Skip to main content

Overriding the active deadline for run-once pods

You can use the Run Once Duration Override Operator to set a maximum active deadline for run-once pods in your cluster.

By enabling the run-once duration override on a namespace, all future run-once pods created or updated in that namespace have their activeDeadlineSeconds field set to the value specified by the Run Once Duration Override Operator.

note

If both the run-once pod and the Run Once Duration Override Operator have their activeDeadlineSeconds value set, the lower of the two values is used.

Install the Run Once Duration Override Operator​

Install the Run Once Duration Override Operator by using the web console to create the required namespace, install the Operator from the software catalog, and create a RunOnceDurationOverride instance.

Prerequisites

  • You have access to the cluster with cluster-admin privileges.
  • You have access to the OpenShift Container Platform web console.

Procedure

  1. Log in to the OpenShift Container Platform web console.
  2. Create the required namespace for the Run Once Duration Override Operator.
    1. Navigate to Administration → Namespaces and click Create Namespace.
    2. Enter openshift-run-once-duration-override-operator in the Name field and click Create.
  3. Install the Run Once Duration Override Operator.
    1. Navigate to Ecosystem → Software Catalog.
    2. Enter Run Once Duration Override Operator into the filter box.
    3. Select the Run Once Duration Override Operator and click Install.
    4. On the Install Operator page:
      1. The Update channel is set to stable, which installs the latest stable release of the Run Once Duration Override Operator.
      2. Select A specific namespace on the cluster.
      3. Choose openshift-run-once-duration-override-operator from the dropdown menu under Installed namespace.
      4. Select an Update approval strategy.
        • The Automatic strategy allows Operator Lifecycle Manager (OLM) to automatically update the Operator when a new version is available.
        • The Manual strategy requires a user with appropriate credentials to approve the Operator update.
      5. Click Install.
  4. Create a RunOnceDurationOverride instance.
    1. From the Ecosystem → Installed Operators page, click Run Once Duration Override Operator.
    2. Select the Run Once Duration Override tab and click Create RunOnceDurationOverride.
    3. Edit the settings as necessary. Under the runOnceDurationOverride section, you can update the spec.activeDeadlineSeconds value, if required. The predefined value is 3600 seconds, or 1 hour.
    4. Click Create.

Verification

  1. Log in to the OpenShift CLI.

  2. Verify all pods are created and running properly.

    $ oc get pods -n openshift-run-once-duration-override-operator
    Example output
    NAME                                                   READY   STATUS    RESTARTS   AGE
    run-once-duration-override-operator-7b88c676f6-lcxgc   1/1     Running   0          7m46s
    runoncedurationoverride-62blp                          1/1     Running   0          41s
    runoncedurationoverride-h8h8b                          1/1     Running   0          41s
    runoncedurationoverride-tdsqk                          1/1     Running   0          41s

Enable the run-once duration override on a namespace​

Enable the run-once duration override on a namespace by adding the runoncedurationoverrides.admission.runoncedurationoverride.openshift.io/enabled=true label to the namespace.

Prerequisites

  • The Run Once Duration Override Operator is installed.

Procedure

  1. Log in to the OpenShift CLI.

  2. Add the label to enable the run-once duration override to your namespace:

    $ oc label namespace <namespace> \
        runoncedurationoverrides.admission.runoncedurationoverride.openshift.io/enabled=true

    Replace with the namespace to enable the run-once duration override on.

    After you enable the run-once duration override on this namespace, future run-once pods that are created in this namespace will have their activeDeadlineSeconds field set to the override value from the Run Once Duration Override Operator. Existing pods in this namespace will also have their activeDeadlineSeconds value set when they are updated next.

Verification

  1. Create a test run-once pod in the namespace that you enabled the run-once duration override on:

    apiVersion: v1
    kind: Pod
    metadata:
      name: example
      namespace: namespace
    spec:
      restartPolicy: Never
      securityContext:
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: busybox
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: [ALL]
          image: busybox:1.25
          command:
            - /bin/sh
            - -ec
            - |
              while sleep 5; do date; done

    where:

    metadata.namespace
    Specifies your namespace.
    spec.restartPolicy
    Specifies the restart policy. The restartPolicy must be Never or OnFailure to be a run-once pod.

  2. Verify that the pod has its activeDeadlineSeconds field set:

    $ oc get pods -n <namespace> -o yaml | grep activeDeadlineSeconds
    Example output
        activeDeadlineSeconds: 3600

Update the run-once active deadline override value​

Update the activeDeadlineSeconds field in the RunOnceDurationOverride resource to customize the override value that the operator applies to run-once pods.

Prerequisites

  • You have access to the cluster with cluster-admin privileges.
  • You have installed the Run Once Duration Override Operator.

Procedure

  1. Log in to the OpenShift CLI.

  2. Edit the RunOnceDurationOverride resource:

    $ oc edit runoncedurationoverride cluster

  3. Update the activeDeadlineSeconds field:

    apiVersion: operator.openshift.io/v1
    kind: RunOnceDurationOverride
    metadata:
    # ...
    spec:
      runOnceDurationOverride:
        spec:
          activeDeadlineSeconds: 1800
    # ...

    where:

    spec.runOnceDurationOverride.spec.activeDeadlineSeconds
    Specifies the desired time limit value, in seconds.

  4. Save the file to apply the changes. Any future run-once pods created in namespaces where the run-once duration override is enabled will have their activeDeadlineSeconds field set to this new value. Existing run-once pods in these namespaces will receive this new value when they are updated.