kedify · wozniakjan · Jun 12, 2026 · Feb 18, 2026 · Mar 13, 2026 · Mar 20, 2026
diff --git a/keda/templates/crds/crd-cloudeventsources.yaml b/keda/templates/crds/crd-cloudeventsources.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.crds.install }}
+{{- if and .Values.crds.install (ne .Values.kedify.multitenant.mode "tenant") }}
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:

diff --git a/keda/templates/crds/crd-clustercloudeventsources.yaml b/keda/templates/crds/crd-clustercloudeventsources.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.crds.install }}
+{{- if and .Values.crds.install (ne .Values.kedify.multitenant.mode "tenant") }}
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:

diff --git a/keda/templates/crds/crd-clustertriggerauthentications.yaml b/keda/templates/crds/crd-clustertriggerauthentications.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.crds.install }}
+{{- if and .Values.crds.install (ne .Values.kedify.multitenant.mode "tenant") }}
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:

diff --git a/keda/templates/crds/crd-scaledjobs.yaml b/keda/templates/crds/crd-scaledjobs.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.crds.install }}
+{{- if and .Values.crds.install (ne .Values.kedify.multitenant.mode "tenant") }}
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:

diff --git a/keda/templates/crds/crd-scaledobjects.yaml b/keda/templates/crds/crd-scaledobjects.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.crds.install }}
+{{- if and .Values.crds.install (ne .Values.kedify.multitenant.mode "tenant") }}
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:

diff --git a/keda/templates/crds/crd-scalinggroups.yaml b/keda/templates/crds/crd-scalinggroups.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.crds.install }}
+{{- if and .Values.crds.install (ne .Values.kedify.multitenant.mode "tenant") }}
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:

diff --git a/keda/templates/crds/crd-triggerauthentications.yaml b/keda/templates/crds/crd-triggerauthentications.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.crds.install }}
+{{- if and .Values.crds.install (ne .Values.kedify.multitenant.mode "tenant") }}
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:

diff --git a/keda/templates/kedify-agent-secret-rbac.yaml b/keda/templates/kedify-agent-secret-rbac.yaml
@@ -0,0 +1,43 @@
+{{- if and .Values.kedify.multitenant .Values.kedify.multitenant.mode }}
+# Grant kedify-agent read access to this tenant's TLS certificate secret.
+# The agent needs this to sync tenant certificates into the shared multitenancy config.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  {{- with .Values.additionalAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  labels:
+    app.kubernetes.io/name: {{ .Release.Name }}-kedify-agent-secret-reader
+    {{- include "keda.labels" . | indent 4 }}
+  name: {{ .Release.Name }}-kedify-agent-secret-reader
+  namespace: {{ .Release.Namespace }}
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get"]
+  resourceNames:
+  - {{ .Values.certificates.secretName | quote }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  {{- with .Values.additionalAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  labels:
+    app.kubernetes.io/name: {{ .Release.Name }}-kedify-agent-secret-reader
+    {{- include "keda.labels" . | indent 4 }}
+  name: {{ .Release.Name }}-kedify-agent-secret-reader
+  namespace: {{ .Release.Namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ .Release.Name }}-kedify-agent-secret-reader
+subjects:
+- kind: ServiceAccount
+  name: {{ .Values.kedify.multitenant.agentServiceAccount }}
+  namespace: {{ .Values.kedify.multitenant.agentNamespace }}
+{{- end }}
diff --git a/keda/templates/kedify-tenant-registration-configmap.yaml b/keda/templates/kedify-tenant-registration-configmap.yaml
@@ -0,0 +1,25 @@
+{{- if and .Values.kedify.multitenant .Values.kedify.multitenant.mode }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Release.Name }}-kedify-tenant-registration
+  namespace: {{ .Release.Namespace }}
+  labels:
+    kedify.io/tenant-registration: "true"
+    {{- include "keda.labels" . | nindent 4 }}
+  {{- with .Values.additionalAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+data:
+  name: {{ printf "%s/%s" .Release.Namespace .Release.Name | quote }}
+  namespace: {{ .Release.Namespace | quote }}
+  watchNamespace: {{ .Values.watchNamespace | default .Release.Namespace | quote }}
+  address: {{ .Values.kedify.multitenant.address | default (printf "%s.%s.svc.%s:9666" .Values.operator.name .Release.Namespace .Values.clusterDomain) | quote }}
+  {{- if .Values.kedify.multitenant.authority }}
+  authority: {{ .Values.kedify.multitenant.authority | quote }}
+  {{- end }}
+  tlsSecretRef: {{ .Values.certificates.secretName | quote }}
+  isDefaultTenant: {{ eq .Values.kedify.multitenant.mode "default" | quote }}
+  operatorDeploymentName: {{ .Values.operator.name | quote }}
+{{- end }}
diff --git a/keda/templates/manager/deployment.yaml b/keda/templates/manager/deployment.yaml
@@ -81,13 +81,17 @@ spec:
           - "--leader-elect"
           {{- if .Values.operator.leaderElectionID }}
           - "--leader-election-id={{ .Values.operator.leaderElectionID }}"
+          {{- else if eq .Values.kedify.multitenant.mode "tenant" }}
+          {{- /* tenant operators may share a namespace with the default install or other tenants;
+                 derive a unique leader-election lock from the (unique) operator name */}}
+          - "--leader-election-id={{ .Values.operator.name }}.keda.sh"
           {{- end }}
           - "--disable-compression={{ .Values.operator.disableCompression}}"
           - "--zap-log-level={{ .Values.logging.operator.level }}"
           - "--zap-encoder={{ .Values.logging.operator.format }}"
           - "--zap-time-encoding={{ .Values.logging.operator.timeEncoding }}"
-          - "--enable-webhook-patching={{ .Values.webhooks.enabled }}"
-          {{- if and .Values.certificates.autoGenerated ( not .Values.certificates.certManager.enabled ) .Values.certificates.operator .Values.certificates.operator.apiServicePatching }}
+          - "--enable-webhook-patching={{ and .Values.webhooks.enabled (ne .Values.kedify.multitenant.mode "tenant") }}"
+          {{- if and .Values.certificates.autoGenerated ( not .Values.certificates.certManager.enabled ) .Values.certificates.operator .Values.certificates.operator.apiServicePatching (ne .Values.kedify.multitenant.mode "tenant") }}
           - "--enable-apiservice-patching={{ .Values.certificates.operator.apiServicePatching.enabled }}"
           {{- end }}
           {{- if .Values.logging.operator.stackTracesEnabled }}
@@ -174,6 +178,10 @@ spec:
             - name: KEDA_HTTP_DISABLE_KEEP_ALIVE
               value: "true"
             {{- end }}
+            {{- if eq .Values.kedify.multitenant.mode "tenant" }}
+            - name: KEDIFY_MULTITENANT_MODE_DISABLE_CERT_INJECTION
+              value: "true"
+            {{- end }}
             {{- if .Values.permissions.operator.restrict.secret }}
             - name: KEDA_RESTRICT_SECRET_ACCESS
               value: {{ .Values.permissions.operator.restrict.secret | quote }}

diff --git a/keda/templates/metrics-server/apiservice.yaml b/keda/templates/metrics-server/apiservice.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.metricsServer.enabled }}
+{{- if and .Values.metricsServer.enabled (ne .Values.kedify.multitenant.mode "tenant") }}
 apiVersion: apiregistration.k8s.io/v1
 kind: APIService
 metadata:

diff --git a/keda/templates/metrics-server/ciliumnetworkpolicy.yaml b/keda/templates/metrics-server/ciliumnetworkpolicy.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.metricsServer.enabled .Values.networkPolicy.enabled (eq .Values.networkPolicy.flavor "cilium") }}
+{{- if and .Values.metricsServer.enabled .Values.networkPolicy.enabled (eq .Values.networkPolicy.flavor "cilium") (ne .Values.kedify.multitenant.mode "tenant") }}
 apiVersion: "cilium.io/v2"
 kind: CiliumNetworkPolicy
 metadata:

diff --git a/keda/templates/metrics-server/clusterrole.yaml b/keda/templates/metrics-server/clusterrole.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.metricsServer.enabled .Values.rbac.create }}
+{{- if and .Values.metricsServer.enabled .Values.rbac.create (ne .Values.kedify.multitenant.mode "tenant") }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:

diff --git a/keda/templates/metrics-server/clusterrolebinding.yaml b/keda/templates/metrics-server/clusterrolebinding.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.metricsServer.enabled .Values.rbac.create }}
+{{- if and .Values.metricsServer.enabled .Values.rbac.create (ne .Values.kedify.multitenant.mode "tenant") }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:

diff --git a/keda/templates/metrics-server/deployment.yaml b/keda/templates/metrics-server/deployment.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.metricsServer.enabled }}
+{{- if and .Values.metricsServer.enabled (ne .Values.kedify.multitenant.mode "tenant") }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -99,6 +99,10 @@ spec:
           env:
             - name: WATCH_NAMESPACE
               value: {{ .Values.watchNamespace | quote }}
+            {{- if eq .Values.kedify.multitenant.mode "default" }}
+            - name: KEDIFY_MULTITENANT_MODE
+              value: "true"
+            {{- end }}
             - name: POD_NAMESPACE
               valueFrom:
                 fieldRef:
@@ -162,6 +166,13 @@ spec:
           - name: grpc-certs
             mountPath: /grpccerts
           {{- end }}
+          {{- if eq .Values.kedify.multitenant.mode "default" }}
+          - name: kedify-multitenancy-config
+            mountPath: /kedify-multitenancy-config
+            readOnly: true
+          - name: kedify-tenant-certs
+            mountPath: /kedify-tenant-certs
+          {{- end }}
           {{- if .Values.hashiCorpVaultTLS }}
           - name: hashicorp-vault-certs
             mountPath: /hashicorp-vaultcerts
@@ -185,6 +196,14 @@ spec:
         secret:
           secretName: {{ .Values.grpcTLSCertsSecret }}
       {{- end }}
+      {{- if eq .Values.kedify.multitenant.mode "default" }}
+      - name: kedify-multitenancy-config
+        secret:
+          defaultMode: 420
+          secretName: {{ .Values.kedify.multitenant.configSecretName }}
+      - name: kedify-tenant-certs
+        emptyDir: {}
+      {{- end }}
       {{- if .Values.hashiCorpVaultTLS }}
       - name: hashicorp-vault-certs
         secret:

diff --git a/keda/templates/metrics-server/kedify-multitenancy-config.yaml b/keda/templates/metrics-server/kedify-multitenancy-config.yaml
@@ -0,0 +1,15 @@
+{{- if eq .Values.kedify.multitenant.mode "default" }}
+# secret for kedify multitenancy configuration, dynamically populated by kedify-agent at runtime
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Values.kedify.multitenant.configSecretName }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "keda.labels" . | nindent 4 }}
+  {{- with .Values.additionalAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+type: Opaque
+{{- end }}
diff --git a/keda/templates/metrics-server/kedify-role.yaml b/keda/templates/metrics-server/kedify-role.yaml
@@ -0,0 +1,43 @@
+{{- if and .Values.metricsServer.enabled .Values.rbac.create (eq .Values.kedify.multitenant.mode "default") }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  {{- with .Values.additionalAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  labels:
+    app.kubernetes.io/name: {{ .Values.operator.name }}-metrics-server-kedify
+    {{- include "keda.labels" . | indent 4 }}
+  name: {{ .Values.operator.name }}-metrics-server-kedify
+  namespace: {{ .Release.Namespace }}
+rules:
+- apiGroups:
+  - events.k8s.io
+  resources:
+  - events
+  verbs:
+  - create
+  - patch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  {{- with .Values.additionalAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  labels:
+    app.kubernetes.io/name: {{ .Values.operator.name }}-metrics-server-kedify
+    {{- include "keda.labels" . | indent 4 }}
+  name: {{ .Values.operator.name }}-metrics-server-kedify
+  namespace: {{ .Release.Namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ .Values.operator.name }}-metrics-server-kedify
+subjects:
+- kind: ServiceAccount
+  name: {{ (.Values.serviceAccount.metricServer).name | default .Values.serviceAccount.name }}
+  namespace: {{ .Release.Namespace }}
+{{- end -}}
diff --git a/keda/templates/metrics-server/networkpolicy.yaml b/keda/templates/metrics-server/networkpolicy.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.metricsServer.enabled .Values.networkPolicy.enabled (eq .Values.networkPolicy.flavor "kubernetes") }}
+{{- if and .Values.metricsServer.enabled .Values.networkPolicy.enabled (eq .Values.networkPolicy.flavor "kubernetes") (ne .Values.kedify.multitenant.mode "tenant") }}
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:

diff --git a/keda/templates/metrics-server/poddisruptionbudget.yaml b/keda/templates/metrics-server/poddisruptionbudget.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.metricsServer.enabled (or (or .Values.podDisruptionBudget.minAvailable .Values.podDisruptionBudget.maxUnavailable) .Values.podDisruptionBudget.metricServer) }}
+{{- if and .Values.metricsServer.enabled (or (or .Values.podDisruptionBudget.minAvailable .Values.podDisruptionBudget.maxUnavailable) .Values.podDisruptionBudget.metricServer) (ne .Values.kedify.multitenant.mode "tenant") }}
 apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:

diff --git a/keda/templates/metrics-server/podmonitor.yaml b/keda/templates/metrics-server/podmonitor.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.metricsServer.enabled .Values.prometheus.metricServer.enabled .Values.prometheus.metricServer.podMonitor.enabled }}
+{{- if and .Values.metricsServer.enabled .Values.prometheus.metricServer.enabled .Values.prometheus.metricServer.podMonitor.enabled (ne .Values.kedify.multitenant.mode "tenant") }}
 apiVersion: monitoring.coreos.com/v1
 kind: PodMonitor
 metadata:

diff --git a/keda/templates/metrics-server/service.yaml b/keda/templates/metrics-server/service.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.metricsServer.enabled }}
+{{- if and .Values.metricsServer.enabled (ne .Values.kedify.multitenant.mode "tenant") }}
 apiVersion: v1
 kind: Service
 metadata:

diff --git a/keda/templates/metrics-server/serviceaccount.yaml b/keda/templates/metrics-server/serviceaccount.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.metricsServer.enabled ((.Values.serviceAccount.metricServer).create | default .Values.serviceAccount.create) -}}
+{{- if and .Values.metricsServer.enabled ((.Values.serviceAccount.metricServer).create | default .Values.serviceAccount.create) (ne .Values.kedify.multitenant.mode "tenant") -}}
 apiVersion: v1
 kind: ServiceAccount
 metadata:

diff --git a/keda/templates/metrics-server/servicemonitor.yaml b/keda/templates/metrics-server/servicemonitor.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.metricsServer.enabled .Values.prometheus.metricServer.enabled .Values.prometheus.metricServer.serviceMonitor.enabled }}
+{{- if and .Values.metricsServer.enabled .Values.prometheus.metricServer.enabled .Values.prometheus.metricServer.serviceMonitor.enabled (ne .Values.kedify.multitenant.mode "tenant") }}
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:

diff --git a/keda/templates/webhooks/ciliumnetworkpolicy.yaml b/keda/templates/webhooks/ciliumnetworkpolicy.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.webhooks.enabled .Values.networkPolicy.enabled (eq .Values.networkPolicy.flavor "cilium") }}
+{{- if and .Values.webhooks.enabled .Values.networkPolicy.enabled (eq .Values.networkPolicy.flavor "cilium") (ne .Values.kedify.multitenant.mode "tenant") }}
 apiVersion: "cilium.io/v2"
 kind: CiliumNetworkPolicy
 metadata:

diff --git a/keda/templates/webhooks/clusterrole.yaml b/keda/templates/webhooks/clusterrole.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.rbac.create }}
+{{- if and .Values.rbac.create .Values.webhooks.enabled (ne .Values.kedify.multitenant.mode "tenant") }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:

diff --git a/keda/templates/webhooks/clusterrolebindings.yaml b/keda/templates/webhooks/clusterrolebindings.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.rbac.create }}
+{{- if and .Values.rbac.create .Values.webhooks.enabled (ne .Values.kedify.multitenant.mode "tenant") }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:

diff --git a/keda/templates/webhooks/deployment.yaml b/keda/templates/webhooks/deployment.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.webhooks.enabled }}
+{{- if and .Values.webhooks.enabled (ne .Values.kedify.multitenant.mode "tenant") }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:

diff --git a/keda/templates/webhooks/networkpolicy.yaml b/keda/templates/webhooks/networkpolicy.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.webhooks.enabled .Values.networkPolicy.enabled (eq .Values.networkPolicy.flavor "kubernetes") }}
+{{- if and .Values.webhooks.enabled .Values.networkPolicy.enabled (eq .Values.networkPolicy.flavor "kubernetes") (ne .Values.kedify.multitenant.mode "tenant") }}
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:

diff --git a/keda/templates/webhooks/poddisruptionbudget.yaml b/keda/templates/webhooks/poddisruptionbudget.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.webhooks.enabled }}
+{{- if and .Values.webhooks.enabled (ne .Values.kedify.multitenant.mode "tenant") }}
 {{- if or (or .Values.podDisruptionBudget.minAvailable .Values.podDisruptionBudget.maxUnavailable)  .Values.podDisruptionBudget.webhooks }}
 apiVersion: policy/v1
 kind: PodDisruptionBudget

diff --git a/keda/templates/webhooks/prometheusrules.yaml b/keda/templates/webhooks/prometheusrules.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.webhooks.enabled }}
+{{- if and .Values.webhooks.enabled (ne .Values.kedify.multitenant.mode "tenant") }}
 {{- if and .Values.prometheus.webhooks.enabled .Values.prometheus.webhooks.prometheusRules.enabled }}
 apiVersion: monitoring.coreos.com/v1
 kind: PrometheusRule

diff --git a/keda/templates/webhooks/service.yaml b/keda/templates/webhooks/service.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.webhooks.enabled }}
+{{- if and .Values.webhooks.enabled (ne .Values.kedify.multitenant.mode "tenant") }}
 apiVersion: v1
 kind: Service
 metadata:

diff --git a/keda/templates/webhooks/serviceaccount.yaml b/keda/templates/webhooks/serviceaccount.yaml
@@ -1,4 +1,4 @@
-{{- if (.Values.serviceAccount.webhooks).create | default .Values.serviceAccount.create -}}
+{{- if and .Values.webhooks.enabled ((.Values.serviceAccount.webhooks).create | default .Values.serviceAccount.create) (ne .Values.kedify.multitenant.mode "tenant") -}}
 apiVersion: v1
 kind: ServiceAccount
 metadata:

diff --git a/keda/templates/webhooks/servicemonitor.yaml b/keda/templates/webhooks/servicemonitor.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.webhooks.enabled }}
+{{- if and .Values.webhooks.enabled (ne .Values.kedify.multitenant.mode "tenant") }}
 {{- if and .Values.prometheus.webhooks.enabled .Values.prometheus.webhooks.serviceMonitor.enabled }}
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor

diff --git a/keda/templates/webhooks/validatingconfiguration.yaml b/keda/templates/webhooks/validatingconfiguration.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.webhooks.enabled }}
+{{- if and .Values.webhooks.enabled (ne .Values.kedify.multitenant.mode "tenant") }}
 apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingWebhookConfiguration
 metadata: