Release: 2.14

[JorTurFer]

This issue template is used to track the rollout of a new KEDA version.

For the full release process, we recommend reading this document.

Required items

• TriggerAuth-podIdentity.identityId - validation removed (operator) #5142
• Keda 2.13.1 Sysdig scan Vulnerabilities CVE-2024-27304 CVE-2024-24786 CVE-2024-28110 CVE-2024-28180 #5660
• RabbitMQ HTTP Triggers ignore provided TLS Configuration #5668
• The replica count of target pods fluctuates when fallback is triggered in scaling-modifier #5666
• Introduce Azure Event Grid as a new CloudEvent destination #5606
• bump deps & k8s deps to 0.29.4 #5733
• bump Go to 1.21.9 #5734
• CVE-2024-28110 (High) detected in github.com/cloudEvents/sdk-go/v2-v2.15.0 - autoclosed #5729
• CVE-2024-27289 (High) detected in github.com/Jackc/pgx/v5-v5.5.2 - autoclosed #5728
• CVE-2024-27304 (Critical) detected in github.com/Jackc/pgx/v5-v5.5.2 - autoclosed #5727
• CVE-2024-24786 (Medium) detected in google.golang.org/protobuf-v1.32.0 - autoclosed #5722
• CVE-2023-44487 (High) detected in k8s.io/APIServer-v0.29.4 #5721
  - [ ] Flowcontrol needs to be allowed in Metrics Server with k8s 0.29.4 #5740
• fix: revert some deps to go back to go 1.21 #5741

Best-effort items

• Reworks the prometheus metrics to adhere to best practices #5687
• feat: validate fallback configuration #5629
• No need to list all secret in the namespace to find just one #5669
• Resolve GCP Pub/Sub subscription or topic name from the target's environment #5693
• Fix fallback logic in formula-based evaluation #5684
• Add AWS MSK IAM authentication to Kafka scaler #5692

Timeline

We aim to release this release in the week of April 12th

Progress

• Prepare changelog (@SpiritZhou)
• Welcome message supported versions are up-to-date (@SpiritZhou)
• Add the new version to GitHub Bug report template (@SpiritZhou)
• Best effort version bump for dependencies, example: #5400 (@SpiritZhou)
  • Update k8s go modules and pin to the 2nd most recent minor version
  • Check if new Go has been released and if KEDA can be safely built by it
  • Update linters and build pipelines if Go has been bumped, example: #5399
• Best effort changelog cleanup, sometimes the notes can be a little inconsistent, example: #5398 (@tomkerkhove)
• Create KEDA release (@tomkerkhove)
• Publish new documentation version (@SpiritZhou)
• Setup continuous container scanning with Snyk (@tomkerkhove)
• Prepare & ship Helm chart (@SpiritZhou)
• Create a new issue in KEDA OLM repository (@tomkerkhove)
• Prepare next release (@SpiritZhou)
• Provide update in Slack (@tomkerkhove)
• Tweet about new release (@tomkerkhove)

[wozniakjan]

I briefly spoke to @zroubalik about prometheus metric refactor from #5174 and he mentioned it would be nice to have for 2.14 release. I couldn't update the PR directly so I fixed a few minor issues with old metric deprecations in a duplicate PR #5687 which is now passing all the tests. Ptal if it's desirable to have it still.

[tomkerkhove]

We're delaying the release a week as all required items are not in - #5703

[tomkerkhove]

@SpiritZhou is going to help me with this release

[JorTurFer]

Release completed!