Skip to content

Create BrowserStation auth secret in quickstart #4

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mike-vincent wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Create BrowserStation auth secret in quickstart #4

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bb0410d
security: enforce BROWSERSTATION_API_KEY on the gateway (head env fro…
mike-vincent Jul 11, 2026
1870cd8
Create BrowserStation auth secret in quickstart
mike-vincent Jul 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions rayservice.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,11 @@ spec:
env:
- name: RAY_memory_usage_threshold
value: "0.95"
- name: BROWSERSTATION_API_KEY
valueFrom:
secretKeyRef:
name: browserstation-auth
key: BROWSERSTATION_API_KEY
Comment on lines +21 to +25

@gemini-code-assist gemini-code-assist Bot Jul 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

Since the --api-key parameter in quickstart.sh is optional, the browserstation-auth secret will not be created if the user runs the quickstart without providing an API key. This will cause the Ray head pod to fail to start with a CreateContainerConfigError because of the missing secret reference. Marking the secretKeyRef as optional: true allows the pod to start successfully when the secret is not present.

            - name: BROWSERSTATION_API_KEY
              valueFrom:
                secretKeyRef:
                  name: browserstation-auth
                  key: BROWSERSTATION_API_KEY
                  optional: true

ports:
- containerPort: 8050
name: http
Expand Down
7 changes: 7 additions & 0 deletions scripts/quickstart.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,13 @@ helm repo update
helm upgrade --install kuberay-operator kuberay/kuberay-operator \
--namespace ray-system --create-namespace --version 1.3.0 --wait

if [[ $API_KEY ]]; then
kubectl create secret generic browserstation-auth \
--from-literal=BROWSERSTATION_API_KEY="$API_KEY" \
--namespace ray-system \
--dry-run=client -o yaml | kubectl apply -f -
fi

DOCKERFILE=$(
[[ $ARCH == arm64 && -f Dockerfile.arm ]] && echo Dockerfile.arm \
|| echo Dockerfile.$ARCH
Expand Down