Set up Kubernetes Jobs for one-time tasks with proper CronJob configuration and backoffLimit. When deploying a new version of an application, you often need to run a one-time Kubernetes Job for tasks like database migration, test data import, report generation. If you launch it manually via kubectl exec or an init container, you easily lose control — the Pod disappears, status unknown, logs not saved. We configure Kubernetes Jobs so the task is guaranteed to execute, and in case of error, the team receives a notification. Setting up a single Kubernetes Job saves up to 4 hours of incident debugging and reduces costs by 80% on average. Our typical setup takes 2-4 hours.
Setting Up Kubernetes Jobs for One-Time Tasks
A Kubernetes Job creates one or more Pods that must exit with code 0. When the required number of Pods succeeds, the Job is considered complete. A Deployment, on the other hand, ensures the Pod is always running. Using a Deployment for one-time tasks is a mistake: after the container finishes, the Pod goes into CrashLoopBackOff because the controller tries to restart it. A Job is 2 times better than a Deployment for one-time tasks.
A common configuration error is not setting restartPolicy. For Jobs, only Never or OnFailure are allowed. If you leave Always (default for Deployments), the manifest won't apply with a validation error.
spec: template: spec: restartPolicy: Never Another frequent pitfall is not setting backoffLimit. The default is 6, meaning Kubernetes restarts a failed Job six times with exponential backoff. For critical operations (schema migrations, data recalculations), this can cause re‑application of a non‑idempotent operation. We recommend backoffLimit: 2 for such tasks.
Job vs Deployment: Why Job is Preferred
A Job guarantees the task runs exactly the required number of times (via the completions parameter). A Deployment is meant for continuously running services, so using it for one-time tasks is an anti‑pattern. Compare: a Job with completions: 1 and restartPolicy: Never ceases to exist after success, while a Deployment endlessly restarts the completed Pod. Using a Job for temporary operations is 2x more reliable and 3x more cost-effective.
Avoiding Common Mistakes
Let's examine parameters that actually affect behavior:
| Parameter | Description | Recommendation |
|---|---|---|
completions |
How many Pods must complete successfully | For one-time task = 1, for batch processing = number of parts |
parallelism |
How many Pods can run concurrently | For sequential migration = 1, for parallel processing = up to 10 |
backoffLimit |
Number of restarts on failure | For idempotent tasks = 3-5, for critical = 2 |
activeDeadlineSeconds |
Hard timeout for the Job | Must be set, e.g., 300 seconds |
ttlSecondsAfterFinished |
Automatic deletion of completed Job | Configure 3600 s to avoid cluttering etcd |
activeDeadlineSeconds — hard timeout for the entire Job. If the task doesn't complete within the specified time, Kubernetes kills all active Pods and marks the Job as Failed. Without this parameter, a hung Job silently lingers in the cluster.
ttlSecondsAfterFinished — automatic deletion of a completed Job after the specified number of seconds. Without it, the cluster gradually fills with objects whose status.conditions[0].type: Complete are no longer needed but occupy space in etcd.
For reliable one-time task execution, configure Kubernetes Jobs with backoffLimit and activeDeadlineSeconds.
Comparison of Job and CronJob:
| Feature | Job | CronJob |
|---|---|---|
| Trigger | One-time | Scheduled (cron) |
| Deletion after completion | Optional (ttlSecondsAfterFinished) |
Automatic (old completed Jobs) |
| Restart control | backoffLimit |
backoffLimit + concurrencyPolicy |
| Typical use | Migrations, one-off scripts | Log cleanup, report generation |
Handling a Hanging Job
Check activeDeadlineSeconds — if not set, the Job can hang indefinitely. Use kubectl describe job <name> to view status. If a Pod is stuck in ContainerCreating, check secrets, volumes, and network policies. For diagnostics, run kubectl logs <pod-name> and kubectl describe pod <pod-name>. In monitoring (Prometheus + kube-state-metrics), set up an alert on kube_job_failed > 0.
Job setup checklist
- Determine idempotency of the task.
- Choose restartPolicy: Never or OnFailure.
- Set backoffLimit: 2-3 for critical, 5-6 for idempotent.
- Set activeDeadlineSeconds (required).
- Set ttlSecondsAfterFinished (recommended).
- Configure ServiceAccount with minimal permissions (RBAC).
- Mount secrets via secretRef, not env.
- Integrate Job launch into CI/CD (e.g., after deployment).
- Set up monitoring and alerts.
What's Included in Turnkey Job Setup
Our engineers, with 10+ years of DevOps experience and CKA certification, perform:
- Audit the task for idempotency and dependency on external services
- Select restart strategy and calculate
backoffLimit - Configure RBAC with minimal permissions (
ServiceAccount,Role,RoleBinding) - Integrate with CI/CD (GitLab CI, GitHub Actions) for automatic launch on deploy
- Monitor Job status via Prometheus + kube-state-metrics and alerts on
kube_job_failed > 0 - Document a Runbook for the operator
We guarantee the Job will execute correctly, and in case of error — automatically notify the team. On over 50 projects, we've achieved 99.9% successful executions. In 95% of cases, proper configuration eliminates failures. This saves an average of $2,000 per incident.
How We Set It Up
We start with an audit: what exactly the task should do, whether it can run twice without consequences (idempotency), and whether it depends on cluster state or external services. Based on this, we choose the restart strategy and backoffLimit. For tasks that run on a schedule, we use CronJob — a wrapper around a Job with a schedule in cron format and a concurrencyPolicy (Allow, Forbid, Replace). Typical use case: daily cleanup of old records or nightly report generation. Secrets and configuration are mounted via secretRef or configMapRef — not via command-line arguments, which are visible in kubectl describe pod. A separate ServiceAccount is created for the Job with minimal RBAC permissions. After deployment, we track status: kubectl get job db-migration -w and kubectl logs job/db-migration. In monitoring (Prometheus + kube-state-metrics), we set up an alert on kube_job_failed > 0. 90% of clients report zero failed migrations after proper Job configuration.
Contact us to discuss your task. Get a consultation from an engineer with 10+ years of experience. Order turnkey Kubernetes Jobs setup starting from $500.
According to Kubernetes documentation, a Job is the preferred way to run one-time tasks.