Implement webhook validation for the TFJob

Signed-off-by: Yuki Iwai <yuki.iwai.tz@gmail.com>

manifests/base/internalcert/kustomization.yaml

@@ -0,0 +1,2 @@
+resources:
+  - secret.yaml

manifests/base/internalcert/secret.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: training-operator-webhook-server-secret

manifests/base/webhook/manifests.yaml

@@ -24,3 +24,23 @@ webhooks:
     resources:
     - pytorchjobs
   sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: webhook-service
+      namespace: system
+      path: /validate-kubeflow-org-v1-tfjob
+  failurePolicy: Fail
+  name: validator.tfjob.training-operator.kubeflow.org
+  rules:
+  - apiGroups:
+    - kubeflow.org
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - tfjobs
+  sideEffects: None

manifests/base/webhook/patch.yaml

@@ -1,6 +1,9 @@
 - op: replace
   path: /webhooks/0/clientConfig/service/name
   value: training-operator
+- op: replace
+  path: /webhooks/1/clientConfig/service/name
+  value: training-operator
 - op: replace
   path: /metadata/name
   value: validator.training-operator.kubeflow.org

manifests/base/webhook/service.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: webhook-service
+spec:
+  ports:
+    - port: 443
+      protocol: TCP
+      targetPort: 9443

pkg/apis/kubeflow.org/v1/tensorflow_types.go

@@ -122,9 +122,14 @@ const (
 	TFJobReplicaTypeEval ReplicaType = "Evaluator"
 )
 
+// IsChiefOrMaster returns true if the type is Master or Chief.
+func IsChiefOrMaster(typ ReplicaType) bool {
+	return typ == TFJobReplicaTypeChief || typ == TFJobReplicaTypeMaster
+}
+
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 // +resource:path=tfjobs
-//+kubebuilder:object:root=true
+// +kubebuilder:object:root=true
 
 // TFJobList is a list of TFJobs.
 type TFJobList struct {

pkg/apis/kubeflow.org/v1/tensorflow_types_test.go

@@ -0,0 +1,45 @@
+/*
+Copyright 2024 The Kubeflow Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import "testing"
+
+func TestIsChiefOrMaster(t *testing.T) {
+	tc := []struct {
+		Type     ReplicaType
+		Expected bool
+	}{
+		{
+			Type:     TFJobReplicaTypeChief,
+			Expected: true,
+		},
+		{
+			Type:     TFJobReplicaTypeMaster,
+			Expected: true,
+		},
+		{
+			Type:     TFJobReplicaTypeWorker,
+			Expected: false,
+		},
+	}
+	for _, c := range tc {
+		actual := IsChiefOrMaster(c.Type)
+		if actual != c.Expected {
+			t.Errorf("Expected %v; Got %v", c.Expected, actual)
+		}
+	}
+}