Kubernetes Restart

Kubernetes Restart
Certified
Trigger rolling restarts for workloads

Performs a rolling restart on Deployments or StatefulSets in a namespace. waitUntilReady is ignored for this task.

yaml
type: io.kestra.plugin.kubernetes.kubectl.Restart

Examples

Trigger a rolling restart of a StatefulSet named 'api'.

yaml
id: restart_api
namespace: company.team

tasks:
  - id: restart
    type: io.kestra.plugin.kubernetes.kubectl.Restart
    connection:
      masterUrl: "{{ secret('MASTER_URL') }}"
      caCertData: "{{ secret('CA_CERT_DATA') }}"
      oauthToken: "{{ secret('OAUTH_TOKEN') }}"
    namespace: api
    resourceType: StatefulSet
    resourcesNames:
      - api

Properties

resourceType *string

Possible Values

DeploymentStatefulSet

Workload type

Deployment or StatefulSet.

resourcesNames *array

SubTypestring

Resource names

Names of workloads to restart in the namespace.

connection

Kubernetes connection

Connection settings for the cluster. If omitted, the client resolves credentials in order: system properties, environment variables, kubeconfig, then in-cluster service account.

Definitions

io.kestra.plugin.kubernetes.shared.models.Connection

apiVersionstring

Defaultv1

API version

API group version used by the client. Default v1.

caCertDatastring

CA certificate data

Base64-encoded PEM CA bundle. Whitespace is stripped automatically.

caCertFilestring

CA certificate file

Path to a PEM CA bundle.

clientCertDatastring

Client certificate data

Base64-encoded client cert. Whitespace is stripped automatically.

clientCertFilestring

Client certificate file

clientKeyAlgostring

DefaultRSA

Client key algorithm

Algorithm for the client key. Default RSA.

clientKeyDatastring

Client key data

Base64-encoded client key. Whitespace is stripped automatically.

clientKeyFilestring

Client key file

clientKeyPassphrasestring

Client key passphrase

disableHostnameVerificationbooleanstring

Disable hostname verification

Disables TLS hostname checks. Avoid in production clusters.

enableHttp2booleanstring

Enable HTTP/2

Off by default (HTTP/1.1, the prior behavior). Enable to use HTTP/2, which keeps long-lived watch/log streams alive better through proxies like GKE konnectivity.

keyStoreFilestring

Keystore file

keyStorePassphrasestring

Keystore passphrase

masterUrlstring

Defaulthttps://kubernetes.default.svc

Kubernetes API URL

API server endpoint. Default https://kubernetes.default.svc.

maxConcurrentRequestsintegerstring

Max concurrent HTTP requests

Caps total concurrent HTTP requests issued by this client. Lower this when running many concurrent tasks against a rate-limited API server (e.g. GKE). Fabric8 default: 64.

maxConcurrentRequestsPerHostintegerstring

Max concurrent HTTP requests per host

Caps concurrent HTTP requests to a single host (the API server). Fabric8 default: 5.

namespacestring

Default namespace

Namespace used when resources omit a namespace.

oauthTokenstring

OAuth token

oauthTokenProvider

Dynamically refreshes the OAuth token used to authenticate with the Kubernetes API. Use this when authenticating via a cloud provider (e.g. GCP, AWS, Azure) whose tokens are short-lived (typically 1 hour). Without this, long-running tasks will fail with an unauthorized error once the initial token expires. The provider executes a Kestra task to fetch a fresh token each time the Kubernetes client needs to re-authenticate.

OAuth token provider

Dynamically refreshes an OAuth token by executing a Kestra task each time the Kubernetes client needs to authenticate. This is essential for cloud providers (e.g. GCP, AWS, Azure) whose tokens are short-lived (typically 1 hour). Without automatic refresh, long-running tasks will fail with an unauthorized error once the initial token expires.

cachestring

DefaultPT5M

Formatduration

Token cache duration

How long a fetched token is reused before the provider executes the task again. Caching avoids hammering the token endpoint on every Kubernetes API call. Defaults to 5 minutes (PT5M). Set to PT0S to disable caching.

outputstring

Token output expression

An expression to extract the token value from the task output, e.g. {{ accessToken.tokenValue }}.

task

Token provider task

A Kestra task that fetches a fresh OAuth token. This task is executed each time the Kubernetes client needs to authenticate, enabling automatic token refresh for long-running operations.

passwordstring

Password

trustCertsbooleanstring

Trust all certificates

When true, skips TLS cert validation. Use only for testing.

trustStoreFilestring

Truststore file

trustStorePassphrasestring

Truststore passphrase

usernamestring

Username

watchReconnectIntervalstring

Watch reconnect interval

Backoff between watch reconnect attempts. Increase to prevent reconnect storms under API server pressure. Fabric8 default: 1s.

websocketPingIntervalstring

WebSocket ping interval

Keepalive ping on exec/log connections so idle streams aren't dropped by a proxy (e.g. GKE konnectivity). Only honored by the OkHttp backend. 0 disables.

containerDefaultSpec object

Default container spec applied to all containers in the pod

When set, these container spec fields are merged into all containers including:

User-defined containers in the spec
Init and sidecar containers for file transfer (unless fileSidecar.defaultSpec is set)

This provides a convenient way to apply uniform container settings across all containers, which is especially useful in restrictive environments like GovCloud.

Supports any valid Kubernetes container spec fields such as:

securityContext: Security settings for all containers
volumeMounts: Volume mounts to add to all containers
resources: Resource limits/requests for all containers
env: Environment variables for all containers

Merge behavior:

For nested objects (like securityContext): deep merge, container-specific values take precedence
For volumeMounts: concatenated, with defaults added first
For env: deduplicated by name — container-specific values always win over defaults on collision
Container-specific values always override defaults

Example configuration:

containerDefaultSpec: 
  securityContext: 
    allowPrivilegeEscalation: false
    capabilities: 
      drop: 
      - ALL
    readOnlyRootFilesystem: true
    seccompProfile: 
      type: RuntimeDefault
  volumeMounts: 
    - name: tmp
      mountPath: /tmp
  resources: 
    limits: 
      memory: "256Mi"

fileSidecar

Default

{
  "image": "busybox"
}

The configuration of the file sidecar container that handles the download and upload of files

Definitions

io.kestra.plugin.kubernetes.shared.models.SideCar

defaultSpecobject

Default spec for file transfer containers

Overrides containerDefaultSpec for the init and sidecar containers that move files. Accepts Pod container fields such as securityContext, volumeMounts, resources, and env; useful for hardening or adding mounts used only by file transfer helpers.

Example: fileSidecar: defaultSpec: securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true volumeMounts: - name: tmp mountPath: /tmp

imagestring

Defaultbusybox

Image for file sidecar

Container image used by the init container (uploads input files) and the sidecar (downloads output files). Defaults to busybox.

The image must provide, on its PATH: a POSIX shell (sh), test/[, and sleep — required by the polling script that waits for the transfer to complete before the container exits. find and wc are also used, on a best-effort basis, to verify that uploaded files were fully transferred; if they're missing, verification is skipped rather than failing the task.

resourcesobject

Configure sidecar resource requests/limits

Optional Kubernetes resources block applied to the file transfer sidecar.

inheritClusterConfig booleanstring

Defaultfalse

Inherit cluster auto-config

When true and a connection is set, the client config is seeded from the ambient auto-config (system properties, env, kubeconfig, in-cluster service account) before applying connection, so a partial connection (e.g. only a namespace) keeps the resolved credentials instead of starting blank. Default false.

inputFiles object

SubTypestring

The files to create on the local filesystem – it can be a map or a JSON object

The files will be available inside the kestra/working-dir directory of the container. You can use the special variable {{workingDir}} in your command to refer to it.

namespace string

Defaultdefault

The namespace where the operation will be done

The Kubernetes namespace in which to execute the operation. Defaults to 'default' if not specified.

outputFiles array

SubTypestring

The files from the container filesystem to send to Kestra's internal storage

Only files created inside the kestra/working-dir directory of the container can be retrieved. Must be a list of glob expressions relative to the current working directory, some examples: my-dir/**, my-dir/*/** or my-dir/my-file.txt..

pluginDefaultsRef string

Reference (ref) of the pluginDefaults to apply to this task.

waitRunning string

DefaultPT1H

Wait for pod completion

Maximum run time after reaching Running (defaults to PT1H). PodCreate fails and deletes the pod when exceeded.

waitUntilReady string

DefaultPT0S

The maximum duration to wait until the resource becomes ready

When set to a positive duration, waits for the resource to report Ready=True in its status conditions. Set to PT0S (zero, default) to skip waiting. Supports Pods, StatefulSets, and custom resources that use the Ready condition. Note: Deployments are not supported as they use the Available condition instead of Ready.

waitUntilRunning string

DefaultPT10M

Wait for pod to reach Running

Maximum time to reach Running (defaults to PT10M). Covers scheduling, image pulls, and startup. Used by PodCreate.