AI ITOps Triage for Jira Issues with RAG

id: ai-jira-itops-triage
namespace: company.team
description: |
  Triage Jira issues with an LLM grounded in your ops playbook via RAG,
  then post the proposed resolution back to the issue as a comment.

variables:
  jira_base_url: https://your-domain.atlassian.net

tasks:
  - id: log_issue
    type: io.kestra.plugin.core.debug.Return
    description: Extract the fields we care about from the Jira webhook payload.
    format: |
      {{ trigger.body | jq('{
        id: .issue.id,
        key: .issue.key,
        summary: .issue.fields.summary,
        description: .issue.fields.description,
        user_name: .user.displayName,
        user_email: .user.emailAddress,
        priority_name: .issue.fields.priority.name
      }') }}

  - id: ingest_kb
    type: io.kestra.plugin.ai.rag.IngestDocument
    description: Embed the ops playbook into the Kestra KV store.
    embeddings:
      type: io.kestra.plugin.ai.embeddings.KestraKVStore
    provider:
      type: io.kestra.plugin.ai.provider.GoogleGemini
      modelName: gemini-embedding-001
    documentSplitter:
      splitter: "PARAGRAPH"
      maxOverlapSizeInChars: 512
      maxSegmentSizeInChars: 1024
    drop: true
    fromDocuments:
      - content: |
          # Ops and Access Playbooks (replace with your real knowledge base)

          ## Web Service Outage (Nginx 502)
          Symptoms: portals intermittently return 502 Bad Gateway, nginx -t OK,
          backend unreachable. Triage: check systemctl status nginx, validate
          config, tail journalctl -u nginx -n 100, restart nginx as low-risk
          remediation, verify with curl expecting HTTP 200.
          Guardrails: restart only if scoped to one host, skip during deploy
          windows, always log the action in Jira before and after execution.

          ## New User Provisioning (Internal Tools)
          Symptoms: unauthorized or access denied on GitLab, VPN, or Grafana.
          Steps: validate identity via HR system or LDAP, check the account
          with ldapsearch, run the provisioning workflow, add the user to the
          requested system, confirm login or send a password reset link.
          Guardrails: only auto-provision corporate email domains, audit new
          accounts weekly.

          ## API Token Rotation Request
          Symptoms: expired token alerts or 401 Unauthorized on API calls.
          Steps: validate the requester's team and scope, revoke the previous
          token, issue a new one from the vault with a 90 day TTL, update
          dependent workflows, confirm with a sample API call.
          Guardrails: one active token per service per user, rotate every
          90 days, log the token ID but never the value.

          ## Disk Usage High (Linux)
          Steps: run df -h for partitions above 85 percent, find large files
          with du, rotate logs with logrotate and journalctl vacuum, archive
          app logs to S3, verify free space.
          Guardrails: never delete /var/lib or /etc manually, escalate if
          usage stays above 90 percent after cleanup.

  - id: invoke_ai
    type: io.kestra.plugin.ai.rag.ChatCompletion
    description: Ask the model for triage steps grounded in the playbook.
    chatProvider:
      type: io.kestra.plugin.ai.provider.GoogleGemini
      modelName: gemini-3.5-flash-lite
    embeddingProvider:
      type: io.kestra.plugin.ai.provider.GoogleGemini
      modelName: gemini-embedding-001
    embeddings:
      type: io.kestra.plugin.ai.embeddings.KestraKVStore
    systemMessage: |
      You are an SRE assistant. Use the provided knowledge base and issue
      to propose concise triage steps.
      - Always include "Risk", "Steps", and "Verification".
      - Structure your response in readable markdown sections with newlines.
    prompt: |
      Issue JSON:
      {{ outputs.log_issue.value }}

      Produce:
      - concise_summary
      - work_notes (bullet list)
      - proposed_resolution (one paragraph)

  - id: log_ai_resp
    type: io.kestra.plugin.core.log.Log
    description: Keep the AI proposal in the execution logs.
    message: "{{ outputs.invoke_ai.textOutput ?? 'n/a' }}"

  - id: update_comment
    type: io.kestra.plugin.core.http.Request
    description: Post the triage proposal back to the Jira issue as a comment.
    method: POST
    uri: "{{ vars.jira_base_url }}/rest/api/3/issue/{{ outputs.log_issue.value |
      jq('.key') | first }}/comment"
    headers:
      Accept: "application/json"
      Authorization: "Basic {{ (secret('JIRA_EMAIL') ~ ':' ~ secret('JIRA_API_TOKEN'))
        | base64encode }}"
    body: |
      {
        "body": {
          "type": "doc",
          "version": 1,
          "content": [{
            "type": "paragraph",
            "content": [{
              "type": "text",
              "text": {{ (outputs.invoke_ai.textOutput ?? 'n/a') | json }}
            }]
          }]
        }
      }

triggers:
  - id: jira_issue
    type: io.kestra.plugin.core.trigger.Webhook
    description: A Jira automation rule or webhook posts new issues here.
    key: "{{ secret('JIRA_WEBHOOK_KEY') }}"

pluginDefaults:
  - type: io.kestra.plugin.ai.provider.GoogleGemini
    values:
      apiKey: "{{ secret('GEMINI_API_KEY') }}"