helm/kedacore/keda 2.21.0 on Artifact Hub

We are happy to release KEDA 2.21.0 🎉

Important

KEDA 2.21.0 contains three breaking changes. If you are upgrading from KEDA 2.20, review Upgrading from KEDA 2.20 to 2.21 before upgrading.

Before upgrading from KEDA 2.20

Service account token audience enforcement (CVE-2026-77524)

KEDA 2.21 fixes the critical CVE-2026-77524 / GHSA-637c-6jxx-4rwm. You are affected if you use:

Vault Kubernetes authentication, including configurations using the operator token, an existing projected token, or credential.serviceAccountName.
Any TriggerAuthentication or ClusterTriggerAuthentication using boundServiceAccountToken, including integrations with Metrics API, Prometheus, Loki, Datadog Cluster Agent, and other token-authenticated receivers.

You are not affected if you use ordinary Vault token authentication, API keys, OAuth credentials, or another authentication method that does not use a bound service account token. Before upgrading, review carefully the upgrade guide

Temporal Rules-Based Versioning settings

The Temporal scaler no longer accepts the deprecated buildId, selectAllActive, and selectUnversioned settings. Existing ScaledObjects and ScaledJobs containing them will fail scaler metadata parsing. Remove the settings for unversioned workers, or migrate versioned workers to workerDeploymentName and workerDeploymentBuildId. See Temporal Rules-Based Versioning settings.

Azure Pipelines in-flight jobs

KEDA 2.21 adds scaleOnInFlight, defaulting to true. Queue length now includes unfinished jobs already assigned to an agent. Set scaleOnInFlight: false to retain the unassigned-only behavior from KEDA 2.20; for ScaledJobs, combine this with the accurate scaling strategy. See Azure Pipelines in-flight jobs.

Highlights

Reduce redundant scaler-backend requests when the HPA already owns the scaling decision (#7999, #8031).
Add Azure Cosmos DB Change Feed, ClickHouse, and GCP Cloud Spanner scalers.
Let external scalers update HPA targets dynamically through StreamMetricSpec, and expose external-scaler gRPC client metrics.
Add Prometheus OAuth2 client-credentials authentication, Kafka Kerberos credential-cache support, and Azure Pipelines service-principal authentication.
Improve scaler and authentication lifecycles with deterministic cancellation, refresh handling, Kubernetes API timeouts, and external-scaler connection cleanup.

Deprecation notice

The Liiklus scaler is deprecated because the upstream project is unmaintained. Its code is planned for removal in a later KEDA release. See #7929.

Learn how to deploy KEDA by reading our documentation.

🗓️ The next KEDA release is currently estimated for the 2nd week of January 2027. Learn more in our roadmap.

Breaking Changes

1e21cc7: Security: Enforce explicit service account token audiences to prevent TriggerAuthentication privilege escalation (CVE-2026-77524 / GHSA-637c-6jxx-4rwm; migration guide) (@wozniakjan)
587d3cd: Azure Pipelines Scaler: Include assigned, unfinished jobs by default with scaleOnInFlight: true (#7905; migration guide) (@dttung2905)
54a6651: Temporal Scaler: Remove deprecated buildId, selectAllActive, and selectUnversioned settings (#7985; migration guide) (@omkar619-dev)

Deprecations

5744068: Liiklus Scaler: Deprecate the scaler because its upstream project is unmaintained; removal is planned for a later KEDA release (#7938, #7929) (@Copilot)

New

14c25e5 : General: Accept pod-level cpu/memory requests in ScaledObject validation (#8119) (@ku524)
7a4c241 : General: controller sharding by label selectors (#7816) (@rossanorbr)
28ab751 : General: Add new GCP Cloud Spanner Scaler (#7844) (@n0rm4l-me)
82ac584 : General: Support StreamMetricSpec RPC in external scaler proto for dynamic HPA target updates (#7794) (@Fedosin)
a84afd5 : General: Add new Clickhouse Scaler (#7850) (@izaakschroeder)
7775bbd : ActiveMQ Scaler: Allow managementEndpoint to be set via TriggerAuthentication (#8129) (@AymenSunstice)
cbfc3f4 : Azure Cosmos DB: Introduce new Azure Cosmos DB Change Feed Scaler (#7557) (@yash2710)
2f37c71 : Azure Monitor Scaler: Add optional metricInterval mapping to the Azure Monitor interval parameter (#7526) (@nicknikolakakis)
b505912 : Kafka Scaler: support GSSAPI authentication with a Kerberos credential cache (#8069) (@Aytida-dev)
f136606 : Metrics: Add external scaler gRPC client metrics (#8199) (@aliaqel-stripe)
c92573e : Prometheus Scaler: Add support for OAuth2 client credentials authentication (#8064) (@thde)
51defd5 : Selenium Grid Scaler: add includeOngoingSessions trigger param (#8107) (@VietND96)
7548d04 : Splunk Observability Scaler: Add sum, count, latest aggregators (#8098) (@js4683)
c4511a2 : Sumologic Scaler: add support ignoreNullValues (#8117) (@rickbrouwer)
9a991fa : Temporal Scaler: add composite metric (backlog + running workflow count) (#7460) (@Sanil2108)
8360d22 : Temporal Scaler: add enableTLS parameter to control TLS with API key auth (#7854) (@LiorRabin)

Improvements

95701bd : General: Include release notes automatically replacing changelog.md (#7990) (@JorTurFer)
eb9a985 : General: Add flag to enable high-cardinality HTTP duration labels (#7751) (@aliaqel-stripe)
e7a7d70 : General: extract shared AuthMetadata struct for GCP scalers to eliminate duplicate credential fields (#8074) (@n0rm4l-me)
7afd9a0 : General: migrate datadog, graphite and github_runner, rabbitmq to authentication.Config (#7767) (@rickbrouwer)
87d6244 : General: stop polling triggers when pollingInterval is not relevant (#8031) (@rickbrouwer)
8e9247d : General: use scorecard.dev API badge in README (#7913) (@rickbrouwer)
4bd9fe1 : General: Share HTTP Transport across HTTP clients to avoid leaking connections (#7941) (@aliaqel-stripe)
88b0844 : General: Aggregate KEDA CRD permissions into default roles (#7872) (@amarkdotdev)
b1e8ee5 : General: move HPA health signal off Ready into a dedicated HPAActive condition (#7928) (@vishnu97770)
a673796 : Azure Pipelines Scaler: add service principal authentication via reusable Azure provider (#7931) (@m-amaresh)
617d0a3 : MSSQL Scaler: Add driverName to select the azuresql driver (#8120) (@DinethShakya23)
fac27c5 : Azure Scalers: add unit tests for Azure cloud environment resolution (#7859) (@Goutham-Annem)
82aede7 : AWS Scalers: Add unit tests for GetAwsAuthorization (#7836) (@archy-rock3t-cloud)
a45f085 : GCP Scalers: Add unit tests for GetGCPAuthorization (#7837) (@archy-rock3t-cloud)

Fixes

5b34e20 : General: Fix concurrent map iteration and map write in pkg/fallback (#7843) (@jiyuchen-stripe)
f193c7f : General: Fix nil pointer dereference in customScalingStrategy when customScalingQueueLengthDeduction is omitted (#7871) (@itxaiohanglover)
01cee0f : General: Guard against negative metric returned in scaler.go (#7889) (@dttung2905)
a9c246e : General: Fix panic in the HashiCorp Vault token renewal (#7940) (@archy-rock3t-cloud)
e794e30 : General: Ignore StreamMetricSpec updates that carry no metric specs (#8116) (@Fedosin)
8b4f083 : General: Keep cached metric records of healthy triggers on scaler errors (#8073) (@rickbrouwer)
41272b2 : General: Make cache deletion synchronous to fix concurrency bug in CachedMetrics (#8067) (@KengoA)
1e3954f : General: Timeout for Kubernetes API operations in scaling loops (#8174) (@josefkarasek)
db72b7c : General: fix context handling for scalers and auth refreshes (#8195) (@wozniakjan)
ee8a4dd : General: Restore gRPC reconnect backoff (#7857) (@simplyaduck)
c5b577c : General: Guard GetCurrentReplicas against nil ScaleTargetGVKR (#7661) (@ggarb)
97e1bd3 : General: use field indexes in verifyScaledObjects to avoid O(N) admission cost (#7681) (@ggarb)
ed8f3db : General: Fix concurrent map writes panic in the shared root CA CertPool (#7911) (@BojanZelic)
b4fc3fb : General: add "default" to ScaledJob scalingStrategy.strategy CRD enum (#7858) (@Goutham-Annem)
637c98e : General: correct pollingInterval and cooldownPeriod relevance check for idleReplicaCount (#7984) (@rickbrouwer)
dad6e70 : General: Emit ScaledJob removal event with the ScaledJob's namespace (#7968) (@tczhao)
5b81441 : General: Grant events permission on both core and events.k8s.io groups (#7923) (@linkvt)
ed5758d : General: Fix nil ptr dereference on uninitialized Deployment spec replicas (#7925) (@wozniakjan)
68d8aaa : General: scaler scheme: recurse on nested pointers and propagate 'optional' (#8128) (@wozniakjan)
f2f5cf0 : General: Fix stale scalercache (#8125) (@GnatorX)
8141d2e : CouchDB Scaler: Close the query result iterator instead of leaking the response body (#7907) (@vidigoat)
86a4ebf : Dynatrace Scaler: Handle all documented DQL query states in execute and poll paths (#7986) (@jcrosel)
035585f : External Scaler: release pooled gRPC connections when the last scaler closes (#8193) (@harshrajdebug)
8d426ed : External Push Scaler: Activation send blocking on stream cancellation (#8170) (@shashankvarma499)
4fb4084 : Github Scaler: key per-run job cache by (repo, runID) (#7952) (@hontarenko)
2f4ebfd : Kafka Scaler: Exclude retention-deleted messages from lag for uncommitted offsets (#7937) (@Nikko-Foti)
778907e : Metrics API Scaler: reject auth modes the scaler does not implement (#8178) (@rickbrouwer)
2963aa3 : Metrics Service: Rebuild CA cert pool on rotation to prevent data race and monotonic growth (#8126) (@zanarellidev)
d010627 : RabbitMQ scaler: fix empty queue handling during fast drain (#8033) (@wozniakjan)
4b7a369 : Solr Scaler: fail on non-200 instead of reporting an empty queue (#8037) (@PrazwalR)
0a7815a : Splunk Observability Scaler: Close SignalFlow client on teardown (#8134) (@js4683)
3a4a73e : Azure Blob Scaler: strip leading slash from globPattern before matching (#7876) (@Goutham-Annem)
0419a25 : CI: replace status check functions in with: expressions (#7970) (@rickbrouwer)
6f589e7 : Mongo Scaler: Disconnect client when initial Ping fails to avoid leaking connections (#7904) (@orfeldman-evolinq)
6375f8b : Kafka Scaler: Metadata scoping (#7886) (@Heniland)
9d0ec6f : Azure EventHub Scaler: Avoid passing EventHubName when connection string contains EntityPath (#7926) (@njuCZ)
503abe3 : AWS Secret Manager: Guard nil credentials in handler (#7932) (@sobol-sudo)

Other

145db7f : General: Automate cherry-pick backports via labels (#7987) (@JorTurFer)
0a86363 : General: Improve e2e comments check to reduce agent usage (#7988) (@JorTurFer)
72a80b7 : General: Improve release notes sorting the entries (#8041) (@JorTurFer)
5fc9e32 : General: Some improvements related with release notes generation (#8010) (@JorTurFer)
cd4bffc : CI: pin Argo Rollouts e2e dependency (#8095) (@linkvt)
a608b83 : CI: use server-side apply for Argo Rollouts (#8094) (@linkvt)
0992d51 : CI: fix broken helper.go links in tests README (#7867) (@s3onghyun)

CI

Show

25e37bd : CI: Add e2e coverage for paused annotation precedence (#7849) (@aliaqel-stripe)
97d2d26 : CI: Force KEDA resources deletion after e2e tests (#8042) (@JorTurFer)
bf1ea1d : CI: assert what the nil identity id tests claim to check (#8024) (@Fedosin)
d14108c : CI: defer cleanup in file_based_auth so the ClusterTriggerAuthentication cannot leak (#8027) (@Fedosin)
d4f6918 : CI: install optional e2e components based on per-test dependency markers (#8038) (@rickbrouwer)
3146a35 : CI: keep waiting when a KedaEventually condition cannot be observed (#8025) (@Fedosin)
39396ed : CI: make the mysql readiness probe mean mysql is reachable (#8029) (@Fedosin)
258b628 : CI: mongodb and selenium activation tests watch a window instead of sleeping through it (#8154) (@Fedosin)
e6ad4ed : CI: re-enable splunk o11y e2e tests (#8012) (@circa10a)
aeb7920 : CI: replica-ready waits must observe the rollout, not just the count (#8035) (@Fedosin)
e48976d : CI: wait for pods to be ready, not merely running (#8026) (@Fedosin)
bb4ad4a : CI: wait for the first job instead of sleeping one polling interval (#8028) (@Fedosin)
87df4de : RabbitMQ scaler: close test HTTP servers (#8076) (@Karthik-Chowdary)
58229df : CI: surface setup/teardown failures in the /run-e2e PR comment (#7809) (@wozniakjan)
0882549 : CI: e2e azure_pipelines scope build cleanup to own definition (#7982) (@wozniakjan)
6038302 : CI: e2e eventemitter/azureeventgridtopic drain foreign events from subscription (#7980) (@wozniakjan)
38428b1 : CI: e2e forgejo bump scale-in timeout 1min -> 3min (#7934) (@wozniakjan)
0f2c27e : CI: e2e rabbitmq eqct purge queue before scale-in assertion (#7981) (@wozniakjan)
8ac846f : CI: e2e selenium pre-pull browser node images before scaling assertions (#7979) (@wozniakjan)
586aca8 : CI: e2e vault wait for vault pod ready (#7978) (@wozniakjan)
2f91d45 : CI: enhance forgejo scale-in diagnostics (#7921) (@wozniakjan)
8d1a3c8 : CI: ensure e2e check runs are always finalized instead of left hanging (#7965) (@rickbrouwer)
ee6a361 : CI: SJ started scalers event + flaky e2e fixes (#7820) (@wozniakjan)
02cd4dd : CI: address github_runner e2e test flakiness (#7842) (@wozniakjan)
f126bef : CI: don't let a failed API read satisfy an e2e wait (#7996) (@Fedosin)
23c3fd8 : CI: wait for metrics instead of sleeping in opentelemetry_metrics (#7974) (@Fedosin)
bf09609 : CI: wait for the pause to take effect in pause_scaledobject_explicitly (#7975) (@Fedosin)
e4b2d9b : CI: wait for the status CheckKubectlGetResult reads (#8023) (@Fedosin)
7e62f2d : CI: wait for what the assertions read in prometheus_metrics (#7992) (@Fedosin)

Dependencies