[core] Use dedicated service account path for Ray auth tokens

[andrewsykim]

Description

This PR updates the default service account token path for Raylet from /var/run/secrets/kubernetes.io/serviceaccount/token to /var/run/secrets/ray.io/serviceaccount/token. This is to avoid using the same token that would be used for Kubernetes API access.

Raylet pods can be configured with additional audience-specific tokens using a feature called serviceAccountToken projected volumes. E.g.:

spec:
  containers:
  - name: ray-worker
    ...
    volumeMounts:
    - name: token-vol
      mountPath: "/var/run/secrets/ray.io/service-account"
      readOnly: true
  serviceAccountName: default
  volumes:
  - name: token-vol
    projected:
      sources:
      - serviceAccountToken:
          audience: ray.io
          expirationSeconds: 3600
          path: token

Related issues

Link related issues: "Fixes #1234", "Closes #1234", or "Related to #1234".

Additional information

Optional: Add implementation details, API changes, usage examples, screenshots, etc.

[andrewsykim]

@sampan-s-nayak PTAL

[gemini-code-assist]

Code Review

This pull request updates the service account token path to use a dedicated path for Ray, which is a good security practice. The changes correctly replace the old token path constant with a new one across the codebase. My review includes a few suggestions to improve code clarity by renaming variables that now refer to this new Ray-specific token path. Overall, the changes are solid and achieve the intended goal.

[gemini-code-assist]

While this change is correct, the variable name k8s_token_path is now a bit misleading as it points to the Ray-specific service account token path (kRaySaTokenPath) instead of the generic Kubernetes one. For improved code clarity and maintainability, consider renaming this variable to something like ray_sa_token_path and updating its usages within this if block.

[gemini-code-assist]

For better clarity, since we are now reading the Ray-specific service account token, consider renaming the variable k8s_sa_token to ray_sa_token to reflect this change.

Suggested change

	std::string k8s_sa_token = ReadFile(kRaySaTokenPath);
	if (k8s_sa_token.empty()) {
	std::string ray_sa_token = ReadFile(kRaySaTokenPath);
	if (ray_sa_token.empty()) {

[gemini-code-assist]

The static variable k8s_sa_token is now initialized from kRaySaTokenPath, which is the path to a Ray-specific token. To avoid confusion and improve clarity, please consider renaming k8s_sa_token to ray_sa_token and updating its usage within this function.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.