Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion doc/source/cluster/kubernetes/user-guides/k8s-events.md
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ This guide describes how to enable and use platform events in the Ray Dashboard
## Prerequisites

* **Ray version**: Ray 2.56.0 or later.
* **Kubernetes Python client**: Install the `kubernetes` Python package in the Ray head pod's Python environment. The official `rayproject/ray` images include it. Add it to custom images.
* **Kubernetes Python client**: Install the `kubernetes` Python package (`pip install kubernetes`) in the Ray head pod's Python environment. The official `rayproject/ray` images don't include it.
Comment thread
machichima marked this conversation as resolved.
* **Kubernetes cluster**: A Kubernetes cluster where you can deploy Ray workloads.

## Configure RBAC permissions
Expand Down
19 changes: 11 additions & 8 deletions doc/source/cluster/kubernetes/user-guides/network-policy.md
Original file line number Diff line number Diff line change
Expand Up @@ -202,18 +202,21 @@ For `HTTPMode` and `SidecarMode`, there is no standalone submitter pod, so no ad

When a `RayJob` targets a pre-existing cluster with `clusterSelector`, the cluster has no `RayJob` owner reference. The operator can't automatically add a submitter ingress rule. To allow the submitter pod to reach the head dashboard port, add an opt-in label to both the `RayCluster` ingress rule and the `RayJob` submitter pod template.

On the `RayCluster`, add an ingress rule under `networkIsolation` that matches the opt-in label:
On the `RayCluster`, add an ingress rule under `head.ingressRules` that matches the opt-in label:

```yaml
spec:
networkIsolation:
networkPolicy:
mode: DenyAll
ingressRules:
- from:
- podSelector:
matchLabels:
ray.io/allow-head-access: "true"
ports: [ { protocol: TCP, port: 8265 } ]
head:
ingressRules:
- from:
- podSelector:
matchLabels:
ray.io/allow-head-access: "true"
ports:
- port: 8265
protocol: TCP
```

On the `RayJob`, set the same label on the submitter pod via `submitterPodTemplate`:
Expand Down
Loading