Git TenantSync

Git TenantSync
Certified
Enterprise Edition
Sync a tenant between Kestra and Git

Synchronizes all Namespaces, flows, files, dashboards, apps, unit tests, and custom blueprints for the current tenant. Defaults to Kestra as source of truth, and can be overridden independently per resource kind via sourceOfTruthOverrides; deletions follow whenMissingInSource and protectedNamespaces are always kept. Use dryRun to inspect the diff before applying.

yaml
type: io.kestra.plugin.git.TenantSync

Examples

Sync all objects (flows, files, dashboards, namespaces, apps, unit tests, and custom blueprints) under the same tenant as this flow using Git as the source of truth

yaml
id: tenant_sync_git
namespace: company.ops
tasks:
  - id: sync
    type: io.kestra.plugin.git.TenantSync
    sourceOfTruth: GIT
    whenMissingInSource: DELETE
    protectedNamespaces:
      - system
    url: https://github.com/fdelbrayelle/plugin-git-qa
    username: fdelbrayelle
    password: "{{ secret('GITHUB_ACCESS_TOKEN') }}"
    branch: main
    gitDirectory: kestra
    kestraUrl: "http://localhost:8080"
    auth:
      username: "{{ secret('KESTRA_USERNAME') }}"
      password: "{{ secret('KESTRA_PASSWORD') }}"

Sync all objects (flows, files, dashboards, namespaces, apps, unit tests, and custom blueprints) under the same tenant as this flow using Kestra as the source of truth

yaml
id: tenant_sync_kestra
namespace: company.ops
tasks:
  - id: sync
    type: io.kestra.plugin.git.TenantSync
    sourceOfTruth: KESTRA
    whenMissingInSource: KEEP
    url: https://github.com/fdelbrayelle/plugin-git-qa
    username: fdelbrayelle
    password: "{{ secret('GITHUB_ACCESS_TOKEN') }}"
    branch: dev
    kestraUrl: "http://localhost:8080"
    auth:
      username: "{{ secret('KESTRA_USERNAME') }}"
      password: "{{ secret('KESTRA_PASSWORD') }}"

Push flows from Kestra to Git while pulling Namespace Files from Git into Kestra, in the same run

yaml
id: tenant_sync_mixed
namespace: company.ops
tasks:
  - id: sync
    type: io.kestra.plugin.git.TenantSync
    sourceOfTruth: KESTRA
    sourceOfTruthOverrides:
      namespaceFiles: GIT
    whenMissingInSource: KEEP
    url: https://github.com/fdelbrayelle/plugin-git-qa
    username: fdelbrayelle
    password: "{{ secret('GITHUB_ACCESS_TOKEN') }}"
    branch: main
    kestraUrl: "http://localhost:8080"
    auth:
      username: "{{ secret('KESTRA_USERNAME') }}"
      password: "{{ secret('KESTRA_PASSWORD') }}"

Properties

auth *

Authentication information

Definitions

io.kestra.plugin.git.shared.AbstractKestraTask-Auth

apiTokenstring

API token for Bearer authentication

autobooleanstring

Defaulttrue

Automatically retrieve the URL and the credentials from Kestra's configuration if available

The default configuration can be configured globally inside the Kestra configuration file:

Set kestra.tasks.sdk.authentication.url to use a given API URL
Set kestra.tasks.sdk.authentication.api-token to use an API token
Set kestra.tasks.sdk.authentication.username and kestra.tasks.sdk.authentication.password for HTTP basic authentication The Enterprise edition also provides setting a default configuration at the Namespace of Tenant level by an administrator. Set this to false without any credentials to call a Kestra API that requires no authentication.

passwordstring

Password for HTTP Basic authentication

usernamestring

Username for HTTP Basic authentication

branch *string

Branch to read and write

Required. Do not prefix with origin/ or refs/heads/.

authorEmail string

Commit author email

authorName string

Commit author name

Defaults to the rendered username when not set.

cloneSubmodules booleanstring

Clone Git submodules

Set to true to fetch and checkout submodules; defaults to false.

connectTimeout integerstring

Default10000

HTTP connect timeout (ms)

Default 10000 ms.

dryRun booleanstring

Defaultfalse

Plan-only mode

When true, computes the diff and outputs it without applying changes.

gitConfig object

Git configuration overrides

Map of git config keys and values applied after clone, e.g.:

core.fileMode: false (ignore permission flips)
core.autocrlf: false (preserve line endings)

gitDirectory string

Base folder for Kestra files

This is the base folder in your Git repository where Kestra will look for code and files. If you don't set it, the repo root will be used. Inside that folder, Kestra always expects a structure like /flows, /files, etc.

gitDirectory	namespace	Expected Git path
(not set)	company	company/flows/my-flow.yaml
monorepo	company.ops	monorepo/company.ops/flows/my-flow.yaml
projectA	company.team	projectA/company.team/flows/my-flow.yaml

Note: a dotted namespace such as company.team maps to a folder literally named company.team, not to a nested company/team path.

kestraUrl string

Kestra API URL

URL of the Kestra server API. If not set, the URL of the default SDK authentication is used, set with the kestra.tasks.sdk.authentication.url configuration property, or at the namespace or the tenant level on the Enterprise Edition. It then falls back to the kestra.url configuration property, and finally to http://localhost: 8080.

knownHosts string

Known hosts file content used for SSH host key verification

OpenSSH known_hosts-formatted content used to verify the remote server's SSH host key. If not set, the system/user known_hosts file is used. Only relevant when strictHostKeyChecking is true.

noProxy booleanstring

Disable proxy for HTTP

When true, forces direct connections instead of using the JVM proxy settings.

onInvalidSyntax string

DefaultFAIL

Possible Values

SKIPWARNFAIL

Action on invalid resource syntax

Defaults to FAIL. Use WARN or SKIP to continue when parsing issues occur.

passphrase string

Passphrase for privateKey

password string

Password or personal access token

Supplies HTTP credentials. When a PAT is used, pushes are recorded under that PAT’s user without needing authorName and authorEmail.

**GitHub PAT permissions required: **

Fine-grained PAT: Contents: Read (clone/fetch) or Contents: Read and Write (push), plus Metadata: Read (mandatory base permission). Add Workflows: Read and Write when pushing .github/workflows/ files.
Classic PAT: repo scope covers all read/write operations; add workflow when pushing workflow files.

privateKey string

PEM private key

PEM-formatted private key matching a public key registered on the Git server. Generate with ssh-keygen -t ecdsa -b 256 -m PEM.

protectedNamespaces array

SubTypestring

Default["system"]

Namespaces protected from deletion

Always kept even if whenMissingInSource is DELETE.

readTimeout integerstring

Default60000

HTTP read timeout (ms)

Default 60000 ms.

sourceOfTruth string

DefaultKESTRA

Possible Values

GITKESTRA

Source of truth for sync

Defaults to KESTRA. Choose GIT to make the repository authoritative.

sourceOfTruthOverrides

Per-resource source of truth overrides

Overrides sourceOfTruth independently per resource kind (flows, Namespace Files, apps, unit tests, dashboards, and custom blueprints), letting a single run push some kinds to Git while pulling others from Git in the same execution. Unset fields fall back to sourceOfTruth. whenMissingInSource stays a single global setting, but its effect flips per kind with the resolved source: for example, with sourceOfTruth: KESTRA, sourceOfTruthOverrides.namespaceFiles: GIT, and whenMissingInSource: DELETE, a Namespace File present in Kestra but absent from Git is deleted from Kestra, since Git is the source for files.

Definitions

io.kestra.plugin.git.EeSourceOfTruthOverrides

appsstring

Possible Values

GITKESTRA

Source of truth for apps

Overrides the task-level sourceOfTruth for apps only. Falls back to sourceOfTruth when unset.

blueprintsstring

Possible Values

GITKESTRA

Source of truth for custom blueprints

Overrides the task-level sourceOfTruth for custom blueprints only. Falls back to sourceOfTruth when unset. Blueprints are tenant-scoped (they carry no namespace), so on NamespaceSync a whenMissingInSource of DELETE or FAIL is ignored for blueprints: Kestra is queried tenant-wide while Git holds only one namespace's folder, so a blueprint missing from that folder cannot be attributed to this namespace. Use TenantSync to delete blueprints tenant-wide.

dashboardsstring

Possible Values

GITKESTRA

Source of truth for dashboards

Overrides the task-level sourceOfTruth for dashboards only. Falls back to sourceOfTruth when unset. Dashboards are tenant-scoped and only synced by TenantSync.

flowsstring

Possible Values

GITKESTRA

Source of truth for flows

Overrides the task-level sourceOfTruth for flows only. Falls back to sourceOfTruth when unset.

namespaceFilesstring

Possible Values

GITKESTRA

Source of truth for Namespace Files

Overrides the task-level sourceOfTruth for Namespace Files only. Falls back to sourceOfTruth when unset.

unitTestsstring

Possible Values

GITKESTRA

Source of truth for unit tests

Overrides the task-level sourceOfTruth for unit tests only. Falls back to sourceOfTruth when unset.

strictHostKeyChecking booleanstring

Whether to verify the SSH remote server's host key

When enabled, the host key presented by the Git server is verified against knownHosts (if provided) or the system/user known_hosts file. Disabling it exposes the connection to man-in-the-middle attacks (CWE-297). Set knownHosts alongside this property for a hardened setup. The default differs by edition: disabled (false) on Kestra OSS, enabled (true) on Kestra Enterprise Edition.

trustedCaPemPath string

Extra trusted CA PEM path

Optional PEM-encoded CA bundle added to the JVM truststore; equivalent to git config http.sslCAInfo <path> for self-signed or internal CAs.

url string

Repository URL

HTTP(S) or SSH URI used for clone and push operations.

username string

Username or organization

Used for HTTP basic authentication and as a fallback commit author.

whenMissingInSource string

DefaultDELETE

Possible Values

DELETEKEEPFAIL

Action when item missing in source

Default DELETE. Determines whether missing resources are deleted, kept, or cause the task to fail.

Outputs

commitId string

Commit ID pushed (if any)

commitURL string

Commit URL (if any)

diff string

Formaturi

Diff file with planned/applied changes

Points to the ion diff stored in internal storage; includes dry-run plans.

Core Plugins and tasks

Tasks that provide Kestra's built-in orchestration, I/O, and observability capabilities.

Core

Azure

Enterprise

Tasks that integrate Microsoft Azure services into Kestra enterprise workflows.

CloudDataInfrastructure

Git TenantSyncCertifiedEnterprise EditionSync a tenant between Kestra and Git

Git TenantSync

More Plugins in this Category

Core Plugins and tasks

Azure

Git TenantSync
Certified
Enterprise Edition
Sync a tenant between Kestra and Git