Changelog
For the complete documentation index, see llms.txt. For a full content snapshot, see llms-full.txt. Append .md to any kestra.io/docs/* URL for plain Markdown.

Notable changes by release. For a complete list of every release including patch versions, see the full changelog or the GitHub releases.

2.0.0

A major release introducing AI-native orchestration, a redesigned trigger model, new enterprise governance features, and significant infrastructure improvements.

AI

  • AI Copilot redesign — persistent sidebar with Ask, Edit, and Plan modes; context pills; reads namespace metadata for credential-aware suggestions. Docs
  • AI Agents — build agentic pipelines with LLM task orchestration; token usage metrics per execution. Docs
  • AI RAG Workflows — native retrieval-augmented generation support with vector store integration. Docs
  • MCP Server — expose flows as MCP tools; connect from Claude Desktop, Claude Code, Cursor, and Codex. Docs
  • MCP Tool Trigger — invoke flows directly from MCP-compatible agents. Docs

Workflow components

Core primitives for building flows have been updated and extended.

  • Loop task — unified replacement for ForEach and ForEachItem with cleaner expressions and output handling. Migration guide
  • Trigger when — trigger conditions renamed to when Pebble expression across all trigger types. Migration guide
  • Reusable Inputs (EE) — define typed input schemas at namespace scope and reference them across flows. Docs
  • Quotas — cap executions per time window at flow, namespace, or tenant scope. Docs
  • subflow() Pebble function — invoke a subflow and retrieve its outputs inline in an expression. Docs
  • Draft flows — save flows as drafts to stage changes without affecting running executions; triggers and manual runs continue using the last published revision until you publish. Docs
  • Execution labels from triggers — triggers can attach labels to the executions they create. Docs
  • Input enhancements — SELECT/MULTISELECT support {label, value} pairs; JSON inputs accept jsonSchema for pre-execution validation. Docs
  • Date helper functions — new Pebble functions for schedule logic: isWeekend(), isPublicHoliday(), isDayWeekInMonth(), isLastWorkingDay(). Docs

Security

New controls for locking down what flows can do and how they are governed.

  • RBAC action model (EE) — CRUD replaced by resource-plus-action permissions (EXECUTION: ACCESS_LOGS, TRIGGER: BACKFILL, etc.). New resources: TRIGGER, SYSTEM_SETTINGS, TENANT_SETTINGS, COPILOT, MCP_SERVER. Five managed roles ship with 2.0; existing roles migrate automatically. Docs Migration guide
  • Policies (EE) — enforce governance rules on flows at save and execution time, per namespace. Docs
  • Management endpoint hardening — /env disabled by default, health details require authentication, logger writes protected, /worker and /scheduler now sensitive, docker-compose no longer exposes port 8081. Migration guide
  • HTTP task URL filtering — allow-list and deny-list for URLs reachable by HTTP plugin tasks. Docs
  • ZIP bomb protection — opt-in protection on flow import and namespace file upload via kestra.security.zip-bomb-protection. Docs
  • Multi-field secrets — secrets can now store structured objects with multiple fields, not just single string values.
  • Instance Owner (formerly Super Admin) — the Super Admin privilege is renamed to Instance Owner across the UI, CLI, config, and API. Deprecated aliases are retained; HTTP API responses emit instanceOwner instead of superAdmin. Migration guide

Enterprise

New features available in the Enterprise Edition.

  • Cases — track and resolve execution failures as incidents with automatic creation, deduplication, SLA targets, and a kanban board. Docs
  • Promote — copy flows between Kestra instances from the UI with a diff review, optional confirmation gate, drift detection across the flows list, and full promotion history. No Git pipeline required. Docs
  • Custom Blueprints — Pebble-templated flow skeletons with form fields, published to your organization’s Blueprint library. Docs

Developer experience

Improvements to the tools and workflows used to build and manage flows.

  • No-code Editor — canvas-based flow editor alongside the YAML editor; Form and Source tabs per block; upstream output browser in the form panel; synced with the AI Copilot in real time. New FORM input type groups inputs into a multi-step wizard. Docs
  • VS Code namespace files — Open namespace (VFS mount), Upload file, and Sync folder commands; kestra.namespaceFiles.exclude setting. Docs
  • Plugin Artifacts — plugins can ship Vue.js frontend components (Module Federation) that load into named slots in the execution topology view, task side drawer, or task detail modal without changes to the core application. Docs
  • Plugin file renderers — plugins can register format-specific renderers for inline output file preview. Docs
  • Dynamic Apps content blocks — Apps support content blocks that update based on execution state. Docs
  • kestractl IAM commands — roles, role bindings, service accounts, and invitations via CLI. Docs

Infrastructure

Changes to deployment, storage, and runtime behavior.

  • gRPC worker-controller — JDBC queue replaced by gRPC; separates control plane (executor, scheduler, webserver) from data plane (workers). Workers connect to the controller rather than the database directly, enabling cross-region and restricted-network deployments. Task run outputs stored in dedicated storage rather than inline in the execution record.
  • New VM task runners — AWS EC2 (SSM Run Command, no SSH, Spot support), Azure Virtual Machine (Run Command API, no SSH or public IP), Google Compute Engine (startup script, no SSH), Huawei Cloud CCI (bare Pods, OBS staging, AK/SK or temp credentials). Docs
  • Worker Groups 2.0 (EE) — tag-based routing via workerSelector.tags replaces workerGroup.key; Worker Queues as routing lanes; per-subscription capacity reservation (STRICT/ELASTIC modes); JWT worker authentication; declarative topology bootstrap via kestra.ee.setup. Docs
  • PurgeStorage — storage-driven file cleanup by last-modified date, independent of execution records. Defaults to dryRun: true. Docs
  • Slim image + plugin auto-install — kestra/kestra:*-slim ships without bundled plugins; set KESTRA_PLUGINS_AUTO_INSTALL_ENABLED=true to auto-fetch from Maven Central. Renamed from -no-plugins. Docs
  • External Log Data Store (EE) — route execution logs to a separate JDBC database or Elasticsearch, keeping the main database lean and reducing schema migration time. Docs
  • ION binary format — task output files in ION format stored as binary (~20–40% smaller). Migration guide

Additional

  • Execution API performance — task run outputs moved to dedicated storage; GET /executions/search responses are significantly lighter. Integrations reading taskRunList[*].outputs should switch to GET /outputs/{executionId}/{taskRunId}. Migration guide
  • TRACEPARENT propagation — pass {{ trace.parent }} as the TRACEPARENT environment variable in script tasks to parent OpenTelemetry spans under the Kestra task span.
  • mTLS on the worker channel — worker-to-controller communication supports mutual TLS with per-worker client certificates. Docs
  • Syslog CEF log exporter (EE) — Log Shipper and Audit Log Shipper gain a Syslog CEF destination over TCP, UDP, or TLS for SIEM integration.
  • LDAP group-sync-only mode (EE) — mode: GROUP_SYNC_ONLY uses LDAP exclusively for group membership resolution while keeping an existing SSO provider for login. Docs
  • Unit test expectedState — flow unit tests can assert that a test case ends in FAILED, WARNING, or KILLED. Docs

Breaking changes

Each breaking change has a dedicated migration guide. See the 2.0 migration guide for the full overview.

ChangeGuide
pluginDefaults removedGuide
pluginDefaults.forced removed from flowsGuide
ForEach / ForEachItem → LoopGuide
Trigger conditions → whenGuide
RBAC action modelGuide
Execution API response shapeGuide
ION binary output formatGuide
json() function removedGuide
local.Delete recursive default changedGuide
Helm gRPC worker-controller changesGuide
Management endpoint hardeningGuide
Database migrations (EE)Guide
execution-data.internal-storage config removed (EE)Guide
Super Admin renamed to Instance Owner (EE, Cloud)Guide
SDK auth required for internal tasksGuide
workerGroup.key removedMigrate to workerSelector.tags. Check fallback default change (WAIT → FAIL). Guide
condition → when on flow checksGuide
CANCELED enum alias removedReplace with CANCELLED in flow expressions, API consumers, and tooling.
Four core tasks removedio.kestra.plugin.core.execution.Count, Resume, trigger.Toggle, log.Fetch — replace with equivalents in plugin-kestra.
Terraform provider ~> 2.0Guide

Was this page helpful?