Docs › Kubernetes CronJob with RunVouch

Kubernetes CronJob with RunVouch

A CronJob that reports Succeeded tells you the pod exited 0. It does not tell you the schedule was missed (startingDeadlineSeconds), the job produced nothing, or an agent inside it called the same tool 400 times.

How it runs on Kubernetes CronJob

The job runs in a pod from the CronJob's jobTemplate. Put rv in the image (pip install runvouch in the Dockerfile, or copy the single file) and wrap the container command.

Store the key

Store the key in a Secret and mount it as an environment variable: env: - name: RUNVOUCH_KEY valueFrom: secretKeyRef: {name: runvouch, key: api-key}.

Wrap the job

apiVersion: batch/v1
kind: CronJob
metadata: {name: nightly-report}
spec:
  schedule: "0 2 * * *"
  concurrencyPolicy: Forbid
  jobTemplate:
    spec:
      template:
        spec:
          restartPolicy: Never
          containers:
          - name: job
            image: ghcr.io/you/report:latest
            command: ["rv", "run", "nightly-report", "--evidence-file", "/out/report.html", "--", "python", "report.py"]
            env:
            - name: RUNVOUCH_KEY
              valueFrom: {secretKeyRef: {name: runvouch, key: api-key}}

rv fails open: if RunVouch is unreachable the job still runs and you get one warning line.

Register the cadence and caps

rv agent nightly-report --cadence 24h --grace 30m --max-runtime 1h --evidence --cap-run-cost 2

Register the agent once, from anywhere with the key. Cadence is what turns a schedule that stopped into an alert; --evidence makes a run without evidence a failure; the caps pause the agent when it overspends.

What goes silent on Kubernetes CronJob

• The controller skips a run when it misses startingDeadlineSeconds; nothing pages you. RunVouch fires MISSED when cadence plus grace passes without a start.
• successfulJobsHistoryLimit keeps a few pods; a job that exits 0 with an empty output looks identical to a good one. --evidence-file makes the empty one FAILED with NO_EVIDENCE.
• With concurrencyPolicy: Allow a slow run overlaps the next; STALLED (max runtime) catches the slow one.

What RunVouch detects

Need a key? Get a free key · Stuck? contact