Table: kubernetes_job - Query Kubernetes Jobs using SQL
Kubernetes Jobs are a resource that represent a finite task, i.e., they run until successful completion. They create one or more Pods and ensure that a specified number of them successfully terminate. As pods successfully complete, the job tracks the successful completions.
Table Usage Guide
The kubernetes_job
table provides insights into Kubernetes Jobs within a Kubernetes cluster. As a DevOps engineer, explore job-specific details through this table, including the status of each job, the number of successful completions, and the parallelism limit. Utilize it to monitor the progress of jobs, ensure that they are running as expected, and troubleshoot any issues that occur.
Examples
Basic Info
Explore the status and performance of jobs within a Kubernetes environment. This allows users to assess job completion status, duration, and overall efficiency, aiding in system monitoring and optimization.
select name, namespace, active, succeeded, failed, completions, start_time, completion_time, age( coalesce(completion_time, current_timestamp), start_time ) as duration, active_deadline_seconds, parallelism, selector, labels, annotationsfrom kubernetes_job;
select name, namespace, active, succeeded, failed, completions, start_time, completion_time, strftime('%s', coalesce(completion_time, current_timestamp)) - strftime('%s', start_time) as duration, active_deadline_seconds, parallelism, selector, labels, annotationsfrom kubernetes_job;
List active jobs
Determine the areas in which jobs are currently active within a Kubernetes environment. This can be useful in managing resources and identifying any potential issues or bottlenecks.
select name, namespace, start_time, age( coalesce(completion_time, current_timestamp), start_time ) as duration, active, succeeded, failedfrom kubernetes_jobwhere active > 0;
select name, namespace, start_time, strftime('%s', coalesce(completion_time, current_timestamp)) - strftime('%s', start_time) as duration, active, succeeded, failedfrom kubernetes_jobwhere active > 0;
List failed jobs
Identify instances where jobs have failed in a Kubernetes environment. This enables quick detection of issues and facilitates timely troubleshooting.
select name, namespace, start_time, age( coalesce(completion_time, current_timestamp), start_time ) as duration, active, succeeded, failedfrom kubernetes_jobwhere failed > 0;
select name, namespace, start_time, coalesce(completion_time, datetime('now')) - start_time as duration, active, succeeded, failedfrom kubernetes_jobwhere failed > 0;
Get list of container and images for jobs
The query provides a way to identify the containers and images associated with specific jobs in a Kubernetes environment. This can be particularly useful for system administrators to track the resources being used by different jobs and ensure optimal resource allocation.
select name, namespace, jsonb_agg(elems.value -> 'name') as containers, jsonb_agg(elems.value -> 'image') as imagesfrom kubernetes_job, jsonb_array_elements(template -> 'spec' -> 'containers') as elemsgroup by name, namespace;
select name, namespace, json_group_array(json_extract(elems.value, '$.name')) as containers, json_group_array(json_extract(elems.value, '$.image')) as imagesfrom kubernetes_job, json_each(template, '$.spec.containers') as elemsgroup by name, namespace;
List manifest resources
Explore the status and details of active Kubernetes jobs, including their success and failure rates. This can be useful for identifying any jobs that may require attention or troubleshooting.
select name, namespace, active, succeeded, failed, completions, parallelism, selector, labels, annotations, pathfrom kubernetes_jobwhere path is not null;
select name, namespace, active, succeeded, failed, completions, parallelism, selector, labels, annotations, pathfrom kubernetes_jobwhere path is not null;
Query examples
- cluster_jobs_count
- containers_for_cronjob
- containers_for_job
- cronjob_jobs_detail
- cronjob_pods_detail
- cronjob_tree
- cronjobs_for_job
- job_1_year_count
- job_24_hours_count
- job_30_90_days_count
- job_30_days_count
- job_90_365_days_count
- job_age_table
- job_annotations
- job_by_context
- job_by_context_name
- job_by_creation_month
- job_by_namespace
- job_container_host_ipc
- job_container_host_ipc_count
- job_container_host_network
- job_container_host_network_count
- job_container_host_pid
- job_container_host_pid_count
- job_count
- job_default_namespace
- job_default_namespace_count
- job_host_table
- job_input
- job_labels
- job_overview
- job_tree
- jobs_for_cronjob
- jobs_for_namespace
- jobs_for_pod
- nodes_for_cronjob
- nodes_for_job
- pods_for_cronjob
- pods_for_job
Control examples
- All Controls > Job > Job containers --service-account-key-file argument should be set as appropriate
- All Controls > Job > Job containers admission control plugin should be set to 'always pull images'
- All Controls > Job > Job containers admission control plugin should not be set to 'always admit'
- All Controls > Job > Job containers argument --streaming-connection-idle-timeout should not be set to 0
- All Controls > Job > Job containers argument admission control plugin NamespaceLifecycle should be enabled
- All Controls > Job > Job containers argument admission control plugin NodeRestriction should be enabled
- All Controls > Job > Job containers argument admission control plugin PodSecurityPolicy should be enabled
- All Controls > Job > Job containers argument admission control plugin ServiceAccount should be enabled
- All Controls > Job > Job containers argument admission control plugin where either PodSecurityPolicy or SecurityContextDeny should be enabled
- All Controls > Job > Job containers argument anonymous auth should be disabled
- All Controls > Job > Job containers argument apiserver etcd certfile and keyfile should be configured
- All Controls > Job > Job containers argument authorization mode should have node
- All Controls > Job > Job containers argument authorization mode should have RBAC
- All Controls > Job > Job containers argument authorization mode should not be set to 'always allow'
- All Controls > Job > Job containers argument basic auth file should not be set
- All Controls > Job > Job containers argument etcd auto TLS should be disabled
- All Controls > Job > Job containers argument etcd cafile should be set
- All Controls > Job > Job containers argument etcd client cert auth should be enabled
- All Controls > Job > Job containers argument event qps should be less than 5
- All Controls > Job > Job containers argument hostname override should not be configured
- All Controls > Job > Job containers argument insecure bind address should not be set
- All Controls > Job > Job containers argument insecure port should be set to 0
- All Controls > Job > Job containers argument kube controller manager service account credentials should be enabled
- All Controls > Job > Job containers argument kube-controller-manager bind address should be set to 127.0.0.1
- All Controls > Job > Job containers argument kube-scheduler bind address should be set to 127.0.0.1
- All Controls > Job > Job containers argument kubelet authorization mode should not be set to 'always allow'
- All Controls > Job > Job containers argument kubelet client certificate and key should be configured
- All Controls > Job > Job containers argument kubelet HTTPS should be enabled
- All Controls > Job > Job containers argument kubelet read-only port should be set to 0
- All Controls > Job > Job containers argument make iptables util chains should be enabled
- All Controls > Job > Job containers argument protect kernel defaults should be enabled
- All Controls > Job > Job containers argument request timeout should be set as appropriate
- All Controls > Job > Job containers argument rotate kubelet server certificate should be enabled
- All Controls > Job > Job containers argument secure port should not be set to 0
- All Controls > Job > Job containers argument service account lookup should be enabled
- All Controls > Job > Job containers certificate rotation should be enabled
- All Controls > Job > Job containers has image pull policy set to Always
- All Controls > Job > Job containers have image tag specified which should be fixed not latest or blank
- All Controls > Job > Job containers kube controller manager profiling should be disabled
- All Controls > Job > Job containers kube scheduler profiling should be disabled
- All Controls > Job > Job containers kube-apiserver profiling should be disabled
- All Controls > Job > Job containers kube-apiserver should only make use of strong cryptographic ciphers
- All Controls > Job > Job containers kubelet should only make use of strong cryptographic ciphers
- All Controls > Job > Job containers Kubernetes dashboard should not be deployed
- All Controls > Job > Job containers peer client cert auth should be enabled
- All Controls > Job > Job containers ports should not have host port specified
- All Controls > Job > Job containers should has admission capability restricted
- All Controls > Job > Job containers should has encryption providers configured appropriately
- All Controls > Job > Job containers should has security context defined
- All Controls > Job > Job containers should have audit log max backup set to 10 or greater
- All Controls > Job > Job containers should have audit log max size set to 100 or greater
- All Controls > Job > Job containers should have audit log max-age set to 30 or greater
- All Controls > Job > Job containers should have audit log path configured appropriately
- All Controls > Job > Job containers should have etcd certfile and keyfile configured appropriately
- All Controls > Job > Job containers should have etcd peer certfile and peer keyfile configured appropriately
- All Controls > Job > Job containers should have kube controller manager root CA file configured appropriately
- All Controls > Job > Job containers should have kube controller manager service account private key file configured appropriately
- All Controls > Job > Job containers should have kube-apiserver TLS cert file and TLS private key file configured appropriately
- All Controls > Job > Job containers should have kubelet certificate authority configured appropriately
- All Controls > Job > Job containers should have kubelet client CA file configured appropriately
- All Controls > Job > Job containers should have kubelet terminated pod gc threshold configured appropriately
- All Controls > Job > Job containers should have kubelet TLS cert file and TLS private key file configured appropriately
- All Controls > Job > Job containers should have liveness probe
- All Controls > Job > Job containers should have readiness probe
- All Controls > Job > Job containers should have secrets defined as files
- All Controls > Job > Job containers should minimize its admission with capabilities assigned
- All Controls > Job > Job containers should minimize the admission of containers with added capability
- All Controls > Job > Job containers should not be mapped with privilege ports
- All Controls > Job > Job containers should not use CAP_SYS_ADMIN linux capability
- All Controls > Job > Job containers token auth file should not be configured
- Job containers should have a CPU limit
- Job containers should have a CPU request
- Job containers should have a memory limit
- Job containers should have a memory request
- Job containers should not allow privilege escalation
- Job containers should not have privileged access
- Job containers should not run with host network access
- Job containers should not run with root privileges
- Job containers should not share the host process namespace
- Job containers should run with a read only root file system
- Job definition should not use default namespace
- Seccomp profile is set to docker/default in Job definition
Schema for kubernetes_job
Name | Type | Operators | Description |
---|---|---|---|
_ctx | jsonb | Steampipe context in JSON form. | |
active | bigint | The number of actively running pods. | |
active_deadline_seconds | bigint | The duration in seconds relative to the startTime that the job may be active before the system tries to terminate it. | |
annotations | jsonb | Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. | |
backoff_limit | bigint | The number of retries before marking this job failed. Defaults to 6. | |
completion_time | timestamp with time zone | Time when the job was completed. | |
completions | bigint | The desired number of successfully finished pods the job should be run with. | |
conditions | jsonb | The latest available observations of an object's current state. | |
context_name | text | Kubectl config context name. | |
creation_timestamp | timestamp with time zone | CreationTimestamp is a timestamp representing the server time when this object was created. | |
deletion_grace_period_seconds | bigint | Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. | |
deletion_timestamp | timestamp with time zone | DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. | |
end_line | bigint | The path to the manifest file. | |
failed | bigint | The number of pods which reached phase Failed. | |
finalizers | jsonb | Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. | |
generate_name | text | GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. | |
generation | bigint | A sequence number representing a specific generation of the desired state. | |
labels | jsonb | Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. | |
manual_selector | boolean | ManualSelector controls generation of pod labels and pod selectors. When false or unset, the system pick labels unique to this job and appends those labels to the pod template. When true, the user is responsible for picking unique labels and specifying the selector. | |
name | text | Name of the object. Name must be unique within a namespace. | |
namespace | text | Namespace defines the space within which each name must be unique. | |
owner_references | jsonb | List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller. | |
parallelism | bigint | The maximum desired number of pods the job should run at any given time. The actual number of pods running in steady state will be less than this number when ((.spec.completions - .status.successful) < .spec.parallelism), i.e. when the work left to do is less than max parallelism. | |
path | text | The path to the manifest file. | |
resource_version | text | An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. | |
selector | jsonb | A label query over pods that should match the pod count. | |
selector_query | text | A query string representation of the selector. | |
source_type | text | The source of the resource. Possible values are: deployed and manifest. If the resource is fetched from the spec file the value will be manifest. | |
sp_connection_name | text | Steampipe connection name. | |
sp_ctx | jsonb | Steampipe context in JSON form. | |
start_line | bigint | The path to the manifest file. | |
start_time | timestamp with time zone | Time when the job was acknowledged by the job controller. | |
succeeded | bigint | The number of pods which reached phase Succeeded. | |
tags | jsonb | A map of tags for the resource. This includes both labels and annotations. | |
template | jsonb | Describes the pod that will be created when executing a job. | |
title | text | Title of the resource. | |
ttl_seconds_after_finished | bigint | limits the lifetime of a Job that has finished execution (either Complete or Failed). If this field is set, ttlSecondsAfterFinished after the Job finishes, it is eligible to be automatically deleted. | |
uid | text | UID is the unique in time and space value for this object. |
Export
This table is available as a standalone Exporter CLI. Steampipe exporters are stand-alone binaries that allow you to extract data using Steampipe plugins without a database.
You can download the tarball for your platform from the Releases page, but it is simplest to install them with the steampipe_export_installer.sh
script:
/bin/sh -c "$(curl -fsSL https://steampipe.io/install/export.sh)" -- kubernetes
You can pass the configuration to the command with the --config
argument:
steampipe_export_kubernetes --config '<your_config>' kubernetes_job