CronJob Manifest Validation

CronJob Manifest Structure

CronJobs have a deeply nested structure: CronJob > JobTemplate > Job > PodTemplate > PodSpec > Containers. Issues at any level can cause problems.

Example CronJob

apiVersion: batch/v1
kind: CronJob
metadata:
  name: daily-cleanup
  labels:
    app: maintenance
spec:
  schedule: "0 2 * * *"
  jobTemplate:
    spec:
      template:
        spec:
          containers:
            - name: cleanup
              image: busybox:latest
              command: ["sh", "-c", "echo cleanup done"]
          restartPolicy: OnFailure

What the Validator Flags

• Warning: Container 'cleanup' uses ':latest' tag
• Warning: Container 'cleanup' has no resource requests or limits
• Warning: No securityContext.runAsNonRoot set

CronJob-Specific Considerations

Field	Purpose	Default
spec.schedule	Cron expression	Required
spec.concurrencyPolicy	Allow, Forbid, or Replace	Allow
spec.successfulJobsHistoryLimit	Keep N successful jobs	3
spec.failedJobsHistoryLimit	Keep N failed jobs	1
spec.startingDeadlineSeconds	Max delay before skip	None
spec.suspend	Pause scheduling	false

Best Practices for CronJobs

1. Set restartPolicy to OnFailure or Never (not Always)
2. Pin image versions (no :latest)
3. Set resource limits even for short-lived jobs
4. Configure activeDeadlineSeconds to prevent runaway jobs
5. Use concurrencyPolicy: Forbid if jobs must not overlap
6. Set appropriate history limits to avoid accumulating completed Job objects