OpenPGP Encrypt

OpenPGP Encrypt
Certified
Encrypt and optionally sign files with OpenPGP

Streams a Kestra-stored file through ASCII-armored PGP encryption (AES-256 with integrity) and returns the storage URI. Optionally signs the payload when a private key and passphrase are provided; only the first key ring in key is used, and its valid encryption subkey is preferred over the primary key.

yaml
type: io.kestra.plugin.crypto.openpgp.Encrypt

Examples

Encrypt a file not signed

yaml
id: crypto_encrypt
namespace: company.team

inputs:
  - id: file
    type: FILE

tasks:
  - id: encrypt
    type: io.kestra.plugin.crypto.openpgp.Encrypt
    from: "{{ inputs.file }}"
    key: |
      -----BEGIN PGP PUBLIC KEY BLOCK----- ...
    recipients:
      - hello@kestra.io

Encrypt a file signed

yaml
id: crypto_encrypt
namespace: company.team

inputs:
  - id: file
    type: FILE

tasks:
  - id: encrypt
    type: io.kestra.plugin.crypto.openpgp.Encrypt
    from: "{{ inputs.file }}"
    key: |
      -----BEGIN PGP PUBLIC KEY BLOCK----- ...
    recipients:
      - hello@kestra.io
    signPublicKey: |
      -----BEGIN PGP PUBLIC KEY BLOCK----- ...
    signPrivateKey: "{{ secret('PGP_SIGN_PRIVATE_KEY') }}"
    signPassphrase: "{{ secret('PGP_SIGN_PASSPHRASE') }}"
    signUser: signer@kestra.io

Installation

Our standard Docker images already include this plugin. If you use a -slim image or another setup, install it with the following command:

kestractl plugins get io.kestra.plugin:plugin-crypto --compatible-for $KESTRA_VERSION

For kestractl, use your Kestra version with --compatible-for, or specify an exact plugin version.

For Kestra CLI, replace LATEST with a specific version or version range to pin the plugin version.

Properties

recipients *array

SubTypestring

Recipient identifiers

Required metadata for compatibility; values are not validated against the provided key.

assets

Assets this task consumes as inputs or produces as outputs, for lineage tracking and the asset graph (Enterprise Edition). A flow declaring this property on a task is rejected in the open-source edition.

Definitions

io.kestra.core.models.assets.AssetsDeclaration

assetFailureBehaviorstring

Possible Values

IGNOREFAILWARN

Asset failure behavior

Behavior applied to the task state when a declared asset fails to render, emit, or be persisted (e.g. a lock conflict): FAIL escalates it to FAILED, WARN (default) warns it if it would otherwise succeed, IGNORE leaves the state untouched.

enableAutobooleanstring

Whether to auto-register assets referenced dynamically at runtime that are not statically declared in inputs or outputs.

inputsarray

The assets consumed as inputs.

io.kestra.core.models.assets.AssetIdentifier

id*string

Min length1

typestring

outputs

The assets produced as outputs.

io.kestra.plugin.ee.assets.Dataset

id*string

Min length1

Max length150

type*object

descriptionstring

displayNamestring

metadataobject

Default{}

namespacestring

Min length1

Max length150

io.kestra.plugin.ee.assets.File

id*string

Min length1

Max length150

type*object

descriptionstring

displayNamestring

metadataobject

Default{}

namespacestring

Min length1

Max length150

io.kestra.plugin.ee.assets.Table

id*string

Min length1

Max length150

type*object

descriptionstring

displayNamestring

metadataobject

Default{}

namespacestring

Min length1

Max length150

io.kestra.plugin.ee.assets.VM

id*string

Min length1

Max length150

type*object

descriptionstring

displayNamestring

metadataobject

Default{}

namespacestring

Min length1

Max length150

io.kestra.core.models.assets.External

id*string

Min length1

Max length150

type*object

descriptionstring

displayNamestring

metadataobject

Default{}

namespacestring

Min length1

Max length150

io.kestra.core.models.assets.Custom

id*string

Min length1

Max length150

type*string

Min length1

Custom asset type

descriptionstring

displayNamestring

metadataobject

Default{}

namespacestring

Min length1

Max length150

from string

Source file to encrypt

Kestra internal storage URI or templated path to the cleartext file.

Pebble expression referencing an Internal Storage URI e.g. {{ outputs.mytask.uri }}.

key string

Public key for encryption

ASCII-armored export such as gpg --export -a; the first key ring found is used, encrypting to its valid encryption subkey or, if it has none, to its primary key.

signPassphrase string

Passphrase for signing key

Leave empty if the signing key is not protected.

signPrivateKey string

Private key for signing

ASCII-armored secret key used to sign the encrypted payload.

signPublicKey string

Public key used for signature metadata

Optional ASCII-armored export; kept for compatibility with legacy plugin expectations.

signUser string

User ID bound to the signature

Required when signPrivateKey is set. Selects the key in signPrivateKey whose user ID contains this value, ignoring case, e.g. signer@kestra.io. The task fails if no key or several keys match. The primary key of the matching key ring signs the file.

Outputs

uri string

Formaturi

URI of encrypted file