General: Add cooldownPeriod and pollingInterval checks for ScaledObject (#7271)
General: Add CRD-level validation markers (Minimum, MinLength, MinItems, Enum) for ScaledObject, ScaledJob, ScaleTriggers, and TriggerAuthentication API types (#7533)
General: Add --leader-election-id flag to allow configuring the leader election Lease name (#7564)
General: Add scaler HTTP request metrics (keda_scaler_http_requests_total, keda_scaler_http_request_duration_seconds) for outbound HTTP requests made during scaler metric collection (#6600)
General: Allow more control of TLS versions & ciphers via KEDA_HTTP_TLS_CIPHER_LIST, KEDA_SERVICE_TLS_CIPHER_LIST and KEDA_SERVICE_MIN_TLS_VERSION env vars (#7617)
General: Cap each scalers-cache reader at a per-reader budget derived from globalHTTPTimeout so ScalersCache.Close cannot block indefinitely (#7574)
General: Make APIService cert injections optional (#7559)
General: Remove unconditional json.MarshalIndent calls from admission webhook validation hot paths; replace spec-comparison MarshalIndent-and-string-compare in isRemovingFinalizer variants with reflect.DeepEqual. Prevents webhook OOM under sustained admission load at large scale (observed at ~60k ScaledObjects) (#7670)
AWS Scalers: Add support for AWS External ID in TriggerAuthentication podIdentity for all AWS scalers (SQS, Kinesis, DynamoDB, CloudWatch, etc.) to enable cross-account access scenarios (#6921)
Elasticsearch Scaler: Add HTTP status check for Elasticsearch errors (#7480)
Github Runner Scaler: Handle rate limit errors by respecting X-RateLimit-Reset and Retry-After headers and returning cached queue length (#7683)
Kubernetes Workload Scaler: Add groupByNode parameter (#7628)
Metrics API Scaler: Add custom HTTP client timeout (#7549)
MSSQL Scaler: Add Azure Workload Identity support for Azure SQL authentication (#6104)
Prometheus Scaler: Emit metric tracking empty responses from Prometheus (#7062)
RabbitMQ Scaler: Add support for OAuth2 authentication for RabbitMQ over HTTP (#7379)
Temporal Scaler: Add support for scaling based on Worker Deployment Version backlog via new workerDeploymentName and workerDeploymentBuildId fields. Deprecate buildId, selectAllActive, and selectUnversioned because those parameters are used for Rules-Based Worker Versioning, which was a short-lived experimental feature that has been deprecated in the Temporal server since December 2024 and will stop being supported soon. Users of Rules-Based Worker Versioning should use Worker Deployments instead. (#7672)

Fixes

General: Check updated status for Fallback condition instead of ScaledObject (#7488)
General: Fail fast in GetMetrics when the gRPC connection is in Shutdown state instead of waiting for context timeout (#7251)
General: Fix int64 overflow in milli-quantity conversion for very large metric values (#7441)
General: Fix keda_scaler_active not being emitted for CPU and memory triggers (#4945)
General: Fix misleading namespace in error log when secret access is restricted (#7739)
General: Fix race in scalers cache rebuild that caused transient scaler errors (#7574)
General: Fix ScaledJob emitting wrong CloudEvent type (ScaledObjectReadyType instead of ScaledJobReadyType) when transitioning to ready state (#7792)
General: Fix ScaledObject admission webhook to return validation error from verifyReplicaCount, preventing invalid ScaledObjects from being created (#5954)
General: Fix ScaledObject Ready condition not reflecting HPA status (#7649)
General: Handle paused scaling directly in reconciler (#7663)
General: Honor stderrthreshold when logtostderr is enabled by updating klog to v2.140.0 (#7568)
General: Limit projected service account token reads during Vault authentication (#7783)
General: Reject ScaledObject creation and update when the name exceeds 63 characters (#6998)
AWS Scalers: Fix TCP connection leak by closing HTTP idle connections on scaler Close() for SQS, Kinesis, DynamoDB, DynamoDB Streams, and CloudWatch scalers (#7756)
Azure Data Explorer Scaler: Remove clientSecretFromEnv support (#7554)
Azure Event Hub Scaler: Reject non-positive unprocessedEventThreshold to prevent integer division by zero when computing lag (#7732)
Azure Pipelines Scaler: Exclude already-assigned jobs from queue length (#7747)
Cron Scaler: Fix metric name generation so cron expressions with comma-separated values no longer produce invalid metric names (#7448)
External Scaler: gRPC Pool uses TLS context in the key (#7687)
Forgejo Scaler: Limit HTTP error response logging (#7469)
Forgejo Scaler: Return correct activity to enable scale-to-zero (#7527)
GCP Cloud Tasks Scaler: Implement escapeFilterValue for metric filtering (#7482)
GCP Scaler: Validate Pub/Sub resource name in BuildMQLQuery (#7468)
GCP Storage Scaler: Metadata is not printed in the log (#7688)
Github Runner Scaler: Bound etag and per-repo caches to prevent unbounded memory growth when enableEtags is on (#7685)
Github Runner Scaler: Improve URL construction and error handling (#7495)
Github Runner Scaler: Limit HTTP error response logging (#7469)
InfluxDB Scaler: Make authToken optional to support unauthenticated InfluxDB instances (#7616)
Loki Scaler: Limit HTTP error response logging (#7469)
Loki Scaler: serverAddress now appends /loki/api/v1/query to the end of existing path instead of overriding (#7648)
Metrics API Scaler: Fix aggregateFromKubeServiceEndpoints using empty label selector that matched all EndpointSlices in the namespace instead of only the target service's (#7641)
Metrics API Scaler: Fix division by zero in average aggregation when all kube service endpoints fail (#7742)
Metrics API Scaler: Prevent response value reflection in scaler errors (#7693)
NATS JetStream Scaler: Return an error from getMaxMsgLag when the configured consumer is missing instead of falling back to the stream's last sequence, preventing incorrect scale-up to maxReplicaCount (#7657)
NATS JetStream Scaler: URL-encode user input in monitoring URL construction (#7483)
PostgreSQL Scaler: Quote whitespace-containing connection parameters in generated connection strings (#7784)
PredictKube Scaler: Bump dysnix/predictkube-libs to v0.1.0 (drops the predictkube path to the archived/EOL go-grpc-prometheus and to the deprecated golang/protobuf) and use a portable Prometheus-API instant query for the health check so the scaler works against VictoriaMetrics, Thanos and other Prometheus-API-compatible backends (#7745)
Prometheus Scaler: Handle NaN results in the same manner as Inf (#7475)
Prometheus Scaler: Limit HTTP error response logging (#7469)
Pulsar Scaler: Drop bearer/basic auth headers on redirects to a different host or on https->http downgrades to prevent credential leakage (#7686)
RabbitMQ Scaler: Fix AMQP connection leak by recovering channels on the existing connection and closing connections properly (#6266)
RabbitMQ Scaler: Use SASL EXTERNAL for RabbitMQ AMQP TLS without credentials (#6840)
Redis Scaler: Use literal command names in Lua script to fix compatibility with Alibaba Cloud Redis Cluster (#7758)
Solace Scaler: Fix URL escaping for Message VPN and Queue names (#7481)
Solr Scaler: Use net/url to safely encode query parameters (#7467)
Splunk Observability Scaler: Add MTS stream handling with context timeout (#7799)

Deprecations

You can find all deprecations in this overview and join the discussion here.

Breaking Changes

GCP PubSub Scaler: The subscriptionSize setting is DEPRECATED and is removed in v2.20 - Use mode and value instead (#7720)
Huawei Cloudeye Scaler: The minMetricValue setting is DEPRECATED and is removed - Use activationTargetMetricValue instead (#7436)
IBM MQ Scaler: The tls setting code is removed (#6094)
InfluxDB Scaler: The authToken setting from triggerMetadata is DEPRECATED and is removed in v2.20 - Use authToken from resolvedEnv or authParams instead (#7722)

Other

General: Migrate event recording RBAC from core events to events.k8s.io (#7781)
General: Migrate metrics service gRPC response away from Kubernetes API protobuf types for Kubernetes 0.35 (#7781)
General: Remove dead code from authentication package and drop unused authModes field from ArangoDB, Loki, Prometheus and PredictKube scalers (#7726)
General: Use informer cache for ReplicaSet lookups in GetCurrentReplicas to reduce API server load (#7466)
External Scaler: Fix race condition in TestWaitForState causing flaky test under -race detector (#7542)
GCP Scaler: Replace credentialsFromJSON with credentialsFromJSONWithType (#7523)
Kafka Scaler: Refactor Kafka Scaler (#7528)

Configuration

📅 Schedule: (in timezone America/Toronto)

Branch creation
- "every weekday"
Automerge
- "every weekday"

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/home-operations/charts-mirror/keda](https://github.com/kedacore/keda) | minor | `2.19.0` → `2.20.0` | --- ### Release Notes <details> <summary>kedacore/keda (ghcr.io/home-operations/charts-mirror/keda)</summary> ### [`v2.20.0`](https://github.com/kedacore/keda/blob/HEAD/CHANGELOG.md#v2200) [Compare Source](https://github.com/kedacore/keda/compare/v2.19.0...v2.20.0) ##### New - **General**: Add `scalingModifiers` fallback behavior ([#7366](https://github.com/kedacore/keda/discussions/7366)) - **General**: Introduce Elastic Forecast Scaler ([#7494](https://github.com/kedacore/keda/issues/7494)) - **General**: Introduce new OpenSearch Scaler ([#7456](https://github.com/kedacore/keda/issues/7456)) ##### Improvements - **General**: Add cooldownPeriod and pollingInterval checks for ScaledObject ([#7271](https://github.com/kedacore/keda/pull/7271)) - **General**: Add CRD-level validation markers (Minimum, MinLength, MinItems, Enum) for ScaledObject, ScaledJob, ScaleTriggers, and TriggerAuthentication API types ([#7533](https://github.com/kedacore/keda/pull/7533)) - **General**: Add `--leader-election-id` flag to allow configuring the leader election Lease name ([#7564](https://github.com/kedacore/keda/issues/7564)) - **General**: Add scaler HTTP request metrics (`keda_scaler_http_requests_total`, `keda_scaler_http_request_duration_seconds`) for outbound HTTP requests made during scaler metric collection ([#6600](https://github.com/kedacore/keda/issues/6600)) - **General**: Allow more control of TLS versions & ciphers via `KEDA_HTTP_TLS_CIPHER_LIST`, `KEDA_SERVICE_TLS_CIPHER_LIST` and `KEDA_SERVICE_MIN_TLS_VERSION` env vars ([#7617](https://github.com/kedacore/keda/pull/7617)) - **General**: Cap each scalers-cache reader at a per-reader budget derived from `globalHTTPTimeout` so `ScalersCache.Close` cannot block indefinitely ([#7574](https://github.com/kedacore/keda/issues/7574)) - **General**: Make APIService cert injections optional ([#7559](https://github.com/kedacore/keda/pull/7559)) - **General**: Remove unconditional `json.MarshalIndent` calls from admission webhook validation hot paths; replace spec-comparison `MarshalIndent`-and-string-compare in `isRemovingFinalizer` variants with `reflect.DeepEqual`. Prevents webhook OOM under sustained admission load at large scale (observed at \~60k ScaledObjects) ([#7670](https://github.com/kedacore/keda/pull/7670)) - **AWS Scalers**: Add support for AWS External ID in TriggerAuthentication podIdentity for all AWS scalers (SQS, Kinesis, DynamoDB, CloudWatch, etc.) to enable cross-account access scenarios ([#6921](https://github.com/kedacore/keda/issues/6921)) - **Elasticsearch Scaler**: Add HTTP status check for Elasticsearch errors ([#7480](https://github.com/kedacore/keda/pull/7480)) - **Github Runner Scaler**: Handle rate limit errors by respecting X-RateLimit-Reset and Retry-After headers and returning cached queue length ([#7683](https://github.com/kedacore/keda/issues/7683)) - **Kubernetes Workload Scaler**: Add `groupByNode` parameter ([#7628](https://github.com/kedacore/keda/issues/7628)) - **Metrics API Scaler**: Add custom HTTP client timeout ([#7549](https://github.com/kedacore/keda/issues/7549)) - **MSSQL Scaler**: Add Azure Workload Identity support for Azure SQL authentication ([#6104](https://github.com/kedacore/keda/issues/6104)) - **Prometheus Scaler**: Emit metric tracking empty responses from Prometheus ([#7062](https://github.com/kedacore/keda/issues/7062)) - **RabbitMQ Scaler**: Add support for OAuth2 authentication for RabbitMQ over HTTP ([#7379](https://github.com/kedacore/keda/issues/7379)) - **Temporal Scaler**: Add support for scaling based on Worker Deployment Version backlog via new `workerDeploymentName` and `workerDeploymentBuildId` fields. Deprecate `buildId`, `selectAllActive`, and `selectUnversioned` because those parameters are used for Rules-Based Worker Versioning, which was a short-lived experimental feature that has been deprecated in the Temporal server since December 2024 and will stop being supported soon. Users of Rules-Based Worker Versioning should use Worker Deployments instead. ([#7672](https://github.com/kedacore/keda/pull/7672)) ##### Fixes - **General**: Check updated status for Fallback condition instead of ScaledObject ([#7488](https://github.com/kedacore/keda/issues/7488)) - **General**: Fail fast in `GetMetrics` when the gRPC connection is in Shutdown state instead of waiting for context timeout ([#7251](https://github.com/kedacore/keda/issues/7251)) - **General**: Fix int64 overflow in milli-quantity conversion for very large metric values ([#7441](https://github.com/kedacore/keda/issues/7441)) - **General**: Fix `keda_scaler_active` not being emitted for CPU and memory triggers ([#4945](https://github.com/kedacore/keda/issues/4945)) - **General**: Fix misleading namespace in error log when secret access is restricted ([#7739](https://github.com/kedacore/keda/issues/7739)) - **General**: Fix race in scalers cache rebuild that caused transient scaler errors ([#7574](https://github.com/kedacore/keda/issues/7574)) - **General**: Fix ScaledJob emitting wrong CloudEvent type (`ScaledObjectReadyType` instead of `ScaledJobReadyType`) when transitioning to ready state ([#7792](https://github.com/kedacore/keda/issues/7792)) - **General**: Fix ScaledObject admission webhook to return validation error from `verifyReplicaCount`, preventing invalid ScaledObjects from being created ([#5954](https://github.com/kedacore/keda/issues/5954)) - **General**: Fix ScaledObject Ready condition not reflecting HPA status ([#7649](https://github.com/kedacore/keda/issues/7649)) - **General**: Handle paused scaling directly in reconciler ([#7663](https://github.com/kedacore/keda/issues/7663)) - **General**: Honor `stderrthreshold` when `logtostderr` is enabled by updating klog to v2.140.0 ([#7568](https://github.com/kedacore/keda/pull/7568)) - **General**: Limit projected service account token reads during Vault authentication ([#7783](https://github.com/kedacore/keda/issues/7783)) - **General**: Reject ScaledObject creation and update when the name exceeds 63 characters ([#6998](https://github.com/kedacore/keda/issues/6998)) - **AWS Scalers**: Fix TCP connection leak by closing HTTP idle connections on scaler `Close()` for SQS, Kinesis, DynamoDB, DynamoDB Streams, and CloudWatch scalers ([#7756](https://github.com/kedacore/keda/issues/7756)) - **Azure Data Explorer Scaler**: Remove clientSecretFromEnv support ([#7554](https://github.com/kedacore/keda/pull/7554)) - **Azure Event Hub Scaler**: Reject non-positive `unprocessedEventThreshold` to prevent integer division by zero when computing lag ([#7732](https://github.com/kedacore/keda/issues/7732)) - **Azure Pipelines Scaler**: Exclude already-assigned jobs from queue length ([#7747](https://github.com/kedacore/keda/issues/7747)) - **Cron Scaler**: Fix metric name generation so cron expressions with comma-separated values no longer produce invalid metric names ([#7448](https://github.com/kedacore/keda/issues/7448)) - **External Scaler**: gRPC Pool uses TLS context in the key ([#7687](https://github.com/kedacore/keda/issues/7687)) - **Forgejo Scaler**: Limit HTTP error response logging ([#7469](https://github.com/kedacore/keda/pull/7469)) - **Forgejo Scaler**: Return correct activity to enable scale-to-zero ([#7527](https://github.com/kedacore/keda/issues/7527)) - **GCP Cloud Tasks Scaler**: Implement escapeFilterValue for metric filtering ([#7482](https://github.com/kedacore/keda/pull/7482)) - **GCP Scaler**: Validate Pub/Sub resource name in BuildMQLQuery ([#7468](https://github.com/kedacore/keda/pull/7468)) - **GCP Storage Scaler**: Metadata is not printed in the log ([#7688](https://github.com/kedacore/keda/issues/7688)) - **Github Runner Scaler**: Bound etag and per-repo caches to prevent unbounded memory growth when `enableEtags` is on ([#7685](https://github.com/kedacore/keda/issues/7685)) - **Github Runner Scaler**: Improve URL construction and error handling ([#7495](https://github.com/kedacore/keda/pull/7495)) - **Github Runner Scaler**: Limit HTTP error response logging ([#7469](https://github.com/kedacore/keda/pull/7469)) - **InfluxDB Scaler**: Make `authToken` optional to support unauthenticated InfluxDB instances ([#7616](https://github.com/kedacore/keda/issues/7616)) - **Loki Scaler**: Limit HTTP error response logging ([#7469](https://github.com/kedacore/keda/pull/7469)) - **Loki Scaler**: `serverAddress` now appends `/loki/api/v1/query` to the end of existing path instead of overriding ([#7648](https://github.com/kedacore/keda/pull/7648)) - **Metrics API Scaler**: Fix `aggregateFromKubeServiceEndpoints` using empty label selector that matched all EndpointSlices in the namespace instead of only the target service's ([#7641](https://github.com/kedacore/keda/issues/7641)) - **Metrics API Scaler**: Fix division by zero in average aggregation when all kube service endpoints fail ([#7742](https://github.com/kedacore/keda/issues/7742)) - **Metrics API Scaler**: Prevent response value reflection in scaler errors ([#7693](https://github.com/kedacore/keda/pull/7693)) - **NATS JetStream Scaler**: Return an error from `getMaxMsgLag` when the configured consumer is missing instead of falling back to the stream's last sequence, preventing incorrect scale-up to `maxReplicaCount` ([#7657](https://github.com/kedacore/keda/issues/7657)) - **NATS JetStream Scaler**: URL-encode user input in monitoring URL construction ([#7483](https://github.com/kedacore/keda/pull/7483)) - **PostgreSQL Scaler**: Quote whitespace-containing connection parameters in generated connection strings ([#7784](https://github.com/kedacore/keda/issues/7784)) - **PredictKube Scaler**: Bump `dysnix/predictkube-libs` to `v0.1.0` (drops the predictkube path to the archived/EOL `go-grpc-prometheus` and to the deprecated `golang/protobuf`) and use a portable Prometheus-API instant query for the health check so the scaler works against VictoriaMetrics, Thanos and other Prometheus-API-compatible backends ([#7745](https://github.com/kedacore/keda/pull/7745)) - **Prometheus Scaler**: Handle NaN results in the same manner as Inf ([#7475](https://github.com/kedacore/keda/issues/7475)) - **Prometheus Scaler**: Limit HTTP error response logging ([#7469](https://github.com/kedacore/keda/pull/7469)) - **Pulsar Scaler**: Drop bearer/basic auth headers on redirects to a different host or on https->http downgrades to prevent credential leakage ([#7686](https://github.com/kedacore/keda/issues/7686)) - **RabbitMQ Scaler**: Fix AMQP connection leak by recovering channels on the existing connection and closing connections properly ([#6266](https://github.com/kedacore/keda/issues/6266)) - **RabbitMQ Scaler**: Use SASL EXTERNAL for RabbitMQ AMQP TLS without credentials ([#6840](https://github.com/kedacore/keda/issues/6840)) - **Redis Scaler**: Use literal command names in Lua script to fix compatibility with Alibaba Cloud Redis Cluster ([#7758](https://github.com/kedacore/keda/issues/7758)) - **Solace Scaler**: Fix URL escaping for Message VPN and Queue names ([#7481](https://github.com/kedacore/keda/pull/7481)) - **Solr Scaler**: Use net/url to safely encode query parameters ([#7467](https://github.com/kedacore/keda/pull/7467)) - **Splunk Observability Scaler**: Add MTS stream handling with context timeout ([#7799](https://github.com/kedacore/keda/pull/7799)) ##### Deprecations You can find all deprecations in [this overview](https://github.com/kedacore/keda/issues?q=is%3Aissue+is%3Aopen+sort%3Aupdated-desc+label%3Abreaking-change) and [join the discussion here](https://github.com/kedacore/keda/discussions/categories/deprecations). ##### Breaking Changes - **GCP PubSub Scaler**: The `subscriptionSize` setting is DEPRECATED and is removed in v2.20 - Use `mode` and `value` instead ([#7720](https://github.com/kedacore/keda/issues/7720)) - **Huawei Cloudeye Scaler**: The `minMetricValue` setting is DEPRECATED and is removed - Use `activationTargetMetricValue` instead ([#7436](https://github.com/kedacore/keda/issues/7436)) - **IBM MQ Scaler**: The `tls` setting code is removed ([#6094](https://github.com/kedacore/keda/issues/6094)) - **InfluxDB Scaler**: The `authToken` setting from `triggerMetadata` is DEPRECATED and is removed in v2.20 - Use `authToken` from `resolvedEnv` or `authParams` instead ([#7722](https://github.com/kedacore/keda/issues/7722)) ##### Other - **General**: Migrate event recording RBAC from core `events` to `events.k8s.io` ([#7781](https://github.com/kedacore/keda/pull/7781)) - **General**: Migrate metrics service gRPC response away from Kubernetes API protobuf types for Kubernetes 0.35 ([#7781](https://github.com/kedacore/keda/pull/7781)) - **General**: Remove dead code from authentication package and drop unused `authModes` field from ArangoDB, Loki, Prometheus and PredictKube scalers ([#7726](https://github.com/kedacore/keda/pull/7726)) - **General**: Use informer cache for ReplicaSet lookups in GetCurrentReplicas to reduce API server load ([#7466](https://github.com/kedacore/keda/pull/7466)) - **External Scaler**: Fix race condition in `TestWaitForState` causing flaky test under `-race` detector ([#7542](https://github.com/kedacore/keda/issues/7542)) - **GCP Scaler**: Replace `credentialsFromJSON` with `credentialsFromJSONWithType` ([#7523](https://github.com/kedacore/keda/pull/7523)) - **Kafka Scaler**: Refactor Kafka Scaler ([#7528](https://github.com/kedacore/keda/pull/7528)) </details> --- ### Configuration 📅 **Schedule**: (in timezone America/Toronto) - Branch creation - "every weekday" - Automerge - "every weekday" 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

dusk-bot added the

renovate/container

type/minor

priority/medium

labels

2026-06-02 12:05:33 +00:00

dusk-bot added 1 commit

2026-06-02 12:05:33 +00:00

feat(container): update image ghcr.io/home-operations/charts-mirror/keda (2.19.0 ➔ 2.20.0)

Flate / Flate - Filter (pull_request) Successful in 17s

Details

Flate / Flate (helmrelease) (pull_request) Has been skipped