Connect KEDA scalers to observed authentication dependencies (#1987)

Connect KEDA ScaledObject and ScaledJob authentication references to
observed TriggerAuthentication and ClusterTriggerAuthentication
resources. Operators can navigate from a scaler to its authentication
configuration and find the scalers that consume it without manually
joining YAML names.

Omitted authentication kind resolves to a same-namespace
TriggerAuthentication. Explicit cluster authentication receives its
exact cluster read tuple. Authentication configuration points into the
scaler with EdgeConfigures; scaler-to-workload usage remains a separate
EdgeUses relationship. Missing or invalid targets are not fabricated,
and credential references are not traversed.

Applications ScaledJob configuration references and counts exclude
authentication objects the caller cannot read. The request projection
uses exact KEDA read permissions and copies affected rows before
deriving counts and the capped list, preserving the shared cache for
other callers. Broader authorization of pre-existing Applications
relationship categories remains a separate change.

Validation: Go build, complete shared/internal Go suites, type-check,
shared UI and web tests, and the embedded application build pass.
Regression coverage includes mixed authentication permissions, counts
above the 20-reference display cap, cache reuse and local mode. Real
KEDA 2.21.0 runs cover 12 ScaledObject/ScaledJob × namespaced/cluster
authentication × Secret/env/podIdentity combinations on REST, MCP and
topology. All scalers reconcile Ready; the Secret/env fixture endpoint
enforces its dummy bearer token. Restricted-user checks verify direct
cluster authentication denial and omission from relationship projections
and Applications. Test objects and the complete KEDA installation are
removed and absence verified.

![Scaler authentication
dependency](https://github.com/user-attachments/assets/b45de6eb-8df6-44b6-83c0-8714cc4eeb17)
![TriggerAuthentication: Required By the ScaledObject and
ScaledJob](https://github.com/user-attachments/assets/c7b49964-76ad-420d-bc5b-1e14eafe76b5)

Pod identity proof covers accepted AWS provider declarations and
relationship navigation against a local fixture endpoint, not a cloud
credential exchange. Declared authentication dependencies do not
establish credential validity or trigger readiness.

Author: nadaverell

docs/integrations.md

@@ -243,7 +243,7 @@ Radar has first-class renderers for **AWS (CAPA)**, **GCP (CAPG)**, and **Azure
 
 ### What Radar Shows
 
-**Topology:** ScaledObject → target workload (Deployment, StatefulSet, or Rollout). See which workloads are managed by KEDA and trace the scaling relationship.
+**Topology:** ScaledObject → target workload (Deployment, StatefulSet, or Rollout). ScaledObject and ScaledJob triggers also link to observed TriggerAuthentication or ClusterTriggerAuthentication resources. Authentication is a dependency, not an autoscaler target; omitted kind defaults to a same-namespace TriggerAuthentication. Cluster-scoped targets retain per-kind read gating. These declarations do not prove credential validity or trigger readiness. Applications configuration references and counts exclude authentication objects the caller cannot read.
 
 <p align="center">
   <img src="screenshots/integrations/keda-topology.png" alt="KEDA Topology" width="800">
@@ -290,8 +290,8 @@ Radar has first-class renderers for **AWS (CAPA)**, **GCP (CAPG)**, and **Azure
 |-----|-------|----------|-------------|------------|
 | ScaledObject | `keda.sh/v1alpha1` | Yes | Yes | Yes |
 | ScaledJob | `keda.sh/v1alpha1` | Yes | Yes | Yes |
-| TriggerAuthentication | `keda.sh/v1alpha1` | — | Yes | Yes |
-| ClusterTriggerAuthentication | `keda.sh/v1alpha1` | — | Yes | Yes |
+| TriggerAuthentication | `keda.sh/v1alpha1` | When referenced | Yes | Yes |
+| ClusterTriggerAuthentication | `keda.sh/v1alpha1` | When referenced | Yes | Yes |
 
 ---
 

internal/server/applications.go

@@ -297,7 +297,7 @@ func (s *Server) handleListApplications(w http.ResponseWriter, r *http.Request)
 		s.writeError(w, http.StatusInternalServerError, err.Error())
 		return
 	}
-	s.writeJSON(w, resp)
+	s.writeJSON(w, s.filterApplicationAuthenticationRefs(r, resp))
 }
 
 // handleApplicationHistory serves a focused app-level change narrative.
@@ -2709,3 +2709,42 @@ func namespaceFromKey(key string) string {
 
 // (worstAppHealth / appHealthRank removed — the app rollup now uses
 // packages.WorseHealth, the single rollup ordering.)
+
+// Applications rows are shared across callers, so authentication references are authorized on a copy after the cache.
+func (s *Server) filterApplicationAuthenticationRefs(r *http.Request, shared *applicationsResponse) *applicationsResponse {
+	if auth.UserFromContext(r.Context()) == nil {
+		return shared
+	}
+	out := *shared
+	out.Applications = append([]appRow(nil), shared.Applications...)
+	for i := range out.Applications {
+		row := &out.Applications[i]
+		if row.Relationships == nil {
+			continue
+		}
+		rel := *row.Relationships
+		refs := make(map[string]topology.ResourceRef, len(rel.configRefs))
+		withheld := false
+		for key, ref := range rel.configRefs {
+			if ref.Group == "keda.sh" && (ref.Kind == "TriggerAuthentication" || ref.Kind == "ClusterTriggerAuthentication") {
+				resource := "triggerauthentications"
+				if ref.Kind == "ClusterTriggerAuthentication" {
+					resource = "clustertriggerauthentications"
+				}
+				if !s.canRead(r, ref.Group, resource, ref.Namespace, "get") {
+					withheld = true
+					continue
+				}
+			}
+			refs[key] = ref
+		}
+		if !withheld {
+			continue
+		}
+		rel.configRefs = refs
+		rel.ConfigRefs = sortedRefs(refs, 20)
+		rel.Configs = len(refs)
+		row.Relationships = &rel
+	}
+	return &out
+}

internal/server/applications_keda_auth_test.go

@@ -0,0 +1,54 @@
+package server
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/skyhook-io/radar/internal/auth"
+	"github.com/skyhook-io/radar/pkg/topology"
+)
+
+func TestApplicationAuthenticationReferencesAreFilteredWithoutChangingSharedRows(t *testing.T) {
+	s := &Server{permCache: auth.NewPermissionCache()}
+	references := []topology.ResourceRef{
+		{Kind: "TriggerAuthentication", Group: "keda.sh", Namespace: "team", Name: "private-local"},
+		{Kind: "ClusterTriggerAuthentication", Group: "keda.sh", Name: "private-cluster"},
+	}
+	for i := 0; i < 21; i++ {
+		references = append(references, topology.ResourceRef{Kind: "ConfigMap", Namespace: "team", Name: fmt.Sprintf("config-%02d", i)})
+	}
+	shared := &applicationsResponse{Applications: []appRow{{Relationships: &appRelationships{Configs: len(references), ConfigRefs: sortedRefs(refsByKey(references), 20), configRefs: refsByKey(references)}}}}
+	for _, allowed := range [][2]bool{{false, false}, {true, false}, {false, true}, {true, true}, {false, false}} {
+		permissions := &auth.UserPermissions{AllowedNamespaces: []string{"team"}}
+		permissions.SetCanI("get", "keda.sh", "triggerauthentications", "team", allowed[0])
+		permissions.SetCanI("get", "keda.sh", "clustertriggerauthentications", "", allowed[1])
+		s.permCache.Set("viewer", nil, permissions)
+		r := httptest.NewRequest(http.MethodGet, "/api/applications", nil)
+		r = r.WithContext(auth.ContextWithUser(r.Context(), &auth.User{Username: "viewer"}))
+		response := s.filterApplicationAuthenticationRefs(r, shared)
+		expected := 21
+		for _, yes := range allowed {
+			if yes {
+				expected++
+			}
+		}
+		rel := response.Applications[0].Relationships
+		if rel.Configs != expected || len(rel.ConfigRefs) != 20 || len(rel.configRefs) != expected {
+			t.Fatalf("allowed=%v count/ref leak: %+v", allowed, rel)
+		}
+		for _, ref := range rel.configRefs {
+			if ref.Kind == "TriggerAuthentication" && !allowed[0] || ref.Kind == "ClusterTriggerAuthentication" && !allowed[1] {
+				t.Fatalf("denied ref retained: %+v", ref)
+			}
+		}
+		if shared.Applications[0].Relationships.Configs != 23 || len(shared.Applications[0].Relationships.configRefs) != 23 {
+			t.Fatal("per-user projection mutated shared cache")
+		}
+	}
+	anonymous := httptest.NewRequest(http.MethodGet, "/api/applications", nil)
+	if s.filterApplicationAuthenticationRefs(anonymous, shared) != shared {
+		t.Fatal("local no-auth response was copied or changed")
+	}
+}

pkg/configrefs/keda.go

@@ -0,0 +1,42 @@
+package configrefs
+
+import (
+	"github.com/skyhook-io/radar/pkg/resourceid"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+)
+
+// KEDAAuthenticationReferences extracts trigger authentication declarations.
+// KEDA defines omitted kind as TriggerAuthentication in the scaler namespace;
+// ClusterTriggerAuthentication is cluster-scoped. Credential scope is separate.
+func KEDAAuthenticationReferences(scaler *unstructured.Unstructured) []resourceid.Ref {
+	if scaler == nil || resourceid.GroupFromAPIVersion(scaler.GetAPIVersion()) != "keda.sh" || scaler.GetKind() != "ScaledObject" && scaler.GetKind() != "ScaledJob" {
+		return nil
+	}
+	triggers, _, _ := unstructured.NestedSlice(scaler.Object, "spec", "triggers")
+	seen := map[resourceid.Ref]bool{}
+	var refs []resourceid.Ref
+	for _, value := range triggers {
+		trigger, ok := value.(map[string]any)
+		if !ok {
+			continue
+		}
+		name, _, _ := unstructured.NestedString(trigger, "authenticationRef", "name")
+		kind, _, _ := unstructured.NestedString(trigger, "authenticationRef", "kind")
+		if kind == "" {
+			kind = "TriggerAuthentication"
+		}
+		if name == "" || kind != "TriggerAuthentication" && kind != "ClusterTriggerAuthentication" {
+			continue
+		}
+		namespace := scaler.GetNamespace()
+		if kind == "ClusterTriggerAuthentication" {
+			namespace = ""
+		}
+		ref := resourceid.NewRef("keda.sh", kind, namespace, name)
+		if !seen[ref] {
+			refs = append(refs, ref)
+			seen[ref] = true
+		}
+	}
+	return refs
+}

pkg/configrefs/keda_test.go

@@ -0,0 +1,43 @@
+package configrefs
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/skyhook-io/radar/pkg/resourceid"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+)
+
+func TestKEDAAuthenticationReferences(t *testing.T) {
+	for _, kind := range []string{"ScaledObject", "ScaledJob"} {
+		t.Run(kind, func(t *testing.T) {
+			scaler := &unstructured.Unstructured{Object: map[string]any{
+				"apiVersion": "keda.sh/v1alpha1", "kind": kind,
+				"metadata": map[string]any{"name": "worker", "namespace": "team"},
+				"spec": map[string]any{"triggers": []any{
+					map[string]any{"authenticationRef": map[string]any{"name": "credentials"}},
+					map[string]any{"authenticationRef": map[string]any{"name": "credentials", "kind": "TriggerAuthentication"}},
+					map[string]any{"authenticationRef": map[string]any{"name": "credentials", "kind": "ClusterTriggerAuthentication"}},
+					map[string]any{"authenticationRef": map[string]any{"name": "bad", "kind": "Secret"}},
+					map[string]any{"authenticationRef": map[string]any{"kind": "TriggerAuthentication"}},
+					map[string]any{},
+				}},
+			}}
+			before := scaler.DeepCopy()
+			want := []resourceid.Ref{resourceid.NewRef("keda.sh", "TriggerAuthentication", "team", "credentials"), resourceid.NewRef("keda.sh", "ClusterTriggerAuthentication", "", "credentials")}
+			if got := KEDAAuthenticationReferences(scaler); !reflect.DeepEqual(got, want) {
+				t.Fatalf("references = %+v, want %+v", got, want)
+			}
+			if !reflect.DeepEqual(scaler, before) {
+				t.Fatal("mutated scaler")
+			}
+			scaler.SetAPIVersion("other.example/v1")
+			if got := KEDAAuthenticationReferences(scaler); len(got) != 0 {
+				t.Fatalf("non-KEDA source: %+v", got)
+			}
+		})
+	}
+	if got := KEDAAuthenticationReferences(nil); len(got) != 0 {
+		t.Fatal(got)
+	}
+}

pkg/topology/builder.go

@@ -1176,6 +1176,8 @@ func (b *Builder) buildResourcesTopology(opts BuildOptions) (*Topology, error) {
 		}
 	}
 
+	var kedaAuthenticationDependencies []declaredDependency
+
 	// 1i. Add KEDA ScaledObject and ScaledJob nodes (CRD - fetched via dynamic cache)
 	var scaledObjectGVR schema.GroupVersionResource
 	hasScaledObjects := false
@@ -1208,6 +1210,10 @@ func (b *Builder) buildResourcesTopology(opts BuildOptions) (*Topology, error) {
 				},
 			})
 
+			for _, ref := range configrefs.KEDAAuthenticationReferences(so) {
+				kedaAuthenticationDependencies = append(kedaAuthenticationDependencies, declaredDependency{Source: resourceid.NewRef("keda.sh", "ScaledObject", ns, name), Target: ref, Label: "authentication", Configuration: true})
+			}
+
 			// ScaledObject → target workload edge (via spec.scaleTargetRef)
 			targetAPIVersion, _, _ := unstructured.NestedString(so.Object, "spec", "scaleTargetRef", "apiVersion")
 			targetKind, _, _ := unstructured.NestedString(so.Object, "spec", "scaleTargetRef", "kind")
@@ -1269,6 +1275,10 @@ func (b *Builder) buildResourcesTopology(opts BuildOptions) (*Topology, error) {
 					"apiVersion": sj.GetAPIVersion(),
 				},
 			})
+			for _, ref := range configrefs.KEDAAuthenticationReferences(sj) {
+				kedaAuthenticationDependencies = append(kedaAuthenticationDependencies, declaredDependency{Source: resourceid.NewRef("keda.sh", "ScaledJob", ns, name), Target: ref, Label: "authentication", Configuration: true})
+			}
+
 		}
 	}
 
@@ -3774,6 +3784,9 @@ func (b *Builder) buildResourcesTopology(opts BuildOptions) (*Topology, error) {
 		}
 	}
 
+	nodes, edges, kedaAuthenticationWarnings := addObservedDependencyEdges(nodes, edges, kedaAuthenticationDependencies, dynamicCache, opts)
+	warnings = append(warnings, kedaAuthenticationWarnings...)
+
 	// 8. Add ConfigMap nodes (if enabled)
 	if opts.IncludeConfigMaps {
 		configmaps, cmErr := b.provider.ConfigMaps()

pkg/topology/keda_authentication_test.go

@@ -0,0 +1,68 @@
+package topology
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+func TestKEDAAuthenticationDependenciesObservedAndScoped(t *testing.T) {
+	gvrs := map[string]schema.GroupVersionResource{}
+	for kind, resource := range map[string]string{"ScaledObject": "scaledobjects", "ScaledJob": "scaledjobs", "TriggerAuthentication": "triggerauthentications", "ClusterTriggerAuthentication": "clustertriggerauthentications"} {
+		gvrs[kind] = schema.GroupVersionResource{Group: "keda.sh", Version: "v1alpha1", Resource: resource}
+	}
+	makeObject := func(kind, namespace, name string) *unstructured.Unstructured {
+		return &unstructured.Unstructured{Object: map[string]any{"apiVersion": "keda.sh/v1alpha1", "kind": kind, "metadata": map[string]any{"namespace": namespace, "name": name}}}
+	}
+	so, sj := makeObject("ScaledObject", "team", "worker"), makeObject("ScaledJob", "team", "jobs")
+	so.Object["spec"] = map[string]any{"triggers": []any{
+		map[string]any{"authenticationRef": map[string]any{"name": "local"}},
+		map[string]any{"authenticationRef": map[string]any{"name": "local"}},
+		map[string]any{"authenticationRef": map[string]any{"name": "absent"}},
+	}}
+	sj.Object["spec"] = map[string]any{"triggers": []any{map[string]any{"authenticationRef": map[string]any{"name": "global", "kind": "ClusterTriggerAuthentication"}}}}
+	p := &issuerTestProvider{monitorDynamicProvider: monitorDynamicProvider{gvrs: gvrs, resources: map[schema.GroupVersionResource][]*unstructured.Unstructured{
+		gvrs["ScaledObject"]: {so}, gvrs["ScaledJob"]: {sj},
+		gvrs["TriggerAuthentication"]:        {makeObject("TriggerAuthentication", "team", "local"), makeObject("TriggerAuthentication", "other", "local"), makeObject("TriggerAuthentication", "team", "unused")},
+		gvrs["ClusterTriggerAuthentication"]: {makeObject("ClusterTriggerAuthentication", "", "global")},
+	}}, listCalls: map[string]int{}}
+	opts := DefaultBuildOptions()
+	opts.Namespaces = []string{"team"}
+	topo, err := NewBuilder(&mockProvider{}).WithDynamic(p).Build(opts)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(topo.Nodes) != 4 || len(topo.Edges) != 2 {
+		t.Fatalf("observed authentication graph: nodes=%+v edges=%+v", topo.Nodes, topo.Edges)
+	}
+	for _, edge := range topo.Edges {
+		if edge.Type != EdgeConfigures || edge.Label != "authentication" {
+			t.Fatalf("authentication presented as scaler usage: %+v", edge)
+		}
+	}
+	for _, tc := range []struct{ kind, name, auth, namespace string }{{"ScaledObject", "worker", "TriggerAuthentication", "team"}, {"ScaledJob", "jobs", "ClusterTriggerAuthentication", ""}} {
+		rel := GetRelationships(tc.kind, "team", tc.name, topo, nil, p)
+		if rel == nil || len(rel.Dependencies) != 1 || rel.Dependencies[0].Kind != tc.auth || rel.Dependencies[0].Namespace != tc.namespace || rel.ScaleTarget != nil {
+			t.Fatalf("authentication misclassified for %s: %+v", tc.kind, rel)
+		}
+		name := "local"
+		if tc.namespace == "" {
+			name = "global"
+		}
+		reverse := GetRelationships(tc.auth, tc.namespace, name, topo, nil, p)
+		if reverse == nil || len(reverse.Dependents) != 1 || reverse.Dependents[0].Kind != tc.kind {
+			t.Fatalf("reverse authentication: %+v", reverse)
+		}
+	}
+	if p.getCalls != 0 || p.listCalls["triggerauthentications"] != 1 || p.listCalls["clustertriggerauthentications"] != 1 {
+		t.Fatalf("per-object lookup or repeated kind list: gets=%d lists=%v", p.getCalls, p.listCalls)
+	}
+	if tuples := topo.ClusterScopedDynamicRBACTuples(); len(tuples) != 1 || tuples[0].Group != "keda.sh" || tuples[0].Resource != "clustertriggerauthentications" {
+		t.Fatalf("cluster authorization tuples = %+v", tuples)
+	}
+	topo.StripClusterScopedDynamicExcept(nil)
+	if len(topo.Nodes) != 3 || len(topo.Edges) != 1 {
+		t.Fatalf("denied cluster authentication retained: %+v", topo)
+	}
+}

pkg/topology/observed_dependencies.go

@@ -12,6 +12,9 @@ import (
 type declaredDependency struct {
 	Source, Target resourceid.Ref
 	Label          string
+	// Configuration emits target → source, matching EdgeConfigures semantics.
+	// Other declarations emit source → target as EdgeUses dependencies.
+	Configuration bool
 }
 
 func addObservedDependencyEdges(nodes []Node, edges []Edge, refs []declaredDependency, provider DynamicProvider, opts BuildOptions) ([]Node, []Edge, []string) {
@@ -45,10 +48,10 @@ func addObservedDependencyEdges(nodes []Node, edges []Edge, refs []declaredDepen
 		}
 		return kinds[i].Kind < kinds[j].Kind
 	})
-	seenEdges := map[[2]string]bool{}
+	seenEdges := map[[3]string]bool{}
 	for _, edge := range edges {
-		if edge.Type == EdgeUses {
-			seenEdges[[2]string{edge.Source, edge.Target}] = true
+		if edge.Type == EdgeUses || edge.Type == EdgeConfigures {
+			seenEdges[[3]string{edge.Source, edge.Target, string(edge.Type)}] = true
 		}
 	}
 	var warnings []string
@@ -95,11 +98,20 @@ func addObservedDependencyEdges(nodes []Node, edges []Edge, refs []declaredDepen
 				nodes = append(nodes, Node{ID: target, Kind: NodeKind(kind.Kind), Name: obj.GetName(), Status: extractGenericStatus(obj), Data: data})
 				byResource[ref.Target.Key()] = target
 			}
-			pair := [2]string{source, target}
+			edgeType := EdgeUses
+			if ref.Configuration {
+				source, target = target, source
+				edgeType = EdgeConfigures
+			}
+			pair := [3]string{source, target, string(edgeType)}
 			if seenEdges[pair] {
 				continue
 			}
-			edges = append(edges, Edge{ID: source + "-to-" + target, Source: source, Target: target, Type: EdgeUses, Label: ref.Label})
+			id := source + "-to-" + target
+			if edgeType == EdgeConfigures {
+				id += "-configures"
+			}
+			edges = append(edges, Edge{ID: id, Source: source, Target: target, Type: edgeType, Label: ref.Label})
 			seenEdges[pair] = true
 		}
 	}

pkg/topology/relationships.go

@@ -394,6 +394,9 @@ func GetRelationshipsWithObject(kind, namespace, name string, obj any, topo *Top
 				continue
 			}
 			rel.Consumers = append(rel.Consumers, *ref)
+			if isConfigurationDependency(refForNodeID(edge.Source)) {
+				rel.Dependents = appendResourceRef(rel.Dependents, *ref)
+			}
 			if reflectionEdge(edge, nodeByID) {
 				if rel.Reflection == nil {
 					rel.Reflection = &ReflectionRelationships{}
@@ -479,6 +482,9 @@ func GetRelationshipsWithObject(kind, namespace, name string, obj any, topo *Top
 				}
 			}
 		case EdgeConfigures:
+			if isConfigurationDependency(ref) {
+				rel.Dependencies = appendResourceRef(rel.Dependencies, *ref)
+			}
 			if reflectionEdge(edge, nodeByID) {
 				if rel.Reflection == nil {
 					rel.Reflection = &ReflectionRelationships{}