Jobs & CronJobs

Batch Work That Terminates

Deployments model endless servers; Jobs model work that finishes. The Job controller creates pods until the desired completions succeed, retrying failures up to backoffLimit (default 6).

apiVersion: batch/v1
kind: Job
metadata: { name: nightly-report }
spec:
  backoffLimit: 4
  activeDeadlineSeconds: 600
  ttlSecondsAfterFinished: 86400
  template:
    spec:
      restartPolicy: Never

Jobs allow only Never or OnFailure restart policies. activeDeadlineSeconds kills the whole Job when wall-clock time runs out, and ttlSecondsAfterFinished garbage-collects finished Jobs. Because a pod may be recreated after a node dies mid-task, downstream effects must be idempotent — the contract is at-least-once.

Scheduling with CronJobs

apiVersion: batch/v1
kind: CronJob
metadata: { name: db-backup }
spec:
  schedule: "17 3 * * *"
  timeZone: "Etc/UTC"
  concurrencyPolicy: Forbid
  startingDeadlineSeconds: 300
  successfulJobsHistoryLimit: 3
  failedJobsHistoryLimit: 1
  jobTemplate:
    spec:
      backoffLimit: 2
      template:
        spec:
          restartPolicy: OnFailure

Fields are minute, hour, day of month, month, day of week. The controller creates a Job per schedule; a missed start still fires if it arrives within startingDeadlineSeconds. timeZone (stable since 1.27) pins interpretation — otherwise the kube-controller-manager's local zone applies.

Pitfalls and Interview Angles

Pitfall 1 — overlapping runs. The default concurrencyPolicy: Allow lets a slow run collide with the next schedule, double-writing results. Use Forbid for locks or Replace when only the newest run matters.

Pitfall 2 — assuming exactly-once. A Job retries after node failure; write effects that tolerate duplicates (idempotent upserts, unique run IDs), externalize state, and watch activeDeadlineSeconds so zombie runs cannot linger.

Interview-ready: distinguish Job from CronJob (one-shot controller vs scheduler of Jobs), explain each concurrency policy, and describe how you verify a run: kubectl create job --from=cronjob/db-backup manual-1 for a dry rehearsal, then check logs and status.succeeded.