keda

# Default values for keda.

# This is a YAML-formatted file.

# Declare variables to be passed into your templates.

global:

image:

# -- Global image registry of KEDA components

registry: null

# -- DNS config for KEDA components

dnsConfig: {}

# nameservers:

# - 1.2.3.4

# searches:

# - ns1.svc.cluster-domain.example

# - my.dns.search.suffix

# options:

# - name: ndots

# value: "1"

# - name: attempts

# value: "3"

image:

keda:

# -- Image registry of KEDA operator

registry: cgr.dev

# -- Image name of KEDA operator

repository: chainguard-private/keda

# -- Image tag of KEDA operator. Optional, given app version of Helm chart is used by default

tag: 2.21.0-r1@sha256:92e30f50d65cd2e54d52f32fbd1f38c13c51d992a7d29e658b7c73574c614872

metricsApiServer:

# -- Image registry of KEDA Metrics API Server

registry: cgr.dev

# -- Image name of KEDA Metrics API Server

repository: chainguard-private/keda-metrics-apiserver

# -- Image tag of KEDA Metrics API Server. Optional, given app version of Helm chart is used by default

tag: 2.21.0-r1@sha256:f79222ec5652498ba2647d108054c50a3382d2cbeef2976ee23fe04cadd6ae93

webhooks:

# -- Image registry of KEDA admission-webhooks

registry: cgr.dev

# -- Image name of KEDA admission-webhooks

repository: chainguard-private/keda-admission-webhooks

# -- Image tag of KEDA admission-webhooks . Optional, given app version of Helm chart is used by default

tag: 2.21.0-r1@sha256:0fbd35ac85de44f1d79579901cd875882ad58611d70575fc71ce05da17fc26cd

# -- Image pullPolicy for all KEDA components

pullPolicy: Always

# -- Kubernetes cluster name. Used in features such as emitting CloudEvents

clusterName: kubernetes-default

# -- Kubernetes cluster domain

clusterDomain: cluster.local

crds:

# -- Defines whether the KEDA CRDs have to be installed or not.

install: true

# -- Custom annotations specifically for CRDs

additionalAnnotations: {}

# foo: bar

# -- Defines Kubernetes namespaces to watch to scale their workloads. Default watches all namespaces

watchNamespace: ""

# -- Restricts the operator to reconcile only ScaledObjects and ScaledJobs (and their derived

# HorizontalPodAutoscalers) matching the given Kubernetes label selector. Default (empty) means

# no label-based filtering. Mirrors `watchNamespace`, but filters by label instead of by namespace.

# Examples: "environment=production", "tier in (gold,silver)", "!canary"

watchLabelSelector: ""

# -- Restricts the operator to reconcile only TriggerAuthentications and ClusterTriggerAuthentications

# matching the given Kubernetes label selector. Default (empty) means no label-based filtering.

# Decoupled from `watchLabelSelector` so a single cluster-scoped ClusterTriggerAuthentication can be

# shared across operators scoped to different label selectors.

watchLabelSelectorForTriggerauth: ""

# -- Name of secret to use to pull images to use to pull Docker images

imagePullSecrets: []

networkPolicy:

# -- Enable network policies

enabled: false

# -- Flavor of the network policies (cilium, kubernetes)

flavor: "cilium"

# -- Allow use of extra egress rules for cilium network policies

cilium:

operator:

extraEgressRules: []

# -- Allow use of extra egress rules for kubernetes network policies

kubernetes:

operator:

extraEgressRules: []

metricsServer:

extraEgressRules: []

webhooks:

extraEgressRules: []

operator:

serviceAccountTokens:

# -- Token audience policy for Vault and boundServiceAccountToken. When configured as "legacy", it disables enforcement and cannot be combined with configured audiences.

mode: enforce-audience # enforce-audience, legacy

# -- Approved audiences for extra token files; creates no mounts or minting defaults. Use audiences not accepted by kube-apiserver. Combined audience config.

additionalAllowedAudiences: []

# -- Optional endpoint filter, passed as KEDA_OUTBOUND_FILTER. Empty disables filtering. Max 64 KiB.

outboundFilter: {}

# Example policy (replace {} above):

# hashiCorpVault:

# mode: "off" # off, warn, or enforce

# allowedEndpoints: [] # exact HTTP(S) origins; empty denies all in enforce mode

# -- Name of the KEDA operator

name: keda-operator

# -- Additional KEDA Operator container environment variables

env: []

# - name: ENV_NAME

# value: 'ENV-VALUE'

# -- ReplicaSets for this Deployment you want to retain (Default: 10)

revisionHistoryLimit: 10

# -- Capability to configure the number of replicas for KEDA operator.

# While you can run more replicas of our operator, only one operator instance will be the leader and serving traffic.

# You can run multiple replicas, but they will not improve the performance of KEDA, it could only reduce downtime during a failover.

# Learn more in [our documentation](https://keda.sh/docs/latest/operate/cluster/#high-availability).

replicaCount: 1

# --Disable response compression for k8s restAPI in client-go.

# Disabling compression simply means that turns off the process of making data smaller for K8s restAPI in client-go for faster transmission.

disableCompression: true

# -- Port for the gRPC Metrics Service endpoint that the KEDA operator binds to and the metrics server connects to.

metricsServiceTargetPort: 9666

# -- Leader election ID (Lease resource name) for the controller manager. Defaults to operator.keda.sh.

# Override to allow multiple independent KEDA operator deployments in the same namespace.

# leaderElectionID: "operator.keda.sh"

# -- DNS config for KEDA operator pod

dnsConfig: {}

# use ClusterFirstWithHostNet if `useHostNetwork: true` https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy

# -- Defined the DNS policy for the operator

dnsPolicy: ClusterFirst

# -- Enable operator to use host network

useHostNetwork: false

# -- (bool) Sets `hostUsers` on the KEDA operator pod. Leave unset to preserve the cluster default, `false` to run the pod in its own [user namespace](https://kubernetes.io/docs/concepts/workloads/pods/user-namespaces/), or `true` to explicitly use the host user namespace.

hostUsers:

# -- [Affinity] for pod scheduling for KEDA operator. Takes precedence over the `affinity` field

affinity: {}

# podAntiAffinity:

# requiredDuringSchedulingIgnoredDuringExecution:

# - labelSelector:

# matchExpressions:

# - key: app

# operator: In

# values:

# - keda-operator

# topologyKey: "kubernetes.io/hostname"

# -- Additional containers to run as part of the operator deployment

extraContainers: []

# - name: hello-many

# args:

# - -c

# - "while true; do echo hi; sleep 300; done"

# command:

# - /bin/sh

# image: 'busybox:glibc'

# -- Additional init containers to run as part of the operator deployment

extraInitContainers: []

# - name: hello-once

# args:

# - -c

# - "echo 'Hello World!'"

# command:

# - /bin/sh

# image: 'busybox:glibc'

# -- Liveness probes for operator ([docs](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/))

livenessProbe:

initialDelaySeconds: 25

periodSeconds: 10

timeoutSeconds: 1

failureThreshold: 3

successThreshold: 1

# -- Readiness probes for operator ([docs](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-readiness-probes))

readinessProbe:

initialDelaySeconds: 20

periodSeconds: 3

timeoutSeconds: 1

failureThreshold: 3

successThreshold: 1

# -- Node selector for pod scheduling ([docs](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/))

nodeSelector: {}

# -- Tolerations for pod scheduling ([docs](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/))

tolerations: []

# -- Additional timeout beyond the ScaledObject or ScaledJob polling interval for Kubernetes API operations in scaling loops. Setting `0s` uses the polling interval as the timeout; the timeout cannot be disabled

kubernetesApiTimeout: 5s

metricsServer:

# -- Enable KEDA metrics server.

enabled: true

# -- Enable registering KEDA metrics server as external metrics API resource.

registerAPIService: true

# -- Additional Metrics Adapter container environment variables

env: []

# - name: ENV_NAME

# value: 'ENV-VALUE'

# -- ReplicaSets for this Deployment you want to retain (Default: 10)

revisionHistoryLimit: 10

# -- Capability to configure the number of replicas for KEDA metric server.

# While you can run more replicas of our metric server, only one instance will used and serve traffic.

# You can run multiple replicas, but they will not improve the performance of KEDA, it could only reduce downtime during a failover.

# Learn more in [our documentation](https://keda.sh/docs/latest/operate/cluster/#high-availability).

replicaCount: 1

# --Disable response compression for k8s restAPI in client-go.

# Disabling compression simply means that turns off the process of making data smaller for K8s restAPI in client-go for faster transmission.

disableCompression: true

# use ClusterFirstWithHostNet if `useHostNetwork: true` https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy

# -- Defined the DNS policy for the metric server

dnsPolicy: ClusterFirst

# -- DNS config for KEDA metrics server pod

dnsConfig: {}

# -- Enable metric server to use host network

useHostNetwork: false

# -- (bool) Sets `hostUsers` on the KEDA metrics server pod. Leave unset to preserve the cluster default, `false` to run the pod in its own [user namespace](https://kubernetes.io/docs/concepts/workloads/pods/user-namespaces/), or `true` to explicitly use the host user namespace.

hostUsers:

# -- [Affinity] for pod scheduling for Metrics API Server. Takes precedence over the `affinity` field

affinity: {}

# podAntiAffinity:

# requiredDuringSchedulingIgnoredDuringExecution:

# - labelSelector:

# matchExpressions:

# - key: app

# operator: In

# values:

# - keda-operator-metrics-apiserver

# topologyKey: "kubernetes.io/hostname"

# -- Liveness probes for Metrics API Server ([docs](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/))

livenessProbe:

initialDelaySeconds: 5

periodSeconds: 10

timeoutSeconds: 1

failureThreshold: 3

successThreshold: 1

# -- Readiness probes for Metrics API Server ([docs](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-readiness-probes))

readinessProbe:

initialDelaySeconds: 5

periodSeconds: 3

timeoutSeconds: 1

failureThreshold: 3

successThreshold: 1

# -- Node selector for pod scheduling ([docs](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/))

nodeSelector: {}

# -- Tolerations for pod scheduling ([docs](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/))

tolerations: []

webhooks:

# It also used to enable or disable webhook patching in the operator

enabled: true

# -- Additional KEDA admission webhook container environment variables

env: []

# - name: ENV_NAME

# value: 'ENV-VALUE'

# -- Port number to use for KEDA admission webhooks. Default is 9443.

port: ""

# -- Port number to use for KEDA admission webhooks health probe

healthProbePort: 8081

# -- DNS config for KEDA admission webhooks pod

dnsConfig: {}

# -- Liveness probes for admission webhooks ([docs](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/))

livenessProbe:

initialDelaySeconds: 25

periodSeconds: 10

timeoutSeconds: 1

failureThreshold: 3

successThreshold: 1

# -- Readiness probes for admission webhooks ([docs](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-readiness-probes))

readinessProbe:

initialDelaySeconds: 20

periodSeconds: 3

timeoutSeconds: 1

failureThreshold: 3

successThreshold: 1

# -- Timeout in seconds for KEDA admission webhooks

timeoutSeconds: 10

# -- Enable webhook to use host network, this is required on EKS with custom CNI

useHostNetwork: false

# -- (bool) Sets `hostUsers` on the KEDA admission webhooks pod. Leave unset to preserve the cluster default, `false` to run the pod in its own [user namespace](https://kubernetes.io/docs/concepts/workloads/pods/user-namespaces/), or `true` to explicitly use the host user namespace.

hostUsers:

# -- Name of the KEDA admission webhooks

name: keda-admission-webhooks

# -- ReplicaSets for this Deployment you want to retain (Default: 10)

revisionHistoryLimit: 10

# -- Capability to configure the number of replicas for KEDA admission webhooks

replicaCount: 1

# -- [Affinity] for pod scheduling for KEDA admission webhooks. Takes precedence over the `affinity` field

affinity: {}

# podAntiAffinity:

# requiredDuringSchedulingIgnoredDuringExecution:

# - labelSelector:

# matchExpressions:

# - key: app

# operator: In

# values:

# - keda-admission-webhooks

# topologyKey: "kubernetes.io/hostname"

# -- [Failure policy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy) to use with KEDA admission webhooks

failurePolicy: Ignore

# -- Node selector for pod scheduling ([docs](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/))

nodeSelector: {}

# -- Tolerations for pod scheduling ([docs](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/))

tolerations: []

upgradeStrategy:

# -- Capability to configure [Deployment upgrade strategy] for operator

operator: {}

# type: RollingUpdate

# rollingUpdate:

# maxUnavailable: 1

# maxSurge: 1

# -- Capability to configure [Deployment upgrade strategy] for Metrics Api Server

metricsApiServer: {}

# type: RollingUpdate

# rollingUpdate:

# maxUnavailable: 1

# maxSurge: 1

# -- Capability to configure [Deployment upgrade strategy] for Admission webhooks

webhooks: {}

# type: RollingUpdate

# rollingUpdate:

# maxUnavailable: 1

# maxSurge: 1

podDisruptionBudget:

# -- Capability to configure [Pod Disruption Budget]

operator: {}

# minAvailable: 1

# maxUnavailable: 1

# -- Capability to configure [Pod Disruption Budget]

metricServer: {}

# minAvailable: 1

# maxUnavailable: 1

# -- Capability to configure [Pod Disruption Budget]

webhooks: {}

# minAvailable: 1

# maxUnavailable: 1

# -- Custom labels to add into metadata

additionalLabels: {}

# foo: bar

# -- Custom annotations to add into metadata

additionalAnnotations: {}

# foo: bar

podAnnotations:

# -- Pod annotations for KEDA operator

keda: {}

# -- Pod annotations for KEDA Metrics Adapter

metricsAdapter: {}

# -- Pod annotations for KEDA Admission webhooks

webhooks: {}

podLabels:

# -- Pod labels for KEDA operator

keda: {}

# -- Pod labels for KEDA Metrics Adapter

metricsAdapter: {}

# -- Pod labels for KEDA Admission webhooks

webhooks: {}

rbac:

# -- Specifies whether RBAC should be used

create: true

# -- Specifies whether RBAC for CRDs should be [aggregated](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles) to default roles (view, edit, admin)

aggregateToDefaultRoles: false

# -- Whether RBAC for configured CRDs that can have a `scale` subresource should be created

enabledCustomScaledRefKinds: true

# -- Customize the namespace of k8s metrics-server deployment

# This could also be achieved by the Kubernetes control plane manager flag --use-service-account-credentials:

# [docs](https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/)

controlPlaneServiceAccountsNamespace: kube-system

# -- List of custom resources that support the `scale` subresource and can be referenced by `scaledobject.spec.scaleTargetRef`.

# The feature needs to be also enabled by `enabledCustomScaledRefKinds`.

# If left empty, RBAC for `apiGroups: *` and `resources: *, */scale` will be created

# note: Deployments and StatefulSets are supported out of the box

scaledRefKinds:

- apiGroup: "*"

kind: "*"

# - apiGroup: argoproj.io

# kind: Rollout

serviceAccount:

operator:

# -- Specifies whether a service account should be created

create: true

# -- The name of the service account to use.

name: keda-operator

# -- Specifies whether a service account should automount API-Credentials

automountServiceAccountToken: true

# -- Annotations to add to the service account

annotations: {}

metricServer:

# -- Specifies whether a service account should be created

create: true

# -- The name of the service account to use.

name: keda-metrics-server

# -- Specifies whether a service account should automount API-Credentials

automountServiceAccountToken: true

# -- Annotations to add to the service account

annotations: {}

webhooks:

# -- Specifies whether a service account should be created

create: true

# -- The name of the service account to use.

name: keda-webhook

# -- Specifies whether a service account should automount API-Credentials

automountServiceAccountToken: true

# -- Annotations to add to the service account

annotations: {}

podIdentity:

azureWorkload:

# -- Set to true to enable Azure Workload Identity usage.

# See https://keda.sh/docs/concepts/authentication/#azure-workload-identity

# This will be set as a label on the KEDA service account.

enabled: false

# Set to the value of the Azure Active Directory Client and Tenant Ids

# respectively. These will be set as annotations on the KEDA service account.

# -- Id of Azure Active Directory Client to use for authentication with Azure Workload Identity. ([docs](https://keda.sh/docs/concepts/authentication/#azure-workload-identity))

clientId: ""

# -- Id Azure Active Directory Tenant to use for authentication with for Azure Workload Identity. ([docs](https://keda.sh/docs/concepts/authentication/#azure-workload-identity))

tenantId: ""

# Set to the value of the service account token expiration duration.

# This will be set as an annotation on the KEDA service account.

# -- Duration in seconds to automatically expire tokens for the service account. ([docs](https://keda.sh/docs/concepts/authentication/#azure-workload-identity))

tokenExpiration: 3600

aws:

irsa:

# -- Specifies whether [AWS IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html) is to be enabled or not.

enabled: false

# -- Sets the token audience for IRSA.

# This will be set as an annotation on the KEDA service account.

audience: "sts.amazonaws.com"

# -- Set to the value of the ARN of an IAM role with a web identity provider.

# This will be set as an annotation on the KEDA service account.

roleArn: ""

# -- Sets the use of an STS regional endpoint instead of global.

# Recommended to use regional endpoint in almost all cases.

# This will be set as an annotation on the KEDA service account.

stsRegionalEndpoints: "true"

# -- Set to the value of the service account token expiration duration.

# This will be set as an annotation on the KEDA service account.

tokenExpiration: 86400

gcp:

# -- Set to true to enable GCP Workload Identity.

# See https://keda.sh/docs/2.10/authentication-providers/gcp-workload-identity/

# This will be set as a annotation on the KEDA service account.

enabled: false

# -- GCP IAM Service Account Email which you would like to use for workload identity.

gcpIAMServiceAccount: ""

# -- Set this if you are using an external scaler and want to communicate

# over TLS (recommended). This variable holds the name of the secret that

# will be mounted to the /grpccerts path on the Pod

grpcTLSCertsSecret: ""

# -- Set this if you are using HashiCorp Vault and want to communicate

# over TLS (recommended). This variable holds the name of the secret that

# will be mounted to the /vault path on the Pod

hashiCorpVaultTLS: ""

hashiCorpVault:

kubernetesAuth:

# -- Projected operator-token audience, also globally approved. Empty disables projection; does not configure named-SA minting. Use an audience not accepted by kube-apiserver.

audience: vault

# -- Mount directory for the Vault token (<path>/token). Empty/null disables projection and implicit file selection; explicit TA token paths remain usable.

projectedTokenMountPath: /var/run/secrets/keda-vault

logging:

operator:

# -- Logging level for KEDA Operator.

# allowed values: `debug`, `info`, `error`, or an integer value greater than 0, specified as string

level: info

# -- Logging format for KEDA Operator.

# allowed values: `json` or `console`

format: console

# -- Logging time encoding for KEDA Operator.

# allowed values are `epoch`, `millis`, `nano`, `iso8601`, `rfc3339` or `rfc3339nano`

timeEncoding: rfc3339

# -- If enabled, the stack traces will be also printed

stackTracesEnabled: false

metricServer:

# -- Logging level for Metrics Server (Deprecated).

# allowed values: `0` for info, `4` for debug, or an integer value greater than 0, specified as string

level: 0

# -- Logging stderrthreshold for Metrics Server (Deprecated)

# allowed values: 'DEBUG','INFO','WARN','ERROR','ALERT','EMERG'

stderrthreshold: ERROR

# -- Zap Logging level for Metrics Server.

# allowed values: `debug`, `info`, `error`, or an integer value greater than 0, specified as string

zapLevel: info

# -- Zap Logging encoder for Metrics Server.

# allowed values: `json` or `console`

zapEncoder: console

# -- Zap logging time encoding for Metrics Server.

# allowed values are `epoch`, `millis`, `nano`, `iso8601`, `rfc3339` or `rfc3339nano`

zapTimeEncoding: rfc3339

webhooks:

# -- Logging level for KEDA Operator.

# allowed values: `debug`, `info`, `error`, or an integer value greater than 0, specified as string

level: info

# -- Logging format for KEDA Admission webhooks.

# allowed values: `json` or `console`

format: console

# -- Logging time encoding for KEDA Operator.

# allowed values are `epoch`, `millis`, `nano`, `iso8601`, `rfc3339` or `rfc3339nano`

timeEncoding: rfc3339

# -- [Security context] for all containers

# @default -- [See below](#KEDA-is-secure-by-default)

securityContext:

# -- [Security context] of the operator container

# @default -- [See below](#KEDA-is-secure-by-default)

operator:

capabilities:

drop:

- ALL

allowPrivilegeEscalation: false

readOnlyRootFilesystem: true

seccompProfile:

type: RuntimeDefault

# -- [Security context] of the metricServer container

# @default -- [See below](#KEDA-is-secure-by-default)

metricServer:

capabilities:

drop:

- ALL

allowPrivilegeEscalation: false

readOnlyRootFilesystem: true

seccompProfile:

type: RuntimeDefault

# -- [Security context] of the admission webhooks container

# @default -- [See below](#KEDA-is-secure-by-default)

webhooks:

capabilities:

drop:

- ALL

allowPrivilegeEscalation: false

readOnlyRootFilesystem: true

seccompProfile:

type: RuntimeDefault

# -- [Pod security context] for all pods

# @default -- [See below](#KEDA-is-secure-by-default)

podSecurityContext:

# -- [Pod security context] of the KEDA operator pod

# @default -- [See below](#KEDA-is-secure-by-default)

operator:

runAsNonRoot: true

# runAsUser: 1000

# runAsGroup: 1000

# fsGroup: 1000

# -- [Pod security context] of the KEDA metrics apiserver pod

# @default -- [See below](#KEDA-is-secure-by-default)

metricServer:

runAsNonRoot: true

# runAsUser: 1000

# runAsGroup: 1000

# fsGroup: 1000

# -- [Pod security context] of the KEDA admission webhooks

# @default -- [See below](#KEDA-is-secure-by-default)

webhooks:

runAsNonRoot: true

# runAsUser: 1000

# runAsGroup: 1000

# fsGroup: 1000

service:

# -- KEDA Metric Server service type

type: ClusterIP

# -- HTTPS port for KEDA Metric Server service

portHttps: 443

# -- HTTPS port for KEDA Metric Server container

portHttpsTarget: 6443

# -- Annotations to add the KEDA Metric Server service

annotations: {}

# -- The minimum TLS version to use when KEDA components provide a TLS-enabled service.

minTlsVersion: "TLS13"

# -- The list of cipher suites to use when KEDA components provide a TLS-enabled service. When left empty or unset, the TLS implementation will provide a default list of cipher suites which are believed to be secure.

tlsCipherList: ""

# We provides the default values that we describe in our docs:

# https://keda.sh/docs/latest/operate/cluster/

# If you want to specify the resources (or totally remove the defaults), change or comment the following

# lines, adjust them as necessary, or simply add the curly braces after 'operator' and/or 'metricServer'

# and remove/comment the default values

resources:

# -- Manage [resource request & limits] of KEDA operator pod

operator:

limits:

cpu: 1

memory: 1000Mi

requests:

cpu: 100m

memory: 100Mi

# -- Manage [resource request & limits] of KEDA metrics apiserver pod

metricServer:

limits:

cpu: 1

memory: 1000Mi

requests:

cpu: 100m

memory: 100Mi

# -- Manage [resource request & limits] of KEDA admission webhooks pod

webhooks:

limits:

cpu: 1

memory: 1000Mi

requests:

cpu: 100m

memory: 100Mi

# -- Node selector for pod scheduling ([docs](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/))

nodeSelector: {}

# -- Tolerations for pod scheduling ([docs](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/))

tolerations: []

# -- HostAliases for pod networking ([docs](https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/))

hostAliases: []

topologySpreadConstraints:

# -- [Pod Topology Constraints] of KEDA operator pod

operator: []

# -- [Pod Topology Constraints] of KEDA metrics apiserver pod

metricsServer: []

# -- [Pod Topology Constraints] of KEDA admission webhooks pod

webhooks: []

# -- [Affinity] for pod scheduling for KEDA operator, Metrics API Server and KEDA admission webhooks.

affinity: {}

# podAntiAffinity:

# requiredDuringSchedulingIgnoredDuringExecution:

# - labelSelector:

# matchExpressions:

# - key: app

# operator: In

# values:

# - keda-operator

# - keda-operator-metrics-apiserver

# - keda-admission-webhooks

# topologyKey: "kubernetes.io/hostname"

# -- priorityClassName for all KEDA components

priorityClassName: ""

## The default HTTP timeout in milliseconds that KEDA should use

## when making requests to external services. Removing this defaults to a

## reasonable default

http:

# -- The default HTTP timeout to use for all scalers that use raw HTTP clients (some scalers use SDKs to access target services. These have built-in HTTP clients, and the timeout does not necessarily apply to them)

timeout: 3000

# -- Maximum number of idle HTTP connections across all hosts. Zero means no limit.

maxIdleConns: 0

# -- Maximum number of idle HTTP connections to keep per host

maxIdleConnsPerHost: 1000

# -- Maximum time an idle HTTP connection remains in the pool. Must be greater than zero.

idleConnTimeout: 90s

keepAlive:

# -- Enable HTTP connection keep alive

enabled: true

# -- The minimum TLS version to use for all scalers that use raw HTTP clients (some scalers use SDKs to access target services. These have built-in HTTP clients, and this value does not necessarily apply to them)

minTlsVersion: TLS12

# -- The list of cipher suites to use when making HTTP over TLS connections. When left empty or unset, the TLS implementation will provide a default list of cipher suites which are believed to be secure.

tlsCipherList: ""

## This setting lets you enable profiling for all of the components of KEDA and in the specific port you choose

## This can be useful when trying to investigate errors like memory leaks or CPU or even look at goroutines to understand better

## This setting is disabled by default

profiling:

operator:

# -- Enable profiling for KEDA operator

enabled: false

# -- Expose profiling on a specific port

port: 8082

metricsServer:

# -- Enable profiling for KEDA metrics server

enabled: false

# -- Expose profiling on a specific port

port: 8083

webhooks:

# -- Enable profiling for KEDA admission webhook

enabled: false

# -- Expose profiling on a specific port

port: 8084

## Extra KEDA Operator, Metrics Adapter and Admission Webhooks container arguments

extraArgs:

# -- Additional KEDA Operator container arguments

keda: {}

# -- Additional Metrics Adapter container arguments

metricsAdapter: {}

# -- Additional KEDA admission webhooks container arguments

webhooks: {}

# Example:

# webhooks:

# cache-miss-to-direct-client: "true"

# -- Additional environment variables that will be passed onto all KEDA components

env: []

# - name: ENV_NAME

# value: 'ENV-VALUE'

# Extra volumes and volume mounts for the deployment. Optional.

volumes:

keda:

# -- Extra volumes for KEDA deployment

extraVolumes: []

# -- Extra volume mounts for KEDA deployment

extraVolumeMounts: []

metricsApiServer:

# -- Extra volumes for metric server deployment

extraVolumes: []

# -- Extra volume mounts for metric server deployment

extraVolumeMounts: []

webhooks:

# -- Extra volumes for admission webhooks deployment

extraVolumes: []

# -- Extra volume mounts for admission webhooks deployment

extraVolumeMounts: []

prometheus:

metricServer:

# -- Enable metric server Prometheus metrics expose

enabled: false

# -- HTTP port used for exposing metrics server prometheus metrics

port: 8080

# -- HTTP port name for exposing metrics server prometheus metrics

portName: metrics

# -- App Protocol for service when scraping metrics endpoint

# appProtocol: http

serviceMonitor:

# -- Enables ServiceMonitor creation for the Prometheus Operator

enabled: false

# -- JobLabel selects the label from the associated Kubernetes service which will be used as the job label for all metrics. [ServiceMonitor Spec]

jobLabel: ""

# -- TargetLabels transfers labels from the Kubernetes `Service` onto the created metrics

targetLabels: []

# -- PodTargetLabels transfers labels on the Kubernetes `Pod` onto the created metrics

podTargetLabels: []

# -- Name of the service port this endpoint refers to. Mutually exclusive with targetPort

port: metrics

# -- Name or number of the target port of the Pod behind the Service, the port must be specified with container port property. Mutually exclusive with port

targetPort: ""

# -- Interval at which metrics should be scraped If not specified Prometheus’ global scrape interval is used.

interval: ""

# -- Timeout after which the scrape is ended If not specified, the Prometheus global scrape timeout is used unless it is less than Interval in which the latter is used

scrapeTimeout: ""

# -- DEPRECATED. List of expressions that define custom relabeling rules for metric server ServiceMonitor crd (prometheus operator). [RelabelConfig Spec]

relabellings: []

# -- List of expressions that define custom relabeling rules for metric server ServiceMonitor crd (prometheus operator). [RelabelConfig Spec]

relabelings: []

# -- List of expressions that define custom metric relabeling rules for metric server ServiceMonitor crd after scrape has happened (prometheus operator). [RelabelConfig Spec]

metricRelabelings: []

# -- Additional labels to add for metric server using ServiceMonitor crd (prometheus operator)

additionalLabels: {}

# -- HTTP scheme used for scraping. Defaults to `http`

scheme: http

# -- TLS configuration for scraping metrics

tlsConfig: {}

# caFile: /etc/prom-certs/root-cert.pem

# certFile: /etc/prom-certs/cert-chain.pem

# insecureSkipVerify: true

# keyFile: /etc/prom-certs/key.pem

podMonitor:

# -- Enables PodMonitor creation for the Prometheus Operator

enabled: false

# -- Scraping interval for metric server using podMonitor crd (prometheus operator)

interval: ""

# -- Scraping timeout for metric server using podMonitor crd (prometheus operator)

scrapeTimeout: ""

# -- Scraping namespace for metric server using podMonitor crd (prometheus operator)

namespace: ""

# -- Additional labels to add for metric server using podMonitor crd (prometheus operator)

additionalLabels: {}

# -- List of expressions that define custom relabeling rules for metric server podMonitor crd (prometheus operator)

relabelings: []

# -- List of expressions that define custom metric relabeling rules for metric server PodMonitor crd after scrape has happened (prometheus operator). [RelabelConfig Spec]

metricRelabelings: []

operator:

# -- Enable KEDA Operator prometheus metrics expose

enabled: false

# -- Port used for exposing KEDA Operator prometheus metrics

port: 8080

# -- App Protocol for service when scraping metrics endpoint

# appProtocol: http

serviceMonitor:

# -- Enables ServiceMonitor creation for the Prometheus Operator

enabled: false

# -- JobLabel selects the label from the associated Kubernetes service which will be used as the job label for all metrics. [ServiceMonitor Spec]

jobLabel: ""

# -- TargetLabels transfers labels from the Kubernetes `Service` onto the created metrics

targetLabels: []

# -- PodTargetLabels transfers labels on the Kubernetes `Pod` onto the created metrics

podTargetLabels: []

# -- Name of the service port this endpoint refers to. Mutually exclusive with targetPort

port: metrics

# -- Name or number of the target port of the Pod behind the Service,

# the port must be specified with container port property. Mutually exclusive with port

targetPort: ""

# -- Interval at which metrics should be scraped If not specified Prometheus’ global scrape interval is used.

interval: ""

# -- Timeout after which the scrape is ended If not specified, the Prometheus global scrape timeout is used unless it is less than Interval in which the latter is used

scrapeTimeout: ""

# -- DEPRECATED. List of expressions that define custom relabeling rules for metric server ServiceMonitor crd (prometheus operator). [RelabelConfig Spec]

relabellings: []

# -- List of expressions that define custom relabeling rules for metric server ServiceMonitor crd (prometheus operator). [RelabelConfig Spec]

relabelings: []

# -- List of expressions that define custom metric relabeling rules for metric server ServiceMonitor crd after scrape has happened (prometheus operator). [RelabelConfig Spec]

metricRelabelings: []

# -- Additional labels to add for metric server using ServiceMonitor crd (prometheus operator)

additionalLabels: {}

# -- HTTP scheme used for scraping. Defaults to `http`

scheme: http

# -- TLS configuration for scraping metrics

tlsConfig: {}

# caFile: /etc/prom-certs/root-cert.pem

# certFile: /etc/prom-certs/cert-chain.pem

# insecureSkipVerify: true

# keyFile: /etc/prom-certs/key.pem

podMonitor:

# -- Enables PodMonitor creation for the Prometheus Operator

enabled: false

# -- Scraping interval for KEDA Operator using podMonitor crd (prometheus operator)

interval: ""

# -- Scraping timeout for KEDA Operator using podMonitor crd (prometheus operator)

scrapeTimeout: ""

# -- Scraping namespace for KEDA Operator using podMonitor crd (prometheus operator)

namespace: ""

# -- Additional labels to add for KEDA Operator using podMonitor crd (prometheus operator)

additionalLabels: {}

# -- List of expressions that define custom relabeling rules for KEDA Operator podMonitor crd (prometheus operator)

relabelings: []

# -- List of expressions that define custom metric relabeling rules for metric server PodMonitor crd after scrape has happened (prometheus operator). [RelabelConfig Spec]

metricRelabelings: []

prometheusRules:

# -- Enables PrometheusRules creation for the Prometheus Operator

enabled: false

# -- Scraping namespace for KEDA Operator using prometheusRules crd (prometheus operator)

namespace: ""

# -- Additional labels to add for KEDA Operator using prometheusRules crd (prometheus operator)

additionalLabels: {}

# -- Additional alerts to add for KEDA Operator using prometheusRules crd (prometheus operator)

alerts: []

# - alert: KedaScalerErrors

# annotations:

# description: Keda scaledObject {{ $labels.scaledObject }} is experiencing errors with {{ $labels.scaler }} scaler

# summary: Keda Scaler {{ $labels.scaler }} Errors

# expr: sum by ( scaledObject , scaler) (rate(keda_metrics_adapter_scaler_errors[2m])) > 0

# for: 2m

# labels:

webhooks:

# -- Enable KEDA admission webhooks prometheus metrics expose

enabled: false

# -- Port used for exposing KEDA admission webhooks prometheus metrics

port: 8080

# -- App Protocol for service when scraping metrics endpoint

# appProtocol: http

serviceMonitor:

# -- Enables ServiceMonitor creation for the Prometheus webhooks

enabled: false

# -- jobLabel selects the label from the associated Kubernetes service which will be used as the job label for all metrics. [ServiceMonitor Spec]

jobLabel: ""

# -- TargetLabels transfers labels from the Kubernetes `Service` onto the created metrics

targetLabels: []

# -- PodTargetLabels transfers labels on the Kubernetes `Pod` onto the created metrics

podTargetLabels: []

# -- Name of the service port this endpoint refers to. Mutually exclusive with targetPort

port: metrics

# -- Name or number of the target port of the Pod behind the Service, the port must be specified with container port property. Mutually exclusive with port

targetPort: ""

# -- Interval at which metrics should be scraped If not specified Prometheus’ global scrape interval is used.

interval: ""

# -- Timeout after which the scrape is ended If not specified, the Prometheus global scrape timeout is used unless it is less than Interval in which the latter is used

scrapeTimeout: ""

# -- DEPRECATED. List of expressions that define custom relabeling rules for metric server ServiceMonitor crd (prometheus operator). [RelabelConfig Spec]

relabellings: []

# -- List of expressions that define custom relabeling rules for metric server ServiceMonitor crd (prometheus operator). [RelabelConfig Spec]

relabelings: []

# -- List of expressions that define custom metric relabeling rules for metric server ServiceMonitor crd after scrape has happened (prometheus operator). [RelabelConfig Spec]

metricRelabelings: []

# -- Additional labels to add for metric server using ServiceMonitor crd (prometheus operator)

additionalLabels: {}

# -- HTTP scheme used for scraping. Defaults to `http`

scheme: http

# -- TLS configuration for scraping metrics

tlsConfig: {}

# caFile: /etc/prom-certs/root-cert.pem

# certFile: /etc/prom-certs/cert-chain.pem

# insecureSkipVerify: true

# keyFile: /etc/prom-certs/key.pem

prometheusRules:

# -- Enables PrometheusRules creation for the Prometheus Operator

enabled: false

# -- Scraping namespace for KEDA admission webhooks using prometheusRules crd (prometheus operator)

namespace: ""

# -- Additional labels to add for KEDA admission webhooks using prometheusRules crd (prometheus operator)

additionalLabels: {}

# -- Additional alerts to add for KEDA admission webhooks using prometheusRules crd (prometheus operator)

alerts: []

opentelemetry:

collector:

# -- Uri of OpenTelemetry Collector to push telemetry to

uri: ""

operator:

# -- Enable pushing metrics to an OpenTelemetry Collector for operator

enabled: false

certificates:

# -- Enables the self generation for KEDA TLS certificates inside KEDA operator

autoGenerated: true

# -- Secret name to be mounted with KEDA TLS certificates

secretName: kedaorg-certs

# -- Path where KEDA TLS certificates are mounted

mountPath: /certs

certManager:

# -- Enables Cert-manager for certificate management

enabled: false

# -- Certificate duration

duration: 8760h0m0s # 1 year

# -- Certificate renewal time before expiration

renewBefore: 5840h0m0s # 8 months

# -- Generates a self-signed CA with Cert-manager.

# If generateCA is false, the secret with the CA

# has to be annotated with `cert-manager.io/allow-direct-injection: "true"`

generateCA: true

# -- Secret name where the CA is stored (generatedby cert-manager or user given)

caSecretName: "kedaorg-ca"

# -- Add labels/annotations to secrets created by Certificate resources

# [docs](https://cert-manager.io/docs/usage/certificate/#creating-certificate-resources)

secretTemplate: {}

# annotations:

# my-secret-annotation-1: "foo"

# my-secret-annotation-2: "bar"

# labels:

# my-secret-label: foo

# -- Reference to custom Issuer. If issuer.generate is false, then issuer.group, issuer.kind and issuer.name are required

issuer:

# -- Generates an Issuer resource with Cert-manager

generate: true

# -- Custom Issuer name. Required when generate: false

name: foo-org-ca

# -- Custom Issuer kind. Required when generate: false

kind: ClusterIssuer

# -- Custom Issuer group. Required when generate: false

group: cert-manager.io

operator:

# -- Enable APIService patching by KEDA operator. Controls whether KEDA operator will inject the self-generated TLS certificate into the APIService used by KEDA Metrics API Server.

# Only takes effect when certificates.autoGenerated is true and certificates.certManager.enabled is false.

# WARNING: If metricsServer.enabled is true and you disable this, you must ensure the APIService CA bundle is injected by an alternative mechanism (e.g. external controller, manual patching), otherwise the metrics API will fail TLS verification.

# apiServicePatching:

# enabled: false

# -- Location(s) of CA files for authentication of external TLS connections such as TLS-enabled metrics sources

# caDirs:

# - /custom/ca

permissions:

metricServer:

restrict:

# -- Restrict Secret Access for Metrics Server

secret: false

operator:

restrict:

# -- Restrict Secret Access for KEDA operator

# if true, KEDA operator will be able to read only secrets in {{ .Release.Namespace }} namespace

secret: false

# -- Array of strings denoting what secrets the KEDA operator will be able to read, this takes into account

# also the configured `watchNamespace`.

# the default is an empty array -> no restriction on the secret name

namesAllowList: []

# -- Creates roles and rolebindings from namespaced service accounts in the array which allow the KEDA operator

# to request service account tokens for use with the boundServiceAccountToken trigger source.

# Optional audience configures minting for this namespace/name; omit it in legacy mode.

# Enforce-audience mode requires a mapping here or in KEDA_SERVICE_ACCOUNT_TOKEN_AUDIENCES.

# If the namespace does not exist, this will cause the helm chart installation to fail.

serviceAccountTokenCreationRoles: []

# - name: metrics-reader

# namespace: apps

# audience: metrics-api

# -- Allow Keda to access all Service Token for KEDA operator

allowAllServiceAccountTokenCreation: false

# -- Array of extra K8s manifests to deploy

extraObjects: []

# - apiVersion: keda.sh/v1alpha1

# kind: ClusterTriggerAuthentication

# metadata:

# name: aws-credentials

# namespace: keda

# spec:

# podIdentity:

# provider: aws-eks

# -- Capability to turn on/off ASCII art in Helm installation notes

asciiArt: true

# -- When specified, each rendered resource will have `app.kubernetes.io/managed-by: ${this}` label on it. Useful, when using only helm template with some other solution.

customManagedBy: ""

# -- Enable service links in pods. Although enabled, mirroring k8s default, it is highly recommended to disable,

# due to its legacy status [Legacy container links](https://docs.docker.com/engine/network/links/)

enableServiceLinks: true