{
 "slug": "kestra",
 "name": "Kestra",
 "tagline": "Event-driven workflow orchestration with declarative YAML flows and hundreds of plugins",
 "category": "workflow-cicd",
 "use_cases": [
  "workflow-orchestration",
  "data-pipelines",
  "scheduling"
 ],
 "aliases": [],
 "status": "live",
 "upstream": {
  "vendor": "Kestra",
  "url": "https://kestra.io",
  "license": "Apache-2.0",
  "license_url": "https://github.com/kestra-io/kestra/blob/master/LICENSE"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   80,
   443
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "restricted",
   "restricted_on": "2026-08-24"
  },
  "azure": {
   "status": "live",
   "version": "1.3.37",
   "last_build": "2026-09-06",
   "offer_id": "kestra",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:kestra:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.kestra?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/kestra/",
  "json": "https://lynxroute.com/products/kestra/product.json"
 },
 "release_notes": [
  {
   "version": "1.3.30",
   "title": "Kestra 1.3.30",
   "notes": "* Kestra 1.3.30 on Ubuntu 24.04 LTS - maintenance release (patch from 1.3.26) rolling up bugfixes: non-terminated task runs now count against Parallel/Dag concurrency limits, asset IDs accept a colon so CRN-format identifiers work, and null input is guarded in the startsWith/endsWith Pebble filters\n* Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "azure": "2026-08-19"
   }
  },
  {
   "version": "1.3.26",
   "title": "Kestra 1.3.26",
   "notes": "* Kestra 1.3.24 on Ubuntu 24.04 LTS - maintenance release (patch from 1.3.22) with bugfixes and security hardening: bcrypt BasicAuth password storage, read-only KVSTORE access controls, a new FORM input wizard, and SSE/Prometheus metrics improvements\n* Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-git",
   "live": {
    "azure": "2026-07-13"
   }
  },
  {
   "version": "1.3.24",
   "title": "Kestra 1.3.24",
   "notes": "* Kestra 1.3.24 on Ubuntu 24.04 LTS - maintenance release (patch from 1.3.22) with bugfixes and security hardening: bcrypt BasicAuth password storage, read-only KVSTORE access controls, a new FORM input wizard, and SSE/Prometheus metrics improvements\n* Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-git",
   "live": {}
  },
  {
   "version": "1.3.22",
   "title": "Kestra 1.3.22 - June 2026",
   "notes": "* Kestra 1.3.22 on Ubuntu 24.04 LTS\n* Certbot pre-installed for one-command trusted HTTPS\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "azure": "2026-06-21"
   }
  },
  {
   "version": "1.3.21",
   "title": "Kestra 1.3.21 - June 2026",
   "notes": "* Kestra 1.3.21 on Ubuntu 24.04 LTS\n* Security: authentication-bypass fix in the authentication filter and path-traversal fixes for namespace files\n* Pebble templating engine updated to 4.1.2\n* Bug fixes - execution/loop and task-runner\n",
   "source": "backfill-aws-listing",
   "live": {
    "azure": "2026-06-07"
   }
  },
  {
   "version": "1.3.19",
   "title": "Kestra 1.3.19 - May 2026",
   "notes": "* Kestra 1.3.19 on Ubuntu 24.04 LTS\n* Security release - prevents path traversal in inputFiles filename resolution (#16143)\n* New: InputStream/OutputStream-based methods to FileSerde\n* Bug fixes - replay to different revision, flaky WorkerTest and liveness coordinator\n",
   "source": "backfill-aws-listing",
   "live": {}
  },
  {
   "version": "1.3.16",
   "title": "Kestra 1.3.16 - Initial release (May 2026)",
   "notes": "* Kestra 1.3.16 on Ubuntu 24.04 LTS (docker-compose stack: kestra/kestra + postgres:16-alpine)\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* Per-instance Kestra admin credential with a policy-compliant random password generated at first launch\n* Kestra REST API and UI bound to 127.0.0.1:8080 - reachable only through nginx with TLS\n* PostgreSQL 16 reachable only on the Docker bridge with per-instance generated password\n* Nginx reverse proxy with TLS termination, WebSocket support for live execution log streaming\n* UFW firewall pre-configured (TCP 22, 80, 443 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {}
  }
 ],
 "release_history": [
  {
   "version": "1.3.37",
   "azure": "2026-09-06"
  },
  {
   "version": "1.3.30",
   "azure": "2026-08-19"
  },
  {
   "version": "1.3.26",
   "azure": "2026-07-13"
  },
  {
   "version": "1.3.22",
   "azure": "2026-06-21"
  },
  {
   "version": "1.3.21",
   "azure": "2026-06-07"
  }
 ],
 "deploy": {
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer kestra --plan payg-gen2\naz vm create -g my-rg -n kestra --size Standard_D2s_v3 \\\n  --image lynxroute:kestra:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "Kestra is an open-source, event-driven workflow orchestration and scheduling platform built on the Java Virtual Machine (Eclipse Temurin 21) with a JDBC-backed Postgres state store. Workflows are authored as declarative YAML \"flows\" with a 600+ plugin catalog covering S3, GCS, Azure Blob, BigQuery, Snowflake, dbt, Airbyte, Kubernetes, Slack, GitHub, Postgres, MySQL, and dozens more. Core features include scheduled and event-driven triggers, dynamic tasks, namespaces with isolated secrets, a visual flow editor with execution graph and Gantt views, runtime expressions via the Pebble template engine, retries with backoff, conditional and parallel branching, and a REST API for headless control. Persists flow definitions, execution history, queue state, and blob metadata in PostgreSQL. Apache-2.0 license, no vendor lock-in. Positioned as a self-hosted alternative to Airflow, Prefect Cloud, and Temporal Cloud - the entire orchestration plane (scheduler, executor, UI, queue, history) runs in your own AWS account; no executions, no secrets, and no metadata leave your VPC.",
  "image_adds": "Security hardening:\n* Per-instance Kestra admin credential with a policy-compliant random password generated at first launch - never baked into the image\n* Kestra REST API and UI bound to 127.0.0.1:8080 - reachable only through the nginx reverse proxy with TLS\n* PostgreSQL 16 reachable only on the Docker bridge network (no host-port published) - database password generated per instance, the upstream demo password `k3str4` never ships in this image\n* Nginx reverse proxy with TLS termination, WebSocket support for live execution log streaming, HTTP-to-HTTPS redirect, security headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy)\n* UFW firewall pre-configured - only TCP 22, 80, 443 are exposed\n* fail2ban, AppArmor\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening, kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
 },
 "generated_at": "2026-10-31T09:36:34Z"
}