µTask is an automation engine built for the cloud. It is:

• simple to operate: only a Postgres DB is required
• secure: all data is encrypted, only visible to authorized users
• extensible: you can develop custom actions in golang

µTask allows you to model business processes in a declarative YAML format. Describe a set of inputs and a graph of actions and their inter-dependencies: µTask will asynchronously handle the execution of each action, working its way around transient errors and keeping an encrypted, auditable trace of all intermediary states until completion.

Real-world examples

Here are a few real-world examples that can be implemented with µTask:

Kubernetes ingress TLS certificate provisioning

A new ingress is created on the production Kubernetes cluster. A hook triggers a µTask template that:

• generates a private key
• requests a new certificate
• meets the certificate issuer’s challenges
• commits the resulting certificate back to the cluster

New team member bootstrap

A new member joins the team. The team leader starts a task specifying the new member’s name, that:

• asks the new team member to generate an SSH key pair and copy the public key in a µTask-generated form
• registers the public SSH key centrally
• creates accounts on internal services (code repository, CI/CD, internal PaaS, …) for the new team member
• triggers another task to spawn a development VM
• sends a welcome email full of GIFs

Payments API asynchronous processing

The payments API receives a request that requires an asynchronous antifraud check. It spawns a task on its companion µTask instance that:

• calls a first risk-assessing API, which returns a number
• if the risk is low, the task succeeds immediately
• otherwise, it calls a SaaS antifraud solution API which returns a score
• if the score is good, the task succeeds
• if the score is very bad, the task fails
• if it is in between, it triggers a human investigation step where an operator can enter a score in a µTask-generated form
• when it is done, the task sends an event to the payments API to notify of the result

The payments API references the running workflow via its task ID. Operators of the payments API can follow the state of current tasks by requesting the µTask instance directly. Depending on the payments API implementation, it may allow its callers to follow a task’s state.

Quick start

Running with docker-compose

Download our latest install script, setup your environment and launch your own local instance of µTask.

mkdir utask && cd utask
wget https://github.com/ovh/utask/releases/latest/download/install-utask.sh
sh install-utask.sh
docker-compose up

All the configuration for the application is found in the environment variables in docker-compose.yaml. You’ll see that basic auth is setup for user admin with password 1234. Try logging in with this user on the graphical dashboard: http://localhost:8081/ui/dashboard.

You can also explore the API schema: http://localhost:8081/unsecured/spec.json.

Request a new task: 

Get an overview of all tasks: 

Get a detailed view of a running task: 

Browse available task templates: 

Running with your own postgres service

Alternatively, you can clone this repository and build the µTask binary:

make all

Operating in production

The folder you created in the previous step will become a git repo where you version your own task templates and plugins. Re-download and run the latest install script to bump your version of µTask.

You’ll deploy your version of µTask by building a docker image based on the official µTask image, including your extensions. See the Dockerfile generated during installation.

Architecture

µTask is designed to run a task scheduler and perform the task workloads within a single runtime: work is not delegated to external agents. Multiple instances of the application will coordinate around a single Postgres database: each will be able to determine independently which tasks are available. When an instance of µTask decides to execute a task, it will take hold of that task to avoid collisions, then release it at the end of an execution cycle.

A task will keep running as long as its steps are successfully executed. If a task’s execution is interrupted before completion, it will become available to be re-collected by one of the active instances of µTask. That means that execution might start in one instance and resume on a different one.

Maintenance procedures

Key rotation

1. Generate a new key with symmecrypt, with the ‘storage’ label.
2. Add it to your configuration items. The library will consider all keys and use the latest possible key, falling back to older keys when finding older data.
3. Set your API in maintenance mode (env var or command line arg, see config below): all write actions will be refused when you reboot the API.
4. Reboot API.
5. Make a POST request on the /key-rotate endpoint of the API.
6. All data will be encrypted with the latest key, you can delete older keys.
7. De-activate maintenance mode.
8. Reboot API.

Dependencies

The only dependency for µTask is a Postgres database server. The minimum version for the Postgres database is 9.5

Configuration