Sync tenant resources at regular intervals

This blueprint turns your Git repository into the single source of truth for an entire Kestra tenant. Every 15 minutes, the flow pulls the latest namespaces, flows, KV pairs, files, and dashboards from a branch in GitHub (or any Git provider) and reconciles them with the running Kestra instance. Resources that exist in Git are created or updated, resources that disappear from Git are deleted from Kestra, and a configurable list of protected namespaces is left untouched. This gives platform teams a clean, auditable GitOps workflow for managing orchestration assets across environments.

How it works

A io.kestra.plugin.core.trigger.Schedule trigger named every_15_minutes fires the flow on the cron expression */15 * * * *. On each run, the tenant_sync task of type io.kestra.plugin.git.TenantSync connects to the configured Git url and branch, reads the contents of gitDirectory, and applies them to the Kestra tenant reachable at kestraUrl. The task uses sourceOfTruth: GIT and whenMissingInSource: DELETE, so the Git tree always wins and anything missing in source is removed from Kestra. The protectedNamespaces list (here, system) is excluded from deletion so that platform flows like this one are never wiped out by their own sync.

What you get

• Hands-off, recurring synchronization of tenant resources from Git to Kestra.
• Strict GitOps semantics: Git is authoritative, drift is auto-corrected.
• Safe deletes through protectedNamespaces.
• Full audit trail of every reconciliation in the Kestra Executions view.
• A single declarative YAML file you can promote across dev, staging, and production tenants.

Who it's for

• Platform and DevOps engineers standardizing Kestra deployments across environments.
• Data platform teams enforcing code review and pull request workflows on orchestration assets.
• SREs who want drift detection and automatic remediation for flows and dashboards.

Why orchestrate this with Kestra

Git providers do not run reconciliation loops, and most ad hoc cron jobs lack visibility, retries, and secret management. Kestra fills that gap. The Schedule trigger gives you predictable execution, every run is recorded with full lineage and logs, failures can be retried declaratively, and credentials are pulled from the secret manager via {{ secret('NAME') }} instead of being baked into scripts. Because the flow is plain YAML, you can version it in the same repo it syncs, review changes through pull requests, and promote them through environments without bespoke tooling.

Prerequisites

• A Kestra instance reachable from the worker running this flow.
• A Git repository containing your tenant resources under a known directory.
• Basic auth credentials (or a personal access token) for the Git provider.
• Basic auth credentials for the Kestra API.

Secrets

The flow reads the following secrets via {{ secret('...') }}:

• GITHUB_USERNAME: Git username used to clone the repository.
• GITHUB_ACCESS_TOKEN: personal access token or password for Git.
• KESTRA_USERNAME: Kestra API username used by TenantSync.
• KESTRA_PASSWORD: Kestra API password used by TenantSync.

Quick start

1. Add GITHUB_USERNAME, GITHUB_ACCESS_TOKEN, KESTRA_USERNAME, and KESTRA_PASSWORD to your secret manager.
2. Update the url, branch, and gitDirectory properties on the tenant_sync task to point at your repository layout.
3. Set kestraUrl to the address of the target Kestra instance (for example, http://localhost:8080 for local testing).
4. Adjust protectedNamespaces to cover any namespaces you never want overwritten or deleted.
5. Save the flow into a protected namespace (such as system) and let the every_15_minutes schedule take over.

How to extend

• Tighten or loosen the cadence by changing the cron expression on the every_15_minutes trigger.
• Switch to a webhook-style trigger so syncs run on each push instead of every 15 minutes.
• Flip whenMissingInSource to KEEP if you want additive syncs that never delete.
• Add more namespaces to protectedNamespaces to carve out areas owned outside of Git.
• Fan out to multiple tenants by templating kestraUrl and auth and running the flow per environment.
• Add a notification task (Slack, email, Microsoft Teams) on failure to alert your platform team when reconciliation breaks.

Links

• Plugin docs: https://kestra.io/plugins/plugin-git
• Orchestration page: https://kestra.io/orchestration/git