Cryptography Encrypt
CertifiedEncrypt and optionally sign files with OpenPGP
Cryptography Encrypt
Encrypt and optionally sign files with OpenPGP
Streams a Kestra-stored file through ASCII-armored PGP encryption (AES-256 with integrity) and returns the storage URI. Optionally signs the payload when a private key and passphrase are provided; only the first public key in key is used for encryption.
type: io.kestra.plugin.crypto.openpgp.EncryptExamples
Encrypt a file not signed
id: crypto_encrypt
namespace: company.team
inputs:
- id: file
type: FILE
tasks:
- id: encrypt
type: io.kestra.plugin.crypto.openpgp.Encrypt
from: "{{ inputs.file }}"
key: |
-----BEGIN PGP PUBLIC KEY BLOCK----- ...
recipients:
- hello@kestra.io
Encrypt a file signed
id: crypto_encrypt
namespace: company.team
inputs:
- id: file
type: FILE
tasks:
- id: encrypt
type: io.kestra.plugin.crypto.openpgp.Encrypt
from: "{{ inputs.file }}"
key: |
-----BEGIN PGP PUBLIC KEY BLOCK----- ...
recipients:
- hello@kestra.io
signPublicKey: |
-----BEGIN PGP PUBLIC KEY BLOCK----- ...
signPrivateKey: "{{ secret('PGP_SIGN_PRIVATE_KEY') }}"
signPassphrase: "{{ secret('PGP_SIGN_PASSPHRASE') }}"
signUser: signer@kestra.io
Properties
recipients *Requiredarray
Recipient identifiers
Required metadata for compatibility; values are not validated against the provided key.
from string
Source file to encrypt
Kestra internal storage URI or templated path to the cleartext file.
Pebble expression referencing an Internal Storage URI e.g. {{ outputs.mytask.uri }}.
key string
Public key for encryption
ASCII-armored export such as gpg --export -a; the first key ring found is used.
pluginDefaultsRef Non-dynamicstring
Reference (ref) of the pluginDefaults to apply to this task.
signPassphrase string
Passphrase for signing key
Leave empty if the signing key is not protected.
signPrivateKey string
Private key for signing
ASCII-armored secret key used to sign the encrypted payload.
signPublicKey string
Public key used for signature metadata
Optional ASCII-armored export; kept for compatibility with legacy plugin expectations.
signUser string
User ID bound to the signature
Required when signing; identifies the signing key within the secret key ring.
Outputs
uri string
uriURI of encrypted file
