Cron Jobs

This guide covers configuring the pgt-cronjob Helm chart for deploying scheduled jobs to Kubernetes. The chart creates Kubernetes CronJob resources that run containers on a specified schedule.

Prerequisites

Add the chart as a dependency in your Chart.yaml:

apiVersion: v2
name: my-cronjob
version: 0.0.1
dependencies:
  - name: pgt-cronjob
    version: 0.0.3
    repository: oci://public.ecr.aws/w9m9e0e9/pgt-helm-charts

After adding the dependency, run:

helm dependency update

Basic Configuration

Required Fields

pgt-cronjob:
  # [Required] CronJob name - used as base name for all K8s resources
  name: my-cronjob

  # [Required] Organisation name for labeling
  organisationName: my-org

  # [Required] Cron schedule expression
  cronjob:
    schedule: "0 * * * *"  # Every hour

  # [Required] Container image configuration
  container:
    image:
      registry: public.ecr.aws
      repository: my-org/my-job
      tag: "1.0.0"
    resources:
      limits:
        memory: 512Mi
      requests:
        memory: 512Mi  # Should equal limits for Guaranteed QoS
        cpu: 100m

  # [Required] ServiceAccount name
  serviceAccount:
    name: my-cronjob-sa

⚠️ Memory Requests and Limits
Always set memory requests equal to memory limits. This ensures your pod receives a Guaranteed Quality of Service (QoS) class, which provides predictable scheduling and OOM kill priority.

Development Environment & Cost Optimization

When deploying CronJobs to non-production environments, consider these settings to reduce costs:

pgt-cronjob:
  # Schedule jobs during off-peak hours or only on weekdays
  cronjob:
    schedule: "0 2 * * 1-5"  # Weekdays at 2 AM only

  affinity:
    nodeAffinity:
      preferSpotInstances: true  # Prefer running on spot instances

  container:
    resources:
      limits:
        memory: 256Mi  # Right-size for dev workloads
      requests:
        memory: 256Mi
        cpu: 50m

💡 Spot Instances
The preferSpotInstances: true setting prefers scheduling your workloads on spot instances when available, which can significantly reduce compute costs. If you're interested in enabling spot instances for your environment, please reach out to the platform team to discuss your requirements and ensure your applications are suitable for spot instance usage.

💰 Cost-Saving Tips for CronJobs
Schedule during off-peak hours: Run jobs during times when cluster resources are less utilised
Reduce frequency in non-prod: If a job runs hourly in production, consider running it daily in development
Right-size resources: Development jobs often need fewer resources than production
Limit job history: Keep fewer completed jobs with successfulJobsHistoryLimit: 1

🕐 Environment-Specific Schedules
Consider using different schedules per environment:
# values-dev.yaml
pgt-cronjob:
  cronjob:
    schedule: "0 9 * * 1"  # Weekly on Monday at 9 AM

# values-prod.yaml
pgt-cronjob:
  cronjob:
    schedule: "0 * * * *"  # Every hour
This reduces unnecessary job executions in development while maintaining production schedules.

Schedule Configuration

Cron Schedule Syntax

The schedule follows standard cron syntax: minute hour day-of-month month day-of-week

Field

Values

Description

Minute

0-59

Minute of the hour

Hour

0-23

Hour of the day

Day of Month

1-31

Day of the month

Month

1-12

Month of the year

Day of Week

0-6

Day of the week (0 = Sunday)

Common Schedule Examples

pgt-cronjob:
  cronjob:
    # Every 15 minutes
    schedule: "*/15 * * * *"

    # Every hour at minute 0
    schedule: "0 * * * *"

    # Daily at midnight
    schedule: "0 0 * * *"

    # Daily at 2:30 AM
    schedule: "30 2 * * *"

    # Weekly on Sunday at midnight
    schedule: "0 0 * * 0"

    # First day of every month at midnight
    schedule: "0 0 1 * *"

    # Every weekday at 9 AM
    schedule: "0 9 * * 1-5"

💡 Cron Schedule Help
Use crontab.guru to build and validate cron expressions.

CronJob Behaviour

Concurrency Policy

Control how the CronJob handles overlapping executions:

pgt-cronjob:
  cronjob:
    schedule: "*/5 * * * *"
    # Options: Allow, Forbid, Replace
    concurrencyPolicy: Forbid

Policy

Behaviour

Forbid

Skip new job if previous is still running (default)

Allow

Allow concurrent job executions

Replace

Cancel currently running job and start a new one

Job History

Configure how many completed jobs to retain:

pgt-cronjob:
  cronjob:
    successfulJobsHistoryLimit: 3  # Keep last 3 successful jobs
    failedJobsHistoryLimit: 1      # Keep last 1 failed job

Restart Policy

Configure pod restart behaviour on failure:

pgt-cronjob:
  cronjob:
    # Options: OnFailure, Never
    restartPolicy: OnFailure

Policy

Behaviour

OnFailure

Restart the container if it exits with a non-zero code (default)

Never

Never restart; create a new pod if the job needs to retry

Container Configuration

Command and Arguments

Override the container's default entrypoint and arguments:

pgt-cronjob:
  container:
    image:
      registry: public.ecr.aws
      repository: my-org/my-job
      tag: "1.0.0"
    # Override entrypoint
    command: ["/bin/sh", "-c"]
    # Arguments passed to command
    args: ["./run-job.sh", "--verbose", "--env=production"]

Image Pull Policy

pgt-cronjob:
  container:
    imagePullPolicy: IfNotPresent  # IfNotPresent | Always | Never

Environment Variables

Direct Environment Variables

pgt-cronjob:
  environmentVariables:
    - name: LOG_LEVEL
      value: info
    - name: DATABASE_URL
      valueFrom:
        secretKeyRef:
          name: db-secret
          key: url
    - name: CONFIG_VALUE
      valueFrom:
        configMapKeyRef:
          name: app-config
          key: some-value

Load from ConfigMap or Secret

pgt-cronjob:
  environmentVariablesFrom:
    - configMapRef:
        name: job-config
    - secretRef:
        name: job-secrets

External Secrets

The pgt-cronjob chart includes pgt-secrets as a subchart for fetching secrets from AWS Secrets Manager or Azure Key Vault. For full configuration options, see the PGT Secrets documentation.

pgt-cronjob:
  # Use the same ServiceAccount for the CronJob and secrets
  serviceAccount:
    name: my-cronjob-sa
    annotations:
      eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/my-cronjob-role

  pgt-secrets:
    enabled: true
    organisationName: my-org
    serviceAccount:
      create: false  # Use the ServiceAccount defined above
      name: my-cronjob-sa
    aws:
      enabled: true
      secretRegion: eu-west-1
    items:
      - secretStoreName: cronjob-store
        kubernetesSecretName: cronjob-secrets
        data:
          - secretKey: database-url
            remoteRef:
              key: prod/cronjob/database
              property: url

Volume Mounts

Mount ConfigMaps or Secrets as files:

pgt-cronjob:
  volumes:
    - kubernetesSecretName: tls-certs
      mountPath: /etc/ssl/certs
      readOnly: true
    - kubernetesConfigMapName: job-config
      mountPath: /etc/config
      readOnly: true

ServiceAccount

Configure a ServiceAccount to allow your CronJob to access cloud resources securely:

pgt-cronjob:
  serviceAccount:
    name: my-cronjob-sa
    annotations:
      # Add cloud-specific annotations - see guides below

For detailed instructions on creating IAM roles and managed identities, see:

AWS IAM Roles (IRSA) - Configure IAM roles for EKS workloads
Azure Workload Identity - Configure managed identities for AKS workloads

Pod Configuration

Labels and Annotations

pgt-cronjob:
  pod:
    metadata:
      labels:
        app: my-cronjob
        environment: production
      annotations:
        logs.example.io/enabled: "true"

Tolerations

For scheduling on specific nodes (e.g., Windows nodes):

pgt-cronjob:
  pod:
    spec:
      tolerations:
        - key: node.playgroundtech.io/os-windows
          operator: Exists
          effect: NoExecute

Prometheus PodMonitor

Enable metrics scraping for CronJobs that expose metrics during execution:

pgt-cronjob:
  podMonitor:
    enabled: true
    path: /metrics
    port: "9090"
    interval: 30s

Complete Examples

Data Processing Job

A daily job that processes data from a database:

pgt-cronjob:
  name: data-processor
  organisationName: acme-corp

  cronjob:
    schedule: "0 2 * * *"  # Daily at 2 AM
    concurrencyPolicy: Forbid
    successfulJobsHistoryLimit: 7
    failedJobsHistoryLimit: 3
    restartPolicy: OnFailure

  container:
    image:
      registry: public.ecr.aws
      repository: acme-corp/data-processor
      tag: "1.2.0"
    command: ["python"]
    args: ["process_data.py", "--date=yesterday"]
    resources:
      limits:
        memory: 2Gi
      requests:
        memory: 2Gi
        cpu: 500m

  serviceAccount:
    name: data-processor-sa
    annotations:
      eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/data-processor-role

  environmentVariables:
    - name: LOG_LEVEL
      value: info
    - name: DATABASE_URL
      valueFrom:
        secretKeyRef:
          name: data-processor-secrets
          key: database-url

  pgt-secrets:
    enabled: true
    organisationName: acme-corp
    serviceAccount:
      create: false
      name: data-processor-sa
    aws:
      enabled: true
      secretRegion: eu-west-1
    items:
      - secretStoreName: data-processor-store
        kubernetesSecretName: data-processor-secrets
        data:
          - secretKey: database-url
            remoteRef:
              key: prod/data-processor/database
              property: connection_string

Cleanup Job

A weekly job that cleans up old resources:

pgt-cronjob:
  name: cleanup-job
  organisationName: acme-corp

  cronjob:
    schedule: "0 0 * * 0"  # Weekly on Sunday at midnight
    concurrencyPolicy: Forbid
    successfulJobsHistoryLimit: 4
    failedJobsHistoryLimit: 2
    restartPolicy: Never

  container:
    image:
      registry: public.ecr.aws
      repository: acme-corp/cleanup-tool
      tag: "1.0.0"
    args: ["--retention-days=30", "--dry-run=false"]
    resources:
      limits:
        memory: 256Mi
      requests:
        memory: 256Mi
        cpu: 100m

  serviceAccount:
    name: cleanup-job-sa
    annotations:
      eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/cleanup-job-role

  environmentVariables:
    - name: LOG_LEVEL
      value: info
    - name: SLACK_WEBHOOK_URL
      valueFrom:
        secretKeyRef:
          name: cleanup-job-secrets
          key: slack-webhook

  pgt-secrets:
    enabled: true
    organisationName: acme-corp
    serviceAccount:
      create: false
      name: cleanup-job-sa
    aws:
      enabled: true
      secretRegion: eu-west-1
    items:
      - secretStoreName: cleanup-store
        kubernetesSecretName: cleanup-job-secrets
        data:
          - secretKey: slack-webhook
            remoteRef:
              key: prod/cleanup/slack
              property: webhook_url

Report Generation Job

A job that generates and emails reports every weekday:

pgt-cronjob:
  name: report-generator
  organisationName: acme-corp

  cronjob:
    schedule: "0 8 * * 1-5"  # Weekdays at 8 AM
    concurrencyPolicy: Forbid
    restartPolicy: OnFailure

  container:
    image:
      registry: public.ecr.aws
      repository: acme-corp/report-generator
      tag: "2.1.0"
    args: ["--report-type=daily", "--send-email"]
    resources:
      limits:
        memory: 1Gi
      requests:
        memory: 1Gi
        cpu: 250m

  serviceAccount:
    name: report-generator-sa
    annotations:
      eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/report-generator-role

  environmentVariablesFrom:
    - secretRef:
        name: report-generator-secrets

  volumes:
    - kubernetesConfigMapName: report-templates
      mountPath: /app/templates
      readOnly: true

  pgt-secrets:
    enabled: true
    organisationName: acme-corp
    serviceAccount:
      create: false
      name: report-generator-sa
    aws:
      enabled: true
      secretRegion: eu-west-1
    items:
      - secretStoreName: report-store
        kubernetesSecretName: report-generator-secrets
        data:
          - secretKey: SMTP_PASSWORD
            remoteRef:
              key: prod/reports/smtp
              property: password
          - secretKey: DATABASE_URL
            remoteRef:
              key: prod/reports/database
              property: url

Troubleshooting

Use Argo CD to investigate issues with CronJobs.

Viewing CronJob Status

Navigate to your application in the Argo CD UI
Locate the CronJob resource in the application tree
Click on the CronJob to view its details including:
- Last schedule time
- Active jobs
- Schedule expression

Viewing Job Executions

In the Argo CD application tree, look for Job resources created by the CronJob
Click on a Job to see its status and completion time
Expand the Job to see its Pods

Checking Pod Logs

In the application tree, find the Pod created by a Job
Click on the Pod resource
Select the Logs tab to view container output
Check for errors or unexpected behaviour

Common Issues

Job not running on schedule:

Verify the cron schedule expression is correct
Check if concurrencyPolicy: Forbid is blocking new jobs because previous jobs are still running
Ensure the CronJob is not suspended

Job failing repeatedly:

Check Pod logs for error messages
Verify secrets and ConfigMaps are correctly configured
Ensure the ServiceAccount has required permissions
Check resource limits aren't too restrictive

Pods stuck in Pending:

Check if the cluster has sufficient resources
Verify node selectors and tolerations match available nodes
Check for PersistentVolumeClaim issues if using volumes

Values Reference

Value

Type

Default

Description

name

string

nil

Required. CronJob name

organisationName

string

nil

Required. Organisation name

cronjob.schedule

string

nil

Required. Cron schedule expression

cronjob.concurrencyPolicy

string

Forbid

Allow, Forbid, or Replace

cronjob.successfulJobsHistoryLimit

int

3

Successful jobs to retain

cronjob.failedJobsHistoryLimit

int

1

Failed jobs to retain

cronjob.restartPolicy

string

OnFailure

OnFailure or Never

affinity.nodeAffinity.preferSpotInstances

bool

false

Prefer scheduling on spot instances

container.image.registry

string

nil

Required. Container registry

container.image.repository

string

nil

Required. Image repository

container.image.tag

string

nil

Required. Image tag

container.imagePullPolicy

string

IfNotPresent

Image pull policy

container.command

list

[]

Container entrypoint override

container.args

list

[]

Container arguments

container.resources.limits.memory

string

1Mi

Memory limit

container.resources.requests.memory

string

1Mi

Memory request

container.resources.requests.cpu

string

1m

CPU request

serviceAccount.name

string

nil

Required. ServiceAccount name

serviceAccount.annotations

object

{}

ServiceAccount annotations

environmentVariables

list

[]

Environment variables

environmentVariablesFrom

list

[]

Load env vars from ConfigMap/Secret

volumes

list

[]

Volume mounts

podMonitor.enabled

bool

false

Enable PodMonitor

podMonitor.path

string

nil

Metrics path

podMonitor.port

string

nil

Metrics port

podMonitor.interval

string

nil

Scrape interval

pgt-secrets.enabled

bool

false

Enable external secrets

PreviousAzure Workload Identities NextScaled Jobs

Last updated 2 days ago

Was this helpful?

hashtagPrerequisites

hashtagBasic Configuration

hashtagRequired Fields

hashtagDevelopment Environment & Cost Optimization

hashtagSchedule Configuration

hashtagCron Schedule Syntax

hashtagCommon Schedule Examples

hashtagCronJob Behaviour

hashtagConcurrency Policy

hashtagJob History

hashtagRestart Policy

hashtagContainer Configuration

hashtagCommand and Arguments

hashtagImage Pull Policy

hashtagEnvironment Variables

hashtagDirect Environment Variables

hashtagLoad from ConfigMap or Secret

hashtagExternal Secrets

hashtagVolume Mounts

hashtagServiceAccount

hashtagPod Configuration

hashtagLabels and Annotations

hashtagTolerations

hashtagPrometheus PodMonitor

hashtagComplete Examples

hashtagData Processing Job

hashtagCleanup Job

hashtagReport Generation Job

hashtagTroubleshooting

hashtagViewing CronJob Status

hashtagViewing Job Executions

hashtagChecking Pod Logs

hashtagCommon Issues

hashtagValues Reference

Prerequisites

Basic Configuration

Required Fields

Development Environment & Cost Optimization

Schedule Configuration

Cron Schedule Syntax

Common Schedule Examples

CronJob Behaviour

Concurrency Policy

Job History

Restart Policy

Container Configuration

Command and Arguments

Image Pull Policy

Environment Variables

Direct Environment Variables

Load from ConfigMap or Secret

External Secrets

Volume Mounts

ServiceAccount

Pod Configuration

Labels and Annotations

Tolerations

Prometheus PodMonitor

Complete Examples

Data Processing Job

Cleanup Job

Report Generation Job

Troubleshooting

Viewing CronJob Status

Viewing Job Executions

Checking Pod Logs

Common Issues

Values Reference