The required-scc annotation should be on the template that gets applied to the pod itself, not the job.

jacobsee · jacobsee · commit be4bc3fd4238 · 2025-03-07T17:26:38.000-08:00
diff --git a/pkg/resource/prunercronjob.go b/pkg/resource/prunercronjob.go
@@ -175,7 +175,7 @@ done
 		},
 	}
 	cj.Spec.JobTemplate.Labels = map[string]string{"created-by": gcj.GetName()}
-	cj.Spec.JobTemplate.Annotations = map[string]string{securityv1.RequiredSCCAnnotation: "restricted-v2"}
+	cj.Spec.JobTemplate.Spec.Template.Annotations = map[string]string{securityv1.RequiredSCCAnnotation: "restricted-v2"}
 	return cj, nil
 }
 

Original file line number	Diff line number	Diff line change
`@@ -175,7 +175,7 @@ done`
`175`	`175`	`},`
`176`	`176`	`}`
`177`	`177`	`cj.Spec.JobTemplate.Labels = map[string]string{"created-by": gcj.GetName()}`
`178`		`- cj.Spec.JobTemplate.Annotations = map[string]string{securityv1.RequiredSCCAnnotation: "restricted-v2"}`
	`178`	`+ cj.Spec.JobTemplate.Spec.Template.Annotations = map[string]string{securityv1.RequiredSCCAnnotation: "restricted-v2"}`
`179`	`179`	`return cj, nil`
`180`	`180`	`}`
`181`	`181`