fix: require connected and approved nodes for scheduling

- fixes #3784

pkg/orchestrator/scheduler/batch_service_job.go

@@ -155,14 +155,13 @@ func (b *BatchServiceJobScheduler) createMissingExecs(
 // placeExecs places the executions
 func (b *BatchServiceJobScheduler) placeExecs(ctx context.Context, execs execSet, job *models.Job) error {
 	if len(execs) > 0 {
-		// TODO: Remove the options once we are ready to enforce that only connected/approved nodes can be used
 		selectedNodes, err := b.nodeSelector.TopMatchingNodes(
 			ctx,
 			job,
 			len(execs),
 			&orchestrator.NodeSelectionConstraints{
-				RequireApproval:  false,
-				RequireConnected: false,
+				RequireApproval:  true,
+				RequireConnected: true,
 			},
 		)
 		if err != nil {

pkg/orchestrator/scheduler/daemon_job.go

@@ -86,11 +86,11 @@ func (b *DaemonJobScheduler) createMissingExecs(
 	ctx context.Context, job *models.Job, plan *models.Plan, existingExecs execSet) (execSet, error) {
 	newExecs := execSet{}
 
-	// Require approval when selecting nodes, but do not require them to be connected.
+	// Require nodes to be approved and connected to schedule work.
 	nodes, err := b.nodeSelector.AllMatchingNodes(
 		ctx,
 		job,
-		&orchestrator.NodeSelectionConstraints{RequireApproval: true, RequireConnected: false},
+		&orchestrator.NodeSelectionConstraints{RequireApproval: true, RequireConnected: true},
 	)
 	if err != nil {
 		return newExecs, err

pkg/orchestrator/scheduler/ops_job.go

@@ -107,7 +107,7 @@ func (b *OpsJobScheduler) createMissingExecs(
 		ctx,
 		job, &orchestrator.NodeSelectionConstraints{
 			RequireApproval:  true,
-			RequireConnected: false,
+			RequireConnected: true,
 		})
 	if err != nil {
 		return newExecs, err