Cryptography Encrypt
CertifiedEncrypt and optionally sign files with OpenPGP
Cryptography Encrypt
Encrypt and optionally sign files with OpenPGP
Streams a Kestra-stored file through ASCII-armored PGP encryption (AES-256 with integrity) and returns the storage URI. Optionally signs the payload when a private key and passphrase are provided; only the first public key in key is used for encryption.
type: io.kestra.plugin.crypto.openpgp.EncryptExamples
Encrypt a file not signed
id: crypto_encrypt
namespace: company.team
inputs:
- id: file
type: FILE
tasks:
- id: encrypt
type: io.kestra.plugin.crypto.openpgp.Encrypt
from: "{{ inputs.file }}"
key: |
-----BEGIN PGP PUBLIC KEY BLOCK----- ...
recipients:
- hello@kestra.io
Encrypt a file signed
id: crypto_encrypt
namespace: company.team
inputs:
- id: file
type: FILE
tasks:
- id: encrypt
type: io.kestra.plugin.crypto.openpgp.Encrypt
from: "{{ inputs.file }}"
key: |
-----BEGIN PGP PUBLIC KEY BLOCK----- ...
recipients:
- hello@kestra.io
signPublicKey: |
-----BEGIN PGP PUBLIC KEY BLOCK----- ...
signPrivateKey: "{{ secret('PGP_SIGN_PRIVATE_KEY') }}"
signPassphrase: "{{ secret('PGP_SIGN_PASSPHRASE') }}"
signUser: signer@kestra.io
Properties
recipients *array
Recipient identifiers
Required metadata for compatibility; values are not validated against the provided key.
assets
Assets this task consumes as inputs or produces as outputs, for lineage tracking and the asset graph (Enterprise Edition). A flow declaring this property on a task is rejected in the open-source edition.
io.kestra.core.models.assets.AssetsDeclaration
IGNOREFAILWARNAsset failure behavior
Behavior applied to the task state when a declared asset fails to render, emit, or be persisted (e.g. a lock conflict): FAIL escalates it to FAILED, WARN (default) warns it if it would otherwise succeed, IGNORE leaves the state untouched.
Whether to auto-register assets referenced dynamically at runtime that are not statically declared in inputs or outputs.
The assets consumed as inputs.
io.kestra.core.models.assets.AssetIdentifier
1The assets produced as outputs.
io.kestra.plugin.ee.assets.Dataset
1150{}1150io.kestra.plugin.ee.assets.File
1150{}1150io.kestra.plugin.ee.assets.Table
1150{}1150io.kestra.plugin.ee.assets.VM
1150{}1150io.kestra.core.models.assets.External
1150{}1150io.kestra.core.models.assets.Custom
11501Custom asset type
{}1150from string
Source file to encrypt
Kestra internal storage URI or templated path to the cleartext file.
Pebble expression referencing an Internal Storage URI e.g. {{ outputs.mytask.uri }}.
key string
Public key for encryption
ASCII-armored export such as gpg --export -a; the first key ring found is used.
signPassphrase string
Passphrase for signing key
Leave empty if the signing key is not protected.
signPrivateKey string
Private key for signing
ASCII-armored secret key used to sign the encrypted payload.
signPublicKey string
Public key used for signature metadata
Optional ASCII-armored export; kept for compatibility with legacy plugin expectations.
signUser string
User ID bound to the signature
Required when signing; identifies the signing key within the secret key ring.
Outputs
uri string
uriURI of encrypted file
