add samples for RayCluster token auth

[andrewsykim]

Why are these changes needed?

Add token auth examples that will be referenced in docs

Related issue number

#4203

Checks

• I've made sure the tests are passing.
• Testing Strategy
  • Unit tests
  • Manual tests
  • This PR is not tested :(

[andrewsykim]

In the docs we will show how to enable this for KubeRay versions < 1.5.1, hence the manual version

[Future-Outlier]

thank you, appreciated it

[andrewsykim]

@Future-Outlier PTAL

[Future-Outlier]

for the file ray-operator/config/samples/ray-cluster.auth.yaml
do you mind change the yaml file to the below?

for 2 reasons:

1. currently image: rayproject/ray:nightly doesn't include auth token's commit, but image: rayproject/ray:nightly-py311-cpu does
2. lesser resources in the request field, this is more easier for most users to run it

apiVersion: ray.io/v1
kind: RayCluster
metadata:
  name: ray-cluster-with-auth
spec:
  enableInTreeAutoscaling: true
  authOptions:
    mode: token
  rayVersion: '2.52.0'
  headGroupSpec:
    rayStartParams: {}
    template:
      spec:
        containers:
        - name: ray-head
          image: rayproject/ray:nightly-py311-cpu
          resources:
            limits:
              memory: 8G
            requests:
              cpu: 2
              memory: 4G
          ports:
          - containerPort: 6379
            name: gcs-server
          - containerPort: 8265
            name: dashboard
          - containerPort: 10001
            name: client
  workerGroupSpecs:
  - replicas: 1
    minReplicas: 1
    maxReplicas: 5
    groupName: workergroup
    rayStartParams: {}
    template:
      spec:
        containers:
        - name: ray-worker
          image: rayproject/ray:nightly-py311-cpu
          resources:
            limits:
              memory: 8G
            requests:
              cpu: 2
              memory: 4G

[Future-Outlier]

for manual-auth, I prefer this example for several reasons:

1. lesser resources
2. a worked image rayproject/ray:nightly-py311-cpu
3. comments to help user create their own secret, and reference the secret
4. add authOptions in the spec

apiVersion: ray.io/v1
kind: RayCluster
metadata:
  name: ray-cluster-with-manual-auth
spec:
  enableInTreeAutoscaling: true
  authOptions:
      mode: token
  rayVersion: '2.52.0'
  headGroupSpec:
    rayStartParams: {}
    template:
      spec:
        containers:
        - name: ray-head
          image: rayproject/ray:nightly-py311-cpu
          env:
          - name: RAY_AUTH_MODE
            value: token
          - name: RAY_AUTH_TOKEN
            # You can create the secret manually with the following command:
            # kubectl create secret generic ray-cluster-with-manual-auth --from-literal=auth_token='raycluster_secret' -n default
            # And then use the following valueFrom to reference the secret:
            valueFrom:
              secretKeyRef:
                key: auth_token # change this to match your Secret key
                name: ray-cluster-with-manual-auth # change this to match your Secret name
          resources:
            limits:
              memory: 8G
            requests:
              cpu: 2
              memory: 4G
          ports:
          - containerPort: 6379
            name: gcs-server
          - containerPort: 8265
            name: dashboard
          - containerPort: 10001
            name: client
  workerGroupSpecs:
  - replicas: 1
    minReplicas: 1
    maxReplicas: 5
    groupName: workergroup
    rayStartParams: {}
    template:
      spec:
        containers:
        - name: ray-worker
          image: rayproject/ray:nightly-py311-cpu
          env:
          - name: RAY_AUTH_MODE
            value: token
          - name: RAY_AUTH_TOKEN
            valueFrom:
              secretKeyRef:
                key: auth_token
                name: ray-cluster-with-manual-auth # change this to match your Secret name
          resources:
            limits:
              memory: 8G
            requests:
              cpu: 2
              memory: 4G

2025-11-18.17-16-00.mp4

[andrewsykim]

I noticed rayproject/ray:nightly doesn't work for me as well but I thought it was a caching issue on my side. Why is rayproject/ray:nightly missing the latest commits but rayproject/ray:nightly-py311-cpu has it? Is it a bug in the release pipeline?