Skip to main content

​
Overview

The CronJob Guardian Helm chart provides declarative installation and configuration for Kubernetes clusters. Chart Repository: https://illeniumstudios.github.io/cronjob-guardian Installation: 
helm repo add cronjob-guardian https://illeniumstudios.github.io/cronjob-guardian
helm repo update
helm install cronjob-guardian cronjob-guardian/cronjob-guardian

​
General Configuration

​
replicaCount
integer
default:"1"
Number of operator replicas. For high availability, use multiple replicas with leaderElection.enabled=true.
​
nameOverride
string
default:""
Override the chart name in resource names.
​
fullnameOverride
string
default:""
Override the full resource name prefix.

​
Image Configuration

​
image.registry
string
default:""
Image registry. If set, prepended to repository. Useful for using private registries.Example: "my-registry.example.com"
​
image.repository
string
default:"ghcr.io/illeniumstudios/cronjob-guardian"
Image repository.
​
image.pullPolicy
string
default:"IfNotPresent"
Image pull policy.Valid values: Always, IfNotPresent, Never
​
image.tag
string
Image tag. Defaults to the chart’s appVersion if not specified.
​
imagePullSecrets
array
default:"[]"
Image pull secrets for private registries.
imagePullSecrets:
  - name: my-registry-secret

​
ServiceAccount & RBAC

​
serviceAccount.create
boolean
default:"true"
Create a ServiceAccount for the operator.
​
serviceAccount.automount
boolean
default:"true"
Automatically mount ServiceAccount token.
​
serviceAccount.annotations
object
default:"{}"
ServiceAccount annotations. Useful for cloud provider IAM integration.
serviceAccount:
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::ACCOUNT:role/guardian
​
serviceAccount.name
string
default:""
ServiceAccount name. Auto-generated if not set.
​
rbac.create
boolean
default:"true"
Create ClusterRole and ClusterRoleBinding. Required for the operator to function.

​
Pod Configuration

​
podAnnotations
object
default:"{}"
Annotations to add to operator pods.
podAnnotations:
  prometheus.io/scrape: "true"
  prometheus.io/port: "8443"
​
podLabels
object
default:"{}"
Additional labels for operator pods.
​
podSecurityContext
object
default:"{}"
Pod-level security context.
podSecurityContext:
  runAsNonRoot: true
  runAsUser: 65532
  fsGroup: 65532
​
securityContext
object
default:"{}"
Container-level security context.
securityContext:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
      - ALL
  readOnlyRootFilesystem: true
​
terminationGracePeriodSeconds
integer
default:"10"
Pod termination grace period in seconds.
​
resources
object
Resource requests and limits.Default:
resources:
  limits:
    cpu: 500m
    memory: 256Mi
  requests:
    cpu: 10m
    memory: 64Mi
​
livenessProbe
object
Liveness probe configuration.Default:
livenessProbe:
  initialDelaySeconds: 15
  periodSeconds: 20
  timeoutSeconds: 1
  failureThreshold: 3
​
readinessProbe
object
Readiness probe configuration.Default:
readinessProbe:
  initialDelaySeconds: 5
  periodSeconds: 10
  timeoutSeconds: 1
  failureThreshold: 3
​
extraEnv
array
default:"[]"
Additional environment variables.
extraEnv:
  - name: GUARDIAN_LOG_LEVEL
    value: debug
  - name: GUARDIAN_STORAGE_POSTGRES_PASSWORD
    valueFrom:
      secretKeyRef:
        name: postgres-credentials
        key: password
​
extraVolumeMounts
array
default:"[]"
Additional volume mounts.
extraVolumeMounts:
  - name: custom-config
    mountPath: /etc/guardian/custom
    readOnly: true
​
extraVolumes
array
default:"[]"
Additional volumes.
extraVolumes:
  - name: custom-config
    configMap:
      name: guardian-custom-config

​
Scheduling

​
nodeSelector
object
default:"{}"
Node selector for pod scheduling.
nodeSelector:
  kubernetes.io/os: linux
  node-role.kubernetes.io/control-plane: ""
​
tolerations
array
default:"[]"
Tolerations for pod scheduling.
tolerations:
  - key: node-role.kubernetes.io/control-plane
    effect: NoSchedule
​
affinity
object
default:"{}"
Affinity rules for pod scheduling.
affinity:
  podAntiAffinity:
    preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 100
        podAffinityTerm:
          labelSelector:
            matchLabels:
              app.kubernetes.io/name: cronjob-guardian
          topologyKey: kubernetes.io/hostname

​
Operator Configuration

Maps directly to operator configuration options. See Operator Configuration Reference for detailed descriptions.
​
config.logLevel
string
default:"info"
Log level.Valid values: debug, info, warn, error

​
Scheduler Configuration

​
config.scheduler.deadManSwitchInterval
duration
default:"1m"
Dead-man’s switch check interval.
​
config.scheduler.slaRecalculationInterval
duration
default:"5m"
SLA recalculation interval.
​
config.scheduler.pruneInterval
duration
default:"1h"
History prune interval.
​
config.scheduler.startupGracePeriod
duration
default:"30s"
Grace period after startup before sending alerts.

​
History Retention Configuration

​
config.historyRetention.defaultDays
integer
default:"30"
Default retention period in days.
​
config.historyRetention.maxDays
integer
default:"90"
Maximum retention period in days.

​
Rate Limits Configuration

​
config.rateLimits.maxAlertsPerMinute
integer
default:"50"
Maximum alerts per minute across all channels.
​
config.rateLimits.burstLimit
integer
default:"10"
Maximum burst of alerts allowed.
​
config.rateLimits.defaultSuppressDuplicatesFor
duration
default:"1h"
Default duration to suppress duplicate alerts.

​
Storage Configuration

​
config.storage.type
string
default:"sqlite"
Storage backend type.Valid values: sqlite, postgres, mysql

​
SQLite Storage

​
config.storage.sqlite.path
string
default:"/data/guardian.db"
Path to SQLite database file. Requires persistence to be enabled.

​
PostgreSQL Storage

​
config.storage.postgres.host
string
default:""
PostgreSQL host.
​
config.storage.postgres.port
integer
default:"5432"
PostgreSQL port.
​
config.storage.postgres.database
string
default:""
PostgreSQL database name.
​
config.storage.postgres.username
string
default:""
PostgreSQL username.
​
config.storage.postgres.password
string
default:""
PostgreSQL password. Ignored if existingSecret is set. Recommend using existingSecret instead.
​
config.storage.postgres.existingSecret
string
default:""
Name of existing Secret containing PostgreSQL password.
​
config.storage.postgres.existingSecretKey
string
default:"password"
Key in existing Secret containing password.
​
config.storage.postgres.sslMode
string
default:"require"
PostgreSQL SSL mode.Valid values: disable, require, verify-ca, verify-full
​
config.storage.postgres.pool.maxIdleConns
integer
default:"10"
Maximum idle connections.
​
config.storage.postgres.pool.maxOpenConns
integer
default:"100"
Maximum open connections.
​
config.storage.postgres.pool.connMaxLifetime
duration
default:"1h"
Maximum connection lifetime.
​
config.storage.postgres.pool.connMaxIdleTime
duration
default:"10m"
Maximum connection idle time.

​
MySQL Storage

MySQL configuration follows the same structure as PostgreSQL:
  • config.storage.mysql.host
  • config.storage.mysql.port (default: 3306)
  • config.storage.mysql.database
  • config.storage.mysql.username
  • config.storage.mysql.password
  • config.storage.mysql.existingSecret
  • config.storage.mysql.existingSecretKey
  • config.storage.mysql.pool.* (same pool settings as PostgreSQL)

​
Storage Features

​
config.storage.logStorageEnabled
boolean
default:"false"
Enable storing job logs in database.
​
config.storage.eventStorageEnabled
boolean
default:"false"
Enable storing Kubernetes events in database.
​
config.storage.maxLogSizeKB
integer
default:"100"
Maximum log size to store per execution (KB).
​
config.storage.logRetentionDays
integer
default:"0"
Log retention days. 0 means use history-retention.default-days.

​
Persistence

Required for SQLite storage backend.
​
persistence.enabled
boolean
default:"true"
Enable persistence for SQLite database.
​
persistence.storageClass
string
default:""
Storage class name. Use "-" for default storage class, or specify a class name.
​
persistence.accessModes
array
PVC access modes.Default:
accessModes:
  - ReadWriteOnce
​
persistence.size
string
default:"1Gi"
PVC storage size.
​
persistence.annotations
object
default:"{}"
PVC annotations.
​
persistence.selector
object
default:"{}"
PVC selector for binding to specific PVs.
persistence:
  selector:
    matchLabels:
      app: cronjob-guardian

​
UI & Ingress

​
ui.enabled
boolean
default:"true"
Enable UI server (serves both web UI and REST API).
​
ui.port
integer
default:"8080"
UI server port.

​
UI Service Configuration

​
ui.service.type
string
default:"ClusterIP"
Service type.Valid values: ClusterIP, NodePort, LoadBalancer
​
ui.service.port
integer
default:"8080"
Service port.
​
ui.service.nodePort
integer
default:"null"
NodePort (only used if type=NodePort).
​
ui.service.annotations
object
default:"{}"
Service annotations.
ui:
  service:
    annotations:
      service.beta.kubernetes.io/aws-load-balancer-type: nlb

​
Ingress Configuration

​
ui.ingress.enabled
boolean
default:"false"
Enable Ingress for UI.
​
ui.ingress.className
string
default:""
Ingress class name.Example: "nginx", "traefik"
​
ui.ingress.annotations
object
default:"{}"
Ingress annotations.
ui:
  ingress:
    annotations:
      cert-manager.io/cluster-issuer: letsencrypt-prod
      nginx.ingress.kubernetes.io/rewrite-target: /
​
ui.ingress.hosts
array
Ingress hosts.Default:
hosts:
  - host: cronjob-guardian.local
    paths:
      - path: /
        pathType: Prefix
​
ui.ingress.tls
array
default:"[]"
Ingress TLS configuration.
ui:
  ingress:
    tls:
      - secretName: cronjob-guardian-tls
        hosts:
          - cronjob-guardian.example.com

​
OpenShift Route Configuration

​
ui.route.enabled
boolean
default:"false"
Enable OpenShift Route.
​
ui.route.host
string
default:""
Route hostname. Leave empty for auto-generation.
​
ui.route.path
string
default:""
Route path.
​
ui.route.annotations
object
default:"{}"
Route annotations.
​
ui.route.tls.enabled
boolean
default:"true"
Enable TLS termination.
​
ui.route.tls.termination
string
default:"edge"
TLS termination type.Valid values: edge, passthrough, reencrypt
​
ui.route.tls.insecureEdgeTerminationPolicy
string
default:"Redirect"
Insecure edge termination policy.Valid values: Allow, Redirect, None

​
Metrics & Monitoring

​
metrics.enabled
boolean
default:"true"
Enable Prometheus metrics endpoint.
​
metrics.bindAddress
string
default:":8443"
Metrics bind address.
​
metrics.secure
boolean
default:"true"
Enable HTTPS for metrics.
​
metrics.certPath
string
default:""
Path to TLS certificate directory.
​
metrics.certName
string
default:"tls.crt"
TLS certificate file name.
​
metrics.certKey
string
default:"tls.key"
TLS key file name.
​
probes.bindAddress
string
default:":8081"
Health probes bind address.

​
ServiceMonitor Configuration

​
serviceMonitor.enabled
boolean
default:"false"
Enable Prometheus Operator ServiceMonitor.
​
serviceMonitor.labels
object
default:"{}"
ServiceMonitor labels for selector matching.
serviceMonitor:
  labels:
    release: prometheus
​
serviceMonitor.interval
string
default:"30s"
Scrape interval.
​
serviceMonitor.scrapeTimeout
string
default:"10s"
Scrape timeout.
​
serviceMonitor.metricRelabelings
array
default:"[]"
Metric relabelings.
serviceMonitor:
  metricRelabelings:
    - sourceLabels: [__name__]
      regex: 'go_.*'
      action: drop
​
serviceMonitor.relabelings
array
default:"[]"
Relabelings.

​
High Availability

​
leaderElection.enabled
boolean
default:"false"
Enable leader election. Required for multiple replicas.
​
leaderElection.leaseDuration
duration
default:"15s"
Leader lease duration.
​
leaderElection.renewDeadline
duration
default:"10s"
Leader renew deadline.
​
leaderElection.retryPeriod
duration
default:"2s"
Leader retry period.

​
Webhook Configuration

​
webhook.certPath
string
default:""
Path to TLS certificate directory for webhook server.
​
webhook.certName
string
default:"tls.crt"
TLS certificate file name.
​
webhook.certKey
string
default:"tls.key"
TLS key file name.
​
webhook.enableHTTP2
boolean
default:"false"
Enable HTTP/2 for webhook server.

​
Complete Examples

​
Basic Installation

# values.yaml
replicaCount: 1

config:
  logLevel: info
  storage:
    type: sqlite

persistence:
  enabled: true
  size: 5Gi

ui:
  enabled: true
  ingress:
    enabled: true
    className: nginx
    hosts:
      - host: guardian.example.com
        paths:
          - path: /
            pathType: Prefix
    tls:
      - secretName: guardian-tls
        hosts:
          - guardian.example.com

​
High Availability with PostgreSQL

# values.yaml
replicaCount: 3

config:
  logLevel: info
  
  storage:
    type: postgres
    postgres:
      host: postgres.database.svc.cluster.local
      port: 5432
      database: cronjob_guardian
      username: guardian
      existingSecret: postgres-credentials
      existingSecretKey: password
      sslMode: require
      pool:
        maxIdleConns: 20
        maxOpenConns: 200
    logStorageEnabled: true
    eventStorageEnabled: true
    maxLogSizeKB: 200
  
  historyRetention:
    defaultDays: 60
    maxDays: 180
  
  rateLimits:
    maxAlertsPerMinute: 100
    burstLimit: 20

leaderElection:
  enabled: true

persistence:
  enabled: false  # Not needed with PostgreSQL

resources:
  limits:
    cpu: 1000m
    memory: 512Mi
  requests:
    cpu: 100m
    memory: 128Mi

affinity:
  podAntiAffinity:
    preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 100
        podAffinityTerm:
          labelSelector:
            matchLabels:
              app.kubernetes.io/name: cronjob-guardian
          topologyKey: kubernetes.io/hostname

serviceMonitor:
  enabled: true
  labels:
    release: prometheus
  interval: 30s

ui:
  enabled: true
  service:
    type: ClusterIP
  ingress:
    enabled: true
    className: nginx
    annotations:
      cert-manager.io/cluster-issuer: letsencrypt-prod
    hosts:
      - host: guardian.example.com
        paths:
          - path: /
            pathType: Prefix
    tls:
      - secretName: guardian-tls
        hosts:
          - guardian.example.com

​
Enterprise Configuration

# values.yaml - Enterprise deployment
replicaCount: 5

image:
  repository: ghcr.io/illeniumstudios/cronjob-guardian
  pullPolicy: IfNotPresent
  tag: "1.0.0"

imagePullSecrets:
  - name: registry-credentials

serviceAccount:
  create: true
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/guardian

podSecurityContext:
  runAsNonRoot: true
  runAsUser: 65532
  fsGroup: 65532

securityContext:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
      - ALL
  readOnlyRootFilesystem: true

config:
  logLevel: info
  
  scheduler:
    deadManSwitchInterval: 30s
    slaRecalculationInterval: 2m
    pruneInterval: 30m
    startupGracePeriod: 1m
  
  storage:
    type: postgres
    postgres:
      host: postgres-ha.database.svc.cluster.local
      port: 5432
      database: guardian_prod
      username: guardian
      existingSecret: postgres-credentials
      sslMode: verify-full
      pool:
        maxIdleConns: 50
        maxOpenConns: 500
        connMaxLifetime: 30m
        connMaxIdleTime: 5m
    logStorageEnabled: true
    eventStorageEnabled: true
    maxLogSizeKB: 500
    logRetentionDays: 90
  
  historyRetention:
    defaultDays: 90
    maxDays: 365
  
  rateLimits:
    maxAlertsPerMinute: 200
    burstLimit: 50
    defaultSuppressDuplicatesFor: 30m

leaderElection:
  enabled: true
  leaseDuration: 30s
  renewDeadline: 20s
  retryPeriod: 5s

persistence:
  enabled: false

resources:
  limits:
    cpu: 2000m
    memory: 1Gi
  requests:
    cpu: 200m
    memory: 256Mi

nodeSelector:
  kubernetes.io/os: linux
  node-role.kubernetes.io/worker: ""

tolerations:
  - key: dedicated
    operator: Equal
    value: monitoring
    effect: NoSchedule

affinity:
  podAntiAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
      - labelSelector:
          matchLabels:
            app.kubernetes.io/name: cronjob-guardian
        topologyKey: kubernetes.io/hostname

serviceMonitor:
  enabled: true
  labels:
    release: prometheus-operator
  interval: 15s
  scrapeTimeout: 10s

ui:
  enabled: true
  service:
    type: ClusterIP
    annotations:
      service.beta.kubernetes.io/aws-load-balancer-internal: "true"
  ingress:
    enabled: true
    className: nginx
    annotations:
      cert-manager.io/cluster-issuer: letsencrypt-prod
      nginx.ingress.kubernetes.io/auth-type: basic
      nginx.ingress.kubernetes.io/auth-secret: guardian-basic-auth
    hosts:
      - host: guardian.prod.example.com
        paths:
          - path: /
            pathType: Prefix
    tls:
      - secretName: guardian-prod-tls
        hosts:
          - guardian.prod.example.com

Build docs developers (and LLMs) love

Get started for freeTalk to us