# Access, telemetry and connectivity boundaries

## Connections and credentials

| Path | Purpose | Configuration |
| --- | --- | --- |
| Agent → `service.kedify.io:443` | Outbound TLS gRPC connection to the Kedify service, authenticated with the Agent API key. | `agent.kedifyServer`, `agent.orgId` and the Agent credential configured during [Helm installation](https://docs.kedify.io/installation/helm/). |
| Agent/controllers → Kubernetes API | Read telemetry and reconcile enabled components/resources using Kubernetes RBAC. | Chart feature flags and `agent.rbac` values; inspect the rendered Role/ClusterRole bindings for the selected release. |
| Agent → member Kubernetes APIs | Reconcile distributed workloads in remote clusters. | Member kubeconfigs and permissions from the [multi-cluster guide](https://docs.kedify.io/features/multi-cluster-scaling/). |
| Scalers → metric/event sources | Read demand signals. Destinations and credentials depend on the scaler. | The owning [scaler guide](https://docs.kedify.io/scalers/) and TriggerAuthentication where supported. |
| Cluster → image/chart registries | Fetch enabled components. | [Private-registry installation](https://docs.kedify.io/installation/air-gapped/). Mirroring images does not remove the Agent’s hosted-service connection. |

See [Networking](https://docs.kedify.io/installation/networking/) for default ports and connection directions. Derive the deployment’s full egress list from its selected registries, member APIs and signal sources.

By default the Agent chart creates the API-key Secret. With `agent.createApiKeySecret=false`, supply the `kedify-agent` Secret yourself with an `apikey` key; keep its value out of committed manifests. [Helm values](https://docs.kedify.io/reference/helm-values/) documents the available settings.

## Resource recommendation collection

The Agent reads container CPU/memory utilization from the Kubernetes Metrics API. With `global.features.recommendationsForLabeledNamespaces=true`, collection selects namespaces carrying `insights.kedify.io/scrape`, except values `false`, `disabled` or `paused`. `agent.metricsWatchNamespace` explicitly adds namespaces even if their label disables collection. Disabling label gating with an empty explicit list selects all namespaces.

Use [Insights collection controls](https://docs.kedify.io/features/insights/) to inspect and change this scope. Resource recommendation collection does not enable PRA or PRP. Other telemetry, logs and health checks have their own settings; see [Agent configuration](https://docs.kedify.io/concepts/kedify-agent/) and [metrics reference](https://docs.kedify.io/reference/metrics/).

## Permissions and diagnostic exports

A namespace-scoped controller does not imply namespace-only installation privileges: charts can install CRDs and cluster RBAC. [Multi-tenant installation](https://docs.kedify.io/how-to/multitenant-scaling/) defines controller ownership; network policy, workload isolation and Secret permissions remain Kubernetes configuration responsibilities.

[Diagnostic exports](https://docs.kedify.io/troubleshooting/collecting-kedify-configuration/) can contain workload names, scaling configuration and operational metadata. Inspect exports before sharing them and remove credentials.

For hosted-service security evidence, use the Trust Center linked from [Security & compliance](https://docs.kedify.io/security-and-compliance/). [FIPS](https://docs.kedify.io/security-and-compliance/fips/) and [SOC 2](https://docs.kedify.io/security-and-compliance/soc2/) describe their respective scope.

---
Canonical: https://docs.kedify.io/security-and-compliance/access-and-data/
Source: src/content/docs/security-and-compliance/access-and-data.md
Documentation index: https://docs.kedify.io/llms.txt