github.com/kedacore/http-add-on

Highlights

HTTP/2 and gRPC support (#1084)

The interceptor now supports HTTP/2 (h2c and h2 over TLS), enabling autoscaling of gRPC workloads. Backend transport is selected based on the Kubernetes appProtocol field on the Service port (#1676): cleartext backends default to HTTP/1.1 unless appProtocol: kubernetes.io/h2c is set; TLS backends negotiate via ALPN.

The KEDA_HTTP_FORCE_HTTP2 environment variable has been removed — HTTP/2 is now negotiated automatically.

Cold-start placeholder responses (#874)

New coldStart.placeholder support lets you return static HTTP responses while a workload scales from zero, instead of holding the request until a pod is ready.

Scaler resilience (#1667)

The scaler now tolerates partial interceptor pod failures instead of restarting on a single unreachable endpoint. Last-known concurrency is cached for unreachable pods to prevent underreporting.

Graceful shutdown (#1636)

The interceptor now drains in-flight requests before exiting. It waits for active handlers to complete (bounded by KEDA_HTTP_DRAIN_TIMEOUT), marks the readiness probe unhealthy immediately on SIGTERM, and delays listener closure by KEDA_HTTP_SHUTDOWN_DELAY to let Kubernetes propagate endpoint removal.

Deprecations

• KEDAHTTP_OPERATOR_EXTERNAL_SCALER_SERVICE and KEDAHTTP_OPERATOR_EXTERNAL_SCALER_PORT have been renamed to KEDA_HTTP_OPERATOR_EXTERNAL_SCALER_SERVICE and KEDA_HTTP_OPERATOR_EXTERNAL_SCALER_PORT. Old names still work but log a deprecation warning. (#1623)

What's Changed

• fix(deps): update module github.com/cert-manager/cert-manager to v1.19.5 by @renovate[bot] in #1612
• fix: disable digest pinning for kindest/node in renovate by @linkvt in #1614
• chore: group e2e-framework with Kubernetes deps in renovate by @linkvt in #1613
• chore(deps): update e2e dependencies by @renovate[bot] in #1615
• chore(deps): update dependency golangci/golangci-lint to v2.12.1 by @renovate[bot] in #1616
• fix(deps): update go dependencies (non-major) by @renovate[bot] in #1611
• chore: remove unused .dockerignore file by @linkvt in #1621
• ci: add stable e2e summary job for branch protection by @linkvt in #1618
• chore: improve OpenSSF Scorecard security posture by @linkvt in #1620
• fix(ci): add retry logic to e2e Helm dependency installs by @Fedosin in #1584
• fix: rename KEDAHTTP_OPERATOR_EXTERNAL_SCALER_* env vars to KEDA_HTTP_OPERATOR_EXTERNAL_SCALER_* by @Fedosin in #1623
• fix: use downward API for namespace env vars instead of hardcoded value by @Fedosin in #1625
• chore: add OpenSSF and community badges to README by @linkvt in #1624
• chore(deps): update github actions by @renovate[bot] in #1630
• chore(deps): update dependency golangci/golangci-lint to v2.12.2 by @renovate[bot] in #1629
• chore(deps): update ghcr.io/wolfi-dev/static:alpine docker digest to de720d5 by @renovate[bot] in #1627
• fix(deps): update k8s.io/utils digest to ff6756f by @renovate[bot] in #1628
• chore: flatten nested checklist in PR template by @linkvt in #1632
• chore: exclude gnu.org/make from lychee link checks by @linkvt in #1631
• feat: add native Go fuzz tests for untrusted-input surfaces by @Fedosin in #1599
• chore(deps): update actions/upload-artifact action to v7 by @renovate[bot] in #1642
• chore(deps): update github/codeql-action action to v4.35.5 by @renovate[bot] in #1638
• chore(deps): update e2e dependencies by @renovate[bot] in #1640
• fix(deps): update go dependencies (non-major) to v0.34.8 by @renovate[bot] in #1639
• fix(deps): update go dependencies (non-major) by @renovate[bot] in #1641
• docs: reference new e2e test suite in contributor docs by @linkvt in #1635
• chore: remove old HTTPSO examples by @linkvt in #1643
• Replace gorilla/websocket with coder/websocket by @Akram-saj in #1633
• fix(deps): update module github.com/coder/websocket to v1.8.14 by @renovate[bot] in #1650
• perf: strip managed fields from controller-runtime cache by @linkvt in #1651
• chore(deps): update module golang.org/x/net to v0.55.0 [security] by @renovate[bot] in #1652
• chore(deps): update github actions by @renovate[bot] in #1653
• chore(deps): update helm release opentelemetry-collector to v0.156.2 - autoclosed by @renovate[bot] in #1654
• ci: add workflow to block PRs with 'on hold' label by @linkvt in #1647
• feat: add coldStart.placeholder support for static responses by @linkvt in #1626
• feat(scaler): add observability (metrics + tracing) to the external scaler by @Fedosin in #1634
• chore(deps): update helm release opentelemetry-collector to v0.158.0 by @renovate[bot] in #1660
• fix: filter GetMetrics response by requested metric name by @linkvt in #1664
• feat: add s390x to release platforms by @linkvt in #1663
• chore: clean up README and remove outdated files by @linkvt in #1666
• fix(deps): update go dependencies (non-major) by @renovate[bot] in #1661
• fix(interceptor): close request body to prevent panic by @linkvt in #1669
• fix(deps): update go dependencies (non-major) to v1.44.0 by @renovate[bot] in #1673
• chore(deps): update github actions by @renovate[bot] in #1671
• chore(deps): update e2e dependencies by @renovate[bot] in #1672
• fix: drain in-flight requests on shutdown by @linkvt in #1648
• feat: add gRPC and HTTP/2 support to interceptor by @linkvt in #1658
• chore: use pinned version comments for GitHub Actions by @linkvt in #1674
• fix: tolerate partial interceptor pod failures in scaler by @Fedosin in #1670
• feat: select backend transport via service appProtocol by @linkvt in #1678
• chore: pin helm version and add timeouts to e2e helm installs by @linkvt in #1686
• fix(deps): update go dependencies (non-major) to v0.34.9 by @renovate[bot] in #1682
• chore(deps): update ghcr.io/wolfi-dev/static:alpine docker digest to 6a4616e by @renovate[bot] in #1680
• chore(deps): update pre-commit hooks to v2.5.0 by @renovate[bot] in #1683
• fix(deps): update go dependencies (non-major) by @renovate[bot] in #1684
• chore: prepare release v0.15.0 by @linkvt in #1687

New Contributors

• @Akram-saj made their first contribution in #1633

Full Changelog: v0.14.0...v0.15.0

New

• General: Add s390x to supported release platforms (#1662)
• General: Add coldStart.placeholder support for returning static HTTP responses during scale-from-zero (#874)
• Interceptor: Add HTTP/2 support (h2c and h2 over TLS), enabling autoscaling of gRPC workloads (#1084)
• Interceptor: Select backend transport based on Kubernetes appProtocol instead of mirroring the client's protocol. Cleartext backends default to HTTP/1.1 unless the Service port sets appProtocol: kubernetes.io/h2c; TLS backends negotiate via ALPN (#1676)
• Scaler: Add OpenTelemetry metrics and distributed tracing to the external scaler (#965)

Improvements

• General: Strip managed fields from controller-runtime cache to reduce memory consumption (#1651)

Fixes

• Interceptor: Fix graceful shutdown so in-flight requests are drained before the process exits. The interceptor now waits for active handlers to complete (bounded by KEDA_HTTP_DRAIN_TIMEOUT), marks the readiness probe unhealthy immediately on SIGTERM, and delays listener closure by KEDA_HTTP_SHUTDOWN_DELAY to let Kubernetes propagate endpoint removal. (#1636)
• Interceptor: Fix panic with "invalid concurrent Body.Read call" when reverse proxy fails without consuming the request body (#1668)
• Scaler: Fix incorrect HPA values when both concurrency and requestRate metrics are configured (#1659)
• Scaler: Tolerate partial interceptor pod failures instead of restarting the scaler on a single unreachable endpoint; cache last-known concurrency for unreachable pods to prevent underreporting (#1667)

Deprecations

• Interceptor: Remove KEDA_HTTP_FORCE_HTTP2 environment variable. This is not a breaking change — HTTP/2 is now negotiated automatically. (#1084)
• Operator: Rename KEDAHTTP_OPERATOR_EXTERNAL_SCALER_SERVICE and KEDAHTTP_OPERATOR_EXTERNAL_SCALER_PORT environment variables to KEDA_HTTP_OPERATOR_EXTERNAL_SCALER_SERVICE and KEDA_HTTP_OPERATOR_EXTERNAL_SCALER_PORT. Old names are still accepted but log a deprecation warning and will be removed in a future release. (#1623)

Breaking Changes

Interceptor timeout defaults changed (#1474)

Default timeout behavior has been redesigned. KEDA_HTTP_REQUEST_TIMEOUT now defaults to 0 (disabled), KEDA_HTTP_RESPONSE_HEADER_TIMEOUT defaults to 300s (was 500ms), and KEDA_HTTP_READINESS_TIMEOUT defaults to 0 (disabled, was 20s). Timeout errors now return 504 instead of 502.

The following environment variables have been removed: KEDA_HTTP_TLS_HANDSHAKE_TIMEOUT, KEDA_HTTP_EXPECT_CONTINUE_TIMEOUT, KEDA_HTTP_KEEP_ALIVE, KEDA_HTTP_IDLE_CONN_TIMEOUT, KEDA_HTTP_DIAL_RETRY_TIMEOUT. These now use Go's DefaultTransport defaults.

Interceptor metrics redesigned (#1563, #1590)

Metrics now use bounded labels: path/host replaced by route_name/route_namespace, and non-standard HTTP methods are normalized to _OTHER. Metrics have also been renamed to follow OTel semantic conventions: interceptor_requests_total → interceptor_request_count_total, interceptor_pending_requests → interceptor_request_concurrency. Dashboards must be updated.

Highlights

New documentation (#1516)

The documentation has been completely rewritten and now lives at keda.sh/http-add-on. It features versioned docs, improved navigation, a quick start and guides for different personas (developers, cluster operators). The legacy in-repo docs have been removed.

InterceptorRoute CRD (#1532)

A new InterceptorRoute CRD separates routing/interceptor configuration from scaling configuration. HTTPScaledObject remains supported but is now deprecated — a warning is logged per resource to guide migration.

See the user guide and the migration guide for details.

Per-route timeout configuration (#1562)

InterceptorRoute supports per-route timeouts via the timeouts spec with request, responseHeader, and readiness fields. When unset, global env var defaults are used.

Migration helper: orphan-scaledobject annotation (#1593)

The new httpscaledobject.keda.sh/orphan-scaledobject annotation lets you preserve the auto-created ScaledObject when deleting an HTTPScaledObject during migration to InterceptorRoute, avoiding scaling gaps.

What's Changed

• refactor: simplify responseWriter using Unwrap pattern by @linkvt in #1555
• feat: implement InterceptorRoute CRD by @linkvt in #1532
• refactor: extract endpoint resolution into dedicated middleware by @linkvt in #1558
• chore(deps): update azure/setup-helm action to v5 by @renovate[bot] in #1561
• chore(deps): update github actions by @renovate[bot] in #1560
• refactor: move RPS calculation from interceptor to scaler by @Fedosin in #1557
• refactor: add new e2e test suite by @linkvt in #1545
• fix: reduce OTEL_METRIC_EXPORT_INTERVAL from 1ms to 5s by @linkvt in #1564
• fix(deps): update go dependencies (non-major) (patch) by @renovate[bot] in #1566
• chore(deps): update e2e dependencies by @renovate[bot] in #1565
• fix(deps): update go dependencies (non-major) by @renovate[bot] in #1568
• chore(deps): update github actions by @renovate[bot] in #1567
• refactor: extract test cert generation into a shared helper by @linkvt in #1569
• fix: resolve semgrep findings by @linkvt in #1570
• feat: redesign interceptor metrics with bounded labels by @linkvt in #1563
• chore(deps): update helm release opentelemetry-collector to v0.150.0 by @renovate[bot] in #1574
• fix(deps): update module go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp to v0.68.0 by @renovate[bot] in #1576
• chore: switch whoami test image to ghcr.io by @linkvt in #1572
• feat: implement per-route timeout configuration by @linkvt in #1562
• chore(deps): update pre-commit hook thlorenz/doctoc to v2.4.1 by @renovate[bot] in #1575
• chore(deps): bump github.com/moby/spdystream from 0.5.0 to 0.5.1 by @dependabot[bot] in #1579
• chore: automate kind version updates via Renovate by @linkvt in #1573
• refactor: set Content-Type in interceptor queue endpoint handler by @linkvt in #1580
• ci: reduce lychee link checker flakiness by @linkvt in #1582
• feat: support OTEL_TRACES_SAMPLER and OTEL_TRACES_SAMPLER_ARG settings by @Fedosin in #1577
• chore(deps): update github actions by @renovate[bot] in #1586
• fix(deps): update go dependencies (non-major) to v0.34.7 (patch) by @renovate[bot] in #1587
• refactor/feat(e2e): improve test reliability and add new InterceptorRoute e2e tests by @Fedosin in #1583
• fix: restrict metrics endpoint to /metrics path by @linkvt in #1591
• refactor: align metric names with OTel semantic conventions by @linkvt in #1590
• refactor: nest cold-start fallback service fields under service key by @linkvt in #1588
• feat: log deprecation warning for HTTPScaledObject by @linkvt in #1595
• feat: require explicit targetValue in scaling metric specs by @linkvt in #1597
• refactor: simplify queue count types and fix RPS naming by @linkvt in #1581
• feat: add orphan-scaledobject annotation for HTTPSO->IR migration by @linkvt in #1593
• chore: remove kubebuilder scaffolding artifacts by @linkvt in #1598
• chore: remove legacy in-repo docs in favor of keda.sh by @linkvt in #1594
• chore: pin ko base image to digest and track with Renovate by @linkvt in #1605
• chore: prepare release v0.14.0 by @linkvt in #1607

Full Changelog: v0.13.0...v0.14.0

Breaking Changes

• Interceptor: Change default timeout behavior: request timeout (KEDA_HTTP_REQUEST_TIMEOUT) defaults to 0 (disabled), response header timeout (KEDA_RESPONSE_HEADER_TIMEOUT → KEDA_HTTP_RESPONSE_HEADER_TIMEOUT) defaults to 300s (was 500ms), and readiness timeout (KEDA_CONDITION_WAIT_TIMEOUT → KEDA_HTTP_READINESS_TIMEOUT) defaults to 0 (disabled, was 20s). Timeout errors return 504 instead of 502. (#1474)
• Interceptor: Redesign interceptor metrics with bounded labels: path/host labels replaced by route_name/route_namespace; non-standard HTTP methods normalized to _OTHER; dashboards must be updated (#1559)
• Interceptor: Remove KEDA_HTTP_TLS_HANDSHAKE_TIMEOUT, KEDA_HTTP_EXPECT_CONTINUE_TIMEOUT, KEDA_HTTP_KEEP_ALIVE, KEDA_HTTP_IDLE_CONN_TIMEOUT, and KEDA_HTTP_DIAL_RETRY_TIMEOUT environment variables; these now use Go's DefaultTransport defaults. (#1474)
• Interceptor: Rename interceptor metrics to follow OTel semantic conventions: interceptor_requests_total → interceptor_request_count_total, interceptor_pending_requests → interceptor_request_concurrency, interceptor_request_duration_seconds unchanged (#1589)

New

• General: Add InterceptorRoute CRD to separate routing/interceptor config from scaling config; HTTPScaledObject remains supported but will be deprecated in a future release (#1501)
• Interceptor: Add per-route timeout configuration via InterceptorRoute timeouts spec with request, responseHeader, and readiness fields. When unset, global env var defaults are used. When a fallback service is configured and no readiness timeout is set, it defaults to 30s. (#1474)
• Operator: Add httpscaledobject.keda.sh/orphan-scaledobject annotation to preserve ScaledObjects during HTTPScaledObject-to-InterceptorRoute migration (#1593)

Improvements

• Interceptor: Support OTEL_TRACES_SAMPLER and OTEL_TRACES_SAMPLER_ARG for trace sampling configuration (#1534)
• Scaler: Move request-rate calculation from interceptor to scaler for a consistent view of request rate across all interceptor replicas (#1557)

Fixes

• Interceptor: Restrict metrics endpoint to /metrics path only, matching the Prometheus scrape convention (#1591)

Deprecations

• Interceptor: Deprecate KEDA_CONDITION_WAIT_TIMEOUT and KEDA_RESPONSE_HEADER_TIMEOUT environment variables in favor of KEDA_HTTP_READINESS_TIMEOUT and KEDA_HTTP_RESPONSE_HEADER_TIMEOUT. Old vars take precedence when set and log deprecation warnings. (#1474)
• Operator: Log deprecation warning for HTTPScaledObject resources, guiding users to migrate to InterceptorRoute (#1595)

Other

• General: Remove legacy in-repo documentation in favor of keda.sh/http-add-on (#1516)

What's Changed

• chore: replace Dependabot with Renovate by @linkvt in #1476
• chore: exclude existing revive var-naming lint issues by @linkvt in #1475
• chore: remove unused CurrentNamespace from interceptor config by @Fedosin in #1484
• fix: update roundToNDigits to use Round instead of Floor by @Fedosin in #1483
• chore(deps): update actions/checkout action to v6 by @renovate[bot] in #1486
• fix(deps): update module go.opentelemetry.io/otel/sdk to v1.40.0 [security] by @renovate[bot] in #1481
• fix: replace deprecated release asset upload actions by @linkvt in #1490
• refactor: replace kelseyhightower/envconfig with caarlos0/env by @linkvt in #1491
• chore: move renovate config to .github dir by @linkvt in #1480
• refactor: migrate build system from Docker to ko by @linkvt in #1465
• refactor: modernize code with go fix by @linkvt in #1494
• refactor: remove dead code identified by deadcode analysis by @linkvt in #1493
• chore: remove archived pre-commit-golang hook by @linkvt in #1495
• perf: add atomic endpoint readiness cache for O(1) hot-path checks by @Fedosin in #1472
• chore: replace hack/tools.go with go.mod tool directive by @linkvt in #1498
• ci: use stable Go version in CI workflows by @linkvt in #1499
• ci: replace keda-tools container with setup-go in CodeQL workflow by @linkvt in #1502
• chore: enable Renovate kubernetes manager for config/ and examples/ by @linkvt in #1503
• chore(config): migrate Renovate config by @renovate[bot] in #1504
• chore(deps): pin dependencies by @renovate[bot] in #1505
• chore(deps): pin golang docker tag to 8bbd140 by @renovate[bot] in #1506
• chore(deps): update pre-commit hook thlorenz/doctoc to v2.3.0 by @renovate[bot] in #1510
• fix(deps): update k8s.io/utils digest to b8788ab by @renovate[bot] in #1508
• chore(deps): update golang docker tag to v1.26.0 by @renovate[bot] in #1509
• chore: improve Renovate dependency grouping by @linkvt in #1507
• chore: remove unused .whitesource configuration by @linkvt in #1513
• fix: reorder Renovate packageRules so specific groups override catch-all by @linkvt in #1514
• chore: extend k8s renovate group with more related pkgs by @linkvt in #1515
• fix(deps): update go dependencies (non-major) by @renovate[bot] in #1511
• fix: fix flaky and skipped tracing e2e tests by @linkvt in #1517
• chore: configure renovate post-update options for Go modules by @linkvt in #1518
• refactor: modernize golangci-lint config and fix issues by @linkvt in #1497
• perf: replace global queue lock with per-host atomics and eliminate counting goroutines by @Fedosin in #1482
• fix: resolve golangci-lint v2.11.1 gosec and nolintlint issues by @Fedosin in #1522
• chore(deps): update github actions by @renovate[bot] in #1524
• chore(deps): update golang docker tag to v1.26.1 by @renovate[bot] in #1525
• chore(deps): update docker/login-action action to v4 by @renovate[bot] in #1529
• fix(deps): update go dependencies (non-major) by @renovate[bot] in #1526
• fix: remove configurable EndpointSlice informer resync interval by @Fedosin in #1485
• fix: drop semconv version-pinned import in favor of schemaless resources by @linkvt in #1531
• refactor(scaler): use WaitGroup.Go for queue pinger goroutines by @Fedosin in #1535
• docs: replace deprecated targetPendingRequests with scalingMetric in design.md by @Paul-Weaver in #1536
• chore: track golangci-lint version with renovate by @linkvt in #1537
• chore: group regex-managed action versions with GitHub Actions updates by @linkvt in #1539
• chore: provide minimal devcontainer config by @linkvt in #1538
• chore(config): migrate Renovate config by @renovate[bot] in #1540
• chore(deps): update github actions by @renovate[bot] in #1542
• refactor: replace homebrew endpoints cache with controller-runtime cache by @Fedosin in #1533
• tracing: Remove B3 trace propagation by @AtharvaPakade in #1543
• feat: add env-based TLS version, cipher suite, and curve configuration by @Fedosin in #1530
• fix(deps): update module google.golang.org/grpc to v1.79.3 [security] by @renovate[bot] in #1546
• chore(deps): update github actions by @renovate[bot] in #1553
• fix(deps): update k8s.io/utils digest to 28399d8 by @renovate[bot] in #1554
• chore: improve issue templates and add needs-triage label by @linkvt in #1552
• chore: prepare release v0.13.0 by @Fedosin in #1556

New Contributors

• @renovate[bot] made their first contribution in #1486
• @Paul-Weaver made their first contribution in #1536
• @AtharvaPakade made their first contribution in #1543

Full Changelog: v0.12.2...v0.13.0

Breaking Changes

• Interceptor: Remove B3 (Zipkin) trace propagation, only W3C TraceContext and W3C Baggage are now supported (#1519)

Improvements

• Docs: Update design doc to use scalingMetric/targetValue instead of deprecated targetPendingRequests (#1536)
• Interceptor: Add env-based TLS configuration for min/max version, cipher suites, and curve preferences (#1530)
• Interceptor: Reduce interceptor latency and memory usage under high concurrency (#1482)
• Interceptor: Speed up endpoint readiness checks with a fast lookup cache (#1472)

Fixes

• General: Fix roundToNDigits using math.Round instead of math.Floor to correctly round small negative floating-point errors to zero (#1483)
• Interceptor: Remove configurable KEDA_HTTP_ENDPOINTS_CACHE_POLLING_INTERVAL_MS and hardcode EndpointSlice informer resync to 60m (#1485)
• Scaler: Remove unused KEDA_HTTP_SCALER_DEPLOYMENT_INFORMER_RSYNC_PERIOD env var (#1533)

Other

• Interceptor: Remove unused CurrentNamespace field and KEDA_HTTP_CURRENT_NAMESPACE env var from interceptor config (#1484)

Upgrade Notes

• Interceptor health probe endpoints moved to the admin port (9090). No action needed if using the Helm chart. If you use custom external health checks (e.g., GCP HealthCheckPolicy), update them to target port 9090 for /readyz and /livez.

Improvements

• Interceptor: Increase default connection pool sizes for higher throughput (#1469)

Fixes

• Interceptor: Fix health probes failing when HTTPScaledObject has no hosts configured (#1447)
• Interceptor: Rework dial retry to tolerate slow Service IP propagation and add KEDA_HTTP_DIAL_RETRY_TIMEOUT (#1449)
• Interceptor: Set endpoint informer resync default to 1s to suppress warning (#1455)

Full Changelog: v0.12.1...v0.12.2

Improvements

• Interceptor: Increase default connection pool sizes for higher throughput (#1469)

Fixes

• Interceptor: Fix health probes failing when HTTPScaledObject has no hosts configured (#1447)
• Interceptor: Rework dial retry to tolerate slow Service IP propagation and add KEDA_HTTP_DIAL_RETRY_TIMEOUT (#1449)
• Interceptor: Set endpoint informer resync default to 1s to suppress warning (#1455)

What's Changed

• chore: cleanup old docs and examples by @linkvt in #1430
• fix(interceptor): preserve upstream X-Forwarded headers by @linkvt in #1434
• chore(deps): bump docker/login-action from 3.6.0 to 3.7.0 in the all-updates group by @dependabot[bot] in #1438
• Add CodeQL by @JorTurFer in #1437
• chore: prepare release v0.12.1 by @linkvt in #1441

Full Changelog: v0.12.0...v0.12.1

Fixes

• Interceptor: Preserve X-Forwarded-Proto and X-Forwarded-Host headers from upstream proxies (#1432)

Breaking Changes

HTTPScaledObject CRD must be updated (#1419)

You must update the HTTPScaledObject CRD before upgrading the operator. The .status.conditions field now uses the standard Kubernetes metav1.Condition format.

If you have tooling that parses HTTPScaledObject conditions, update it to expect standard fields (lastTransitionTime, observedGeneration).

This fixes duplicate Ready conditions that caused issues with GitOps tools like ArgoCD and Flux.

Highlights

Wildcard host matching (#1411)

Use wildcard patterns like *.example.com to match any subdomain with a single HTTPScaledObject.

spec:
  hosts:
    - "*.example.com"  # matches foo.example.com, bar.foo.example.com, etc.

HTTP header-based routing (#1289)

Route requests to different backends based on HTTP headers. Multiple HTTPScaledObjects can now match the same host and path with different header requirements.

apiVersion: http.keda.sh/v1alpha1
kind: HTTPScaledObject
spec:
  hosts:
    - api.example.com
  headers:
    - name: X-API-Version
      value: v2
  scaleTargetRef:
    name: api-v2

Performance improvements (#1404)

The interceptor now uses significantly less memory under load, with reduced memory growth over time. Latency is also improved for high-throughput workloads.

Full-duplex HTTP/1.1 support (#1386)

Bidirectional streaming now works correctly - response bodies can start streaming while request bodies are still being sent.

Configurable request logging (#1375)

Request logging in the interceptor is now optional. Disable it to reduce log volume in high-traffic environments.

What's Changed

• Update ADOPTERS.md for IMVARIA inc. by @dcb-imvaria in #1366
• interceptor: make request logging optional by @wozniakjan in #1375
• feat: add environment variables for leader election timing configuration by @nader-ziada in #1365
• fix broken link to propulsion ai by @wozniakjan in #1381
• chore: fix devcontainer build by updating deprecated Go tools by @linkvt in #1384
• ci: use GitHub-hosted ARM64 runners for e2e tests by @linkvt in #1389
• chore(deps): bump the all-updates group across 1 directory with 5 updates by @dependabot[bot] in #1377
• chore(deps): bump github.com/expr-lang/expr from 1.17.6 to 1.17.7 by @dependabot[bot] in #1401
• Improve interceptor performance and allocations by @linkvt in #1404
• ci: replace stale bot with official GitHub Actions stale action by @linkvt in #1398
• fix: spaces are allowed in project basepath (#1392) by @khauser in #1393
• fix: decouple connection retry backoff from TCP dial timeout by @linkvt in #1387
• fix: consolidate HTTPScaledObject status updates to prevent conflicts by @Fedosin in #1408
• fix: prevent duplicate conditions by matching on Type instead of Reason by @linkvt in #1395
• chore(deps): update OpenTelemetry semconv version to v1.37.0 by @jochbru in #1407
• ci: update e2e test k8s and kind versions by @linkvt in #1413
• feat: add wildcard host matching for HTTPScaledObject by @linkvt in #1411
• feat: expose and secure controller-runtime metrics by @khauser in #1369
• chore: Fix codeowner and add the notification flow by @JorTurFer in #1416
• refactor: simplify TableMemory and remove dead code by @linkvt in #1412
• Support full-duplex http1.1 by @jackkleeman in #1386
• chore(deps): bump the all-updates group across 1 directory with 3 updates by @dependabot[bot] in #1414
• Bump golang to 1.25.5 + small fixes by @JorTurFer in #1418
• chore(deps): bump github.com/kedacore/keda/v2 from 2.18.0 to 2.18.3 by @dependabot[bot] in #1406
• interceptor: support for HTTP header routing by @wozniakjan in #1289
• refactor(operator)!: migrate to standard metav1.Condition by @linkvt in #1419
• e2e test: header routing by @wozniakjan in #1420
• feat: Add FOSSA to monitor licenses by @JorTurFer in #1422
• chore: update dependencies and remove version pinning by @linkvt in #1424
• chore(deps): bump actions/checkout from 6.0.1 to 6.0.2 in the all-updates group by @dependabot[bot] in #1426
• chore: prepare for release 0.12.0 by @linkvt in #1429

New Contributors

• @dcb-imvaria made their first contribution in #1366
• @nader-ziada made their first contribution in #1365
• @linkvt made their first contribution in #1384
• @khauser made their first contribution in #1393
• @Fedosin made their first contribution in #1408
• @jochbru made their first contribution in #1407
• @jackkleeman made their first contribution in #1386

Full Changelog: v0.11.1...v0.12.0

Breaking Changes

• Operator: Migrate HTTPScaledObject status conditions to standard metav1.Condition type (#1409)

New

• General: Add environment variables for leader election timing configuration (#1365)
• General: Add multi-level wildcard host matching for HTTPScaledObject routing (#281)

Improvements

• General: Make interceptor request logging optional (#1375)
• Interceptor: Add support for full-duplex HTTP1.1 (#1386)
• Interceptor: Route requests by HTTP header matching (#1177)
• Interceptor: Significant performance improvements (#1403)

Fixes

• Interceptor: Decouple connection retry backoff from TCP dial timeout for faster cold starts (#1385)
• Operator: Fix conflict errors when updating HTTPScaledObject status (#1402)
• Operator: Prevent duplicate Ready conditions in HTTPScaledObject status by matching on Type instead of Reason (#1390)

Deprecations

None

Other

• General: Fix Makefile to support spaces in project base path (#1392)
• General: Get rid of kube-rbac-proxy (#1369)
• General: Update OpenTelemetry semconv version to v1.37.0 (#1407)
• CI: Replace stale bot with official GitHub Actions stale action (#1398)
• CI: Use GitHub-hosted ARM64 runners for e2e tests (#1388)
• DevContainer: Fix devcontainer build by updating deprecated Go tools (#1347)

What's Changed

• Update Kubernetes compatibility documentation to include v1.33, v1.34, and v0.11.0 release by @Copilot in #1349
• fix: check endpoint readiness before forwarding by @wozniakjan in #1348
• chore: update k8s versions by @zroubalik in #1351
• chore(deps): bump the all-updates group across 1 directory with 5 updates by @dependabot[bot] in #1343
• ci: bump go to 1.24.7 and fix link checker by @wozniakjan in #1357
• feat: add environment variable to control X-KEDA-HTTP-Cold-Start response header by @sean-redmond in #1354
• e2e: deploy zipkin as part of testsuite setup by @wozniakjan in #1358
• chore: bump deps to k8s 0.33.4 & KEDA core 2.18.0 by @zroubalik in #1353
• release v0.11.1 prep by @wozniakjan in #1360

New Contributors

• @Copilot made their first contribution in #1349
• @sean-redmond made their first contribution in #1354

Full Changelog: v0.11.0...v0.11.1

Improvements

• General: Updated k8s versions (#1351)
• General: Updated KEDA versions (#1353)

What's Changed

• chore(deps): bump the all-updates group with 4 updates by @dependabot[bot] in #1263
• Update ADOPTERS.md by @rd-zahari-aleksiev in #1265
• chore(deps): bump the all-updates group across 1 directory with 11 updates by @JorTurFer in #1268
• chore(deps): bump golang.org/x/net from 0.35.0 to 0.36.0 by @dependabot[bot] in #1269
• chore(deps): bump github.com/expr-lang/expr from 1.16.9 to 1.17.0 by @dependabot[bot] in #1272
• chore(deps): bump the all-updates group with 2 updates by @dependabot[bot] in #1271
• chore(deps): bump github.com/prometheus/common from 0.62.0 to 0.63.0 in the all-updates group by @dependabot[bot] in #1270
• Change path in walkthrough call to match httpscaledobject from example by @GilbertBckr in #1266
• chore(deps): bump the all-updates group with 3 updates by @dependabot[bot] in #1275
• e2e tests: use ghcr registry for otel images by @wozniakjan in #1284
• feat: Add support for tracing for http addon by @bhussain91 in #1021
• chore: reformat scaler code to match KEDA go style by @zroubalik in #1295
• chore: get the correct HTTPScaledObject reference in the scaler by @zroubalik in #1296
• e2e: fix nginx installation via helm by @zroubalik in #1300
• scaler: allow using HSO and SO with different names by @zroubalik in #1299
• Add a way to turn off the profiling for all three http add-on components by @jkremser in #1308
• feat(interceptor): Add possibility to skip tls verification for upstreams by @ilia-medvedev-codefresh in #1307
• Implement HTTPScaledObject scoped timeout by @AlexPykavy in #1285
• chore: Bump go version and deps by @JorTurFer in #1305
• feat: failover route on cold-start time out by @yyewolf in #1280
• feat(middleware-logging): implement http.Hijacker by @guilhem in #835
• chore(deps): bump the all-updates group across 1 directory with 6 updates by @dependabot[bot] in #1325
• migrate from v1.Endpoints to discoveryv1.EndpointSlices by @jkremser in #1298
• ci: fix semver release trigger by @wozniakjan in #1336

New Contributors

• @rd-zahari-aleksiev made their first contribution in #1265
• @GilbertBckr made their first contribution in #1266
• @bhussain91 made their first contribution in #1021
• @jkremser made their first contribution in #1308
• @ilia-medvedev-codefresh made their first contribution in #1307
• @AlexPykavy made their first contribution in #1285
• @yyewolf made their first contribution in #1280
• @guilhem made their first contribution in #835

Full Changelog: v0.10.0...v0.11.0

Breaking Changes

• General: Migrate from deprecated v1.Endpoints to discoveryv1.EndpointSlices (#1297)

New

• General: Add configurable tracing support to the interceptor proxy (#1021)
• General: Add failover service on cold-start (#1280)
• General: Add possibility to skip TLS verification for upstreams in interceptor (#1307)
• General: Allow using HSO and SO with different names (#1293)
• General: Support profiling for KEDA components (#1308)

Improvements

• General: License compliance monitored with FOSSA (#1423)
• Interceptor: Support HTTPScaledObject scoped timeout (#813)

Other

• Documentation: Correct the service name used in the walkthrough documentation (#1244)

What's Changed

New

• General: Fix infrastructure crashes when deleting ScaledObject while scaling (#1245)
• General: Fix kubectl active printcolumn (#1211)
• General: Support InitialCooldownPeriod for HTTPScaledObject #1213

Other

• Documentation: Correct the service name used in the walkthrough documentation (#1244)

• chore(deps): bump golangci/golangci-lint-action from 6.1.1 to 6.2.0 in the all-updates group by @dependabot in #1237
• chore(deps): bump the all-updates group across 1 directory with 11 updates by @dependabot in #1238
• chore: add missing examples for 0.9.0 by @brunopadz in #1240
• Readme: update status message by @zroubalik in #1243
• fix(doc): use correct service name by @ldvc in #1244
• chore(deps): bump actions/setup-go from 5.2.0 to 5.3.0 in the all-updates group by @dependabot in #1242
• chore(deps): bump the all-updates group with 2 updates by @dependabot in #1241
• Update compatibility documentation for v0.9.0 by @Spenhouet in #1247
• chore(deps): bump the all-updates group with 3 updates by @dependabot in #1249
• fix kubectl active printcolumn selector by @wozniakjan in #1248
• Fix KEDA Interceptor/Scaler issues when deleting ScaledObject while scaling by @kmd922 in #1245
• chore(deps): bump golangci/golangci-lint-action from 6.3.2 to 6.5.0 in the all-updates group by @dependabot in #1253
• fix: ingnore Make link in the linkinator workflow by @zroubalik in #1255
• chore: run e2e tests against k8s 1.32 by @zroubalik in #1257
• chore: fix kind action by @zroubalik in #1259
• bump k8s deps to 1.31.6 by @zroubalik in #1256
• bump go to 1.23.6 by @zroubalik in #1258
• fix: Rename keda-http-add-on-interceptor-proxy to keda-add-ons-http-interceptor-proxy by @kahirokunn in #1037
• Add support for initialCooldownPeriod On httpScaledObjects by @shayrybak in #1212
• Prepare release v0.10.0 by @wozniakjan in #1260

New Contributors

• @brunopadz made their first contribution in #1240
• @ldvc made their first contribution in #1244
• @Spenhouet made their first contribution in #1247
• @kmd922 made their first contribution in #1245
• @shayrybak made their first contribution in #1212

Full Changelog: v0.9.0...v0.10.0

New

• General: Fix infrastructure crashes when deleting ScaledObject while scaling (#1245)
• General: Fix kubectl active printcolumn (#1211)
• General: Support InitialCooldownPeriod for HTTPScaledObject (#1213)

Other

• Documentation: Correct the service name used in the walkthrough documentation (#1244)

We are happy to release KEDA HTTP Add-on v0.9.0 🎉

Breaking Changes

• General: Drop support for deprecated field spec.scaleTargetRef.deployment (#1061)

New

• General: Support portName in HTTPScaledObject service scaleTargetRef (#1174)
• General: Support setting multiple TLS certs for different domains on the interceptor proxy (#1116)
• Interceptor: Add support for for AWS ELB healthcheck probe (#1198)

Fixes

• General: Align the interceptor metrics env var configuration with the OTEL spec (#1031)
• General: Include trailing 0 window buckets in RPS calculation (#1075)

Other

• General: Sign images with Cosign (#1062)

New Contributors

• @wozniakjan made their first contribution in #1040
• @d4nyll made their first contribution in #1071
• @kahirokunn made their first contribution in #1093
• @kek-Sec made their first contribution in #1137
• @boillodmanuel made their first contribution in #1199
• @step-security-bot made their first contribution in #1217

Full Changelog: v0.8.0...v0.9.0

Breaking Changes

• General: Drop support for deprecated field spec.scaleTargetRef.deployment (#1061)

New

• General: Support portName in HTTPScaledObject service scaleTargetRef (#1174)
• General: Support setting multiple TLS certs for different domains on the interceptor proxy (#1116)
• Interceptor: Add support for for AWS ELB healthcheck probe (#1198)

Fixes

• General: Align the interceptor metrics env var configuration with the OTEL spec (#1031)
• General: Include trailing 0 window buckets in RPS calculation (#1075)

Other

• General: Sign images with Cosign (#1062)

New

• General: Add configurable TLS on the wire support to the interceptor proxy (#907)
• General: Add support for collecting metrics using a Prometheus compatible endpoint or by sending metrics to an OpenTelemetry's HTTP endpoint (#910)
• General: Propagate HTTPScaledObject labels and annotations to ScaledObject (#840)
• General: Provide support for allowing HTTP scaler to work alongside other core KEDA scalers (#489)
• General: Support aggregation windows (#882)

Fixes

• General: Ensure operator is aware about changes on underlying ScaledObject (#900)

Deprecations

You can find all deprecations in this overview and join the discussion here.

• General: Deprecated targetPendingRequests in favor of spec.scalingMetric.*.targetValue (#959)

Other

• General: Align with the new format of Ingress in the example demo (#979)
• General: Unify loggers (#958)

Breaking Changes

• General: host field has been removed in favor of hosts in HTTPScaledObject (#552|#888)

New

• General: Support any resource which implements /scale subresource (#438)

Improvements

• General: Improve Scaler reliability adding probes and 3 replicas (#870)

Fixes

• General: Add new user agent probe (#862)
• General: Fix external scaler getting into bad state when retrieving queue lengths fails. (#870)
• General: Increase ScaledObject polling interval to 15 seconds (#799)
• General: Set forward request RawPath to original request RawPath (#864)

Deprecations

You can find all deprecations in this overview and join the discussion here.

New deprecation(s):

• General: Deprecated KEDA_HTTP_DEPLOYMENT_CACHE_POLLING_INTERVAL_MS in favor of KEDA_HTTP_ENDPOINTS_CACHE_POLLING_INTERVAL_MS (#438)

Other

• General: Bump golang version (#853)

New

• General: Add manifests to deploy the Add-on (#716)

Improvements

• Scaler: Decrease memory usage by allowing increasing stream interval configuration (#745)

Fixes

• Interceptor: Add support for streaming responses (#743)
• Interceptor: Fatal error: concurrent map iteration and map write (#726)
• Interceptor: Keep original Host in the Host header (#331)
• Interceptor: Provide graceful shutdown for http servers on SIGINT and SIGTERM (#731)
• Operator: Remove ScaledObject name & app custom labels (#717)
• Scaler: Provide graceful shutdown for grpc server on SIGINT and SIGTERM (#731)
• Scaler: Reimplement custom interceptor metrics (#718)

Deprecations

You can find all deprecations in this overview and join the discussion here.

New deprecation(s):

• General: host field deprecated in favor of hosts in HTTPScaledObject (#552)

Other

• General: Adding a changelog validating script to check for formatting and order (#761)
• General: Skip not required CI checks on PRs on new commits (#801)

Breaking Changes

None.

New

• General: Log incoming requests using the Combined Log Format (#669)
• Routing: Add multi-host support to HTTPScaledObject (#552)
• Routing: Support path-based routing (#338)

Improvements

• General: Automatically tag Docker image with commit SHA (#567)
• Operator: Migrate project to Kubebuilder v3 (#625)
• RBAC: Introduce fine-grained permissions per component and reduce required permissions (#612)
• Routing: New routing table implementation that relies on the live state of HTTPScaledObjects on the K8s Cluster instead of a ConfigMap that is updated periodically (#605)

Fixes

• General: Changes to HTTPScaledObjects now take effect (#605)
• General: HTTPScaledObject is the owner of the underlying ScaledObject (#703)
• Controller: Use kedav1alpha1.ScaledObject default values (#607)
• Routing: Lookup host without port (#608)

Deprecations

You can find all deprecations in this overview and join the discussion here.

New deprecation(s):

• General: host field deprecated in favor of hosts in HTTPScaledObject (#552)

Previously announced deprecation(s):

• None.

Other

• General: Use kubernetes e2e images for e2e test and samples (#665)
• e2e tests: Use the same e2e system as in core (#686)