Kestra polling trigger quarantine

id: kestra-crashlooping-trigger-quarantine-guard
namespace: company.team
description: Quarantine one repeatedly failing Kestra polling trigger after
  explicit approval, with scheduler-state verification. Report-only defaults
  protect normal operation.
concurrency:
  limit: 1
  behavior: QUEUE
inputs:
  - id: kestra_url
    type: STRING
    displayName: Target Kestra API URL
    description: Kestra instance whose trigger is checked.
    defaults: http://localhost:8080
  - id: tenant_id
    type: STRING
    displayName: Kestra tenant
    defaults: main
    validator: ^[A-Za-z0-9_][A-Za-z0-9_.-]{0,149}$
  - id: namespace
    type: STRING
    displayName: Target namespace
    description: Exact namespace containing the trigger.
    defaults: company.team
    validator: ^[A-Za-z0-9_][A-Za-z0-9_.-]{0,149}$
  - id: flow_id
    type: STRING
    displayName: Target flow id
    description: Exact flow containing the trigger.
    defaults: target-flow
    validator: ^[A-Za-z0-9_][A-Za-z0-9_.-]{0,149}$
  - id: trigger_id
    type: STRING
    displayName: Target trigger id
    description: Exact trigger whose evaluation errors are counted and which may be
      quarantined.
    defaults: poll_dependency
    validator: ^[A-Za-z0-9_][A-Za-z0-9_.-]{0,149}$
  - id: time_range
    type: STRING
    displayName: Detection window
    description: ISO-8601 duration for the historical detector window.
    defaults: PT15M
  - id: min_log_errors
    type: INT
    displayName: Minimum trigger errors
    description: Minimum WARN or ERROR log rows for the exact trigger in the window.
    defaults: 3
    min: 1
    max: 500
  - id: min_failed_executions
    type: INT
    displayName: Minimum failed executions
    description: Minimum FAILED evaluations from the exact trigger in the window.
    defaults: 3
    min: 1
    max: 500
  - id: kestra_user
    type: SECRET
    displayName: Kestra API username
    required: true
    description: Target API username secret; override with an operator-provided identity.
    defaults: "{{ secret('KESTRA_USER') }}"
  - id: kestra_password
    type: SECRET
    displayName: Kestra API password
    defaults: "{{ secret('KESTRA_PASSWORD') }}"
  - id: auto_remediate
    type: BOOL
    displayName: Auto remediate
    description: Permit quarantine after the approval pause. Must be true with
      dry_run false.
    defaults: false
  - id: dry_run
    type: BOOL
    displayName: Dry run
    description: Keep true for report-only mode. No trigger changes are allowed while true.
    defaults: true
tasks:
  - id: initial
    type: io.kestra.plugin.kestra.flows.List
    namespace: "{{ inputs.namespace }}"
    kestraUrl: "{{ inputs.kestra_url }}"
    tenantId: "{{ inputs.tenant_id }}"
    auth:
      username: "{{ inputs.kestra_user }}"
      password: "{{ inputs.kestra_password }}"
  - id: snapshot
    type: io.kestra.plugin.core.output.OutputValues
    values:
      flow: "{{ outputs.initial.flows | toJson | jq('[.[] | select(.namespace == ' ~
        (inputs.namespace | toJson) ~ ' and .id == ' ~ (inputs.flow_id | toJson)
        ~ ')] | if length == 1 then .[0] else null end') | first | toJson }}"
  - id: before
    type: io.kestra.plugin.core.http.Request
    description: The Kestra plugin has no task that reads polling-trigger scheduler
      state; ScheduleMonitor only monitors schedules.
    uri: "{{ inputs.kestra_url }}/api/v1/{{ inputs.tenant_id }}/triggers/search"
    method: GET
    options:
      auth:
        type: BASIC
        username: "{{ inputs.kestra_user }}"
        password: "{{ inputs.kestra_password }}"
      timeout:
        readIdleTimeout: PT15S
        connectTimeout: PT5S
    params:
      size: '500'
      page: '1'
      filters[namespace][EQUALS]: "{{ inputs.namespace }}"
      filters[flowId][EQUALS]: "{{ inputs.flow_id }}"
  - id: before_target
    type: io.kestra.plugin.core.output.OutputValues
    values:
      target: "{{ outputs.before.body | jq('[.results[] | select(.state.namespace == '
        ~ (inputs.namespace | toJson) ~ ' and .state.flowId == ' ~
        (inputs.flow_id | toJson) ~ ' and .state.triggerId == ' ~
        (inputs.trigger_id | toJson) ~ ')] | if length == 1 then .[0] else null
        end') | first | toJson }}"
  - id: logs
    type: io.kestra.plugin.core.http.Request
    description: Native logs.Fetch can select the trigger pseudo-execution id but
      has no bounded timeRange; the API bounds this exact-trigger read.
    uri: "{{ inputs.kestra_url }}/api/v1/{{ inputs.tenant_id }}/logs/search"
    method: GET
    options:
      auth:
        type: BASIC
        username: "{{ inputs.kestra_user }}"
        password: "{{ inputs.kestra_password }}"
      timeout:
        readIdleTimeout: PT15S
        connectTimeout: PT5S
    params:
      size: '500'
      page: '1'
      filters[namespace][EQUALS]: "{{ inputs.namespace }}"
      filters[flowId][EQUALS]: "{{ inputs.flow_id }}"
      filters[triggerId][EQUALS]: "{{ inputs.trigger_id }}"
      filters[level][GREATER_THAN_OR_EQUAL_TO]: WARN
      filters[timeRange][EQUALS]: "{{ inputs.time_range }}"
  - id: failures
    type: io.kestra.plugin.kestra.executions.Query
    namespace: "{{ inputs.namespace }}"
    flowId: "{{ inputs.flow_id }}"
    states:
      - FAILED
    labels:
      system.from: trigger
    timeRange: "{{ inputs.time_range }}"
    fetchType: FETCH
    size: 500
    page: 1
    kestraUrl: "{{ inputs.kestra_url }}"
    tenantId: "{{ inputs.tenant_id }}"
    auth:
      username: "{{ inputs.kestra_user }}"
      password: "{{ inputs.kestra_password }}"
  - id: counts
    type: io.kestra.plugin.core.output.OutputValues
    values:
      log_count: "{{ outputs.logs.body | jq('.results | length') | first }}"
      failed_count: "{{ outputs.failures.rows | toJson | jq('flatten |
        map(select(.namespace == ' ~ (inputs.namespace | toJson) ~ ' and .flowId
        == ' ~ (inputs.flow_id | toJson) ~ ' and .trigger.id == ' ~
        (inputs.trigger_id | toJson) ~ ' and ((.state.histories | map(.state))
        == [\"CREATED\",\"FAILED\"]))) | length') | first }}"
      first_error: "{{ outputs.logs.body | jq('.results[0].message // \"no matching
        evaluation error\"') | first }}"
      latest_error_evaluation: "{{ outputs.logs.body | jq('[.results[] |
        select(.message | contains(\"Trigger evaluation failed in the worker
        with error:\")) | .message | split(\"[date: \")[1] | split(\"]\")[0] |
        .[0:19]] | max // \"\"') | first }}"
  - id: capacity
    type: io.kestra.plugin.core.flow.If
    condition: "{{ (outputs.logs.body | jq('.total >= 500') | first) or
      outputs.failures.size >= 500 or (outputs.before.body | jq('.total >= 500')
      | first) }}"
    then:
      - id: truncated
        type: io.kestra.plugin.core.execution.Fail
        errorMessage: Read ceiling reached. Refusing an incomplete detector or
          trigger-state snapshot; narrow the scope/window.
    else:
      - id: candidate
        type: io.kestra.plugin.core.flow.If
        condition: "{{ (outputs.before_target.values.target | jq('. != null and
          .state.kind == \"POLLING\" and .state.disabled != true and
          .state.sourceDisabled != true and .trigger.failOnTriggerError ==
          true') | first) and (outputs.counts.values.log_count | number) >=
          inputs.min_log_errors and (outputs.counts.values.failed_count |
          number) >= inputs.min_failed_executions }}"
        then:
          - id: alert
            type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
            url: "{{ secret('SLACK_WEBHOOK_URL') }}"
            payload: "{{ {'text': 'Kestra trigger quarantine candidate ' ~ inputs.namespace
              ~ '/' ~ inputs.flow_id ~ '/' ~ inputs.trigger_id ~ ': ' ~
              outputs.counts.values.log_count ~ ' WARN/ERROR evaluation rows and
              ' ~ outputs.counts.values.failed_count ~ ' failed evaluations in '
              ~ inputs.time_range ~ '. First error: ' ~
              outputs.counts.values.first_error ~ '. auto_remediate=' ~
              inputs.auto_remediate ~ ', dry_run=' ~ inputs.dry_run} | toJson
              }}"
          - id: remediation_gate
            type: io.kestra.plugin.core.flow.If
            condition: "{{ inputs.auto_remediate and not inputs.dry_run }}"
            then:
              - id: approval
                type: io.kestra.plugin.core.flow.Pause
                description: "Approve quarantine of {{ inputs.namespace }}/{{ inputs.flow_id
                  }}/{{ inputs.trigger_id }}. {{ outputs.counts.values.log_count
                  }} WARN/ERROR rows; {{ outputs.counts.values.failed_count }}
                  failed evaluations. First error: {{
                  outputs.counts.values.first_error }}. Wait for another failed
                  evaluation before approving. A recovered or unproven current
                  evaluation is refused."
                pauseDuration: PT1H
                behavior: RESUME
                onResume:
                  - id: approved
                    type: BOOL
                    required: false
                    description: Set true to disable the exact polling trigger.
                  - id: note
                    type: STRING
                    required: false
              - id: approved_gate
                type: io.kestra.plugin.core.flow.If
                condition: "{{ outputs.approval.onResume.approved ?? false }}"
                then:
                  - id: fresh_logs
                    type: io.kestra.plugin.core.http.Request
                    description: Native logs.Fetch can select the trigger pseudo-execution id but
                      has no bounded timeRange; the API bounds this
                      exact-trigger read.
                    uri: "{{ inputs.kestra_url }}/api/v1/{{ inputs.tenant_id }}/logs/search"
                    method: GET
                    options:
                      auth:
                        type: BASIC
                        username: "{{ inputs.kestra_user }}"
                        password: "{{ inputs.kestra_password }}"
                      timeout:
                        readIdleTimeout: PT15S
                        connectTimeout: PT5S
                    params:
                      size: '500'
                      page: '1'
                      filters[namespace][EQUALS]: "{{ inputs.namespace }}"
                      filters[flowId][EQUALS]: "{{ inputs.flow_id }}"
                      filters[triggerId][EQUALS]: "{{ inputs.trigger_id }}"
                      filters[level][GREATER_THAN_OR_EQUAL_TO]: WARN
                      filters[timeRange][EQUALS]: "{{ inputs.time_range }}"
                  - id: fresh_failures
                    type: io.kestra.plugin.kestra.executions.Query
                    namespace: "{{ inputs.namespace }}"
                    flowId: "{{ inputs.flow_id }}"
                    states:
                      - FAILED
                    labels:
                      system.from: trigger
                    timeRange: "{{ inputs.time_range }}"
                    fetchType: FETCH
                    size: 500
                    page: 1
                    kestraUrl: "{{ inputs.kestra_url }}"
                    tenantId: "{{ inputs.tenant_id }}"
                    auth:
                      username: "{{ inputs.kestra_user }}"
                      password: "{{ inputs.kestra_password }}"
                  - id: fresh_counts
                    type: io.kestra.plugin.core.output.OutputValues
                    values:
                      log_count: "{{ outputs.fresh_logs.body | jq('.results | length') | first }}"
                      failed_count: "{{ outputs.fresh_failures.rows | toJson | jq('flatten |
                        map(select(.namespace == ' ~ (inputs.namespace | toJson)
                        ~ ' and .flowId == ' ~ (inputs.flow_id | toJson) ~ ' and
                        .trigger.id == ' ~ (inputs.trigger_id | toJson) ~ ' and
                        ((.state.histories | map(.state)) ==
                        [\"CREATED\",\"FAILED\"]))) | length') | first }}"
                      first_error: "{{ outputs.fresh_logs.body | jq('.results[0].message // \"no
                        matching evaluation error\"') | first }}"
                      latest_error_evaluation: "{{ outputs.fresh_logs.body | jq('[.results[] |
                        select(.message | contains(\"Trigger evaluation failed
                        in the worker with error:\")) | .message |
                        split(\"[date: \")[1] | split(\"]\")[0] | .[0:19]] | max
                        // \"\"') | first }}"
                  - id: prewrite
                    type: io.kestra.plugin.kestra.flows.List
                    namespace: "{{ inputs.namespace }}"
                    kestraUrl: "{{ inputs.kestra_url }}"
                    tenantId: "{{ inputs.tenant_id }}"
                    auth:
                      username: "{{ inputs.kestra_user }}"
                      password: "{{ inputs.kestra_password }}"
                  - id: prewrite_snapshot
                    type: io.kestra.plugin.core.output.OutputValues
                    values:
                      flow: "{{ outputs.prewrite.flows | toJson | jq('[.[] | select(.namespace == ' ~
                        (inputs.namespace | toJson) ~ ' and .id == ' ~
                        (inputs.flow_id | toJson) ~ ')] | if length == 1 then
                        .[0] else null end') | first | toJson }}"
                  - id: prewrite_state
                    type: io.kestra.plugin.core.http.Request
                    description: The Kestra plugin has no task that reads polling-trigger scheduler
                      state; ScheduleMonitor only monitors schedules.
                    uri: "{{ inputs.kestra_url }}/api/v1/{{ inputs.tenant_id }}/triggers/search"
                    method: GET
                    options:
                      auth:
                        type: BASIC
                        username: "{{ inputs.kestra_user }}"
                        password: "{{ inputs.kestra_password }}"
                      timeout:
                        readIdleTimeout: PT15S
                        connectTimeout: PT5S
                    params:
                      size: '500'
                      page: '1'
                      filters[namespace][EQUALS]: "{{ inputs.namespace }}"
                      filters[flowId][EQUALS]: "{{ inputs.flow_id }}"
                  - id: prewrite_target
                    type: io.kestra.plugin.core.output.OutputValues
                    values:
                      target: "{{ outputs.prewrite_state.body | jq('[.results[] |
                        select(.state.namespace == ' ~ (inputs.namespace |
                        toJson) ~ ' and .state.flowId == ' ~ (inputs.flow_id |
                        toJson) ~ ' and .state.triggerId == ' ~
                        (inputs.trigger_id | toJson) ~ ')] | if length == 1 then
                        .[0] else null end') | first | toJson }}"
                  - id: fresh_capacity
                    type: io.kestra.plugin.core.flow.If
                    condition: "{{ (outputs.fresh_logs.body | jq('.total >= 500') | first) or
                      outputs.fresh_failures.size >= 500 or
                      (outputs.prewrite_state.body | jq('.total >= 500') |
                      first) }}"
                    then:
                      - id: fresh_truncated
                        type: io.kestra.plugin.core.execution.Fail
                        errorMessage: Refreshed read ceiling reached; no Toggle attempted.
                    else:
                      - id: stale_gate
                        type: io.kestra.plugin.core.flow.If
                        condition: "{{ outputs.snapshot.values.flow != 'null' and
                          outputs.snapshot.values.flow ==
                          outputs.prewrite_snapshot.values.flow and
                          (outputs.prewrite_target.values.target | jq('. != null
                          and .state.kind == \"POLLING\" and .state.disabled !=
                          true and .state.sourceDisabled != true and
                          .trigger.failOnTriggerError == true') | first) and
                          (outputs.fresh_counts.values.log_count | number) >=
                          inputs.min_log_errors and
                          (outputs.fresh_counts.values.failed_count | number) >=
                          inputs.min_failed_executions and
                          (outputs.prewrite_target.values.target |
                          jq('.state.locked == false') | first) and
                          (outputs.prewrite_target.values.target |
                          jq('.state.evaluatedAt // \"\"') | first) >
                          (outputs.before_target.values.target |
                          jq('.state.evaluatedAt // \"\"') | first) and
                          outputs.fresh_counts.values.latest_error_evaluation !=
                          '' and
                          outputs.fresh_counts.values.latest_error_evaluation ==
                          (outputs.prewrite_target.values.target |
                          jq('.state.evaluatedAt[0:19]') | first) }}"
                        then:
                          - id: quarantine
                            type: io.kestra.plugin.kestra.triggers.Toggle
                            description: Disable exactly one trigger in scheduler state; Toggle does not
                              edit flow source. No write retry.
                            namespace: "{{ inputs.namespace }}"
                            flowId: "{{ inputs.flow_id }}"
                            trigger: "{{ inputs.trigger_id }}"
                            enabled: false
                            kestraUrl: "{{ inputs.kestra_url }}"
                            tenantId: "{{ inputs.tenant_id }}"
                            auth:
                              username: "{{ inputs.kestra_user }}"
                              password: "{{ inputs.kestra_password }}"
                          - id: after
                            type: io.kestra.plugin.core.http.Request
                            description: The Kestra plugin has no task that reads polling-trigger scheduler
                              state; ScheduleMonitor only monitors schedules.
                            uri: "{{ inputs.kestra_url }}/api/v1/{{ inputs.tenant_id }}/triggers/search"
                            method: GET
                            options:
                              auth:
                                type: BASIC
                                username: "{{ inputs.kestra_user }}"
                                password: "{{ inputs.kestra_password }}"
                              timeout:
                                readIdleTimeout: PT15S
                                connectTimeout: PT5S
                            params:
                              size: '500'
                              page: '1'
                              filters[namespace][EQUALS]: "{{ inputs.namespace }}"
                              filters[flowId][EQUALS]: "{{ inputs.flow_id }}"
                          - id: after_target
                            type: io.kestra.plugin.core.output.OutputValues
                            values:
                              target: "{{ outputs.after.body | jq('[.results[] | select(.state.namespace == '
                                ~ (inputs.namespace | toJson) ~ ' and
                                .state.flowId == ' ~ (inputs.flow_id | toJson) ~
                                ' and .state.triggerId == ' ~ (inputs.trigger_id
                                | toJson) ~ ')] | if length == 1 then .[0] else
                                null end') | first | toJson }}"
                          - id: verify
                            type: io.kestra.plugin.core.flow.If
                            condition: "{{ outputs.after_target.values.target | jq('. != null and
                              .state.disabled == true') | first }}"
                            then:
                              - id: quarantined
                                type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
                                url: "{{ secret('SLACK_WEBHOOK_URL') }}"
                                payload: "{{ {'text': 'Quarantined Kestra polling trigger ' ~ inputs.namespace ~
                                  '/' ~ inputs.flow_id ~ '/' ~ inputs.trigger_id
                                  ~ '. Scheduler disabled=true verified.
                                  Observed ' ~
                                  outputs.fresh_counts.values.log_count ~ '
                                  error/warning rows and ' ~
                                  outputs.fresh_counts.values.failed_count ~ '
                                  failed evaluations. Fix the dependency before
                                  manually re-enabling. Approval note: ' ~
                                  (outputs.approval.onResume.note ?? '')} |
                                  toJson }}"
                            else:
                              - id: verify_failed
                                type: io.kestra.plugin.core.execution.Fail
                                errorMessage: Toggle did not persist scheduler disabled=true for the exact
                                  trigger.
                        else:
                          - id: stale_plan
                            type: io.kestra.plugin.core.execution.Fail
                            errorMessage: Eligibility changed or no newer completed failed evaluation is
                              proven. Refusing stale approval; no Toggle
                              attempted.
                else:
                  - id: declined
                    type: io.kestra.plugin.core.log.Log
                    message: Approval not granted; no trigger changed.
            else:
              - id: report_only
                type: io.kestra.plugin.core.log.Log
                message: Candidate reported; no trigger change permitted by safe-mode inputs.
        else:
          - id: healthy
            type: io.kestra.plugin.core.log.Log
            message: "No eligible candidate. {{ outputs.counts.values.log_count }}
              WARN/ERROR evaluation rows and {{
              outputs.counts.values.failed_count }} failed evaluations; no
              trigger changed."
errors:
  - id: alert_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK_URL') }}"
    payload: |
      {{ {'text': 'Kestra crash-looping trigger quarantine guard failed for ' ~ inputs.namespace ~ '/' ~ inputs.flow_id ~ '/' ~ inputs.trigger_id ~ ' (execution ' ~ execution.id ~ '). Trigger state is unknown; inspect the run before changing it manually.'} | toJson }}
triggers:
  - id: hourly
    type: io.kestra.plugin.core.trigger.Schedule
    description: Disabled by default and forced to report-only inputs.
    cron: '@hourly'
    disabled: true
    inputs:
      auto_remediate: false
      dry_run: true

Safety

Disabling a polling trigger stops new work from that trigger.

Guard	What it stops
Exact identifiers and enabled POLLING state	Writes to neighbouring or source-disabled triggers
Both evidence thresholds and failOnTriggerError	Selection based only on failed flow tasks
Safe defaults and an explicit approval	Unattended quarantine
Full detector, source and scheduler re-read after approval	Writes based on stale counts or a recovered, edited, deleted or disabled target
Scheduler read after Toggle	Reporting an ineffective write as successful

How it works

initial uses native flows.List to snapshot one target flow; before reads its polling-trigger scheduler state through the API because the plugin has no task for that state read.
logs selects WARN/ERROR evaluation rows for the exact namespace, flow and trigger over time_range; native logs.Fetch can select the trigger pseudo-execution but cannot bound a read by duration.
Native executions.Query reads FAILED trigger-created executions; counts selects the exact trigger and CREATED-to-FAILED state history, excluding executions that reached RUNNING.
capacity refuses a read reaching the 500-row ceiling; candidate requires both positive thresholds and an enabled polling trigger with failOnTriggerError: true.
With auto_remediate: true and dry_run: false, approval shows the first error and both counts; after approval, fresh_logs, fresh_failures and fresh_counts reapply both thresholds; prewrite and prewrite_state require unchanged source, enabled state and a newer completed evaluation matching the latest worker error.
Native triggers.Toggle disables that exact trigger; verify reads scheduler state and fails unless disabled: true is present, then Slack records the trigger and approval note.

This blueprint was created by zkasuran.

What you get

Evaluation error-row and creation-time failure counts for one polling trigger.
A report-only default, approval record and verified scheduler quarantine.
Slack messages for candidates, completed quarantines and failed guard executions.

Who it's for

Platform teams responsible for Kestra polling triggers and noisy dependency failures.

Why orchestrate this with Kestra

Native execution history, Pause approval and the Toggle task keep detection and the decision in one execution. Both API credential inputs use SECRET to protect operator-supplied values in execution records.

Tested end to end

Kestra OSS 2.0.6 with an unreachable PostgreSQL polling trigger, a healthy SQLite control and ordinary flow-task failures. Independent target API reads found 60 WARN/ERROR evaluation rows and 15 failed evaluations before quarantine; no new rows or failed evaluations appeared over 247 seconds after disabling the one-minute trigger.

Case	Execution	Result
Credential protection	`3peTscUn95IvtSZd8msSyB`	Raw inputs, outputs and logs checked
Healthy dependency	`5YNvvSjEQDQDPbaxwtmqlV`	No candidate
Degraded dry run	`12IMwmiHTzfJn0vBqpKS2M`	Candidate; no write
Declined approval	`7fqF6t5lZJqp9i4IclU0iv`	No write
Approved quarantine	`RT8DFKm1nU3Nxp67Gj2LW`	Scheduler disabled=true
Repeat	`2gBBoEhMkQHGa1xWUhkxfW`	No further Toggle
Source changed during approval	`1hm1GBJZUNndL9B5W4lIJ4`	Failed before Toggle
Proxy acknowledges a no-op	`3oVkFVPtGBNAH7nQPza8tM`	Verification failed
Dependency recovered during approval	`6p6iTBWgIydpOw2Xd3umVM`	Failed before Toggle
Real Toggle, verification unavailable	`3hQnhuhzRPFC3VXVXE0a49`	Failed; retry preserves quarantine

Additional cases cover both threshold boundaries, source-disabled targets, neighbouring namespaces and triggers, empty and saturated results, invalid identifiers, a concurrent second execution, deletion during approval, refused writes and slow or unavailable state reads. Healthy control, quarantine, approval-time source change and repeat were reproduced against a second fresh Kestra 2.0.6 target.

Prerequisites

A reachable target Kestra OSS 2.0.6 API and a polling trigger configured with failOnTriggerError: true.
A target API identity permitted to list flows, search logs and executions, read trigger state and toggle the selected trigger.

Secrets

KESTRA_USER and KESTRA_PASSWORD: target API identity.
SLACK_WEBHOOK_URL: Slack incoming webhook.

Inputs

Input	Default	Purpose
`kestra_url`, `tenant_id`	`http://localhost:8080`, `main`	Target API
`namespace`, `flow_id`, `trigger_id`	`company.team`, `target-flow`, `poll_dependency`	Exact target
`time_range`	`PT15M`	Historical duration window
`min_log_errors`, `min_failed_executions`	`3`, `3`	Both thresholds must be met; allowed range 1 to 500
`kestra_user`, `kestra_password`	Username and password secrets	Basic authentication
`auto_remediate`, `dry_run`	`false`, `true`	Report-only defaults

Quick start

Provide the API and Slack secrets plus the exact target coordinates.
Run with the report-only defaults and review the candidate error and counts.
For a confirmed incident, set auto_remediate: true and dry_run: false, wait for another failed polling evaluation during the Pause, then approve.
Inspect the verified scheduler state and Slack record; fix the dependency before re-enabling the trigger.

How to extend

Raise both thresholds for a noisier environment while keeping exact target selection and approval.

Limits: Counts cover a historical window. After approval, a newer completed scheduler evaluation must match the latest structured worker evaluation-error date; this check depends on Kestra 2.0.6 log formatting and refuses missing evidence or approval before another evaluation. Three failed creation-time executions are the default repeated-event threshold; log rows only corroborate because one evaluation emits several rows. Lowering the execution threshold to one permits a transient incident. Other creation failures with the same CREATED-to-FAILED history can affect report counts; errors outside the window and failOnTriggerError=false are excluded. Toggle changes scheduler state and leaves YAML unchanged. This guard serializes its own executions only. Operators must have exclusive control of the chosen trigger during approval and verification: unrelated writers can race the final read because Toggle has no conditional-version property. Do not enable remediation where that ownership cannot be guaranteed. Fix the dependency before manually re-enabling the trigger.

Quarantine a repeatedly failing Kestra polling trigger

Safety

How it works

What you get

Who it's for

Why orchestrate this with Kestra

Tested end to end

Prerequisites

Secrets

Inputs

Quick start

How to extend

Links

Tasks

Orchestrate with Kestra

Share this Blueprint

Create a Blueprint

New to Kestra?

Quarantine a repeatedly failing Kestra polling trigger

Safety

How it works

What you get

Who it's for

Why orchestrate this with Kestra

Tested end to end

Prerequisites

Secrets

Inputs

Quick start

How to extend

Links

Tasks

Orchestrate with Kestra

Share this Blueprint

Create a Blueprint

More Core Blueprints

Kestra Schedule Trigger Health Sentinel

Nightly digest of failed Kestra executions with their ERROR log lines per namespace

Recover Kestra executions abandoned in PAUSED

Kestra Flow Security, Governance and Linting Gate

Kestra Flow Failure Rate Gate

Promote Kestra flows from staging to production with approval, snapshot and rollback

More Infrastructure Blueprints

Kafka Idle Consumer Partition Guard

Kafka Consumer Group Dead-Letter Rebalance and Offset Rewind Guard

Kafka Consumer Lag Sentinel

Kafka Connect Sink Poison Pill Offset Rewind and Skip Gate

Kafka Orphaned Topic Reclaim Guard

Self-heal Kafka Connect connectors with a restart budget and escalation

New to Kestra?