

CheyuWu force-pushed the feat/i/5056 branch from 899cea1 to 58f0e9a Compare August 4, 2026 16:34

cursor Bot reviewed Aug 4, 2026

View reviewed changes

Comment thread historyserver/config/raycluster.yaml Outdated

chore: update yaml file

4e22807

Signed-off-by: Cheyu Wu <cheyu1220@gmail.com>

CheyuWu force-pushed the feat/i/5056 branch from 58f0e9a to 4e22807 Compare August 4, 2026 16:43

machichima self-assigned this Aug 5, 2026

win5923 reviewed Aug 5, 2026

View reviewed changes

Comment thread historyserver/pkg/utils/constant.go Outdated

Comment thread historyserver/pkg/utils/auth.go

Comment thread historyserver/config/raycluster.yaml Outdated

win5923 reviewed Aug 5, 2026

View reviewed changes

Comment thread historyserver/config/raycluster.yaml Outdated

Comment thread historyserver/pkg/utils/auth.go

CheyuWu added 3 commits August 6, 2026 00:36

Merge remote-tracking branch 'upstream/master' into feat/i/5056

11d57ae

chore: refactor the code and add auth.go unit test

6baf3e6

Signed-off-by: Cheyu Wu <cheyu1220@gmail.com>

feat: add example for k8s auth yaml

3725470

Signed-off-by: Cheyu Wu <cheyu1220@gmail.com>

win5923 reviewed Aug 6, 2026

View reviewed changes

CheyuWu added 4 commits August 7, 2026 20:24

Merge remote-tracking branch 'upstream/master' into feat/i/5056

2d6add6

chore: update yaml file and update readme

aa57c32

Signed-off-by: Cheyu Wu <cheyu1220@gmail.com>

chore: update the auth.go func name

b164f05

Signed-off-by: Cheyu Wu <cheyu1220@gmail.com>

fix: remove duplicate and unused test code

4c0191f

Signed-off-by: Cheyu Wu <cheyu1220@gmail.com>

CheyuWu added 2 commits August 7, 2026 22:42

chore: use enum

4af2e32

Signed-off-by: Cheyu Wu <cheyu1220@gmail.com>

Merge remote-tracking branch 'upstream/master' into feat/i/5056

cee1e00

cursor Bot reviewed Aug 8, 2026

View reviewed changes

Comment thread historyserver/pkg/utils/utils.go Outdated

CheyuWu added 3 commits August 8, 2026 14:03

chore: update kubernetes-auth.yaml

1539672

Signed-off-by: Cheyu Wu <cheyu1220@gmail.com>

fix: Auth config errors still retry

96c8b86

Signed-off-by: Cheyu Wu <cheyu1220@gmail.com>

chore: update env var

701aad2

Signed-off-by: Cheyu Wu <cheyu1220@gmail.com>

win5923 reviewed Aug 8, 2026

View reviewed changes

CheyuWu added 3 commits August 9, 2026 13:50

fix: bad testing type

10112f4

Signed-off-by: Cheyu Wu <cheyu1220@gmail.com>

fix: enum problem and unrelated comment

23f7c34

Signed-off-by: Cheyu Wu <cheyu1220@gmail.com>

fix: wrong ray version

c5a9d0e

Signed-off-by: Cheyu Wu <cheyu1220@gmail.com>

cursor Bot reviewed Aug 9, 2026

View reviewed changes

Comment thread ray-operator/config/samples/ray-cluster.historyserver.yaml Outdated

chore: update the historyServerOptions yaml config

083e8c4

Signed-off-by: Cheyu Wu <cheyu1220@gmail.com>

CheyuWu force-pushed the feat/i/5056 branch from 6d71cbb to 083e8c4 Compare August 9, 2026 08:07

win5923 approved these changes Aug 9, 2026

View reviewed changes

Revert "chore: update the historyServerOptions yaml config"

36269c0

This reverts commit 083e8c4.


	proxyReq.Header.Set(utils.RayAuthHeader, fmt.Sprintf("Bearer %s", authToken))

Uh oh!

Conversation

CheyuWu commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why are these changes needed?

Related issue number

Labels

Checks

Manual test instructions

Basic setup

Launch collector

uncomment the block in historyserver/config/raycluster.yaml

Apply the yaml file - historyserver/config/raycluster.yaml

Send the unauth request to ray dashboard -> 401

Check the restart count is zero

Send the request with auth to ray dashboard -> 200

port forward minio and check the log exists

kubernetes auth for history server raycluster

Minio log

Apply the yaml with historyServerOptions -> ray-operator/config/samples/ray-cluster.historyserver.yaml

Uh oh!

Uh oh!

CheyuWu commented Aug 4, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

machichima commented Aug 5, 2026

Uh oh!

machichima commented Aug 5, 2026

Uh oh!

win5923 commented Aug 5, 2026

Uh oh!

machichima commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

CheyuWu commented Aug 7, 2026

Uh oh!

CheyuWu commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

CheyuWu commented Aug 8, 2026

Uh oh!

win5923 commented Aug 8, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

CheyuWu Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

CheyuWu Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

CheyuWu commented Aug 4, 2026 •

edited

Loading

uncomment the block in `historyserver/config/raycluster.yaml`

Apply the yaml file - `historyserver/config/raycluster.yaml`

Apply the yaml with historyServerOptions -> `ray-operator/config/samples/ray-cluster.historyserver.yaml`

machichima commented Aug 5, 2026 •

edited

Loading

CheyuWu commented Aug 7, 2026 •

edited

Loading

CheyuWu Aug 9, 2026 •

edited

Loading

CheyuWu Aug 9, 2026 •

edited

Loading

win5923 left a comment •

edited

Loading

CheyuWu Aug 9, 2026 •

edited

Loading