<p>I wanted to know is it possible to have a job in Kubernetes that will run every hour, and will delete certain pods. I need this as a temporary
stop gap to fix an issue.</p>

<p>Use a CronJob (<a href="https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/" rel="nofollow noreferrer">1</a>, <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.12/#cronjob-v1beta1-batch" rel="nofollow noreferrer">2</a>) to run the Job every hour.</p>

<p>K8S API can be accessed from Pod (<a href="https://kubernetes.io/docs/tasks/administer-cluster/access-cluster-api/" rel="nofollow noreferrer">3</a>) with proper permissions. When a Pod is created a <code>default ServiceAccount</code> is assigned to it (<a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#use-the-default-service-account-to-access-the-api-server" rel="nofollow noreferrer">4</a>) by default. The <code>default ServiceAccount</code> has no RoleBinding and hence the <code>default ServiceAccount</code> and also the Pod has no permissions to invoke the API.</p>

<p>If a role (with permissions) is created and mapped to the <code>default ServiceAccount</code>, then all the Pods by default will get those permissions. So, it's better to create a new ServiceAccount instead of modifying the <code>default ServiceAccount</code>.</p>

<p>So, here are steps for RBAC (<a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="nofollow noreferrer">5</a>)</p>

<ul>
<li>Create a ServiceAccount</li>
<li>Create a Role with proper permissions (deleting pods)</li>
<li>Map the ServiceAccount with the Role using RoleBinding</li>
<li>Use the above ServiceAccount in the Pod definition</li>
<li>Create a pod/container with the code/commands to delete the pods</li>
</ul>

<p>I know it's a bit confusing, but that's the way K8S works.</p>
