In partnership with
TechOps Examples
Hey — It's Govardhana MK 👋
Welcome to another technical edition.
Every Tuesday – You’ll receive a free edition with a byte-size use case, remote job opportunities, top news, tools, and articles.
Every Thursday and Saturday – You’ll receive a special edition with a deep dive use case, remote job opportunities and articles.
👋 👋 A big thank you to today's sponsor TLDR AI
The AI brief curated by Anthropic and ex-Google engineers
Thousands of AI papers, model releases, and product launches ship every week. You don't need all of them. You need the ten that matter.
TLDR AI is the free daily newsletter curated by Anthropic and ex-Google engineers. People who build AI for a living read everything, then send you what's actually worth your time: the models, research, and tools that will still matter next month.
No hot takes, no hype cycles, no 60-tweet threads. Clear summaries you can read between meetings.
Join 1.1M+ readers. Subscribe for free.
IN TODAY'S EDITION
🧠 Use Case
Kestra - Open Source Orchestration for DevOps and AI Workflows
👀 Remote Jobs
Chess.com is hiring a Site Reliability Engineer
Remote Location: Worldwide
Buffer is hiring a Senior Infrastructure Engineer
Remote Location: Worldwide
📚 Resources
🧠 USE CASE
Kestra - Open Source Orchestration for DevOps and AI Workflows
For years our container release process looked like most DevOps stacks I've seen: GitHub Actions or GitLab CI runs aws ecr get-login-password, pipes it into docker login, builds the image, tags it, then pushes, all wired together as separate CI steps with no shared execution history. It works, until the login token expires mid build, or someone hardcodes a long lived registry password into a CI variable because rotating it properly is a chore nobody has time for. Nobody owns the whole chain end to end, it's just a pipeline config that either works or breaks silently.
It's the exact problem I went looking to fix, and it's why I spent the last couple of weeks with Kestra 2.0.
What is Kestra?
Kestra is an open-source, event-driven orchestration platform for data, AI, and infrastructure workflows, self-hosted on Docker or Kubernetes, free forever on the core engine. Instead of stitching cron jobs, CI steps, and shell scripts together by hand, you write the workflow itself declaratively in YAML, tasks, triggers, retries, error handling, all version-controlled in Git like any other code. It plugs into your existing stack through 1900+ plugins, Terraform, Ansible, ServiceNow, Docker, Kubernetes, AWS, GCP, Azure, and pretty much any API, so it sits on top of the tools you already run rather than replacing them.
Here's the same release process as one declarative, auditable Kestra flow, using a short lived ECR token instead of a static password:
id: build-aws-ecr-image
namespace: company.team
tasks:
- id: fetch_auth_token
type: io.kestra.plugin.aws.ecr.GetAuthToken
accessKeyId: "{{ secret('AWS_ACCESS_KEY_ID') }}"
secretKeyId: "{{ secret('AWS_SECRET_ACCESS_KEY') }}"
region: "{{ secret('AWS_DEFAULT_REGION') }}"
- id: build
type: io.kestra.plugin.docker.Build
dockerfile: |
FROM python:3.10
RUN pip install --upgrade pip
RUN pip install --no-cache-dir kestra requests "polars[all]"
tags:
- 123456789.dkr.ecr.eu-central-1.amazonaws.com/data-infrastructure:latest
push: true
credentials:
username: AWS
password: "{{ outputs.fetch_auth_token.token }}"fetch_auth_token mints a fresh ECR authorization token straight from the AWS API, and build pipes that token directly into the push, {{ outputs.fetch_auth_token.token }}, so there's no static Docker credential sitting in a secrets manager waiting to go stale. Authenticate, build, tag, and push are four lines of intent living in one execution, instead of scattered across separate CI steps with their own retry logic and their own logs. This exact flow is one of 690+ ready-to-clone flows in Kestra's blueprint library, more on that further down.
Agentic workflows are the part I'd actually watch
If a flow has more than one AI agent task, you don't want to paste the same provider block and API key reference into every single one. Kestra handles that with pluginDefaults, set the provider, model, and logging once at the flow level, and every AIAgent task inherits it unless it explicitly overrides:
pluginDefaults:
- type: io.kestra.plugin.ai.agent.AIAgent
values:
provider:
type: io.kestra.plugin.ai.provider.GoogleGemini
modelName: gemini-2.5-flash
apiKey: "{{ secret('GEMINI_API_KEY') }}"
configuration:
logRequests: true
logResponses: true
responseFormat:
type: TEXTThat's the same instinct DevOps teams already apply everywhere else, define once, inherit everywhere, keep the secret reference in one place instead of five. logRequests and logResponses matter more than they look here: they give you an audit trail of every prompt and response an agent sent, which is the first thing anyone reviewing an agent-touched pipeline is going to ask for. Swap GoogleGemini for OpenAI, Anthropic, or a self-hosted model and the block stays the same, and the agent plugin namespace itself (io.kestra.plugin.ai.*) runs entirely on the open-source core, not gated behind Enterprise. Flows built this way can also be exposed as MCP tools, callable from Claude, Cursor, or any MCP client, so the same governed defaults apply whether a human or an agent triggers the run. One honest caveat: RBAC scoping and cross-team audit-log visibility on top of this is an Enterprise Edition feature, the provider config and logging above run entirely on the open-source core.
What’s new in Kestra 2.0?
Kestra 2.0 brings a rebuilt execution engine, faster performance, stateless workers, a redesigned UI, and MCP support while remaining open source. Explore the Kestra GitHub repository
Where the blueprints actually save you time
This is the part I'd lean on hardest if you're trying Kestra for the first time. The blueprint library has 690+ ready flows, and for infra work:
Build and Push Docker Images to AWS ECR, the one above.
Cross Stack Pipeline with Terraform, Ansible, and Jenkins, provision, configure, test, and report across three tools in one execution.
Kubernetes Pod Lifecycle Management, create, inspect, and clean up a pod with kubectl, one flow.
Kubernetes Deployment Restart Remediation from Alerts, webhook-triggered restart with namespace allowlist guardrails and Slack alerts, built by their own customer success team off a real support case.
If you only try one thing from this piece, clone a Blueprint that matches a flow you already run by hand, point it at your stack, and see what breaks. That's a more honest test than any demo video.
Try it yourself
Pull the latest build straight from Docker Hub or grab a release candidate off GitHub, the repo's sitting at 27k stars and the READMe has a docker run one-liner that gets you a UI in minutes. Watch the Kestra 2.0 announcement video to see what is new in the release.
🔴 Get my DevOps & Kubernetes ebooks! (free for Premium Club and Personal Tier newsletter subscribers)
Looking to promote your company, product, service, or event to 50,000+ DevOps and Cloud Professionals? Let's work together.
