Standardize provisioning and Day 2 operations with less risk and operational overhead. Get full visibility and control across all infrastructure workflows.
Our goal is for Kestra to become the go-to solution across the organization whenever data wrangling and complex pipeline orchestration are needed.
Run IaC the same way every time. Kestra orchestrates the full lifecycle with shared parameters, secrets, retries, and evidence-grade logs across all environments.
Provision and evolve workloads anywhere. Kestra workflows drive K8s, vSphere, cloud, and network APIs with consistent sequencing, execution, and traceability.
Pause workflows for critical checks. Kestra offers reliable Business Decisions with audit trail and controlled executions.
Wrap your playbooks in a production-grade layer. Gain structured inputs, secret injection, parallel execution, and granular logging without changing a single line of code.
Automate your Playbooks with KestraEnable true self-service infrastructure. Kestra turns catalog requests into provisioned resources, automatically updates the CMDB, and closes the ticket with audit proof, delivering assets in minutes, not days.
Manage your full ticket lifecycleExplore how Kestra gives you full control over complex infrastructure workflows.
Take the tour
Orchestrate maintenance. Execute Ansible playbooks or PowerShell scripts across thousands of nodes with built-in safety controls.
Enforce policies and rotate credentials. Turn manual security tasks into auditable, automated workflows.
Reduce MTTR with event-driven logic. Connect your observability stack directly to remediation workflows.
Wrap complex automation into interactive apps. Allow users to request resources or patching via simple forms, routing requests for human approval before execution.
Find Camunda 8 instances whose job retries are exhausted and whose incident is past a grace window, cancel them behind an approval gate, then prove from the engine that they are gone.
Execute Camunda 8 BPMN service tasks as a resilient job worker, enforcing payload contract validation, graduated retry backoff, and instant incident escalation.
Find overdue Camunda message subscriptions with matching PostgreSQL outbox rows, then safely republish and prove the instance moved.
Start a critical Camunda 8 process, classify its completion HEALTHY, AT_RISK, or UNREACHABLE by its own outcome variable, alert Slack, and optionally retry.
Audits Capsule operator telemetry for tenant namespace quota breaches, owner lock cordons, and proxy drops.
Execute the workload selected by the carbon-aware scheduler and preserve its artifact, checksum, planning context, and estimated impact.
Shift deferrable batch work into a lower-carbon regional grid window without missing its hard completion deadline.
Continuously audit Casdoor authentication engine availability, verify OIDC metadata endpoints, and alert on identity provider degradation.
Flag Cassandra base tables stuck at default_time_to_live = 0 in keyspaces meant to expire data, alert Slack, then optionally set a bounded default TTL with ALTER TABLE and verify the schema.
Read system_auth.role_permissions, flag non-superuser grants on ALL KEYSPACES or a whole keyspace, revoke them behind an approval, then read the table back.
Query Cassandra's system_schema.keyspaces on a schedule, flag any keyspace still using SimpleStrategy replication, and alert Slack when the cluster is unsafely replicated or unreachable.
Flag Cassandra tables whose caching option sets rows_per_partition to ALL or above a ceiling, alert Slack, then rewrite it with ALTER TABLE behind an approval and re-read the schema.
Audit Apache Cassandra table speculative retry policies, pause for operator approval, mitigate read retry storms with safe CQL alterations, and verify alignment.
Audit Cassandra's system_auth.roles for superuser roles with login enabled, alert Slack on exposure, and optionally revoke login with ALTER ROLE.
Flag Cassandra base tables stored uncompressed, alert Slack, then turn on LZ4 compression with ALTER TABLE behind an approval and re-read the schema.
Monitor Cassandra 4.0+ virtual tables on schedule, detect saturated thread pools with blocked or pending tasks, and alert Slack.
Flag Cassandra tables whose compaction tombstone_threshold is too high to purge tombstones while unchecked_tombstone_compaction is off, alert Slack, then tune both subproperties with ALTER TABLE behind an approval while keeping the compaction class and re-read the schema.
Audits Redis-backed Celery queues for stranded unacknowledged tasks, requeues recoverable work, and quarantines poison pills.
Fetch the Ceph Dashboard's own full health report and alert Slack on HEALTH_WARN or HEALTH_ERR, read-only.
List Ceph pools, alert Slack on any replicated pool below a minimum replica size, and optionally raise it back up.
Find Camunda 8 instances whose job retries are exhausted and whose incident is past a grace window, cancel them behind an approval gate, then prove from the engine that they are gone.
Execute Camunda 8 BPMN service tasks as a resilient job worker, enforcing payload contract validation, graduated retry backoff, and instant incident escalation.
Find overdue Camunda message subscriptions with matching PostgreSQL outbox rows, then safely republish and prove the instance moved.
Start a critical Camunda 8 process, classify its completion HEALTHY, AT_RISK, or UNREACHABLE by its own outcome variable, alert Slack, and optionally retry.
Audits Capsule operator telemetry for tenant namespace quota breaches, owner lock cordons, and proxy drops.
Execute the workload selected by the carbon-aware scheduler and preserve its artifact, checksum, planning context, and estimated impact.
ServiceNow
Ansible
AWS
Azure
GCP
Git
Go
VMware
ServiceNow
Ansible
AWS
Azure
GCP
Git
Go
VMware
Your Unified Infrastructure Control Plane. From Terraform to Python, manage every tool and script in a single, governed environment.
Run tasks safely inside air-gapped networks, VPCs, and private data centers, or in the cloud of your choice.
Automatically capture full run history, task logs, approvals, and evidence bundles for instant compliance.
Manage infrastructure directly from a self service catalog. Kestra provisions the server, syncs the records, and resolves the ticket request automatically.
Reuse your existing scripts, Terraform modules, Ansible roles, alongside VMware, NetApp or any other tool you already use.
Keep your scripts lightweight. Offload inputs, secrets, retries, and backoff logic to Kestra, so your code focuses purely on the business logic.
Manage cloud, IT, and OT automation from one platform. Execute tasks securely inside your VPCs or private networks.
Workflows live in your codebase, move through CI/CD pipelines, and can be instantly rolled back if a deployment fails.
Teams replace vRO, Rundeck, Cron, Jenkins, and manual scripts with Kestra