Standardize provisioning and Day 2 operations with less risk and operational overhead. Get full visibility and control across all infrastructure workflows.
Our goal is for Kestra to become the go-to solution across the organization whenever data wrangling and complex pipeline orchestration are needed.
Run IaC the same way every time. Kestra orchestrates the full lifecycle with shared parameters, secrets, retries, and evidence-grade logs across all environments.
Provision and evolve workloads anywhere. Kestra workflows drive K8s, vSphere, cloud, and network APIs with consistent sequencing, execution, and traceability.
Pause workflows for critical checks. Kestra offers reliable Business Decisions with audit trail and controlled executions.
Wrap your playbooks in a production-grade layer. Gain structured inputs, secret injection, parallel execution, and granular logging without changing a single line of code.
Automate your Playbooks with KestraEnable true self-service infrastructure. Kestra turns catalog requests into provisioned resources, automatically updates the CMDB, and closes the ticket with audit proof, delivering assets in minutes, not days.
Manage your full ticket lifecycleExplore how Kestra gives you full control over complex infrastructure workflows.
Take the tour
Orchestrate maintenance. Execute Ansible playbooks or PowerShell scripts across thousands of nodes with built-in safety controls.
Enforce policies and rotate credentials. Turn manual security tasks into auditable, automated workflows.
Reduce MTTR with event-driven logic. Connect your observability stack directly to remediation workflows.
Wrap complex automation into interactive apps. Allow users to request resources or patching via simple forms, routing requests for human approval before execution.
Audits Redis-backed Celery queues for stranded unacknowledged tasks, requeues recoverable work, and quarantines poison pills.
Fetch the Ceph Dashboard's own full health report and alert Slack on HEALTH_WARN or HEALTH_ERR, read-only.
List Ceph pools, alert Slack on any replicated pool below a minimum replica size, and optionally raise it back up.
List an RBD image's snapshots via the Ceph Dashboard API and alert Slack on any that are not protected, read-only.
List every Ceph RGW bucket on a schedule and alert Slack if a must-always-exist bucket disappears or total bucket count crosses a governance threshold.
Audit Cerbos PDP authorization policies against canary test vectors, detect policy drift, and dispatch Slack alerts.
Audits cert-manager for failed TLS/SSL certificate issuance and renewal cycles to prevent production HTTPS outages.
Poll the Cert Spotter Certificate Transparency API on a schedule, advance an opaque id cursor in the KV store, then report hostnames nobody registered, certificate authorities outside your allowlist plus new wildcards.
Watches TLS certificates in a namespace and alerts on Slack before they expire.
Check Chainlink-style price feeds on any EVM chain for staleness, invalid answers, carried-over rounds and deviation from a reference, alert once per change, and let on-call pause your protocol.
Score each change request on service criticality, blast radius, size, backout plan, testing and the team's failure rate, catch freeze windows and colliding changes, and route it to pre-approval, peer review or the CAB.
Pod-loss chaos drill with parallel blast-radius watches and a post-run evidence report.
Audits ChaosBlade operator telemetry for runaway fault injections, execution errors, and target revert stalls.
Audits Chrony NTP daemon telemetry to detect stratum degradation, root dispersion spikes, and distributed clock drift.
Clone Kestra flows from GitHub, validate them, then deploy to your namespaces, all in one self-managed pipeline.
Trigger CI/CD from GitHub pull request webhooks and post automated comments back, with local JSON testing built in.
Diagnose GitHub Actions and Kestra failures with log retrieval, deterministic error classification, sensitive-data redaction, and Markdown reports.
Monitors Cilium CNI eBPF map pressure to prevent kernel connection table overflow and pod packet dropouts.
Pull recent CircleCI builds over a webhook or schedule, ratchet failure and flaky rates against a rolling baseline, and escalate regressions as a GitHub issue plus a Slack alert.
Fan out CIS benchmark controls as parallel subflows against a host, log verdicts, and auto-scan new VMs right after provisioning.
Audits Redis-backed Celery queues for stranded unacknowledged tasks, requeues recoverable work, and quarantines poison pills.
Fetch the Ceph Dashboard's own full health report and alert Slack on HEALTH_WARN or HEALTH_ERR, read-only.
List Ceph pools, alert Slack on any replicated pool below a minimum replica size, and optionally raise it back up.
List an RBD image's snapshots via the Ceph Dashboard API and alert Slack on any that are not protected, read-only.
List every Ceph RGW bucket on a schedule and alert Slack if a must-always-exist bucket disappears or total bucket count crosses a governance threshold.
Audit Cerbos PDP authorization policies against canary test vectors, detect policy drift, and dispatch Slack alerts.
ServiceNow
Ansible
AWS
Azure
GCP
Git
Go
VMware
ServiceNow
Ansible
AWS
Azure
GCP
Git
Go
VMware
Your Unified Infrastructure Control Plane. From Terraform to Python, manage every tool and script in a single, governed environment.
Run tasks safely inside air-gapped networks, VPCs, and private data centers, or in the cloud of your choice.
Automatically capture full run history, task logs, approvals, and evidence bundles for instant compliance.
Manage infrastructure directly from a self service catalog. Kestra provisions the server, syncs the records, and resolves the ticket request automatically.
Reuse your existing scripts, Terraform modules, Ansible roles, alongside VMware, NetApp or any other tool you already use.
Keep your scripts lightweight. Offload inputs, secrets, retries, and backoff logic to Kestra, so your code focuses purely on the business logic.
Manage cloud, IT, and OT automation from one platform. Execute tasks securely inside your VPCs or private networks.
Workflows live in your codebase, move through CI/CD pipelines, and can be instantly rolled back if a deployment fails.
Teams replace vRO, Rundeck, Cron, Jenkins, and manual scripts with Kestra