# Networking

Default destination ports for [Helm installations](https://docs.kedify.io/installation/helm/); check [Helm values](https://docs.kedify.io/reference/helm-values/) for overrides. All ports are TCP except DNS (UDP/TCP). `443 → 6443` denotes Service port → pod port. Network policies and firewalls must allow the pod target ports. Component Services are cluster-internal by default.

## Cluster and external access

| Source | Destination | Port | Purpose |
| --- | --- | --- | --- |
| Agent | `service.kedify.io` | `443` | Outbound TLS gRPC (HTTP/2). |
| Controllers, scalers and Agent | Kubernetes API | `443` | Kubernetes resources and Metrics API via `kubernetes.default.svc`. |
| Kedify pods | cluster DNS | `53` UDP/TCP | DNS resolution. |
| Kubernetes API server | KEDA metrics API server | `443 → 6443` | `external.metrics.k8s.io`. |
| Kubernetes API server | KEDA admission webhooks | `443 → 9443` | Resource validation. |
| KEDA metrics API server | KEDA operator | `9666` | Metrics over mTLS gRPC. |

For Kubernetes API egress, also allow the actual endpoint port, commonly `6443`. Allow control-plane-to-pod traffic on `6443` and `9443`. Installation clients and nodes need HTTPS `443` to chart/image registries ([private-registry setup](https://docs.kedify.io/installation/air-gapped/)). Scalers need access to their configured metric/event sources.

## HTTP Scaler

| Source | Destination | Port | Purpose |
| --- | --- | --- | --- |
| Ingress/gateway or clients | Kedify Proxy | `8080`; `8443` TLS; `9002` inference | Application traffic; allow the ports used by configured routes. |
| Kedify Proxy or direct clients | HTTP interceptor | `8080`; `8443` TLS | Request buffering during scale from zero. |
| Kedify Proxy | HTTP interceptor | `5678`, `9901` | gRPC xDS configuration and Envoy metrics, respectively. |
| KEDA operator | HTTP external scaler | `9090` | External-scaler gRPC API. |
| HTTP interceptor | HTTP external scaler pod IPs | `50051` | Metrics/activation streams (`grpcBridge.enabled=true` by default). |
| HTTP external scaler | HTTP interceptor | `9090` | `/queue` polling when `grpcBridge.enabled=false`. |
| Kedify Proxy and HTTP interceptor | application backends | Backend Service/target ports | Forward requests. |

## Optional components

| Source | Destination | Port | Purpose |
| --- | --- | --- | --- |
| OTLP producers | OTel Scaler or Predictor | `4317` | OTLP/gRPC metrics. |
| KEDA operator | OTel Scaler | `4318` | External-scaler gRPC API. |
| API clients / OTel check runners | OTel Scaler | `9090` | REST API. |
| KEDA operator, prediction controller and training jobs | Predictor | `8000` | Prediction/model REST API. |
| Predictor | KEDA operator | `9666` | Raw metrics over mTLS gRPC. |
| Autoscaling Check runners | check targets / Kedify Proxy | `8080` | Test traffic; also allow configured metric-source/OTLP endpoints. |

Predictor’s optional external PostgreSQL connection uses the configured port (default `5432`); optional notebooks use `8888`.

## Deployment variants

### KPA

[KPA](https://docs.kedify.io/features/kedify-pod-autoscaler/) → paired KEDA operator: `9666` over mTLS. CPU/memory metrics use `metrics.k8s.io` through the Kubernetes API. Match `keda.metricsAddress`, `keda.metricsAuthority` and `keda.certificateSecret` to the paired operator.

KPA’s `networkPolicy.enabled` defaults to `false`. When enabled, configure `networkPolicy.kedaNamespaceSelector`, `networkPolicy.kedaPodSelector`, metrics-ingress selectors (including Agent access), and `networkPolicy.apiServerPorts`.

### Multi-cluster

Central Agent → each member’s kubeconfig API endpoint: HTTPS on its configured port, usually `443` or `6443`. DNS, routing and firewall access must work from the Agent pod. Distributed jobs also require Agent → central KEDA operator on `9666`. Metric sources must be reachable from central KEDA.

[vCluster discovery](https://docs.kedify.io/how-to/vcluster-scaling/) uses the internal vCluster Service, normally `443 → 8443`; allow the pod target port in host network policies. See [member registration](https://docs.kedify.io/how-to/multicluster-gitops/) for kubeconfigs.

### Multi-tenant

Shared metrics adapter → every tenant KEDA operator: `9666` over mTLS, including across installation namespaces. Each KPA connects to its paired operator on `9666`. The metrics API (`6443`) and webhook (`9443`) remain shared in the default installation.

Match policies to tenant labels: KPA’s default `app.kubernetes.io/name=keda-operator` selector does not match `keda-operator-foo`. Allow metrics scraping on `8080` across installation namespaces. `watchNamespace` does not enforce network isolation. See [multi-tenant setup](https://docs.kedify.io/how-to/multitenant-scaling/) for pairing and certificates.

## Metrics and health probes

Allow Agent/monitoring scrapers to reach metrics ports and kubelets to reach pod probe ports.

| Component | Metrics port | Probe port |
| --- | --- | --- |
| Agent, KEDA operator, KEDA admission webhooks, KPA | `8080` | `8081` |
| KEDA metrics API server | `8080` | `6443` HTTPS |
| HTTP interceptor | `2223` | `8080` |
| HTTP external scaler | `2223` (pod only) | `9090` gRPC |
| Kedify Proxy | `9901` (Envoy admin) | `9901` |
| OTel Scaler | `8080` | `9090` |
| Predictor | `8080` | `8082`; startup `8000` |
| Autoscaling Checks | `8080` | `8080` where configured |
| OTel operator (bundled with OTel Scaler) | `8080`; `8443` HTTPS proxy | `8081` |

The legacy HTTP operator is disabled (`operator.replicas=0`). If enabled: metrics on HTTPS `8443`, probes on `8081`.

Last updated: Sep 22, 2026

---
Canonical: https://docs.kedify.io/installation/networking/
Source: src/content/docs/installation/networking.md
Documentation index: https://docs.kedify.io/llms.txt