cronjob

cronjob deploys one of your scheduled tasks: a CronJob that starts a Job on a schedule, whose pod runs until its work is done. It shares webapp’s blocks and their values, in the same shape: the image, the environment, the resources, the restricted profile, the volumes, and the objects it creates (ConfigMaps, Secrets, ExternalSecrets, disks, its ServiceAccount). Every pod it renders passes every kyverno_policies policy in its restricted profile, all of them enforced.

What it renders

Object	When	Name
CronJob	always	<release>
ServiceAccount, token not mounted	always	<release>
ConfigMap, Secret, ExternalSecret, PersistentVolumeClaim	one per entry, as in webapp	<release>-<name>

No Service, route, autoscaler or budget: nothing calls a task.

The values

The contract is values.yaml and values.schema.json; the shared keys are webapp’s. The task’s own:

Key	Default
schedule	required	cron’s format
timeZone	Etc/UTC	no hour shift twice a year unless asked
suspend	false	no new Job while true
concurrencyPolicy	Forbid	a run still going at the next time skips it
successfulJobsHistoryLimit, failedJobsHistoryLimit	3, 1	Jobs, and their logs, kept
startingDeadlineSeconds	unset	how late a missed run may start
backoffLimit	0	a failed run is not replayed unless you decide to
activeDeadlineSeconds	required	without it, a task that hangs runs forever
restartPolicy	Never	a failure stays visible, with its pod

Good to know

• Deploy it as webapp: the same ArgoCD Application, chart: cronjob (webapp).
• No Reloader: every run starts a new pod, which reads the ConfigMaps and Secrets as they are.
• A disk in persistence is attached by one Job’s pod at a time: concurrencyPolicy: Forbid keeps it so.

Under the hood

Built from charts/cronjob and the socle-lib library chart. Proven as webapp is; on floci and on the GKE sandbox (charts-gke), its first Job completes with every policy enforced. Published at each release as oci://ghcr.io/do-now-io/charts/cronjob, signed.