Ory Kratos Identity Service Readiness & Health Sentinel

id: ory-kratos-identity-service-health-sentinel
namespace: company.team
description: |
  Audits standalone or cluster Ory Kratos identity management instances on a
  schedule, verifying admin readiness probes and identity querying capabilities
  to catch database pool exhaustion, migration locks, or trait schema errors,
  and dispatching actionable operational Slack alerts.

triggers:
  - id: periodic_kratos_audit
    type: io.kestra.plugin.core.trigger.Schedule
    description: "Periodically asserts Ory Kratos admin readiness and identity
      retrieval operations. Shipped disabled by default; enable once kratos_host
      and kratos_admin_port point to a running Ory Kratos instance."
    cron: "*/15 * * * *"
    disabled: true
    inputs:
      kratos_host: "localhost"
      kratos_admin_port: 4434
      alert_channel: "#identity-ops"

inputs:
  - id: kratos_host
    type: STRING
    displayName: "Ory Kratos Host"
    defaults: "localhost"
    description: "Hostname or IP address of the Ory Kratos server instance."

  - id: kratos_admin_port
    type: INT
    displayName: "Kratos Admin Port"
    defaults: 4434
    description: "HTTP port exposed by Ory Kratos for its administrative API
      (default: 4434)."

  - id: alert_channel
    type: STRING
    displayName: "Slack Alert Channel"
    defaults: "#identity-ops"
    description: "Slack channel where operational identity engine alerts are posted."

tasks:
  - id: probe_kratos_readiness
    type: io.kestra.plugin.core.http.Request
    description: "Queries Ory Kratos GET /admin/health/ready endpoint to verify
      database connectivity, schema migrations, and cryptographic cipher
      readiness."
    uri: "http://{{ inputs.kratos_host }}:{{ inputs.kratos_admin_port
      }}/admin/health/ready"
    method: GET
    headers:
      Accept: "application/json"
    options:
      allowFailed: true

  - id: probe_identity_query
    type: io.kestra.plugin.core.http.Request
    description: "Executes synthetic admin identity query via GET /admin/identities
      asserting SQL read capability and traits schema deserialization."
    uri: "http://{{ inputs.kratos_host }}:{{ inputs.kratos_admin_port
      }}/admin/identities?per_page=1"
    method: GET
    headers:
      Accept: "application/json"
    options:
      allowFailed: true

  - id: classify_kratos_status
    type: io.kestra.plugin.core.flow.Switch
    description: "Evaluates readiness status and identity query response code to
      classify operational health."
    value: >-
      {% if (fromJson(outputs.probe_kratos_readiness.body).status ?? '') != 'ok'
      %} ENGINE_UNREADY {% elif outputs.probe_identity_query.code >= 400 %}
      IDENTITY_QUERY_FAILED {% else %} HEALTHY {% endif %}
    cases:
      ENGINE_UNREADY:
        - id: alert_engine_unready
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          description: "Dispatches critical operational alert when Ory Kratos readiness
            probe reports degraded or unready status."
          url: "{{ secret('SLACK_WEBHOOK_URL') }}"
          payload: |
            {
              "channel": "{{ inputs.alert_channel }}",
              "text": ":rotating_light: *Ory Kratos Identity Engine Unready*",
              "blocks": [
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": ":rotating_light: *Ory Kratos Readiness Check Failed*\n*Host:* `{{ inputs.kratos_host }}:{{ inputs.kratos_admin_port }}`\n*Readiness Status:* `{{ fromJson(outputs.probe_kratos_readiness.body).status ?? 'unreachable' }}`\n*HTTP Code:* `{{ outputs.probe_kratos_readiness.code }}`\n*Impact:* The identity engine is rejecting traffic. Database connection pool may be exhausted, migration locks unresolved, or encryption secrets misconfigured."
                  }
                }
              ]
            }

      IDENTITY_QUERY_FAILED:
        - id: alert_query_failed
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          description: "Dispatches warning alert when Kratos returns an HTTP error during
            administrative identity retrieval."
          url: "{{ secret('SLACK_WEBHOOK_URL') }}"
          payload: |
            {
              "channel": "{{ inputs.alert_channel }}",
              "text": ":warning: *Ory Kratos Identity Query Degradation*",
              "blocks": [
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": ":warning: *Identity Deserialization or Query Failure*\n*Host:* `{{ inputs.kratos_host }}:{{ inputs.kratos_admin_port }}`\n*HTTP Code:* `{{ outputs.probe_identity_query.code }}`\n*Impact:* Admin API failed to query or deserialize user identity records. Identity traits JSON schema may have drifted or SQL read replicas are timing out."
                  }
                }
              ]
            }

      HEALTHY:
        - id: log_healthy_state
          type: io.kestra.plugin.core.log.Log
          message: "Ory Kratos identity service verified healthy on {{ inputs.kratos_host
            }}:{{ inputs.kratos_admin_port }}. Readiness status: ok, identity
            query HTTP code: {{ outputs.probe_identity_query.code }}."

  - id: log_audit_complete
    type: io.kestra.plugin.core.log.Log
    description: "Persists final execution audit entry with endpoint host and
      response verification metadata for compliance lineage."
    message: "Ory Kratos sentinel audit completed for host {{ inputs.kratos_host
      }}:{{ inputs.kratos_admin_port }}."

errors:
  - id: alert_kratos_unreachable
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    description: "Dispatches out-of-band notification if Ory Kratos server cannot be
      reached."
    url: "{{ secret('SLACK_WEBHOOK_URL') }}"
    payload: |
      {
        "channel": "{{ inputs.alert_channel }}",
        "text": ":rotating_light: *Ory Kratos Server Unreachable*",
        "blocks": [
          {
            "type": "section",
            "text": {
              "type": "mrkdwn",
              "text": ":rotating_light: *Ory Kratos Connectivity Outage*\nFailed to connect to Ory Kratos Admin API at `http://{{ inputs.kratos_host }}:{{ inputs.kratos_admin_port }}`. The server container may be down, network routing severed, or firewall rules blocking port."
            }
          }
        ]
      }