feat: New validation hook to check if scale target is already managed (…

…#4001)

* feat: New validation hook to check if scale target is already managed

Signed-off-by: Jorge Turrado <jorge_turrado@hotmail.es>

* update missing changes

Signed-off-by: Jorge Turrado <jorge_turrado@hotmail.es>

* add prometheus metrics to webhooks

Signed-off-by: Jorge Turrado <jorge_turrado@hotmail.es>

* fix test

Signed-off-by: Jorge Turrado <jorge_turrado@hotmail.es>

* fix styles

Signed-off-by: Jorge Turrado <jorge_turrado@hotmail.es>

* remove unused parameter

Signed-off-by: Jorge Turrado <jorge_turrado@hotmail.es>

* use k8s 1.26 for smoke test

Signed-off-by: Jorge Turrado <jorge_turrado@hotmail.es>

* fix style

Signed-off-by: Jorge Turrado <jorge_turrado@hotmail.es>

* add webhook logs to e2e output

Signed-off-by: Jorge Turrado <jorge_turrado@hotmail.es>

* apply feedback

Signed-off-by: Jorge Turrado <jorge_turrado@hotmail.es>

* use kedautil.GetPodNamespace() in adapter

Signed-off-by: Jorge Turrado <jorge_turrado@hotmail.es>

* use gvkr parser for webhooks

Signed-off-by: Jorge Turrado <jorge_turrado@hotmail.es>

* remove the empty secret as requirement

Signed-off-by: Jorge Turrado <jorge_turrado@hotmail.es>

* update go.sum

Signed-off-by: Jorge Turrado <jorge_turrado@hotmail.es>

* update errors

Signed-off-by: Jorge Turrado <jorge_turrado@hotmail.es>

* update pictures

Signed-off-by: Jorge Turrado <jorge_turrado@hotmail.es>

* update external name to use admission-webhooks

Signed-off-by: Jorge Turrado <jorge_turrado@hotmail.es>

* update bin output

Signed-off-by: Jorge Turrado <jorge_turrado@hotmail.es>

* add a core release

Signed-off-by: Jorge Turrado <jorge_turrado@hotmail.es>

* split rbac

Signed-off-by: Jorge Turrado <jorge_turrado@hotmail.es>

* update changelog

Signed-off-by: Jorge Turrado <jorge_turrado@hotmail.es>

* fix styles

Signed-off-by: Jorge Turrado <jorge_turrado@hotmail.es>

* fix typo

Signed-off-by: Jorge Turrado <jorge_turrado@hotmail.es>

* update parameter name

Signed-off-by: Jorge Turrado <jorge.turrado@scrm.lidl>

* update docs

Signed-off-by: Jorge Turrado <jorge.turrado@scrm.lidl>

* update rbac

Signed-off-by: Jorge Turrado <jorge.turrado@scrm.lidl>

* update contributing

Signed-off-by: Jorge Turrado <jorge.turrado@scrm.lidl>

* add cpu/memory validation

Signed-off-by: Jorge Turrado <jorge.turrado@scrm.lidl>

* solve styles

Signed-off-by: Jorge Turrado <jorge.turrado@scrm.lidl>

* fix errors

Signed-off-by: Jorge Turrado <jorge.turrado@scrm.lidl>

* update arch picture

Signed-off-by: Jorge Turrado <jorge.turrado@scrm.lidl>

* use my own fork temporally

Signed-off-by: Jorge Turrado <jorge_turrado@hotmail.es>

* move to the operator the cert generation

Signed-off-by: Jorge Turrado <jorge_turrado@hotmail.es>

* fix influx test

Signed-off-by: Jorge Turrado <jorge_turrado@hotmail.es>

* fix influx test

Signed-off-by: Jorge Turrado <jorge_turrado@hotmail.es>

* fix matching errors

Signed-off-by: Jorge Turrado <jorge_turrado@hotmail.es>

* undo incorrect change

Signed-off-by: Jorge Turrado <jorge_turrado@hotmail.es>

* remove keda-architecture ppt in favour of keda-docs schematics.pptx

Signed-off-by: Jorge Turrado <jorge.turrado@scrm.lidl>

* Update Makefile

Signed-off-by: Jorge Turrado Ferrero <Jorge_turrado@hotmail.es>

* apply feedback

Signed-off-by: Jorge Turrado <jorge.turrado@scrm.lidl>

* add a deletion note in release yaml

Signed-off-by: Jorge Turrado <jorge.turrado@scrm.lidl>

Signed-off-by: Jorge Turrado <jorge_turrado@hotmail.es>
Signed-off-by: Jorge Turrado <jorge.turrado@scrm.lidl>
Signed-off-by: Jorge Turrado Ferrero <Jorge_turrado@hotmail.es>

.devcontainer/Dockerfile

@@ -91,9 +91,12 @@ RUN apt-get update \
 # Enable go modules
 ENV GO111MODULE=on
 
-ENV OPERATOR_RELEASE_VERSION=v1.0.1
-RUN curl -LO https://github.com/operator-framework/operator-sdk/releases/download/${OPERATOR_RELEASE_VERSION}/operator-sdk-${OPERATOR_RELEASE_VERSION}-x86_64-linux-gnu \
-    && chmod +x operator-sdk-${OPERATOR_RELEASE_VERSION}-x86_64-linux-gnu \
+ENV OPERATOR_RELEASE_VERSION=v1.26.0
+RUN ARCH=$(case $(uname -m) in x86_64) echo -n amd64 ;; aarch64) echo -n arm64 ;; *) echo -n $(uname -m) ;; esac) \
+    && OS=$(uname | awk '{print tolower($0)}') \
+    && OPERATOR_SDK_DL_URL=https://github.com/operator-framework/operator-sdk/releases/download/${OPERATOR_RELEASE_VERSION} \
+    && curl -LO ${OPERATOR_SDK_DL_URL}/operator-sdk_${OS}_${ARCH} \
+    && chmod +x operator-sdk_${OS}_${ARCH} \
     && mkdir -p /usr/local/bin/ \
-    && cp operator-sdk-${OPERATOR_RELEASE_VERSION}-x86_64-linux-gnu /usr/local/bin/operator-sdk \
-    && rm operator-sdk-${OPERATOR_RELEASE_VERSION}-x86_64-linux-gnu
+    && cp operator-sdk_${OS}_${ARCH} /usr/local/bin/operator-sdk \
+    && rm operator-sdk_${OS}_${ARCH}

.github/workflows/release-build.yml

@@ -102,3 +102,15 @@ jobs:
           asset_path: keda-${{ steps.get_version.outputs.VERSION }}.yaml
           asset_name: keda-${{ steps.get_version.outputs.VERSION }}.yaml
           asset_content_type: application/x-yaml
+
+      # Upload core deployment YAML file to GitHub release (TO BE DELETED FOR v2.12)
+      - name: Upload Deployment YAML file
+        id: upload-deployment-yaml
+        uses: actions/upload-release-asset@v1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          upload_url: https://uploads.github.com/repos/kedacore/keda/releases/${{ steps.get-release-info.outputs.id }}/assets?name=keda-${{ steps.get_version.outputs.VERSION }}-core.yaml
+          asset_path: keda-${{ steps.get_version.outputs.VERSION }}-core.yaml
+          asset_name: keda-${{ steps.get_version.outputs.VERSION }}-core.yaml
+          asset_content_type: application/x-yaml

.github/workflows/template-arm64-smoke-tests.yml

@@ -10,5 +10,5 @@ jobs:
     uses: kedacore/keda/.github/workflows/template-smoke-tests.yml@main
     with:
       runs-on: ARM64
-      kubernetesVersion: v1.25
-      kindImage: kindest/node:v1.25.0@sha256:428aaa17ec82ccde0131cb2d1ca6547d13cf5fdabcc0bbecf749baa935387cbf
+      kubernetesVersion: v1.26
+      kindImage: kindest/node:v1.26.0@sha256:691e24bd2417609db7e589e1a479b902d2e209892a10ce375fab60a8407c7352

.github/workflows/template-versions-smoke-tests.yml

@@ -9,8 +9,10 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        kubernetesVersion: [v1.25, v1.24, v1.23]
+        kubernetesVersion: [v1.26, v1.25, v1.24, v1.23]
         include:
+        - kubernetesVersion: v1.26
+          kindImage: kindest/node:v1.26.0@sha256:691e24bd2417609db7e589e1a479b902d2e209892a10ce375fab60a8407c7352
         - kubernetesVersion: v1.25
           kindImage: kindest/node:v1.25.0@sha256:428aaa17ec82ccde0131cb2d1ca6547d13cf5fdabcc0bbecf749baa935387cbf
         - kubernetesVersion: v1.24

.gitignore

@@ -39,8 +39,9 @@ apiserver.local.config/
 
 cover.out
 
-# GO debug binary
+# GO debug binaries
 cmd/manager/debug.test
+__debug_bin
 
 # GO Test result
 report.xml

BUILD.md

@@ -4,17 +4,22 @@
 <!-- DON'T EDIT THIS SECTION, INSTEAD RE-RUN doctoc TO UPDATE -->
 **Table of Contents**  *generated with [DocToc](https://github.com/thlorenz/doctoc)*
 
-- [Build & Deploy KEDA](#build--deploy-keda)
-  - [Building](#building)
-    - [Quick start with Visual Studio Code Remote - Containers](#quick-start-with-visual-studio-code-remote---containers)
-    - [Locally directly](#locally-directly)
-  - [Deploying](#deploying)
-    - [Custom KEDA locally outside cluster](#custom-keda-locally-outside-cluster)
-    - [Custom KEDA as an image](#custom-keda-as-an-image)
-  - [Miscellaneous](#miscellaneous)
-    - [Setting log levels](#setting-log-levels)
-    - [KEDA Operator logging](#keda-operator-logging)
-    - [Metrics Server logging](#metrics-server-logging)
+- [Building](#building)
+  - [Quick start with Visual Studio Code Remote - Containers](#quick-start-with-visual-studio-code-remote---containers)
+  - [Locally directly](#locally-directly)
+- [Deploying](#deploying)
+  - [Custom KEDA locally outside cluster](#custom-keda-locally-outside-cluster)
+  - [Custom KEDA as an image](#custom-keda-as-an-image)
+- [Debugging with VS Code](#debugging-with-vs-code)
+  - [Operator](#operator)
+  - [Metrics server](#metrics-server)
+  - [Admission Webhooks](#admission-webhooks)
+- [Miscellaneous](#miscellaneous)
+  - [How to use devcontainers and a local Kubernetes cluster](#how-to-use-devcontainers-and-a-local-kubernetes-cluster)
+  - [Setting log levels](#setting-log-levels)
+  - [KEDA Operator and Admission webhooks logging](#keda-operator-and-admission-webhooks-logging)
+  - [Metrics Server logging](#metrics-server-logging)
+  - [CPU/Memory Profiling](#cpumemory-profiling)
 
 <!-- END doctoc generated TOC please keep comment here to allow auto update -->
 
@@ -137,7 +142,7 @@ Follow these instructions if you want to debug the KEDA operator using VS Code.
             "type": "go",
             "request": "launch",
             "mode": "debug",
-            "program": "${workspaceFolder}/main.go",
+            "program": "${workspaceFolder}/cmd/operator/main.go",
             "env": {
                 "WATCH_NAMESPACE": "",
                 "KEDA_CLUSTER_OBJECT_NAMESPACE": "keda"
@@ -173,7 +178,7 @@ Follow these instructions if you want to debug the KEDA metrics server using VS
             "type": "go",
             "request": "launch",
             "mode": "auto",
-            "program": "${workspaceFolder}/adapter/main.go",
+            "program": "${workspaceFolder}/cmd/adapter/main.go",
             "env": {
                 "WATCH_NAMESPACE": "",
                 "KEDA_CLUSTER_OBJECT_NAMESPACE": "keda"
@@ -223,6 +228,64 @@ You can query list metrics executing `curl --insecure https://localhost:6443/api
 
 If you prefer to use an authenticated user, you can use a user or service account with access over external metrics API adding their token as authorization header in `curl`, ie: `curl -H "Authorization:Bearer TOKEN" --insecure https://localhost:6443/apis/external.metrics.k8s.io/v1beta1/`
 
+### Admission Webhooks
+
+Follow these instructions if you want to debug the KEDA webhook using VS Code.
+
+1. Create a `launch.json` file inside the `.vscode/` folder in the repo with the following configuration:
+   ```json
+   {
+    "configurations": [
+         {
+            "name": "Launch webhooks",
+            "type": "go",
+            "request": "launch",
+            "mode": "auto",
+            "program": "${workspaceFolder}/cmd/webhooks/main.go",
+            "env": {
+                "WATCH_NAMESPACE": "",
+                "KEDA_CLUSTER_OBJECT_NAMESPACE": "keda"
+            },
+            "args": [
+                "--zap-log-level=debug",
+                "--zap-encoder=console",
+                "--zap-time-encoding=rfc3339"
+            ]
+         },
+    ]
+   }
+   ```
+   Refer to [this](https://code.visualstudio.com/docs/editor/debugging) for more information about debugging with VS Code.
+2. Expose your local instance to internet. If you can't expose it directly, you can use something like [localtunnel](https://theboroer.github.io/localtunnel-www/) using the command `lt --port 9443 --local-https --allow-invalid-cert` after installing the tool.
+
+3. Update the `admissing_webhooks.yaml` in `config/webhooks`, replacing the section (but not commiting this change)
+   ```yaml
+   webhooks:
+   - admissionReviewVersions:
+     - v1
+     clientConfig:
+       service:
+         name: keda-admission-webhooks
+         namespace: keda
+         path: /validate-keda-sh-v1alpha1-scaledobject
+   ```
+   with the section:
+   ```yaml
+   webhooks:
+   - admissionReviewVersions:
+     - v1
+     clientConfig:
+       url: "https://${YOUR_URL}/validate-keda-sh-v1alpha1-scaledobject"
+   ```
+   **Note:** You could need to define also the key `caBundle` with the CA bundle encoded in base64 if the cluster can get it during the manifest apply (this happens with localtunnel for instance)
+
+4. Deploy CRDs and KEDA into `keda` namespace
+   ```bash
+   make deploy
+   ```
+5. Set breakpoints in the code as required.
+6. Select `Run > Start Debugging` or press `F5` to start debugging.
+
 ## Miscellaneous
 
 ### How to use devcontainers and a local Kubernetes cluster
@@ -236,24 +299,21 @@ To solve this and be able to work with devcontainers and a local cluster, you sh
 You can change default log levels for both KEDA Operator and Metrics Server. KEDA Operator uses
  [Operator SDK logging](https://sdk.operatorframework.io/docs/building-operators/golang/references/logging/) mechanism.
 
-### KEDA Operator logging
+### KEDA Operator and Admission webhooks logging
 
-To change the logging level, find `--zap-log-level=` argument in Operator Deployment section in `config/manager/manager.yaml` file,
- modify its value and redeploy.
+To change the logging level, find `--zap-log-level=` argument in Operator Deployment section in `config/manager/manager.yaml` file or in Webhooks Deployment section in `config/webhooks/webhooks.yaml` file, modify its value and redeploy.
 
 Allowed values are `debug`, `info`, `error`, or an integer value greater than `0`, specified as string
 
 Default value: `info`
 
-To change the logging format, find `--zap-encoder=` argument in Operator Deployment section in `config/manager/manager.yaml` file,
- modify its value and redeploy.
+To change the logging format, find `--zap-encoder=` argument in Operator Deployment section in `config/manager/manager.yaml` file or in Webhooks Deployment section in `config/webhooks/webhooks.yaml` file, modify its value and redeploy.
 
 Allowed values are `json` and `console`
 
 Default value: `console`
 
-To change the logging time encoding, find `--zap-time-encoding=` argument in Operator Deployment section in `config/manager/manager.yaml` file,
- modify its value and redeploy.
+To change the logging time encoding, find `--zap-time-encoding=` argument in Operator Deployment section in `config/manager/manager.yaml` file or in Webhooks Deployment section in `config/webhooks/webhooks.yaml` file, modify its value and redeploy.
 
 Allowed values are `epoch`, `millis`, `nano`, `iso8601`, `rfc3339` or `rfc3339nano`
 

CHANGELOG.md

@@ -48,8 +48,9 @@ To learn more about active deprecations, we recommend checking [GitHub Discussio
 
 Here is an overview of all **stable** additions:
 
-- **Prometheus Metrics**: Introduce scaler latency in Prometheus metrics. ([#4037](https://github.com/kedacore/keda/issues/4037))
+- **General**: Introduce admission webhooks to automatically validate resource changes to prevent misconfiguration and enforce best practices. ([#3755](https://github.com/kedacore/keda/issues/3755))
 - **General**: Introduce new ArangoDB Scaler ([#4000](https://github.com/kedacore/keda/issues/4000))
+- **Prometheus Metrics**: Introduce scaler latency in Prometheus metrics. ([#4037](https://github.com/kedacore/keda/issues/4037))
 
 Here is an overview of all new **experimental** features:
 

CONTRIBUTING.md

@@ -13,6 +13,7 @@ There are many areas we can use contributions - ranging from code, documentation
 - [Making Breaking Changes](#making-breaking-changes)
 - [Contributing Scalers](#contributing-scalers)
   - [Testing](#testing)
+- [Contributing webhooks](#contributing-webhooks)
 - [Changelog](#changelog)
 - [Including Documentation Changes](#including-documentation-changes)
 - [Creating and building a local environment](#creating-and-building-a-local-environment)
@@ -51,6 +52,10 @@ It is mandatory to provide end-to-end (e2e) tests for new scaler. For more infor
 check the [test documentation](./tests/README.md). Those tests are run nightly on our
 [CI system](https://github.com/kedacore/keda/actions?query=workflow%3A%22nightly+e2e+test%22).
 
+## Contributing webhooks
+
+Another easy way to contribute is improving the validations to avoid misconfigurations. New rules can be added in the proper type's webhooks file (`apis/keda/v1alpha1/*_webhook.go`).
+
 ## Changelog
 
 Every change should be added to our changelog under `Unreleased` which is located in `CHANGELOG.md`. This helps us keep track of all changes in a given release.

Dockerfile

@@ -12,8 +12,7 @@ COPY Makefile Makefile
 # Copy the go source
 COPY hack/ hack/
 COPY version/ version/
-COPY main.go main.go
-COPY adapter/ adapter/
+COPY cmd/ cmd/
 COPY apis/ apis/
 COPY controllers/ controllers/
 COPY pkg/ pkg/

Dockerfile.adapter

@@ -12,8 +12,7 @@ COPY Makefile Makefile
 # Copy the go source
 COPY hack/ hack/
 COPY version/ version/
-COPY main.go main.go
-COPY adapter/ adapter/
+COPY cmd/ cmd/
 COPY apis/ apis/
 COPY controllers/ controllers/
 COPY pkg/ pkg/

Dockerfile.webhooks

@@ -0,0 +1,37 @@
+# Build the manager binary
+FROM --platform=$BUILDPLATFORM ghcr.io/kedacore/build-tools:1.18.8 AS builder
+
+ARG BUILD_VERSION=main
+ARG GIT_COMMIT=HEAD
+ARG GIT_VERSION=main
+
+WORKDIR /workspace
+
+COPY Makefile Makefile
+
+# Copy the go source
+COPY hack/ hack/
+COPY version/ version/
+COPY cmd/ cmd/
+COPY apis/ apis/
+COPY controllers/ controllers/
+COPY pkg/ pkg/
+COPY vendor/ vendor/
+COPY go.mod go.mod
+COPY go.sum go.sum
+
+# Build
+# https://www.docker.com/blog/faster-multi-platform-builds-dockerfile-cross-compilation-guide/
+ARG TARGETOS
+ARG TARGETARCH
+RUN VERSION=${BUILD_VERSION} GIT_COMMIT=${GIT_COMMIT} GIT_VERSION=${GIT_VERSION} TARGET_OS=$TARGETOS ARCH=$TARGETARCH make webhooks
+
+# Use distroless as minimal base image to package the manager binary
+# Refer to https://github.com/GoogleContainerTools/distroless for more details
+FROM gcr.io/distroless/static:nonroot
+WORKDIR /
+COPY --from=builder /workspace/bin/keda-admission-webhooks .
+# 65532 is numeric for nonroot
+USER 65532:65532
+
+ENTRYPOINT ["/keda-admission-webhooks", "--zap-log-level=info", "--zap-encoder=console"]

Makefile

@@ -20,6 +20,7 @@ IMAGE_REPO     ?= kedacore
 
 IMAGE_CONTROLLER = $(IMAGE_REGISTRY)/$(IMAGE_REPO)/keda$(SUFFIX):$(VERSION)
 IMAGE_ADAPTER    = $(IMAGE_REGISTRY)/$(IMAGE_REPO)/keda-metrics-apiserver$(SUFFIX):$(VERSION)
+IMAGE_WEBHOOKS   = $(IMAGE_REGISTRY)/$(IMAGE_REPO)/keda-admission-webhooks$(SUFFIX):$(VERSION)
 
 BUILD_TOOLS_GO_VERSION = 1.18.8
 IMAGE_BUILD_TOOLS = $(IMAGE_REGISTRY)/$(IMAGE_REPO)/build-tools:$(BUILD_TOOLS_GO_VERSION)
@@ -156,8 +157,10 @@ pkg/mock/mock_scaling/mock_executor/mock_interface.go: pkg/scaling/executor/scal
 pkg/mock/mock_scaler/mock_scaler.go: pkg/scalers/scaler.go
 	$(MOCKGEN) -destination=$@ -package=mock_scalers -source=$^
 pkg/mock/mock_scale/mock_interfaces.go: vendor/k8s.io/client-go/scale/interfaces.go
+	mkdir -p pkg/mock/mock_scale
 	$(MOCKGEN) k8s.io/client-go/scale ScalesGetter,ScaleInterface > $@
 pkg/mock/mock_client/mock_interfaces.go: vendor/sigs.k8s.io/controller-runtime/pkg/client/interfaces.go
+	mkdir -p pkg/mock/mock_client
 	$(MOCKGEN) sigs.k8s.io/controller-runtime/pkg/client Patch,Reader,Writer,StatusClient,StatusWriter,Client,WithWatch,FieldIndexer > $@
 pkg/scalers/liiklus/mocks/mock_liiklus.go:
 	$(MOCKGEN) -destination=$@ github.com/kedacore/keda/v2/pkg/scalers/liiklus LiiklusServiceClient
@@ -168,47 +171,59 @@ pkg/scalers/liiklus/mocks/mock_liiklus.go:
 
 ##@ Build
 
-build: generate fmt vet manager adapter ## Build Operator (manager) and Metrics Server (adapter) binaries.
+build: generate fmt vet manager adapter webhooks ## Build Operator (manager), Metrics Server (adapter) and Admision Web Hooks (webhooks) binaries.
 
 manager: generate
-	${GO_BUILD_VARS} go build -ldflags $(GO_LDFLAGS) -mod=vendor -o bin/keda main.go
+	${GO_BUILD_VARS} go build -ldflags $(GO_LDFLAGS) -mod=vendor -o bin/keda cmd/operator/main.go
 
 adapter: generate
-	${GO_BUILD_VARS} go build -ldflags $(GO_LDFLAGS) -mod=vendor -o bin/keda-adapter adapter/main.go
+	${GO_BUILD_VARS} go build -ldflags $(GO_LDFLAGS) -mod=vendor -o bin/keda-adapter cmd/adapter/main.go
+
+webhooks: generate
+	${GO_BUILD_VARS} go build -ldflags $(GO_LDFLAGS) -mod=vendor -o bin/keda-admission-webhooks cmd/webhooks/main.go
 
 run: manifests generate ## Run a controller from your host.
 	WATCH_NAMESPACE="" go run -ldflags $(GO_LDFLAGS) ./main.go $(ARGS)
 
 docker-build: ## Build docker images with the KEDA Operator and Metrics Server.
 	DOCKER_BUILDKIT=1 docker build . -t ${IMAGE_CONTROLLER} --build-arg BUILD_VERSION=${VERSION} --build-arg GIT_VERSION=${GIT_VERSION} --build-arg GIT_COMMIT=${GIT_COMMIT}
 	DOCKER_BUILDKIT=1 docker build -f Dockerfile.adapter -t ${IMAGE_ADAPTER} . --build-arg BUILD_VERSION=${VERSION} --build-arg GIT_VERSION=${GIT_VERSION} --build-arg GIT_COMMIT=${GIT_COMMIT}
+	DOCKER_BUILDKIT=1 docker build -f Dockerfile.webhooks -t ${IMAGE_WEBHOOKS} . --build-arg BUILD_VERSION=${VERSION} --build-arg GIT_VERSION=${GIT_VERSION} --build-arg GIT_COMMIT=${GIT_COMMIT}
 
 publish: docker-build ## Push images on to Container Registry (default: ghcr.io).
 	docker push $(IMAGE_CONTROLLER)
 	docker push $(IMAGE_ADAPTER)
+	docker push $(IMAGE_WEBHOOKS)
 
 publish-controller-multiarch: ## Build and push multi-arch Docker image for KEDA Operator.
 	docker buildx build --output=type=${OUTPUT_TYPE} --platform=${BUILD_PLATFORMS} . -t ${IMAGE_CONTROLLER} --build-arg BUILD_VERSION=${VERSION} --build-arg GIT_VERSION=${GIT_VERSION} --build-arg GIT_COMMIT=${GIT_COMMIT}
 
 publish-adapter-multiarch: ## Build and push multi-arch Docker image for KEDA Metrics Server.
 	docker buildx build --output=type=${OUTPUT_TYPE} --platform=${BUILD_PLATFORMS} -f Dockerfile.adapter -t ${IMAGE_ADAPTER} . --build-arg BUILD_VERSION=${VERSION} --build-arg GIT_VERSION=${GIT_VERSION} --build-arg GIT_COMMIT=${GIT_COMMIT}
 
-publish-multiarch: publish-controller-multiarch publish-adapter-multiarch ## Push multi-arch Docker images on to Container Registry (default: ghcr.io).
+publish-webhooks-multiarch: ## Build and push multi-arch Docker image for KEDA Hooks.
+	docker buildx build --output=type=${OUTPUT_TYPE} --platform=${BUILD_PLATFORMS} -f Dockerfile.webhooks -t ${IMAGE_WEBHOOKS} . --build-arg BUILD_VERSION=${VERSION} --build-arg GIT_VERSION=${GIT_VERSION} --build-arg GIT_COMMIT=${GIT_COMMIT}
+
+publish-multiarch: publish-controller-multiarch publish-adapter-multiarch publish-webhooks-multiarch ## Push multi-arch Docker images on to Container Registry (default: ghcr.io).
 
 release: manifests kustomize set-version ## Produce new KEDA release in keda-$(VERSION).yaml file.
 	cd config/manager && \
 	$(KUSTOMIZE) edit set image ghcr.io/kedacore/keda=${IMAGE_CONTROLLER}
 	cd config/metrics-server && \
     $(KUSTOMIZE) edit set image ghcr.io/kedacore/keda-metrics-apiserver=${IMAGE_ADAPTER}
+	cd config/webhooks && \
+    $(KUSTOMIZE) edit set image ghcr.io/kedacore/keda-admission-webhooks=${IMAGE_WEBHOOKS}
 	# Need this workaround to mitigate a problem with inserting labels into selectors,
 	# until this issue is solved: https://github.com/kubernetes-sigs/kustomize/issues/1009
 	@sed -i".out" -e 's@version:[ ].*@version: $(VERSION)@g' config/default/kustomize-config/metadataLabelTransformer.yaml
 	rm -rf config/default/kustomize-config/metadataLabelTransformer.yaml.out
 	$(KUSTOMIZE) build config/default > keda-$(VERSION).yaml
+	$(KUSTOMIZE) build config/minimal > keda-$(VERSION)-core.yaml
 
 sign-images: ## Sign KEDA images published on GitHub Container Registry
 	COSIGN_EXPERIMENTAL=1 cosign sign ${COSIGN_FLAGS} $(IMAGE_CONTROLLER)
 	COSIGN_EXPERIMENTAL=1 cosign sign ${COSIGN_FLAGS} $(IMAGE_ADAPTER)
+	COSIGN_EXPERIMENTAL=1 cosign sign ${COSIGN_FLAGS} $(IMAGE_WEBHOOKS)
 
 .PHONY: set-version
 set-version:
@@ -246,6 +261,9 @@ deploy: manifests kustomize ## Deploy controller to the K8s cluster specified in
 		$(KUSTOMIZE) edit add annotation --force cloud.google.com/workload-identity-provider:${GCP_WI_PROVIDER} cloud.google.com/service-account-email:${TF_GCP_SA_EMAIL} cloud.google.com/gcloud-run-as-user:${NON_ROOT_USER_ID}; \
 	fi
 
+	cd config/webhooks && \
+	$(KUSTOMIZE) edit set image ghcr.io/kedacore/keda-admission-webhooks=${IMAGE_WEBHOOKS}
+
 	# Need this workaround to mitigate a problem with inserting labels into selectors,
 	# until this issue is solved: https://github.com/kubernetes-sigs/kustomize/issues/1009
 	@sed -i".out" -e 's@version:[ ].*@version: $(VERSION)@g' config/default/kustomize-config/metadataLabelTransformer.yaml