Table: kubernetes_cronjob - Query Kubernetes CronJobs using SQL
A Kubernetes CronJob creates Jobs on a repeating schedule, similar to the job scheduling in Unix-like systems. It is a way to run automated tasks at regular, predetermined times. CronJobs use the Cron format to schedule tasks.
Table Usage Guide
The kubernetes_cronjob
table provides insights into CronJobs within Kubernetes. As a DevOps engineer, explore CronJob-specific details through this table, including schedules, job histories, and associated metadata. Utilize it to monitor and manage your automated tasks, and ensure they are running as expected.
Examples
Basic Info
Explore which scheduled tasks within your Kubernetes environment have failed. This allows for proactive troubleshooting and understanding of task scheduling and execution patterns.
select name, namespace, uid, failed_jobs_history_limit, schedule, suspendfrom kubernetes_cronjob;
select name, namespace, uid, failed_jobs_history_limit, schedule, suspendfrom kubernetes_cronjob;
Get list of container and images for cronJobs
Explore which cronJobs are running in your Kubernetes environment and identify the containers and images they are using. This is useful to understand the dependencies and configurations of your scheduled tasks, and can help in troubleshooting or optimizing resource usage.
select name, namespace, jsonb_agg(elems.value -> 'name') as containers, jsonb_agg(elems.value -> 'image') as imagesfrom kubernetes_cronjob, jsonb_array_elements( job_template -> 'spec' -> 'template' -> 'spec' -> 'containers' ) as elemsgroup by name, namespace;
select name, namespace, json_group_array(json_extract(elems.value, '$.name')) as containers, json_group_array(json_extract(elems.value, '$.image')) as imagesfrom kubernetes_cronjob, json_each(job_template, '$.spec.template.spec.containers') as elemsgroup by name, namespace;
List manifest resources
Explore which scheduled tasks within your Kubernetes environment have a specified path. This can be useful to identify tasks that may be associated with certain applications or services, helping you to manage and monitor your resources more effectively.
select name, namespace, uid, failed_jobs_history_limit, schedule, suspend, pathfrom kubernetes_cronjobwhere path is not null;
select name, namespace, uid, failed_jobs_history_limit, schedule, suspend, pathfrom kubernetes_cronjobwhere path is not null;
Query examples
- cluster_cronjobs_count
- cronjob_1_year_count
- cronjob_24_hours_count
- cronjob_30_90_days_count
- cronjob_30_days_count
- cronjob_90_365_days_count
- cronjob_age_table
- cronjob_annotations
- cronjob_by_context
- cronjob_by_context_name
- cronjob_by_creation_month
- cronjob_by_namespace
- cronjob_configuration_detail
- cronjob_container_host_ipc
- cronjob_container_host_ipc_count
- cronjob_container_host_network
- cronjob_container_host_network_count
- cronjob_container_host_pid
- cronjob_container_host_pid_count
- cronjob_count
- cronjob_default_namespace
- cronjob_default_namespace_count
- cronjob_host_table
- cronjob_input
- cronjob_labels
- cronjob_overview
- cronjob_tree
- cronjobs_for_namespace
Control examples
- All Controls > CronJob > CronJob containers --service-account-key-file argument should be set as appropriate
- All Controls > CronJob > CronJob containers admission control plugin should be set to 'always pull images'
- All Controls > CronJob > CronJob containers admission control plugin should not be set to 'always admit'
- All Controls > CronJob > CronJob containers argument --streaming-connection-idle-timeout should not be set to 0
- All Controls > CronJob > CronJob containers argument admission control plugin NamespaceLifecycle should be enabled
- All Controls > CronJob > CronJob containers argument admission control plugin NodeRestriction should be enabled
- All Controls > CronJob > CronJob containers argument admission control plugin PodSecurityPolicy should be enabled
- All Controls > CronJob > CronJob containers argument admission control plugin ServiceAccount should be enabled
- All Controls > CronJob > CronJob containers argument admission control plugin where either PodSecurityPolicy or SecurityContextDeny should be enabled
- All Controls > CronJob > CronJob containers argument anonymous auth should be disabled
- All Controls > CronJob > CronJob containers argument apiserver etcd certfile and keyfile should be configured
- All Controls > CronJob > CronJob containers argument authorization mode should have node
- All Controls > CronJob > CronJob containers argument authorization mode should have RBAC
- All Controls > CronJob > CronJob containers argument authorization mode should not be set to 'always allow'
- All Controls > CronJob > CronJob containers argument basic auth file should not be set
- All Controls > CronJob > CronJob containers argument etcd auto TLS should be disabled
- All Controls > CronJob > CronJob containers argument etcd cafile should be set
- All Controls > CronJob > CronJob containers argument etcd client cert auth should be enabled
- All Controls > CronJob > CronJob containers argument event qps should be less than 5
- All Controls > CronJob > CronJob containers argument hostname override should not be configured
- All Controls > CronJob > CronJob containers argument insecure bind address should not be set
- All Controls > CronJob > CronJob containers argument insecure port should be set to 0
- All Controls > CronJob > CronJob containers argument kube controller manager service account credentials should be enabled
- All Controls > CronJob > CronJob containers argument kube-controller-manager bind address should be set to 127.0.0.1
- All Controls > CronJob > CronJob containers argument kube-scheduler bind address should be set to 127.0.0.1
- All Controls > CronJob > CronJob containers argument kubelet authorization mode should not be set to 'always allow'
- All Controls > CronJob > CronJob containers argument kubelet client certificate and key should be configured
- All Controls > CronJob > CronJob containers argument kubelet HTTPS should be enabled
- All Controls > CronJob > CronJob containers argument kubelet read-only port should be set to 0
- All Controls > CronJob > CronJob containers argument make iptables util chains should be enabled
- All Controls > CronJob > CronJob containers argument protect kernel defaults should be enabled
- All Controls > CronJob > CronJob containers argument request timeout should be set as appropriate
- All Controls > CronJob > CronJob containers argument rotate kubelet server certificate should be enabled
- All Controls > CronJob > CronJob containers argument secure port should not be set to 0
- All Controls > CronJob > CronJob containers argument service account lookup should be enabled
- All Controls > CronJob > CronJob containers certificate rotation should be enabled
- All Controls > CronJob > CronJob containers have image tag specified which should be fixed not latest or blank
- All Controls > CronJob > CronJob containers kube controller manager profiling should be disabled
- All Controls > CronJob > CronJob containers kube scheduler profiling should be disabled
- All Controls > CronJob > CronJob containers kube-apiserver profiling should be disabled
- All Controls > CronJob > CronJob containers kube-apiserver should only make use of strong cryptographic ciphers
- All Controls > CronJob > CronJob containers kubelet should only make use of strong cryptographic ciphers
- All Controls > CronJob > CronJob containers Kubernetes dashboard should not be deployed
- All Controls > CronJob > CronJob containers peer client cert auth should be enabled
- All Controls > CronJob > CronJob containers ports should not have host port specified
- All Controls > CronJob > CronJob containers should has admission capability restricted
- All Controls > CronJob > CronJob containers should has encryption providers configured appropriately
- All Controls > CronJob > CronJob containers should has image pull policy set to Always
- All Controls > CronJob > CronJob containers should has security context defined
- All Controls > CronJob > CronJob containers should have audit log max backup set to 10 or greater
- All Controls > CronJob > CronJob containers should have audit log max size set to 100 or greater
- All Controls > CronJob > CronJob containers should have audit log max-age set to 30 or greater
- All Controls > CronJob > CronJob containers should have audit log path configured appropriately
- All Controls > CronJob > CronJob containers should have etcd certfile and keyfile configured appropriately
- All Controls > CronJob > CronJob containers should have etcd peer certfile and peer keyfile configured appropriately
- All Controls > CronJob > CronJob containers should have kube controller manager root CA file configured appropriately
- All Controls > CronJob > CronJob containers should have kube controller manager service account private key file configured appropriately
- All Controls > CronJob > CronJob containers should have kube-apiserver TLS cert file and TLS private key file configured appropriately
- All Controls > CronJob > CronJob containers should have kubelet certificate authority configured appropriately
- All Controls > CronJob > CronJob containers should have kubelet client CA file configured appropriately
- All Controls > CronJob > CronJob containers should have kubelet terminated pod gc threshold configured appropriately
- All Controls > CronJob > CronJob containers should have kubelet TLS cert file and TLS private key file configured appropriately
- All Controls > CronJob > CronJob containers should have liveness probe
- All Controls > CronJob > CronJob containers should have readiness probe
- All Controls > CronJob > CronJob containers should have secrets defined as files
- All Controls > CronJob > CronJob containers should minimize its admission with capabilities assigned
- All Controls > CronJob > CronJob containers should not be mapped with privilege ports
- All Controls > CronJob > CronJob containers should not have added capabilities
- All Controls > CronJob > CronJob containers should not use CAP_SYS_ADMIN linux capability
- All Controls > CronJob > CronJob containers token auth file should not be configured
- CronJob containers should have a CPU limit
- CronJob containers should have a CPU request
- CronJob containers should have a memory limit
- CronJob containers should have a memory request
- CronJob containers should not allow privilege escalation
- CronJob containers should not have privileged access
- CronJob containers should not run with host network access
- CronJob containers should not run with root privileges
- CronJob containers should not share the host process namespace
- CronJob containers should run with a read only root file system
- CronJob definition should not use default namespace
- Seccomp profile is set to docker/default in CronJob definition
Schema for kubernetes_cronjob
Name | Type | Operators | Description |
---|---|---|---|
_ctx | jsonb | Steampipe context in JSON form. | |
active | jsonb | A list of pointers to currently running jobs. | |
annotations | jsonb | Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. | |
concurrency_policy | jsonb | Specifies how to treat concurrent executions of a Job. | |
context_name | text | Kubectl config context name. | |
creation_timestamp | timestamp with time zone | CreationTimestamp is a timestamp representing the server time when this object was created. | |
deletion_grace_period_seconds | bigint | Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. | |
deletion_timestamp | timestamp with time zone | DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. | |
end_line | bigint | The path to the manifest file. | |
failed_jobs_history_limit | bigint | The number of failed finished jobs to retain. Value must be non-negative integer. | |
finalizers | jsonb | Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. | |
generate_name | text | GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. | |
generation | bigint | A sequence number representing a specific generation of the desired state. | |
job_template | jsonb | Specifies the job that will be created when executing a CronJob. | |
labels | jsonb | Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. | |
last_schedule_time | timestamp with time zone | Information when was the last time the job was successfully scheduled. | |
last_successful_time | timestamp with time zone | Information when was the last time the job successfully completed. | |
name | text | Name of the object. Name must be unique within a namespace. | |
namespace | text | Namespace defines the space within which each name must be unique. | |
owner_references | jsonb | List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller. | |
path | text | The path to the manifest file. | |
resource_version | text | An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. | |
schedule | text | The schedule in Cron format. | |
source_type | text | The source of the resource. Possible values are: deployed and manifest. If the resource is fetched from the spec file the value will be manifest. | |
sp_connection_name | text | Steampipe connection name. | |
sp_ctx | jsonb | Steampipe context in JSON form. | |
start_line | bigint | The path to the manifest file. | |
starting_deadline_seconds | bigint | Optional deadline in seconds for starting the job if it misses scheduledtime for any reason. | |
successful_jobs_history_limit | bigint | The number of successful finished jobs to retain. Value must be non-negative integer. | |
suspend | boolean | This flag tells the controller to suspend subsequent executions, it does not apply to already started executions. Defaults to false. | |
tags | jsonb | A map of tags for the resource. This includes both labels and annotations. | |
title | text | Title of the resource. | |
uid | text | UID is the unique in time and space value for this object. |
Export
This table is available as a standalone Exporter CLI. Steampipe exporters are stand-alone binaries that allow you to extract data using Steampipe plugins without a database.
You can download the tarball for your platform from the Releases page, but it is simplest to install them with the steampipe_export_installer.sh
script:
/bin/sh -c "$(curl -fsSL https://steampipe.io/install/export.sh)" -- kubernetes
You can pass the configuration to the command with the --config
argument:
steampipe_export_kubernetes --config '<your_config>' kubernetes_cronjob