Access, telemetry and connectivity boundaries
Connections and credentials
Section titled “Connections and credentials”| Path | Purpose | Configuration |
|---|---|---|
Agent → service.kedify.io:443 | Outbound TLS gRPC connection to the Kedify service, authenticated with the Agent API key. | agent.kedifyServer, agent.orgId and the Agent credential configured during Helm installation. |
| Agent/controllers → Kubernetes API | Read telemetry and reconcile enabled components/resources using Kubernetes RBAC. | Chart feature flags and agent.rbac values; inspect the rendered Role/ClusterRole bindings for the selected release. |
| Agent → member Kubernetes APIs | Reconcile distributed workloads in remote clusters. | Member kubeconfigs and permissions from the multi-cluster guide. |
| Scalers → metric/event sources | Read demand signals. Destinations and credentials depend on the scaler. | The owning scaler guide and TriggerAuthentication where supported. |
| Cluster → image/chart registries | Fetch enabled components. | Private-registry installation. Mirroring images does not remove the Agent’s hosted-service connection. |
See Networking for default ports and connection directions. Derive the deployment’s full egress list from its selected registries, member APIs and signal sources.
By default the Agent chart creates the API-key Secret. With agent.createApiKeySecret=false, supply the kedify-agent Secret yourself with an apikey key; keep its value out of committed manifests. Helm values documents the available settings.
Resource recommendation collection
Section titled “Resource recommendation collection”The Agent reads container CPU/memory utilization from the Kubernetes Metrics API. With global.features.recommendationsForLabeledNamespaces=true, collection selects namespaces carrying insights.kedify.io/scrape, except values false, disabled or paused. agent.metricsWatchNamespace explicitly adds namespaces even if their label disables collection. Disabling label gating with an empty explicit list selects all namespaces.
Use Insights collection controls to inspect and change this scope. Resource recommendation collection does not enable PRA or PRP. Other telemetry, logs and health checks have their own settings; see Agent configuration and metrics reference.
Permissions and diagnostic exports
Section titled “Permissions and diagnostic exports”A namespace-scoped controller does not imply namespace-only installation privileges: charts can install CRDs and cluster RBAC. Multi-tenant installation defines controller ownership; network policy, workload isolation and Secret permissions remain Kubernetes configuration responsibilities.
Diagnostic exports can contain workload names, scaling configuration and operational metadata. Inspect exports before sharing them and remove credentials.
For hosted-service security evidence, use the Trust Center linked from Security & compliance. FIPS and SOC 2 describe their respective scope.