Ray Serve 2.58.0

Apply the Python 3 baseline first. Use these rules for Ray Serve 2.58.0 with a maintained CPython version supported by its published wheels (3.10–3.14), and verify the serving and model dependencies on the chosen platform.

Cluster and control-plane trust

• Treat Ray job submission, Ray Client, privileged dashboard APIs, and deployment configuration as cluster code-execution authority. Use separate clusters for mutually untrusted code or administrators; application names and Ray namespaces do not isolate them.
• Keep the dashboard, Jobs API, GCS, Ray Client, metrics, and internal replica ports on isolated networks. The internal Serve ASGIService deserializes Python request metadata; never expose it as an inference endpoint.
• Enable RAY_AUTH_MODE=token before starting every node and authorized client; token authentication is opt-in. Distribute the same protected token to the cluster, preferably through RAY_AUTH_TOKEN_PATH or the default ~/.ray/auth_token file. Check that a stale RAY_AUTH_TOKEN environment variable does not override the intended file.
• Treat the cluster token as a shared administrative credential, never as an inference-user credential. Tokens do not expire, and a running cluster retains its token for its lifetime; rotate by restarting with a new token and updating authorized clients.
• Encrypt cluster communication as well as client ingress. For Ray gRPC TLS, configure RAY_USE_TLS=1, RAY_TLS_SERVER_CERT, RAY_TLS_SERVER_KEY, and RAY_TLS_CA_CERT on participating processes. This does not enable application authentication or automatically