
- Helm packages KEDA’s CRDs, Deployments, ServiceAccounts, Roles/ClusterRoles, and more in a single chart.
- The chart automates resource ordering (CRDs first), RBAC binding, and lifecycle hooks so KEDA components are installed and configured correctly.
- CustomResourceDefinitions (CRDs)
CRDs extend the Kubernetes API so KEDA can introduce custom objects such as ScaledObjects, ScaledJobs, TriggerAuthentication, and ClusterTriggerAuthentication. These let you declare KEDA scaling behavior alongside standard Kubernetes manifests. - APIService / Metrics API Server
The Metrics API Server exposes external metrics underexternal.metrics.k8s.io, enabling HPAs and other consumers to read KEDA-provided metrics. - Deployments
KEDA’s operator, the Metrics API Server, and the Admission Webhook are deployed as standard Kubernetes Deployments. These controllers implement the logic to observe event sources and act on scaling decisions. - ServiceAccounts
ServiceAccounts define the identity KEDA components use when interacting with the Kubernetes API. - ClusterRoles and ClusterRoleBindings
Cluster-wide permissions are declared via ClusterRoles and bound to ServiceAccounts with ClusterRoleBindings. - Roles and RoleBindings
Roles and RoleBindings grant namespace-scoped permissions and can reference ClusterRoles to restrict cluster-level capabilities to a particular namespace.

Important notes on RBAC and RoleBindings
RoleBindings can reference ClusterRoles. This is useful when you want to grant cluster-level permissions but restrict the effect to a specific namespace by creating a RoleBinding in that namespace that references a ClusterRole.
Installing KEDA’s CRDs and cluster-level resources requires cluster-wide permissions (for example,
cluster-admin or equivalent). Ensure you run Helm with an account that has the necessary RBAC privileges.- Add the KEDA Helm repository and update:
- Install the KEDA chart. Example (creates namespace if needed):
- The chart will:
- Create KEDA CRDs (ScaledObjects, ScaledJobs, TriggerAuthentication, ClusterTriggerAuthentication, etc.).
- Deploy the KEDA operator, Metrics API Server, and Admission Webhook.
- Create ServiceAccounts and bind Roles/ClusterRoles and RoleBindings/ClusterRoleBindings.
- Register an APIService to surface metrics under
external.metrics.k8s.io.
- Verify CRDs exist:
- Check KEDA deployments in the namespace (example uses
keda):
- Confirm ServiceAccounts, Roles, and RoleBindings:
- Verify the external metrics API service is present:
- Inspect the operator logs if a pod is not ready:
- Install CRDs before resources that depend on them. The official Helm chart handles this, but manual installs should respect ordering.
- Use a dedicated namespace (for example,
keda) to scope visibility and RoleBindings. - If HPAs cannot see external metrics, ensure the
APIServiceforexternal.metrics.k8s.ioisAvailableand that RBAC rules allow the Metrics API Server to list/ get the resources it needs. - For upgrades, follow Helm upgrade best practices and watch for CRD changes — some CRD updates require manual steps.