<commit_before>= Limit Run-once Pod Duration
{product-author}
{product-version}
:data-uri:
:icons:
:experimental:
:toc: macro
:toc-title:

toc::[]

== Overview
OpenShift relies on run-once pods to perform tasks such as link:../dev_guide/deployments.html[deploying a pod] or
link:../dev_guide/builds.html[performing a build]. Run-once pods are pods that have a RestartPolicy of `Never` or `OnFailure`.

The cluster administrator can use the `RunOnceDuration` admission control plug-in to force a limit on the time that those
run-once pods can be active. Once the time limit expires, the cluster will try to actively terminate those pods.
The main reason to have such a limit is to prevent tasks such as builds to run for an excessive amount of time.

== Configuring the RunOnceDuration plug-in

Because the `RunOnceDuration` plug-in is not enabled by default, it must be specified along with default Kubernetes admission
control plug-ins in the master-config.yaml configuration file.

The plugin configuration can also include the default active deadline for run-once pods. This deadline will be enforced globally
but can be superseded on per-project basis.

====

[source,yaml]
----
kubernetesMasterConfig:
  admissionConfig:
    pluginOrderOverride:
    - RunOnceDuration <1>
    - NamespaceLifecycle
    - OriginPodeNodeEnvironment
    - LimitRanger
    - ServiceAccount
    - SecurityContextConstraint
    - ResourceQuota
    - SCCExecRestrictions
    pluginConfig:
      RunOnceDuration:
        configuration:<commit_msg>Fix typo in RunOnceDuration example<commit_after>= Limit Run-once Pod Duration
{product-author}
{product-version}
:data-uri:
:icons:
:experimental:
:toc: macro
:toc-title:

toc::[]

== Overview
OpenShift relies on run-once pods to perform tasks such as link:../dev_guide/deployments.html[deploying a pod] or
link:../dev_guide/builds.html[performing a build]. Run-once pods are pods that have a RestartPolicy of `Never` or `OnFailure`.

The cluster administrator can use the `RunOnceDuration` admission control plug-in to force a limit on the time that those
run-once pods can be active. Once the time limit expires, the cluster will try to actively terminate those pods.
The main reason to have such a limit is to prevent tasks such as builds to run for an excessive amount of time.

== Configuring the RunOnceDuration plug-in

Because the `RunOnceDuration` plug-in is not enabled by default, it must be specified along with default Kubernetes admission
control plug-ins in the master-config.yaml configuration file.

The plugin configuration can also include the default active deadline for run-once pods. This deadline will be enforced globally
but can be superseded on per-project basis.

====

[source,yaml]
----
kubernetesMasterConfig:
  admissionConfig:
    pluginOrderOverride:
    - RunOnceDuration <1>
    - NamespaceLifecycle
    - OriginPodNodeEnvironment
    - LimitRanger
    - ServiceAccount
    - SecurityContextConstraint
    - ResourceQuota
    - SCCExecRestrictions
    pluginConfig:
      RunOnceDuration:
        configuration:
{'fraction_non_alphanumeric': 0.06703547022453628, 'fraction_numerical': 0.0006508298080052066, 'mean_word_length': 4.131886477462437, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 5, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6976011', 'n_tokens_mistral': 855, 'n_tokens_neox': 800, 'n_words': 355}