keda

Renders KEDA ScaledObjects, ScaledJobs and TriggerAuthentications from inventory parameters.

Latest: 1.0.3 · 2026-10-14
License: Apache-2.0
Owners: Moep90
Source: github.com/kadet-hub/generators · 0 repo stars, shared by 35 generators
Thumbs up: 👍 0 on GitHub Discussions
Popularity: 20 · 971 pulls

Badge

Show the latest listed version in your README. shields.io draws the badge from this page's badge.json, which every catalog build updates; once no version is listed, it reads "not listed".

[![kadet-hub](https://img.shields.io/endpoint?url=https://kadet-hub.org/generators/keda/badge.json)](https://kadet-hub.org/generators/keda/)

KEDA Generator

Published on kadet-hub: pin a released version by digest from its catalog page.

Kapitan kadet generator for KEDA resources (keda.sh/v1alpha1, KEDA v2.21):

ScaledObject: event-driven scaling of a Deployment, StatefulSet or any /scale resource
ScaledJob: event-driven creation of Kubernetes Jobs
TriggerAuthentication: namespaced scaler credentials
ClusterTriggerAuthentication: cluster-scoped scaler credentials

Scale targets, Secrets and ServiceAccounts belong in the kubernetes generator.

Usage

Kapitan Configuration

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/keda@sha256:<digest>
        output_path: lib/keda
    compile:
      - output_path: manifests/keda/
        input_type: kadet
        output_type: yml
        input_paths:
          - lib/keda

Inventory Contract

All keys live under parameters.generators.keda.

Key	Kind	Output key
`namespace`		Default namespace. Falls back to `parameters.namespace`, then `default`.
`scaled_objects.<name>`	ScaledObject	`<namespace>/<name>-so`
`scaled_jobs.<name>`	ScaledJob	`<namespace>/<name>-sj`
`trigger_authentications.<name>`	TriggerAuthentication	`<namespace>/<name>-ta`
`cluster_trigger_authentications.<name>`	ClusterTriggerAuthentication	`<name>-cta`

Every resource accepts labels, annotations and spec; namespaced kinds also accept namespace. spec is merged into the resource spec first, then the flat keys below are applied. A flat key that overrides a spec value logs a warning.

Flat keys are the snake_case spelling of the CRD spec fields; values pass through unchanged:

Kind	Flat keys
ScaledObject	`scale_target_ref`, `triggers`, `min_replica_count`, `max_replica_count`, `idle_replica_count`, `polling_interval`, `cooldown_period`, `initial_cooldown_period`, `fallback`, `advanced`
ScaledJob	`job_target_ref`, `triggers`, `env_source_container_name`, `min_replica_count`, `max_replica_count`, `polling_interval`, `successful_jobs_history_limit`, `failed_jobs_history_limit`, `scaling_strategy`, `rollout`
TriggerAuthentication, ClusterTriggerAuthentication	`secret_target_ref`, `config_map_target_ref`, `env`, `pod_identity`, `hashi_corp_vault`, `azure_key_vault`, `azure_service_principal`, `aws_secret_manager`, `gcp_secret_manager`, `bound_service_account_token`, `oauth2`, `file_path`

Shorthands:

Input	Result
`scale_target_ref: <name>`	`scaleTargetRef: {name: <name>}`
trigger `authentication_ref: <name>`	`authenticationRef: {name: <name>}`

A dict passes through, for example authentication_ref: {name: x, kind: ClusterTriggerAuthentication}. All other trigger keys, including the scaler-specific metadata, stay verbatim. Operator defaults (minReplicaCount: 0, maxReplicaCount: 100, pollingInterval: 30, cooldownPeriod: 300, scale target kind Deployment) are not emitted.

Example

parameters:
  generators:
    keda:
      namespace: workers
      scaled_objects:
        orders-consumer:
          scale_target_ref: orders-consumer
          min_replica_count: 1
          max_replica_count: 20
          triggers:
            - type: rabbitmq
              metadata:
                protocol: amqp
                queueName: orders
                mode: QueueLength
                value: "20"
              authentication_ref: rabbitmq-auth
            - type: prometheus
              metadata:
                serverAddress: http://prometheus.monitoring.svc:9090
                query: sum(rate(http_requests_total{app="orders"}[2m]))
                threshold: "100"
              authentication_ref:
                name: prometheus-auth
                kind: ClusterTriggerAuthentication
      scaled_jobs:
        report-builder:
          job_target_ref:
            template:
              spec:
                restartPolicy: Never
                containers:
                  - name: builder
                    image: registry.example.com/report-builder:1.0.0
          max_replica_count: 10
          triggers:
            - type: aws-sqs-queue
              metadata:
                queueURL: https://sqs.eu-central-1.amazonaws.com/000000000000/reports
                queueLength: "5"
                awsRegion: eu-central-1
              authentication_ref: aws-auth
      trigger_authentications:
        rabbitmq-auth:
          secret_target_ref:
            - parameter: host
              name: rabbitmq-credentials
              key: host
        aws-auth:
          pod_identity:
            provider: aws
      cluster_trigger_authentications:
        prometheus-auth:
          bound_service_account_token:
            - parameter: bearerToken
              serviceAccountName: keda-prometheus

Versions

Add a version's inventory entry, then compile with the consumer workflow, which verifies the artifact and runs Kapitan in the sandbox.

Free of charge, as is and on a best-effort basis: use at your own risk, and review the compiled output before you apply it. Terms

This catalog was built from index serial 47. Set index_serial: 47 in .kapitan-sandbox.yaml and the consumer workflow refuses any older index, so a rolled-back index cannot bring back a yanked version.

Checks find known patterns; they do not prove a generator safe. What a listing covers

Version	Built for (schema-checked)
1.0.3	KEDA 2.21.0
1.0.2	KEDA 2.21.0
1.0.1	KEDA 2.21.0
1.0.0	not recorded

1.0.3# 2026-10-14

Inventory

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/keda:1.0.3@sha256:e3cc0b2f6d047e48fbd34532727be44af644696af32a4d0844c2adeeac6f6af3
        output_path: lib/keda

Verify

gh attestation verify \
  oci://ghcr.io/kadet-hub/keda@sha256:e3cc0b2f6d047e48fbd34532727be44af644696af32a4d0844c2adeeac6f6af3 \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

Transparency log: Rekor entry 3250237951, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.

Kapitan declared: >=0.36.3,<0.37
Kapitan checked: 0.36.3
Backends checked: not recorded
With --cache: not recorded
krab: compatible
Built for (schema-checked): KEDA 2.21.0
Source: keda-v1.0.3 · e4891e8fd85ca0a19ebf361e8b54fd6473fd8a2f · keda
Binaries: none
Output capabilities: none
Digest: sha256:e3cc0b2f6d047e48fbd34532727be44af644696af32a4d0844c2adeeac6f6af3

Checks

Checked by the release run on 2026-10-14, gate at 8fbfd22097fa.

Secrets gitleaks 8.30.1
No secret matched the marketplace's gitleaks rules.
Malware ClamAV 1.5.4
No file matched a ClamAV signature.
Malicious package heuristics GuardDog 3.2.0
No GuardDog threat rule matched.
Dangerous code Semgrep 1.180.0
No marketplace Semgrep rule matched, such as eval, subprocess or network calls.
Python errors Ruff 0.17.0
No syntax error or undefined name (Ruff, error rules only).
File tree tree_check.py
No symlink, executable or banned file; imports within the allowlist.
Sandboxed compile gVisor 20261005, Kapitan 0.36.3
The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read.
Output capabilities Conftest 0.71.1
The compiled output uses only the capabilities the manifest declares.
CI detection Kapitan 0.36.3
The output is the same with CI variables set.

SBOM (SPDX 2.3)

Output diff

No output diff recorded: this version was published before the release run recorded one.

1.0.2# 2026-10-13

Inventory

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/keda:1.0.2@sha256:b80940afa4feb922f4572c5ffe715316e162a1077c2171d4025339fe7f38b290
        output_path: lib/keda

Verify

gh attestation verify \
  oci://ghcr.io/kadet-hub/keda@sha256:b80940afa4feb922f4572c5ffe715316e162a1077c2171d4025339fe7f38b290 \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

Transparency log: Rekor entry 3244179179, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.

Kapitan declared: >=0.36.3,<0.37
Kapitan checked: 0.36.3
Backends checked: not recorded
With --cache: not recorded
krab: compatible
Built for (schema-checked): KEDA 2.21.0
Source: keda-v1.0.2 · 9166cb30e0ae4874bc8f229c6a6823eff7451d04 · keda
Binaries: none
Output capabilities: none
Digest: sha256:b80940afa4feb922f4572c5ffe715316e162a1077c2171d4025339fe7f38b290

Checks

Checked by the release run on 2026-10-13, gate at 529dab245f19.

Secrets gitleaks 8.30.1
No secret matched the marketplace's gitleaks rules.
Malware ClamAV 1.5.4
No file matched a ClamAV signature.
Malicious package heuristics GuardDog 3.2.0
No GuardDog threat rule matched.
Dangerous code Semgrep 1.180.0
No marketplace Semgrep rule matched, such as eval, subprocess or network calls.
Python errors Ruff 0.17.0
No syntax error or undefined name (Ruff, error rules only).
File tree tree_check.py
No symlink, executable or banned file; imports within the allowlist.
Sandboxed compile gVisor 20261005, Kapitan 0.36.3
The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read.
Output capabilities Conftest 0.71.1
The compiled output uses only the capabilities the manifest declares.
CI detection Kapitan 0.36.3
The output is the same with CI variables set.

SBOM (SPDX 2.3)

Output diff

No output diff recorded: this version was published before the release run recorded one.

1.0.1# 2026-10-11

Inventory

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/keda:1.0.1@sha256:c9dc8ec8e5259d82118f7a26e2999dec53bee025b44ca810341c19beb4007164
        output_path: lib/keda

Verify

gh attestation verify \
  oci://ghcr.io/kadet-hub/keda@sha256:c9dc8ec8e5259d82118f7a26e2999dec53bee025b44ca810341c19beb4007164 \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

Transparency log: Rekor entry 3204400342, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.

Kapitan declared: >=0.36.3,<0.37
Kapitan checked: 0.36.3
Backends checked: not recorded
With --cache: not recorded
krab: compatible
Built for (schema-checked): KEDA 2.21.0
Source: keda-v1.0.1 · 458d3e62f3c5be32fb57924e286455969e8f576b · keda
Binaries: none
Output capabilities: none
Digest: sha256:c9dc8ec8e5259d82118f7a26e2999dec53bee025b44ca810341c19beb4007164

Checks

Checked by the release run on 2026-10-11, gate at aba169020294.

Secrets gitleaks 8.30.1
No secret matched the marketplace's gitleaks rules.
Malware ClamAV 1.5.4
No file matched a ClamAV signature.
Malicious package heuristics GuardDog 3.2.0
No GuardDog threat rule matched.
Dangerous code Semgrep 1.180.0
No marketplace Semgrep rule matched, such as eval, subprocess or network calls.
Python errors Ruff 0.17.0
No syntax error or undefined name (Ruff, error rules only).
File tree tree_check.py
No symlink, executable or banned file; imports within the allowlist.
Sandboxed compile gVisor 20261005, Kapitan 0.36.3
The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read.
Output capabilities Conftest 0.71.1
The compiled output uses only the capabilities the manifest declares.
CI detection Kapitan 0.36.3
The output is the same with CI variables set.

SBOM (SPDX 2.3)

Output diff

No output diff recorded: this version was published before the release run recorded one.

1.0.0# 2026-10-11

Inventory

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/keda:1.0.0@sha256:8ff7c02952f48255a456366aa00d7677c354b8993bd42fe97425509ac62a5c96
        output_path: lib/keda

Verify

gh attestation verify \
  oci://ghcr.io/kadet-hub/keda@sha256:8ff7c02952f48255a456366aa00d7677c354b8993bd42fe97425509ac62a5c96 \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

Transparency log: Rekor entry 3202022821, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.

Kapitan declared: >=0.36.3,<0.37
Kapitan checked: not recorded
Backends checked: not recorded
With --cache: not recorded
krab: compatible
Built for (schema-checked): not recorded
Source: keda-v1.0.0 · a79687266b89e35a4d533473ade613056f1b4d4d · keda
Binaries: none
Output capabilities: none
Digest: sha256:8ff7c02952f48255a456366aa00d7677c354b8993bd42fe97425509ac62a5c96

Checks

No scan record: this version was published before the release run recorded its checks. It passed the gate in its pull request.

No SBOM attestation for this version.

Output diff

No output diff recorded: this version was published before the release run recorded one.