Implement webhook validation for the TFJob

Signed-off-by: Yuki Iwai <[email protected]>

manifests/base/webhook/manifests.yaml

@@ -24,3 +24,23 @@ webhooks:
     resources:
     - pytorchjobs
   sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: webhook-service
+      namespace: system
+      path: /validate-kubeflow-org-v1-tfjob
+  failurePolicy: Fail
+  name: validator.tfjob.training-operator.kubeflow.org
+  rules:
+  - apiGroups:
+    - kubeflow.org
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - tfjobs
+  sideEffects: None

manifests/base/webhook/patch.yaml

@@ -1,6 +1,9 @@
 - op: replace
   path: /webhooks/0/clientConfig/service/name
   value: training-operator
+- op: replace
+  path: /webhooks/1/clientConfig/service/name
+  value: training-operator
 - op: replace
   path: /metadata/name
   value: validator.training-operator.kubeflow.org

pkg/apis/kubeflow.org/v1/tensorflow_types.go

@@ -122,9 +122,14 @@ const (
 	TFJobReplicaTypeEval ReplicaType = "Evaluator"
 )
 
+// IsChiefOrMaster returns true if the type is Master or Chief.
+func IsChiefOrMaster(typ ReplicaType) bool {
+	return typ == TFJobReplicaTypeChief || typ == TFJobReplicaTypeMaster
+}
+
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 // +resource:path=tfjobs
-//+kubebuilder:object:root=true
+// +kubebuilder:object:root=true
 
 // TFJobList is a list of TFJobs.
 type TFJobList struct {

pkg/apis/kubeflow.org/v1/tensorflow_types_test.go

@@ -0,0 +1,45 @@
+/*
+Copyright 2024 The Kubeflow Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import "testing"
+
+func TestIsChiefOrMaster(t *testing.T) {
+	tc := []struct {
+		Type     ReplicaType
+		Expected bool
+	}{
+		{
+			Type:     TFJobReplicaTypeChief,
+			Expected: true,
+		},
+		{
+			Type:     TFJobReplicaTypeMaster,
+			Expected: true,
+		},
+		{
+			Type:     TFJobReplicaTypeWorker,
+			Expected: false,
+		},
+	}
+	for _, c := range tc {
+		actual := IsChiefOrMaster(c.Type)
+		if actual != c.Expected {
+			t.Errorf("Expected %v; Got %v", c.Expected, actual)
+		}
+	}
+}

pkg/cert/cert.go

@@ -18,9 +18,10 @@ package cert
 
 import (
 	"fmt"
+	"os"
+
 	cert "github.com/open-policy-agent/cert-controller/pkg/rotator"
 	"k8s.io/apimachinery/pkg/types"
-	"os"
 	ctrl "sigs.k8s.io/controller-runtime"
 )