Multi-Cluster Kubernetes Apply Across Tenants

Standardize configuration across a fleet of Kubernetes clusters from one declarative workflow. This blueprint takes a single shared manifest and applies it to many tenant clusters at once, resolving each cluster's API endpoint and credentials dynamically from secrets, then reading the resource back so you have proof the rollout landed everywhere. It solves the multi-cluster drift problem: instead of running kubectl apply by hand against each kubeconfig context or wiring a fragile shell loop, you get a repeatable, auditable, parallel rollout with built-in verification.

How it works

1. The apply_across_clusters task (io.kestra.plugin.core.flow.ForEach) iterates over the clusters input array, with concurrencyLimit: 3 so at most three clusters are updated in parallel.
2. For each cluster, apply_manifest (io.kestra.plugin.kubernetes.kubectl.Apply) resolves masterUrl and oauthToken from per-cluster secrets using {{ secret('K8S_MASTER_URL_' ~ taskrun.value) }} and {{ secret('K8S_TOKEN_' ~ taskrun.value) }}, then server-side applies the inline manifest into the target_namespace.
3. verify_apply (io.kestra.plugin.kubernetes.kubectl.Get) reads the configmaps resource named platform-baseline back from the same cluster with fetchType: FETCH, confirming the object exists post-apply.
4. The rollout_on_schedule trigger (io.kestra.plugin.core.trigger.Schedule) can roll the baseline out every Monday at 08:00 via cron: "0 8 * * 1". It ships disabled: true, so enable it when you are ready.

What you get

• A single source of truth for configuration applied identically across every cluster.
• Per-cluster apply plus read-back verification in one run.
• Parallel rollout with a concurrency cap to protect your control planes.
• Per-cluster outputs under outputs.apply_across_clusters for downstream checks or auditing.

Who it's for

• Platform and infrastructure engineers managing tenant or regional cluster fleets.
• SRE and DevOps teams enforcing baseline policy, config, or RBAC across clusters.
• Anyone tired of looping kubectl across kubeconfig contexts by hand.

Why orchestrate this with Kestra

kubectl is a single-cluster CLI with no scheduler, no retry semantics, and no audit trail. Kestra wraps it in declarative YAML, fans out across clusters with ForEach, resolves credentials securely per cluster, captures verification output, and gives you event or schedule triggers, automatic retries, and full execution lineage that the tool's own command line cannot provide.

Prerequisites

• A reachable API server URL and a valid bearer token for each cluster in the list.
• The manifest you want to standardize (a ConfigMap here; swap in your own).

Secrets

For every cluster name <name> you pass in the clusters input:

• K8S_MASTER_URL_<name>: API server URL for that cluster.
• K8S_TOKEN_<name>: bearer token for that cluster.

Quick start

1. Create K8S_MASTER_URL_<name> and K8S_TOKEN_<name> secrets for each cluster.
2. Pass the list of cluster names in the clusters input and set target_namespace.
3. Replace the inline manifest with the resource you want to standardize.
4. Execute, then inspect outputs.apply_across_clusters to confirm every cluster.

How to extend

• Swap the inline ConfigMap for a Deployment, NetworkPolicy, RBAC, or any manifest you need to standardize.
• Drive the manifest from inputs or a templated file to vary it per cluster.
• Add a io.kestra.plugin.kubernetes.kubectl.Delete step to prune retired resources.
• Enable the schedule trigger, or replace it with a flow or webhook trigger for GitOps-style rollouts.

Links

• Plugin docs: https://kestra.io/plugins/plugin-kubernetes
• Orchestrate Kubernetes with Kestra: https://kestra.io/orchestration/kubernetes