JobJanitor - Kubernetes completed Job cleaner

id: jobjanitor
namespace: company.team
description: Finds completed Kubernetes Jobs older than the retention window,
  deletes them, and reports the cleanup on Slack.

labels:
  project: jobjanitor
  team: platform

inputs:
  - id: namespace
    type: STRING
    displayName: "Namespace"
    description: the namespace whose jobs to clean
    defaults: default
  - id: retention_days
    type: INT
    displayName: "Retention (days)"
    description: completed jobs older than this many days get deleted
    defaults: 7
  - id: dry_run
    type: BOOL
    displayName: "Dry run"
    description: when true, only reports what would be deleted without deleting anything
    defaults: true
  - id: slack_webhook
    type: STRING
    displayName: "Slack Webhook URL"
    description: Incoming webhook URL of the Slack channel for the cleanup report

triggers:
  - id: schedule
    type: io.kestra.plugin.core.trigger.Schedule
    description: cleans up old completed jobs every Sunday morning
    cron: "0 8 * * 0"
    timezone: UTC
    inputs:
      namespace: default
      retention_days: 7
      dry_run: true
      slack_webhook: "{{ secret('SLACK_WEBHOOK') }}"

tasks:
  - id: list_jobs
    type: io.kestra.plugin.scripts.shell.Commands
    description: lists all jobs in the namespace as JSON
    taskRunner:
      type: io.kestra.plugin.scripts.runner.docker.Docker
      user: "0"
    containerImage: bitnami/kubectl
    inputFiles:
      client.crt: "{{ secret('CLIENT_CRT') }}"
      client.key: "{{ secret('CLIENT_KEY') }}"
    commands:
      - kubectl get jobs -n {{ inputs.namespace }} -o json
        --client-certificate=client.crt --client-key=client.key --server={{
        secret('MASTERURL') }} --insecure-skip-tls-verify=true > jobs.json
    outputFiles:
      - jobs.json

  - id: find_stale
    type: io.kestra.plugin.scripts.python.Script
    description: finds completed jobs older than the retention window
    taskRunner:
      type: io.kestra.plugin.scripts.runner.docker.Docker
      user: "0"
    containerImage: python:3.11
    dependencies:
      - kestra
    outputFiles:
      - stale.txt
    script: |
      import json
      from datetime import datetime, timezone, timedelta
      from kestra import Kestra

      namespace = """{{ inputs.namespace }}"""
      retention = int("""{{ inputs.retention_days }}""")
      dry_run = """{{ inputs.dry_run }}""".strip().lower() == "true"

      with open("""{{ outputs.list_jobs.outputFiles['jobs.json'] }}""") as f:
          jobs = json.load(f)['items']

      cutoff = datetime.now(timezone.utc) - timedelta(days=retention)

      stale = []
      for job in jobs:
          status = job.get('status', {})
          # only successful completions; failed jobs stay for investigation
          completed = any(
              c.get('type') == 'Complete' and c.get('status') == 'True'
              for c in status.get('conditions', [])
          )
          if not completed:
              continue
          done_at_raw = status.get('completionTime')
          if not done_at_raw:
              continue
          done_at = datetime.fromisoformat(done_at_raw.replace('Z', '+00:00'))
          if done_at < cutoff:
              age = (datetime.now(timezone.utc) - done_at).days
              stale.append({'name': job['metadata']['name'], 'age_days': age})

      # one name per line for the delete step to read
      with open('stale.txt', 'w') as f:
          for s in stale:
              f.write(s['name'] + '\n')

      if dry_run:
          title = f"*JobJanitor - dry run in '{namespace}'*"
          tail = "would delete {n} job(s). set dry_run to false to actually clean."
      else:
          title = f"*JobJanitor - cleaned '{namespace}'*"
          tail = "deleted {n} job(s)."
      lines = [title, ""]
      for s in stale:
          lines.append(f"- *{s['name']}*: completed {s['age_days']} days ago")
      lines.append("")
      lines.append(tail.format(n=len(stale)))
      summary_text = "\n".join(lines)

      Kestra.outputs({
          'stale': stale,
          'count': len(stale),
          'summary_text': summary_text,
      })

  - id: maybe_clean
    type: io.kestra.plugin.core.flow.If
    description: only acts when there is something stale to report
    condition: "{{ outputs.find_stale.vars.count > 0 }}"
    then:
      - id: do_clean
        type: io.kestra.plugin.core.flow.If
        description: deletes the stale jobs, live mode only
        condition: "{{ inputs.dry_run == false }}"
        then:
          - id: delete_jobs
            type: io.kestra.plugin.scripts.shell.Commands
            description: deletes each stale job by name
            taskRunner:
              type: io.kestra.plugin.scripts.runner.docker.Docker
              user: "0"
            containerImage: bitnami/kubectl
            inputFiles:
              client.crt: "{{ secret('CLIENT_CRT') }}"
              client.key: "{{ secret('CLIENT_KEY') }}"
            commands:
              - |
                while read -r name; do
                  if [ -n "$name" ]; then
                    kubectl delete job "$name" -n {{ inputs.namespace }} --client-certificate=client.crt --client-key=client.key --server={{ secret('MASTERURL') }} --insecure-skip-tls-verify=true
                  fi
                done < {{ outputs.find_stale.outputFiles['stale.txt'] }}
      - id: send_summary
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        description: posts the cleanup summary to Slack
        url: "{{ inputs.slack_webhook }}"
        messageText: "{{ outputs.find_stale.vars.summary_text }}"