<p><strong>Current state:</strong> From local command line, after authenticating to the cluster and setting the right context, I am using Kubectl to get list of &quot;Completed&quot; pods and then deleting them using a simple one liner. This works, but we want to automate it.</p>
<p>These are pods NOT jobs which are in &quot;Completed&quot; state. I am aware of ttl settings for jobs and but I cannot find similar settings for Pods.</p>
<p><strong>Future state:</strong> We want to be able to deploy a pod/cronjob inside a namespace which will just look for &quot;Completed&quot; pods and delete them, without using Kubectl. My understanding is that this would be a security risk if we allow a Pod to have Kubectl access. Correct me if I am wrong. That being said, how could we do it if there is a way?</p>

shan
<blockquote>
<p>We want to be able to deploy a pod/cronjob inside a namespace which will just look for &quot;Completed&quot; pods and delete them, without using Kubectl.</p>
</blockquote>
<p>This should work perfectly fine. Just make sure that the ServiceAccount has RBAC permissions to delete those pods.</p>
<blockquote>
<p>My understanding is that this would be a security risk if we allow a Pod to have Kubectl access. Correct me if I am wrong.</p>
</blockquote>
<p>This should be fine. But you should practice <em>least privilege</em> and configure the RBAC permissions to only allow just this operation, e.g. only delete Pods, and only within the same namespace.</p>
<blockquote>
<p>That being said, how could we do it if there is a way?</p>
</blockquote>
<p>This should be possible with an image containing <code>kubectl</code> and proper RBAC permissions for the ServiceAccount.</p>
