Skip to main content

CronJob Selectors

CronJobMonitor resources use selectors to define which CronJobs to monitor. This page covers all selection patterns.

Overview​

Selectors can match CronJobs by:

  • Labels: Standard Kubernetes label matching
  • Names: Explicit name lists
  • Namespaces: Single, multiple, or all namespaces

Label Selectors​

matchLabels​

Match CronJobs with specific labels:

spec:
  selector:
    matchLabels:
      tier: critical
      app: backup

This matches CronJobs that have both labels.

matchExpressions​

Use operators for complex matching:

spec:
  selector:
    matchExpressions:
      - key: tier
        operator: In
        values:
          - critical
          - high
      - key: team
        operator: Exists

Operators:

OperatorDescription
InValue is in the list
NotInValue is not in the list
ExistsLabel key exists (any value)
DoesNotExistLabel key does not exist

Combined Labels and Expressions​

spec:
  selector:
    matchLabels:
      monitored: "true"
    matchExpressions:
      - key: tier
        operator: In
        values:
          - critical
          - high
      - key: experimental
        operator: DoesNotExist

All conditions must match.

Name-based Selection​

matchNames​

Explicitly list CronJob names:

spec:
  selector:
    matchNames:
      - daily-backup
      - weekly-report
      - hourly-sync

Combining with Labels​

spec:
  selector:
    matchLabels:
      type: report
    matchNames:
      - quarterly-audit  # Also include this even without label

Namespace Selection​

Single Namespace (Default)​

By default, monitors watch their own namespace:

apiVersion: guardian.illenium.net/v1alpha1
kind: CronJobMonitor
metadata:
  name: my-monitor
  namespace: production     # Only watches CronJobs in 'production'
spec:
  selector: {}

Explicit Namespaces​

Watch multiple namespaces:

spec:
  namespaces:
    - production
    - staging
    - batch-jobs
  selector:
    matchLabels:
      monitored: "true"

Namespace Selector​

Select namespaces by label:

spec:
  namespaceSelector:
    matchLabels:
      environment: production
  selector:
    matchLabels:
      tier: critical

This watches CronJobs in namespaces labeled environment: production.

All Namespaces​

Watch cluster-wide:

spec:
  selector:
    allNamespaces: true
    matchLabels:
      global-monitoring: "true"
caution

Cluster-wide monitoring requires appropriate RBAC permissions.

Empty Selector​

An empty selector matches all CronJobs in scope:

spec:
  selector: {}   # Matches ALL CronJobs in the namespace

Complete Examples​

All in Namespace​

all-in-namespace.yaml
apiVersion: guardian.illenium.net/v1alpha1
kind: CronJobMonitor
metadata:
  name: all-jobs
  namespace: production
spec:
  selector: {}

  deadManSwitch:
    enabled: true
    autoFromSchedule:
      enabled: true

  alerting:
    channelRefs:
      - name: team-slack

Critical Tier Only​

critical-only.yaml
apiVersion: guardian.illenium.net/v1alpha1
kind: CronJobMonitor
metadata:
  name: critical-jobs
  namespace: production
spec:
  selector:
    matchLabels:
      tier: critical

  sla:
    minSuccessRate: 99.9
    windowDays: 30

  alerting:
    channelRefs:
      - name: pagerduty-critical
    severityOverrides:
      jobFailed: critical

Multi-Namespace by Team​

team-jobs.yaml
apiVersion: guardian.illenium.net/v1alpha1
kind: CronJobMonitor
metadata:
  name: data-team-jobs
  namespace: cronjob-guardian
spec:
  namespaces:
    - data-pipelines
    - analytics
    - ml-training

  selector:
    matchLabels:
      team: data

  sla:
    minSuccessRate: 95
    windowDays: 14

  alerting:
    channelRefs:
      - name: data-team-slack

Cluster-Wide Critical​

cluster-critical.yaml
apiVersion: guardian.illenium.net/v1alpha1
kind: CronJobMonitor
metadata:
  name: cluster-critical
  namespace: cronjob-guardian
spec:
  selector:
    allNamespaces: true
    matchLabels:
      tier: critical
    matchExpressions:
      - key: skip-monitoring
        operator: DoesNotExist

  deadManSwitch:
    enabled: true
    autoFromSchedule:
      enabled: true
      missedScheduleThreshold: 1

  sla:
    minSuccessRate: 99.9
    windowDays: 30

  alerting:
    channelRefs:
      - name: pagerduty-critical
      - name: ops-slack

Production Namespaces by Label​

prod-namespaces.yaml
apiVersion: guardian.illenium.net/v1alpha1
kind: CronJobMonitor
metadata:
  name: production-jobs
  namespace: cronjob-guardian
spec:
  namespaceSelector:
    matchLabels:
      environment: production

  selector:
    matchLabels:
      monitored: "true"

  deadManSwitch:
    enabled: true
    autoFromSchedule:
      enabled: true

  alerting:
    channelRefs:
      - name: ops-slack

Selector Priority​

When multiple conditions are specified:

  1. All namespace conditions must match (namespaces, namespaceSelector, allNamespaces)
  2. Within matched namespaces, all selector conditions must match
  3. matchLabels AND matchExpressions AND matchNames all apply

Best Practices​

  1. Start specific, expand later: Begin with explicit names, then generalize to labels
  2. Use consistent labeling: Establish a labeling convention for monitoring
  3. Test selectors: Verify which CronJobs match before enabling strict SLAs
  4. Document selection logic: Comment your monitors explaining what they target
  5. Avoid over-broad selectors: Don't monitor everything cluster-wide without good reason