Add hyperpod-ray-endpoint-operator to HyperPod Helm chart

[jchatter321]

Summary

Adds the hyperpod-ray-endpoint-operator as a sub-chart to the HyperPodHelmChart. The chart can be installed with the following command -

helm install hyperpod-ray-endpoint-operator \
  ./helm_chart/HyperPodHelmChart/charts/hyperpod-ray-endpoint-operator \
  --create-namespace \
  --set region=us-west-2 \
  --set domain=<domain> \

To install the chart in a specific namespace -

helm install hyperpod-ray-endpoint-operator \
  ./helm_chart/HyperPodHelmChart/charts/hyperpod-ray-endpoint-operator \
  --namespace my-custom-ns --create-namespace \
  --set region=us-west-2 \
  --set namespace=my-custom-ns \
  --set domain=<domain>

To install with KMS-based JWT signing (instead of K8s Secrets):

helm install hyperpod-ray-endpoint-operator \
  ./helm_chart/HyperPodHelmChart/charts/hyperpod-ray-endpoint-operator \
  --create-namespace \
  --set region=us-west-2 \
  --set domain=<domain> \
  --set kmsKeyArn="arn:aws:kms:us-west-2:123456789012:key/your-key-id"

To install with a custom admin group:

helm install hyperpod-ray-endpoint-operator \
  ./helm_chart/HyperPodHelmChart/charts/hyperpod-ray-endpoint-operator \
  --create-namespace \
  --set region=us-west-2 \
  --set domain=<domain> \
  --set adminGroup=my-admin-group

To install with a custom image override (e.g., for testing with a specific digest):

helm install hyperpod-ray-endpoint-operator \
  ./helm_chart/HyperPodHelmChart/charts/hyperpod-ray-endpoint-operator \
  --create-namespace \
  --set region=us-west-2 \
  --set domain=<domain> \
  --set image.override=123456789012.dkr.ecr.us-west-2.amazonaws.com/hyperpod-ray-endpoint-operator@sha256:<digest>

To install from the parent chart:

helm install hyperpod ./helm_chart/HyperPodHelmChart \
  --namespace aws-hyperpod --create-namespace \
  --set hyperpod-ray-endpoint-operator.enabled=true \
  --set hyperpod-ray-endpoint-operator.region=us-west-2 \
  --set hyperpod-ray-endpoint-operator.domain=<domain>

HyperPod Ray Endpoint Operator — Installation Defaults

Required at install time

Parameter	Description
region	AWS region (required unless image.override is set)
domain	Domain for Ray dashboard URLs (e.g., spaces.example.com)

Namespace

Setting	Default
namespace	hyperpod-ray

Image

Setting	Default
Image name	hyperpod-ray-endpoint-operator (hardcoded)
Image tag	1.0.173.0_1.0.18.0
Registry	Resolved from region → ECR account map (19 regions)
image.override	"" (off) — when set, bypasses all resolution

JWT signing

Setting	Default	Behavior
kmsKeyArn	"" (empty)	K8s Secret — when set, switches to AWS KMS HMAC

Controller Manager

Setting	Default
manager.enabled	true
manager.replicas	1
manager.image.pullPolicy	IfNotPresent
manager.resources.limits	500m CPU, 128Mi memory
manager.resources.requests	10m CPU, 64Mi memory
manager.nodeSelector	amd64, sagemaker.amazonaws.com/compute-type: hyperpod
manager.terminationGracePeriodSeconds	10
Leader election	On (--leader-elect)
Extension API	On (--enable-extension-api)

Auth Middleware

Setting	Default
authMiddleware.enabled	true
authMiddleware.replicas	2
authMiddleware.image.pullPolicy	IfNotPresent
authMiddleware.resources.limits	200m CPU, 256Mi memory
authMiddleware.resources.requests	100m CPU, 128Mi memory
authMiddleware.env.sessionTTL	6h
authMiddleware.env.cookieSecure	true
authMiddleware.env.cookieSameSite	lax
authMiddleware.nodeSelector	amd64, sagemaker.amazonaws.com/compute-type: hyperpod
authMiddleware.terminationGracePeriodSeconds	30

Access Control

Setting	Default
adminGroup	system:masters

Metrics & Monitoring

Setting	Default
metrics.enable	true
metrics.port	8443
metrics.secure	true (HTTPS)
prometheus.enable	false (no ServiceMonitor)

Security (all components)

• runAsNonRoot: true, UID/GID 65532
• readOnlyRootFilesystem: true
• allowPrivilegeEscalation: false
• All capabilities dropped
• Seccomp: RuntimeDefault

Parent chart

Setting	Default
hyperpod-ray-endpoint-operator.enabled	false (must explicitly enable)

Testing

Verified with helm template across multiple regions and override scenarios. Deployed to local cluster against different namespace and ran internal e2e tests to validate functionality.

[psnilesh]

To install from the parent chart:

helm install hyperpod ./helm_chart/HyperPodHelmChart \
  --namespace aws-hyperpod --create-namespace \
  --set hyperpod-ray-endpoint-operator.enabled=true \
  --set hyperpod-ray-endpoint-operator.region=us-west-2 \
  --set hyperpod-ray-endpoint-operator.domain=<domain>

In this case, which namespace is the endpoint operator installed to?

[psnilesh]

We also need to know the version that's being used from the logs. Should we add the helm version (i.e sagemaker-hyperpod-cli repo release version) as an env variable to all operator pods and log it at startup?

[jchatter321]

To install from the parent chart:

helm install hyperpod ./helm_chart/HyperPodHelmChart \
  --namespace aws-hyperpod --create-namespace \
  --set hyperpod-ray-endpoint-operator.enabled=true \
  --set hyperpod-ray-endpoint-operator.region=us-west-2 \
  --set hyperpod-ray-endpoint-operator.domain=<domain>

In this case, which namespace is the endpoint operator installed to?

The operator will be installed in hyperpod-ray.

[jchatter321]

We also need to know the version that's being used from the logs. Should we add the helm version (i.e sagemaker-hyperpod-cli repo release version) as an env variable to all operator pods and log it at startup?

Discussed offline, will address this in another PR.