Dataform DataformCLI

Whether to enable namespace files to be loaded into the working directory. If explicitly set to true in a task, it will load all Namespace Files into the task's working directory. Note that this property is by default set to true so that you can specify only the include and exclude properties to filter the files to load without having to explicitly set enabled to true.

A list of filters to exclude matching glob patterns. This allows you to exclude a subset of the Namespace Files from being downloaded at runtime. You can combine this property together with include to only inject a subset of files that you need into the task's working directory.

Whether to mount file into the root of the working directory, or create a folder per namespace

Comportment of the task if a file already exist in the working directory.

A list of filters to include only matching glob patterns. This allows you to only load a subset of the Namespace Files into the working directory.

A list of namespaces in which searching files. The files are loaded in the namespace order, and only the latest version of a file is kept. Meaning if a file is present in the first and second namespace, only the file present on the second namespace will be loaded.

Docker configuration file.

Docker configuration file that can set access credentials to private container registries. Usually located in ~/.docker/config.json.

Limits the CPU usage to a given maximum threshold value.

By default, each container’s access to the host machine’s CPU cycles is unlimited. You can set various constraints to limit a given container’s access to the host machine’s CPU cycles.

Whether the container should be deleted upon completion.

A list of device requests to be sent to device drivers.

Docker entrypoint to use.

Extra hostname mappings to the container network interface configuration.

File handling strategy.

How to handle local files (input files, output files, namespace files, ...). By default, we create a volume and copy the file into the volume bind path. Configuring it to MOUNT will mount the working directory instead.

Docker API URI.

When a task is killed, this property sets the grace period before killing the container.

By default, we kill the container immediately when a task is killed. Optionally, you can configure a grace period so the container is stopped with a grace period instead.

Limits memory usage to a given maximum threshold value.

Docker can enforce hard memory limits, which allow the container to use no more than a given amount of user or system memory, or soft limits, which allow the container to use as much memory as it needs unless certain conditions are met, such as when the kernel detects low memory or contention on the host machine. Some of these options have different effects when used alone or when more than one option is set.

Docker network mode to use e.g. host, none, etc.

Reference (ref) of the pluginDefaults to apply to this task runner.

List of port bindings.

Corresponds to the --publish (-p) option of the docker run CLI command using the format ip: dockerHostPort: containerPort/protocol. Possible example :

• 8080: 80/udp- 127.0.0.1: 8080: 80- 127.0.0.1: 8080: 80/udp

Give extended privileges to this container.

Whether to resume an existing matching container on restart.

If enabled, the runner will search for an existing container labeled with the current execution/task identifiers and reattach to it instead of creating a new container.

Size of /dev/shm in bytes.

The size must be greater than 0. If omitted, the system uses 64MB.

User in the Docker container.

Plugin Version

Defines the version of the plugin to use.

The version must follow the Semantic Versioning (SemVer) specification:

• A single-digit MAJOR version (e.g., 1).
• A MAJOR.MINOR version (e.g., 1.1).
• A MAJOR.MINOR.PATCH version, optionally with any qualifier (e.g., 1.1.2, 1.1.0-SNAPSHOT).

List of volumes to mount.

Make sure to provide a map of a local path to a container path in the format: /home/local/path:/app/container/path. Volume mounts are disabled by default for security reasons — if you are sure you want to use them, enable that feature in the plugin configuration by setting volume-enabled to true.

Here is how you can add that setting to your kestra configuration:

kestra: 
  plugins: 
    configurations: 
      - type: io.kestra.plugin.scripts.runner.docker.Docker
        values: 
          volume-enabled: true

Whether to wait for the container to exit.

Reference (ref) of the pluginDefaults to apply to this task runner.

Plugin Version

Defines the version of the plugin to use.

The version must follow the Semantic Versioning (SemVer) specification:

• A single-digit MAJOR version (e.g., 1).
• A MAJOR.MINOR version (e.g., 1.1).
• A MAJOR.MINOR.PATCH version, optionally with any qualifier (e.g., 1.1.2, 1.1.0-SNAPSHOT).

Compute environment in which to run the job

AWS region with which the SDK should communicate

Access Key Id in order to connect to AWS

If no credentials are defined, we will use the default credentials provider chain to fetch credentials.

S3 Bucket to upload (inputFiles and namespaceFiles) and download (outputFiles) files

It's mandatory to provide a bucket if you want to use such properties.

Determines how often Kestra should poll the container for completion. By default, the task runner checks every 5 seconds whether the job is completed. You can set this to a lower value (e.g. PT0.1S = every 100 milliseconds) for quick jobs and to a lower threshold (e.g. PT1M = every minute) for long-running jobs. Setting this property to a lower value will reduce the number of API calls Kestra makes to the remote service — keep that in mind in case you see API rate limit errors

Whether the job should be deleted upon completion

Warning, if the job is not deleted, a retry of the task could resume an old failed attempt of the job.

The endpoint with which the SDK should communicate

This property allows you to use a different S3 compatible storage backend.

Execution role for the AWS Batch job

Mandatory if the compute environment is ECS Fargate. See the AWS documentation for more details. Ignored for EKS compute environments.

Job queue to use to submit jobs (ARN). If not specified, the task runner will create a job queue — keep in mind that this can lead to a longer execution

Reference (ref) of the pluginDefaults to apply to this task runner.

Custom resources for the container

For ECS Fargate, see the AWS documentation for supported CPU/memory combinations. For EKS, values follow Kubernetes resource format: CPU as a decimal (e.g. 0.5, 1) and memory as an integer in MiB (e.g. 2048).

Whether to reconnect to the current job if it already exists

Secret Key Id in order to connect to AWS

If no credentials are defined, we will use the default credentials provider chain to fetch credentials.

Kubernetes service account name for the EKS pod

Used with IRSA (IAM Roles for Service Accounts) for IAM authorization in EKS compute environments. Ignored for ECS.

AWS session token, retrieved from an AWS token service, used for authenticating that this user has received temporary permissions to access a given resource

If no credentials are defined, we will use the default credentials provider chain to fetch credentials.

Resources for sidecar containers

Resources used by the internal inputFiles and outputFiles containers (S3 upload/download). If not set, defaults to minimal valid values depending on the compute environment (Fargate: 0.25 vCPU / 512 MiB; EC2: 1 vCPU / 128 MiB). Note: on Fargate, AWS Batch validates resources at the task level; sidecar resources are therefore subtracted from the main container to keep the overall task resources equal to resources.request.

Whether to stream job logs in near real-time using CloudWatch Logs Live Tail

When true (default), the task runner starts a CloudWatch Logs Live Tail session so job logs appear in the Kestra execution as they are produced. Live Tail is priced per GB of log data scanned/streamed and requires the AWS credentials to remain valid for the entire job duration; if short-lived or role-chained credentials expire mid-job, the log stream is interrupted and the task fails even if the underlying AWS Batch job succeeds. Set this to false to skip Live Tail entirely — no CloudWatch API calls are made — job polling and exit-code mapping are unaffected. Job container logs are still written to the /aws/batch/job CloudWatch log group by the awslogs log driver (ECS) or Fluent Bit (EKS) regardless of this setting; only near-real-time streaming into Kestra is disabled. Note: unlike the unrelated streamLogs property on io.kestra.plugin.ee.aws.batch.Run (which defaults to false), this defaults to true because Live Tail is this task runner's only way to surface job output in the Kestra execution as it happens.

The AWS STS endpoint with which the SDKClient should communicate

AWS STS Role

The Amazon Resource Name (ARN) of the role to assume. If set the task will use the StsAssumeRoleCredentialsProvider. If no credentials are defined, we will use the default credentials provider chain to fetch credentials.

AWS STS External Id

A unique identifier that might be required when you assume a role in another account. This property is only used when an stsRoleArn is defined.

AWS STS Session duration

The duration of the role session (default: 15 minutes, i.e., PT15M). This property is only used when an stsRoleArn is defined.

AWS STS Session name

This property is only used when an stsRoleArn is defined.

Whether to synchronize working directory from remote runner back to local one after run.

Task role to use within the container

Needed if you want to authenticate with AWS CLI within your container. Ignored for EKS compute environments.

Plugin Version

Defines the version of the plugin to use.

The version must follow the Semantic Versioning (SemVer) specification:

• A single-digit MAJOR version (e.g., 1).
• A MAJOR.MINOR version (e.g., 1.1).
• A MAJOR.MINOR.PATCH version, optionally with any qualifier (e.g., 1.1.2, 1.1.0-SNAPSHOT).

The maximum duration to wait for the job completion unless the task timeout property is set which will take precedence over this property

AWS Batch will automatically timeout the job upon reaching that duration and the task will be marked as failed.

Maximum storage in MiB for the task's working directory on EKS compute environments

Size limit of the working-directory volume backing the EKS pod, in mebibytes (MiB). Raise it for tasks that sync large input or output files. Ignored for ECS compute environments.

AMI ID to launch the instance from

The ID of the Amazon Machine Image used to launch the instance, for example ami-0c55b159cbfafe1f0. The AMI must have the SSM Agent installed and running (true by default for modern Amazon Linux 2/2023 and Ubuntu AMIs), since this task runner executes the task via AWS Systems Manager Run Command rather than SSH.

IAM instance profile

Name or ARN of the IAM instance profile attached to the instance. Must grant at minimum the AmazonSSMManagedInstanceCore managed policy (or equivalent) so the SSM Agent can register with Systems Manager and receive commands, plus S3 read/write access to bucket if file staging is used. AmazonSSMManagedInstanceCore alone does not grant CloudWatch Logs permissions: if streamLogs is true (the default), also grant logs: CreateLogGroup, logs: CreateLogStream, and logs: PutLogEvents.

EC2 instance type

The compute capacity of the instance, for example t3.micro or m5.large. See the AWS documentation for available types.

AWS region with which the SDK should communicate

Access Key Id in order to connect to AWS

If no credentials are defined, we will use the default credentials provider chain to fetch credentials.

S3 Bucket to upload (inputFiles and namespaceFiles) and download (outputFiles) files

It's mandatory to provide a bucket if you want to use such properties.

Determines how often Kestra should poll the SSM command for completion. By default, the task runner checks every 5 seconds whether the command is completed. You can set this to a lower value (e.g. PT0.1S = every 100 milliseconds) for quick tasks and to a higher threshold (e.g. PT1M = every minute) for long-running tasks. Setting this property to a lower value will reduce the number of API calls Kestra makes to the remote service, so keep that in mind in case you see API rate limit errors

The endpoint with which the SDK should communicate

This property allows you to use a different S3 compatible storage backend.

Instance and SSM Agent readiness timeout

The maximum duration to wait for the launched instance to reach the running state and for its SSM Agent to register with Systems Manager, before failing the task. Defaults to PT5M. Heavy or custom AMIs (e.g. ones that run lengthy boot-time provisioning) may need a higher value.

Reference (ref) of the pluginDefaults to apply to this task runner.

Whether to reconnect to the current instance and command if they already exist

Secret Key Id in order to connect to AWS

If no credentials are defined, we will use the default credentials provider chain to fetch credentials.

Security groups to attach to the instance

List of security group IDs to associate with the instance's network interface. If not set, the subnet's default security group is used.

AWS session token, retrieved from an AWS token service, used for authenticating that this user has received temporary permissions to access a given resource

If no credentials are defined, we will use the default credentials provider chain to fetch credentials.

Maximum Spot price per hour

If set, the instance is launched as a Spot Instance with this maximum hourly price in USD (e.g. 0.05). Leave unset to launch a standard On-Demand instance. Spot instances can be reclaimed by AWS at any time. Only use this for interruption-tolerant workloads.

Whether to poll CloudWatch Logs for near real-time command output

When true (default), the task runner polls the /aws/ec2/kestra-run-command CloudWatch log group for this command's output while it runs, so it appears in the Kestra execution as it is produced. This requires the instance's iamInstanceProfile to grant logs: CreateLogGroup, logs: CreateLogStream, and logs: PutLogEvents (AmazonSSMManagedInstanceCore alone does not include these). Set this to false to skip that live polling entirely: no CloudWatch API calls are made. Either way, command output always reaches Kestra once the command finishes: the task runner falls back to reading StandardOutputContent/StandardErrorContent straight from SSM's GetCommandInvocation response (capped at roughly 24 KB per stream) whenever nothing was already streamed from CloudWatch. Command polling and exit-code mapping are unaffected by this property either way.

The AWS STS endpoint with which the SDKClient should communicate

AWS STS Role

The Amazon Resource Name (ARN) of the role to assume. If set the task will use the StsAssumeRoleCredentialsProvider. If no credentials are defined, we will use the default credentials provider chain to fetch credentials.

AWS STS External Id

A unique identifier that might be required when you assume a role in another account. This property is only used when an stsRoleArn is defined.

AWS STS Session duration

The duration of the role session (default: 15 minutes, i.e., PT15M). This property is only used when an stsRoleArn is defined.

AWS STS Session name

This property is only used when an stsRoleArn is defined.

Subnet to launch the instance in

The ID of the subnet the instance's network interface is attached to. If not set, AWS launches the instance into your account's default VPC/subnet. The instance must be able to reach the AWS Systems Manager and (if bucket is set) S3 endpoints, either via a NAT/internet gateway or VPC endpoints.

Whether to synchronize working directory from remote runner back to local one after run.

Plugin Version

Defines the version of the plugin to use.

The version must follow the Semantic Versioning (SemVer) specification:

• A single-digit MAJOR version (e.g., 1).
• A MAJOR.MINOR version (e.g., 1.1).
• A MAJOR.MINOR.PATCH version, optionally with any qualifier (e.g., 1.1.2, 1.1.0-SNAPSHOT).

Post-completion CloudWatch log drain period

Once the command reaches a terminal status, the task runner keeps polling CloudWatch Logs until no new output has arrived for this long, so a short command's entire output burst, which can land in CloudWatch a second or two after the command already finished, isn't lost. Only used when streamLogs is true. Defaults to PT5S.

The maximum duration to wait for the SSM command completion unless the task timeout property is set which will take precedence over this property

The task will be marked as failed if the command has not completed by the time this duration elapses.

Batch account access key

Batch account name

The blob service endpoint.

Id of the pool on which to run the job

Blob storage configuration for staging batch task files

Determines how often Kestra should poll the container for completion. By default, the task runner checks every 5 seconds whether the job is completed. You can set this to a lower value (e.g. PT0.1S = every 100 milliseconds) for quick jobs and to a lower threshold (e.g. PT1M = every minute) for long-running jobs. Setting this property to a lower value will reduce the number of API calls Kestra makes to the remote service — keep that in mind in case you see API rate limit errors

Whether the job should be deleted upon completion

Warning, if the job is not deleted, a retry of the task could resume an old failed attempt of the job.

Reference (ref) of the pluginDefaults to apply to this task runner.

The private registry which contains the container image

Whether to reconnect to the current job if it already exists

Enable log streaming during task execution

This property is useful for capturing logs from tasks that have a timeout. If a task with a timeout is terminated, this property makes sure all logs up to that point are retrieved.

Whether to synchronize working directory from remote runner back to local one after run.

Plugin Version

Defines the version of the plugin to use.

The version must follow the Semantic Versioning (SemVer) specification:

• A single-digit MAJOR version (e.g., 1).
• A MAJOR.MINOR version (e.g., 1.1).
• A MAJOR.MINOR.PATCH version, optionally with any qualifier (e.g., 1.1.2, 1.1.0-SNAPSHOT).

The maximum duration to wait for the job completion unless the task timeout property is set, which will take precedence over this property

Azure Batch will automatically timeout the job upon reaching such duration and the task will fail.

Resource group containing the virtual machine

Used both to look up an existing VM (vmName) and to create a new one.

Azure subscription ID

The subscription that owns resourceGroupName and the virtual machine.

Blob storage used to stage inputFiles, outputFiles, namespaceFiles, and {{ outputDir }}

Mandatory to set if you want to use these properties.

Service principal client (application) ID

Required together with tenantId and clientSecret for service-principal authentication.

Service principal client secret

Required together with tenantId and clientId for service-principal authentication.

Determines how often Kestra polls while waiting for the VM to become ready and for the Run Command to complete

By default, every 5 seconds. Lower it for quick tasks, raise it (e.g. PT1M) for long-running ones to reduce API calls.

Whether to delete the VM once the task finishes

Defaults to true. Set to false (together with stopVm: false) to keep a shared/reusable VM alive across runs.

Linux image to provision the VM from

Format publisher: offer: sku; the latest version of that image is used. Defaults to Ubuntu 22.04 LTS. Ignored when reusing an existing VM.

VM readiness timeout

The maximum duration to wait for a newly created or restarted VM to reach the running power state before failing the task. Defaults to PT5M.

Reference (ref) of the pluginDefaults to apply to this task runner.

Azure region to create the virtual machine in

For example eastus. Required unless vmName refers to an already existing VM.

Whether to reconnect to an already running Kestra-created VM instead of creating a new one

Only applies when vmName is not set: on a Worker restart mid-run, the task runner looks for a VM it previously created for this same task run (matched by tags) and reuses it rather than launching a duplicate. The command itself is always re-issued against the resumed VM regardless (see the class description).

Whether to stop (deallocate) the VM once the task finishes

Deallocating stops compute billing (a plain "power off" alone does not, since Azure still reserves the compute capacity). Defaults to true. Honored whether the task succeeds, fails, or is killed.

Subnet the virtual machine's network interface joins

Full resource ID of an existing subnet, for example /subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.Network/virtualNetworks/<vnet>/subnets/<subnet>. Required to create a new VM, ignored when reusing one via vmName. The runner never creates a virtual network, so the subnet must already provide any outbound network path the VM needs (see blobStorage).

Whether to download the whole working directory back from Blob Storage instead of just the declared outputFiles

Defaults to false. Useful when the set of files produced by the task isn't known in advance.

Azure Active Directory tenant ID

Required together with clientId and clientSecret for service-principal authentication. When all three are left unset, the task runner falls back to DefaultAzureCredential (e.g. a managed identity attached to the Kestra Worker).

Plugin Version

Defines the version of the plugin to use.

The version must follow the Semantic Versioning (SemVer) specification:

• A single-digit MAJOR version (e.g., 1).
• A MAJOR.MINOR version (e.g., 1.1).
• A MAJOR.MINOR.PATCH version, optionally with any qualifier (e.g., 1.1.2, 1.1.0-SNAPSHOT).

Name of an already existing virtual machine to run the task on

Must reference a VM that already exists in resourceGroupName. The runner never creates a VM when vmName is set, and fails if none is found. Since it didn't create the VM, stopVm and deleteVm are ignored for it. Leave unset to have the runner provision a new VM, or resume one it created earlier.

Virtual machine size

For example Standard_DS1_v2. See the Azure documentation for available sizes. Required unless vmName refers to an already existing VM.

The maximum duration to wait for the Run Command completion unless the task timeout property is set which will take precedence over this property

The task will be marked as failed if the command has not completed by the time this duration elapses.

Configure Kubernetes cluster connection

Cluster endpoint, auth, and TLS settings used by the runner.

Default container spec applied to all containers

Merged into every container in the pod: the Kestra main container, user-defined sidecars from podSpec.containers, and Kestra's file-transfer init/sidecar containers.

This is the correct place for settings that must be uniform across all containers:

• volumeMounts — declare a shared volume mount once instead of repeating it per container
• securityContext — enforce a consistent security posture across all containers
• resources — set default limits/requests that containers can override individually
• env — inject common environment variables into all containers

Nested objects (securityContext, resources) are deep-merged; container-specific values win. Lists (volumeMounts, env) are prepended from the default; for env vars the last entry with a given name wins (container-specific overrides the default). To apply settings only to Kestra's file-transfer containers, use fileSideCarSpec instead.

Example — mounting a shared Docker socket into all containers:

containerDefaultSpec: 
  volumeMounts: 
    - name: docker-socket
      mountPath: /dind

Augment main container spec

Merged into the Kestra-generated main container before defaults; supports template expressions.

Environment variables defined here are preserved and merged with Kestra-injected vars (e.g. WORKING_DIR, OUTPUT_DIR). When a variable name collides, the Kestra-injected value takes precedence.

When set, the runner creates an ephemeral kubernetes.io/dockerconfigjson imagePullSecret in the pod namespace, references it from the task pod, and deletes it together with the pod. Field names mirror the Docker task runner's credentials block, so a flow can switch runner type without changing its credentials definition. Requires the runner ServiceAccount to be allowed to create/delete secrets in the namespace.

Delete pod after completion

Defaults to true; set false to keep the pod for debugging.

Augment file sidecar spec

Merged into init/sidecar containers used for file transfer; supports template expressions.

File transfer sidecar settings

Configure image, resources, and defaults for init/sidecar containers handling uploads/downloads.

Inherit cluster auto-config

When true, the client config is seeded from the ambient auto-config (in-cluster service account, kube config, env) before applying config, so tuning like config.enableHttp2 works in-cluster without re-declaring credentials. Only applies when config is set; default false.

Add custom pod labels

Merged with Kestra default flow/execution/taskrun labels.

Namespace for created pod

Defaults to 'default'; template expressions are allowed.

Node selector for scheduling

Assigns the pod to nodes matching the selector (see Assign Pod Nodes).

Reference (ref) of the pluginDefaults to apply to this task runner.

Additional YAML spec for the pod

Optional PodSpec merged into the generated pod; Kestra still sets the main container, restartPolicy=Never, volumes, and sidecars. Supports template expressions including {{ workingDir }} resolving to /kestra/working-dir when file I/O is enabled. To define a spec, refer to the using pods guide from the official Kubernetes documentation.

Any container listed under containers whose name is not "main" is preserved as a user-defined sidecar alongside the Kestra main container. A container named "main" is merged into the Kestra-built main container as a set of defaults — fields such as ports, env, and imagePullPolicy from the user entry are applied first, then containerSpec and Kestra-injected values (image, commands, env vars like WORKING_DIR) take precedence on collision. For settings that must apply to all containers (e.g. volumeMounts, per-container securityContext), use containerDefaultSpec rather than repeating them per container.

Set main container resources

CPU and memory requests/limits for the main task container.

Resume existing pod on restart

Default true; reconnects to an existing pod for the same taskrun when found.

Choose service account name

Uses the namespace default when omitted; must carry required RBAC.

Whether to synchronize working directory from remote runner back to local one after run.

Plugin Version

Defines the version of the plugin to use.

The version must follow the Semantic Versioning (SemVer) specification:

• A single-digit MAJOR version (e.g., 1).
• A MAJOR.MINOR version (e.g., 1.1).
• A MAJOR.MINOR.PATCH version, optionally with any qualifier (e.g., 1.1.2, 1.1.0-SNAPSHOT).

Extra wait for late logs

Default 30s; allows log streaming to finish after containers exit.

Wait for pod completion

Pod wall-clock timeout when task timeout is unset; default 1h.

Wait for pod to start

Max time for scheduling, image pull, and container start; default 10m.

GCP region

Region where the Batch job runs.

Staging GCS bucket

Bucket used to upload input/namespace files and retrieve outputs; required when using file transfer or {{outputDir}}.

Completion poll interval

How often to check job status; defaults to PT5S. Lower for short jobs, higher to reduce API calls. Setting this property to a lower value will reduce the number of API calls Kestra makes to the remote service — keep that in mind in case you see API rate limit errors.

Per-task compute resources

ComputeResource defines the amount of resources required for each task. Make sure your tasks have enough compute resources to successfully run. If you also define the types of resources for a job to use with the InstancePolicyOrTemplate field, make sure both fields are compatible with each other. Override CPU, memory, and boot disk per task (defaults: cpu 2000 milliCPU, memory 2048 MiB). Values must stay compatible with the chosen machine type or instance policy.

Delete job after completion

Defaults to true; set false to inspect or resume but stale jobs may be reused.

Container entrypoint

Override container entrypoint command.

The GCP service account to impersonate

Service account email to impersonate for API calls. For Cloud Run runner, this value applies to API calls used to create and run the job (--impersonate-service-account equivalent). It does not set the job execution identity (--service-account).

Lifecycle policy for failed tasks

Optional policy executed when conditions match; defaults to exit on code 0 and retry on non-zero up to max_retry_count.

Compute machine type

VM type for the Batch instance; defaults to e2-medium. See https://cloud.google.com/compute/docs/machine-types

Maximum number of retries when creating the batch job fails

Max task retries

Batch retry count on failure; default 0 disables retries.

Network interfaces

List of networks/subnets to attach to the Batch VM.

Reference (ref) of the pluginDefaults to apply to this task runner.

The GCP project ID

Compute reservation

Reservation resource name to target reserved capacity.

Resume existing job

If true (default), reattach to a matching job instead of creating a new one.

The GCP scopes to be used

The GCP service account key

Service account JSON key used to authenticate API calls. For Cloud Run runner job execution identity, this value is used as a fallback for --service-account when runtimeServiceAccount is not provided.

Whether to synchronize working directory from remote runner back to local one after run.

Plugin Version

Defines the version of the plugin to use.

The version must follow the Semantic Versioning (SemVer) specification:

• A single-digit MAJOR version (e.g., 1).
• A MAJOR.MINOR version (e.g., 1.1).
• A MAJOR.MINOR.PATCH version, optionally with any qualifier (e.g., 1.1.2, 1.1.0-SNAPSHOT).

Post-completion log wait

Quiet period after the job ends: Kestra keeps polling for new log entries until none have arrived for this long, then finalizes logs and outputs; defaults to PT5S.

Job timeout

Maximum wall-clock duration before Batch times out the job; defaults to PT1H. Task timeout takes precedence.

GCP region

Region where the Cloud Run job executes.

Staging GCS bucket

Bucket used to upload input/namespace files and retrieve outputs; required when using file transfer or {{outputDir}}.

Completion poll interval

How often to check execution status; defaults to PT5S. Lower for short jobs, higher to reduce API calls.

Delete job after completion

Defaults to true; set false to inspect runs but stale jobs may be reused.

The GCP service account to impersonate

Service account email to impersonate for API calls. For Cloud Run runner, this value applies to API calls used to create and run the job (--impersonate-service-account equivalent). It does not set the job execution identity (--service-account).

Max Cloud Run retries

Number of execution retries; defaults to 3.

VPC network

VPC network for Direct VPC Egress, for example projects/my-project/global/networks/my-vpc; cannot be used with vpcAccessConnector.

Reference (ref) of the pluginDefaults to apply to this task runner.

The GCP project ID

Container resource limits

CPU and memory limits for the Cloud Run container. If unset, Cloud Run defaults apply.

Resume existing job

If true (default), reattach to a matching job instead of creating a new one.

Cloud Run runtime service account

Service account email used as the Cloud Run Job execution identity (--service-account equivalent). This only controls runtime identity for the job's container and does not affect API authentication. If unset, the runner falls back to serviceAccount for backward compatibility.

The GCP scopes to be used

The GCP service account key

Service account JSON key used to authenticate API calls. For Cloud Run runner job execution identity, this value is used as a fallback for --service-account when runtimeServiceAccount is not provided.

VPC subnetwork

VPC subnetwork for Direct VPC Egress, for example projects/my-project/regions/europe-west1/subnetworks/my-subnet; cannot be used with vpcAccessConnector.

Whether to synchronize working directory from remote runner back to local one after run.

Plugin Version

Defines the version of the plugin to use.

The version must follow the Semantic Versioning (SemVer) specification:

• A single-digit MAJOR version (e.g., 1).
• A MAJOR.MINOR version (e.g., 1.1).
• A MAJOR.MINOR.PATCH version, optionally with any qualifier (e.g., 1.1.2, 1.1.0-SNAPSHOT).

Additional GCS bucket volumes

List of GCS buckets to mount as volumes inside the container. Each entry requires a bucket name and a container mount path. Set readOnly: true for read-only access; omit or set readOnly: false (the default) for read-write access.

VPC Access Connector

Full resource name for egress connector, e.g. projects/my-project/locations/europe-west1/connectors/my-connector.

VPC egress setting

PRIVATE_RANGES_ONLY or ALL_TRAFFIC; requires either vpcAccessConnector, network, or subnetwork.

Post-completion log wait

Quiet period after the job ends: Kestra keeps polling for new log entries until none have arrived for this long, then finalizes logs and outputs; defaults to PT5S.

Task timeout

Maps to the GCP "Task timeout" field visible in the GCP console under Task capacity. Controls both the GCP-enforced task timeout (applied to the job template and the per-run override) and the Kestra polling timeout — the Cloud Run task is forcibly terminated by GCP when this duration elapses. The Kestra task-level timeout property takes precedence over this value when set. Defaults to PT1H. GCP maximum is 168 hours (PT168H).