feat: Add TLS support with client certificates to Artemis scaler by thc1006 · Pull Request #7106 · kedacore/keda

thc1006 · 2025-09-28T17:04:07Z

Description

This PR implements comprehensive TLS/HTTPS support for the ActiveMQ Artemis scaler, addressing issue #6448.

Changes

Core Implementation

Add unsafeSsl field to allow connections to HTTPS endpoints with self-signed certificates
Add ca, cert, key, keyPassword fields for mutual TLS authentication
Implement certificate validation ensuring cert and key are provided together
Integrate with kedautil.NewTLSConfigWithPassword for TLS configuration

Test Coverage

Add 9 comprehensive test cases covering:
- Basic unsafeSsl functionality (default, true, false)
- Client certificate authentication
- Password-protected private keys
- CA certificate validation
- Error handling for mismatched cert/key pairs

Documentation

Update CHANGELOG.md with the improvement entry

Implementation Details

The implementation follows the established pattern from RabbitMQ, Temporal, and IBM MQ scalers, ensuring consistency across the KEDA codebase.

TLS Parameters:

unsafeSsl (triggerMetadata) - Skip TLS certificate verification
ca (authParams) - CA certificate for server verification
cert (authParams) - Client certificate for mTLS
key (authParams) - Client private key for mTLS
keyPassword (authParams) - Password for encrypted private key

Use Cases:

Development with self-signed certificates (unsafeSsl: true)
Production with valid certificates (unsafeSsl: false)
Production with mutual TLS (cert + key)
Custom CA verification (ca only)

Testing

All tests pass successfully:

TestArtemisUnsafeSslDefaultValue
TestArtemisUnsafeSslTrue
TestArtemisUnsafeSslFalse
TestArtemisTLSWithCertAndKey
TestArtemisTLSWithKeyPassword
TestArtemisTLSMissingCert
TestArtemisTLSMissingKey
TestArtemisTLSCaOnly

Checklist

Commits are signed with Developer Certificate of Origin (DCO)
Tests included for new functionality
Documentation updated (CHANGELOG.md)
Follows existing code patterns (RabbitMQ/Temporal/IBM MQ scalers)
Backward compatible (all fields optional with defaults)

Fixes #6448

Implements TLS/HTTPS support for ActiveMQ Artemis scaler to enable secure connections following the pattern from ActiveMQ scaler. Changes: - Added UnsafeSsl metadata field (default: false) to artemisMetadata - Updated HTTP client creation to use kedautil.CreateHTTPClient with TLS - Added 4 test cases for HTTPS endpoints in testArtemisMetadata - Added 3 dedicated unit tests for TLS configuration validation - Supports both HTTP (backward compatible) and HTTPS endpoints - Secure by default with optional self-signed certificate support Related to: kedacore#6448 Test Coverage: - HTTP endpoints (backward compatibility) - HTTPS with valid certificates (unsafeSsl=false) - HTTPS with self-signed certificates (unsafeSsl=true) - Custom HTTPS restApiTemplate support - Default UnsafeSsl value validation Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com>

This commit implements comprehensive TLS/HTTPS support for the ActiveMQ Artemis scaler, addressing GitHub issue kedacore#6448. Changes: - Add unsafeSsl field to allow self-signed certificates - Add ca, cert, key, keyPassword fields for mutual TLS authentication - Implement certificate validation (cert and key must be provided together) - Integrate with kedautil.NewTLSConfigWithPassword for TLS configuration - Add 9 comprehensive test cases covering all TLS scenarios: * Basic unsafeSsl functionality (default, true, false) * Client certificate authentication * Password-protected private keys * CA certificate validation * Error handling for mismatched cert/key pairs The implementation follows the established pattern from RabbitMQ, Temporal, and IBM MQ scalers, ensuring consistency across the KEDA codebase. Fixes kedacore#6448 Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com>

github-actions · 2025-09-28T17:04:16Z

Thank you for your contribution! 🙏

Please understand that we will do our best to review your PR and give you feedback as soon as possible, but please bear with us if it takes a little longer as expected.

While you are waiting, make sure to:

Add an entry in our changelog in alphabetical order and link related issue
Update the documentation, if needed
Add unit & e2e tests for your changes
GitHub checks are passing
Is the DCO check failing? Here is how you can fix DCO issues

Once the initial tests are successful, a KEDA member will ensure that the e2e tests are run. Once the e2e tests have been successfully completed, the PR may be merged at a later date. Please be patient.

Learn more about our contribution guide.

Update generated schema files to include new TLS configuration fields (unsafeSsl, ca, cert, key, keyPassword) for the Artemis scaler. Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com>

zroubalik · 2025-09-30T14:20:33Z

/run-e2e artemis
Update: You can check the progress here

Copilot

Pull Request Overview

This PR adds comprehensive TLS/HTTPS support to the ActiveMQ Artemis scaler to enable secure connections with client certificates and custom CA validation. The implementation follows established patterns from other KEDA scalers (RabbitMQ, Temporal, IBM MQ) for consistency.

Adds TLS configuration fields (unsafeSsl, ca, cert, key, keyPassword) to support various TLS scenarios
Integrates with existing KEDA TLS utilities for secure HTTP client configuration
Implements validation to ensure cert and key are provided together for mutual TLS

Reviewed Changes

Copilot reviewed 3 out of 5 changed files in this pull request and generated no comments.

File	Description
pkg/scalers/artemis_scaler.go	Adds TLS metadata fields, certificate validation logic, and TLS-enabled HTTP client configuration
pkg/scalers/artemis_scaler_test.go	Comprehensive test coverage for all TLS scenarios including validation, error cases, and configuration parsing
CHANGELOG.md	Documents the new TLS feature addition

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot

Pull Request Overview

Copilot reviewed 3 out of 5 changed files in this pull request and generated no new comments.

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

thc1006 · 2025-10-02T10:37:41Z

@zroubalik @wozniakjan Review request

JorTurFer · 2025-10-07T06:20:39Z

/run-e2e artemis
Update: You can check the progress here

JorTurFer · 2025-10-07T06:21:09Z

Could you open a PR in docs repo documenting new values?

Signed-off-by: Jan Wozniak <wozniak.jan@gmail.com>

wozniakjan · 2025-10-07T07:01:04Z

/run-e2e artemis
Update: You can check the progress here

- Add metadataVariableReadable, envVariableReadable, and triggerAuthenticationVariableReadable to validation whitelist - Add parameters field to validation whitelist - Add deprecated field support (in addition to deprecatedAnnounce) Fixes s390x CI validation failure caused by schema format changes in main branch. Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com>

thc1006 · 2025-10-07T07:43:14Z

Hi @JorTurFer,

I've identified and fixed the CI issue:

Problem

The s390x validation job was failing due to new schema fields (, , , ) not being in the validation whitelist in hack/verify-schema.sh.

Solution

Updated the schema validation script to include these new fields. The schema is now properly validated.

Documentation PR

I'm preparing a documentation PR for the keda-docs repository to document the new TLS parameters. I'll link it here once it's ready.

Latest commit: a2cf50c fix: Update schema validation script for new schema fields

wozniakjan · 2025-10-07T09:39:39Z

/run-e2e artemis
Update: You can check the progress here

JorTurFer · 2025-10-07T10:29:43Z

Hi @JorTurFer,

I've identified and fixed the CI issue:

Problem

The s390x validation job was failing due to new schema fields (, , , ) not being in the validation whitelist in hack/verify-schema.sh.

Solution

Updated the schema validation script to include these new fields. The schema is now properly validated.

Documentation PR

I'm preparing a documentation PR for the keda-docs repository to document the new TLS parameters. I'll link it here once it's ready.

Latest commit: a2cf50c fix: Update schema validation script for new schema fields

Sorry, I meant opening a PR changing this file -> https://github.com/kedacore/keda-docs/blob/main/content/docs/2.18/scalers/artemis.md

It's the public documentation published in keda.sh

zroubalik · 2025-10-07T12:54:39Z

@thc1006 FYI, we plan to ship a new release tomorrow. In case you would like to include this feature in this release, we would need the docs PR ready.

- Document unsafeSsl parameter for HTTPS connections - Add TLS authentication parameters (ca, cert, key, keyPassword) - Include example configurations for TLS scenarios: * HTTPS with self-signed certificates * Mutual TLS with client certificates Related to kedacore/keda#7106 Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com>

thc1006 · 2025-10-07T16:28:13Z

Hi @JorTurFer @zroubalik,

Documentation PR is now ready!

Docs PR: kedacore/keda-docs#1637

What's Included

The documentation covers all new TLS parameters:

unsafeSsl - Skip certificate validation for HTTPS endpoints
ca - CA certificate for server verification
cert - Client certificate for mutual TLS
key - Client private key for mutual TLS
keyPassword - Password for encrypted private keys

Examples Provided

✅ Basic HTTP connection (backward compatible)
✅ HTTPS with self-signed certificates
✅ Mutual TLS (mTLS) with client certificates

Ready for tomorrow's release!

JorTurFer · 2025-10-07T16:52:39Z

awesome! Thanks a lot! 🙇

JorTurFer · 2025-10-07T16:53:27Z

/run-e2e artemis
Update: You can check the progress here

- Document unsafeSsl parameter for HTTPS connections - Add TLS authentication parameters (ca, cert, key, keyPassword) - Include example configurations for TLS scenarios: * HTTPS with self-signed certificates * Mutual TLS with client certificates Related to kedacore/keda#7106 Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com>

…acore#7106) Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com> Signed-off-by: Jan Wozniak <wozniak.jan@gmail.com> Co-authored-by: Jan Wozniak <wozniak.jan@gmail.com> Signed-off-by: Dmitriy Altuhov <altuhovd@gmail.com>

…acore#7106) Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com> Signed-off-by: Jan Wozniak <wozniak.jan@gmail.com> Co-authored-by: Jan Wozniak <wozniak.jan@gmail.com>

thc1006 added 2 commits September 29, 2025 00:45

thc1006 requested a review from a team as a code owner September 28, 2025 17:04

keda-automation requested a review from a team September 28, 2025 17:04

chore: Regenerate scalers schema for Artemis TLS fields

fa50173

Update generated schema files to include new TLS configuration fields (unsafeSsl, ca, cert, key, keyPassword) for the Artemis scaler. Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com>

zroubalik mentioned this pull request Sep 30, 2025

Release: 2.18.0 #6853

Closed

22 tasks

wozniakjan requested a review from Copilot September 30, 2025 14:24

Copilot AI reviewed Sep 30, 2025

View reviewed changes

thc1006 requested a review from Copilot October 1, 2025 01:30

Copilot AI reviewed Oct 1, 2025

View reviewed changes

JorTurFer approved these changes Oct 7, 2025

View reviewed changes

Merge branch 'main' into main

1f01ca7

Signed-off-by: Jan Wozniak <wozniak.jan@gmail.com>

keda-automation requested a review from a team October 7, 2025 07:00

wozniakjan approved these changes Oct 7, 2025

View reviewed changes

keda-automation requested a review from a team October 7, 2025 07:41

thc1006 force-pushed the main branch from c60a7bd to a2cf50c Compare October 7, 2025 07:43

zroubalik approved these changes Oct 7, 2025

View reviewed changes

Merge branch 'main' into main

7a3d6dc

keda-automation requested a review from a team October 7, 2025 10:15

thc1006 mentioned this pull request Oct 7, 2025

docs: Add TLS support documentation for Artemis scaler kedacore/keda-docs#1637

Merged

zroubalik merged commit 727925a into kedacore:main Oct 7, 2025
24 checks passed

Conversation

thc1006 commented Sep 28, 2025

Description

Changes

Core Implementation

Test Coverage

Documentation

Implementation Details

Testing

Checklist

Uh oh!

github-actions bot commented Sep 28, 2025

Uh oh!

zroubalik commented Sep 30, 2025 • edited by github-actions bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

thc1006 commented Oct 2, 2025

Uh oh!

JorTurFer commented Oct 7, 2025 • edited by github-actions bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

JorTurFer commented Oct 7, 2025

Uh oh!

wozniakjan commented Oct 7, 2025 • edited by github-actions bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

thc1006 commented Oct 7, 2025

Problem

Solution

Documentation PR

Uh oh!

wozniakjan commented Oct 7, 2025 • edited by github-actions bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

JorTurFer commented Oct 7, 2025

Problem

Solution

Documentation PR

Uh oh!

zroubalik commented Oct 7, 2025

Uh oh!

thc1006 commented Oct 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What's Included

Examples Provided

Uh oh!

JorTurFer commented Oct 7, 2025

Uh oh!

JorTurFer commented Oct 7, 2025 • edited by github-actions bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

zroubalik commented Sep 30, 2025 •

edited by github-actions bot

Loading

JorTurFer commented Oct 7, 2025 •

edited by github-actions bot

Loading

wozniakjan commented Oct 7, 2025 •

edited by github-actions bot

Loading

wozniakjan commented Oct 7, 2025 •

edited by github-actions bot

Loading

thc1006 commented Oct 7, 2025 •

edited

Loading

JorTurFer commented Oct 7, 2025 •

edited by github-actions bot

Loading