Restore MySQL binlog_row_image FULL for Debezium CDC with Kestra

id: mysql-binlog-row-image-minimal-cdc-restore-guard
namespace: company.team

description: |
  Find a MySQL server whose binlog_row_image is no longer FULL, the setting Debezium needs before it
  will start. In report mode it lists the setting and the sessions still writing reduced row images.
  With both change inputs on and an approval it sets FULL, then proves the repair by capturing a real
  update of a canary row through Debezium and comparing its before image with the row read just before.

concurrency:
  limit: 1
  behavior: QUEUE

inputs:
  - id: mysql_host
    type: STRING
    displayName: MySQL host
    defaults: localhost
    description: Host used by the JDBC tasks and by the Debezium connector.

  - id: mysql_port
    type: STRING
    displayName: MySQL port
    defaults: "3306"

  - id: mysql_database
    type: STRING
    displayName: Database holding the canary table
    defaults: cdc_demo
    description: Simple identifier. Debezium captures only the canary table in this
      database.

  - id: canary_table
    type: STRING
    displayName: Canary table
    defaults: cdc_canary
    description: Table with columns id (primary key), marker and counter. Only the
      canary row is ever updated.

  - id: canary_id
    type: INT
    displayName: Canary row id
    defaults: 1

  - id: mysql_username
    type: STRING
    displayName: MySQL account
    defaults: "{{ secret('MYSQL_USERNAME') }}"
    description: Needs SELECT on the canary database and on performance_schema,
      UPDATE on the canary table, REPLICATION SLAVE, REPLICATION CLIENT and, for
      a repair, SYSTEM_VARIABLES_ADMIN.

  - id: mysql_password
    type: SECRET
    displayName: MySQL password
    defaults: "{{ secret('MYSQL_PASSWORD') }}"

  - id: debezium_server_id
    type: STRING
    displayName: Debezium server id
    defaults: "40401"
    description: Must not collide with a server-id of any replica or other connector.

  - id: persist_setting
    type: BOOL
    displayName: Persist the repair across restarts
    defaults: false
    description: Uses SET PERSIST so mysqld-auto.cnf keeps FULL after a restart.
      Leave false when the setting is managed by a config file or parameter
      group.

  - id: auto_remediate
    type: BOOL
    displayName: Allow the repair
    defaults: false

  - id: dry_run
    type: BOOL
    displayName: Dry run
    defaults: true
    description: Must be false together with auto_remediate for any change.

tasks:
  - id: validate_names
    type: io.kestra.plugin.core.flow.If
    description: The database and table names are placed in SQL text, so only simple
      identifiers pass.
    condition: "{{ ((inputs.mysql_database ~ inputs.canary_table) |
      replace({'[A-Za-z0-9_]': ''}, regexp=true) | length) > 0 or
      (inputs.mysql_database | length) == 0 or (inputs.canary_table | length) ==
      0 or (inputs.mysql_database | length) > 64 or (inputs.canary_table |
      length) > 64 }}"
    then:
      - id: invalid_names
        type: io.kestra.plugin.core.execution.Fail
        errorMessage: "mysql_database and canary_table must match ^[A-Za-z0-9_]{1,64}$.
          Nothing was read or changed."

  - id: read_settings
    type: io.kestra.plugin.jdbc.mysql.Query
    description: Read the global binary log settings the connector depends on.
    url: "jdbc:mysql://{{ inputs.mysql_host }}:{{ inputs.mysql_port }}/{{
      inputs.mysql_database }}?connectionAttributes=kestra_guard:before-{{
      execution.id }}"
    username: "{{ inputs.mysql_username }}"
    password: "{{ inputs.mysql_password }}"
    fetchType: FETCH_ONE
    sql: "SELECT @@global.log_bin AS log_bin, @@global.binlog_format AS
      binlog_format, @@global.binlog_row_image AS row_image, @@global.version AS
      version"

  - id: read_sessions
    type: io.kestra.plugin.jdbc.mysql.Query
    description: Count client sessions that still write a reduced row image. A
      change to the global value does not reach them until they reconnect. The
      sessions this flow opens are tagged and left out.
    url: "jdbc:mysql://{{ inputs.mysql_host }}:{{ inputs.mysql_port }}/{{
      inputs.mysql_database }}?connectionAttributes=kestra_guard:before-{{
      execution.id }}"
    username: "{{ inputs.mysql_username }}"
    password: "{{ inputs.mysql_password }}"
    fetchType: FETCH_ONE
    sql: >-
      SELECT COUNT(*) AS reduced_sessions FROM
      performance_schema.variables_by_thread v JOIN performance_schema.threads t
      ON t.THREAD_ID = v.THREAD_ID WHERE v.VARIABLE_NAME = 'binlog_row_image'
      AND v.VARIABLE_VALUE <> 'FULL'
        AND t.TYPE = 'FOREGROUND' AND t.PROCESSLIST_ID IS NOT NULL
        AND NOT EXISTS (SELECT 1 FROM performance_schema.session_connect_attrs a WHERE a.PROCESSLIST_ID = t.PROCESSLIST_ID AND a.ATTR_NAME = 'kestra_guard')

  - id: summary
    type: io.kestra.plugin.core.log.Log
    message: "MySQL {{ outputs.read_settings.row.version }}: log_bin={{
      outputs.read_settings.row.log_bin }} binlog_format={{
      outputs.read_settings.row.binlog_format }} binlog_row_image={{
      outputs.read_settings.row.row_image }} sessions_with_reduced_image={{
      outputs.read_sessions.row.reduced_sessions }}"

  - id: route
    type: io.kestra.plugin.core.flow.If
    condition: "{{ outputs.read_settings.row.log_bin == 1 and
      outputs.read_settings.row.binlog_format == 'ROW' and
      outputs.read_settings.row.row_image != 'FULL' }}"
    then:
      - id: alert
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        description: Debezium refuses to start while the row image is reduced, so change
          capture from this server is stopped or about to stop.
        url: "{{ secret('SLACK_WEBHOOK_URL') }}"
        payload: >-
          {{ {'text': 'MySQL binlog_row_image is ' ~
          outputs.read_settings.row.row_image ~ ' on ' ~ inputs.mysql_host ~ '.
          Debezium needs FULL. ' ~ outputs.read_sessions.row.reduced_sessions ~
          ' session(s) currently write a reduced image.'} | toJson }}

      - id: remediation_gate
        type: io.kestra.plugin.core.flow.If
        condition: "{{ inputs.auto_remediate and not inputs.dry_run }}"
        then:
          - id: approval
            type: io.kestra.plugin.core.flow.Pause
            pauseDuration: PT1H
            description: Setting FULL enlarges every row event in the binary log. Approve
              only after reviewing log volume and replica capacity.
            onResume:
              - id: approved
                type: BOOL
                defaults: false
                description: Approve setting binlog_row_image to FULL.

          - id: approved_branch
            type: io.kestra.plugin.core.flow.If
            condition: "{{ outputs.approval.onResume.approved ?? false }}"
            then:
              - id: recheck_settings
                type: io.kestra.plugin.jdbc.mysql.Query
                description: Read the setting again after the approval.
                url: "jdbc:mysql://{{ inputs.mysql_host }}:{{ inputs.mysql_port }}/{{
                  inputs.mysql_database
                  }}?connectionAttributes=kestra_guard:before-{{ execution.id
                  }}"
                username: "{{ inputs.mysql_username }}"
                password: "{{ inputs.mysql_password }}"
                fetchType: FETCH_ONE
                sql: "SELECT @@global.log_bin AS log_bin, @@global.binlog_format AS
                  binlog_format, @@global.binlog_row_image AS row_image"

              - id: still_degraded
                type: io.kestra.plugin.core.flow.If
                condition: "{{ outputs.recheck_settings.row.log_bin == 1 and
                  outputs.recheck_settings.row.binlog_format == 'ROW' and
                  outputs.recheck_settings.row.row_image != 'FULL' }}"
                then:
                  - id: read_canary
                    type: io.kestra.plugin.jdbc.mysql.Query
                    description: Read the canary row so the captured before image can be compared
                      with it.
                    url: "jdbc:mysql://{{ inputs.mysql_host }}:{{ inputs.mysql_port }}/{{
                      inputs.mysql_database
                      }}?connectionAttributes=kestra_guard:before-{{
                      execution.id }}"
                    username: "{{ inputs.mysql_username }}"
                    password: "{{ inputs.mysql_password }}"
                    fetchType: FETCH_ONE
                    sql: "SELECT id, marker, counter FROM {{ inputs.canary_table }} WHERE id = {{
                      inputs.canary_id }}"

                  - id: canary_exists
                    type: io.kestra.plugin.core.execution.Fail
                    condition: "{{ outputs.read_canary.row is null }}"
                    errorMessage: "The canary row does not exist. Nothing was changed."

                  - id: set_row_image
                    type: io.kestra.plugin.jdbc.mysql.Query
                    description: The only server change. It sets the global value and, when asked,
                      keeps it across restarts.
                    url: "jdbc:mysql://{{ inputs.mysql_host }}:{{ inputs.mysql_port }}/{{
                      inputs.mysql_database
                      }}?connectionAttributes=kestra_guard:before-{{
                      execution.id }}"
                    username: "{{ inputs.mysql_username }}"
                    password: "{{ inputs.mysql_password }}"
                    sql: "{{ inputs.persist_setting ? \"SET PERSIST binlog_row_image = 'FULL'\" :
                      \"SET GLOBAL binlog_row_image = 'FULL'\" }}"

                  - id: verify_setting
                    type: io.kestra.plugin.jdbc.mysql.Query
                    description: Read the global value back from a new session.
                    url: "jdbc:mysql://{{ inputs.mysql_host }}:{{ inputs.mysql_port }}/{{
                      inputs.mysql_database
                      }}?connectionAttributes=kestra_guard:before-{{
                      execution.id }}"
                    username: "{{ inputs.mysql_username }}"
                    password: "{{ inputs.mysql_password }}"
                    fetchType: FETCH_ONE
                    sql: "SELECT @@global.binlog_row_image AS row_image"

                  - id: setting_not_applied
                    type: io.kestra.plugin.core.execution.Fail
                    condition: "{{ outputs.verify_setting.row.row_image != 'FULL' }}"
                    errorMessage: "binlog_row_image is {{ outputs.verify_setting.row.row_image }}
                      after the change. Debezium still cannot start."

                  - id: prove_capture
                    type: io.kestra.plugin.core.flow.Parallel
                    description: Start Debezium on the canary table, update the canary row from a
                      second branch and keep the first event.
                    tasks:
                      - id: capture
                        type: io.kestra.plugin.debezium.mysql.Capture
                        hostname: "{{ inputs.mysql_host }}"
                        port: "{{ inputs.mysql_port }}"
                        username: "{{ inputs.mysql_username }}"
                        password: "{{ inputs.mysql_password }}"
                        serverId: "{{ inputs.debezium_server_id }}"
                        snapshotMode: SCHEMA_ONLY
                        properties:
                          table.include.list: "{{ inputs.mysql_database }}.{{ inputs.canary_table }}"
                        format: RAW
                        maxRecords: 1
                        maxDuration: PT45S
                        maxWait: PT40S
                        stateName: "row-image-{{ execution.id }}"

                      - id: touch
                        type: io.kestra.plugin.core.flow.Sequential
                        tasks:
                          - id: let_connector_start
                            type: io.kestra.plugin.core.flow.Sleep
                            duration: PT12S

                          - id: update_canary
                            type: io.kestra.plugin.jdbc.mysql.Query
                            url: "jdbc:mysql://{{ inputs.mysql_host }}:{{ inputs.mysql_port }}/{{
                              inputs.mysql_database
                              }}?connectionAttributes=kestra_guard:after-{{
                              execution.id }}"
                            username: "{{ inputs.mysql_username }}"
                            password: "{{ inputs.mysql_password }}"
                            sql: "UPDATE {{ inputs.canary_table }} SET marker = 'kestra-{{ execution.id }}',
                              counter = counter + 1 WHERE id = {{
                              inputs.canary_id }}"

                  - id: decode_event
                    type: io.kestra.plugin.serdes.json.IonToJson
                    from: "{{ outputs.capture.uris[inputs.mysql_database ~ '.' ~
                      inputs.canary_table] }}"

                  - id: before_image_incomplete
                    type: io.kestra.plugin.core.execution.Fail
                    condition: >-
                      {{ (read(outputs.decode_event.uri) |
                      jq('.value.before.marker') | first) !=
                      outputs.read_canary.row.marker
                         or (read(outputs.decode_event.uri) | jq('.value.before.counter') | first) != outputs.read_canary.row.counter
                         or (read(outputs.decode_event.uri) | jq('.value.after.marker') | first) != ('kestra-' ~ execution.id) }}
                    errorMessage: "The captured update does not carry the full before image of the
                      canary row. Debezium reads the binary log but the change
                      is not complete."

                  - id: read_sessions_after
                    type: io.kestra.plugin.jdbc.mysql.Query
                    description: Sessions opened before the change keep their old value until they
                      reconnect.
                    url: "jdbc:mysql://{{ inputs.mysql_host }}:{{ inputs.mysql_port }}/{{
                      inputs.mysql_database
                      }}?connectionAttributes=kestra_guard:after-{{ execution.id
                      }}"
                    username: "{{ inputs.mysql_username }}"
                    password: "{{ inputs.mysql_password }}"
                    fetchType: FETCH_ONE
                    sql: >-
                      SELECT COUNT(*) AS reduced_sessions FROM
                      performance_schema.variables_by_thread v JOIN
                      performance_schema.threads t ON t.THREAD_ID = v.THREAD_ID
                      WHERE v.VARIABLE_NAME = 'binlog_row_image' AND
                      v.VARIABLE_VALUE <> 'FULL'
                        AND t.TYPE = 'FOREGROUND' AND t.PROCESSLIST_ID IS NOT NULL
                        AND NOT EXISTS (SELECT 1 FROM performance_schema.session_connect_attrs a WHERE a.PROCESSLIST_ID = t.PROCESSLIST_ID AND a.ATTR_NAME = 'kestra_guard')

                  - id: sessions_still_reduced
                    type: io.kestra.plugin.core.execution.Fail
                    allowFailure: true
                    condition: "{{ outputs.read_sessions_after.row.reduced_sessions > 0 }}"
                    errorMessage: "binlog_row_image is FULL and a new session writes full images,
                      but {{ outputs.read_sessions_after.row.reduced_sessions }}
                      existing session(s) still write reduced images until they
                      reconnect. Recycle those connections."

                  - id: repaired
                    type: io.kestra.plugin.core.log.Log
                    message: "binlog_row_image is FULL and a Debezium capture of the canary update
                      carried the full before image."
                else:
                  - id: already_repaired
                    type: io.kestra.plugin.core.log.Log
                    message: "binlog_row_image is no longer reduced after the approval. Nothing was
                      changed."
            else:
              - id: declined
                type: io.kestra.plugin.core.log.Log
                message: "Approval was declined or timed out. binlog_row_image was not changed."
        else:
          - id: dry_run_only
            type: io.kestra.plugin.core.log.Log
            message: "Report only. Set auto_remediate=true and dry_run=false to request an
              approval."
    else:
      - id: not_degraded
        type: io.kestra.plugin.core.flow.If
        condition: "{{ outputs.read_settings.row.log_bin == 1 and
          outputs.read_settings.row.binlog_format == 'ROW' and
          outputs.read_sessions.row.reduced_sessions > 0 }}"
        then:
          - id: sessions_warning
            type: io.kestra.plugin.core.execution.Fail
            allowFailure: true
            errorMessage: "binlog_row_image is FULL but {{
              outputs.read_sessions.row.reduced_sessions }} session(s) still
              write reduced row images. Recycle those connections."
        else:
          - id: healthy_or_not_applicable
            type: io.kestra.plugin.core.log.Log
            message: "{{ outputs.read_settings.row.log_bin == 1 and
              outputs.read_settings.row.binlog_format == 'ROW' ?
              'binlog_row_image is FULL and no session writes a reduced image.'
              : 'Row based binary logging is not on, so the row image does not
              apply. Nothing was changed.' }}"

errors:
  - id: alert_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK_URL') }}"
    payload: >-
      {{ {'text': 'MySQL row image guard failed on ' ~ inputs.mysql_host ~ '
      (execution ' ~ execution.id ~ '). The setting may have been changed
      without proof; read binlog_row_image before retrying.'} | toJson }}

triggers:
  - id: scheduled_audit
    type: io.kestra.plugin.core.trigger.Schedule
    description: Disabled by default and pinned to report-only inputs.
    cron: "*/30 * * * *"
    disabled: true
    inputs:
      auto_remediate: false
      dry_run: true

Safety

With binlog_row_image set to MINIMAL or NOBLOB MySQL writes only part of each row into the binary log. Debezium refuses to start on such a server, so change capture stops and every consumer behind it goes quiet. This flow reads the setting, changes only that one variable after an approval and proves the result with a real capture.

Guard	What it stops
Detector on `log_bin`, `binlog_format` and `binlog_row_image`	Acting on a server where the row image does not apply
Disabled schedule and safe input pins	An unattended change from the scheduled path
`Pause` and a fresh read after it	Applying an approval to a server an operator already fixed
One variable, no restart and no retry	Touching anything but `binlog_row_image`
Debezium capture of a canary update	Reporting success while the change stream still fails
Count of sessions with a reduced image	Calling the repair done while open sessions keep writing partial rows
Flow level queue with limit 1	Two runs changing the setting together

How it works

validate_names accepts only simple identifiers for the database and the canary table.
read_settings and read_sessions (io.kestra.plugin.jdbc.mysql.Query) read the global settings and count client sessions whose own value is not FULL. Sessions opened by this flow carry a connection attribute and are left out.
A server with row based logging and a reduced image gets a Slack alert from alert. The default path ends there.
With auto_remediate true and dry_run false, approval (io.kestra.plugin.core.flow.Pause) waits. recheck_settings then reads the value again and a server that is already fixed is left alone.
read_canary reads the canary row, set_row_image runs SET GLOBAL (or SET PERSIST when persist_setting is true) and verify_setting reads the value back.
prove_capture (io.kestra.plugin.core.flow.Parallel) starts io.kestra.plugin.debezium.mysql.Capture on the canary table and updates the canary row from a second branch on a fresh connection. before_image_incomplete compares the captured before image with the row read in step 5 and fails the run if they differ.
read_sessions_after counts sessions that still write reduced images. A non-zero count ends the run as WARNING because the stream is repaired for new sessions only.

What you get

A report of the row image setting and of the sessions that still write reduced images.
A single approved change to one variable, with the old and new value in the execution log.
Proof from Debezium itself that a canary update arrives with a full before image.
A clear WARNING when long-lived connections have to be recycled.

Who it's for

Data platform teams that stream MySQL changes with Debezium into a warehouse or a Kafka topic.
DBAs who manage MySQL parameters across restarts, upgrades and managed service parameter groups.
Anyone who found a CDC pipeline silent after a MySQL change.

Why orchestrate this with Kestra

MySQL can set the variable and Debezium can read the log, but nothing connects the two. Kestra reads the setting, holds the approval, changes it once, starts a real capture while it updates the canary row and keeps the whole proof in one execution with a Slack alert and a failure state.

Tested end to end

Kestra 2.0.6 with the bundled MySQL, Debezium and Slack tasks against MySQL 8.0.36 with log_bin=ON, binlog_format=ROW and binlog_row_image=MINIMAL. With that setting a stand-alone Debezium capture refused to start (execution 6zmLJCSCcJU03HKuUn6hjT: "The database server is not configured to use a FULL binlog_row_image"). After the approved repair the same capture read an update of the canary row with a complete before image and every outcome was confirmed with the mysql client inside the server container.

A session that was already open when the setting changed kept writing reduced row images: the flow found it, finished with WARNING and said which sessions to recycle. The flow's own connections are tagged so they are never counted. The account password is a SECRET input and was absent from every execution and log.

Case	Execution	Result
Healthy: row image is FULL	`15upvmAh2vGReyyg7ypeRf`	SUCCESS. No alert, no write
Dry run: row image is MINIMAL	`39UbK2s0Igbv7QVlHfwK2u`	SUCCESS. Alert sent, report only, setting still MINIMAL
Declined approval	`5bMR6r5Rdx06YPVy59ctg3`	SUCCESS. Setting still MINIMAL, canary untouched
Approved repair	`7Xt4VPezzZmmDu3xB3R033`	SUCCESS. Global value FULL, Debezium captured the canary update and its before image matched the row read just before; canary updated exactly once
Repeat	`1r1gHatDBPaZ8IMV14DmpD`	SUCCESS. Healthy branch, no write, no approval
Account without SYSTEM_VARIABLES_ADMIN	`9JKrVxOIgCD3wlkidC1L8`	FAILED as intended. MySQL refused the change, the setting stayed MINIMAL and the canary was not touched
Operator fixed the setting during the Pause	`43LipqMYicS2CPK4tHmtUo`	SUCCESS. Recheck found FULL, no write, canary untouched
Existing session keeps the reduced image	`1KXFTywm7kkohu0PswWsA`	WARNING as intended. Global value FULL and capture proved, one open session still writes reduced images until it reconnects
FULL globally, one session still reduced	`6CvWqe0ys0DOGIZ7U5LQIV`	WARNING as intended. Reported without any write
Statement or mixed logging	`1jSLjv2GgkzTxPx4wQP4Jj`	SUCCESS. Row image does not apply, no alert, no write
Repair with SET PERSIST	`2n3wlK5rkVsUAZi7Gj42CJ`	SUCCESS. Global and persisted value FULL
Invalid canary table name	`57oxmUvDhZq3BMK047gJAL`	FAILED as intended before any query
Second MySQL: healthy	`4isveeTERE68pPce42Mcyq`	SUCCESS
Second MySQL: dry run	`4bGu9qSUAzua1JHCwVfbN2`	SUCCESS
Second MySQL: approved repair	`6fIBkWwPeuPng96EVeqGD6`	SUCCESS. Same proof
Second MySQL: fixed during the Pause	`1x1R1RPWKS3kYNS1Ircvoe`	SUCCESS

Prerequisites

Kestra OSS 2.0.6 or later with the MySQL, Debezium and Slack plugins.
MySQL 8.0 with log_bin=ON, binlog_format=ROW, a unique server_id and GTIDs or file positions that Debezium can read.
A canary table with an id primary key, a marker column and a counter column and one row in it. Only that row is ever updated.
A MySQL account (use mysql_native_password if your Debezium build cannot use caching_sha2_password) with SELECT on the canary database and on performance_schema, UPDATE on the canary table, REPLICATION SLAVE, REPLICATION CLIENT, RELOAD, SHOW DATABASES and LOCK TABLES for the Debezium schema snapshot and SYSTEM_VARIABLES_ADMIN for a repair.

Secrets

MYSQL_USERNAME and MYSQL_PASSWORD: the account above.
SLACK_WEBHOOK_URL: incoming webhook for the alert and the failure handler.

Inputs

Input	Purpose	Default
`mysql_host`, `mysql_port`	Server used by JDBC and by Debezium	`localhost`, `3306`
`mysql_database`	Database that holds the canary table	`cdc_demo`
`canary_table`, `canary_id`	Canary table and row	`cdc_canary`, `1`
`mysql_username`, `mysql_password`	Account; the password is a `SECRET` input	from secrets
`debezium_server_id`	Replica id used by the capture; must be unique	`40401`
`persist_setting`	Use `SET PERSIST` so a restart keeps `FULL`	`false`
`auto_remediate`	Allow the approval and repair branch	`false`
`dry_run`	Must be false before any change	`true`

Quick start

Create the canary table and row and grant the account its privileges.
Add the three secrets and run the flow with the defaults. It only reads.
If the setting is reduced, review the Slack alert. A change enlarges every row event in the binary log, so check log volume and replica capacity first.
Run again with auto_remediate=true and dry_run=false, review the Pause and resume with approved=true.
If the run ends in WARNING, recycle the connection pools listed by your application owners and run the report again.

How to extend

Set persist_setting to true on self-managed servers. On managed services change the parameter group instead, because a restart restores the group value.
Add a second capture of another table by adding a table to table.include.list.
Send the WARNING to the owning team with SlackIncomingWebhook and the session list from performance_schema.threads.

Limits: the flow changes the live value only. The next restart restores whatever the configuration file or parameter group says. Sessions that were open before the change keep their old value and the flow cannot recycle them. Capture uses properties for table.include.list because the dedicated includedTables property was not rendered by this plugin version.

MySQL Binlog Row Image Guard for Debezium CDC

Safety

How it works

What you get

Who it's for

Why orchestrate this with Kestra

Tested end to end

Prerequisites

Secrets

Inputs

Quick start

How to extend

Links

Tasks

Orchestrate with Kestra

Share this Blueprint

Create a Blueprint

New to Kestra?

MySQL Binlog Row Image Guard for Debezium CDC

Safety

How it works

What you get

Who it's for

Why orchestrate this with Kestra

Tested end to end

Prerequisites

Secrets

Inputs

Quick start

How to extend

Links

Tasks

Orchestrate with Kestra

Share this Blueprint

Create a Blueprint

More Data Blueprints

Hold Every Release to a Lighthouse Score Budget

Close IFRS 16 leases each month with remeasurements, terminations and the maturity analysis

Kubernetes Secret Exposure Sentinel

Kinesis Stream Throughput Quota Gate

Langfuse Daily LLM Trace Quality and Cost Sentinel

Detect lasting KPI shifts and name the release that caused them

More Infrastructure Blueprints

KMS Key Rotation Compliance Gate

KeyDB Active-Replica Multi-Master Peering Sentinel

Knative Service Revision Failure and Scale Sentinel

Retire Unused Kestra Flows with Quarantine, Approval and Restore

Kinesis Stream Throughput Quota Gate

Gate a Kestra upgrade against every live flow

New to Kestra?