Deploy TPU Webhook to ray-system Namespace and Remove RayCluster Label Selectors

[ryanaoleary]

This PR changes the namespace used to deploy the webhook, service, and certificate to ray-system rather than default, creating the ray-system namespace with kubectl create namespace if it does not already exist. This PR also separates the /validate operations the webhook performs into two configs: validate-pod- and validate-raycluster-. validate-pod- continues to select objects based on the automatically applied app.kubernetes.io/name: kuberay label, while validate-raycluster- now intercepts any RayCluster creation requests to check whether they request TPUs.

In a follow-up PR:
I plan to create a helm-chart for the webhook and have it installed in the same namespace alongside kuberay-operator in modules/kuberay-operator/kuberay.tf. Users will have the option of manually deploying the webhook using the Makefile or creating it through the Terraform in applications/ray when enable_tpu = true.

Related Issues:
#306
#307
#308

Testing Strategy:

• Manual Tests
  • This PR was manually tested by deploying the webhook with the updated configuration, verifying that it successfully runs in ray-system, deploying a multi-host 2x2x2 RayCluster with 2 replicas (causing 4 pods to scale up), and checking that the webhook correctly injected all pod affinities, labels, and env vars using kubectl describe.

[andrewsykim]

@ryanaoleary can we follow some of the guidance around webhooks mentioned here: https://cloud.google.com/kubernetes-engine/docs/how-to/optimize-webhooks

Specifically this section about excluding kube-system and kube-node-lease namespaces.

[ryanaoleary]

@ryanaoleary can we follow some of the guidance around webhooks mentioned here: https://cloud.google.com/kubernetes-engine/docs/how-to/optimize-webhooks

Specifically this section about excluding kube-system and kube-node-lease namespaces.

Done, I changed it to exclude those two namespaces.

[ryanaoleary]

/gcbrun

[andrewsykim]

LGTM

@ryanaoleary since we don't have automated tests, can you document manual steps you took to test this change?

[ryanaoleary]

LGTM

@ryanaoleary since we don't have automated tests, can you document manual steps you took to test this change?

Done.

[andrewsykim]

(the reflection annotations below can be remnoved now)