Kubernetes Patch

Kubernetes Patch
Certified
Patch Kubernetes resources with merge or JSON patch

Applies targeted updates to a namespaced resource using Strategic Merge (default), JSON Merge, or JSON Patch. Supports waiting for readiness after the patch (waitUntilReady, default PT0S).

yaml
type: io.kestra.plugin.kubernetes.kubectl.Patch

Examples

Patch pod resource limits and wait for it to become ready.

yaml
id: patch_pod_with_wait
namespace: company.team

tasks:
  - id: patch
    type: io.kestra.plugin.kubernetes.kubectl.Patch
    connection:
      masterUrl: "{{ secret('K8S_MASTER_URL') }}"
      oauthToken: "{{ secret('K8S_TOKEN') }}"
    namespace: production
    resourceType: pod
    resourceName: my-pod
    waitUntilReady: PT5M
    patch: |
      {
        "spec": {
          "containers": [
            {
              "name": "app",
              "resources": {
                "limits": {"memory": "512Mi", "cpu": "500m"},
                "requests": {"memory": "256Mi", "cpu": "250m"}
              }
            }
          ]
        }
      }

Patch a deployment to update container resources using strategic merge (default).

yaml
id: patch_deployment_resources
namespace: company.team

tasks:
  - id: patch
    type: io.kestra.plugin.kubernetes.kubectl.Patch
    connection:
      masterUrl: "{{ secret('K8S_MASTER_URL') }}"
      oauthToken: "{{ secret('K8S_TOKEN') }}"
    namespace: production
    resourceType: deployment
    resourceName: my-api
    apiGroup: apps
    patch: |
      {
        "spec": {
          "template": {
            "spec": {
              "containers": [
                {
                  "name": "api",
                  "resources": {
                    "limits": {"memory": "2Gi", "cpu": "1000m"},
                    "requests": {"memory": "1Gi", "cpu": "500m"}
                  }
                }
              ]
            }
          }
        }
      }

Scale a deployment using JSON Patch operations.

yaml
id: scale_deployment
namespace: company.team

tasks:
  - id: scale
    type: io.kestra.plugin.kubernetes.kubectl.Patch
    connection:
      masterUrl: "{{ secret('K8S_MASTER_URL') }}"
      oauthToken: "{{ secret('K8S_TOKEN') }}"
    namespace: production
    resourceType: deployment
    resourceName: my-api
    apiGroup: apps
    patchStrategy: JSON_PATCH
    patch: |
      [
        {"op": "replace", "path": "/spec/replicas", "value": 5}
      ]

Remove an annotation using JSON Merge Patch.

yaml
id: remove_annotation
namespace: company.team

tasks:
  - id: patch
    type: io.kestra.plugin.kubernetes.kubectl.Patch
    connection:
      masterUrl: "{{ secret('K8S_MASTER_URL') }}"
      oauthToken: "{{ secret('K8S_TOKEN') }}"
    namespace: production
    resourceType: deployment
    resourceName: my-api
    apiGroup: apps
    patchStrategy: JSON_MERGE
    patch: |
      {
        "metadata": {
          "annotations": {
            "deprecated-annotation": null
          }
        }
      }

Patch a custom resource.

yaml
id: patch_custom_resource
namespace: company.team

tasks:
  - id: patch
    type: io.kestra.plugin.kubernetes.kubectl.Patch
    connection:
      masterUrl: "{{ secret('K8S_MASTER_URL') }}"
      oauthToken: "{{ secret('K8S_TOKEN') }}"
    namespace: production
    resourceType: shirts
    resourceName: my-shirt
    apiGroup: stable.example.com
    apiVersion: v1
    patch: |
      {
        "spec": {
          "color": "blue",
          "size": "L"
        }
      }

Conditionally update replicas using JSON Patch test operation.

yaml
id: conditional_scale
namespace: company.team

tasks:
  - id: scale
    type: io.kestra.plugin.kubernetes.kubectl.Patch
    connection:
      masterUrl: "{{ secret('K8S_MASTER_URL') }}"
      oauthToken: "{{ secret('K8S_TOKEN') }}"
    namespace: production
    resourceType: deployment
    resourceName: my-api
    apiGroup: apps
    patchStrategy: JSON_PATCH
    patch: |
      [
        {"op": "test", "path": "/spec/replicas", "value": 3},
        {"op": "replace", "path": "/spec/replicas", "value": 10}
      ]

Properties

patch *string

Patch content

The format depends on the patchStrategy. For STRATEGIC_MERGE and JSON_MERGE, provide a JSON object with the fields to update. For JSON_PATCH, provide a JSON array of operations with 'op', 'path', and 'value' fields.

resourceName *string

Resource name

resourceType *string

Resource kind

Namespaced Kubernetes kind (e.g., Deployment, StatefulSet, Pod). Cluster-scoped kinds are not supported.

apiGroup string

API group

Group for the resource kind. Leave empty for core resources.

apiVersion string

API version

Version for the resource kind (e.g., v1). Defaults to v1 when omitted.

connection

Kubernetes connection

Connection settings for the cluster. If omitted, the client resolves credentials in order: system properties, environment variables, kubeconfig, then in-cluster service account.

Definitions

io.kestra.plugin.kubernetes.models.Connection

apiVersionstring

Defaultv1

API version

API group version used by the client. Default v1.

caCertDatastring

CA certificate data

Base64-encoded PEM CA bundle. Whitespace is stripped automatically.

caCertFilestring

CA certificate file

Path to a PEM CA bundle.

clientCertDatastring

Client certificate data

Base64-encoded client cert. Whitespace is stripped automatically.

clientCertFilestring

Client certificate file

clientKeyAlgostring

DefaultRSA

Client key algorithm

Algorithm for the client key. Default RSA.

clientKeyDatastring

Client key data

Base64-encoded client key. Whitespace is stripped automatically.

clientKeyFilestring

Client key file

clientKeyPassphrasestring

Client key passphrase

disableHostnameVerificationbooleanstring

Disable hostname verification

Disables TLS hostname checks. Avoid in production clusters.

keyStoreFilestring

Keystore file

keyStorePassphrasestring

Keystore passphrase

masterUrlstring

Defaulthttps://kubernetes.default.svc

Kubernetes API URL

API server endpoint. Default https://kubernetes.default.svc.

namespacestring

Default namespace

Namespace used when resources omit a namespace.

oauthTokenstring

OAuth token

oauthTokenProvider

OAuth token provider

io.kestra.plugin.kubernetes.models.OAuthTokenProvider

cachestring

DefaultPT5M

Formatduration

Token cache duration

How long a fetched token is cached before the underlying task is called again. Defaults to 5 minutes. Set to PT0S or a negative duration to disable caching and re-fetch a token on every request.

outputstring

task

passwordstring

Password

trustCertsbooleanstring

Trust all certificates

When true, skips TLS cert validation. Use only for testing.

trustStoreFilestring

Truststore file

trustStorePassphrasestring

Truststore passphrase

usernamestring

Username

containerDefaultSpec object

Default container spec applied to all containers in the pod

When set, these container spec fields are merged into all containers including:

User-defined containers in the spec
Init and sidecar containers for file transfer (unless fileSidecar.defaultSpec is set)

This provides a convenient way to apply uniform container settings across all containers, which is especially useful in restrictive environments like GovCloud.

Supports any valid Kubernetes container spec fields such as:

securityContext: Security settings for all containers
volumeMounts: Volume mounts to add to all containers
resources: Resource limits/requests for all containers
env: Environment variables for all containers

Merge behavior:

For nested objects (like securityContext): deep merge, container-specific values take precedence
For volumeMounts: concatenated, with defaults added first
For env: deduplicated by name — container-specific values always win over defaults on collision
Container-specific values always override defaults

Example configuration:

containerDefaultSpec: 
  securityContext: 
    allowPrivilegeEscalation: false
    capabilities: 
      drop: 
      - ALL
    readOnlyRootFilesystem: true
    seccompProfile: 
      type: RuntimeDefault
  volumeMounts: 
    - name: tmp
      mountPath: /tmp
  resources: 
    limits: 
      memory: "256Mi"

fileSidecar

Default

{
  "image": "busybox"
}

The configuration of the file sidecar container that handles the download and upload of files

Definitions

io.kestra.plugin.kubernetes.models.SideCar

defaultSpecobject

Default spec for file transfer containers

Overrides containerDefaultSpec for the init and sidecar containers that move files. Accepts Pod container fields such as securityContext, volumeMounts, resources, and env; useful for hardening or adding mounts used only by file transfer helpers.

Example: fileSidecar: defaultSpec: securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true volumeMounts: - name: tmp mountPath: /tmp

imagestring

Defaultbusybox

Image for file sidecar

Container image used by the init container (uploads input files) and the sidecar (downloads output files). Defaults to busybox.

The image must provide, on its PATH: a POSIX shell (sh), test/[, and sleep — required by the polling script that waits for the transfer to complete before the container exits. find and wc are also used, on a best-effort basis, to verify that uploaded files were fully transferred; if they're missing, verification is skipped rather than failing the task.

resourcesobject

Configure sidecar resource requests/limits

Optional Kubernetes resources block applied to the file transfer sidecar.

inheritClusterConfig booleanstring

Defaultfalse

Inherit cluster auto-config

When true and a connection is set, the client config is seeded from the ambient auto-config (system properties, env, kubeconfig, in-cluster service account) before applying connection, so a partial connection (e.g. only a namespace) keeps the resolved credentials instead of starting blank. Default false.

inputFiles object

SubTypestring

The files to create on the local filesystem – it can be a map or a JSON object

The files will be available inside the kestra/working-dir directory of the container. You can use the special variable {{workingDir}} in your command to refer to it.

namespace string

Defaultdefault

The namespace where the operation will be done

The Kubernetes namespace in which to execute the operation. Defaults to 'default' if not specified.

outputFiles array

SubTypestring

The files from the container filesystem to send to Kestra's internal storage

Only files created inside the kestra/working-dir directory of the container can be retrieved. Must be a list of glob expressions relative to the current working directory, some examples: my-dir/**, my-dir/*/** or my-dir/my-file.txt..

patchStrategy string

DefaultSTRATEGIC_MERGE

Possible Values

STRATEGIC_MERGEJSON_MERGEJSON_PATCH

Patch strategy

STRATEGIC_MERGE (default): Kubernetes strategic merge patch, most user-friendly. Understands K8s resource structure and intelligently merges lists by merge keys. JSON_MERGE: Simple merge with null-deletion semantics (RFC 7386). JSON_PATCH: Precision operations with add/remove/replace/test (RFC 6902).

pluginDefaultsRef string

Reference (ref) of the pluginDefaults to apply to this task.

waitRunning string

DefaultPT1H

Wait for pod completion

Maximum run time after reaching Running (defaults to PT1H). PodCreate fails and deletes the pod when exceeded.

waitUntilReady string

DefaultPT0S

The maximum duration to wait until the resource becomes ready

When set to a positive duration, waits for the resource to report Ready=True in its status conditions. Set to PT0S (zero, default) to skip waiting. Supports Pods, StatefulSets, and custom resources that use the Ready condition. Note: Deployments are not supported as they use the Available condition instead of Ready.

waitUntilRunning string

DefaultPT10M

Wait for pod to reach Running

Maximum time to reach Running (defaults to PT10M). Covers scheduling, image pulls, and startup. Used by PodCreate.

Outputs

metadata

Patched resource metadata

Metadata returned after patch application.

Definitions

io.kestra.plugin.kubernetes.models.Metadata

annotationsobject

Resource annotations

clusterNamestring

Cluster name

creationTimestampstring

Formatdate-time

Creation timestamp

deletionGracePeriodSecondsinteger

Deletion grace period in seconds

deletionTimestampstring

Formatdate-time

Deletion timestamp

finalizersarray

SubTypestring

Finalizers

generateNamestring

Generated name prefix

generationinteger

Generation

labelsobject

Resource labels

managedFieldsarray

Managed fields

io.fabric8.kubernetes.api.model.ManagedFieldsEntry

apiVersionstring

fieldsTypestring

fieldsV1

io.fabric8.kubernetes.api.model.FieldsV1

managerstring

operationstring

subresourcestring

timestring

namestring

Resource name

namespacestring

Resource namespace

ownerReferencesarray

Owner references

io.fabric8.kubernetes.api.model.OwnerReference

apiVersionstring

blockOwnerDeletionboolean

controllerboolean

kindstring

namestring

uidstring

resourceVersionstring

Resource version

selfLinkstring

Self link

uidstring

Generated UUID of this resource

status

Patched resource status

Current status snapshot (conditions, replicas, phase) after the patch.

Definitions

io.kestra.plugin.kubernetes.models.ResourceStatus

statusobject

The status of the Kubernetes resource

Contains the current state of the resource as a generic map structure

NetBox

Enterprise

Enterprise NetBox tasks to create, update, and query devices, IP addresses, and sites over the NetBox API.

Infrastructure

AS400

Tasks that connect to AS400 via JDBC to run queries and loads.

DataInfrastructure

Kubernetes PatchCertifiedPatch Kubernetes resources with merge or JSON patch

Kubernetes Patch

More Plugins in this Category

NetBox

AS400

Kubernetes Patch
Certified
Patch Kubernetes resources with merge or JSON patch