#6767 Add queue dockerfile Pull request opened by WangWang0226 ## Tracking issue Related to #6703 --- ## Why are the changes needed? The Queue service previously lacked containerization and Kubernetes deployment manifests, preventing it from running inside a cluster and from performing end-to-end integration tests alongside other Flyte components. This PR introduces a Dockerfile and K8s deployment configuration so that: • The Queue service can be built into a reproducible OCI image • The service runs inside its own Namespace • RBAC permissions for manipulating

TaskAction

CRs are explicitly defined • Other components (e.g., Runs) can access Queue through a stable ClusterIP Service These additions make it possible to validate the Queue service in a real Kubernetes environment. --- ## What changes were proposed in this pull request? (Updated) ### 1. Dockerfile for Queue service • Multi-stage build (Go builder → minimal Alpine runtime) •

CGO_ENABLED=0

static binary for lightweight deployment • Bundled default

config.yaml

• Container health check exposed at

/healthz

### 2. Kubernetes deployment manifests (Kustomize-based)

queue/config/
  ├── default/        (Kustomization root)
  ├── manager/        (Deployment + Service)
  └── rbac/           (SA + Role + RoleBinding)

• Namespace is defined at deployment time (

flyte

) • RBAC is namespace-scoped and grants minimal permissions to operate

TaskAction

CRs • Deployment specifies readiness & liveness probes • ClusterIP Service exposes port 8089 (`http://queue:8089`) ### 3. End-to-end validation Verified locally using kind: • Image builds successfully • Deployment becomes Ready • Probes function correctly • Queue can create/delete

TaskAction

CRs via Kubernetes API --- ## How was this patch tested? (Updated) ### ✅ A. Local kind Cluster (Health + Routing Verification) #### 1. Build the Docker image docker build -t flyte-queue:latest -f queue/Dockerfile . #### 2. Create a kind cluster kind create cluster --name flyte-dev kubectl cluster-info --context kind-flyte-dev #### 3. Install Executor CRDs (required for TaskAction recognition) kubectl apply -f executor/config/crd/bases kubectl get crd taskactions.flyte.org #### 4. Load the image into kind kind load docker-image flyte-queue:latest --name flyte-dev #### 5. Deploy Queue using Kustomize kubectl create namespace flyte kubectl apply -k queue/config/default

queue/config/default/kustomization.yaml aggregates resources from rbac/ and manager/ and applies them into the flyte namespace.

--- ### 6. Verification kubectl get pods -n flyte kubectl logs deploy/queue -n flyte -f kubectl get svc queue -n flyte kubectl port-forward svc/queue -n flyte 8089:8089 curl -f http://localhost:8089/healthz --- ### ✅ B. Functional Verification (Creating/Deleting TaskAction CR) Keep the port-forward active, then run: go run queue/testclient/main.go This demonstrates: • Queue can create and delete

TaskAction

CRs • RBAC rules allow the required operations • The Kubernetes API interaction logic is functioning correctly You may also observe CR lifecycle changes: kubectl get taskactions -n flyte -w kubectl describe taskaction <name> -n flyte --- ### Cleanup kubectl delete -k queue/config/default kind delete cluster --name flyte-dev --- ## Notes / Compatibility • Requires Executor CRDs (

executor/config/crd/bases

); without these,

TaskAction

cannot be created. • RBAC is namespace-scoped; cluster-wide operation would require a ClusterRole/ClusterRoleBinding. • In-cluster service discovery: •

<http://queue:8089>

• or full DNS:

queue.flyte.svc.cluster.local:8089

--- ## Labels • added: Dockerfile for Queue service • added: K8s manifests (Namespace, SA, RBAC, Deployment, Service) • added: End-to-end validation for Queue → TaskAction CR • changed: Queue can now run inside Kubernetes and be consumed by other services --- ## Docs link N/A (deployment and testing documentation can be added to README in a future PR) --- flyteorg/flyte