kedify-agent: multitenant keda config#424
Merged
Merged
Conversation
wozniakjan
force-pushed
the
agent_mt
branch
3 times, most recently
from
7150e18 to
bee2009
Compare
wozniakjan
force-pushed
the
main
branch
2 times, most recently
from
eff3384 to
e349f69
Compare
There was a problem hiding this comment.
Pull request overview
This PR introduces initial Helm-chart wiring for a multitenant KEDA setup in the kedify-agent chart: a feature flag in values, additional RBAC needed for tenant discovery/cert/config management, and CRD/schema + default CR changes to represent multitenancy configuration.
Changes:
- Add
agent.features.multitenantKEDAEnabledflag and anagent.multitenantvalues block placeholder. - Gate additional ClusterRole permissions (configmaps + specific secrets) behind the multitenancy feature flag.
- Extend
KedifyConfigurationCRD schema with multitenancy fields/validations and surfacemultitenancyin the defaultKedifyConfigurationCR when enabled.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| kedify-agent/values.yaml | Adds multitenancy-related values (multitenantKEDAEnabled, multitenant). |
| kedify-agent/templates/agent-rbac.yaml | Adds conditional RBAC rules for multitenant tenant discovery/config/certs. |
| kedify-agent/files/crs/default-kedifyconfig.yaml | Enables emitting multitenancy config in the default KedifyConfiguration CR when feature is on. |
| kedify-agent/files/crds/kedify-configuration.yaml | Extends CRD schema for multitenancy, adds validations and requires name/namespace in installations. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
wozniakjan
force-pushed
the
agent_mt
branch
2 times, most recently
from
8a7cf1b to
d4dc38a
Compare
wozniakjan
commented
Jun 10, 2026
Merged
ConfigMap-based self-registration: enable multitenancy on the default KEDA installation and grant the agent RBAC to sync tenant certs and the shared multitenancy config. Ported onto the hookless CR install (kedacore#462): the multitenancy toggle now lives in files/crs/default-kedifyconfig.yaml. Squashes the two original PR kedacore#424 commits (the second reverted the verbose per-tenant CR templating of the first). Signed-off-by: Jan Wozniak <wozniak.jan@gmail.com>
…tenant value - The updated KedifyConfiguration CRD requires a non-empty name on each kedaInstallations entry, but the default CR only set namespace, so CR creation/upgrade would fail validation. Set name to the release namespace. - Remove agent.multitenant (was an empty value wired to nothing); multitenancy is driven by features.multitenantKEDAEnabled and dynamic tenant registration.
The multitenant ClusterRole granted the agent cluster-wide `get` on Secrets named `kedaorg-certs`. That is redundant and hardcodes the secret name: the keda chart already grants the agent per-tenant access via namespaced, resourceName- scoped Roles created in each tenant namespace (kedify-agent-secret-rbac.yaml), bound to the agent ServiceAccount and keyed on each tenant's own configurable certificates.secretName. The cluster-wide rule only ever matched the default name and broadened secret read unnecessarily. Keep the cluster-wide ConfigMap discovery (RBAC can't label-filter list/watch) and the resourceName-scoped get/patch/update on the kedify-multitenancy-config secret the agent owns. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
kedifybot
approved these changes
Jun 12, 2026
Signed-off-by: Jan Wozniak <wozniak.jan@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Enable the multitenant KEDA feature for kedify-agent
This means that kedify-agent will watch for KEDA tenant helm installations and connect them to a single multitenant KEDA deployment.
see also: #423