DigitalOcean Create
CertifiedCreate a DigitalOcean Spaces access key
DigitalOcean Create
Create a DigitalOcean Spaces access key
Creates an S3-compatible access key for Spaces, scoped to specific buckets (READ or READWRITE) or with FULLACCESS to every bucket. DigitalOcean returns the secret key only once, in this response: the task outputs it as an encrypted string, so it is not stored in cleartext in the execution outputs (this requires Kestra's encryption secret key to be configured).
type: io.kestra.plugin.digitalocean.spaces.key.CreateExamples
Create a read-only key for one bucket and pass it to a later task
id: digitalocean_create_spaces_key
namespace: company.team
tasks:
- id: create_key
type: io.kestra.plugin.digitalocean.spaces.key.Create
apiToken: "{{ secret('DIGITALOCEAN_TOKEN') }}"
name: reports-reader
grants:
- bucket: reports
permission: READ
- id: log_key
type: io.kestra.plugin.core.log.Log
message: "Created access key {{ outputs.create_key.accessKey }}"
Properties
apiToken *string
DigitalOcean API token
Personal access token used to authenticate against the DigitalOcean API v2, sent as Authorization: Bearer <token>. Create one (prefixed dop_v1_) in the DigitalOcean control panel under API > Tokens, and store it as a Kestra secret.
name *string
Key name
Name of the access key.
assets
Assets this task consumes as inputs or produces as outputs, for lineage tracking and the asset graph (Enterprise Edition). A flow declaring this property on a task is rejected in the open-source edition.
io.kestra.core.models.assets.AssetsDeclaration
IGNOREFAILWARNAsset failure behavior
Behavior applied to the task state when a declared asset fails to render, emit, or be persisted (e.g. a lock conflict): FAIL escalates it to FAILED, WARN (default) warns it if it would otherwise succeed, IGNORE leaves the state untouched.
Whether to auto-register assets referenced dynamically at runtime that are not statically declared in inputs or outputs.
The assets consumed as inputs.
io.kestra.core.models.assets.AssetIdentifier
1The assets produced as outputs.
io.kestra.plugin.ee.assets.Dataset
1150{}1150io.kestra.plugin.ee.assets.File
1150{}1150io.kestra.plugin.ee.assets.Table
1150{}1150io.kestra.plugin.ee.assets.VM
1150{}1150io.kestra.core.models.assets.External
1150{}1150io.kestra.core.models.assets.Custom
11501Custom asset type
{}1150baseUrl string
https://api.digitalocean.comDigitalOcean API base URL
Base endpoint for all DigitalOcean API calls. Defaults to https://api.digitalocean.com.
grants array
Grants
Bucket permissions of the key. Each grant has a bucket and a permission (READ or READWRITE); use a single grant with permission FULLACCESS and no bucket for a key that can access every bucket. FULLACCESS cannot be combined with bucket-scoped grants. Leave empty for a key with no access yet.
io.kestra.plugin.digitalocean.spaces.key.Grant
READREADWRITEFULLACCESSPermission
READ, READWRITE, or FULLACCESS.
Bucket name
Name of the Spaces bucket the permission applies to. Leave empty for FULLACCESS, which covers every bucket.
options
HTTP client options
Optional HTTP configuration (timeouts, proxy, SSL) applied to every DigitalOcean API call.
io.kestra.core.http.client.configurations.HttpConfiguration
falseIf true, allow a failed response code (response code >= 400)
List of response code allowed for this request
The authentication to use.
io.kestra.core.http.client.configurations.BasicAuthConfiguration
The password for HTTP basic authentication.
The username for HTTP basic authentication.
io.kestra.core.http.client.configurations.BearerAuthConfiguration
The token for bearer token authentication.
io.kestra.core.http.client.configurations.DigestAuthConfiguration
The password for HTTP Digest authentication.
The username for HTTP Digest authentication.
UTF-8The default charset for the request.
java.nio.charset.Charset
trueWhether to enable TCP Keep-Alive extended socket options (TCP_KEEPIDLE, TCP_KEEPINTERVAL, TCP_KEEPCOUNT).
Set to false when running on Windows workers, as these extended socket options are not supported by the Windows JDK and will cause connection failures.
trueWhether redirects should be followed automatically.
REQUEST_HEADERSREQUEST_BODYRESPONSE_HEADERSRESPONSE_BODYThe enabled log.
The proxy configuration.
io.kestra.core.http.client.configurations.ProxyConfiguration
The address of the proxy server.
The password for proxy authentication.
The port of the proxy server.
DIRECTDIRECTHTTPSOCKSThe type of proxy to use.
The username for proxy authentication.
The SSL request options
io.kestra.core.http.client.configurations.SslOptions
Whether to disable checking of the remote SSL certificate.
Only applies if no trust store is configured. Note: This makes the SSL connection insecure and should only be used for testing. If you are using a self-signed certificate, set up a trust store instead.
The timeout configuration.
io.kestra.core.http.client.configurations.TimeoutConfiguration
The time allowed to establish a connection to the server before failing.
PT5MThe time allowed for a read connection to remain idle before closing it.
Outputs
accessKey string
Access key ID
The access key ID used to access the buckets, e.g. DO00EXAMPLE.
createdAt string
date-timeCreation timestamp
grants array
Grants
Bucket permissions of the key, each with a bucket and a permission (read, readwrite, or fullaccess).
name string
Key name
secretKey string
Secret key
The secret key, encrypted in the execution outputs. DigitalOcean returns it only at creation, so store it right away, e.g. in a secret manager.
