maintenance: expire completed one-off jobs

services/bstein-dev-home/oneoffs/portal-onboarding-e2e-test-job.yaml

@@ -9,6 +9,7 @@ metadata:
   name: portal-onboarding-e2e-test-27
   namespace: bstein-dev-home
 spec:
+  ttlSecondsAfterFinished: 3600
   suspend: true
   backoffLimit: 0
   template:

services/comms/oneoffs/bstein-force-leave-job.yaml

@@ -9,6 +9,7 @@ metadata:
   name: bstein-leave-rooms-12
   namespace: comms
 spec:
+  ttlSecondsAfterFinished: 3600
   suspend: true
   backoffLimit: 0
   template:

services/comms/oneoffs/mas-admin-client-secret-ensure-job.yaml

@@ -45,6 +45,7 @@ metadata:
   name: mas-admin-client-secret-ensure-11
   namespace: comms
 spec:
+  ttlSecondsAfterFinished: 3600
   suspend: true
   backoffLimit: 2
   template:

services/comms/oneoffs/othrys-kick-numeric-job.yaml

@@ -9,6 +9,7 @@ metadata:
   name: othrys-kick-numeric-8
   namespace: comms
 spec:
+  ttlSecondsAfterFinished: 3600
   suspend: true
   backoffLimit: 0
   template:

services/comms/oneoffs/synapse-seeder-admin-ensure-job.yaml

@@ -9,6 +9,7 @@ metadata:
   name: synapse-seeder-admin-ensure-9
   namespace: comms
 spec:
+  ttlSecondsAfterFinished: 3600
   suspend: true
   backoffLimit: 2
   template:

services/comms/oneoffs/synapse-signingkey-ensure-job.yaml

@@ -9,6 +9,7 @@ metadata:
   name: othrys-synapse-signingkey-ensure-7
   namespace: comms
 spec:
+  ttlSecondsAfterFinished: 3600
   suspend: true
   backoffLimit: 2
   template:

services/gitea/oneoffs/veles-feedback-acl-ensure-job.yaml

@@ -8,7 +8,8 @@ metadata:
   name: veles-feedback-acl-ensure-4
   namespace: gitea
 spec:
-  suspend: false
+  ttlSecondsAfterFinished: 3600
+  suspend: true
   backoffLimit: 0
   template:
     metadata:

services/keycloak/oneoffs/agent-oidc-secret-ensure-job.yaml

@@ -1,13 +1,15 @@
 # services/keycloak/oneoffs/agent-oidc-secret-ensure-job.yaml
 # One-off job for sso/agent-oidc-secret-ensure-1.
 # Purpose: ensure the agent UI oauth2-proxy OIDC client and Vault secret exist.
-# Keep this completed Job around; bump the suffix if it ever needs to be rerun.
+# Keep this manifest around; set suspend false and bump the suffix to rerun.
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: agent-oidc-secret-ensure-1
   namespace: sso
 spec:
+  ttlSecondsAfterFinished: 3600
+  suspend: true
   backoffLimit: 0
   template:
     metadata:

services/keycloak/oneoffs/ldap-federation-job.yaml

@@ -9,6 +9,7 @@ metadata:
   name: keycloak-ldap-federation-12
   namespace: sso
 spec:
+  ttlSecondsAfterFinished: 3600
   suspend: true
   backoffLimit: 2
   template:

services/keycloak/oneoffs/metis-oidc-secret-ensure-job.yaml

@@ -1,13 +1,15 @@
 # services/keycloak/oneoffs/metis-oidc-secret-ensure-job.yaml
 # One-off job for sso/metis-oidc-secret-ensure-2.
 # Purpose: ensure the Metis oauth2-proxy OIDC client and Vault secret exist.
-# Keep this completed Job around; bump the suffix if it ever needs to be rerun.
+# Keep this manifest around; set suspend false and bump the suffix to rerun.
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: metis-oidc-secret-ensure-3
   namespace: sso
 spec:
+  ttlSecondsAfterFinished: 3600
+  suspend: true
   backoffLimit: 0
   template:
     metadata:

services/keycloak/oneoffs/portal-admin-client-secret-ensure-job.yaml

@@ -9,6 +9,7 @@ metadata:
   name: keycloak-portal-admin-secret-ensure-5
   namespace: sso
 spec:
+  ttlSecondsAfterFinished: 3600
   suspend: true
   backoffLimit: 0
   template:

services/keycloak/oneoffs/portal-e2e-client-job.yaml

@@ -9,6 +9,7 @@ metadata:
   name: keycloak-portal-e2e-client-8
   namespace: sso
 spec:
+  ttlSecondsAfterFinished: 3600
   suspend: true
   backoffLimit: 0
   template:

services/keycloak/oneoffs/portal-e2e-execute-actions-email-test-job.yaml

@@ -9,6 +9,7 @@ metadata:
   name: keycloak-portal-e2e-execute-actions-email-14
   namespace: sso
 spec:
+  ttlSecondsAfterFinished: 3600
   suspend: true
   backoffLimit: 3
   template:

services/keycloak/oneoffs/portal-e2e-target-client-job.yaml

@@ -9,6 +9,7 @@ metadata:
   name: keycloak-portal-e2e-target-7
   namespace: sso
 spec:
+  ttlSecondsAfterFinished: 3600
   suspend: true
   backoffLimit: 0
   template:

services/keycloak/oneoffs/portal-e2e-token-exchange-permissions-job.yaml

@@ -9,6 +9,7 @@ metadata:
   name: keycloak-portal-e2e-token-exchange-permissions-11
   namespace: sso
 spec:
+  ttlSecondsAfterFinished: 3600
   suspend: true
   backoffLimit: 6
   template:

services/keycloak/oneoffs/portal-groups-scope-ensure-job.yaml

@@ -1,13 +1,15 @@
 # services/keycloak/oneoffs/portal-groups-scope-ensure-job.yaml
 # One-off job for sso/portal-groups-scope-ensure-1.
 # Purpose: allow bstein-dev-home to request the groups OIDC scope.
-# Keep this completed Job around; bump the suffix if it ever needs to be rerun.
+# Keep this manifest around; set suspend false and bump the suffix to rerun.
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: portal-groups-scope-ensure-1
   namespace: sso
 spec:
+  ttlSecondsAfterFinished: 3600
+  suspend: true
   backoffLimit: 0
   template:
     metadata:

services/keycloak/oneoffs/quality-oidc-secret-ensure-job.yaml

@@ -1,13 +1,15 @@
 # services/keycloak/oneoffs/quality-oidc-secret-ensure-job.yaml
 # One-off job for sso/quality-oidc-secret-ensure-1.
 # Purpose: ensure the SonarQube oauth2-proxy OIDC client and Vault secret exist.
-# Keep this completed Job around; bump the suffix if it ever needs to be rerun.
+# Keep this manifest around; set suspend false and bump the suffix to rerun.
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: quality-oidc-secret-ensure-1
   namespace: sso
 spec:
+  ttlSecondsAfterFinished: 3600
+  suspend: true
   backoffLimit: 0
   template:
     metadata:

services/keycloak/oneoffs/realm-settings-job.yaml

@@ -9,7 +9,8 @@ metadata:
   name: keycloak-realm-settings-37
   namespace: sso
 spec:
-  suspend: false
+  ttlSecondsAfterFinished: 3600
+  suspend: true
   backoffLimit: 0
   template:
     metadata:

services/keycloak/oneoffs/soteria-oidc-secret-ensure-job.yaml

@@ -1,13 +1,15 @@
 # services/keycloak/oneoffs/soteria-oidc-secret-ensure-job.yaml
 # One-off job for sso/soteria-oidc-secret-ensure-1.
 # Purpose: ensure the Soteria oauth2-proxy OIDC client and Vault secret exist.
-# Keep this completed Job around; bump the suffix if it ever needs to be rerun.
+# Keep this manifest around; set suspend false and bump the suffix to rerun.
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: soteria-oidc-secret-ensure-1
   namespace: sso
 spec:
+  ttlSecondsAfterFinished: 3600
+  suspend: true
   backoffLimit: 0
   template:
     metadata:

services/keycloak/oneoffs/user-overrides-job.yaml

@@ -9,6 +9,7 @@ metadata:
   name: keycloak-user-overrides-9
   namespace: sso
 spec:
+  ttlSecondsAfterFinished: 3600
   suspend: true
   backoffLimit: 0
   template:

services/mailu/oneoffs/mailu-sync-job.yaml

@@ -9,6 +9,7 @@ metadata:
   name: mailu-sync-9
   namespace: mailu-mailserver
 spec:
+  ttlSecondsAfterFinished: 3600
   suspend: true
   template:
     metadata:

services/maintenance/oneoffs/k3s-traefik-cleanup-job.yaml

@@ -9,6 +9,7 @@ metadata:
   name: k3s-traefik-cleanup-2
   namespace: maintenance
 spec:
+  ttlSecondsAfterFinished: 3600
   suspend: true
   backoffLimit: 1
   template:

services/monitoring/oneoffs/grafana-org-bootstrap.yaml

@@ -9,6 +9,7 @@ metadata:
   name: grafana-org-bootstrap-3
   namespace: monitoring
 spec:
+  ttlSecondsAfterFinished: 3600
   suspend: true
   backoffLimit: 2
   template:

services/monitoring/oneoffs/grafana-user-dedupe-job.yaml

@@ -9,6 +9,7 @@ metadata:
   name: grafana-user-dedupe-api-v8
   namespace: monitoring
 spec:
+  ttlSecondsAfterFinished: 3600
   suspend: true
   backoffLimit: 1
   template: