File system Command
CertifiedRun commands over SSH
File system Command
Run commands over SSH
Executes one or more commands on a remote host via SSH. Supports PASSWORD, PUBLIC_KEY, or OPEN_SSH auth. Default port 22 and strict host key checking off (no). Allow weak rsa-sha1 only when enableSshRsa1 is true.
type: io.kestra.plugin.fs.ssh.CommandExamples
Run SSH command using password authentication
id: fs_ssh_command
namespace: company.team
tasks:
- id: command
type: io.kestra.plugin.fs.ssh.Command
host: localhost
port: "22"
authMethod: PASSWORD
username: foo
password: "{{ secret('SSH_PASSWORD') }}"
commands:
- ls
Run SSH command using public key authentication (must be an OpenSSH private key)
id: fs_ssh_command
namespace: company.team
tasks:
- id: command
type: io.kestra.plugin.fs.ssh.Command
host: localhost
port: "22"
authMethod: PUBLIC_KEY
username: root
privateKey: "{{ secret('SSH_RSA_PRIVATE_KEY') }}"
commands:
- touch kestra_was_here
Run SSH command through a proxy command
id: fs_ssh_proxy_command
namespace: company.team
tasks:
- id: command
type: io.kestra.plugin.fs.ssh.Command
host: host
username: user
authMethod: PASSWORD
password: "{{ secret('SSH_PASSWORD') }}"
proxyCommand: |
cloudflared access ssh --service-token-id {{ secret('SSH_PROXY_SERVICE_TOKEN_ID') }} --service-token-secret {{ secret('SSH_PROXY_SERVICE_TOKEN_SECRET') }} --hostname proxy_host
commands:
- mycmd
Run a tool that logs its levels on stderr; the level declared in each line is kept
id: fs_ssh_stderr_levels
namespace: company.team
tasks:
- id: backup
type: io.kestra.plugin.fs.ssh.Command
host: localhost
authMethod: PASSWORD
username: foo
password: "{{ secret('SSH_PASSWORD') }}"
commands:
- python3 /opt/scripts/backup.py # logs with the `logging` module, e.g. "WARNING:root:disk almost full"
Keep every stderr line at the ERROR level by disabling log level detection
id: fs_ssh_stderr_as_error
namespace: company.team
tasks:
- id: backup
type: io.kestra.plugin.fs.ssh.Command
host: localhost
authMethod: PASSWORD
username: foo
password: "{{ secret('SSH_PASSWORD') }}"
parseLogLevel: false
commands:
- python3 /opt/scripts/backup.py # logs with the `logging` module, e.g. "WARNING:root:disk almost full"
Run SSH command using the local OpenSSH configuration
id: ssh
namespace: company.team
tasks:
- id: ssh
type: io.kestra.plugin.fs.ssh.Command
authMethod: OPEN_SSH
host: localhost
password: "{{ secret('SSH_PASSWORD') }}"
commands:
- echo "Hello World"Properties
commands *array
1Commands to execute
host *string
Remote host
assets
Assets this task consumes as inputs or produces as outputs, for lineage tracking and the asset graph (Enterprise Edition). A flow declaring this property on a task is rejected in the open-source edition.
io.kestra.core.models.assets.AssetsDeclaration
IGNOREFAILWARNAsset failure behavior
Behavior applied to the task state when a declared asset fails to render, emit, or be persisted (e.g. a lock conflict): FAIL escalates it to FAILED, WARN (default) warns it if it would otherwise succeed, IGNORE leaves the state untouched.
Whether to auto-register assets referenced dynamically at runtime that are not statically declared in inputs or outputs.
The assets consumed as inputs.
io.kestra.core.models.assets.AssetIdentifier
1The assets produced as outputs.
io.kestra.plugin.ee.assets.Dataset
1150{}1150io.kestra.plugin.ee.assets.File
1150{}1150io.kestra.plugin.ee.assets.Table
1150{}1150io.kestra.plugin.ee.assets.VM
1150{}1150io.kestra.core.models.assets.External
1150{}1150io.kestra.core.models.assets.Custom
11501Custom asset type
{}1150authMethod string
PASSWORDPASSWORDPUBLIC_KEYOPEN_SSHSSH authentication configuration
When authMethod is OPEN_SSH, access to local SSH config must be allowed with allow-open-ssh-config: true in the plugin configuration:
kestra:
plugins:
configurations:
- type: io.kestra.plugin.fs.ssh.Command
values:
allow-open-ssh-config: true
enableSshRsa1 booleanstring
falseEnable the disabled by default RSA/SHA1 algorithm
env object
Environment variables to pass to the SSH process
openSSHConfigPath string
OpenSSH config file path
Used when authMethod is OPEN_SSH. Access must be allowed via plugin configuration.
Defaults to ~/.ssh/config when neither this nor the deprecated openSSHConfigDir is set.
parseLogLevel booleanstring
trueDetect the log level of stderr lines
When true (default), a stderr line starting with a level is logged at that level instead of ERROR.
The level is read from the start of the line, after an optional timestamp, either in brackets ([WARN] msg)
or bare followed by a space or colon (WARNING: root: msg, 2026-01-01 10: 00: 00 ERROR msg).
Recognized levels are FATAL, CRITICAL, SEVERE, ERROR, WARN, WARNING, INFO and NOTICE, plus DEBUG, TRACE, FINE, FINER and FINEST in brackets only.
The detected level is never below INFO, so [DEBUG] lines are shown at INFO.
Lines without a recognized level stay at ERROR, including continuation lines of a multi-line record, and stdout is not affected.
A ::{...}:: payload still takes priority over level detection.
Since detection is on by default, some stderr lines move from ERROR to WARN or INFO, so flows alerting on ERROR logs may stop firing for them.
Set to false to log every stderr line at ERROR, as before.
password string
Password
Required for PASSWORD auth; optional for OPEN_SSH when config supplies credentials.
port string
22Remote port
privateKey string
Private SSH key
OpenSSH private key content for PUBLIC_KEY auth.
privateKeyPassphrase string
Private key passphrase
Optional passphrase for the private key.
proxyCommand string
Proxy command
Optional local command used to establish the SSH transport (OpenSSH ProxyCommand semantics).
Example: cloudflared access ssh --service-token-id ... --service-token-secret ... --hostname ...
strictHostKeyChecking string
noStrict host key checking
One of yes|no|ask. Default no.
username string
Username
Required for PASSWORD and PUBLIC_KEY methods.
Outputs
exitCode integer
0The exit code of the entire flow execution
vars object
The values extracted from executed commands using the Kestra outputs format
