Thank you for your contribution! 🙏

Please understand that we will do our best to review your PR and give you feedback as soon as possible, but please bear with us if it takes a little longer as expected.

While you are waiting, make sure to:

• Update the documentation, if needed
• Add unit & e2e tests for your changes
• GitHub checks are passing
• Is the DCO check failing? Here is how you can fix DCO issues

Once the initial tests are successful, a KEDA member will ensure that the e2e tests are run. Once the e2e tests have been successfully completed, the PR may be merged at a later date. Please be patient.

Learn more about our contribution guide.

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

sequenceDiagram
  participant ScaledObject
  participant AdmissionWebhook
  participant ResolveScaleTargetName
  participant KubernetesAPI
  participant HPAController
  ScaledObject->>AdmissionWebhook: submit target reference
  AdmissionWebhook->>ResolveScaleTargetName: resolve reference and GVK
  ResolveScaleTargetName->>KubernetesAPI: list matching target-kind objects
  KubernetesAPI-->>ResolveScaleTargetName: matching objects
  ResolveScaleTargetName-->>AdmissionWebhook: resolved workload name or error
  AdmissionWebhook-->>ScaledObject: admission result
  ScaledObject->>HPAController: reconcile admitted target
  HPAController->>ResolveScaleTargetName: resolve target name
  ResolveScaleTargetName-->>HPAController: resolved workload name

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands.}

All bot findings addressed in 24e18d5:

• XValidation CEL rule on ScaleTarget: empty name/namePrefix/labelSelector combinations are now rejected at admission instead of failing at reconcile time.
• Executor handles paused state before replica and target resolution, so no API calls happen while paused.
• Ambiguous selector match fails closed: the HPA is deleted and reconciliation returns an error instead of scaling an ambiguous target.
• Duplicate-target guard extracted into findConflictingScaledObject, shared by the webhook and the executor, so two ScaledObjects cannot own one target even when a selector matches late.
• Controllers suite gains a delayed-target regression test: target created after the ScaledObject clears the error and scales normally.
• ScaleTargetGVKR removed from the update equality check to avoid re-reconcile hot loops.
• Nodes list RBAC marker moved out of this commit into the kubernetes-nodes commit (Scalers: kubernetes-nodes trigger (replicas follow node count) #8234), which is the only consumer.

Reworked in d87d1d3, all bot findings from this round addressed:

• Deterministic duplicate-target hold: the check lives in resolver.FindConflictingScaledObject, shared by webhook, executor and reconciler. A fixed-name ref always beats a selector-based ref; two selector-based refs defer to the oldest ScaledObject (creationTimestamp, then name). Exactly one side holds, so selector pairs can no longer deadlock with both sides holding while both HPAs actuate. The dead fixed-fixed branch is removed.
• Selector-involved neighbors (Name plus NamePrefix/LabelSelector) are resolved before comparing, so a neighbor whose criteria match nothing no longer raises a false conflict.
• Resolve-once per loop: GetCurrentReplicas now returns the resolved target name, and the executor reads and scales that same object (no read-A/scale-B race).
• verifyHpas no longer trusts a cached zero-match: on errNoScaleTargetMatch it rechecks against the direct client before skipping HPA ownership validation. A confirmed zero-match still skips; direct ambiguity still rejects.
• Reconciler deletes the HPA and stops the scale loop on both zero-match and ambiguous resolution (idempotent; the error return requeues, so delayed targets still converge). On a lost duplicate-target race the loser deletes its own HPA, stops its loop and returns an error, so it resumes if the winner goes away. Ready=False with a specific reason is the degraded signal; no new condition type was added.

Round 2 in 05e232b (single commit, force-pushed):

• Complexity: the duplicate-target loser check is extracted from reconcileScaledObject into ensureSingleTargetOwner (gocyclo back under the limit).
• Admission neighbor fix: a candidate with Name plus selectors now resolves before comparing, mirroring the runtime helper (same false-conflict class as the executor one).
• verifyHpas authoritative recheck with a regression test simulating a stale informer cache (cached client sees the HPA but not the workload, direct client sees both): ownership check runs instead of skipping.
• Tie-break, resolve-once, loser-HPA handling unchanged from the previous round.

Round 3 in 966fb20:

• Admission skips neighbors with unparseable scaleTargetRef instead of rejecting the incoming object because of them.
• Manifests fixed: the nodes RBAC marker no longer leaks into this commit (it lives only in Scalers: kubernetes-nodes trigger (replicas follow node count) #8234). verify-manifests passes on this tree; the reported config-out-of-date failure was this exact leak.

Round 4 in b54fcf4:

• Vacuous test fixed: the fixed-over-selector spec now expects admission success (fixed refs win the runtime tie-break) with a rename and rationale comment. The other rejection specs assert exact error text via ValidateCreate, so an AlreadyExists retry error can no longer satisfy them.
• Admission applies the runtime duplicate precedence (fixed beats selector; oldest selector wins; zero-timestamp creates lose): updating the winning selector is no longer rejected because of its loser. Unit plus admission-level tests.
• Admission neighbor with unparseable ref is skipped instead of rejecting.

@coderabbitai review

Vet fixed in 7ff37b6: the placement-event test imports stayed on this branch while the spec itself lives in #8234. Full go vet ./... is clean on this tree.

Note on the informer-cache thread (resolved): the typed-list optimization for selector resolution lives in #8234 single commit, which is a superset of this PR. This PR is intentionally untouched so its running checks are not invalidated for a Minor perf item; the behavior here is correct, uncached reads only. Happy to cherry-pick it here too if preferred.

@coderabbitai review