keda

We are happy to release KEDA 2.21.0 🎉

> [!IMPORTANT]

> KEDA 2.21.0 contains three breaking changes. If you are upgrading from KEDA 2.20, review Upgrading from KEDA 2.20 to 2.21 before upgrading.

Before upgrading from KEDA 2.20

Service account token audience enforcement (CVE-2026-77524)

KEDA 2.21 fixes the critical CVE-2026-77524 / GHSA-637c-6jxx-4rwm. You are affected if you use:

• Vault Kubernetes authentication, including configurations using the operator token, an existing projected token, or credential.serviceAccountName.
• Any TriggerAuthentication or ClusterTriggerAuthentication using boundServiceAccountToken, including integrations with Metrics API, Prometheus, Loki, Datadog Cluster Agent, and other token-authenticated receivers.

You are not affected if you use ordinary Vault token authentication, API keys, OAuth credentials, or another authentication method that does not use a bound service account token. Before upgrading, review carefully the upgrade guide

Temporal Rules-Based Versioning settings

The Temporal scaler no longer accepts the deprecated buildId, selectAllActive, and selectUnversioned settings. Existing ScaledObjects and ScaledJobs containing them will fail scaler metadata parsing. Remove the settings for unversioned workers, or migrate versioned workers to workerDeploymentName and workerDeploymentBuildId. See Temporal Rules-Based Versioning settings.

Azure Pipelines in-flight jobs

KEDA 2.21 adds scaleOnInFlight, defaulting to true. Queue length now includes unfinished jobs already assigned to an agent. Set scaleOnInFlight: false to retain the unassigned-only behavior from KEDA 2.20; for ScaledJobs, combine this with the accurate scaling strategy. See Azure Pipelines in-flight jobs.

Highlights

• Reduce redundant scaler-backend requests when the HPA already owns the scaling decision (#7999, #8031).
• Add Azure Cosmos DB Change Feed, ClickHouse, and GCP Cloud Spanner scalers.
• Let external scalers update HPA targets dynamically through StreamMetricSpec, and expose external-scaler gRPC client metrics.
• Add Prometheus OAuth2 client-credentials authentication, Kafka Kerberos credential-cache support, and Azure Pipelines service-principal authentication.
• Improve scaler and authentication lifecycles with deterministic cancellation, refresh handling, Kubernetes API timeouts, and external-scaler connection cleanup.

Deprecation notice

The Liiklus scaler is deprecated because the upstream project is unmaintained. Its code is planned for removal in a later KEDA release. See #7929.

Learn how to deploy KEDA by reading our documentation.

🗓️ The next KEDA release is currently estimated for the 2nd week of January 2027. Learn more in our roadmap.

Breaking Changes

• 1e21cc7: Security: Enforce explicit service account token audiences to prevent TriggerAuthentication privilege escalation (CVE-2026-77524 / GHSA-637c-6jxx-4rwm; migration guide) (@wozniakjan)
• 587d3cd: Azure Pipelines Scaler: Include assigned, unfinished jobs by default with scaleOnInFlight: true (#7905; migration guide) (@dttung2905)
• 54a6651: Temporal Scaler: Remove deprecated buildId, selectAllActive, and selectUnversioned settings (#7985; migration guide) (@omkar619-dev)

Deprecations

• 5744068: Liiklus Scaler: Deprecate the scaler because its upstream project is unmaintained; removal is planned for a later KEDA release (#7938, #7929) (@Copilot)

New

• 14c25e5 : General: Accept pod-level cpu/memory requests in ScaledObject validation (#8119) (@ku524)
• 7a4c241 : General: controller sharding by label selectors (#7816) (@rossanorbr)
• 28ab751 : General: Add new GCP Cloud Spanner Scaler (#7844) (@n0rm4l-me)
• 82ac584 : General: Support StreamMetricSpec RPC in external scaler proto for dynamic HPA target updates (#7794) (@Fedosin)
• a84afd5 : General: Add new Clickhouse Scaler (#7850) (@izaakschroeder)
• 7775bbd : ActiveMQ Scaler: Allow managementEndpoint to be set via TriggerAuthentication (#8129) (@AymenSunstice)
• cbfc3f4 : Azure Cosmos DB: Introduce new Azure Cosmos DB Change Feed Scaler (#7557) (@yash2710)
• 2f37c71 : Azure Monitor Scaler: Add optional metricInterval mapping to the Azure Monitor interval parameter (#7526) (@nicknikolakakis)
• b505912 : Kafka Scaler: support GSSAPI authentication with a Kerberos credential cache (#8069) (@Aytida-dev)
• f136606 : Metrics: Add external scaler gRPC client metrics (#8199) (@aliaqel-stripe)
• c92573e : Prometheus Scaler: Add support for OAuth2 client credentials authentication (#8064) (@thde)
• 51defd5 : Selenium Grid Scaler: add includeOngoingSessions trigger param (#8107) (@VietND96)
• 7548d04 : Splunk Observability Scaler: Add sum, count, latest aggregators (#8098) (@js4683)
• c4511a2 : Sumologic Scaler: add support ignoreNullValues (#8117) (@rickbrouwer)
• 9a991fa : Temporal Scaler: add composite metric (backlog + running workflow count) (#7460) (@Sanil2108)
• 8360d22 : Temporal Scaler: add enableTLS parameter to control TLS with API key auth (#7854) (@LiorRabin)

Improvements

• 95701bd : General: Include release notes automatically replacing changelog.md (#7990) (@JorTurFer)
• eb9a985 : General: Add flag to enable high-cardinality HTTP duration labels (#7751) (@aliaqel-stripe)
• e7a7d70 : General: extract shared AuthMetadata struct for GCP scalers to eliminate duplicate credential fields (#8074) (@n0rm4l-me)
• 7afd9a0 : General: migrate datadog, graphite and github_runner, rabbitmq to authentication.Config (#7767) (@rickbrouwer)
• 87d6244 : General: stop polling triggers when pollingInterval is not relevant (#8031) (@rickbrouwer)
• 8e9247d : General: use scorecard.dev API badge in README (#7913) (@rickbrouwer)
• 4bd9fe1 : General: Share HTTP Transport across HTTP clients to avoid leaking connections (#7941) (@aliaqel-stripe)
• 88b0844 : General: Aggregate KEDA CRD permissions into default roles (#7872) (@amarkdotdev)
• b1e8ee5 : General: move HPA health signal off Ready into a dedicated HPAActive condition (#7928) (@vishnu97770)
• a673796 : Azure Pipelines Scaler: add service principal authentication via reusable Azure provider (#7931) (@m-amaresh)
• 617d0a3 : MSSQL Scaler: Add driverName to select the azuresql driver (#8120) (@DinethShakya23)
• fac27c5 : Azure Scalers: add unit tests for Azure cloud environment resolution (#7859) (@Goutham-Annem)
• 82aede7 : AWS Scalers: Add unit tests for GetAwsAuthorization (#7836) (@archy-rock3t-cloud)