WIP: add keda autoscaler section on runner installation #1073
No reviewers
Labels
No labels
404
backport/v1.19
backport/v1.20
backport/v1.21
backport/v10.0
backport/v11.0
backport/v12.0
backport/v13.0
backport/v14.0
backport/v15.0
backport/v7.0
backport/v8.0
backport/v9.0
good first issue
meta
new docs
User research - Accessibility
User research - Blocked
User research - Community
User research - Config (instance)
User research - Errors
User research - Filters
User research - Future backlog
User research - Git workflow
User research - Labels
User research - Moderation
User research - Needs input
User research - Notifications/Dashboard
User research - Rendering
User research - Repo creation
User research - Repo units
User research - Security
User research - Settings (in-app)
No milestone
No project
No assignees
3 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
forgejo/docs!1073
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "cobak78/docs:keda-autoscaler"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Before diving into details, there is one important aspect to address. Keda being Open Core and Forgejo being committed to providing software and documentation with no strings attached, it is necessary to clarify where to look for 100% Free Software Keda and if it is not crippled (because some companies do that, so it needs to be stated clearly).
To clarify my meaning, one of the worst example of software crippling is when security updates are provided with a delay to the general public, only after paying customers get the security fix.
Does that sound reasonable?
575fece9cb7226f1edc7Hello
I'm Jorge, one of KEDA's maintainers. KEDA belongs to CNCF with the graduated status and it's mainly maintained by serval companies, including Microsoft, RedHat, SCRM Lidl International Hub (Schwarz Grouppe) or Kedify.. You can get more info about CNCF's Intellectual Property Rights Policy here, but basically all the code contributions are done under "Apache 2.0" license and docs contributions are licensed with "Creative Commons Attribution 4.0 International"
About our governance, you can see all the related things in our governance repo
About the question of offering security fixes only to paid users, we ship all the releases according our roadmap to all the users, usually we ship a release every 3 months, but we are currently discussing to change the release process because of the maturity of the project.
Keeping these points aside, there are enterprise providers which could offer (or not) better release cadence or improved security under a paywall. KEDA is open source community driven and it means that not all the vulnerabilities can be fixed and the hotfix shipped the day after the disclosure, but definitively we don't block any fix or security improvement that contributors do (and all the merged commits are built and published as
maindocker tag, so users can early adopt the fixes although a proper hotfix release hasn't been cut yet)In any case, let me know if you have any doubt or concern and I'll try to solve it
My concern was specifically that there is a conflict of interest when Kedify who employs 50% of the maintainers sells a proprietary product based on Keda which is advertised as follows:
In other words, the maintainers and the company are in a position where they need to choose between Keda and Kedify. If Keda gets updates, patches and critical fixes as fast as Kedify, the Enterprise-grade support is no longer a value proposition of the proprietary product over the Free Software product.
The Kedify maintainers may do their best so security patches are always simulatenously released on Keda and Kedify, so the Free Software community is not left behind with vulnerabilities, because it matters to them, personally. Or maybe they see such a difference as justified for some reason, I can't tell. And I can't say which way it will go because, and this is the problem, they have a conflict of interest.
Yeah, that's true and it's a legit concern, but it doesn't mean that there aren't other maintainers with different affiliations, and other contributors contributing (CNCF Metrics)
That's true, but you're placing at the same label a startup with RedHat, Snowflake, Microsoft or Schwarz Group, any company/person that want to contribute, can contribute with security fixes or features. Keeping aside the point that Kedify doesn't own the project, the project belong to CNCF, which is backed by Linux Fundation, AWS, Google, Microsoft, Apple, etc... We as maintainers can't take those kind of decisions as the CNCF can takedown maintainers.
The open source commitment has been clear for more than 5 years, but it's true, something can change in the future because of any reason. It happens also with all the deps of a project, any dependency can change the license from one day to the next one.
Answering to the question about delaying the security fixes, the answer is: a user can expect a any merged change ready to use on their sides just in a couple of minutes via
main(docker)tag and a "feature" release every 3 months with a hotfix release in the middle, like we have been doing with the possibility of changing a bit based on this discussion.In that discussion, we are aiming to cut a feature release probably every 4-6 months and hotfixes every month but it's not official yet and it's under discussion.We built all the commits for AMD and ARM (the current supported architectures), the only difference is that you won't see it as v2.10.x tag as it requires a release process, updating helm charts and docs, but the fix is automatically published as soon as it merged.
There are automated tools opening PRs to bump deps when there is a CVE detected as well as a detection tools to monitor new CVEs introduced with PRs.
I very much appreciate the time you took to explain the situation. And also for being understanding of my concerns 🙏 I consider them resolved as far as Forgejo is concerned. 👍
One last question out of curiosity: do you know what Kedify
Enterprise-grade support, ensuring secure KEDA builds with timely updates, patches, and critical fixes.entails exactly? I know you're not an employee of Kedify and I'm interested in your outsider perspective.@ -280,1 +280,4 @@## Autoescaling runners with KEDAAnother type of configuration for the runners is to create a ScaledJob on KEDA that polls the job endpoints on your Forgejo instance. When it detects a job to be executed, it spawns a runner with the --one-job flag.A link to keda.sh would be useful for people who were never exposed to KEDA.
@cobak78 the examples / snippets look good but it always is challenging to go from there to something that one can actually play with and experiment from. I'm not sure how to do that in a semi-simple way though. If you have ideas I'll take them. The CI can run k3s clusters started from scratch so the context for checking an example actually works is there but... designing one is another matter. The forgejo-helm end to end tests are a source of inspiration but they lack the simplicity that is expected from an example.
@ -281,0 +284,4 @@### Registering runners and binding config with autoscalersTo match job endpoints with job execution, we need to pre-register a runner, save the generated JSON file as a ConfigMap, and share it with the autoscaler. On register select the desired scope (user, repository or global) and create the corresponding JSON file.A link to the section about registering a runner would be good here.
@ -281,0 +324,4 @@### Create a token on forgejoThe autoscaler will continuously fetch new waiting jobs from Forgejo, so it requires a properly configured token with the appropriate permissions. Navigate to **Forgejo > User settings > Applications > Access Tokens** and generate a new token. This token will be used by the autoscalerPlease add which permissions are required.
@ -281,0 +328,4 @@### Configuring KEDA AutoscalerCreate a new custom resource with the required parameters and custom fields based on the scope chosen during runner registration. For example, set `global="true"` for global runners or specify `repo=xxx` and `owner=xxx` for repository level runners.The word
scopeis usually associated with the token scope. Maybe the following clarifies that it is about something different:Is it not possible to specify
owner=xxxfor user or organization runners?@ -281,0 +359,4 @@containers:- name: runnerimage: forgejo:5001/runner:latestcommand: ["sh", "-c", "stackit-git-runner job"]Is this intended?
@ -281,0 +352,4 @@volumes:- name: runner-datapersistentVolumeClaim:claimName: runner-pvc-claimIs this necessary in the context of this example?
The message displayed there is chosen by the provider, but I guess that they mean that they will update anything that is required out-of-the-box without 0 effort from users side (AFAIK, they use an agent to manage KEDA inside customers clusters).
Using OSS project, users need to update their version by themselves, checking if they work for them or not. Mostly this is just a change in the chart version used but we can fail (we try to improve our test suite but shit happens xD) and it can impact.
About critical fixes, I guess that it means that they solve any bug that happens instantly and ship a patch version and KEDA follows its release process with a feature release + 1 hotfix release between feature releases 🤷
I know them but I haven't asked about their business model around KEDA tbh, I know that they are building a business model around HTTP autoscaling, which is an add-on on top of KEDA to extend KEDA with HTTP Scaling capabilities but that's a split project from the core and it's something in beta atm
@earl-warren wrote in #1073 (comment):
I'm working on an end-to-end (e2e) test for the KEDA pull request, where a Forgejo instance with a populated database is set up. This setup will trigger the KEDA autoscaler to detect a job to run and spawn a ScaledJob. I will try to replicate this on Forgejo CI and document it here.
Great news 🎉
Note that the CI at https://codeberg.org/forgejo/forgejo/ or https://code.forgejo.org/forgejo/end-to-end/ do not have the required capabilities to run a k8s cluster. A dedicated repository can be created (e.g. https://code.forgejo.org/keda/end-to-end/?) and a runner with the required capabilities assigned to it.
Would that help?
7226f1edc7816696c8fa@cobak78 the v11 branch will be cut in a few days (26 March), do you have time to complete this in time?
@cobak78 ping?
@cobak78 could you please rebase and fix this PR so it can be merged before v11 is published?
@cobak78 ping?
add keda autoscaler section on runner installationto WIP: add keda autoscaler section on runner installationPlease re-open when you have time to complete this 🙏
forgejo-actions referenced this pull request from forgejo/website2025-11-27 18:11:38 +01:00
Pull request closed