Kubernetes Deployment Restart Remediation with Protected Namespace Approval

id: k8s-deployment-restart-remediation
namespace: company.team
description: |
  Kubernetes remediation with human approval for protected namespaces. Allowed non-protected namespaces restart automatically, while protected namespaces require explicit approval before remediation.

triggers:
  - id: alert_webhook
    type: io.kestra.plugin.core.trigger.Webhook
    key: "{{ secret('K8S_REMEDIATION_WEBHOOK_KEY') }}"

variables:
  namespace: default
  deployment_name: null
  allowed_namespaces: [ "default", "staging", "production", "production-canary" ]
  protected_namespaces: [ "production", "production-canary" ]

tasks:
  - id: parse_webhook_payload
    type: io.kestra.plugin.core.execution.SetVariables
    description: Take the target from webhook parameters, falling back to defaults.
    variables:
      namespace: "{{ (trigger.parameters.namespace | first) ?? vars.namespace }}"
      deployment_name: "{{ (trigger.parameters.deployment_name | first) ??
        vars.deployment_name }}"

  - id: log_params
    type: io.kestra.plugin.core.log.Log
    message: "namespace: {{ vars.namespace }}, deployment: {{ vars.deployment_name }}"
    logLevel: DEBUG

  - id: validate_namespace
    type: io.kestra.plugin.core.flow.If
    condition: "{{ (vars.deployment_name is null) or (not (vars.namespace isIn
      vars.allowed_namespaces)) }}"
    then:
      - id: fail_invalid_namespace
        type: io.kestra.plugin.core.execution.Fail
        errorMessage: |
          Provide a deployment name. Deployment name: {{ vars.deployment_name }}
          Invalid namespace '{{ vars.namespace }}'. Allowed namespaces are: {{ vars.allowed_namespaces }}

  - id: production_approval_gate
    type: io.kestra.plugin.core.flow.If
    description: Require human approval only for protected production namespaces.
      Staging remediation proceeds automatically.
    condition: "{{ vars.namespace isIn vars.protected_namespaces }}"
    then:
      - id: human_approval
        type: io.kestra.plugin.core.flow.Pause
        description: Hold production remediation for explicit human approval. Timeout
          fails closed.
        pauseDuration: PT1H
        behavior: FAIL

  - id: restart_service
    type: io.kestra.plugin.kubernetes.kubectl.Restart
    description: Rolling restart of the target deployment.
    connection:
      masterUrl: "{{ secret('K8S_MASTER_URL') }}"
      caCertData: "{{ secret('K8S_CA_CERT_DATA') }}"
      oauthToken: "{{ secret('K8S_OAUTH_TOKEN') }}"
    namespace: "{{ vars.namespace }}"
    resourceType: Deployment
    resourcesNames:
      - "{{ vars.deployment_name }}"

  - id: get_deployment_status
    type: io.kestra.plugin.kubernetes.kubectl.Get
    description: Fetch the deployment status, retrying until the rollout is healthy.
    connection:
      masterUrl: "{{ secret('K8S_MASTER_URL') }}"
      caCertData: "{{ secret('K8S_CA_CERT_DATA') }}"
      oauthToken: "{{ secret('K8S_OAUTH_TOKEN') }}"
    namespace: "{{ vars.namespace }}"
    resourceType: deployments
    resourcesNames:
      - "{{ vars.deployment_name }}"
    fetchType: FETCH_ONE
    retry:
      type: exponential
      maxAttempts: 5
      interval: PT15S
      maxInterval: PT5M

  - id: log_status
    type: io.kestra.plugin.core.log.Log
    message: |
      Deployment status: {{ outputs.get_deployment_status.statusItem | str }}

  - id: notify_slack_success
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK_URL') }}"
    payload: |
      {
        "text": "K8s remediation success. Target: {{ vars.namespace }}/{{ vars.deployment_name }}. Status: {{ outputs.get_deployment_status.statusItem | str }}"
      }

errors:
  - id: notify_slack_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK_URL') }}"
    payload: |
      {
        "text": "K8s remediation FAILED. Target: {{ vars.namespace }}/{{ vars.deployment_name }}. The rollout did not complete or the service is still unhealthy."
      }