Standardize provisioning and Day 2 operations with less risk and operational overhead. Get full visibility and control across all infrastructure workflows.
Our goal is for Kestra to become the go-to solution across the organization whenever data wrangling and complex pipeline orchestration are needed.
Run IaC the same way every time. Kestra orchestrates the full lifecycle with shared parameters, secrets, retries, and evidence-grade logs across all environments.
Provision and evolve workloads anywhere. Kestra workflows drive K8s, vSphere, cloud, and network APIs with consistent sequencing, execution, and traceability.
Pause workflows for critical checks. Kestra offers reliable Business Decisions with audit trail and controlled executions.
Wrap your playbooks in a production-grade layer. Gain structured inputs, secret injection, parallel execution, and granular logging without changing a single line of code.
Automate your Playbooks with KestraEnable true self-service infrastructure. Kestra turns catalog requests into provisioned resources, automatically updates the CMDB, and closes the ticket with audit proof, delivering assets in minutes, not days.
Manage your full ticket lifecycleExplore how Kestra gives you full control over complex infrastructure workflows.
Take the tour
Orchestrate maintenance. Execute Ansible playbooks or PowerShell scripts across thousands of nodes with built-in safety controls.
Enforce policies and rotate credentials. Turn manual security tasks into auditable, automated workflows.
Reduce MTTR with event-driven logic. Connect your observability stack directly to remediation workflows.
Wrap complex automation into interactive apps. Allow users to request resources or patching via simple forms, routing requests for human approval before execution.
Audit ML training datasets for leaked credentials, API tokens, and covert prompt injection poisoning before fine-tuning.
Compare MLflow registered model versions with the production serving registry table, alert Slack on gaps, missing rows, and archived models, and publish a reconciliation verdict.
Render a model card from a registry promotion webhook, escalate missing fields to GitHub and Slack, then publish and verify the artifact.
Join a MongoDB child collection to its parent with $lookup, report the children whose reference resolves to nothing, delete the aged orphans behind an approval, then re-join to prove none is left.
Find the MongoDB documents that do not match their collection validator, backfill a missing required field behind an approval, then re-read the collection and fail the run if any repairable violator is left.
Detect MongoDB documents sharing a business key no unique index could prevent, keep one survivor per key, delete the surplus behind an approval, then re-group to prove each key is unique.
Detect MongoDB documents older than a retention window, alert Slack, then delete them behind an approval and re-read the collection to prove none remain.
Detect orphaned binary chunks in MongoDB GridFS with $lookup, pause for operator confirmation, purge confirmed orphans, and reverify zero residual storage leaks.
Detect MongoDB documents whose embedded array is growing toward the 16MB BSON limit, archive the overflow, trim each array to its newest entries behind an approval and re-measure to prove it.
Dump a MongoDB collection to S3-compatible storage, restore the stored archive into a scratch database, then promote it only when documents and indexes match.
Reconcile a denormalized MongoDB read model against its PostgreSQL source of truth, find orphaned and stale documents by reading the keyset from PostgreSQL, alert Slack, then behind an approval gate delete and refresh them and re-verify.
Audit MongoDB WiredTiger cache pressure via serverStatus, detect dirty byte eviction saturation, file GitHub issues, and alert Slack.
Map changed monorepo paths to package test targets, loop only the selected suites, and escalate paths no package covers.
Pull curl's extract of the Mozilla root store, check its SHA-256, add your proxy or internal roots, see which roots come and go, review removals in Google Chat, and publish to namespace files with a verified rollback.
Download the Mozilla Public Suffix List, probe web endpoints, and detect supercookie domain leaks using DuckDB.
Subscribe to an MQTT broker's own reserved $SYS diagnostic topic tree on a schedule and page Slack when the broker's self-reporting channel goes silent or unreachable.
Publish a JSON command built from flow inputs to a per-device MQTT topic with QoS 1, confirm it in Slack, and keep every dispatch auditable.
A scheduled Subscribe task listens for device heartbeats in a short window, alerts Discord and fails the run when zero messages arrive, and logs the count otherwise.
A realtime MQTT trigger starts one Kestra execution per alarm message and posts the topic and severity to Discord within moments of the device raising it.
Publish a retained JSON config document to a per-environment MQTT topic so late-joining devices receive last-known-good settings, with Discord confirmation per push.
Audit ML training datasets for leaked credentials, API tokens, and covert prompt injection poisoning before fine-tuning.
Compare MLflow registered model versions with the production serving registry table, alert Slack on gaps, missing rows, and archived models, and publish a reconciliation verdict.
Render a model card from a registry promotion webhook, escalate missing fields to GitHub and Slack, then publish and verify the artifact.
Join a MongoDB child collection to its parent with $lookup, report the children whose reference resolves to nothing, delete the aged orphans behind an approval, then re-join to prove none is left.
Find the MongoDB documents that do not match their collection validator, backfill a missing required field behind an approval, then re-read the collection and fail the run if any repairable violator is left.
Detect MongoDB documents sharing a business key no unique index could prevent, keep one survivor per key, delete the surplus behind an approval, then re-group to prove each key is unique.
ServiceNow
Ansible
AWS
Azure
GCP
Git
Go
VMware
ServiceNow
Ansible
AWS
Azure
GCP
Git
Go
VMware
Your Unified Infrastructure Control Plane. From Terraform to Python, manage every tool and script in a single, governed environment.
Run tasks safely inside air-gapped networks, VPCs, and private data centers, or in the cloud of your choice.
Automatically capture full run history, task logs, approvals, and evidence bundles for instant compliance.
Manage infrastructure directly from a self service catalog. Kestra provisions the server, syncs the records, and resolves the ticket request automatically.
Reuse your existing scripts, Terraform modules, Ansible roles, alongside VMware, NetApp or any other tool you already use.
Keep your scripts lightweight. Offload inputs, secrets, retries, and backoff logic to Kestra, so your code focuses purely on the business logic.
Manage cloud, IT, and OT automation from one platform. Execute tasks securely inside your VPCs or private networks.
Workflows live in your codebase, move through CI/CD pipelines, and can be instantly rolled back if a deployment fails.
Teams replace vRO, Rundeck, Cron, Jenkins, and manual scripts with Kestra