Bump k8s deps to 0.35.5 and bump deps - #7781
Merged
Merged
Conversation
|
Thank you for your contribution! 🙏 Please understand that we will do our best to review your PR and give you feedback as soon as possible, but please bear with us if it takes a little longer as expected. While you are waiting, make sure to:
Once the initial tests are successful, a KEDA member will ensure that the e2e tests are run. Once the e2e tests have been successfully completed, the PR may be merged at a later date. Please be patient. Learn more about our contribution guide. |
|
| Status | Scan Engine |  Critical |
 High |
 Medium |
 Low |
Total (0) |
|---|---|---|---|---|---|---|
| Open Source Security | 0 | 0 | 0 | 0 | See details |
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.
zroubalik
marked this pull request as draft
May 26, 2026 10:26
zroubalik
added
the
required:keda-v2.20
zroubalik
force-pushed
the
bd220
branch
2 times, most recently
from
May 26, 2026 15:10
4c5514a to
665be49
Compare
zroubalik
marked this pull request as ready for review
May 26, 2026 15:10
JorTurFer
approved these changes
May 26, 2026
Member
Author
|
/run-e2e |
Member
Author
|
/run-e2e passed tests: 24failed tests: 172 |
Member
Author
|
/run-e2e |
Member
|
/run-e2e passed tests: 56failed tests: 140 |
Member
|
hmm, looks like there will be some more work - kubernetes/kubernetes#134256 as a result, scaling is broken |
zroubalik
marked this pull request as draft
May 28, 2026 19:26
zroubalik
force-pushed
the
bd220
branch
2 times, most recently
from
May 28, 2026 19:49
3e1dda3 to
0096380
Compare
Member
|
/run-e2e datadog_dca|prometheus_metrics|opentelemetry_metrics|github_runner|internals/events|forgejo_runner passed tests: 4failed tests: 2 |
run-all.go retries failed tests up to 3 times in fresh `go test` invocations. Between attempts, events from the previous SO incarnation can still match `--field-selector regarding.name=<so>` because the selector is name-only. With negative jsonpath indices ([-1]/[-2]) this makes the assertion latch onto the wrong event and the test fails. Look up the current resource's UID and add `regarding.uid=<uid>` to the field selector. Falls back to name-only if the lookup misses, preserving prior behavior when the resource is mid-create or already deleted. Signed-off-by: Jan Wozniak <wozniak.jan@gmail.com>
Member
|
/run-e2e internals/events|github passed tests: 0failed tests: 2 |
…edup The events.k8s.io broadcaster's aggregation key is (eventType, action, reason, reportingController, reportingInstance, regarding) — it does NOT include note. When Emit passed reason as both reason and action, two calls with the same reason but different notes (e.g. ScaleTargetErrMsg and ScaleTargetNoSubresourceMsg under reason=ScaledObjectCheckFailed) collided in the dedup key. The broadcaster kept the first note's record and silently incremented series.count for subsequent emissions, dropping the second note entirely. This made events_test's assertions on the "spec" note impossible to satisfy on PR 7781. Pass the message itself as action, so distinct notes get distinct aggregation keys and each surfaces as its own event record. Signed-off-by: Jan Wozniak <wozniak.jan@gmail.com>
Member
|
/run-e2e internals/events|github |
Member
|
the last remaining failing e2e test is github_runner. I think the reason is independent of the changes on this PR so, merging this and will track that one down separatelly |
wozniakjan
added a commit
that referenced
this pull request
May 31, 2026
The events e2e test asserted events at fixed positions in a list sorted by .metadata.creationTimestamp. KEDA emits several events for a single ScaledObject/ScaledJob within the same second, and events.k8s.io creationTimestamp only has 1s granularity, so same-second events sort non-deterministically. After #7781 migrated event recording to events.k8s.io, "Started scalers watch" [1] and "ScaledJob is ready for scaling" [2] started swapping positions, failing the test every night. Match the expected reason/note pair against any event emitted for the resource instead of a fixed index, removing the ordering dependency. Signed-off-by: Jan Wozniak <wozniak.jan@gmail.com>
wozniakjan
added a commit
that referenced
this pull request
Jun 1, 2026
…ration (#7808) #7755 added TestGetScaledObjectStateRecordsResourceScalerActiveMetric and TestGetScaledObjectStateSkipsResourceScalerActiveMetricWithModifiers using record.NewFakeRecorder. In the meantime #7781 migrated this file to the events recorder and dropped the k8s.io/client-go/tools/record import, so the merged result fails to compile with "undefined: record", breaking the unit-test build and Static Checks on main. Use events.NewFakeRecorder, matching the rest of the file and the events.EventRecorder type of the Recorder/recorder fields. Signed-off-by: Jan Wozniak <wozniak.jan@gmail.com>
eleboucher
pushed a commit
to eleboucher/homelab
that referenced
this pull request
Jun 1, 2026
…eda (2.19.0 ➔ 2.20.0) (#779) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/home-operations/charts-mirror/keda](https://github.com/kedacore/keda) | minor | `2.19.0` → `2.20.0` | --- ### Release Notes <details> <summary>kedacore/keda (ghcr.io/home-operations/charts-mirror/keda)</summary> ### [`v2.20.0`](https://github.com/kedacore/keda/blob/HEAD/CHANGELOG.md#v2200) [Compare Source](kedacore/keda@v2.19.0...v2.20.0) ##### New - **General**: Add `scalingModifiers` fallback behavior ([#​7366](kedacore/keda#7366)) - **General**: Introduce Elastic Forecast Scaler ([#​7494](kedacore/keda#7494)) - **General**: Introduce new OpenSearch Scaler ([#​7456](kedacore/keda#7456)) ##### Improvements - **General**: Add cooldownPeriod and pollingInterval checks for ScaledObject ([#​7271](kedacore/keda#7271)) - **General**: Add CRD-level validation markers (Minimum, MinLength, MinItems, Enum) for ScaledObject, ScaledJob, ScaleTriggers, and TriggerAuthentication API types ([#​7533](kedacore/keda#7533)) - **General**: Add `--leader-election-id` flag to allow configuring the leader election Lease name ([#​7564](kedacore/keda#7564)) - **General**: Add scaler HTTP request metrics (`keda_scaler_http_requests_total`, `keda_scaler_http_request_duration_seconds`) for outbound HTTP requests made during scaler metric collection ([#​6600](kedacore/keda#6600)) - **General**: Allow more control of TLS versions & ciphers via `KEDA_HTTP_TLS_CIPHER_LIST`, `KEDA_SERVICE_TLS_CIPHER_LIST` and `KEDA_SERVICE_MIN_TLS_VERSION` env vars ([#​7617](kedacore/keda#7617)) - **General**: Cap each scalers-cache reader at a per-reader budget derived from `globalHTTPTimeout` so `ScalersCache.Close` cannot block indefinitely ([#​7574](kedacore/keda#7574)) - **General**: Make APIService cert injections optional ([#​7559](kedacore/keda#7559)) - **General**: Remove unconditional `json.MarshalIndent` calls from admission webhook validation hot paths; replace spec-comparison `MarshalIndent`-and-string-compare in `isRemovingFinalizer` variants with `reflect.DeepEqual`. Prevents webhook OOM under sustained admission load at large scale (observed at \~60k ScaledObjects) ([#​7670](kedacore/keda#7670)) - **AWS Scalers**: Add support for AWS External ID in TriggerAuthentication podIdentity for all AWS scalers (SQS, Kinesis, DynamoDB, CloudWatch, etc.) to enable cross-account access scenarios ([#​6921](kedacore/keda#6921)) - **Elasticsearch Scaler**: Add HTTP status check for Elasticsearch errors ([#​7480](kedacore/keda#7480)) - **Github Runner Scaler**: Handle rate limit errors by respecting X-RateLimit-Reset and Retry-After headers and returning cached queue length ([#​7683](kedacore/keda#7683)) - **Kubernetes Workload Scaler**: Add `groupByNode` parameter ([#​7628](kedacore/keda#7628)) - **Metrics API Scaler**: Add custom HTTP client timeout ([#​7549](kedacore/keda#7549)) - **MSSQL Scaler**: Add Azure Workload Identity support for Azure SQL authentication ([#​6104](kedacore/keda#6104)) - **Prometheus Scaler**: Emit metric tracking empty responses from Prometheus ([#​7062](kedacore/keda#7062)) - **RabbitMQ Scaler**: Add support for OAuth2 authentication for RabbitMQ over HTTP ([#​7379](kedacore/keda#7379)) - **Temporal Scaler**: Add support for scaling based on Worker Deployment Version backlog via new `workerDeploymentName` and `workerDeploymentBuildId` fields. Deprecate `buildId`, `selectAllActive`, and `selectUnversioned` because those parameters are used for Rules-Based Worker Versioning, which was a short-lived experimental feature that has been deprecated in the Temporal server since December 2024 and will stop being supported soon. Users of Rules-Based Worker Versioning should use Worker Deployments instead. ([#​7672](kedacore/keda#7672)) ##### Fixes - **General**: Check updated status for Fallback condition instead of ScaledObject ([#​7488](kedacore/keda#7488)) - **General**: Fail fast in `GetMetrics` when the gRPC connection is in Shutdown state instead of waiting for context timeout ([#​7251](kedacore/keda#7251)) - **General**: Fix int64 overflow in milli-quantity conversion for very large metric values ([#​7441](kedacore/keda#7441)) - **General**: Fix `keda_scaler_active` not being emitted for CPU and memory triggers ([#​4945](kedacore/keda#4945)) - **General**: Fix misleading namespace in error log when secret access is restricted ([#​7739](kedacore/keda#7739)) - **General**: Fix race in scalers cache rebuild that caused transient scaler errors ([#​7574](kedacore/keda#7574)) - **General**: Fix ScaledJob emitting wrong CloudEvent type (`ScaledObjectReadyType` instead of `ScaledJobReadyType`) when transitioning to ready state ([#​7792](kedacore/keda#7792)) - **General**: Fix ScaledObject admission webhook to return validation error from `verifyReplicaCount`, preventing invalid ScaledObjects from being created ([#​5954](kedacore/keda#5954)) - **General**: Fix ScaledObject Ready condition not reflecting HPA status ([#​7649](kedacore/keda#7649)) - **General**: Handle paused scaling directly in reconciler ([#​7663](kedacore/keda#7663)) - **General**: Honor `stderrthreshold` when `logtostderr` is enabled by updating klog to v2.140.0 ([#​7568](kedacore/keda#7568)) - **General**: Limit projected service account token reads during Vault authentication ([#​7783](kedacore/keda#7783)) - **General**: Reject ScaledObject creation and update when the name exceeds 63 characters ([#​6998](kedacore/keda#6998)) - **AWS Scalers**: Fix TCP connection leak by closing HTTP idle connections on scaler `Close()` for SQS, Kinesis, DynamoDB, DynamoDB Streams, and CloudWatch scalers ([#​7756](kedacore/keda#7756)) - **Azure Data Explorer Scaler**: Remove clientSecretFromEnv support ([#​7554](kedacore/keda#7554)) - **Azure Event Hub Scaler**: Reject non-positive `unprocessedEventThreshold` to prevent integer division by zero when computing lag ([#​7732](kedacore/keda#7732)) - **Azure Pipelines Scaler**: Exclude already-assigned jobs from queue length ([#​7747](kedacore/keda#7747)) - **Cron Scaler**: Fix metric name generation so cron expressions with comma-separated values no longer produce invalid metric names ([#​7448](kedacore/keda#7448)) - **External Scaler**: gRPC Pool uses TLS context in the key ([#​7687](kedacore/keda#7687)) - **Forgejo Scaler**: Limit HTTP error response logging ([#​7469](kedacore/keda#7469)) - **Forgejo Scaler**: Return correct activity to enable scale-to-zero ([#​7527](kedacore/keda#7527)) - **GCP Cloud Tasks Scaler**: Implement escapeFilterValue for metric filtering ([#​7482](kedacore/keda#7482)) - **GCP Scaler**: Validate Pub/Sub resource name in BuildMQLQuery ([#​7468](kedacore/keda#7468)) - **GCP Storage Scaler**: Metadata is not printed in the log ([#​7688](kedacore/keda#7688)) - **Github Runner Scaler**: Bound etag and per-repo caches to prevent unbounded memory growth when `enableEtags` is on ([#​7685](kedacore/keda#7685)) - **Github Runner Scaler**: Improve URL construction and error handling ([#​7495](kedacore/keda#7495)) - **Github Runner Scaler**: Limit HTTP error response logging ([#​7469](kedacore/keda#7469)) - **InfluxDB Scaler**: Make `authToken` optional to support unauthenticated InfluxDB instances ([#​7616](kedacore/keda#7616)) - **Loki Scaler**: Limit HTTP error response logging ([#​7469](kedacore/keda#7469)) - **Loki Scaler**: `serverAddress` now appends `/loki/api/v1/query` to the end of existing path instead of overriding ([#​7648](kedacore/keda#7648)) - **Metrics API Scaler**: Fix `aggregateFromKubeServiceEndpoints` using empty label selector that matched all EndpointSlices in the namespace instead of only the target service's ([#​7641](kedacore/keda#7641)) - **Metrics API Scaler**: Fix division by zero in average aggregation when all kube service endpoints fail ([#​7742](kedacore/keda#7742)) - **Metrics API Scaler**: Prevent response value reflection in scaler errors ([#​7693](kedacore/keda#7693)) - **NATS JetStream Scaler**: Return an error from `getMaxMsgLag` when the configured consumer is missing instead of falling back to the stream's last sequence, preventing incorrect scale-up to `maxReplicaCount` ([#​7657](kedacore/keda#7657)) - **NATS JetStream Scaler**: URL-encode user input in monitoring URL construction ([#​7483](kedacore/keda#7483)) - **PostgreSQL Scaler**: Quote whitespace-containing connection parameters in generated connection strings ([#​7784](kedacore/keda#7784)) - **PredictKube Scaler**: Bump `dysnix/predictkube-libs` to `v0.1.0` (drops the predictkube path to the archived/EOL `go-grpc-prometheus` and to the deprecated `golang/protobuf`) and use a portable Prometheus-API instant query for the health check so the scaler works against VictoriaMetrics, Thanos and other Prometheus-API-compatible backends ([#​7745](kedacore/keda#7745)) - **Prometheus Scaler**: Handle NaN results in the same manner as Inf ([#​7475](kedacore/keda#7475)) - **Prometheus Scaler**: Limit HTTP error response logging ([#​7469](kedacore/keda#7469)) - **Pulsar Scaler**: Drop bearer/basic auth headers on redirects to a different host or on https->http downgrades to prevent credential leakage ([#​7686](kedacore/keda#7686)) - **RabbitMQ Scaler**: Fix AMQP connection leak by recovering channels on the existing connection and closing connections properly ([#​6266](kedacore/keda#6266)) - **RabbitMQ Scaler**: Use SASL EXTERNAL for RabbitMQ AMQP TLS without credentials ([#​6840](kedacore/keda#6840)) - **Redis Scaler**: Use literal command names in Lua script to fix compatibility with Alibaba Cloud Redis Cluster ([#​7758](kedacore/keda#7758)) - **Solace Scaler**: Fix URL escaping for Message VPN and Queue names ([#​7481](kedacore/keda#7481)) - **Solr Scaler**: Use net/url to safely encode query parameters ([#​7467](kedacore/keda#7467)) - **Splunk Observability Scaler**: Add MTS stream handling with context timeout ([#​7799](kedacore/keda#7799)) ##### Deprecations You can find all deprecations in [this overview](https://github.com/kedacore/keda/issues?q=is%3Aissue+is%3Aopen+sort%3Aupdated-desc+label%3Abreaking-change) and [join the discussion here](https://github.com/kedacore/keda/discussions/categories/deprecations). ##### Breaking Changes - **GCP PubSub Scaler**: The `subscriptionSize` setting is DEPRECATED and is removed in v2.20 - Use `mode` and `value` instead ([#​7720](kedacore/keda#7720)) - **Huawei Cloudeye Scaler**: The `minMetricValue` setting is DEPRECATED and is removed - Use `activationTargetMetricValue` instead ([#​7436](kedacore/keda#7436)) - **IBM MQ Scaler**: The `tls` setting code is removed ([#​6094](kedacore/keda#6094)) - **InfluxDB Scaler**: The `authToken` setting from `triggerMetadata` is DEPRECATED and is removed in v2.20 - Use `authToken` from `resolvedEnv` or `authParams` instead ([#​7722](kedacore/keda#7722)) ##### Other - **General**: Migrate event recording RBAC from core `events` to `events.k8s.io` ([#​7781](kedacore/keda#7781)) - **General**: Migrate metrics service gRPC response away from Kubernetes API protobuf types for Kubernetes 0.35 ([#​7781](kedacore/keda#7781)) - **General**: Remove dead code from authentication package and drop unused `authModes` field from ArangoDB, Loki, Prometheus and PredictKube scalers ([#​7726](kedacore/keda#7726)) - **General**: Use informer cache for ReplicaSet lookups in GetCurrentReplicas to reduce API server load ([#​7466](kedacore/keda#7466)) - **External Scaler**: Fix race condition in `TestWaitForState` causing flaky test under `-race` detector ([#​7542](kedacore/keda#7542)) - **GCP Scaler**: Replace `credentialsFromJSON` with `credentialsFromJSONWithType` ([#​7523](kedacore/keda#7523)) - **Kafka Scaler**: Refactor Kafka Scaler ([#​7528](kedacore/keda#7528)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDEuMSIsInVwZGF0ZWRJblZlciI6IjQzLjEwMS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZS9jb250YWluZXIiLCJ0eXBlL21pbm9yIl19--> Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/779
Sammyrules7
pushed a commit
to Sammyrules7/Servers
that referenced
this pull request
Jun 3, 2026
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [authentik](https://goauthentik.io) ([source](https://github.com/goauthentik/helm)) | minor | `2026.2.x` → `2026.5.x` | | [fluxcd/flux2](https://github.com/fluxcd/flux2) | patch | `v2.8.5` → `v2.8.8` | | [ghcr.io/fluxcd/helm-controller](https://github.com/fluxcd/helm-controller) | patch | `v1.5.3` → `v1.5.5` | | [ghcr.io/fluxcd/kustomize-controller](https://github.com/fluxcd/kustomize-controller) | patch | `v1.8.3` → `v1.8.5` | | [ghcr.io/fluxcd/notification-controller](https://github.com/fluxcd/notification-controller) | patch | `v1.8.3` → `v1.8.4` | | [ghcr.io/fluxcd/source-controller](https://github.com/fluxcd/source-controller) | patch | `v1.8.2` → `v1.8.5` | | [keda](https://github.com/kedacore/keda) | minor | `2.19.0` → `2.20.0` | | [renovate/renovate](https://renovatebot.com) ([source](https://github.com/renovatebot/renovate)) | patch | [`43.209.1` → `43.209.2`](https://octochangelog.com/compare?repo=renovatebot%2Frenovate&from=43.209.1&to=43.209.2) | | [victoria-metrics-k8s-stack](https://github.com/VictoriaMetrics/helm-charts) | minor | `0.76.x` → `0.81.x` | --- ### Release Notes <details> <summary>goauthentik/helm (authentik)</summary> ### [`v2026.5.2`](https://github.com/goauthentik/helm/releases/tag/authentik-2026.5.2) [Compare Source](goauthentik/helm@authentik-2026.5.0...authentik-2026.5.2) authentik is an open-source Identity Provider focused on flexibility and versatility #### What's Changed - charts/authentik: bump to 2026.5.2 by [@​authentik-automation](https://github.com/authentik-automation)\[bot] in [#​476](goauthentik/helm#476) **Full Changelog**: <goauthentik/helm@authentik-2026.5.0...authentik-2026.5.2> ### [`v2026.5.0`](https://github.com/goauthentik/helm/releases/tag/authentik-2026.5.0) [Compare Source](goauthentik/helm@authentik-2026.2.3...authentik-2026.5.0) authentik is an open-source Identity Provider focused on flexibility and versatility See <https://docs.goauthentik.io/releases/2026.5/> #### What's Changed - charts/authentik: bump postgresql subchart from 16.7.27 to 18.6.5 by [@​renovate](https://github.com/renovate)\[bot] in [#​410](goauthentik/helm#410) - charts/authentik: remove hardcoded AUTHENTIK\_LISTEN variables by [@​rissson](https://github.com/rissson) in [#​468](goauthentik/helm#468) - charts/authentik: update docker.io/library/postgres Docker tag to v17.10 by [@​renovate](https://github.com/renovate)\[bot] in [#​470](goauthentik/helm#470) - charts/authentik: bump postgresql subchart to v18.6.7 by [@​renovate](https://github.com/renovate)\[bot] in [#​469](goauthentik/helm#469) - charts/authentik: bump to 2026.5.0 by [@​authentik-automation](https://github.com/authentik-automation)\[bot] in [#​471](goauthentik/helm#471) **Full Changelog**: <goauthentik/helm@authentik-2026.2.3...authentik-2026.5.0> </details> <details> <summary>fluxcd/flux2 (fluxcd/flux2)</summary> ### [`v2.8.8`](https://github.com/fluxcd/flux2/releases/tag/v2.8.8) [Compare Source](fluxcd/flux2@v2.8.7...v2.8.8) #### Highlights Flux v2.8.8 is a patch release that includes CVE fixes via go-git v5.19.1 (source-controller, image-automation-controller), reliability fixes in helm-controller and source-controller, the move of Helm back to upstream v4.2.0, support for GCP sovereign cloud artifact registries, and dependency updates. Users are encouraged to upgrade for the best experience. ℹ️ Please follow the [Upgrade Procedure for Flux v2.7+](fluxcd/flux2#5572) for a smooth upgrade from Flux v2.6 to the latest version. Fixes: - Add a configurable HTTP timeout for artifact fetching, preventing fetches that could block indefinitely and stall reconciliations (helm-controller) - Fix unbounded memory growth caused by a Kubernetes client transport retry wrapper accumulating on every reconcile (helm-controller) - Stop force-applying non-CRD objects placed under a chart's `crds/` directory (helm-controller) - Fix the Helm test action failing to find releases with names longer than 53 characters (helm-controller) - Improve path handling in the source reconcilers (source-controller) - Support Helm semver build-metadata encoding in OCIRepository tags (source-controller) Improvements: - Update go-git to v5.19.1 which fixes [CVE-2026-45571](GHSA-crhj-59gh-8x96) and [CVE-2026-45570](GHSA-m7cr-m3pv-hgrp) (source-controller, image-automation-controller) - Move Helm back to upstream v4.2.0 (source-controller, helm-controller) - Add support for GCP sovereign cloud artifact registries (source-controller, image-reflector-controller) - Upgrade Kubernetes to 1.36.1 (source-controller, helm-controller) - Update fluxcd/pkg dependencies #### Components changelog - helm-controller [v1.5.5](https://github.com/fluxcd/helm-controller/blob/v1.5.5/CHANGELOG.md) - image-automation-controller [v1.1.4](https://github.com/fluxcd/image-automation-controller/blob/v1.1.4/CHANGELOG.md) - image-reflector-controller [v1.1.2](https://github.com/fluxcd/image-reflector-controller/blob/v1.1.2/CHANGELOG.md) - source-controller [v1.8.5](https://github.com/fluxcd/source-controller/blob/v1.8.5/CHANGELOG.md) #### CLI changelog - Update toolkit components by [@​fluxcdbot](https://github.com/fluxcdbot) in [#​5904](fluxcd/flux2#5904) **Full Changelog**: <fluxcd/flux2@v2.8.7...v2.8.8> ### [`v2.8.7`](https://github.com/fluxcd/flux2/releases/tag/v2.8.7) [Compare Source](fluxcd/flux2@v2.8.6...v2.8.7) #### Highlights Flux v2.8.7 is a patch release that includes a bug fix in kustomize-controller, a CVE fix in source-controller and image-automation-controller via go-git v5.19.0, and dependency updates. Users are encouraged to upgrade for the best experience. ℹ️ Please follow the [Upgrade Procedure for Flux v2.7+](fluxcd/flux2#5572) for a smooth upgrade from Flux v2.6 to the latest version. Fixes: - Fix management of objects annotated with `kustomize.toolkit.fluxcd.io/ssa: IfNotPresent` where non-namespaced resources were being deleted and recreated on each reconciliation (kustomize-controller) Improvements: - Update go-git to v5.19.0 which fixes [CVE-2026-45022](GHSA-389r-gv7p-r3rp) (source-controller, image-automation-controller) - Update fluxcd/pkg dependencies (source-controller, kustomize-controller, image-automation-controller) #### Components changelog - helm-controller [v1.5.4](https://github.com/fluxcd/helm-controller/blob/v1.5.4/CHANGELOG.md) - image-automation-controller [v1.1.3](https://github.com/fluxcd/image-automation-controller/blob/v1.1.3/CHANGELOG.md) - kustomize-controller [v1.8.5](https://github.com/fluxcd/kustomize-controller/blob/v1.8.5/CHANGELOG.md) - notification-controller [v1.8.4](https://github.com/fluxcd/notification-controller/blob/v1.8.4/CHANGELOG.md) - source-controller [v1.8.4](https://github.com/fluxcd/source-controller/blob/v1.8.4/CHANGELOG.md) #### CLI changelog - Update toolkit components by [@​fluxcdbot](https://github.com/fluxcdbot) in [#​5891](fluxcd/flux2#5891) **Full Changelog**: <fluxcd/flux2@v2.8.6...v2.8.7> ### [`v2.8.6`](https://github.com/fluxcd/flux2/releases/tag/v2.8.6) [Compare Source](fluxcd/flux2@v2.8.5...v2.8.6) #### Highlights Flux v2.8.6 is a patch release that includes bug fixes and improvements across helm-controller, image-automation-controller, kustomize-controller, notification-controller, and source-controller. Users are encouraged to upgrade for the best experience. ℹ️ Please follow the [Upgrade Procedure for Flux v2.7+](fluxcd/flux2#5572) for a smooth upgrade from Flux v2.6 to the latest version. Fixes: - Fix a post-renderer conflict between overlapping hooks and templates (helm-controller) - Ignore force replace when server-side apply is enabled (helm-controller) - Fix a regression where generic providers would not forward commit status events (notification-controller) - Require the `audience` field on the GCR Receiver secret for tighter verification — will become mandatory in Flux v2.9 (notification-controller) Improvements: - Introduce the `MigrateAPIVersion` feature gate for migrating the API version of resources in managed field entries (kustomize-controller) - Update go-git to v5.18.0 bringing performance improvements for Git operations (source-controller, image-automation-controller) #### Components changelog - helm-controller [v1.5.4](https://github.com/fluxcd/helm-controller/blob/v1.5.4/CHANGELOG.md) - image-automation-controller [v1.1.2](https://github.com/fluxcd/image-automation-controller/blob/v1.1.2/CHANGELOG.md) - kustomize-controller [v1.8.4](https://github.com/fluxcd/kustomize-controller/blob/v1.8.4/CHANGELOG.md) - notification-controller [v1.8.4](https://github.com/fluxcd/notification-controller/blob/v1.8.4/CHANGELOG.md) - source-controller [v1.8.3](https://github.com/fluxcd/source-controller/blob/v1.8.3/CHANGELOG.md) #### CLI changelog - Update toolkit components by [@​fluxcdbot](https://github.com/fluxcdbot) in [#​5857](fluxcd/flux2#5857) **Full Changelog**: <fluxcd/flux2@v2.8.5...v2.8.6> </details> <details> <summary>fluxcd/helm-controller (ghcr.io/fluxcd/helm-controller)</summary> ### [`v1.5.5`](https://github.com/fluxcd/helm-controller/releases/tag/v1.5.5) [Compare Source](fluxcd/helm-controller@v1.5.4...v1.5.5) #### Changelog [v1.5.5 changelog](https://github.com/fluxcd/helm-controller/blob/v1.5.5/CHANGELOG.md) #### Container images - `docker.io/fluxcd/helm-controller:v1.5.5` - `ghcr.io/fluxcd/helm-controller:v1.5.5` Supported architectures: `linux/amd64`, `linux/arm64` and `linux/arm/v7`. The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the [security documentation](https://fluxcd.io/flux/security/). ### [`v1.5.4`](https://github.com/fluxcd/helm-controller/releases/tag/v1.5.4) [Compare Source](fluxcd/helm-controller@v1.5.3...v1.5.4) #### Changelog [v1.5.4 changelog](https://github.com/fluxcd/helm-controller/blob/v1.5.4/CHANGELOG.md) #### Container images - `docker.io/fluxcd/helm-controller:v1.5.4` - `ghcr.io/fluxcd/helm-controller:v1.5.4` Supported architectures: `linux/amd64`, `linux/arm64` and `linux/arm/v7`. The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the [security documentation](https://fluxcd.io/flux/security/). </details> <details> <summary>fluxcd/kustomize-controller (ghcr.io/fluxcd/kustomize-controller)</summary> ### [`v1.8.5`](https://github.com/fluxcd/kustomize-controller/releases/tag/v1.8.5) [Compare Source](fluxcd/kustomize-controller@v1.8.4...v1.8.5) #### Changelog [v1.8.5 changelog](https://github.com/fluxcd/kustomize-controller/blob/v1.8.5/CHANGELOG.md) #### Container images - `docker.io/fluxcd/kustomize-controller:v1.8.5` - `ghcr.io/fluxcd/kustomize-controller:v1.8.5` Supported architectures: `linux/amd64`, `linux/arm64` and `linux/arm/v7`. The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the [security documentation](https://fluxcd.io/flux/security/). ### [`v1.8.4`](https://github.com/fluxcd/kustomize-controller/releases/tag/v1.8.4) [Compare Source](fluxcd/kustomize-controller@v1.8.3...v1.8.4) #### Changelog [v1.8.4 changelog](https://github.com/fluxcd/kustomize-controller/blob/v1.8.4/CHANGELOG.md) #### Container images - `docker.io/fluxcd/kustomize-controller:v1.8.4` - `ghcr.io/fluxcd/kustomize-controller:v1.8.4` Supported architectures: `linux/amd64`, `linux/arm64` and `linux/arm/v7`. The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the [security documentation](https://fluxcd.io/flux/security/). </details> <details> <summary>fluxcd/notification-controller (ghcr.io/fluxcd/notification-controller)</summary> ### [`v1.8.4`](https://github.com/fluxcd/notification-controller/releases/tag/v1.8.4) [Compare Source](fluxcd/notification-controller@v1.8.3...v1.8.4) #### Changelog [v1.8.4 changelog](https://github.com/fluxcd/notification-controller/blob/v1.8.4/CHANGELOG.md) #### Container images - `docker.io/fluxcd/notification-controller:v1.8.4` - `ghcr.io/fluxcd/notification-controller:v1.8.4` Supported architectures: `linux/amd64`, `linux/arm64` and `linux/arm/v7`. The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the [security documentation](https://fluxcd.io/flux/security/). </details> <details> <summary>fluxcd/source-controller (ghcr.io/fluxcd/source-controller)</summary> ### [`v1.8.5`](https://github.com/fluxcd/source-controller/releases/tag/v1.8.5) [Compare Source](fluxcd/source-controller@v1.8.4...v1.8.5) #### Changelog [v1.8.5 changelog](https://github.com/fluxcd/source-controller/blob/v1.8.5/CHANGELOG.md) #### Container images - `docker.io/fluxcd/source-controller:v1.8.5` - `ghcr.io/fluxcd/source-controller:v1.8.5` Supported architectures: `linux/amd64`, `linux/arm64` and `linux/arm/v7`. The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the [security documentation](https://fluxcd.io/flux/security/). ### [`v1.8.4`](https://github.com/fluxcd/source-controller/releases/tag/v1.8.4) [Compare Source](fluxcd/source-controller@v1.8.3...v1.8.4) #### Changelog [v1.8.4 changelog](https://github.com/fluxcd/source-controller/blob/v1.8.4/CHANGELOG.md) #### Container images - `docker.io/fluxcd/source-controller:v1.8.4` - `ghcr.io/fluxcd/source-controller:v1.8.4` Supported architectures: `linux/amd64`, `linux/arm64` and `linux/arm/v7`. The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the [security documentation](https://fluxcd.io/flux/security/). ### [`v1.8.3`](https://github.com/fluxcd/source-controller/releases/tag/v1.8.3) [Compare Source](fluxcd/source-controller@v1.8.2...v1.8.3) #### Changelog [v1.8.3 changelog](https://github.com/fluxcd/source-controller/blob/v1.8.3/CHANGELOG.md) #### Container images - `docker.io/fluxcd/source-controller:v1.8.3` - `ghcr.io/fluxcd/source-controller:v1.8.3` Supported architectures: `linux/amd64`, `linux/arm64` and `linux/arm/v7`. The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the [security documentation](https://fluxcd.io/flux/security/). </details> <details> <summary>kedacore/keda (keda)</summary> ### [`v2.20.0`](https://github.com/kedacore/keda/blob/HEAD/CHANGELOG.md#v2200) [Compare Source](kedacore/keda@v2.19.0...v2.20.0) ##### New - **General**: Add `scalingModifiers` fallback behavior ([#​7366](kedacore/keda#7366)) - **General**: Introduce Elastic Forecast Scaler ([#​7494](kedacore/keda#7494)) - **General**: Introduce new OpenSearch Scaler ([#​7456](kedacore/keda#7456)) ##### Improvements - **General**: Add cooldownPeriod and pollingInterval checks for ScaledObject ([#​7271](kedacore/keda#7271)) - **General**: Add CRD-level validation markers (Minimum, MinLength, MinItems, Enum) for ScaledObject, ScaledJob, ScaleTriggers, and TriggerAuthentication API types ([#​7533](kedacore/keda#7533)) - **General**: Add `--leader-election-id` flag to allow configuring the leader election Lease name ([#​7564](kedacore/keda#7564)) - **General**: Add scaler HTTP request metrics (`keda_scaler_http_requests_total`, `keda_scaler_http_request_duration_seconds`) for outbound HTTP requests made during scaler metric collection ([#​6600](kedacore/keda#6600)) - **General**: Allow more control of TLS versions & ciphers via `KEDA_HTTP_TLS_CIPHER_LIST`, `KEDA_SERVICE_TLS_CIPHER_LIST` and `KEDA_SERVICE_MIN_TLS_VERSION` env vars ([#​7617](kedacore/keda#7617)) - **General**: Cap each scalers-cache reader at a per-reader budget derived from `globalHTTPTimeout` so `ScalersCache.Close` cannot block indefinitely ([#​7574](kedacore/keda#7574)) - **General**: Make APIService cert injections optional ([#​7559](kedacore/keda#7559)) - **General**: Remove unconditional `json.MarshalIndent` calls from admission webhook validation hot paths; replace spec-comparison `MarshalIndent`-and-string-compare in `isRemovingFinalizer` variants with `reflect.DeepEqual`. Prevents webhook OOM under sustained admission load at large scale (observed at \~60k ScaledObjects) ([#​7670](kedacore/keda#7670)) - **AWS Scalers**: Add support for AWS External ID in TriggerAuthentication podIdentity for all AWS scalers (SQS, Kinesis, DynamoDB, CloudWatch, etc.) to enable cross-account access scenarios ([#​6921](kedacore/keda#6921)) - **Elasticsearch Scaler**: Add HTTP status check for Elasticsearch errors ([#​7480](kedacore/keda#7480)) - **Github Runner Scaler**: Handle rate limit errors by respecting X-RateLimit-Reset and Retry-After headers and returning cached queue length ([#​7683](kedacore/keda#7683)) - **Kubernetes Workload Scaler**: Add `groupByNode` parameter ([#​7628](kedacore/keda#7628)) - **Metrics API Scaler**: Add custom HTTP client timeout ([#​7549](kedacore/keda#7549)) - **MSSQL Scaler**: Add Azure Workload Identity support for Azure SQL authentication ([#​6104](kedacore/keda#6104)) - **Prometheus Scaler**: Emit metric tracking empty responses from Prometheus ([#​7062](kedacore/keda#7062)) - **RabbitMQ Scaler**: Add support for OAuth2 authentication for RabbitMQ over HTTP ([#​7379](kedacore/keda#7379)) - **Temporal Scaler**: Add support for scaling based on Worker Deployment Version backlog via new `workerDeploymentName` and `workerDeploymentBuildId` fields. Deprecate `buildId`, `selectAllActive`, and `selectUnversioned` because those parameters are used for Rules-Based Worker Versioning, which was a short-lived experimental feature that has been deprecated in the Temporal server since December 2024 and will stop being supported soon. Users of Rules-Based Worker Versioning should use Worker Deployments instead. ([#​7672](kedacore/keda#7672)) ##### Fixes - **General**: Check updated status for Fallback condition instead of ScaledObject ([#​7488](kedacore/keda#7488)) - **General**: Fail fast in `GetMetrics` when the gRPC connection is in Shutdown state instead of waiting for context timeout ([#​7251](kedacore/keda#7251)) - **General**: Fix int64 overflow in milli-quantity conversion for very large metric values ([#​7441](kedacore/keda#7441)) - **General**: Fix `keda_scaler_active` not being emitted for CPU and memory triggers ([#​4945](kedacore/keda#4945)) - **General**: Fix misleading namespace in error log when secret access is restricted ([#​7739](kedacore/keda#7739)) - **General**: Fix race in scalers cache rebuild that caused transient scaler errors ([#​7574](kedacore/keda#7574)) - **General**: Fix ScaledJob emitting wrong CloudEvent type (`ScaledObjectReadyType` instead of `ScaledJobReadyType`) when transitioning to ready state ([#​7792](kedacore/keda#7792)) - **General**: Fix ScaledObject admission webhook to return validation error from `verifyReplicaCount`, preventing invalid ScaledObjects from being created ([#​5954](kedacore/keda#5954)) - **General**: Fix ScaledObject Ready condition not reflecting HPA status ([#​7649](kedacore/keda#7649)) - **General**: Handle paused scaling directly in reconciler ([#​7663](kedacore/keda#7663)) - **General**: Honor `stderrthreshold` when `logtostderr` is enabled by updating klog to v2.140.0 ([#​7568](kedacore/keda#7568)) - **General**: Limit projected service account token reads during Vault authentication ([#​7783](kedacore/keda#7783)) - **General**: Reject ScaledObject creation and update when the name exceeds 63 characters ([#​6998](kedacore/keda#6998)) - **AWS Scalers**: Fix TCP connection leak by closing HTTP idle connections on scaler `Close()` for SQS, Kinesis, DynamoDB, DynamoDB Streams, and CloudWatch scalers ([#​7756](kedacore/keda#7756)) - **Azure Data Explorer Scaler**: Remove clientSecretFromEnv support ([#​7554](kedacore/keda#7554)) - **Azure Event Hub Scaler**: Reject non-positive `unprocessedEventThreshold` to prevent integer division by zero when computing lag ([#​7732](kedacore/keda#7732)) - **Azure Pipelines Scaler**: Exclude already-assigned jobs from queue length ([#​7747](kedacore/keda#7747)) - **Cron Scaler**: Fix metric name generation so cron expressions with comma-separated values no longer produce invalid metric names ([#​7448](kedacore/keda#7448)) - **External Scaler**: gRPC Pool uses TLS context in the key ([#​7687](kedacore/keda#7687)) - **Forgejo Scaler**: Limit HTTP error response logging ([#​7469](kedacore/keda#7469)) - **Forgejo Scaler**: Return correct activity to enable scale-to-zero ([#​7527](kedacore/keda#7527)) - **GCP Cloud Tasks Scaler**: Implement escapeFilterValue for metric filtering ([#​7482](kedacore/keda#7482)) - **GCP Scaler**: Validate Pub/Sub resource name in BuildMQLQuery ([#​7468](kedacore/keda#7468)) - **GCP Storage Scaler**: Metadata is not printed in the log ([#​7688](kedacore/keda#7688)) - **Github Runner Scaler**: Bound etag and per-repo caches to prevent unbounded memory growth when `enableEtags` is on ([#​7685](kedacore/keda#7685)) - **Github Runner Scaler**: Improve URL construction and error handling ([#​7495](kedacore/keda#7495)) - **Github Runner Scaler**: Limit HTTP error response logging ([#​7469](kedacore/keda#7469)) - **InfluxDB Scaler**: Make `authToken` optional to support unauthenticated InfluxDB instances ([#​7616](kedacore/keda#7616)) - **Loki Scaler**: Limit HTTP error response logging ([#​7469](kedacore/keda#7469)) - **Loki Scaler**: `serverAddress` now appends `/loki/api/v1/query` to the end of existing path instead of overriding ([#​7648](kedacore/keda#7648)) - **Metrics API Scaler**: Fix `aggregateFromKubeServiceEndpoints` using empty label selector that matched all EndpointSlices in the namespace instead of only the target service's ([#​7641](kedacore/keda#7641)) - **Metrics API Scaler**: Fix division by zero in average aggregation when all kube service endpoints fail ([#​7742](kedacore/keda#7742)) - **Metrics API Scaler**: Prevent response value reflection in scaler errors ([#​7693](kedacore/keda#7693)) - **NATS JetStream Scaler**: Return an error from `getMaxMsgLag` when the configured consumer is missing instead of falling back to the stream's last sequence, preventing incorrect scale-up to `maxReplicaCount` ([#​7657](kedacore/keda#7657)) - **NATS JetStream Scaler**: URL-encode user input in monitoring URL construction ([#​7483](kedacore/keda#7483)) - **PostgreSQL Scaler**: Quote whitespace-containing connection parameters in generated connection strings ([#​7784](kedacore/keda#7784)) - **PredictKube Scaler**: Bump `dysnix/predictkube-libs` to `v0.1.0` (drops the predictkube path to the archived/EOL `go-grpc-prometheus` and to the deprecated `golang/protobuf`) and use a portable Prometheus-API instant query for the health check so the scaler works against VictoriaMetrics, Thanos and other Prometheus-API-compatible backends ([#​7745](kedacore/keda#7745)) - **Prometheus Scaler**: Handle NaN results in the same manner as Inf ([#​7475](kedacore/keda#7475)) - **Prometheus Scaler**: Limit HTTP error response logging ([#​7469](kedacore/keda#7469)) - **Pulsar Scaler**: Drop bearer/basic auth headers on redirects to a different host or on https->http downgrades to prevent credential leakage ([#​7686](kedacore/keda#7686)) - **RabbitMQ Scaler**: Fix AMQP connection leak by recovering channels on the existing connection and closing connections properly ([#​6266](kedacore/keda#6266)) - **RabbitMQ Scaler**: Use SASL EXTERNAL for RabbitMQ AMQP TLS without credentials ([#​6840](kedacore/keda#6840)) - **Redis Scaler**: Use literal command names in Lua script to fix compatibility with Alibaba Cloud Redis Cluster ([#​7758](kedacore/keda#7758)) - **Solace Scaler**: Fix URL escaping for Message VPN and Queue names ([#​7481](kedacore/keda#7481)) - **Solr Scaler**: Use net/url to safely encode query parameters ([#​7467](kedacore/keda#7467)) - **Splunk Observability Scaler**: Add MTS stream handling with context timeout ([#​7799](kedacore/keda#7799)) ##### Deprecations You can find all deprecations in [this overview](https://github.com/kedacore/keda/issues?q=is%3Aissue+is%3Aopen+sort%3Aupdated-desc+label%3Abreaking-change) and [join the discussion here](https://github.com/kedacore/keda/discussions/categories/deprecations). ##### Breaking Changes - **GCP PubSub Scaler**: The `subscriptionSize` setting is DEPRECATED and is removed in v2.20 - Use `mode` and `value` instead ([#​7720](kedacore/keda#7720)) - **Huawei Cloudeye Scaler**: The `minMetricValue` setting is DEPRECATED and is removed - Use `activationTargetMetricValue` instead ([#​7436](kedacore/keda#7436)) - **IBM MQ Scaler**: The `tls` setting code is removed ([#​6094](kedacore/keda#6094)) - **InfluxDB Scaler**: The `authToken` setting from `triggerMetadata` is DEPRECATED and is removed in v2.20 - Use `authToken` from `resolvedEnv` or `authParams` instead ([#​7722](kedacore/keda#7722)) ##### Other - **General**: Migrate event recording RBAC from core `events` to `events.k8s.io` ([#​7781](kedacore/keda#7781)) - **General**: Migrate metrics service gRPC response away from Kubernetes API protobuf types for Kubernetes 0.35 ([#​7781](kedacore/keda#7781)) - **General**: Remove dead code from authentication package and drop unused `authModes` field from ArangoDB, Loki, Prometheus and PredictKube scalers ([#​7726](kedacore/keda#7726)) - **General**: Use informer cache for ReplicaSet lookups in GetCurrentReplicas to reduce API server load ([#​7466](kedacore/keda#7466)) - **External Scaler**: Fix race condition in `TestWaitForState` causing flaky test under `-race` detector ([#​7542](kedacore/keda#7542)) - **GCP Scaler**: Replace `credentialsFromJSON` with `credentialsFromJSONWithType` ([#​7523](kedacore/keda#7523)) - **Kafka Scaler**: Refactor Kafka Scaler ([#​7528](kedacore/keda#7528)) </details> <details> <summary>renovatebot/renovate (renovate/renovate)</summary> ### [`v43.209.2`](https://github.com/renovatebot/renovate/releases/tag/43.209.2) [Compare Source](renovatebot/renovate@43.209.1...43.209.2) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.55.6 (main) ([#​43751](renovatebot/renovate#43751)) ([160e9f9](renovatebot/renovate@160e9f9)) </details> <details> <summary>VictoriaMetrics/helm-charts (victoria-metrics-k8s-stack)</summary> ### [`v0.81.0`](https://github.com/VictoriaMetrics/helm-charts/releases/tag/victoria-metrics-k8s-stack-0.81.0) [Compare Source](VictoriaMetrics/helm-charts@victoria-metrics-k8s-stack-0.80.0...victoria-metrics-k8s-stack-0.81.0) ### Release notes for version 0.81.0 **Release date:** 28 May 2026   **Update note 1**: `defaultRules.create` is renamed to `defaultRules.enabled`; per-group `create` is renamed to `enabled`. Old `create` key is still respected as a fallback if `enabled` is not set. **Update note 2**: `defaultRules.additionalGroupByLabels` is renamed to `defaultRules.extraGroupByLabels`. Old `additionalGroupByLabels` is still respected as a fallback if `extraGroupByLabels` is not set. - rename `defaultRules.create` and per-group `create` to `enabled`, with fallback to `create` for backward compatibility. - add per-group extraGroupByLabels, that replace defaultRules.extraGroupByLabels (if absent defaults to defaultRules.additionalGroupByLabels). See [#​2832](VictoriaMetrics/helm-charts#2832). ### [`v0.80.0`](https://github.com/VictoriaMetrics/helm-charts/releases/tag/victoria-metrics-k8s-stack-0.80.0) [Compare Source](VictoriaMetrics/helm-charts@victoria-metrics-k8s-stack-0.79.1...victoria-metrics-k8s-stack-0.80.0) ### Release notes for version 0.80.0 **Release date:** 25 May 2026   - bump version of VM components to [v1.144.0](https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.144.0) ### [`v0.79.1`](https://github.com/VictoriaMetrics/helm-charts/releases/tag/victoria-metrics-k8s-stack-0.79.1) [Compare Source](VictoriaMetrics/helm-charts@victoria-metrics-k8s-stack-0.79.0...victoria-metrics-k8s-stack-0.79.1) ### Release notes for version 0.79.1 **Release date:** 20 May 2026   - support Grafana HTTPRoute when resolving grafanaAddr - bump operator dependency chart to version 0.63.1 ### [`v0.79.0`](https://github.com/VictoriaMetrics/helm-charts/releases/tag/victoria-metrics-k8s-stack-0.79.0) [Compare Source](VictoriaMetrics/helm-charts@victoria-metrics-k8s-stack-0.78.0...victoria-metrics-k8s-stack-0.79.0) ### Release notes for version 0.79.0 **Release date:** 18 May 2026   - bump victoria-metrics-operator dependency chart to version 0.63.0 - bump grafana dependency chart to version 12.3.3 - bump node-exporter dependency chart to version 4.55.0 ### [`v0.78.0`](https://github.com/VictoriaMetrics/helm-charts/releases/tag/victoria-metrics-k8s-stack-0.78.0) [Compare Source](VictoriaMetrics/helm-charts@victoria-metrics-k8s-stack-0.77.0...victoria-metrics-k8s-stack-0.78.0) ### Release notes for version 0.78.0 **Release date:** 11 May 2026   - bump version of VM components to [v1.143.0](https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.143.0) - fix Alertmanager templates path to match VM Operator mount. See [#​2883](VictoriaMetrics/helm-charts#2883). ### [`v0.77.0`](https://github.com/VictoriaMetrics/helm-charts/releases/tag/victoria-metrics-k8s-stack-0.77.0) [Compare Source](VictoriaMetrics/helm-charts@victoria-metrics-k8s-stack-0.76.0...victoria-metrics-k8s-stack-0.77.0) ### Release notes for version 0.77.0 **Release date:** 03 May 2026   - set default securityContext for Alertmanager, when persistence is enabled to prevent from permissions issues. See [#​2846](VictoriaMetrics/helm-charts#2846). - default operator `admissionWebhooks.policy` to `Ignore` so the stack can be installed and upgraded in a single pass without races against the operator's webhook server. Override to `Fail` for strict validation. See [#​2874](VictoriaMetrics/helm-charts#2874). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMDkuMSIsInVwZGF0ZWRJblZlciI6IjQzLjIwOS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://forgejo.maio-tech.com/Sammy/Servers/pulls/2
shcherbak
pushed a commit
to shcherbak/keda
that referenced
this pull request
Jun 3, 2026
* bump deps Signed-off-by: Zbynek Roubalik <zroubalik@gmail.com> * update clientset Signed-off-by: Zbynek Roubalik <zroubalik@gmail.com> * manifests Signed-off-by: Zbynek Roubalik <zroubalik@gmail.com> * fix lint: replace deprecated `record.EventRecorder` Signed-off-by: Zbynek Roubalik <zroubalik@gmail.com> * fix: update Prometheus parser to use UTF8Validation Signed-off-by: Zbynek Roubalik <zroubalik@gmail.com> * fix rebase Signed-off-by: Zbynek Roubalik <zroubalik@gmail.com> * moar Signed-off-by: Zbynek Roubalik <zroubalik@gmail.com> * RBAC change from "events" to "events.k8s.io" Signed-off-by: Zbynek Roubalik <zroubalik@gmail.com> * Fix metrics gRPC response proto for Kubernetes 0.35 Signed-off-by: Zbynek Roubalik <zroubalik@gmail.com> * changelog update Signed-off-by: Zbynek Roubalik <zroubalik@gmail.com> * fix(test): use UTF8Validation in expfmt.NewTextParser for metric tests Mirrors 25674df (which fixed pkg/scalers/metrics_api_scaler.go) for the two e2e test files that still construct expfmt.TextParser{} directly. prometheus/common v0.66 removed the no-arg TextParser zero value as a valid usage; calling TextToMetricFamilies on a parser without an explicit NameValidationScheme now panics with "Invalid name validation scheme requested: unset". Both TestPrometheusMetrics and TestOpenTelemetryMetrics hit this on every run in the PR e2e (deterministic, not a flake). Signed-off-by: Jan Wozniak <wozniak.jan@gmail.com> * fix(test): query events.k8s.io in events_test (post-recorder migration) After c479867 migrated cmd/operator/main.go from mgr.GetEventRecorderFor (record.EventRecorder, writes core/events) to mgr.GetEventRecorder (events.EventRecorder, writes events.k8s.io), KEDA no longer emits to the legacy core/events API. The internals/events test was still polling with 'kubectl get events --field-selector involvedObject.name=<so>', which is core/events-only; events.k8s.io rows do not match that selector. The test would therefore time out waiting for events that exist on the new API but are invisible to the old query. Switch to: kubectl get events.events.k8s.io --field-selector regarding.name=<so> -o jsonpath={.items[N].reason}:{.items[N].note} Field mapping per k8s.io/api/events/v1.Event: involvedObject -> regarding message -> note reason -> unchanged Signed-off-by: Jan Wozniak <wozniak.jan@gmail.com> * fix(test): filter events by regarding.uid in checkingEvent run-all.go retries failed tests up to 3 times in fresh `go test` invocations. Between attempts, events from the previous SO incarnation can still match `--field-selector regarding.name=<so>` because the selector is name-only. With negative jsonpath indices ([-1]/[-2]) this makes the assertion latch onto the wrong event and the test fails. Look up the current resource's UID and add `regarding.uid=<uid>` to the field selector. Falls back to name-only if the lookup misses, preserving prior behavior when the resource is mid-create or already deleted. Signed-off-by: Jan Wozniak <wozniak.jan@gmail.com> * fix(eventemitter): pass message as action so distinct notes survive dedup The events.k8s.io broadcaster's aggregation key is (eventType, action, reason, reportingController, reportingInstance, regarding) — it does NOT include note. When Emit passed reason as both reason and action, two calls with the same reason but different notes (e.g. ScaleTargetErrMsg and ScaleTargetNoSubresourceMsg under reason=ScaledObjectCheckFailed) collided in the dedup key. The broadcaster kept the first note's record and silently incremented series.count for subsequent emissions, dropping the second note entirely. This made events_test's assertions on the "spec" note impossible to satisfy on PR 7781. Pass the message itself as action, so distinct notes get distinct aggregation keys and each surfaces as its own event record. Signed-off-by: Jan Wozniak <wozniak.jan@gmail.com> --------- Signed-off-by: Zbynek Roubalik <zroubalik@gmail.com> Signed-off-by: Jan Wozniak <wozniak.jan@gmail.com> Co-authored-by: Jan Wozniak <wozniak.jan@gmail.com> Signed-off-by: Yurii Shcherbak <ju.shcherbak@gmail.com>
shcherbak
pushed a commit
to shcherbak/keda
that referenced
this pull request
Jun 3, 2026
) The events e2e test asserted events at fixed positions in a list sorted by .metadata.creationTimestamp. KEDA emits several events for a single ScaledObject/ScaledJob within the same second, and events.k8s.io creationTimestamp only has 1s granularity, so same-second events sort non-deterministically. After kedacore#7781 migrated event recording to events.k8s.io, "Started scalers watch" [1] and "ScaledJob is ready for scaling" [2] started swapping positions, failing the test every night. Match the expected reason/note pair against any event emitted for the resource instead of a fixed index, removing the ordering dependency. Signed-off-by: Jan Wozniak <wozniak.jan@gmail.com> Signed-off-by: Yurii Shcherbak <ju.shcherbak@gmail.com>
shcherbak
pushed a commit
to shcherbak/keda
that referenced
this pull request
Jun 3, 2026
…ration (kedacore#7808) kedacore#7755 added TestGetScaledObjectStateRecordsResourceScalerActiveMetric and TestGetScaledObjectStateSkipsResourceScalerActiveMetricWithModifiers using record.NewFakeRecorder. In the meantime kedacore#7781 migrated this file to the events recorder and dropped the k8s.io/client-go/tools/record import, so the merged result fails to compile with "undefined: record", breaking the unit-test build and Static Checks on main. Use events.NewFakeRecorder, matching the rest of the file and the events.EventRecorder type of the Recorder/recorder fields. Signed-off-by: Jan Wozniak <wozniak.jan@gmail.com> Signed-off-by: Yurii Shcherbak <ju.shcherbak@gmail.com>
1 task
Fedosin
added a commit
to Fedosin/keda-olm-operator
that referenced
this pull request
Jul 19, 2026
Since KEDA 2.20.0 the bundled release manifests grant the keda-operator the 'events' resource only on the events.k8s.io API group (kedacore/keda#7781). However client-go's event broadcaster still writes events to the core ("") API group as well (kubernetes/kubernetes#94857), so with only events.k8s.io granted, event recording — including controller-runtime leader-election events and ScaledObject events such as ScaledObjectReady, KEDAScalersStarted and ScaledObjectCheckFailed — is denied with "events is forbidden". Restore the core "" API group alongside events.k8s.io on the keda-operator ClusterRole in resources/keda.yaml, and add an idempotent post-download awk patch in hack/relprep.sh so the fix is reapplied on future KEDA version syncs until the upstream KEDA manifest is corrected. Signed-off-by: Mikhail Fedosin <mfedosin@redhat.com>
linkvt
added a commit
to linkvt/kedacore-keda
that referenced
this pull request
Jul 20, 2026
The kubebuilder RBAC marker only listed events.k8s.io, but client-go's
event broadcaster also writes events to the legacy core ("") API group.
This caused "events is forbidden" errors for the keda-operator service
account, breaking all native Kubernetes event recording.
Regression introduced in kedacore#7781 (v2.20.0).
Changes:
- Add core ("") API group to events RBAC marker in scaledobject_controller.go
- Regenerate config/rbac/role.yaml
- Add CHANGELOG entry
Signed-off-by: Vincent Link <vlink@redhat.com>
linkvt
added a commit
to linkvt/kedacore-keda
that referenced
this pull request
Jul 20, 2026
The kubebuilder RBAC marker only listed events.k8s.io, but client-go's
event broadcaster also writes events to the legacy core ("") API group.
This caused "events is forbidden" errors for the keda-operator service
account, breaking all native Kubernetes event recording.
Regression introduced in kedacore#7781 (v2.20.0).
Changes:
- Add core ("") API group to events RBAC marker in scaledobject_controller.go
- Regenerate config/rbac/role.yaml
- Add CHANGELOG entry
Signed-off-by: Vincent Link <vlink@redhat.com>
3 tasks
wozniakjan
pushed a commit
that referenced
this pull request
Jul 30, 2026
…7923) The kubebuilder RBAC marker only listed events.k8s.io, but client-go's event broadcaster also writes events to the legacy core ("") API group. This caused "events is forbidden" errors for the keda-operator service account, breaking all native Kubernetes event recording. Regression introduced in #7781 (v2.20.0). Changes: - Add core ("") API group to events RBAC marker in scaledobject_controller.go - Regenerate config/rbac/role.yaml - Add CHANGELOG entry Signed-off-by: Vincent Link <vlink@redhat.com>
wozniakjan
added a commit
that referenced
this pull request
Jul 31, 2026
* fix: add "default" to ScaledJob scalingStrategy.strategy CRD enum (#7858) * fix: add "default" to ScaledJob scalingStrategy.strategy CRD enum The CRD validation for ScaledJob.spec.scalingStrategy.strategy was missing "default" as a valid value, despite the docs listing it as valid. The runtime already handles empty/"default" via the switch default case; this aligns the CRD enum to match the documented behavior. Fixes #7855 Signed-off-by: Goutham Annem <gouthemannem@gmail.com> * Apply suggestions from code review Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Jan Wozniak <wozniak.jan@gmail.com> --------- Signed-off-by: Goutham Annem <gouthemannem@gmail.com> Signed-off-by: Jan Wozniak <wozniak.jan@gmail.com> Co-authored-by: Jan Wozniak <wozniak.jan@gmail.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> (cherry picked from commit b4fc3fb) * fix(metricsservice): restore gRPC reconnect backoff (#7857) WithConnectParams replaces grpc-go's default backoff with the supplied Backoff field; leaving it unset zeroed the backoff and caused a zero-delay reconnect loop that floods the metrics-apiserver logs when keda-operator is unreachable. Set Backoff to grpc's DefaultConfig. Signed-off-by: Chris Kandalaft <chris.kandalaft@affinity.co> Signed-off-by: Jan Wozniak <wozniak.jan@gmail.com> Co-authored-by: Jan Wozniak <wozniak.jan@gmail.com> (cherry picked from commit ee8a4dd) * fix(scaling): guard GetCurrentReplicas against nil ScaleTargetGVKR (#7661) When the informer cache races with ScaledObject creation, scaledObject.Status.ScaleTargetGVKR can be nil at the point the scale loop invokes GetCurrentReplicas. The current code then dereferences .Group / .Kind on a nil pointer and panics, taking down the operator. This applies the same defensive pattern already used in ResolveScaleTargetPodSpec: re-fetch the ScaledObject via the client when Status.ScaleTargetGVKR is nil, and if it is still nil after re-fetch, return a descriptive error instead of panicking. Observed in a 10k-ScaledObject KWOK load test where kube-burner created ScaledObjects at 10/s; the cache-race window opened wide enough that the panic fired reliably within the first 750 objects. Refs: #4389, #4955, #6176 Signed-off-by: Greg Garber <ggarb@netflix.com> Signed-off-by: Rick Brouwer <rickbrouwer@gmail.com> Signed-off-by: Zbynek Roubalik <zroubalik@gmail.com> Co-authored-by: Rick Brouwer <rickbrouwer@gmail.com> Co-authored-by: Zbynek Roubalik <zroubalik@gmail.com> (cherry picked from commit c5b577c) * Fix nil pointer dereference in customScalingStrategy (#7871) Add nil guards for CustomScalingQueueLengthDeduction (*int32) and CustomScalingRunningJobPercentage (*float64) in customScalingStrategy.GetEffectiveMaxScale. The CustomScalingQueueLengthDeduction field is declared with omitempty in the CRD spec, so it is nil whenever a ScaledJob is created without setting it. Previously the method unconditionally dereferenced the pointer, causing the controller goroutine to panic with a nil pointer dereference and interrupting the ScaledJob reconciliation loop. A nil deduction is now treated as zero, consistent with how the running job percentage is handled. A regression test is added that exercises both the direct struct path and the NewScalingStrategy factory path with the deduction omitted. Fixes #7798 Signed-off-by: itxaiohanglover <1531137510@qq.com> (cherry picked from commit f193c7f) * fix(azure-blob): strip leading slash from globPattern before matching (#7876) Azure Storage blob names never include a leading "/", but users naturally write path-style patterns like "/folder/sub/*.json". The gobwas/glob library treats a leading "/" in the pattern literally, so such patterns never matched any blob and the scaler silently never activated, regardless of single or double asterisk usage. Strip a leading "/" from the pattern before compiling it. Fixes #6492 Signed-off-by: Goutham Annem <gouthemannem@gmail.com> (cherry picked from commit 3a4a73e) * Fix(scaler): Guard against negative metric returned in scaler.go (#7889) * Guard against negative metric returned Signed-off-by: dttung2905 <ttdao.2015@accountancy.smu.edu.sg> * Update comment Signed-off-by: dttung2905 <ttdao.2015@accountancy.smu.edu.sg> --------- Signed-off-by: dttung2905 <ttdao.2015@accountancy.smu.edu.sg> (cherry picked from commit 01cee0f) * fix(mongo): disconnect client when initial Ping fails (#7904) mongo.Connect starts background topology-monitoring connections to the replica-set members before Ping runs. When Ping fails, createMongoDBClient returned the error while discarding the just-created client as a local variable, so nothing ever called Disconnect on it and those background connections ran forever. Every failed scaler poll (a transient network blip, an Atlas maintenance event, or the cluster already being loaded by prior leaks) permanently leaked one more client, with no backoff or cap. Disconnect the client on the Ping error path so the connections are torn down. Relates to #5612 Signed-off-by: orfeldman-evolinq <or@evolinq.io> (cherry picked from commit 6f589e7) * fix: Fix concurrent map writes panic in the shared root CA `CertPool` (#7911) * fix: Fix concurrent map writes panic in the shared root CA `CertPool` Signed-off-by: bojan <bnzelic@gmail.com> * fix: Fix concurrent map writes panic in the shared root CA `CertPool` Signed-off-by: bojan <bnzelic@gmail.com> * clone CA certs instead of utilizing locks Signed-off-by: bojan <bnzelic@gmail.com> --------- Signed-off-by: bojan <bnzelic@gmail.com> Co-authored-by: Zbynek Roubalik <zroubalik@gmail.com> (cherry picked from commit ed8f3db) * keda-operator: fix nil ptr dereference on uninitialized Deployment spec replicas (#7925) Signed-off-by: Jan Wozniak <wozniak.jan@gmail.com> (cherry picked from commit ed5758d) * feat: move HPA health signal off Ready into a dedicated HPAActive condition (#7928) * feat: move HPA health signal to dedicated HPAActive condition Ready no longer reflects HPA runtime state; HPA health is now surfaced on a dedicated HPAActive condition mirroring the HPA's ScalingActive. Signed-off-by: Your Name <vv162370@email.com> Signed-off-by: vishnu97770 <vv162370@gmail.com> * fix: address review feedback on HPAActive condition - getHPAHealth returns a tri-state; unobservable HPA leaves HPAActive untouched - preserve the HPA condition's own message on HPAActive - surface ScalingDisabled as a distinct HPAActive reason - add unit tests for the new condition helpers Signed-off-by: vishnu97770 <vv162370@gmail.com> * fix: pass HPA condition reason through as HPAActive reason Downstream tooling can filter on the specific HPA reason (e.g. FailedGetExternalMetric) rather than parsing it out of the message. HPAMetricsUnavailable remains the fallback when the HPA reports no reason. Signed-off-by: vishnu97770 <vv162370@gmail.com> --------- Signed-off-by: Your Name <vv162370@email.com> Signed-off-by: vishnu97770 <vv162370@gmail.com> (cherry picked from commit b1e8ee5) * fix: grant events permission on both core and events.k8s.io groups (#7923) The kubebuilder RBAC marker only listed events.k8s.io, but client-go's event broadcaster also writes events to the legacy core ("") API group. This caused "events is forbidden" errors for the keda-operator service account, breaking all native Kubernetes event recording. Regression introduced in #7781 (v2.20.0). Changes: - Add core ("") API group to events RBAC marker in scaledobject_controller.go - Regenerate config/rbac/role.yaml - Add CHANGELOG entry Signed-off-by: Vincent Link <vlink@redhat.com> (cherry picked from commit 5b81441) * Share HTTP Transport across HTTP clients to avoid leaking connections (#7941) * fix(http): share transports across scaler clients Signed-off-by: Ali Aqel <aliaqel@stripe.com> * refactor(http): simplify transport configuration Signed-off-by: Ali Aqel <aliaqel@stripe.com> * Update pkg/util/http.go Co-authored-by: Jan Wozniak <wozniak.jan@gmail.com> Signed-off-by: aliaqel-stripe <120822631+aliaqel-stripe@users.noreply.github.com> * fix(http): apply idle timeout consistently Signed-off-by: Ali Aqel <aliaqel@stripe.com> * test(http): use valid transport configuration Signed-off-by: Ali Aqel <aliaqel@stripe.com> * refactor(http): simplify keep-alive configuration Signed-off-by: Ali Aqel <aliaqel@stripe.com> * refactor(http): initialize keep-alive setting inline Signed-off-by: Ali Aqel <aliaqel@stripe.com> * fix(http): share transports returned by CreateRT Signed-off-by: Ali Aqel <aliaqel@stripe.com> * fix(http): close dedicated custom TLS transports Signed-off-by: Ali Aqel <aliaqel@stripe.com> * refactor(http): apply pool config in transport constructor Signed-off-by: Ali Aqel <aliaqel@stripe.com> * fix(http): require positive idle connection timeout Signed-off-by: Ali Aqel <aliaqel@stripe.com> * refactor(http): remove shared transport wrapper Signed-off-by: Ali Aqel <aliaqel@stripe.com> * refactor(http): type custom transports as closeable Signed-off-by: Ali Aqel <aliaqel@stripe.com> * refactor(http): colocate closeable transport interface Signed-off-by: Ali Aqel <aliaqel@stripe.com> --------- Signed-off-by: Ali Aqel <aliaqel@stripe.com> Signed-off-by: aliaqel-stripe <120822631+aliaqel-stripe@users.noreply.github.com> Co-authored-by: Jan Wozniak <wozniak.jan@gmail.com> (cherry picked from commit 4bd9fe1) * fix: guard nil credentials in AWS Secret Manager TriggerAuthentication handler (#7932) Signed-off-by: sobol4156 <sobol4156@gmail.com> (cherry picked from commit 503abe3) * chore: prepare changelog for v2.20.2 release Signed-off-by: Jan Wozniak <wozniak.jan@gmail.com> --------- Signed-off-by: Goutham Annem <gouthemannem@gmail.com> Signed-off-by: Jan Wozniak <wozniak.jan@gmail.com> Signed-off-by: Chris Kandalaft <chris.kandalaft@affinity.co> Signed-off-by: Greg Garber <ggarb@netflix.com> Signed-off-by: Rick Brouwer <rickbrouwer@gmail.com> Signed-off-by: Zbynek Roubalik <zroubalik@gmail.com> Signed-off-by: itxaiohanglover <1531137510@qq.com> Signed-off-by: dttung2905 <ttdao.2015@accountancy.smu.edu.sg> Signed-off-by: orfeldman-evolinq <or@evolinq.io> Signed-off-by: bojan <bnzelic@gmail.com> Signed-off-by: Your Name <vv162370@email.com> Signed-off-by: vishnu97770 <vv162370@gmail.com> Signed-off-by: Vincent Link <vlink@redhat.com> Signed-off-by: Ali Aqel <aliaqel@stripe.com> Signed-off-by: aliaqel-stripe <120822631+aliaqel-stripe@users.noreply.github.com> Signed-off-by: sobol4156 <sobol4156@gmail.com> Co-authored-by: Goutham-Annem <42384252+Goutham-Annem@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Chris Kandalaft <chris.kandalaft@affinity.co> Co-authored-by: ggarb <148484457+ggarb@users.noreply.github.com> Co-authored-by: Rick Brouwer <rickbrouwer@gmail.com> Co-authored-by: Zbynek Roubalik <zroubalik@gmail.com> Co-authored-by: artboy <80608452+itxaiohanglover@users.noreply.github.com> Co-authored-by: Dao Thanh Tung <ttdao.2015@accountancy.smu.edu.sg> Co-authored-by: orfeldman-evolinq <or@evolinq.io> Co-authored-by: Bojan Zelic <bnzelic@gmail.com> Co-authored-by: V Vishnu <vv162370@gmail.com> Co-authored-by: Vincent Link <linkvt@users.noreply.github.com> Co-authored-by: aliaqel-stripe <120822631+aliaqel-stripe@users.noreply.github.com> Co-authored-by: Alexander Kolesnik <sobol4156@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
events->events.k8s.ioCommit: 092bbe1
This updates KEDA’s event RBAC from the legacy core events resource to events.k8s.io/events.
With the Kubernetes dependency bump, event publishing uses the events.k8s.io API group, so the operator needs > create/patch permissions there to continue recording Kubernetes events successfully.
Helm update: kedacore/charts#858
gRPC contract change
Commit: d1e1d17
This updates the internal metrics gRPC response to use KEDA-owned protobuf messages instead of returning Kubernetes
ExternalMetricValueListAPI structs directly.Kubernetes 0.35 moved API types away from implementing the standard
google.golang.org/protobufmessage interface by default, which can make gRPC’s standard protobuf codec panic when marshalingExternalMetricValueList. The new local response messages mirror the Kubernetes external metrics wire shape while keeping Kubernetes API structs out of the gRPC method signature.