MySQL General Query Log Revert Guard with Kestra

id: mysql-general-query-log-left-on-revert-guard
namespace: company.team
description: Restore an expected-OFF runtime general query log policy after
  approval and prove instrumented file writes stop.

concurrency:
  limit: 1
  behavior: QUEUE

inputs:
  - id: jdbc_url
    type: STRING
    defaults: "{{ secret('MYSQL_JDBC_URL') }}"
    description: MySQL 8.0 or 8.4 server URL with connectTimeout=5000 and
      socketTimeout=10000.
  - id: username
    type: STRING
    defaults: "{{ secret('MYSQL_USERNAME') }}"
  - id: password
    type: STRING
    defaults: "{{ secret('MYSQL_PASSWORD') }}"
  - id: expected_general_log
    type: SELECT
    values: [ 'OFF', INTENTIONAL_ON ]
    defaults: 'OFF'
    description: Explicit policy for this server. INTENTIONAL_ON protects an
      intentional logging session.
  - id: protected_setters
    type: ARRAY
    itemType: STRING
    defaults: [ observability ]
    description: Users whose last general_log change must be preserved. Match
      SET_USER exactly.
  - id: grace_seconds
    type: INT
    defaults: 1800
    min: 1
    max: 86400
  - id: dry_run
    type: BOOL
    defaults: true
  - id: auto_remediate
    type: BOOL
    defaults: false
  - id: slack_webhook_url
    type: STRING
    defaults: "{{ secret('SLACK_WEBHOOK_URL') }}"

variables:
  snapshot_sql: |
    SELECT @@GLOBAL.server_uuid AS server_uuid,
           IF(@@GLOBAL.general_log, 'ON', 'OFF') AS general_log,
           @@GLOBAL.log_output AS log_output,
           @@GLOBAL.general_log_file AS log_file,
           IF(@@GLOBAL.slow_query_log, 'ON', 'OFF') AS slow_query_log,
           @@GLOBAL.slow_query_log_file AS slow_log_file,
           @@GLOBAL.long_query_time AS long_query_time,
           v.VARIABLE_SOURCE AS source,
           COALESCE(DATE_FORMAT(v.SET_TIME, '%Y-%m-%d %H:%i:%s.%f'), '') AS set_at,
           COALESCE(v.SET_USER, '') AS set_user,
           COALESCE(TIMESTAMPDIFF(SECOND, v.SET_TIME, NOW(6)), -1) AS age_seconds,
           COALESCE((SELECT VARIABLE_VALUE FROM performance_schema.persisted_variables
                     WHERE VARIABLE_NAME='general_log'), 'ABSENT') AS persisted,
           (SELECT COUNT(*) FROM performance_schema.setup_instruments
            WHERE NAME='wait/io/file/sql/query_log' AND ENABLED='YES') AS instrument_enabled,
           (SELECT COUNT(*) FROM performance_schema.file_summary_by_instance
            WHERE EVENT_NAME='wait/io/file/sql/query_log' AND FILE_NAME=@@GLOBAL.general_log_file) AS file_instances,
           COALESCE((SELECT MAX(OBJECT_INSTANCE_BEGIN) FROM performance_schema.file_summary_by_instance
                     WHERE EVENT_NAME='wait/io/file/sql/query_log' AND FILE_NAME=@@GLOBAL.general_log_file), 0) AS file_instance,
           COALESCE((SELECT SUM(SUM_NUMBER_OF_BYTES_WRITE) FROM performance_schema.file_summary_by_instance
                     WHERE EVENT_NAME='wait/io/file/sql/query_log' AND FILE_NAME=@@GLOBAL.general_log_file), 0) AS bytes_written,
           CASE WHEN @@GLOBAL.general_log=1 AND :expected='OFF'
                 AND @@GLOBAL.log_output='FILE'
                 AND v.VARIABLE_SOURCE='DYNAMIC' AND v.SET_TIME IS NOT NULL
                 AND TIMESTAMPDIFF(SECOND, v.SET_TIME, NOW(6)) >= :grace
                 AND NOT JSON_CONTAINS(:protected_json, JSON_QUOTE(COALESCE(v.SET_USER, '')))
                 AND NOT EXISTS (SELECT 1 FROM performance_schema.persisted_variables
                                 WHERE VARIABLE_NAME='general_log' AND VARIABLE_VALUE IN ('ON','1'))
                 AND EXISTS (SELECT 1 FROM performance_schema.setup_instruments
                             WHERE NAME='wait/io/file/sql/query_log' AND ENABLED='YES')
                 AND EXISTS (SELECT 1 FROM performance_schema.file_summary_by_instance
                             WHERE EVENT_NAME='wait/io/file/sql/query_log' AND FILE_NAME=@@GLOBAL.general_log_file)
                THEN 1 ELSE 0 END AS eligible
    FROM performance_schema.variables_info v WHERE v.VARIABLE_NAME='general_log'

tasks:
  - id: detect
    type: io.kestra.plugin.jdbc.mysql.Query
    url: "{{ inputs.jdbc_url }}"
    username: "{{ inputs.username }}"
    password: "{{ inputs.password }}"
    connectionPoolSize: 1
    sql: "{{ render(vars.snapshot_sql) }}"
    parameters:
      expected: "{{ inputs.expected_general_log }}"
      grace: "{{ inputs.grace_seconds }}"
      protected_json: "{{ inputs.protected_setters | toJson }}"
    fetchType: FETCH_ONE
    timeout: PT20S

  - id: report
    type: io.kestra.plugin.core.log.Log
    message: >-
      General query log {{ outputs.detect.row.general_log }} on server {{
      outputs.detect.row.server_uuid }}. Policy {{ inputs.expected_general_log
      }}, age {{ outputs.detect.row.age_seconds }} seconds, source {{
      outputs.detect.row.source }}, setter {{ outputs.detect.row.set_user }},
      output {{ outputs.detect.row.log_output }}, persisted {{
      outputs.detect.row.persisted }}, eligible {{ outputs.detect.row.eligible
      }}. Startup settings, TABLE output, persisted ON, protected setters and
      unknown instrumentation require operator investigation.

  - id: incident
    type: io.kestra.plugin.core.flow.If
    condition: "{{ outputs.detect.row.eligible == 1 }}"
    then:
      - id: finding
        type: io.kestra.plugin.core.http.Request
        uri: "{{ inputs.slack_webhook_url }}"
        method: POST
        contentType: application/json
        body: >-
          {{ {'text': 'MySQL general query log was left ON beyond the
          expected-OFF grace on server ' ~ outputs.detect.row.server_uuid ~ '.
          File ' ~ outputs.detect.row.log_file ~ ', age ' ~
          outputs.detect.row.age_seconds ~ ' seconds. dry_run=' ~ inputs.dry_run
          ~ ' auto_remediate=' ~ inputs.auto_remediate ~ '. Execution ' ~
          execution.id} | toJson }}
      - id: change_enabled
        type: io.kestra.plugin.core.flow.If
        condition: "{{ inputs.auto_remediate and not inputs.dry_run }}"
        then:
          - id: approval
            type: io.kestra.plugin.core.flow.Pause
            pauseDuration: PT30M
            onResume:
              - id: approved
                type: BOOL
                defaults: false
                description: Approve turning runtime general_log OFF for this server only.
          - id: approved_change
            type: io.kestra.plugin.core.flow.If
            condition: "{{ outputs.approval.onResume.approved ?? false }}"
            then:
              - id: recheck
                type: io.kestra.plugin.jdbc.mysql.Query
                url: "{{ inputs.jdbc_url }}"
                username: "{{ inputs.username }}"
                password: "{{ inputs.password }}"
                connectionPoolSize: 1
                sql: "{{ render(vars.snapshot_sql) }}"
                parameters:
                  expected: "{{ inputs.expected_general_log }}"
                  grace: "{{ inputs.grace_seconds }}"
                  protected_json: "{{ inputs.protected_setters | toJson }}"
                fetchType: FETCH_ONE
                timeout: PT20S
              - id: unchanged_plan
                type: io.kestra.plugin.core.flow.If
                condition: >-
                  {{ outputs.recheck.row.eligible == 1 and
                     outputs.recheck.row.server_uuid == outputs.detect.row.server_uuid and
                     outputs.recheck.row.set_at == outputs.detect.row.set_at and
                     outputs.recheck.row.log_file == outputs.detect.row.log_file and
                     outputs.recheck.row.slow_query_log == outputs.detect.row.slow_query_log and
                     outputs.recheck.row.slow_log_file == outputs.detect.row.slow_log_file and
                     outputs.recheck.row.long_query_time == outputs.detect.row.long_query_time }}
                then:
                  - id: restore_runtime_off
                    type: io.kestra.plugin.jdbc.mysql.Query
                    url: "{{ inputs.jdbc_url }}"
                    username: "{{ inputs.username }}"
                    password: "{{ inputs.password }}"
                    connectionPoolSize: 1
                    allowFailure: true
                    timeout: PT20S
                    sql: |
                      SET GLOBAL general_log=IF(
                        @@GLOBAL.general_log=1 AND @@GLOBAL.server_uuid=:server_uuid
                        AND @@GLOBAL.log_output='FILE' AND @@GLOBAL.general_log_file=:log_file
                        AND IF(@@GLOBAL.slow_query_log,'ON','OFF')=:slow_query_log
                        AND @@GLOBAL.slow_query_log_file=:slow_log_file
                        AND @@GLOBAL.long_query_time=:long_query_time
                        AND EXISTS (SELECT 1 FROM performance_schema.setup_instruments
                          WHERE NAME='wait/io/file/sql/query_log' AND ENABLED='YES')
                        AND EXISTS (SELECT 1 FROM performance_schema.file_summary_by_instance
                          WHERE EVENT_NAME='wait/io/file/sql/query_log' AND FILE_NAME=:log_file)
                        AND EXISTS (SELECT 1 FROM performance_schema.variables_info
                          WHERE VARIABLE_NAME='general_log' AND VARIABLE_SOURCE='DYNAMIC'
                            AND DATE_FORMAT(SET_TIME, '%Y-%m-%d %H:%i:%s.%f')=:set_at
                            AND TIMESTAMPDIFF(SECOND, SET_TIME, NOW(6)) >= :grace
                            AND NOT JSON_CONTAINS(:protected_json, JSON_QUOTE(COALESCE(SET_USER, ''))))
                        AND NOT EXISTS (SELECT 1 FROM performance_schema.persisted_variables
                          WHERE VARIABLE_NAME='general_log' AND VARIABLE_VALUE IN ('ON','1')),
                        0, -1)
                    parameters:
                      server_uuid: "{{ outputs.detect.row.server_uuid }}"
                      log_file: "{{ outputs.detect.row.log_file }}"
                      set_at: "{{ outputs.detect.row.set_at }}"
                      slow_query_log: "{{ outputs.detect.row.slow_query_log }}"
                      slow_log_file: "{{ outputs.detect.row.slow_log_file }}"
                      long_query_time: "{{ outputs.detect.row.long_query_time }}"
                      grace: "{{ inputs.grace_seconds }}"
                      protected_json: "{{ inputs.protected_setters | toJson }}"
                  - id: after_write
                    type: io.kestra.plugin.jdbc.mysql.Query
                    url: "{{ inputs.jdbc_url }}"
                    username: "{{ inputs.username }}"
                    password: "{{ inputs.password }}"
                    connectionPoolSize: 1
                    sql: "{{ render(vars.snapshot_sql) }}"
                    parameters:
                      expected: "{{ inputs.expected_general_log }}"
                      grace: "{{ inputs.grace_seconds }}"
                      protected_json: "{{ inputs.protected_setters | toJson }}"
                    fetchType: FETCH_ONE
                    timeout: PT20S
                  - id: controlled_query_burst
                    type: io.kestra.plugin.core.flow.Loop
                    values: [ 1, 2, 3, 4, 5 ]
                    concurrencyLimit: 1
                    tasks:
                      - id: harmless_statement
                        type: io.kestra.plugin.jdbc.mysql.Query
                        url: "{{ inputs.jdbc_url }}"
                        username: "{{ inputs.username }}"
                        password: "{{ inputs.password }}"
                        connectionPoolSize: 1
                        sql: "SELECT :probe AS general_log_guard_probe"
                        parameters:
                          probe: "{{ item.value }}"
                        fetchType: FETCH_ONE
                        timeout: PT20S
                  - id: verify
                    type: io.kestra.plugin.jdbc.mysql.Query
                    url: "{{ inputs.jdbc_url }}"
                    username: "{{ inputs.username }}"
                    password: "{{ inputs.password }}"
                    connectionPoolSize: 1
                    sql: "{{ render(vars.snapshot_sql) }}"
                    parameters:
                      expected: "{{ inputs.expected_general_log }}"
                      grace: "{{ inputs.grace_seconds }}"
                      protected_json: "{{ inputs.protected_setters | toJson }}"
                    fetchType: FETCH_ONE
                    timeout: PT20S
                  - id: outcome
                    type: io.kestra.plugin.core.flow.If
                    condition: >-
                      {{ outputs.after_write.row.general_log == 'OFF' and
                      outputs.verify.row.general_log == 'OFF' and
                         outputs.verify.row.server_uuid == outputs.detect.row.server_uuid and
                         outputs.verify.row.log_file == outputs.detect.row.log_file and outputs.verify.row.log_output == 'FILE' and
                         outputs.after_write.row.instrument_enabled == 1 and outputs.verify.row.instrument_enabled == 1 and
                         outputs.after_write.row.file_instances == 1 and outputs.verify.row.file_instances == 1 and
                         outputs.after_write.row.bytes_written > 0 and
                         outputs.verify.row.file_instance == outputs.after_write.row.file_instance and
                         outputs.verify.row.bytes_written == outputs.after_write.row.bytes_written and
                         outputs.verify.row.slow_query_log == outputs.detect.row.slow_query_log and
                         outputs.verify.row.slow_log_file == outputs.detect.row.slow_log_file and
                         outputs.verify.row.long_query_time == outputs.detect.row.long_query_time }}
                    then:
                      - id: recovered
                        type: io.kestra.plugin.core.log.Log
                        message: >-
                          Runtime general_log is OFF. Instrumented bytes stayed
                          at {{ outputs.verify.row.bytes_written }} across five
                          harmless queries. Slow-log settings were preserved.
                          Existing log contents remain.
                    else:
                      - id: unresolved
                        type: io.kestra.plugin.core.execution.Fail
                        errorMessage: General query logging remains enabled, its instrumented file
                          writes continued or protected settings changed.
                          Inspect the server before retrying.
                else:
                  - id: stale_approval
                    type: io.kestra.plugin.core.execution.Fail
                    errorMessage: Approval expired because the server or logging policy changed. No
                      remediation was attempted. Read current state and approve
                      a new plan.
            else:
              - id: declined
                type: io.kestra.plugin.core.log.Log
                message: Approval was not granted. Runtime logging was preserved.
        else:
          - id: report_only
            type: io.kestra.plugin.core.log.Log
            message: Read-only mode. Eligible runtime general_log would be turned OFF after
              approval.

triggers:
  - id: forgotten_log
    type: io.kestra.plugin.jdbc.mysql.Trigger
    disabled: true
    allowConcurrent: false
    interval: PT5M
    url: "{{ secret('MYSQL_JDBC_URL') }}"
    username: "{{ secret('MYSQL_USERNAME') }}"
    password: "{{ secret('MYSQL_PASSWORD') }}"
    connectionPoolSize: 1
    fetchType: FETCH_ONE
    sql: |
      SELECT @@GLOBAL.server_uuid AS server_uuid, v.SET_TIME AS changed_at
      FROM performance_schema.variables_info v
      WHERE v.VARIABLE_NAME='general_log' AND @@GLOBAL.general_log=1
        AND @@GLOBAL.log_output='FILE' AND v.VARIABLE_SOURCE='DYNAMIC'
        AND v.SET_TIME IS NOT NULL AND TIMESTAMPDIFF(SECOND, v.SET_TIME, NOW(6)) >= 1800
        AND COALESCE(v.SET_USER,'') NOT IN ('observability')
        AND NOT EXISTS (SELECT 1 FROM performance_schema.persisted_variables
          WHERE VARIABLE_NAME='general_log' AND VARIABLE_VALUE IN ('ON','1'))
        AND EXISTS (SELECT 1 FROM performance_schema.setup_instruments
          WHERE NAME='wait/io/file/sql/query_log' AND ENABLED='YES')
        AND EXISTS (SELECT 1 FROM performance_schema.file_summary_by_instance
          WHERE EVENT_NAME='wait/io/file/sql/query_log' AND FILE_NAME=@@GLOBAL.general_log_file)

errors:
  - id: alert_failure
    type: io.kestra.plugin.core.http.Request
    uri: "{{ inputs.slack_webhook_url }}"
    method: POST
    contentType: application/json
    body: >-
      {{ {'text': 'MySQL general query log guard failed. An unreadable server,
      stale approval, refused write or unresolved logging symptom needs
      investigation. Execution ' ~ execution.id} | toJson }}

Safety

SET GLOBAL general_log = ON is the quickest way to see every statement a MySQL server receives. It is usually turned on for a debugging session and then forgotten. From then on every query, including the text of statements with personal data, is written to disk on every request. The log grows without bound and costs I/O. Turning it off is a one-line change, but the wrong server, an intentional audit log or a change made by another administrator a second ago must be left alone. So the flow refuses by default and every guard below is load bearing. Each one was proven by its own run.

Guard	What it stops
`expected_general_log: OFF` policy, `INTENTIONAL_ON` to opt out	turning off a log someone keeps on purpose
`protected_setters`	undoing a change made by a protected account such as `observability`
Grace period on `variables_info.SET_TIME`	ending a debugging session that is still going on
Persisted ON, startup ON, `TABLE` or `FILE,TABLE` output spared	fighting configuration that was set deliberately
Missing file instrumentation makes the server ineligible	a change the flow could not verify afterwards
`auto_remediate` false, `dry_run` true, `Pause`	three separate gates before one write
Recheck of server UUID, change time, setter and slow-log settings after approval	acting on a plan that went stale while the approval waited
Conditional write that sends an invalid value when the precondition fails	rewriting the setter and time metadata when nothing should change
Read-back plus a controlled query burst against the file counter	a `SET` that returned success being reported as a fix

How it works

detect (io.kestra.plugin.jdbc.mysql.Query) reads general_log, log_output, the persisted and startup values, the setter and SET_TIME from performance_schema.variables_info, the slow-log settings and the byte counter of the wait/io/file/sql/query_log instrument. It classifies the server as eligible or names why not.
report logs the setter, age, output destination and persisted state. It never reads statement contents. incident (If) continues only when the server is eligible and posts the finding to Slack (finding).
change_enabled (If) requires auto_remediate: true and dry_run: false. Otherwise report_only logs and the run ends.
approval (Pause) waits for a person. approved_change reads onResume.approved ?? false, so a resume with no answer is a refusal.
recheck reads the server again. unchanged_plan (If) continues only if the server UUID, change time, setter, output destination and slow-log settings all match the plan. Otherwise stale_approval fails the run before any write.
restore_runtime_off sets general_log with one conditional statement: OFF if the same change is still in place, otherwise the invalid value -1. MySQL rejects -1 with error 1231 and leaves the variable, its setter and its time unchanged.
after_write reads the value back. controlled_query_burst (Loop) runs five harmless queries. verify reads the file counter again. outcome fails the run (unresolved) unless logging is OFF and the counter did not move. alert_failure posts failures to Slack.

The event trigger forgotten_log (io.kestra.plugin.jdbc.mysql.Trigger) ships disabled: true, with dry_run: true and auto_remediate: false.

What you get

An alert when a general query log has been left on past the grace period, naming who turned it on and when.
A return to the expected OFF state that only happens on the server and change that were approved.
Proof that statements stopped reaching the log file. When they did not, the run fails and says so.
Existing log contents, slow-log settings and intentional audit logging left as they were.

Who it's for

Database operators and SREs who turn on MySQL's general query log for debugging and want it reliably turned off afterwards.

Why orchestrate this with Kestra

A forgotten log has no alert of its own: the server keeps working while the file grows. Kestra makes it an event-driven check, holds the change at a Pause for a person, rechecks the server after the approval and proves the effect with a controlled workload, all in one execution. MySQL's own variable metadata and Performance Schema instrument provide the evidence.

Tested end to end

Kestra 2.0.5, JDBC MySQL plugin 2.1.0, MySQL 8.0.46. Validate was clean: no constraints, warnings or deprecations. Every state was read with an independent mysql client, not from the flow's output. All seven required cases ran on the final revision 3:

Case	Execution	Result
Healthy	`7gxsy51Fl9wSzIqGqAbVln`	SUCCESS. `general_log` OFF, nothing written
Dry run	`1iGhiT2g7fP8yVppD3aDxm`	SUCCESS. Eligible, still ON, file kept growing from 277,992 to 285,124 bytes, no write
Declined approval	`hApUtoVkQwzACJPUBqgzs`	SUCCESS. Still ON, setter and set time unchanged
Remediation	`2R6ypFIzyx7Mqmj4Nj5YkE`	SUCCESS. ON to OFF. The file stayed at 308,814 bytes with the same SHA-256 through five queries and a separate client burst. Slow logging stayed ON and its file kept growing
Repeat	`QPpLY4R1PqSLcsTMfTdx4`	SUCCESS. Already OFF, nothing written
Refused write	`2oFKIHLWHrM83IlbXqKBWd`	FAILED as intended. A `readonly` user without `SYSTEM_VARIABLES_ADMIN` reached the write, MySQL refused it, logging stayed ON and the file grew from 310,976 to 339,133 bytes. Verification failed the run
Change during the Pause	`7mABDq1Mdyg8z03hHk3lxz`	FAILED as intended. The protected `observability` account changed the setting while the approval waited. `recheck` refused before any write and the new setter was kept

Earlier revisions also proved the protected cases: intentional ON, protected setter, persisted ON, TABLE and FILE,TABLE output, disabled instrumentation, startup ON, below-grace changes and a two-second grace boundary. Five changes made during the Pause failed before any write. A fresh digest-pinned fixture repeated the seven required cases. An enabled copy of the event trigger produced no execution while healthy and one execution once logging was turned on. Slack was a local HTTP sink.

Revision 3 exists because a review found that the earlier conditional write, when its precondition failed, rewrote general_log to its current value and so changed SET_TIME and SET_USER. The invalid-value form leaves all three untouched, measured on the same server.

Prerequisites

MySQL 8.0 with Performance Schema and the wait/io/file/sql/query_log instrument enabled. Tested on 8.0.46 only.
Kestra 2.0.5 with the JDBC MySQL and Slack plugins.
Minimum permissions: SELECT on performance_schema, plus SYSTEM_VARIABLES_ADMIN to turn the log off. No SUPER.

Secrets

MYSQL_JDBC_URL, MYSQL_USERNAME, MYSQL_PASSWORD: the server and account.
SLACK_WEBHOOK_URL: Slack incoming webhook for findings and failures.

Inputs

Input	Default	Purpose
`expected_general_log`	`OFF`	Policy. `INTENTIONAL_ON` spares a server that keeps the log on purpose
`protected_setters`	`[observability]`	Accounts whose changes are never undone
`grace_seconds`	`1800`	Time the log may stay on before it counts as forgotten
`dry_run`	`true`	Report only
`auto_remediate`	`false`	Ask for approval to turn the log off

Quick start

Add the four secrets. Grant the account SELECT on performance_schema and SYSTEM_VARIABLES_ADMIN.
Execute with the defaults. Read the report: setter, age and output destination.
List debugging or audit accounts you never want undone in protected_setters.
Execute with dry_run: false and auto_remediate: true, then approve the Pause.
Read the verification lines: the variable is OFF and the file counter did not move.
Enable the forgotten_log trigger to check continuously.

How to extend

Rotate or archive the existing general log file after the change, with its own approval.
Run the same flow per server from a list, so each keeps its own approval and recheck.
Feed the finding into a ticket so the person who turned the log on is told.

Limits: the change is runtime only. It does not edit my.cnf or a persisted value. It does not shrink the existing file either. The conditional SET is not a lock, so another administrator can still change the variable afterwards. MySQL 8.4 was not tested.

MySQL General Query Log Left On Revert Guard

Safety

How it works

What you get

Who it's for

Why orchestrate this with Kestra

Tested end to end

Prerequisites

Secrets

Inputs

Quick start

How to extend

Links

Tasks

Share this Blueprint

Create a Blueprint

New to Kestra?

MySQL General Query Log Left On Revert Guard

Safety

How it works

What you get

Who it's for

Why orchestrate this with Kestra

Tested end to end

Prerequisites

Secrets

Inputs

Quick start

How to extend

Links

Tasks

Share this Blueprint

Create a Blueprint

More Data Blueprints

Changelog CI Validation with Liquibase Update-Testing-Rollback

Kubernetes Secret Exposure Sentinel

Kinesis Stream Throughput Quota Gate

KeyDB Active-Replica Multi-Master Peering Sentinel

Langfuse Daily LLM Trace Quality and Cost Sentinel

LakeFS Isolated Lakehouse Branching and Atomic Merge Gate

More Infrastructure Blueprints

Retire Unused Kestra Flows with Quarantine, Approval and Restore

Gate Kestra Subflow Changes Against Every Caller Before Deploying

KMS Key Rotation Compliance Gate

Knative Service Revision Failure and Scale Sentinel

Kinesis Stream Throughput Quota Gate

KeyDB Active-Replica Multi-Master Peering Sentinel

New to Kestra?