CronJob Deadline Not Configured

YAML Configuration

rule.yaml YAML

apiVersion: rules.spotter.dev/v1alpha1
kind: SpotterRule
metadata:
  name: spotter-config-007
  labels:
    severity: "medium"
    category: "config"
  annotations:
    rules.spotter.dev/title: "CronJob Deadline Not Configured"
    rules.spotter.dev/version: "1.0.0"
    rules.spotter.dev/cwe: "CWE-730"
    rules.spotter.dev/description: "A starting deadline for a CronJob is important to prevent jobs from running at unexpected times, for example, after a long downtime."
spec:
  match:
    resources:
      kubernetes:
        apiGroups:
          - "batch"
        versions:
          - "v1"
          - "v1beta1"
        kinds:
          - CronJob
        namespaces:
          include: ["*"]
          exclude: ["kube-system", "kube-public"]
        labels:
          exclude:
            rules.spotter.dev/ignore: ["true"]
  cel: |
    !has(object.spec.startingDeadlineSeconds) || object.spec.startingDeadlineSeconds <= 0
  remediation:
    manual: "Set a startingDeadlineSeconds value for the CronJob."
  references:
    - title: "CronJob Limitations"
      url: "https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/#limitations"

Test Cases

test-cases.yaml YAML

- name: insecure sample 1 should fail
  pass: false
  input: |
    apiVersion: batch/v1beta1
    kind: CronJob
    metadata:
      name: hello
    spec:
      schedule: "*/1 * * * *"
      jobTemplate:
        spec:
          template:
            spec:
              containers:
              - name: hello
                image: busybox
                args:
                - /bin/sh
                - -c
                - date; echo Hello from the Kubernetes cluster
              restartPolicy: OnFailure

- name: secure sample 1 should pass
  pass: true
  input: |
    apiVersion: batch/v1beta1
    kind: CronJob
    metadata:
      name: hello
    spec:
      schedule: "*/1 * * * *"
      startingDeadlineSeconds: 100
      jobTemplate:
        spec:
          template:
            spec:
              containers:
              - name: hello
                image: busybox
                args:
                - /bin/sh
                - -c
                - date; echo Hello from the Kubernetes cluster
              restartPolicy: OnFailure

Validating Admission Policy

validating-admission-policy.yaml YAML

# VAP export for spotter-config-007
# Generated from Spotter rule
apiVersion: admissionregistration.k8s.io/v1beta1
kind: ValidatingAdmissionPolicy
metadata:
  name: spotter-config-007
spec:
  # Add your VAP configuration here

Rule Metadata

CronJob Deadline Not Configured

YAML Configuration

Test Cases

Validating Admission Policy

Rule Metadata

Rule Information

Tags & Compliance

Compliance Standards

General Tags

Spotter Hub