Manage Kestra Namespaces with the Terraform Provider

Terraform Resource: kestra_namespace

Manages a Kestra Namespace.

Example usage

resource "kestra_worker_queue" "gpu" {
  queue_id = "gpu"
  tags     = ["gpu", "linux"]
}

resource "kestra_namespace" "example" {
  namespace_id = "company.team"
  description  = "Friendly description"
  variables    = <<EOT
k1: 1
k2:
    v1: 1
EOT

  # route every task of the namespace to a Worker Queue matching these tags
  default_worker_selector {
    tags     = kestra_worker_queue.gpu.tags
    match    = "ALL"
    fallback = "WAIT"
  }

  # cap how many executions of this namespace and its descendants run at once
  concurrency {
    limit    = 5
    behavior = "QUEUE"
  }

  quotas {
    duration = "PT1H"
    limit    = 50
    behavior = "FAIL"
  }
}

Schema

Required

• namespace_id (String) The namespace id.

Optional

• allowed_namespaces (Block List) The allowed namespaces. (see below for nested schema)
• concurrency (Block List) The concurrency limit applied to the executions of every flow inside this scope and its descendants. (see below for nested schema)
• default_worker_selector (Block List) The default routing applied to every task of the namespace that does not define its own. Tasks are routed to a kestra_worker_queue whose tag set matches. (see below for nested schema)
• description (String) The namespace friendly description.
• outputs_in_internal_storage (Boolean) Whether outputs are stored in internal storage.
• quotas (Block List) Quotas evaluated before an execution starts. Without any quota, executions run normally. (see below for nested schema)
• secret_configuration (Dynamic) Per-backend secret configuration. The whole value is a free-form map keyed by backend type (e.g. vault, aws, gcp), where each value is either a string or a nested object describing that backend’s config.
• secret_isolation (Block List) Secret isolation configuration. (see below for nested schema)
• secret_read_only (Boolean) Whether secrets are read-only in this namespace.
• secret_type (String) The secret type.
• storage_configuration (Map of String) The storage configuration.
• storage_isolation (Block List) Storage isolation configuration. (see below for nested schema)
• storage_type (String) The storage type.
• variables (String) The namespace variables in yaml string.

Read-Only

• id (String) The namespace id.
• tenant_id (String) The tenant id.

Nested Schema for allowed_namespaces

Required:

• namespace (String) The namespace.

Nested Schema for concurrency

Required:

• behavior (String) What happens to an execution once the limit is reached.
• limit (Number) The maximum number of concurrent executions.

Nested Schema for default_worker_selector

Required:

• tags (Set of String) The tags used to route to a matching Worker Queue (each tag is an RFC 1123 label). Required: the API rejects match and fallback without a non-empty tag set.

Optional:

• fallback (String) The strategy when no worker is available: FAIL (default), WAIT, CANCEL or IGNORE.
• match (String) How the tags are matched against a Worker Queue tag set: ALL (default, the queue tags must be a superset) or ANY (they must intersect).

Nested Schema for quotas

Required:

• behavior (String) What happens to an execution once the quota is exhausted.
• duration (String) The sliding window the quota is counted over, as an ISO-8601 duration (for example PT1H).
• limit (Number) The maximum number of executions allowed inside the window.

Nested Schema for secret_isolation

Optional:

• denied_services (Set of String) Set of denied services.
• enabled (Boolean) Whether isolation is enabled.

Nested Schema for storage_isolation

Optional:

• denied_services (Set of String) Set of denied services.
• enabled (Boolean) Whether isolation is enabled.

Import

Import is supported using the following syntax:

The terraform import command can be used, for example:

terraform import kestra_namespace.example {{namespace}}