For the HTTP Add-on to intercept and scale your HTTP traffic, external requests must be routed to the interceptor proxy service (keda-add-ons-http-interceptor-proxy) instead of directly to your application. The interceptor then forwards requests to your application based on the InterceptorRoute configuration.

The HTTP Add-on is ingress-agnostic — it works with any ingress controller or Gateway API implementation.

Using Gateway API

Gateway API is the recommended approach for new Kubernetes clusters.

Step 1: Create an HTTPRoute

Create an HTTPRoute that sends traffic to the interceptor proxy service:

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: <your-app>
  namespace: <your-namespace>
spec:
  parentRefs:
    - name: <your-gateway>
      namespace: <gateway-namespace>
  hostnames:
    - <your-hostname>
  rules:
    - backendRefs:
        - name: keda-add-ons-http-interceptor-proxy
          namespace: keda
          port: 8080

The hostnames in the HTTPRoute should match the hosts in your InterceptorRoute so the interceptor can route the request correctly.

Step 2: Create a ReferenceGrant

Cross-namespace backend references require a ReferenceGrant in the keda namespace. This grants the HTTPRoute’s namespace permission to reference the interceptor service:

apiVersion: gateway.networking.k8s.io/v1beta1
kind: ReferenceGrant
metadata:
  name: allow-httproute-to-interceptor
  namespace: keda
spec:
  from:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      namespace: <your-namespace>
  to:
    - group: ""
      kind: Service
      name: keda-add-ons-http-interceptor-proxy

If your HTTPRoute is in the same namespace as the interceptor (e.g., keda), you do not need a ReferenceGrant.

Using Kubernetes Ingress

Create an Ingress resource that routes traffic to the interceptor proxy service:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: <your-app>
  namespace: keda
spec:
  rules:
    - host: <your-hostname>
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: keda-add-ons-http-interceptor-proxy
                port:
                  number: 8080

The Ingress resource should be in the same namespace as the interceptor service (default: keda). If your Ingress must live in a different namespace, create an ExternalName Service to reference the interceptor across namespaces.

Using Istio

Add the interceptor proxy service as a destination in your Istio VirtualService:

apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
  name: <your-app>
  namespace: <your-namespace>
spec:
  hosts:
    - <your-hostname>
  gateways:
    - <your-gateway>
  http:
    - route:
        - destination:
            host: keda-add-ons-http-interceptor-proxy.keda.svc.cluster.local
            port:
              number: 8080

The host field uses the fully qualified service name because the VirtualService and the interceptor are in different namespaces.

Note: Creating the ReferenceGrant shown in the Gateway API section is not required for Istio — Istio’s VirtualService uses DNS-based service discovery, not Kubernetes cross-namespace backend references.

Verifying Traffic Flow

1. Confirm the interceptor proxy service exists:

   kubectl get svc keda-add-ons-http-interceptor-proxy -n keda
   

2. Find your ingress endpoint. For Gateway API, check the Gateway’s address:

   kubectl get gateway <your-gateway> -n <gateway-namespace> -o jsonpath='{.status.addresses[0].value}'
   

   For Ingress, check the Ingress address:

   kubectl get ingress <your-app> -n keda -o jsonpath='{.status.loadBalancer.ingress[0].ip}'
   

3. Send a test request:

   curl http://<ingress-address>/
   

4. Verify the request reached your application by checking your application logs or response.

What’s Next

• Architecture — Understand how the interceptor fits into the request flow.
• Autoscale an App — Create the ScaledObject and InterceptorRoute resources.