Kueue operand should use readOnlyRootFilesystem

Author: kannon92

pkg/configmap/configmap.go

@@ -170,10 +170,13 @@ func defaultKueueConfigurationTemplate(kueueCfg kueue.KueueConfiguration) *confi
 		InternalCertManagement: &configapi.InternalCertManagement{
 			Enable: ptr.To(false),
 		},
-		// Disable the HierarchicalCohorts feature gate by default.
-		// related to https://github.com/kubernetes-sigs/kueue/issues/4869
 		FeatureGates: map[string]bool{
+			// Disable the HierarchicalCohorts feature gate by default.
+			// related to https://github.com/kubernetes-sigs/kueue/issues/4869
 			"HierarchialCohorts": false,
+			// Disable visibilityOnDemand
+			// apiserver is insecure.
+			"VisibilityOnDemand": false,
 		},
 		ManageJobsWithoutQueueName: buildManagedJobsWithoutQueueName(kueueCfg.WorkloadManagement),
 		WaitForPodsReady:           buildWaitForPodsReady(kueueCfg.GangScheduling),

pkg/configmap/configmap_test.go

@@ -53,6 +53,7 @@ fairSharing:
   enable: false
 featureGates:
   HierarchialCohorts: false
+  VisibilityOnDemand: false
 health:
   healthProbeBindAddress: :8081
 integrations:
@@ -109,6 +110,7 @@ fairSharing:
   enable: false
 featureGates:
   HierarchialCohorts: false
+  VisibilityOnDemand: false
 health:
   healthProbeBindAddress: :8081
 integrations:
@@ -168,6 +170,7 @@ fairSharing:
   - LessThanInitialShare
 featureGates:
   HierarchialCohorts: false
+  VisibilityOnDemand: false
 health:
   healthProbeBindAddress: :8081
 integrations:
@@ -218,6 +221,7 @@ fairSharing:
   enable: false
 featureGates:
   HierarchialCohorts: false
+  VisibilityOnDemand: false
 health:
   healthProbeBindAddress: :8081
 integrations:
@@ -277,6 +281,7 @@ fairSharing:
   enable: false
 featureGates:
   HierarchialCohorts: false
+  VisibilityOnDemand: false
 health:
   healthProbeBindAddress: :8081
 integrations:

pkg/operator/target_config_reconciler.go

@@ -880,6 +880,10 @@ func (c *TargetConfigReconciler) manageDeployment(kueueoperator *kueuev1alpha1.K
 		required.Spec.Template.Spec.Containers[0].VolumeMounts,
 		metricsCertVolumeMount,
 	)
+
+	// add ReadOnlyRootFilesystem to Kueue deployment.
+	// this will be fixed in upstream as of 0.12.
+	required.Spec.Template.Spec.Containers[0].SecurityContext.ReadOnlyRootFilesystem = ptr.To(true)
 	// Add HA configuration for Kueue deployment.
 	var replicas int32 = 2
 	required.Spec.Replicas = ptr.To(replicas)