Skip to content

operator cert auto-management: make APIService cert injections optional #832

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
wozniakjan merged 2 commits into from
Mar 18, 2026
Merged

operator cert auto-management: make APIService cert injections optional #832

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d2916df
operator cert auto-management: make APIService cert injections optional
wozniakjan Mar 18, 2026
6b0394d
address review: improve gating condition and documentation for apiSer…
wozniakjan Mar 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions keda/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,6 +76,7 @@ their default values.
| `certificates.certManager.secretTemplate` | object | `{}` | Add labels/annotations to secrets created by Certificate resources [docs](https://cert-manager.io/docs/usage/certificate/#creating-certificate-resources) |
| `certificates.mountPath` | string | `"/certs"` | Path where KEDA TLS certificates are mounted |
| `certificates.secretName` | string | `"kedaorg-certs"` | Secret name to be mounted with KEDA TLS certificates |
| `certificates.operator.apiServicePatching.enabled` | bool | `nil` | When explicitly set, controls whether the operator injects the self-generated TLS CA into the APIService for the KEDA Metrics API Server via the `--enable-apiservice-patching` flag. When unset (default), the flag is not passed and the operator uses its built-in default. Only effective when `certificates.autoGenerated=true` and `certificates.certManager.enabled=false`. If set to `false` while `metricsServer.enabled=true`, you must provide an alternative CA injection mechanism or the metrics API will fail TLS verification. |
| `clusterDomain` | string | `"cluster.local"` | Kubernetes cluster domain |
| `clusterName` | string | `"kubernetes-default"` | Kubernetes cluster name. Used in features such as emitting CloudEvents |
| `crds.additionalAnnotations` | object | `{}` | Custom annotations specifically for CRDs |
Expand Down
3 changes: 3 additions & 0 deletions keda/templates/manager/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,6 +84,9 @@ spec:
- "--zap-encoder={{ .Values.logging.operator.format }}"
- "--zap-time-encoding={{ .Values.logging.operator.timeEncoding }}"
- "--enable-webhook-patching={{ .Values.webhooks.enabled }}"
{{- if and .Values.certificates.autoGenerated ( not .Values.certificates.certManager.enabled ) .Values.certificates.operator .Values.certificates.operator.apiServicePatching }}
- "--enable-apiservice-patching={{ .Values.certificates.operator.apiServicePatching.enabled }}"
Comment thread
wozniakjan marked this conversation as resolved.
{{- end }}
{{- if .Values.logging.operator.stackTracesEnabled }}
- "--zap-stacktrace-level=error"
{{- end }}
Expand Down
5 changes: 5 additions & 0 deletions keda/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -885,6 +885,11 @@ certificates:
# -- Custom Issuer group. Required when generate: false
group: cert-manager.io
operator:
# -- Enable APIService patching by KEDA operator. Controls whether KEDA operator will inject the self-generated TLS certificate into the APIService used by KEDA Metrics API Server.
Comment thread
wozniakjan marked this conversation as resolved.
# Only takes effect when certificates.autoGenerated is true and certificates.certManager.enabled is false.
# WARNING: If metricsServer.enabled is true and you disable this, you must ensure the APIService CA bundle is injected by an alternative mechanism (e.g. external controller, manual patching), otherwise the metrics API will fail TLS verification.
# apiServicePatching:
# enabled: false
# -- Location(s) of CA files for authentication of external TLS connections such as TLS-enabled metrics sources
# caDirs:
# - /custom/ca
Expand Down
Loading