Skip to content

feat(keda): enabling worloads scaling with KEDA (TLP-2389) - #108

Open
al-gold wants to merge 2 commits into
mainfrom
ag/keda
Open

feat(keda): enabling worloads scaling with KEDA (TLP-2389)#108
al-gold wants to merge 2 commits into
mainfrom
ag/keda

Conversation

@al-gold

@al-gold al-gold commented Jul 5, 2026

Copy link
Copy Markdown

Summary

  • Adds KEDA ScaledObject and PodDisruptionBudget templates to enable workload autoscaling
  • Wires up scaling configuration in staging/production Helm values

Test plan

  • helm template / helm lint renders cleanly with the new scaling objects
  • Deploy to staging and confirm KEDA scales the workload as expected

Ref: TLP-2389

Summary by CodeRabbit

  • New Features
    • Added optional Pod Disruption Budget support to improve workload availability during maintenance.
    • Added optional KEDA-based autoscaling with configurable replica limits, timing, and CPU utilization triggers.
    • Added production and staging configurations with environment-specific availability and scaling settings.
  • Configuration
    • New features are disabled by default and can be enabled through deployment values.

@CLAassistant

CLAassistant commented Jul 5, 2026

Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
0 out of 2 committers have signed the CLA.

❌ alex.goldenberg
❌ al-gold


alex.goldenberg seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
You have signed the CLA already but the status is still pending? Let us recheck it.

@coderabbitai

coderabbitai Bot commented Jul 5, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

📝 Walkthrough

Walkthrough

The Helm chart adds optional KEDA ScaledObject and Kubernetes PodDisruptionBudget templates, default configuration for both features, and staging and production overrides for autoscaling and disruption protection.

Changes

Helm operational resources

Layer / File(s) Summary
Operational values configuration
helm/values.yaml, helm/values-staging.yaml, helm/values-production.yaml
Default, staging, and production values configure KEDA autoscaling and PodDisruptionBudget behavior.
Operational resource templates
helm/templates/scaling-object.yaml, helm/templates/pdb.yaml
Conditional templates render the KEDA ScaledObject and PodDisruptionBudget resources from Helm values.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly matches the main change: enabling workload autoscaling with KEDA.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch ag/keda

Comment @coderabbitai help to get the list of available commands.

@github-actions

github-actions Bot commented Jul 5, 2026

Copy link
Copy Markdown
Contributor

🔒 Container Vulnerability Scan (hub-migrations - amd64)

Click to expand results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.69/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


hub-migrations:edfdd0998f6686cb281fd7f57099bb931e6fcda0-amd64 (debian 13.6)
===========================================================================
Total: 12 (UNKNOWN: 0, LOW: 7, MEDIUM: 5, HIGH: 0, CRITICAL: 0)

┌─────────┬──────────────────┬──────────┬──────────┬─────────────────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│ Library │  Vulnerability   │ Severity │  Status  │      Installed Version      │ Fixed Version │                            Title                             │
├─────────┼──────────────────┼──────────┼──────────┼─────────────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ libc6   │ CVE-2026-5435    │ MEDIUM   │ affected │ 2.41-12+deb13u3             │               │ glibc: glibc: Out-of-bounds write via TSIG record processing │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2026-5435                    │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-5450    │          │          │                             │               │ glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc`     │
│         │                  │          │          │                             │               │ format specifier and...                                      │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2026-5450                    │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-5928    │          │          │                             │               │ glibc: glibc: Information disclosure or denial of service    │
│         │                  │          │          │                             │               │ via ungetwc function with...                                 │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2026-5928                    │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-6238    │          │          │                             │               │ glibc: glibc: Application crash or uninitialized memory read │
│         │                  │          │          │                             │               │ via crafted DNS response...                                  │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2026-6238                    │
│         ├──────────────────┼──────────┤          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2010-4756    │ LOW      │          │                             │               │ glibc: glob implementation can cause excessive CPU and       │
│         │                  │          │          │                             │               │ memory consumption due to...                                 │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2010-4756                    │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2018-20796   │          │          │                             │               │ glibc: uncontrolled recursion in function                    │
│         │                  │          │          │                             │               │ check_dst_limits_calc_pos_1 in posix/regexec.c               │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2018-20796                   │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010022 │          │          │                             │               │ glibc: stack guard protection bypass                         │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010022                 │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010023 │          │          │                             │               │ glibc: running ldd on malicious ELF leads to code execution  │
│         │                  │          │          │                             │               │ because of...                                                │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010023                 │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010024 │          │          │                             │               │ glibc: ASLR bypass using cache of thread stack and heap      │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010024                 │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010025 │          │          │                             │               │ glibc: information disclosure of heap addresses of           │
│         │                  │          │          │                             │               │ pthread_created thread                                       │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010025                 │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-9192    │          │          │                             │               │ glibc: uncontrolled recursion in function                    │
│         │                  │          │          │                             │               │ check_dst_limits_calc_pos_1 in posix/regexec.c               │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2019-9192                    │
├─────────┼──────────────────┼──────────┤          ├─────────────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ zlib1g  │ CVE-2026-27171   │ MEDIUM   │          │ 1:1.3.dfsg+really1.3.1-1+b1 │               │ zlib: zlib: Denial of Service via infinite loop in CRC32     │
│         │                  │          │          │                             │               │ combine functions...                                         │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2026-27171                   │
└─────────┴──────────────────┴──────────┴──────────┴─────────────────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

OS Packages (license)
=====================
Total: 29 (UNKNOWN: 0, LOW: 11, MEDIUM: 0, HIGH: 18, CRITICAL: 0)

┌─────────────┬───────────────────┬────────────────┬──────────┐
│   Package   │      License      │ Classification │ Severity │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ base-files  │ GPL-2.0-or-later  │ restricted     │ HIGH     │
├─────────────┤                   │                │          │
│ gcc-14-base │                   │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-3.0-only      │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Artistic-2.0      │ notice         │ LOW      │
│             ├───────────────────┼────────────────┼──────────┤
│             │ LGPL-2.0-or-later │ restricted     │ HIGH     │
├─────────────┼───────────────────┤                │          │
│ libc6       │ LGPL-2.1-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-2.0-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-3.0-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-2.0-or-later  │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-2.0-only      │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-3.0-or-later  │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Unicode-DFS-2016  │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ BSL-1.0           │                │          │
│             ├───────────────────┤                │          │
│             │ BSD-2-Clause      │                │          │
│             ├───────────────────┤                │          │
│             │ ISC               │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-3.0-only      │ restricted     │ HIGH     │
│             ├───────────────────┤                │          │
│             │ LGPL-2.0-only     │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-2.1-only     │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-3.0-only     │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ libssl3t64  │ Apache-2.0        │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ Artistic-2.0      │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-1.0-or-later  │ restricted     │ HIGH     │
│             ├───────────────────┤                │          │
│             │ GPL-1.0-only      │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ libzstd1    │ BSD-3-Clause      │ notice         │ LOW      │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-2.0-only      │ restricted     │ HIGH     │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Zlib              │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ MIT               │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ netbase     │ GPL-2.0-only      │ restricted     │ HIGH     │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ zlib1g      │ Zlib              │ notice         │ LOW      │
└─────────────┴───────────────────┴────────────────┴──────────┘

@github-actions

github-actions Bot commented Jul 5, 2026

Copy link
Copy Markdown
Contributor

🔒 Container Vulnerability Scan (hub-migrations - arm64)

Click to expand results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.69/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


hub-migrations:edfdd0998f6686cb281fd7f57099bb931e6fcda0-arm64 (debian 13.6)
===========================================================================
Total: 12 (UNKNOWN: 0, LOW: 7, MEDIUM: 5, HIGH: 0, CRITICAL: 0)

┌─────────┬──────────────────┬──────────┬──────────┬─────────────────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│ Library │  Vulnerability   │ Severity │  Status  │      Installed Version      │ Fixed Version │                            Title                             │
├─────────┼──────────────────┼──────────┼──────────┼─────────────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ libc6   │ CVE-2026-5435    │ MEDIUM   │ affected │ 2.41-12+deb13u3             │               │ glibc: glibc: Out-of-bounds write via TSIG record processing │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2026-5435                    │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-5450    │          │          │                             │               │ glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc`     │
│         │                  │          │          │                             │               │ format specifier and...                                      │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2026-5450                    │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-5928    │          │          │                             │               │ glibc: glibc: Information disclosure or denial of service    │
│         │                  │          │          │                             │               │ via ungetwc function with...                                 │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2026-5928                    │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-6238    │          │          │                             │               │ glibc: glibc: Application crash or uninitialized memory read │
│         │                  │          │          │                             │               │ via crafted DNS response...                                  │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2026-6238                    │
│         ├──────────────────┼──────────┤          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2010-4756    │ LOW      │          │                             │               │ glibc: glob implementation can cause excessive CPU and       │
│         │                  │          │          │                             │               │ memory consumption due to...                                 │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2010-4756                    │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2018-20796   │          │          │                             │               │ glibc: uncontrolled recursion in function                    │
│         │                  │          │          │                             │               │ check_dst_limits_calc_pos_1 in posix/regexec.c               │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2018-20796                   │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010022 │          │          │                             │               │ glibc: stack guard protection bypass                         │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010022                 │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010023 │          │          │                             │               │ glibc: running ldd on malicious ELF leads to code execution  │
│         │                  │          │          │                             │               │ because of...                                                │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010023                 │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010024 │          │          │                             │               │ glibc: ASLR bypass using cache of thread stack and heap      │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010024                 │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010025 │          │          │                             │               │ glibc: information disclosure of heap addresses of           │
│         │                  │          │          │                             │               │ pthread_created thread                                       │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010025                 │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-9192    │          │          │                             │               │ glibc: uncontrolled recursion in function                    │
│         │                  │          │          │                             │               │ check_dst_limits_calc_pos_1 in posix/regexec.c               │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2019-9192                    │
├─────────┼──────────────────┼──────────┤          ├─────────────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ zlib1g  │ CVE-2026-27171   │ MEDIUM   │          │ 1:1.3.dfsg+really1.3.1-1+b1 │               │ zlib: zlib: Denial of Service via infinite loop in CRC32     │
│         │                  │          │          │                             │               │ combine functions...                                         │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2026-27171                   │
└─────────┴──────────────────┴──────────┴──────────┴─────────────────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

OS Packages (license)
=====================
Total: 29 (UNKNOWN: 0, LOW: 11, MEDIUM: 0, HIGH: 18, CRITICAL: 0)

┌─────────────┬───────────────────┬────────────────┬──────────┐
│   Package   │      License      │ Classification │ Severity │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ base-files  │ GPL-2.0-or-later  │ restricted     │ HIGH     │
├─────────────┤                   │                │          │
│ gcc-14-base │                   │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-3.0-only      │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Artistic-2.0      │ notice         │ LOW      │
│             ├───────────────────┼────────────────┼──────────┤
│             │ LGPL-2.0-or-later │ restricted     │ HIGH     │
├─────────────┼───────────────────┤                │          │
│ libc6       │ LGPL-2.1-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-2.0-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-3.0-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-2.0-or-later  │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-2.0-only      │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-3.0-or-later  │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Unicode-DFS-2016  │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ BSL-1.0           │                │          │
│             ├───────────────────┤                │          │
│             │ BSD-2-Clause      │                │          │
│             ├───────────────────┤                │          │
│             │ ISC               │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-3.0-only      │ restricted     │ HIGH     │
│             ├───────────────────┤                │          │
│             │ LGPL-2.0-only     │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-2.1-only     │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-3.0-only     │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ libssl3t64  │ Apache-2.0        │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ Artistic-2.0      │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-1.0-or-later  │ restricted     │ HIGH     │
│             ├───────────────────┤                │          │
│             │ GPL-1.0-only      │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ libzstd1    │ BSD-3-Clause      │ notice         │ LOW      │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-2.0-only      │ restricted     │ HIGH     │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Zlib              │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ MIT               │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ netbase     │ GPL-2.0-only      │ restricted     │ HIGH     │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ zlib1g      │ Zlib              │ notice         │ LOW      │
└─────────────┴───────────────────┴────────────────┴──────────┘

@github-actions

github-actions Bot commented Jul 5, 2026

Copy link
Copy Markdown
Contributor

🔒 Container Vulnerability Scan (hub - amd64)

Click to expand results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.69/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


hub:edfdd0998f6686cb281fd7f57099bb931e6fcda0-amd64 (debian 13.6)
================================================================
Total: 12 (UNKNOWN: 0, LOW: 7, MEDIUM: 5, HIGH: 0, CRITICAL: 0)

┌─────────┬──────────────────┬──────────┬──────────┬─────────────────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│ Library │  Vulnerability   │ Severity │  Status  │      Installed Version      │ Fixed Version │                            Title                             │
├─────────┼──────────────────┼──────────┼──────────┼─────────────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ libc6   │ CVE-2026-5435    │ MEDIUM   │ affected │ 2.41-12+deb13u3             │               │ glibc: glibc: Out-of-bounds write via TSIG record processing │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2026-5435                    │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-5450    │          │          │                             │               │ glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc`     │
│         │                  │          │          │                             │               │ format specifier and...                                      │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2026-5450                    │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-5928    │          │          │                             │               │ glibc: glibc: Information disclosure or denial of service    │
│         │                  │          │          │                             │               │ via ungetwc function with...                                 │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2026-5928                    │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-6238    │          │          │                             │               │ glibc: glibc: Application crash or uninitialized memory read │
│         │                  │          │          │                             │               │ via crafted DNS response...                                  │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2026-6238                    │
│         ├──────────────────┼──────────┤          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2010-4756    │ LOW      │          │                             │               │ glibc: glob implementation can cause excessive CPU and       │
│         │                  │          │          │                             │               │ memory consumption due to...                                 │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2010-4756                    │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2018-20796   │          │          │                             │               │ glibc: uncontrolled recursion in function                    │
│         │                  │          │          │                             │               │ check_dst_limits_calc_pos_1 in posix/regexec.c               │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2018-20796                   │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010022 │          │          │                             │               │ glibc: stack guard protection bypass                         │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010022                 │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010023 │          │          │                             │               │ glibc: running ldd on malicious ELF leads to code execution  │
│         │                  │          │          │                             │               │ because of...                                                │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010023                 │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010024 │          │          │                             │               │ glibc: ASLR bypass using cache of thread stack and heap      │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010024                 │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010025 │          │          │                             │               │ glibc: information disclosure of heap addresses of           │
│         │                  │          │          │                             │               │ pthread_created thread                                       │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010025                 │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-9192    │          │          │                             │               │ glibc: uncontrolled recursion in function                    │
│         │                  │          │          │                             │               │ check_dst_limits_calc_pos_1 in posix/regexec.c               │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2019-9192                    │
├─────────┼──────────────────┼──────────┤          ├─────────────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ zlib1g  │ CVE-2026-27171   │ MEDIUM   │          │ 1:1.3.dfsg+really1.3.1-1+b1 │               │ zlib: zlib: Denial of Service via infinite loop in CRC32     │
│         │                  │          │          │                             │               │ combine functions...                                         │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2026-27171                   │
└─────────┴──────────────────┴──────────┴──────────┴─────────────────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

OS Packages (license)
=====================
Total: 29 (UNKNOWN: 0, LOW: 11, MEDIUM: 0, HIGH: 18, CRITICAL: 0)

┌─────────────┬───────────────────┬────────────────┬──────────┐
│   Package   │      License      │ Classification │ Severity │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ base-files  │ GPL-2.0-or-later  │ restricted     │ HIGH     │
├─────────────┤                   │                │          │
│ gcc-14-base │                   │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-3.0-only      │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Artistic-2.0      │ notice         │ LOW      │
│             ├───────────────────┼────────────────┼──────────┤
│             │ LGPL-2.0-or-later │ restricted     │ HIGH     │
├─────────────┼───────────────────┤                │          │
│ libc6       │ LGPL-2.1-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-2.0-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-3.0-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-2.0-or-later  │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-2.0-only      │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-3.0-or-later  │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Unicode-DFS-2016  │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ BSL-1.0           │                │          │
│             ├───────────────────┤                │          │
│             │ BSD-2-Clause      │                │          │
│             ├───────────────────┤                │          │
│             │ ISC               │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-3.0-only      │ restricted     │ HIGH     │
│             ├───────────────────┤                │          │
│             │ LGPL-2.0-only     │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-2.1-only     │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-3.0-only     │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ libssl3t64  │ Apache-2.0        │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ Artistic-2.0      │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-1.0-or-later  │ restricted     │ HIGH     │
│             ├───────────────────┤                │          │
│             │ GPL-1.0-only      │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ libzstd1    │ BSD-3-Clause      │ notice         │ LOW      │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-2.0-only      │ restricted     │ HIGH     │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Zlib              │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ MIT               │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ netbase     │ GPL-2.0-only      │ restricted     │ HIGH     │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ zlib1g      │ Zlib              │ notice         │ LOW      │
└─────────────┴───────────────────┴────────────────┴──────────┘

@github-actions

github-actions Bot commented Jul 5, 2026

Copy link
Copy Markdown
Contributor

🔒 Container Vulnerability Scan (hub - arm64)

Click to expand results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.69/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


hub:edfdd0998f6686cb281fd7f57099bb931e6fcda0-arm64 (debian 13.6)
================================================================
Total: 12 (UNKNOWN: 0, LOW: 7, MEDIUM: 5, HIGH: 0, CRITICAL: 0)

┌─────────┬──────────────────┬──────────┬──────────┬─────────────────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│ Library │  Vulnerability   │ Severity │  Status  │      Installed Version      │ Fixed Version │                            Title                             │
├─────────┼──────────────────┼──────────┼──────────┼─────────────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ libc6   │ CVE-2026-5435    │ MEDIUM   │ affected │ 2.41-12+deb13u3             │               │ glibc: glibc: Out-of-bounds write via TSIG record processing │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2026-5435                    │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-5450    │          │          │                             │               │ glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc`     │
│         │                  │          │          │                             │               │ format specifier and...                                      │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2026-5450                    │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-5928    │          │          │                             │               │ glibc: glibc: Information disclosure or denial of service    │
│         │                  │          │          │                             │               │ via ungetwc function with...                                 │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2026-5928                    │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-6238    │          │          │                             │               │ glibc: glibc: Application crash or uninitialized memory read │
│         │                  │          │          │                             │               │ via crafted DNS response...                                  │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2026-6238                    │
│         ├──────────────────┼──────────┤          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2010-4756    │ LOW      │          │                             │               │ glibc: glob implementation can cause excessive CPU and       │
│         │                  │          │          │                             │               │ memory consumption due to...                                 │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2010-4756                    │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2018-20796   │          │          │                             │               │ glibc: uncontrolled recursion in function                    │
│         │                  │          │          │                             │               │ check_dst_limits_calc_pos_1 in posix/regexec.c               │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2018-20796                   │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010022 │          │          │                             │               │ glibc: stack guard protection bypass                         │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010022                 │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010023 │          │          │                             │               │ glibc: running ldd on malicious ELF leads to code execution  │
│         │                  │          │          │                             │               │ because of...                                                │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010023                 │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010024 │          │          │                             │               │ glibc: ASLR bypass using cache of thread stack and heap      │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010024                 │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010025 │          │          │                             │               │ glibc: information disclosure of heap addresses of           │
│         │                  │          │          │                             │               │ pthread_created thread                                       │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010025                 │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-9192    │          │          │                             │               │ glibc: uncontrolled recursion in function                    │
│         │                  │          │          │                             │               │ check_dst_limits_calc_pos_1 in posix/regexec.c               │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2019-9192                    │
├─────────┼──────────────────┼──────────┤          ├─────────────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ zlib1g  │ CVE-2026-27171   │ MEDIUM   │          │ 1:1.3.dfsg+really1.3.1-1+b1 │               │ zlib: zlib: Denial of Service via infinite loop in CRC32     │
│         │                  │          │          │                             │               │ combine functions...                                         │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2026-27171                   │
└─────────┴──────────────────┴──────────┴──────────┴─────────────────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

OS Packages (license)
=====================
Total: 29 (UNKNOWN: 0, LOW: 11, MEDIUM: 0, HIGH: 18, CRITICAL: 0)

┌─────────────┬───────────────────┬────────────────┬──────────┐
│   Package   │      License      │ Classification │ Severity │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ base-files  │ GPL-2.0-or-later  │ restricted     │ HIGH     │
├─────────────┤                   │                │          │
│ gcc-14-base │                   │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-3.0-only      │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Artistic-2.0      │ notice         │ LOW      │
│             ├───────────────────┼────────────────┼──────────┤
│             │ LGPL-2.0-or-later │ restricted     │ HIGH     │
├─────────────┼───────────────────┤                │          │
│ libc6       │ LGPL-2.1-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-2.0-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-3.0-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-2.0-or-later  │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-2.0-only      │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-3.0-or-later  │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Unicode-DFS-2016  │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ BSL-1.0           │                │          │
│             ├───────────────────┤                │          │
│             │ BSD-2-Clause      │                │          │
│             ├───────────────────┤                │          │
│             │ ISC               │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-3.0-only      │ restricted     │ HIGH     │
│             ├───────────────────┤                │          │
│             │ LGPL-2.0-only     │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-2.1-only     │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-3.0-only     │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ libssl3t64  │ Apache-2.0        │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ Artistic-2.0      │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-1.0-or-later  │ restricted     │ HIGH     │
│             ├───────────────────┤                │          │
│             │ GPL-1.0-only      │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ libzstd1    │ BSD-3-Clause      │ notice         │ LOW      │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-2.0-only      │ restricted     │ HIGH     │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Zlib              │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ MIT               │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ netbase     │ GPL-2.0-only      │ restricted     │ HIGH     │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ zlib1g      │ Zlib              │ notice         │ LOW      │
└─────────────┴───────────────────┴────────────────┴──────────┘

@doronkopit5 doronkopit5 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

didnt you say you have some issue with this

@al-gold

al-gold commented Jul 14, 2026

Copy link
Copy Markdown
Author

didnt you say you have some issue with this

yes, the issue was in CI/CD "Build Images and Deploy" did not applied changes to staging, so I did it manually.

UPD:
Screnshot of confirmation. Normally when keda applied it also have KEDA ScaledObejct listed in k8s tab
image

UPD2. Here you can see that it really included scaled object

@al-gold
al-gold requested a review from doronkopit5 July 15, 2026 06:46

@doronkopit5 doronkopit5 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

dont add prod and stg overlays here, i'll explain in private

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@helm/templates/pdb.yaml`:
- Around line 10-13: Update the PDB template’s maxUnavailable/minAvailable
selection to use explicit key-presence or null checks rather than truthiness and
the default function, so configured zero values are preserved and only an absent
value falls back to minAvailable’s intended default.

In `@helm/values-staging.yaml`:
- Around line 5-14: Replace the CPU-only KEDA triggers with demand-based scaling
by adding an appropriate request, queue, or concurrency metric in
helm/values-staging.yaml lines 5-14 and helm/values-production.yaml lines 9-18;
retain CPU only if it remains needed, and ensure both environments use the
corresponding demand metric configuration.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: a4d89f01-a3f3-4516-a92f-7ca2c43e56d1

📥 Commits

Reviewing files that changed from the base of the PR and between e1be468 and 9ca4f33.

📒 Files selected for processing (5)
  • helm/templates/pdb.yaml
  • helm/templates/scaling-object.yaml
  • helm/values-production.yaml
  • helm/values-staging.yaml
  • helm/values.yaml

Comment thread helm/templates/pdb.yaml
Comment on lines +10 to +13
{{- if .Values.pdb.maxUnavailable }}
maxUnavailable: {{ .Values.pdb.maxUnavailable }}
{{- else }}
minAvailable: {{ .Values.pdb.minAvailable | default 1 }}

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Preserve explicit zero values in PDB configuration.

Helm treats numeric 0 as false/empty here, so maxUnavailable: 0 falls through to minAvailable, while minAvailable: 0 is replaced by the default 1. Both are valid Kubernetes settings and have different disruption semantics. Use key-presence/null checks instead of truthiness and default for these fields. (kubernetes.io)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@helm/templates/pdb.yaml` around lines 10 - 13, Update the PDB template’s
maxUnavailable/minAvailable selection to use explicit key-presence or null
checks rather than truthiness and the default function, so configured zero
values are preserved and only an absent value falls back to minAvailable’s
intended default.

Comment thread helm/values-staging.yaml
Comment on lines +5 to +14
# LLM hub proxy — CPU under-reads long inference calls
minReplicaCount: 1
maxReplicaCount: 4
pollingInterval: 30
cooldownPeriod: 300
triggers:
- type: cpu
metricType: Utilization
metadata:
value: "70"

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚀 Performance & Scalability | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '== files ==\n'
git ls-files helm | sed -n '1,120p'

printf '\n== ast outline values-staging.yaml ==\n'
ast-grep outline helm/values-staging.yaml --view expanded || true

printf '\n== ast outline values-production.yaml ==\n'
ast-grep outline helm/values-production.yaml --view expanded || true

printf '\n== relevant autoscaling references ==\n'
rg -n "minReplicaCount|maxReplicaCount|pollingInterval|cooldownPeriod|triggers|type: cpu|metricType: Utilization|ScaledObject|autoscal" helm -S

Repository: traceloop/hub

Length of output: 2045


🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '== helm/values.yaml relevant section ==\n'
sed -n '60,110p' helm/values.yaml | cat -n

printf '\n== helm/templates/scaling-object.yaml ==\n'
sed -n '1,80p' helm/templates/scaling-object.yaml | cat -n

printf '\n== staging values ==\n'
sed -n '1,40p' helm/values-staging.yaml | cat -n

printf '\n== production values ==\n'
sed -n '1,50p' helm/values-production.yaml | cat -n

Repository: traceloop/hub

Length of output: 3377


Use a demand-based KEDA trigger instead of CPU-only scaling.

Both helm/values-staging.yaml and helm/values-production.yaml enable KEDA with only a CPU utilization trigger, but the config itself notes that CPU under-reads long inference calls. Add a request/queue/concurrency metric, or document why CPU alone is sufficient.

📍 Affects 2 files
  • helm/values-staging.yaml#L5-L14 (this comment)
  • helm/values-production.yaml#L9-L18
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@helm/values-staging.yaml` around lines 5 - 14, Replace the CPU-only KEDA
triggers with demand-based scaling by adding an appropriate request, queue, or
concurrency metric in helm/values-staging.yaml lines 5-14 and
helm/values-production.yaml lines 9-18; retain CPU only if it remains needed,
and ensure both environments use the corresponding demand metric configuration.

@al-gold

al-gold commented Jul 16, 2026

Copy link
Copy Markdown
Author

dont add prod and stg overlays here, i'll explain in private

now Octopus applying scaled objects.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants