Clean Up License-Dependent VM Assets Automatically

When a software license is revoked or deleted, the machines provisioned against it become compliance liabilities that usually linger in inventories for months. This blueprint closes that gap: it purges io.kestra.plugin.ee.assets.VM assets whose metadata references a deleted license, keeping the Kestra asset catalog honest. It runs in two ways, automatically as a downstream reaction to a license deletion flow, or on demand through a secured webhook that a monitoring tool can call.

How it works

1. The license input is a dynamic SELECT whose expression lists all io.kestra.plugin.ee.assets.VM.License asset ids via the assets() function and jq('.[].id'), so manual runs pick from real catalog entries.
2. The on_license_deletion trigger (io.kestra.plugin.core.trigger.Flow) uses preconditions to fire whenever the delete_license flow in company.team finishes in SUCCESS, mapping {{ trigger.outputs.licenseId }} into the license input. Flow chaining without hardcoded couplings.
3. The webhook trigger (io.kestra.plugin.core.trigger.Webhook) offers an HTTP entry point, secured with the CLEANUP_WEBHOOK_KEY secret, for tools like Dynatrace to request cleanups.
4. The purge_dependent_vms task (io.kestra.plugin.kestra.ee.assets.PurgeAssets) deletes VM assets matching two conditions: an endDate of {{ now() | dateAdd(-90, 'DAYS') }} so only assets older than 90 days are touched, and a metadataQuery requiring licenseId to EQUAL_TO the given license. allowFailure: true keeps a partial purge from failing the whole run.

What you get

• Automatic catalog hygiene: dependent VM assets disappear when their license does.
• A safety window: only assets older than 90 days are purged, protecting recent machines.
• Two entry points, event-driven flow chaining and secured webhook, from one definition.
• An audit trail of every purge with the exact license and matching criteria.

Who it's for

• IT asset managers enforcing license compliance across VM fleets.
• Platform teams chaining lifecycle flows, create, license, delete, clean up, with Kestra triggers.
• Operations teams that want monitoring tools to drive remediation directly.

Why orchestrate this with Kestra

License systems and hypervisors do not talk to each other, so revocations rarely propagate to inventories. Kestra's Flow trigger turns the license deletion itself into the event that drives cleanup, with preconditions scoping it to exactly the right upstream flow and state. The PurgeAssets task then operates on the catalog with typed filters and metadata queries instead of custom scripts, and every run is logged, retryable, and auditable.

Prerequisites

• A Kestra Enterprise Edition instance (Assets are an EE feature).
• VM assets registered with a licenseId metadata field, for example by extending the asset-create-vm-with-license blueprint.
• A delete_license flow in the company.team namespace that outputs licenseId, or use the webhook and manual execution paths only.

Secrets

• CLEANUP_WEBHOOK_KEY: shared secret guarding the Webhook trigger so only authorized callers can start a purge.

Quick start

1. Add the CLEANUP_WEBHOOK_KEY secret to your Kestra instance.
2. Import this blueprint into the company.team namespace.
3. Run it manually and pick a license from the dropdown to test the purge logic.
4. Create or adapt your delete_license flow so the Flow trigger chains automatically.

How to extend

• Change the 90-day endDate window to match your compliance policy.
• Add a Pause approval step before purging in regulated environments.
• Notify a Slack channel with the list of purged asset ids after the purge.
• Broaden assetType to also purge dependent snapshots, IPs, or certificates.

Links

• Kestra Assets documentation: https://kestra.io/docs/enterprise/governance/assets
• Flow trigger docs: https://kestra.io/docs/workflow-components/triggers/flow-trigger