Kestra Plugin Set

Kestra Plugin Set

Certified

Create a role binding

Creates a role binding for a user or group. If a binding already exists (HTTP 409), the task returns the existing binding ID unless failIfExists is set to true.

yaml
type: io.kestra.plugin.kestra.ee.iam.bindings.Set

Bind a user to a role.

yaml
id: iam_binding_set
namespace: company.team

tasks:
  - id: create_binding
    type: io.kestra.plugin.kestra.ee.iam.bindings.Set
    subjectType: USER
    externalId: "user-external-id"
    roleId: "role-id"
    namespace: "company.team"
Properties

External ID of the user or group to bind

Role ID to assign

Possible Values
USERGROUPUNKNOWN_DEFAULT_OPEN_API

Binding subject type

Whether the binding applies to a USER or a GROUP.

Select API authentication

Use either an API token or HTTP Basic (username/password); do not provide both.

Definitions
apiTokenstring

API token for bearer auth

autobooleanstring
Defaulttrue

Automatically retrieve credentials from Kestra's configuration if available

The default configuration can be configured globally inside the Kestra configuration file:

  • Set kestra.tasks.sdk.authentication.api-token to use an API token
  • Set kestra.tasks.sdk.authentication.username and kestra.tasks.sdk.authentication.password for HTTP basic authentication
  • Set kestra.tasks.sdk.authentication.url to also default the Kestra API endpoint (see kestraUrl above) The Enterprise edition also provides setting a default configuration at the Namespace or Tenant level by an administrator. Set to false to also opt out of the default URL.
passwordstring

Password for HTTP Basic auth

usernamestring

Username for HTTP Basic auth

Defaultfalse

Fail if a binding already exists

When false (default), the task returns the existing binding ID on conflict. When true, a 409 conflict throws an exception.

Override Kestra API endpoint

URL used for calls to the Kestra API. When null, falls back to the url configured alongside the default SDK authentication (Namespace or Tenant level, Enterprise edition), then renders {{ kestra.url }} from configuration; if still empty, defaults to http://localhost: 8080. Trailing slashes are stripped before use.

Namespace scope for the binding

If omitted, the binding applies to the whole tenant.

Reference (ref) of the pluginDefaults to apply to this task.

Override target tenant

Tenant identifier applied to API calls; defaults to the current execution tenant.

ID of the created or existing binding

More Plugins in this Category

Core Plugins and tasks
Core Plugins and tasks

Tasks that provide Kestra's built-in orchestration, I/O, and observability capabilities.

Core

122 tasks

580 blueprints

Ruby
Ruby

Tasks that run Ruby scripts.

Core

4 tasks