Compression FileEncrypt

Compression FileEncrypt

Certified

Encrypt a file with AES-256

Default PBKDF2_SHA256 is OpenSSL-compatible (openssl enc -aes-256-cbc -pbkdf2). Other KDFs use authenticated AES-GCM with a KESTRAENC file format.

yaml
type: io.kestra.plugin.compress.FileEncrypt
yaml
id: file_encrypt
namespace: company.team

inputs:
  - id: file
    type: FILE

tasks:
  - id: encrypt
    type: io.kestra.plugin.compress.FileEncrypt
    from: "{{ inputs.file }}"
    password: "{{ secret('ENCRYPTION_PASSWORD') }}"

Encrypt with Argon2id (memory-hard, GPU-resistant)

yaml
id: file_encrypt_argon2id
namespace: company.team

inputs:
  - id: file
    type: FILE

tasks:
  - id: encrypt
    type: io.kestra.plugin.compress.FileEncrypt
    from: "{{ inputs.file }}"
    password: "{{ secret('ENCRYPTION_PASSWORD') }}"
    keyDerivation: ARGON2ID
    argon2TimeCost: 3
    memory: 65536
    parallelism: 1

Encrypt with Scrypt

yaml
id: file_encrypt_scrypt
namespace: company.team

inputs:
  - id: file
    type: FILE

tasks:
  - id: encrypt
    type: io.kestra.plugin.compress.FileEncrypt
    from: "{{ inputs.file }}"
    password: "{{ secret('ENCRYPTION_PASSWORD') }}"
    keyDerivation: SCRYPT
    memory: 65536
    parallelism: 1
Installation

Our standard Docker images already include this plugin. If you use a -slim image or another setup, install it with the following command: 

kestractl plugins get io.kestra.plugin:plugin-compress --compatible-for $KESTRA_VERSION

For kestractl, use your Kestra version with --compatible-for, or specify an exact plugin version.

For Kestra CLI, replace LATEST with a specific version or version range to pin the plugin version.

Properties

Source file URI

Password

Default3

Argon2id time cost

Number of passes over the memory buffer for Argon2id. RFC 9106 recommends 2-4. Default 3. Used only when keyDerivation is ARGON2ID; ignored otherwise.

Assets this task consumes as inputs or produces as outputs, for lineage tracking and the asset graph (Enterprise Edition). A flow declaring this property on a task is rejected in the open-source edition.

Definitions
assetFailureBehaviorstring
Possible Values
IGNOREFAILWARN

Asset failure behavior

Behavior applied to the task state when a declared asset fails to render, emit, or be persisted (e.g. a lock conflict): FAIL escalates it to FAILED, WARN (default) warns it if it would otherwise succeed, IGNORE leaves the state untouched.

enableAutobooleanstring

Whether to auto-register assets referenced dynamically at runtime that are not statically declared in inputs or outputs.

inputsarray

The assets consumed as inputs.

id*string
Min length1
typestring
outputs

The assets produced as outputs.

id*string
Min length1
Max length150
type*object
descriptionstring
displayNamestring
metadataobject
Default{}
namespacestring
Min length1
Max length150
id*string
Min length1
Max length150
type*object
descriptionstring
displayNamestring
metadataobject
Default{}
namespacestring
Min length1
Max length150
id*string
Min length1
Max length150
type*object
descriptionstring
displayNamestring
metadataobject
Default{}
namespacestring
Min length1
Max length150
id*string
Min length1
Max length150
type*object
descriptionstring
displayNamestring
metadataobject
Default{}
namespacestring
Min length1
Max length150
id*string
Min length1
Max length150
type*object
descriptionstring
displayNamestring
metadataobject
Default{}
namespacestring
Min length1
Max length150
id*string
Min length1
Max length150
type*string
Min length1

Custom asset type

descriptionstring
displayNamestring
metadataobject
Default{}
namespacestring
Min length1
Max length150
Default600000

PBKDF2 iteration count

PBKDF2 number of hashing rounds (min 100000, default 600000). Used only by PBKDF2_SHA256 and PBKDF2_SHA512. Ignored for Argon2id (use argon2TimeCost), Scrypt (uses memory only), and when decrypting KESTRAENC files (read from the file header).

DefaultPBKDF2_SHA256
Possible Values
PBKDF2_SHA256PBKDF2_SHA512ARGON2IDSCRYPT

Key derivation function

PBKDF2_SHA256 (default): OpenSSL-compatible, no integrity check. PBKDF2_SHA512, ARGON2ID, SCRYPT: authenticated (AES-GCM).

Default65536

Memory cost

Argon2id: memory in KB. Scrypt: N (power of 2). Ignored for PBKDF2.

Default1

Parallelism

Argon2id threads or Scrypt p. Ignored for PBKDF2.

Formaturi

Encrypted file URI

More Plugins in this Category

Core Plugins and tasks
Core Plugins and tasks

Tasks that provide Kestra's built-in orchestration, I/O, and observability capabilities.

Core

109 tasks

2141 blueprints

Bun
Bun

Tasks that run Bun scripts.

DataCore

4 tasks