Git TenantSync

Git TenantSync

Certified

Sync a tenant between Kestra and Git

Synchronizes all Namespaces, flows, files, dashboards, apps, unit tests, and custom blueprints for the current tenant. Defaults to Kestra as source of truth; deletions follow whenMissingInSource and protectedNamespaces are always kept. Use dryRun to inspect the diff before applying.

yaml
type: io.kestra.plugin.git.TenantSync

Sync all objects (flows, files, dashboards, namespaces, apps, unit tests, and custom blueprints) under the same tenant as this flow using Git as the source of truth

yaml
id: tenant_sync_git
namespace: company.ops
tasks:
  - id: sync
    type: io.kestra.plugin.git.TenantSync
    sourceOfTruth: GIT
    whenMissingInSource: DELETE
    protectedNamespaces:
      - system
    url: https://github.com/fdelbrayelle/plugin-git-qa
    username: fdelbrayelle
    password: "{{ secret('GITHUB_ACCESS_TOKEN') }}"
    branch: main
    gitDirectory: kestra
    kestraUrl: "http://localhost:8080"
    auth:
      username: "{{ secret('KESTRA_USERNAME') }}"
      password: "{{ secret('KESTRA_PASSWORD') }}"

Sync all objects (flows, files, dashboards, namespaces, apps, unit tests, and custom blueprints) under the same tenant as this flow using Kestra as the source of truth

yaml
id: tenant_sync_kestra
namespace: company.ops
tasks:
  - id: sync
    type: io.kestra.plugin.git.TenantSync
    sourceOfTruth: KESTRA
    whenMissingInSource: KEEP
    url: https://github.com/fdelbrayelle/plugin-git-qa
    username: fdelbrayelle
    password: "{{ secret('GITHUB_ACCESS_TOKEN') }}"
    branch: dev
    kestraUrl: "http://localhost:8080"
    auth:
      username: "{{ secret('KESTRA_USERNAME') }}"
      password: "{{ secret('KESTRA_PASSWORD') }}"
Properties

Authentication options

Choose either apiToken or HTTP Basic credentials; mixing both is rejected.

Definitions
apiTokenstring

API token

Preferred for server-to-server access; mutually exclusive with username/password.

autobooleanstring
Defaulttrue

Automatically retrieve credentials from Kestra's configuration if available

The default configuration can be configured globally inside the Kestra configuration file:

  • Set kestra.tasks.sdk.authentication.api-token to use an API token
  • Set kestra.tasks.sdk.authentication.username and kestra.tasks.sdk.authentication.password for HTTP basic authentication The Enterprise edition also provides setting a default configuration at the Namespace of Tenant level by an administrator.
passwordstring

Password for HTTP Basic authentication

usernamestring

Username for HTTP Basic authentication

Branch to read and write

Required. Do not prefix with origin/ or refs/heads/.

Commit author email

Commit author name

Defaults to the rendered username when not set.

Clone Git submodules

Set to true to fetch and checkout submodules; defaults to false.

Defaultfalse

Plan-only mode

When true, computes the diff and outputs it without applying changes.

Git config applied after clone

Map of Git config keys and values, applied after clone
Few examples: 
- 'core.fileMode': false -> ignore file permission changes
- 'core.autocrlf': false -> prevent line ending conversion

Base folder for Kestra files

This is the base folder in your Git repository where Kestra will look for code and files. If you don't set it, the repo root will be used. Inside that folder, Kestra always expects a structure like /flows, /files, etc.

gitDirectory namespace Expected Git path
(not set) company company/flows/my-flow.yaml
monorepo company.ops monorepo/company.ops/flows/my-flow.yaml
projectA company.team projectA/company.team/flows/my-flow.yaml

Note: a dotted namespace such as company.team maps to a folder literally named company.team, not to a nested company/team path.

Kestra API URL

Rendered first; falls back to kestra.url from configuration, then to http://localhost: 8080.

Known hosts file content used for SSH host key verification

OpenSSH known_hosts-formatted content used to verify the remote server's SSH host key. If not set, the system/user known_hosts file is used.

DefaultFAIL
Possible Values
SKIPWARNFAIL

Action on invalid resource syntax

Defaults to FAIL. Use WARN or SKIP to continue when parsing issues occur.

Passphrase for privateKey

Password or personal access token

When set, pushes use the identity tied to this credential, so authorName and authorEmail become optional.

Reference (ref) of the pluginDefaults to apply to this task.

SSH private key in PEM format

Use an ECDSA/PEM key whose public part is registered on Git. Example: ssh-keygen -t ecdsa -b 256 -m PEM.

SubTypestring
Default["system"]

Namespaces protected from deletion

Always kept even if whenMissingInSource is DELETE.

DefaultKESTRA
Possible Values
GITKESTRA

Source of truth for sync

Defaults to KESTRA. Choose GIT to make the repository authoritative.

Defaulttrue

Whether to verify the SSH remote server's host key

When true (default), the host key presented by the Git server is verified against knownHosts (if provided) or the system/user known_hosts file, protecting against man-in-the-middle attacks. Only disable this for trusted networks/testing.

Git repository URL

HTTPS or SSH URL used for clone/fetch/push. Supports templating.

Repository username or organization

DefaultDELETE
Possible Values
DELETEKEEPFAIL

Action when item missing in source

Default DELETE. Determines whether missing resources are deleted, kept, or cause the task to fail.

Commit ID pushed (if any)

Commit URL (if any)

Formaturi

Diff file with planned/applied changes

Points to the ion diff stored in internal storage; includes dry-run plans.

More Plugins in this Category

NetBox (EE)
NetBox
Enterprise

Enterprise NetBox tasks to create, update, and query devices, IP addresses, and sites over the NetBox API.

Infrastructure

7 tasks

4 blueprints

YouTube
YouTube

Tasks that interact with the YouTube Data API.

Business

4 tasks