​Kubernetes

This plugin is only available in the Enterprise Edition (EE).

To generate output files you can:

• Use the outputFiles property of the task and create a file with the same name in the task’s working directory, or
• Create any file in the output directory, which can be accessed with the {{outputDir}} Pebble expression or the OUTPUT_DIR environment variable.

When the Kestra Worker running this task is terminated, the pod continues until completion. After restarting, the Worker will resume processing on the existing pod unless resume is set to false.

If your cluster is configured with RBAC, the service account running your pod must have the following authorizations:

• pods: get, create, delete, watch, list
• pods/log: get, watch
• pods/exec: get, watch

Here is an example role that grants these authorizations:

yaml

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: task-runner
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "create", "delete", "watch", "list"]
- apiGroups: [""]
  resources: ["pods/exec"]
  verbs: ["get", "watch"]
- apiGroups: [""]
  resources: ["pods/log"]
  verbs: ["get", "watch"]

Enterprise Edition Talk to us

The configuration of the target Kubernetes cluster.

Default container spec applied to all containers in the pod

When set, these container spec fields are merged into all containers including:

• User-defined containers in the spec
• Init and sidecar containers for file transfer (unless fileSidecar.defaultSpec is set)

This provides a convenient way to apply uniform container settings across all containers, which is especially useful in restrictive environments like GovCloud.

Supports any valid Kubernetes container spec fields such as:

• securityContext: Security settings for all containers
• volumeMounts: Volume mounts to add to all containers
• resources: Resource limits/requests for all containers
• env: Environment variables for all containers

Merge behavior:

• For nested objects (like securityContext): deep merge, container-specific values take precedence
• For lists (like volumeMounts, env): concatenated, with defaults added first
• Container-specific values always override defaults

Example configuration:

containerDefaultSpec: 
  securityContext: 
    allowPrivilegeEscalation: false
    capabilities: 
      drop: 
      - ALL
    readOnlyRootFilesystem: true
    seccompProfile: 
      type: RuntimeDefault
  volumeMounts: 
    - name: tmp
      mountPath: /tmp
  resources: 
    limits: 
      memory: "256Mi"

Additional YAML spec for the container.

Whether the pod should be deleted upon completion.

Additional YAML spec for the sidecar container.

The configuration of the file sidecar container that handle download and upload of files.

The pod custom labels

Kestra will add default labels to the pod with execution and flow identifiers.

The namespace where the pod will be created.

Node selector for pod scheduling

Kestra will assign the pod to the nodes you want (see Assign Pod Nodes)

Additional YAML spec for the pod.

The image pull policy for a container image and the tag of the image, which affect when Docker attempts to pull (download) the specified image.

The pod custom resources

Whether to reconnect to the current pod if it already exists.

The name of the service account.

Whether to synchronize working directory from remote runner back to local one after run.

Plugin Version

Defines the version of the plugin to use.

The version must follow the Semantic Versioning (SemVer) specification:

• A single-digit MAJOR version (e.g., 1).
• A MAJOR.MINOR version (e.g., 1.1).
• A MAJOR.MINOR.PATCH version, optionally with any qualifier (e.g., 1.1.2, 1.1.0-SNAPSHOT).

The additional duration to wait for logs to arrive after pod completion.

As logs are not retrieved in real time, we cannot guarantee that we have fetched all logs when the pod complete, therefore we wait for a fixed amount of time to fetch late logs.

The maximum duration to wait for the pod completion unless the task timeout property is set which will take precedence over this property.

The maximum duration to wait until the pod is created.

This timeout is the maximum time that Kubernetes scheduler can take to

• schedule the pod
• pull the pod image
• and start the pod.