What's New in Kestra 2.0

Table of Contents

For the complete documentation index, see llms.txt. For a full content snapshot, see llms-full.txt. Append .md to any kestra.io/docs/* URL for plain Markdown.

Kestra 2.0 is a major release introducing AI-native orchestration, redesigned governance, and significant infrastructure improvements.

For breaking changes and migration steps, see the 2.0 migration guide.

AI

Native AI capabilities built into the platform for flow authoring, agent orchestration, and external tool integration.

AI Copilot

The AI Copilot has been redesigned as a persistent sidebar with three modes:

Ask — answers questions about Kestra using docs-grounded responses
Edit — generates and iteratively refines flow YAML with a confirmation step before applying changes
Plan — proposes a step-by-step execution plan; each step requires individual approval

Context pills attach the resource you are viewing automatically. The Copilot reads Namespace metadata (Policies, Variables, Secrets, KV pairs) so it can reuse your configured credentials in suggestions.

AI Agents

AI Agents let you build agentic pipelines using LLM task orchestration within flows. Agents emit usage metrics so you can track token consumption per execution.

AI RAG Workflows

RAG Workflows provide native support for retrieval-augmented generation pipelines, including vector store integration and chunking tasks.

MCP Server and MCP Tool Trigger

The Kestra MCP server exposes flows as tools AI agents can call. The complementary MCP Tool Trigger lets flows be invoked directly by MCP-compatible agents. Agent Skills extend this with reusable tool definitions.

Workflow components

Updates to the core primitives used to build flows.

Loop task

The ForEach and ForEachItem tasks are replaced by a unified Loop task with a cleaner API and improved output expressions. See the migration guide for the mapping from old to new syntax.

Trigger conditions renamed to `when`

Trigger conditions blocks are now written as when. The trigger redesign migration guide covers the exact rename and any structural changes.

Reusable Inputs

Reusable Inputs (EE) let you define typed input schemas at namespace scope and reference them across multiple flows, eliminating repeated input definitions.

Quotas

Quotas cap how many executions can be created within a time window at flow, namespace, or tenant scope. Quota counters appear in the Quota Limits page immediately on flow creation.

`subflow()` Pebble function

The new subflow() Pebble function lets you invoke a subflow and retrieve its outputs inline within an expression, without a dedicated subflow task.

Draft flows

The flow editor now supports saving flows as drafts. Use Save as draft to stage changes without affecting running executions; any trigger or manual run continues to use the last published revision until you explicitly publish. This lets you iterate on a flow that is already in production without disrupting live executions. When you’re ready, click Publish in the run panel’s draft warning banner to make the draft active.

Execution labels from triggers

Triggers can now attach labels directly to the executions they create, making it easier to filter and group executions in dashboards.

Input enhancements

Inputs have two notable additions:

SELECT/MULTISELECT label/value pairs — each option can now be a {label, value} object. The UI shows the label; the expression {{ inputs.x }} resolves to the value. Useful for user-friendly dropdowns that map display names to IDs or codes.
JSON schema validation — a jsonSchema property accepts a JSON Schema Draft 2020-12 string. Kestra validates the input at execution creation time and rejects the execution before any task runs if the input is invalid.

Date helper functions

New Pebble date functions make schedule-based when conditions more expressive without string manipulation:

isWeekend() — true on Saturday and Sunday
isPublicHoliday(date, countryCode[, subDivision]) — checks against a country’s public holiday calendar
isDayWeekInMonth(date, dayOfWeek, position) — matches patterns like “second Tuesday of the month”
isLastWorkingDay(date) — true on the last working day of the month

Security

New controls for what flows can access and how they are governed.

HTTP task URL filtering

HTTP task filtering lets operators configure allow-lists and deny-lists for URLs reachable by HTTP plugin tasks, blocking access to metadata endpoints and internal services.

Enterprise

New capabilities available in Enterprise Edition.

RBAC: action-based permissions (EE)

The CRUD permission model (READ, CREATE, UPDATE, DELETE on generic resources) is replaced by a resource-plus-action model. Each resource exposes only the actions that make sense for it, for example EXECUTION: ACCESS_LOGS, EXECUTION: FOLLOW, and TRIGGER: BACKFILL. New resources in 2.0 include TRIGGER, SYSTEM_SETTINGS, TENANT_SETTINGS, COPILOT, and MCP_SERVER. Five managed roles ship with 2.0: Viewer, Launcher, Editor, Developer, and Admin. Existing custom roles and bindings migrate automatically on upgrade. See the RBAC reference and migration guide.

Instance Owner (formerly Super Admin)

The Super Admin privilege is renamed to Instance Owner. The privilege itself is unchanged. Instance Owners retain the same instance-wide authority over tenants, IAM, infrastructure, and governance. Deprecated aliases are retained for the CLI, config, and HTTP request bodies. HTTP API responses now emit instanceOwner instead of superAdmin.

Policies (EE)

Policies enforce governance rules on flows at save time and execution time. Rules can require specific task types, block others, or validate property values, applied per namespace.

Cases (EE)

Cases is a full incident management system built into Kestra. When an execution fails, it becomes an incident you can track without leaving the platform.

The CreateCase task opens a case automatically from your flow’s errors, finally, or afterExecution block. With linkMatchingExecutions: true, repeated failures of the same flow and task attach to the already-open case rather than creating a new one, keeping alert volume under control when a single outage generates dozens of executions. Cases track severity, status (Open, Acknowledged, Investigating, Resolved), SLA targets with live countdowns, assignees and watchers, linked executions and assets, and one-click remediation actions. A kanban board and list view surface all open incidents across the tenant.

Promote (EE)

Promote copies a flow from one Kestra instance to another directly from the UI, with no Git pipeline required.

From the Promote tab on any flow, select a target environment, review a source-to-target diff, and confirm. A Deploy column in the flows list shows the drift state of every flow (IN_SYNC, OUT_OF_SYNC, NOT_PROMOTED) so you can see at a glance what needs to be deployed. Production targets can require an explicit confirmation gate before any promotion lands. Promotion history is recorded per flow and surfaced in the audit log.

Promote is the right path for teams that author flows in the Kestra UI and run separate instances per environment but do not want to maintain a CI/CD pipeline. Teams already using Git as the source of truth should continue with Git-based deployment.

Custom Blueprints (EE)

Custom Blueprints let you publish Pebble-templated flow skeletons to your organization’s Blueprint library. Each blueprint defines form fields using standard input types; when a user instantiates it, Kestra renders the template into a ready-to-use flow. Useful for standardizing common flow patterns across teams.

Developer experience

Improvements to the tools and workflows used to build and manage flows.

VS Code extension: Namespace files

The VS Code extension now supports three namespace file commands: Open namespace (mounts a namespace as a live folder), Upload file to namespace, and Sync folder to namespace. The kestra.namespaceFiles.exclude setting controls which files are skipped during upload and sync.

Plugin file renderers

Plugin file renderers allow plugins to register custom renderers so task output files are previewed inline in the Kestra UI with format-specific rendering.

Dynamic Apps content blocks

Apps support dynamic content blocks that update based on execution state, enabling richer interactive UIs built on flow outputs.

No-code Editor

The No-code editor is a visual flow builder that sits alongside the YAML editor. Each flow section (Triggers, Tasks, Errors, Finally, After Execution) renders as a list of blocks. Clicking a block opens a side panel with a Form tab (guided fields with inline documentation) and a Source tab (raw YAML for that block). The left panel lists every upstream task output and execution context variable available at that point in the flow.

All three views (YAML editor, No-code editor, and AI Copilot) stay in sync. Changes made in any view reflect immediately in the others.

A new FORM input type groups related inputs into a labeled multi-step wizard in the Execute modal.

`kestractl` IAM commands

The kestractl CLI now supports IAM management: roles, role bindings, service accounts, and invitations. See the kestractl reference.

Plugin Artifacts

Plugins can ship Vue.js frontend components that load into the Kestra UI at runtime without changes to the core application. Components target named slots in the execution topology view, task side drawer, or task detail modal. They are compiled as Module Federation micro-frontends using @kestra-io/artifact-sdk and bundled into the plugin JAR. See the plugin artifact developer guide.

Infrastructure

Changes to deployment, storage, and runtime behavior.

New VM task runners

Four new task runners ship in 2.0 for workloads that require direct VM control:

AWS EC2 Task Runner — runs commands on EC2 via AWS Systems Manager Run Command; no SSH required. Supports Spot instances and reattaches mid-run if the Kestra Worker restarts.
Azure Virtual Machine Task Runner — runs commands on Azure VMs via the Azure Run Command API; no SSH and no public IP required.
Google Compute Engine Task Runner — runs commands directly on a Compute Engine VM as a startup script; no SSH or IAP tunnel.
Huawei Cloud CCI Task Runner (EE) — runs tasks as bare Pods on Huawei Cloud CCI with OBS file staging, flavor-tier resource sizing, and AK/SK or temporary credential authentication.

Worker Groups 2.0 (EE)

Worker Groups 2.0 separates three concerns the previous model conflated: Workers (compute units), Worker Groups (pools of workers), and Worker Queues (tag-based routing lanes).

Tasks declare routing requirements with workerSelector.tags instead of the removed workerGroup.key:

match: ALL requires all tags to be present; match: ANY requires at least one
fallback controls behavior when a matching queue exists but has no live workers: FAIL (new default), WAIT, CANCEL, or IGNORE

Capacity reservation: each Worker Group subscription supports a reservedPercent floor on its thread pool. Two modes control idle slot behavior: STRICT keeps reserved capacity exclusive; ELASTIC lends idle slots to other queues and reclaims them on demand. Reservations update live without restarting workers.

Worker authentication: workers authenticate via JWT. A registration token is created in the UI or via kestractl; the worker exchanges it on first connect for a short-lived access token and rotating refresh token. Revoking a token cuts off that worker at the next refresh.

Declarative topology bootstrap: kestra.ee.setup in application.yml lets you declare the full topology (queues, groups, subscriptions, registration tokens) at startup. Provisioning uses create-if-not-exists semantics, so restarts are safe and the database remains the source of truth once an entity exists.

See the Worker Groups reference and migration guide.

External Log Data Store (EE)

External Log Data Store routes execution logs to a dedicated JDBC database or Elasticsearch, separate from the main backend, to reduce database size and speed up migrations.

ION output files are binary

Task output files in ION format are now stored as binary ION rather than text. Existing text ION files remain readable. See the migration guide.

Architecture: gRPC worker-controller

The JDBC queue that handled all worker communication in 1.x is replaced by a gRPC-based controller. Workers connect to the controller over gRPC instead of directly to the database, which separates the control plane (executor, scheduler, webserver) from the data plane (workers). Workers are independently deployable across regions, inside restricted networks, or within infrastructure you control.

This also enables a leaner execution context: task run outputs are stored in dedicated storage rather than inline in the execution record, reducing database size and improving execution list load time on large instances.

See the Architecture page for the current model.

PurgeStorage

PurgeStorage walks the internal storage tree and deletes files based on last-modified date, regardless of whether a matching execution record exists. This fills a gap left by PurgeExecutions, which is database-driven and cannot clean files whose execution records are already gone. The task defaults to dryRun: true. Use workerSelector.tags to target a specific worker group’s isolated storage.

Slim image and plugin auto-install

The kestra/kestra:*-slim image ships without bundled plugins. Set KESTRA_PLUGINS_AUTO_INSTALL_ENABLED=true to have Kestra fetch plugins from Maven Central before execution and cache them for subsequent runs. The suffix was renamed from -no-plugins to -slim in 2.0. See the Docker installation guide.

Breaking changes summary

All breaking changes have migration guides:

Change	Guide
`pluginDefaults` removed	Guide
`pluginDefaults.forced` removed from flows	Guide
`ForEach` / `ForEachItem` → `Loop`	Guide
Trigger `conditions` → `when`	Guide
RBAC action model	Guide
Execution API response shape	Guide
ION binary output format	Guide
`json()` function removed	Guide
`local.Delete` recursive default changed	Guide
Helm gRPC worker-controller changes	Guide
Database migrations (EE)	Guide
`execution-data.internal-storage` config removed (EE)	Guide
Super Admin renamed to Instance Owner (EE, Cloud)	Guide
SDK auth required for internal tasks	Guide
`workerGroup.key` removed	Guide
Management endpoint hardening	Guide
`condition` → `when` on flow checks	Guide
`CANCELED` enum alias removed	Replace with `CANCELLED` in expressions, API consumers, and tooling
Four core tasks removed	`Count`, `Resume`, `trigger.Toggle`, `log.Fetch`: use `plugin-kestra` equivalents
Terraform provider `~> 2.0`	Guide

Build with Kestra

Was this page helpful?