Skip to content

feat(container): update image ghcr.io/home-operations/charts-mirror/keda ( 2.20.2 → 2.21.0 ) - #2667

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/ghcr.io-home-operations-charts-mirror-keda-2.x
Open

feat(container): update image ghcr.io/home-operations/charts-mirror/keda ( 2.20.2 → 2.21.0 )#2667
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/ghcr.io-home-operations-charts-mirror-keda-2.x

Conversation

@renovate

@renovate renovate Bot commented Sep 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Update Change
ghcr.io/home-operations/charts-mirror/keda minor 2.20.2 → 2.21.0

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

kedacore/keda (ghcr.io/home-operations/charts-mirror/keda)

v2.21.0

Compare Source

We are happy to release KEDA 2.21.0 🎉

[!IMPORTANT]
KEDA 2.21.0 contains three breaking changes. If you are upgrading from KEDA 2.20, review Upgrading from KEDA 2.20 to 2.21 before upgrading.

Before upgrading from KEDA 2.20

Service account token audience enforcement (CVE-2026-77524)

KEDA 2.21 fixes the critical CVE-2026-77524 / GHSA-637c-6jxx-4rwm. You are affected if you use:

  • Vault Kubernetes authentication, including configurations using the operator token, an existing projected token, or credential.serviceAccountName.
  • Any TriggerAuthentication or ClusterTriggerAuthentication using boundServiceAccountToken, including integrations with Metrics API, Prometheus, Loki, Datadog Cluster Agent, and other token-authenticated receivers.

You are not affected if you use ordinary Vault token authentication, API keys, OAuth credentials, or another authentication method that does not use a bound service account token. Before upgrading, review carefully the upgrade guide

Temporal Rules-Based Versioning settings

The Temporal scaler no longer accepts the deprecated buildId, selectAllActive, and selectUnversioned settings. Existing ScaledObjects and ScaledJobs containing them will fail scaler metadata parsing. Remove the settings for unversioned workers, or migrate versioned workers to workerDeploymentName and workerDeploymentBuildId. See Temporal Rules-Based Versioning settings.

Highlights

  • Reduce redundant scaler-backend requests when the HPA already owns the scaling decision (#​7999, #​8031).
  • Add Azure Cosmos DB Change Feed, ClickHouse, and GCP Cloud Spanner scalers.
  • Let external scalers update HPA targets dynamically through StreamMetricSpec, and expose external-scaler gRPC client metrics.
  • Add Prometheus OAuth2 client-credentials authentication, Kafka Kerberos credential-cache support, and Azure Pipelines service-principal authentication.
  • Improve scaler and authentication lifecycles with deterministic cancellation, refresh handling, Kubernetes API timeouts, and external-scaler connection cleanup.

Deprecation notice

The Liiklus scaler is deprecated because the upstream project is unmaintained. Its code is planned for removal in a later KEDA release. See #​7929.

Learn how to deploy KEDA by reading our documentation.

🗓️ The next KEDA release is currently estimated for the 2nd week of January 2027. Learn more in our roadmap.

Breaking Changes

Deprecations

  • 5744068: Liiklus Scaler: Deprecate the scaler because its upstream project is unmaintained; removal is planned for a later KEDA release (#​7938, #​7929) (@​Copilot)

New

Improvements

Fixes

Other

CI

Show

Dependencies

Show

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone America/New_York)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@github-actions

github-actions Bot commented Sep 23, 2026

Copy link
Copy Markdown 
@@ spec.ref.tag @@
# source.toolkit.fluxcd.io/v1/OCIRepository/monitoring/keda
! ± value change
- 2.20.2
+ 2.21.0

@@ spec.template.spec.containers.keda-operator.args @@
# apps/v1/Deployment/monitoring/keda-operator
! + three list entries added:
+ - "--metrics-service-bind-address=:9666"
+ - "--service-account-token-mode=enforce-audience"
+ - "--vault-kubernetes-auth-token-file=/var/run/secrets/keda-vault/token"

@@ spec.template.spec.containers.keda-operator.env @@
# apps/v1/Deployment/monitoring/keda-operator
! + four list entries added:
+ - name: KEDA_SERVICE_ACCOUNT_TOKEN_AUDIENCES
+   value: "[{\"audience\":\"vault\"}]"
+ - name: WATCH_LABEL_SELECTOR
+   value: 
+ - name: WATCH_LABEL_SELECTOR_FOR_TRIGGERAUTH
+   value: 
+ - name: KEDA_KUBERNETES_API_TIMEOUT
+   value: 5s

@@ spec.template.spec.containers.keda-operator.image @@
# apps/v1/Deployment/monitoring/keda-operator
! ± value change
- ghcr.io/kedacore/keda:2.20.2
+ ghcr.io/kedacore/keda:2.21.0

@@ spec.template.spec.containers.keda-operator.volumeMounts @@
# apps/v1/Deployment/monitoring/keda-operator
! + one list entry added:
+ - name: keda-vault-e6f0a1fbb43c8919
+   mountPath: /var/run/secrets/keda-vault
+   readOnly: true

@@ spec.template.spec.volumes @@
# apps/v1/Deployment/monitoring/keda-operator
! + one list entry added:
+ - name: keda-vault-e6f0a1fbb43c8919
+   projected:
+     sources:
+     - serviceAccountToken:
+         audience: vault
+         expirationSeconds: 3600
+         path: token

@@ spec.template.spec.containers.keda-operator-metrics-apiserver.image @@
# apps/v1/Deployment/monitoring/keda-operator-metrics-apiserver
! ± value change
- ghcr.io/kedacore/keda-metrics-apiserver:2.20.2
+ ghcr.io/kedacore/keda-metrics-apiserver:2.21.0

@@ spec.template.spec.containers.keda-admission-webhooks.image @@
# apps/v1/Deployment/monitoring/keda-admission-webhooks
! ± value change
- ghcr.io/kedacore/keda-admission-webhooks:2.20.2
+ ghcr.io/kedacore/keda-admission-webhooks:2.21.0

@renovate
renovate Bot force-pushed the renovate/ghcr.io-home-operations-charts-mirror-keda-2.x branch from fc820ca to ccd9f06 Compare September 24, 2026 20:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

area/kubernetes renovate/container type/minor

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants