Standardize provisioning and Day 2 operations with less risk and operational overhead. Get full visibility and control across all infrastructure workflows.
Our goal is for Kestra to become the go-to solution across the organization whenever data wrangling and complex pipeline orchestration are needed.
Run IaC the same way every time. Kestra orchestrates the full lifecycle with shared parameters, secrets, retries, and evidence-grade logs across all environments.
Provision and evolve workloads anywhere. Kestra workflows drive K8s, vSphere, cloud, and network APIs with consistent sequencing, execution, and traceability.
Pause workflows for critical checks. Kestra offers reliable Business Decisions with audit trail and controlled executions.
Wrap your playbooks in a production-grade layer. Gain structured inputs, secret injection, parallel execution, and granular logging without changing a single line of code.
Automate your Playbooks with KestraEnable true self-service infrastructure. Kestra turns catalog requests into provisioned resources, automatically updates the CMDB, and closes the ticket with audit proof, delivering assets in minutes, not days.
Manage your full ticket lifecycleExplore how Kestra gives you full control over complex infrastructure workflows.
Take the tour
Orchestrate maintenance. Execute Ansible playbooks or PowerShell scripts across thousands of nodes with built-in safety controls.
Enforce policies and rotate credentials. Turn manual security tasks into auditable, automated workflows.
Reduce MTTR with event-driven logic. Connect your observability stack directly to remediation workflows.
Wrap complex automation into interactive apps. Allow users to request resources or patching via simple forms, routing requests for human approval before execution.
A webhook trigger receives JSON events over HTTP and republishes selected fields as a JSON MQTT message to a topic named in the request, with Slack notes per event.
Sample tempdb usage on a schedule or webhook, escalate to Slack and GitHub above your threshold, and keep per-file recommendations.
Build a Docker image from a GitHub repo and deploy it to local, GCP Cloud Run, or Azure Container Instances from one declarative flow.
Probe three regions in parallel and cut Cloudflare DNS over to a healthy secondary when the primary goes dark.
Investigate a URL with URLhaus and optional AlienVault OTX, write an explainable risk report, and pause for an analyst before any GitHub issue. A missing record is not a verdict that the URL is safe.
Verify HMAC signatures, dedupe with Redis, reshape with JSONata, and fan verified events out to matched subflows - one hardened endpoint for every tenant.
Read recent Mux video assets every hour and alert Slack when uploads stop becoming playable or get stuck in preparing, with the top Mux error.
Audit MySQL accounts for anonymous users, empty passwords, remote root, global admin privileges and wildcard hosts, alert Slack, and optionally drop, lock or revoke and verify, never touching the connected account.
Restore the newest mysqldump plus the archived binlogs into a throwaway MySQL, stop at a time or right before a bad statement, run your checks and measure the restore time.
Compute the binary log purge boundary from every replica's own read position and the last backup, alert Slack, then purge behind an approval with a re-check that fails if a needed log went missing.
Find a MySQL server whose binlog_row_image is no longer FULL and restore it after approval, proved with a real Debezium capture.
Restore an expected-OFF MySQL runtime general query log policy after a grace period and approval then prove instrumented file writes stop.
Proactively detect long-running uncommitted MySQL transactions and row lock contention before thread pool exhaustion occurs.
Find MySQL tables without a primary key and non-InnoDB tables, alert Slack, and optionally promote a unique NOT NULL key or add an invisible id column, then verify.
Dry-run the ALTER, copy the table with gh-ost while throttling on replica lag, verify the ghost table, and swap the tables only after a person approves. Declines and failures clean up after themselves.
Find MySQL XA branches stuck in the prepared state after a coordinator crash, age-gate them so a real in-flight commit is never touched, roll back only the orphans behind a dry-run and approval gate, then re-read XA RECOVER and fail if any targeted branch is still prepared.
Catch a MySQL server left running with InnoDB redo logging disabled after a bulk load, turn it back on behind a dry-run and approval gate, then re-read the Innodb_redo_log_enabled status variable and fail the run if crash recovery is still off.
Checksum every table on the primary and its replicas, preview the repair with pt-table-sync, apply it through the primary after approval, and prove the replicas match.
Monitor MySQL replica Seconds_Behind_Master and IO/SQL thread statuses via SHOW REPLICA STATUS, alerting DBAs before stale read drift.
Find a MySQL replica that accepts client writes because super_read_only is OFF, set it ON behind a dry-run and approval gate, then re-read both variables and fail if the replica is still writable. An instance with no replication configured is never touched.
A webhook trigger receives JSON events over HTTP and republishes selected fields as a JSON MQTT message to a topic named in the request, with Slack notes per event.
Sample tempdb usage on a schedule or webhook, escalate to Slack and GitHub above your threshold, and keep per-file recommendations.
Build a Docker image from a GitHub repo and deploy it to local, GCP Cloud Run, or Azure Container Instances from one declarative flow.
Probe three regions in parallel and cut Cloudflare DNS over to a healthy secondary when the primary goes dark.
Investigate a URL with URLhaus and optional AlienVault OTX, write an explainable risk report, and pause for an analyst before any GitHub issue. A missing record is not a verdict that the URL is safe.
Verify HMAC signatures, dedupe with Redis, reshape with JSONata, and fan verified events out to matched subflows - one hardened endpoint for every tenant.
ServiceNow
Ansible
AWS
Azure
GCP
Git
Go
VMware
ServiceNow
Ansible
AWS
Azure
GCP
Git
Go
VMware
Your Unified Infrastructure Control Plane. From Terraform to Python, manage every tool and script in a single, governed environment.
Run tasks safely inside air-gapped networks, VPCs, and private data centers, or in the cloud of your choice.
Automatically capture full run history, task logs, approvals, and evidence bundles for instant compliance.
Manage infrastructure directly from a self service catalog. Kestra provisions the server, syncs the records, and resolves the ticket request automatically.
Reuse your existing scripts, Terraform modules, Ansible roles, alongside VMware, NetApp or any other tool you already use.
Keep your scripts lightweight. Offload inputs, secrets, retries, and backoff logic to Kestra, so your code focuses purely on the business logic.
Manage cloud, IT, and OT automation from one platform. Execute tasks securely inside your VPCs or private networks.
Workflows live in your codebase, move through CI/CD pipelines, and can be instantly rolled back if a deployment fails.
Teams replace vRO, Rundeck, Cron, Jenkins, and manual scripts with Kestra