Add authentication to apiserver

[akihikokuroda]

Summary

PR: #189 is a pre-req for this.

Fix #138
This PR enables "Client Credentials Grant" in OAuth2 specification for the apiserver.

Details and comments

Access to the apiserver needs the access token issued by the keycloak.
Here is the example script accessing the apiserver.

#!/bin/bash
API=$1
RESPONSE=$(curl --request POST \
  --url 'http://<LOCAL-IP>:31059/realms/quantumserverless/protocol/openid-connect/token' \
  --header 'content-type: application/x-www-form-urlencoded' \
  --data grant_type=client_credentials \
  --data client_id=rayapiserver \
  --data client_secret=APISERVERSECRET-CHANGEME \
  --data audience=rayapiserver | jq .access_token)
TOKEN=${RESPONSE//'"'/}

curl --request GET -k --proxy http://<LOCAL-IP>:30634/ \
--header "authorization: Bearer $TOKEN" \
--header 'content-type: application/json' \
--url "http://kuberay-apiserver-service:8888/$API"

[akihikokuroda]

My PR in ray-project/kuberay got merged. I can remove the hack when they cut a new release.
Another PR got merged, too. We can remove the (temporary) step from the README.

[psschwei]

Nice work @akihikokuroda

[Tansito]

Sorry that I couldn't have time to review this pull request properly 🙏

My only question for the future would be how we can remove this patch? I assume that is something related with ray like the patch that we have above, doesn't it, @psschwei , @akihikokuroda ?

[psschwei]

That's right. The fix(es) has already been merged upstream, so once there's a new release cut we can bump our deps and drop the patch(es)

[Tansito]

My question was more related to what actions do we need to apply to remove the patch (or not need it)? Like for example with the first one, that we need to open an issue in ray to fix the app.kubernetes.io/component annotation. I assume that the problem in this case is that we can't add as sidecar in the kuberay-api the gatekeeper image? To have it under control and move these things as soon as I can.

[akihikokuroda]

For the sidecar patch, the sidecar setting is already in the values.yaml so when kuberay has a new release and we upgrade, we can just remove the patch script and update the README. For the service, we can just update the README when we get the new kuberay release.