System flow blueprints fail validation on Kestra 2.0 (removed trigger conditions, forced pluginDefaults, expiredOnly, ForEach) #246

Summary

Deploying the 22 system namespace blueprints to a Kestra EE v2.0.0-rc1 instance (kestractl flows validate / flows deploy) fails for 15 of 22 flows. Kestra 2.0 removed several deprecated constructs that these blueprints still use.

Validation errors

1. conditions removed from io.kestra.plugin.core.trigger.Flow (11 flows)

Unrecognized field "conditions" (class io.kestra.plugin.core.trigger.Flow) — the v2 trigger now uses states, when, dependsOn, window, mode, minSatisfied.

Affected: create-hubspot-ticket-on-failure, create-linear-issue-on-failure, failure-alert-discord, failure-alert-email, failure-alert-gmail, failure-alert-sentry, failure-alert-sentry-1, failure-alert-slack, failure-alert-teams, failure-alert-zenduty, zenduty-failure-alert

2. forced removed from pluginDefaults (2 flows)

Unrecognized field "forced" (class io.kestra.core.models.flows.FlowPluginDefault) — only type and values remain.

Affected: copy-flows-to-new-tenant, k8s-namespace-logs-and-events

3. expiredOnly removed from io.kestra.plugin.core.kv.PurgeKV (1 flow)

Replaced by the behavior object (type: key / type: version).

Affected: kv-store-purge

4. io.kestra.plugin.core.flow.ForEach removed (1 flow)

Invalid type: io.kestra.plugin.core.flow.ForEach — replaced by io.kestra.plugin.core.flow.Loop (same values / concurrencyLimit properties).

Affected: k8s-namespace-logs-and-events

Validation warnings

• Plain-text secret properties (new v2 warning): username in push-to-git, sync-from-git, failure-alert-email; apiKey in create-hubspot-ticket-on-failure; token in create-linear-issue-on-failure — should use {{ secret('...') }}.
• This flow will be triggered for EVERY execution of EVERY flow on your instance on the 7 unscoped failure-alert blueprints — expected for instance-wide alerting patterns, kept as-is (the trigger now recommends dependsOn scoping).

Note for the core team

The canonical v2 replacement for prefix-based namespace alert scoping (official Flow trigger example #3 in core) is when: "{{ flow.namespace | startsWith('company') }}". Reading the rc1 sources, the trigger-level when is rendered with a RunContext built from of(null, execution), which doesn't expose a flow variable (and Pebble is strict) — worth verifying that this documented pattern actually fires at runtime; if not it's a core bug affecting the example docs too.

Repro

kestractl flows validate <dir-with-system-flows>   # against a 2.0.0-rc1 instance

All 22 flows validate and deploy cleanly after the fixes in the linked PR (validated + deployed on EE v2.0.0-rc1).