# Do not use one CronJob’s concurrency policy as a global lock

> Different scheduled jobs can still overlap even when each forbids its own concurrent runs.

- Canonical URL: https://update.dsesecurity.com/updates/do-not-use-one-cronjob-s-concurrency-policy-as-a-global-lock/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:14:55+00:00
- Modified: 2026-10-20T18:34:32+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: IT, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Different scheduled jobs can still overlap even when each forbids its own concurrent runs.

## Potentially affected

Review concurrency within one CronJob and coordination between separate schedules.

## DSE recommendation

DSE recommends identifying all writers to the same data before selecting a concurrency mode.

## Article

Different scheduled jobs can still overlap even when each forbids its own concurrent runs.

## Source facts

Kubernetes CronJob concurrencyPolicy applies only to Jobs created by that same CronJob. Forbid skips a new run when the preceding run is unfinished; Replace substitutes a new run. Jobs from separate CronJobs may run concurrently. Scheduling is approximate, and Kubernetes recommends idempotent Jobs because circumstances can produce duplicate or missed creation.

Source: [Kubernetes documentation — CronJob](https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/).

## Applicability

Review concurrency within one CronJob and coordination between separate schedules.

## DSE recommendation

DSE recommends identifying all writers to the same data before selecting a concurrency mode. Use application-level coordination when independent schedules must serialize work. Decide whether a missed schedule or interrupted prior run is acceptable, then record that choice with the task owner. Monitor completion time relative to the schedule so an unexpectedly long run does not silently skip future work. Keep recovery procedures clear about whether a manual rerun can overlap an automatically created Job and how duplicate execution is made safe.

## Verification

In a test namespace, observe a long-running task under the chosen policy and inspect which scheduled run is created, skipped, or replaced. Separately exercise two CronJobs against a safe shared target to validate the intended application-level coordination. Record the scheduled time, actual Job identity and shared-target operation identifier. Ask the task owner to decide how to recover a skipped or interrupted run without accidentally conflicting with a later scheduled execution.

## Official reference

[Kubernetes documentation — CronJob](https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/). Reviewed October 20, 2026.

## Primary reference

- Name: Kubernetes documentation — CronJob
- Authority: kubernetes.io
- URL: https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Do not use one CronJob’s concurrency policy as a global lock,” DSE Security, https://update.dsesecurity.com/updates/do-not-use-one-cronjob-s-concurrency-policy-as-a-global-lock/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.