Networking
Default destination ports for Helm installations; check Helm values for overrides. All ports are TCP except DNS (UDP/TCP). 443 → 6443 denotes Service port → pod port. Network policies and firewalls must allow the pod target ports. Component Services are cluster-internal by default.
Cluster and external access
Section titled “Cluster and external access”| Source | Destination | Port | Purpose |
|---|---|---|---|
| Agent | service.kedify.io | 443 | Outbound TLS gRPC (HTTP/2). |
| Controllers, scalers and Agent | Kubernetes API | 443 | Kubernetes resources and Metrics API via kubernetes.default.svc. |
| Kedify pods | cluster DNS | 53 UDP/TCP | DNS resolution. |
| Kubernetes API server | KEDA metrics API server | 443 → 6443 | external.metrics.k8s.io. |
| Kubernetes API server | KEDA admission webhooks | 443 → 9443 | Resource validation. |
| KEDA metrics API server | KEDA operator | 9666 | Metrics over mTLS gRPC. |
For Kubernetes API egress, also allow the actual endpoint port, commonly 6443. Allow control-plane-to-pod traffic on 6443 and 9443. Installation clients and nodes need HTTPS 443 to chart/image registries (private-registry setup). Scalers need access to their configured metric/event sources.
HTTP Scaler
Section titled “HTTP Scaler”| Source | Destination | Port | Purpose |
|---|---|---|---|
| Ingress/gateway or clients | Kedify Proxy | 8080; 8443 TLS; 9002 inference | Application traffic; allow the ports used by configured routes. |
| Kedify Proxy or direct clients | HTTP interceptor | 8080; 8443 TLS | Request buffering during scale from zero. |
| Kedify Proxy | HTTP interceptor | 5678, 9901 | gRPC xDS configuration and Envoy metrics, respectively. |
| KEDA operator | HTTP external scaler | 9090 | External-scaler gRPC API. |
| HTTP interceptor | HTTP external scaler pod IPs | 50051 | Metrics/activation streams (grpcBridge.enabled=true by default). |
| HTTP external scaler | HTTP interceptor | 9090 | /queue polling when grpcBridge.enabled=false. |
| Kedify Proxy and HTTP interceptor | application backends | Backend Service/target ports | Forward requests. |
Optional components
Section titled “Optional components”| Source | Destination | Port | Purpose |
|---|---|---|---|
| OTLP producers | OTel Scaler or Predictor | 4317 | OTLP/gRPC metrics. |
| KEDA operator | OTel Scaler | 4318 | External-scaler gRPC API. |
| API clients / OTel check runners | OTel Scaler | 9090 | REST API. |
| KEDA operator, prediction controller and training jobs | Predictor | 8000 | Prediction/model REST API. |
| Predictor | KEDA operator | 9666 | Raw metrics over mTLS gRPC. |
| Autoscaling Check runners | check targets / Kedify Proxy | 8080 | Test traffic; also allow configured metric-source/OTLP endpoints. |
Predictor’s optional external PostgreSQL connection uses the configured port (default 5432); optional notebooks use 8888.
Deployment variants
Section titled “Deployment variants”KPA → paired KEDA operator: 9666 over mTLS. CPU/memory metrics use metrics.k8s.io through the Kubernetes API. Match keda.metricsAddress, keda.metricsAuthority and keda.certificateSecret to the paired operator.
KPA’s networkPolicy.enabled defaults to false. When enabled, configure networkPolicy.kedaNamespaceSelector, networkPolicy.kedaPodSelector, metrics-ingress selectors (including Agent access), and networkPolicy.apiServerPorts.
Multi-cluster
Section titled “Multi-cluster”Central Agent → each member’s kubeconfig API endpoint: HTTPS on its configured port, usually 443 or 6443. DNS, routing and firewall access must work from the Agent pod. Distributed jobs also require Agent → central KEDA operator on 9666. Metric sources must be reachable from central KEDA.
vCluster discovery uses the internal vCluster Service, normally 443 → 8443; allow the pod target port in host network policies. See member registration for kubeconfigs.
Multi-tenant
Section titled “Multi-tenant”Shared metrics adapter → every tenant KEDA operator: 9666 over mTLS, including across installation namespaces. Each KPA connects to its paired operator on 9666. The metrics API (6443) and webhook (9443) remain shared in the default installation.
Match policies to tenant labels: KPA’s default app.kubernetes.io/name=keda-operator selector does not match keda-operator-foo. Allow metrics scraping on 8080 across installation namespaces. watchNamespace does not enforce network isolation. See multi-tenant setup for pairing and certificates.
Metrics and health probes
Section titled “Metrics and health probes”Allow Agent/monitoring scrapers to reach metrics ports and kubelets to reach pod probe ports.
| Component | Metrics port | Probe port |
|---|---|---|
| Agent, KEDA operator, KEDA admission webhooks, KPA | 8080 | 8081 |
| KEDA metrics API server | 8080 | 6443 HTTPS |
| HTTP interceptor | 2223 | 8080 |
| HTTP external scaler | 2223 (pod only) | 9090 gRPC |
| Kedify Proxy | 9901 (Envoy admin) | 9901 |
| OTel Scaler | 8080 | 9090 |
| Predictor | 8080 | 8082; startup 8000 |
| Autoscaling Checks | 8080 | 8080 where configured |
| OTel operator (bundled with OTel Scaler) | 8080; 8443 HTTPS proxy | 8081 |
The legacy HTTP operator is disabled (operator.replicas=0). If enabled: metrics on HTTPS 8443, probes on 8081.