[nadaverell]

Connect KEDA ScaledObject and ScaledJob authentication references to observed TriggerAuthentication and ClusterTriggerAuthentication resources. Operators can navigate from a scaler to its authentication configuration and find the scalers that consume it without manually joining YAML names.

Omitted authentication kind resolves to a same-namespace TriggerAuthentication. Explicit cluster authentication receives its exact cluster read tuple. Authentication configuration points into the scaler with EdgeConfigures; scaler-to-workload usage remains a separate EdgeUses relationship. Missing or invalid targets are not fabricated, and credential references are not traversed.

Applications ScaledJob configuration references and counts exclude authentication objects the caller cannot read. The request projection uses exact KEDA read permissions and copies affected rows before deriving counts and the capped list, preserving the shared cache for other callers. Broader authorization of pre-existing Applications relationship categories remains a separate change.

Validation: Go build, complete shared/internal Go suites, type-check, shared UI and web tests, and the embedded application build pass. Regression coverage includes mixed authentication permissions, counts above the 20-reference display cap, cache reuse and local mode. Real KEDA 2.21.0 runs cover 12 ScaledObject/ScaledJob × namespaced/cluster authentication × Secret/env/podIdentity combinations on REST, MCP and topology. All scalers reconcile Ready; the Secret/env fixture endpoint enforces its dummy bearer token. Restricted-user checks verify direct cluster authentication denial and omission from relationship projections and Applications. Test objects and the complete KEDA installation are removed and absence verified.

Pod identity proof covers accepted AWS provider declarations and relationship navigation against a local fixture endpoint, not a cloud credential exchange. Declared authentication dependencies do not establish credential validity or trigger readiness.

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Show observed KEDA authentication resources as scaler dependencies

✨ Enhancement 🧪 Tests 📝 Documentation 🕐 20-40 Minutes

AI Description

• Link ScaledObjects and ScaledJobs to referenced, observed authentication resources without
 changing workload targets.
• Preserve namespace and cluster-read boundaries while avoiding invented nodes and per-object
 requests.
• Test forward and reverse relationships, deduplication, and permission stripping; document topology
 behavior.

Diagram

graph TD
  Scalers["KEDA Scalers"] --> Extractor["Reference Extractor"] --> Join["Observed Join"] --> Topology["Topology Graph"] --> Consumers["Related Resources"]
  Cache[("Dynamic Cache")] --> Join

Loading

High-Level Assessment

Reusing the observed-dependency join is the best fit: it preserves existing node identities and authorization handling while avoiding per-object Gets. Fetching each declaration directly or displaying every authentication resource would weaken those properties.

Files changed (5) +165 / -3

Enhancement (2) +56 / -0

keda.goExtract scoped KEDA authentication references +42/-0

Extract scoped KEDA authentication references

• Adds a pure extractor for ScaledObject and ScaledJob triggers. It defaults omitted kinds to same-namespace TriggerAuthentication, treats ClusterTriggerAuthentication as cluster-scoped, and deduplicates valid references.

pkg/configrefs/keda.go

builder.goJoin scaler authentication declarations to observed resources +14/-0

Join scaler authentication declarations to observed resources

• Collects authentication references while building ScaledObject and ScaledJob nodes, then passes them to the shared observed-dependency join. The resulting authentication edges remain separate from ScaledObject workload-target edges.

pkg/topology/builder.go

Tests (2) +106 / -0

keda_test.goTest authentication reference extraction +43/-0

Test authentication reference extraction

• Covers both scaler kinds, default and explicit kinds, deduplication, invalid declarations, non-KEDA inputs, and nonmutation.

pkg/configrefs/keda_test.go

keda_authentication_test.goTest observed KEDA dependency graph and authorization +63/-0

Test observed KEDA dependency graph and authorization

• Checks scoped matching, missing-target omission, forward and reverse relationships, and separation from scale targets. Also verifies one list per authentication kind, zero object Gets, and removal of denied cluster-scoped targets.

pkg/topology/keda_authentication_test.go

Documentation (1) +3 / -3

integrations.mdDocument KEDA authentication topology +3/-3

Document KEDA authentication topology

• Explains that referenced authentication resources appear as dependencies, distinct from scaling targets. Clarifies default namespace scope, cluster read gating, and that a declaration does not establish credential validity or trigger readiness.

docs/integrations.md

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Authentication links get the wrong type ✓ Resolved

Description

buildResourcesTopology passes KEDA authentication references to addObservedDependencyEdges,
which assigns them EdgeUses rather than a configuration edge. When a trigger references an
authentication resource, the graph gives that configuration dependency the same edge type as a
scaler-to-workload link, so consumers filtering topology by edge type cannot distinguish them.

Code

pkg/topology/builder.go[3793]

+	nodes, edges, kedaAuthenticationWarnings := addObservedDependencyEdges(nodes, edges, kedaAuthenticationDependencies, dynamicCache, opts)

Evidence

Rule 3036572 reserves EdgeUses for autoscalers pointing to target workloads and EdgeConfigures
for configuration relationships. The added builder call sends authentication references through a
helper that always emits EdgeUses; relationship code separately identifies KEDA authentication as
a configuration dependency.

Rule 3036572: Use semantically correct topology edge types for Kubernetes relationships
pkg/topology/builder.go[3793-3793]
pkg/topology/observed_dependencies.go[87-98]
pkg/topology/relationships.go[794-810]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
KEDA authentication references enter a shared dependency helper that emits `EdgeUses`, although these references are configuration dependencies rather than autoscaler targets.
## Fix Focus Areas
- pkg/topology/builder.go[3793-3793]
- pkg/topology/observed_dependencies.go[87-98]
- pkg/topology/relationships.go[370-470]
## Recommended Fix
Emit `EdgeConfigures` for authentication references with the configuration resource as the source. Update relationship projection and tests so both dependency directions remain navigable.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Tip of the day

💡 Did you know, you can turn these tips off under Display > Comment parts

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗