Manage Kestra Tenants with the Terraform Provider

Terraform Resource: kestra_tenant

Manages a Kestra Tenant.

Example usage

resource "kestra_tenant" "example" {
  tenant_id = "my-tenant"
  name      = "My Tenant"

  # cap how many executions of the whole tenant run at once
  concurrency {
    limit    = 10
    behavior = "QUEUE"
  }

  # and how many may start inside a sliding window
  quotas {
    duration = "PT1H"
    limit    = 100
    behavior = "FAIL"
  }
}

Schema

Required

• tenant_id (String) The tenant id.

Optional

• concurrency (Block List) The concurrency limit applied to the executions of every flow inside this scope and its descendants. (see below for nested schema)
• default_worker_selector (Block List) The default routing applied to every task of the tenant that does not define its own. Tasks are routed to a kestra_worker_queue whose tag set matches. (see below for nested schema)
• name (String) The tenant name.
• outputs_in_internal_storage (Boolean) Whether outputs are stored in internal storage.
• quotas (Block List) Quotas evaluated before an execution starts. Without any quota, executions run normally. (see below for nested schema)
• require_existing_namespace (Boolean) Whether tenant requires an existing namespace.
• secret_configuration (Map of String) The secret configuration.
• secret_isolation (Block List) Secret isolation configuration (same shape as storage_isolation). (see below for nested schema)
• secret_read_only (Boolean) Whether secrets are read-only in this tenant.
• secret_type (String) The secret type.
• storage_configuration (Map of String) The storage configuration.
• storage_isolation (Block List) Storage isolation configuration. (see below for nested schema)
• storage_type (String) The storage type.

Read-Only

• id (String) The tenant id.

Nested Schema for concurrency

Required:

• behavior (String) What happens to an execution once the limit is reached.
• limit (Number) The maximum number of concurrent executions.

Nested Schema for default_worker_selector

Required:

• tags (Set of String) The tags used to route to a matching Worker Queue (each tag is an RFC 1123 label). The API rejects match and fallback without a non-empty tag set.

Optional:

• fallback (String) The strategy when no worker is available: FAIL (default), WAIT, CANCEL or IGNORE.
• match (String) How the tags are matched against a Worker Queue tag set: ALL (default, the queue tags must be a superset) or ANY (they must intersect).

Nested Schema for quotas

Required:

• behavior (String) What happens to an execution once the quota is exhausted.
• duration (String) The sliding window the quota is counted over, as an ISO-8601 duration (for example PT1H).
• limit (Number) The maximum number of executions allowed inside the window.

Nested Schema for secret_isolation

Optional:

• denied_services (Set of String) Set of denied services.
• enabled (Boolean) Whether isolation is enabled.

Nested Schema for storage_isolation

Optional:

• denied_services (Set of String) Set of denied services.
• enabled (Boolean) Whether isolation is enabled.

Import

Import is supported using the following syntax:

The terraform import command can be used, for example:

terraform import kestra_tenant.example {{tenant_id}}