This changelog keeps track of work items that have been completed and are ready to be shipped in the next release.
To learn more about our roadmap, we recommend reading this document.
- Unreleased
- v2.7.1
- v2.7.0
- v2.6.1
- v2.6.0
- v2.5.0
- v2.4.0
- v2.3.0
- v2.2.0
- v2.1.0
- v2.0.0
- v1.5.0
- v1.4.1
- v1.4.0
- v1.3.0
- v1.2.0
- v1.1.0
- v1.0.0
- General: Support for Azure AD Workload Identity as a pod identity provider. (2487)
- General: Use more readable timestamps in KEDA Operator logs (#3066)
- Prometheus Scaler: Add ignoreNullValues to return error when prometheus return null in values (#3065)
- Selenium Grid Scaler: Edge active sessions not being properly counted (#2709)
- Selenium Grid Scaler: Max Sessions implementation issue (#3061)
- General: Use metricName from GetMetricsSpec in ScaledJobs instead of
queueLength
(#3032) - General: Refactor adapter startup to ensure proper log initilization. (2316)
- Azure Eventhub Scaler: KEDA operator crashes on nil memory panic if the eventhub connectionstring for Azure Eventhub Scaler contains an invalid character (#3082)
- General: Scaleobject ready condition 'False/Unknow' to 'True' requeue(#3096)
- TODO (#XXX)
- TODO (#XXX)
- General: Fix devcontainer on ARM64 Arch. (3084)
- General: Improve error message in resolving ServiceAccount for AWS EKS PodIdentity (3142)
- General: Improve e2e on PR process. (3004)
- General: Unify the used tooling on different workflows and arch. (3092)
- General: Use Github's Checks API for e2e tests on PR. (2567)
- General: Don't hardcode UIDs in securityContext (#3012)
- General: Fix CVE-2022-21221 in
github.com/valyala/fasthttp
(#2775) - General: Bump Golang to 1.17.9 (#3016)
- General: Fix autoscaling behaviour while paused. (#3009)
- General: Introduce annotation
"autoscaling.keda.sh/paused-replicas"
for ScaledObjects to pause scaling at a fixed replica count. (#944) - General: Introduce ARM-based container image for KEDA (#2263|#2262)
- General: Introduce new AWS DynamoDB Scaler (#2486)
- General: Introduce new Azure Data Explorer Scaler (#1488|#2734)
- General: Introduce new GCP Stackdriver Scaler (#2661)
- General: Introduce new GCP Storage Scaler (#2628)
- General: Provide support for authentication via Azure Key Vault (#900|#2733)
- General: Support for
ValueMetricType
inScaledObject
for all scalers except CPU/Memory (#2030)
- General: Bump dependencies versions (#2978)
- General: Properly handle
restoreToOriginalReplicaCount
ifScaleTarget
is missing (#2872) - General: Support for running KEDA secure-by-default as non-root (#2933)
- General: Synchronize HPA annotations from ScaledObject (#2659)
- General: Updated HTTPClient to be proxy-aware, if available, from environment variables. (#2577)
- General: Using manager client in KEDA Metrics Server to avoid flush request to Kubernetes Apiserver(2914)
- ActiveMQ Scaler: Add CorsHeader information to ActiveMQ Scaler (#2884)
- AWS CloudWatch: Add support to use expressions(#2998)
- Azure Application Insights Scaler: Provide support for non-public clouds (#2735)
- Azure Blob Storage Scaler: Add optional parameters for counting blobs recursively (#1789)
- Azure Event Hub Scaler: Improve logging when blob container not found (#2363)
- Azure Event Hub Scaler: Provide support for non-public clouds (#1915)
- Azure Log Analytics Scaler: Provide support for non-public clouds (#1916)
- Azure Monitor Scaler: Provide support for non-public clouds (#1917)
- Azure Queue: Don't call Azure queue GetProperties API unnecessarily (#2613)
- Datadog Scaler: Validate query to contain
{
to prevent panic on invalid query (#2625) - Datadog Scaler: Several improvements, including a new optional parameter
metricUnavailableValue
to fill data when no Datadog metric was returned (#2657) - Datadog Scaler: Rely on Datadog API to validate the query (2761)
- Graphite Scaler Use the latest non-null datapoint returned by query. (#2625)
- Kafka Scaler: Make "disable" a valid value for tls auth parameter (#2608)
- Kafka Scaler: New
scaleToZeroOnInvalidOffset
to control behavior when partitions have an invalid offset (#2033#2612) - Metric API Scaler: Improve error handling on not-ok response (#2317)
- New Relic Scaler: Support to get account value from authentication resources. (#2883)
- Prometheus Scaler: Check and properly inform user that
threshold
is not set (#2793) - Prometheus Scaler: Support for
X-Scope-OrgID
header (#2667) - RabbitMQ Scaler: Include
vhost
for RabbitMQ when retrieving queue info withuseRegex
(#2498) - Selenium Grid Scaler: Consider
maxSession
grid info when scaling. (#2618)
- CPU, Memory, Datadog Scalers:
metadata.type
is deprecated in favor of the globalmetricType
(#2030)
None.
- General: Clean go.mod to fix golangci-lint (#2783)
- General: Consistent file naming in
pkg/scalers/
(#2806) - General: Fix mismatched errors for updating HPA (#2719)
- General: Improve e2e tests reliability (#2580)
- General: Improve e2e tests to always cleanup resources in cluster (#2584)
- General: Internally represent value and threshold as int64 (#2790)
- General: Refactor active directory endpoint parsing for Azure scalers. (#2853)
- AWS CloudWatch: Adding e2e test (#1525)
- AWS DynamoDB: Setup AWS DynamoDB test account (#2803)
- AWS Kinesis Stream: Adding e2e test (#1526)
- AWS SQS Queue: Adding e2e test (#1527)
- Azure Data Explorer: Adding e2e test (#2841)
- Azure Data Explorer: Replace deprecated function
iter.Next()
in favour ofiter.NextRowOrError()
(#2989) - Azure Service Bus: Adding e2e test (#2731|#2732)
- External Scaler: Adding e2e test. (#2697)
- External Scaler: Fix issue with internal KEDA core prefix being passed to external scaler. (#2640)
- GCP Pubsub Scaler: Adding e2e test (#1528)
- Hashicorp Vault Secret Provider: Adding e2e test (#2842)
- Memory Scaler: Adding e2e test (#2220)
- Selenium Grid Scaler: Adding e2e test (#2791)
- General: Fix generation of metric names if any of ScaledObject's triggers is unavailable (#2592)
- General: Fix logging in KEDA operator and properly set
ScaledObject.Status
in case there is a problem in a ScaledObject's trigger (#2603)
- General: Fix failing tests based on the scale to zero bug (#2603)
- Add ActiveMQ Scaler (#2305)
- Add Azure Application Insights Scaler (2506)
- Add New Datadog Scaler (#2354)
- Add New Relic Scaler (#2387)
- Add PredictKube Scaler (#2418)
- General: Delete the cache entry when a ScaledObject is deleted (#2564)
- General: Fail fast on
buildScalers
when not able to resolve a secret that a deployment is relying on (#2394) - General:
keda-operator
Cluster Role: addlist
andwatch
access to service accounts (#2406)|(#2410) - General: Sign KEDA images published on GitHub Container Registry (#2501)|(#2502)|(#2504)
- AWS Scalers: Support temporary AWS credentials using session tokens (#2573)
- AWS SQS Scaler: Allow using simple queue name instead of URL (#2483)
- Azure EventHub Scaler: Don't expose connection string in metricName (#2404)
- Azure Pipelines Scaler: Support
poolName
orpoolID
validation (#2370) - CPU Scaler: Adding e2e test for the cpu scaler (#2441)
- External Scaler: Fix wrong calculation of retry backoff duration (#2416)
- Graphite Scaler: Use the latest datapoint returned, not the earliest (#2365)
- Kafka Scaler: Allow flag
topic
to be optional, where lag of all topics within the consumer group will be used for scaling (#2409) - Kafka Scaler: Concurrently query brokers for consumer and producer offsets (#2405)
- Kubernetes Workload Scaler: Ignore terminated pods (#2384)
- PostgreSQL Scaler: Assign PostgreSQL
userName
to correct attribute (#2432)|(#2433) - Prometheus Scaler: Support namespaced Prometheus queries (#2575)
- No longer push to Docker Hub as of v2.5 as per our announcement in March 2021
- Learn more about the background on kedacore/governance#16
- Add Cassandra Scaler (#2211)
- Add Elasticsearch Scaler (#2311)
- Add Graphite Scaler (#1628)
- ScaledJob: introduce
MultipleScalersCalculation
(#2016) - ScaledJob: introduce
RolloutStrategy
(#2164) - Add ScalersCache to reuse scalers unless they need changing (#2187)
- Cache metric names provided by KEDA Metrics Server (#2279)
- Artemis Scaler: parse out broker config parameters in case
restAPITemplate
is given (#2104) - AWS Cloudwatch Scaler: improve metric exporting logic (#2243)
- AWS Cloudwatch Scaler: return minimum value for the metric when cloudwatch returns empty list (#2345)
- Azure Log Analytics Scaler: add support to provide the metric name(#2106)
- Azure Pipelines Scaler: improve logs (#2297)
- Cron Scaler: improve validation in case start & end input is same (#2032)
- Cron Scaler: improve the cron validation (#2038)
- GCP PubSub Scaler: introduce
SubscriptionSize
andOldestUnackedMessageAge
modes (#2266) - GCP PubSub Scaler: add GCP identity authentication when using (#2225)
- GCP PubSub Scaler: add possibility to reference a GCP PubSub subscription by full link, including project ID (#2269)
- InfluxDB Scaler: add
unsafeSsl
parameter (#2157|#2320) - Metrics API Scaler: add Bearer auth (#2028)
- MongoDB Scaler: add support to get connection data from Trigger Authorization (#2115)
- MSSQL Scaler: add support to get connection data from Trigger Authorization (#2112)
- MySQL Scaler: add support to get connection data from Trigger Authorization (#2113)
- MySQL Scaler: don't expose connection string in
metricName
(#2171) - PostgreSQL Scaler: add support to get connection data from Trigger Authorization (#2114)
- Prometheus Scaler: validating values length in Prometheus query response (#2264)
- Prometheus Scaler: omit
serverAddress
from generated metric name (#2099) - RabbitMQ Scaler: anonymize the host in case of HTTP failure (#2041)
- RabbitMQ Scaler: escape
queueName
andvhostName
before use them in query string (bug fix) (#2055) - RabbitMQ Scaler: add custom http timeout (#2086)
- RabbitMQ Scaler: add
pageSize
(using regex) (#2162|#2319) - Redis Scaler: upgrade library, add username and Sentinel support (#2181)
- SeleniumGrid Scaler: add
unsafeSsl
parameter (#2157) - Stan Scaler: provide support for configuring authentication through TriggerAuthentication (#2167)
- Allow setting
MaxConcurrentReconciles
for controllers (#2272) - Cleanup metric names inside scalers (#2260)
- Drop support to
ValueMetricType
using cpu_memory_scaler (#2218) - Improve metric name creation to be unique using scaler index inside the scaler (#2161)
- Improve error message if
IdleReplicaCount
are equal toMinReplicaCount
to be the same as the check (#2212) - TriggerAuthentication/Vault: add support for HashiCorp Vault namespace (Vault Enterprise) (#2085)
- GCP PubSub Scaler:
subscriptionSize
is deprecated in favor ofmode
andvalue
(#2266)
- TODO (#XXX)
- Ensure that
context.Context
values are properly passed down the stack (#2202|#2249) - Refactor AWS related scalers to reuse the AWS clients instead of creating a new one for every
GetMetrics
call (#2255) - Improve context handling in appropriate functionality in which we instantiate scalers (#2267)
- Migrate to Kubebuilder v3 (#2082)
- API path has been changed:
github.com/kedacore/keda/v2/api/v1alpha1
->github.com/kedacore/keda/v2/apis/keda/v1alpha1
- API path has been changed:
- Use Patch to set FallbackCondition on ScaledObject.Status (#2037)
- Bump Golang to 1.17.3 (#2329)
- Add Makefile mockgen targets (#2090|#2184)
- Add github action to run e2e command "on-demand" (#2241)
- Add execution url in the pr-e2e triggering comment and fix problem related with not starting with (#2306)
- Add Solace PubSub+ Event Broker scaler (#1945)
- Add Selenium Grid scaler (#1971)
- Add Kubernetes Workload scaler (#2010)
- Introduce fallback functionality (#1872)
- Introduce Idle Replica Mode (#1958)
- ScaledJob: Support pod conditions for pending job count calculation (#1970|#2009)
- Optimize Kafka scaler by fetching all topic offsets using a single HTTP request (#1956)
- Adding ability to specify Kafka Broker Version (#1866)
- Support custom metric name in RabbitMQ scaler (#1976)
- Support using regex to select the queues in RabbitMQ scaler (#1957)
- Extend Azure Monitor scaler to support custom metrics (#1883)
- Support non-public cloud environments in the Azure Service Bus scaler (#1907)
- Support non-public cloud environments in the Azure Storage Queue and Azure Storage Blob scalers (#1863)
- Adjusts InfluxDB scaler to support queries that return integers in addition to those that return floats (#1977)
- Allow InfluxDB
authToken
,serverURL
, andorganizationName
to be sourced from(Cluster)TriggerAuthentication
(#1904) - IBM MQ scaler password handling fix (#1939)
- Metrics APIServer: Add ratelimiting parameters to override client (#1944)
- Fix READY and ACTIVE fields of ScaledJob to show status when we run
kubectl get sj
(#1855) - Show HashiCorp Vault Address when using
kubectl get ta
orkubectl get cta
(#1862) - Don't panic when HashiCorp Vault path doesn't exist (#1864)
- Fix
keda-system-auth-delegator
ClusterRoleBinding name (#1616. Upgrading may leave a stray ClusterRoleBinding with the old namekeda:system:auth-delegator
behind.
- Use
scaled[object/job].keda.sh/
prefix for KEDA related labels (#2008)
- Add Azure Pipelines Scaler (#1706)
- Add OpenStack Metrics Scaler (#1382)
- Added basic, tls and bearer authentication support to the Prometheus scaler #1559
- Add header Origin to Apache Artemis scaler #1796
- Azure Service Bus Scaler: Namespace from
connectionString
parameter is added tometricName
due to uniqueness violation for clusters having more than one queue with the same name (#1755) - Remove app.kubernetes.io/version label from label selectors (#1696)
- Apache Kafka Scaler: Add
allowIdleConsumers
to the list of trigger parameters (#1684) - Fixed goroutine leaks in usage of timers (#1704 | #1739)
- Setting timeouts in the HTTP client used by the IBM MQ scaler (#1758)
- Fix cleanup of removed triggers (#1768)
- Eventhub Scaler: Add trigger parameter
checkpointStrategy
to support more language-specific checkpoints (#1621) - Fix Azure Blob scaler when using multiple triggers with the same
blobContainerName
and added a optionalmetricName
field (#1816)
- None.
- Adding OpenStack Swift scaler end-to-end tests (#1522)
- Pass deepCopy objects to the polling goroutines (#1812)
- Emit Kubernetes Events on KEDA events (#1523 | #1647)
- Support Quantities in Metrics API scaler (#1667)
- Add Microsoft SQL Server (MSSQL) scaler (#674 | docs)
- Add
publishRate
trigger to RabbitMQ scaler (#1653) - ScaledJob: support metadata labels in Job template (#1686)
- Add
KEDA_HTTP_DEFAULT_TIMEOUT
support in Operator (#1548) - Removed
MIN field
for ScaledJob (#1553) - Add container port for Prometheus on Operator YAML (#1562)
- Fix a memory leak in Kafka client and close push scalers (#1565)
- Add 'Metadata' header to AAD podIdentity request (#1566)
- KEDA should make sure generate correct labels for HPA (#1630)
- Fix memory leak by checking triggers uniqueness properly (#1640)
- Print correct ScaleTarget Kind in Events (#1641)
- Fixed KEDA ClusterRoles to give permissions for ClusterTriggerAuthentications (#1645)
- Make
swiftURL
parameter optional for the OpenStack Swift scaler (#1652) - Fix memory leak of
keda-metrics-apiserver
by setting a controller-runtime logger properly (#1654) - AWS SQS Scaler: Add Visible + NotVisible messages for scaling considerations (#1664)
- Fixing behavior on ScaledJob with incorrect External Scaler (#1672)
- None.
- None.
- Can use Pod Identity with Azure Event Hub scaler (#994)
- Introducing InfluxDB scaler (#1239)
- Add Redis cluster support for Redis list and Redis streams scalers (#1437)
- Global authentication credentials can be managed using
ClusterTriggerAuthentication
objects (#1452) - Introducing OpenStack Swift scaler (#1342)
- Introducing MongoDB scaler (#1467)
- Support add ScaledJob's label to its job (#1311)
- Bug fix in aws_iam_authorization to utilize correct secret from env key name (#1332)
- Add metricName field to postgres scaler and auto generate if not defined (#1381)
- Mask password in postgres scaler auto generated metricName (#1381)
- Bug fix for pending jobs in ScaledJob's accurateScalingStrategy (#1323)
- Fix memory leak because of unclosed scalers (#1413)
- Override the vhost on a RabbitMQ scaler via
vhostName
in the metadata (#1451) - Optimize Kafka scaler's
getLagForPartition
function (#1464) - Reduce unnecessary /scale requests from ScaledObject controller (#1453)
- Add support for the
WATCH_NAMESPACE
environment variable to the operator (#1474) - Automatically determine the RabbitMQ protocol when possible, and support setting the protocl via TriggerAuthentication (#1459, #1483)
- Improve performance when fetching pod information (#1457)
- Improve performance when fetching current scaling information on Deployments (#1458)
- Improve error reporting in prometheus scaler (#1497)
- Check that metricNames are unique in ScaledObject (#1390)
- Serve OpenAPI spec from KEDA Metrics Apiserver (#1512)
- Support metrics with multiple dimensions and configurable metricValues on AWS Cloudwatch Scaler (#1230)
- Show
MIN/MAX
replica counts when usingkubectl get scaledobject/scaledjob
(#1534) - Fix unnecessary HPA updates when Resource based Trigger is used (#1541)
None.
- Bump go module version to v2 (#1324)
- KEDA uses a dedicated HTTP client, connection pool, and (optional) TLS certificate for each configured scaler
- KEDA scales any CustomResource that implements Scale subresource (#703)
- Provide KEDA go-client (#494)
- Define KEDA readiness and liveness probes (#788)
- KEDA Support for configurable scaling behavior in HPA v2beta2 (#802)
- Add External Push scaler (#820 | docs)
- Managed Identity support for Azure Monitor scaler (#936)
- Add support for multiple triggers on ScaledObject (#476)
- Add consumer offset reset policy option to Kafka scaler (#925)
- Add option to restore to original replica count after ScaledObject's deletion (#219)
- Add Prometheus metrics for KEDA Metrics API Server (#823 | docs)
- Add support for multiple redis list types in redis list scaler (#1006) | docs)
- Introduce Azure Log Analytics scaler (#1061) | docs)
- Add Metrics API Scaler (#1026)
- Add cpu/memory Scaler (#1215)
- Add Scaling Strategy for ScaledJob (#1227)
- Add IBM MQ Scaler (#1253)
- Move from autoscaling
v2beta1
tov2beta2
for HPA (#721) - Introduce shortnames for CRDs (#774)
- Improve
kubectl get scaledobject
to show related trigger authentication (#777) - Improve
kubectl get triggerauthentication
to show information about configured parameters (#778) - Added ScaledObject Status Conditions to display status of scaling (#750)
- Added optional authentication parameters for the Redis Scaler (#962)
- Improved GCP PubSub Scaler performance by closing the client correctly (#1087)
- Added support for Trigger Authentication for GCP PubSub scaler (#1291)
- Change
apiGroup
fromkeda.k8s.io
tokeda.sh
(#552) - Introduce a separate ScaledObject and ScaledJob(#653)
- Remove
New()
andClose()
from the interface ofservice ExternalScaler
inexternalscaler.proto
. - Removed deprecated brokerList for Kafka scaler (#882)
- All scalers metadata that is resolved from the scaleTarget environment have suffix
FromEnv
added. e.g:connection
->connectionFromEnv
- Kafka: split metadata and config for SASL and TLS (#1074)
- Service Bus:
queueLength
is now calledmessageCount
(#1109) - Use
host
instead ofapiHost
inrabbitmq
scaler. Addprotocol
in trigger spec to specify which protocol should be used (#1115) - CRDs are using
apiextensions.k8s.io/v1
apiVersion (#1202)
- Change API optional structs to pointers to conform with k8s guide (#1170)
- Update Operator SDK and k8s deps (#1007,#870,#1180)
- Change Metrics Server image name from
keda-metrics-adapter
tokeda-metrics-apiserver
(#1105) - Add Argo Rollouts e2e test (#1234)
Learn more about our release in our milestone.
- Scalers
- Secret Providers
- Other
- Introduction of
nodeSelector
in raw YAML deployment specifications (Details)
- Introduction of
- Improved message count determination when using
includeUnacked
in RabbitMQ scaler (Details) - Fix for blank path without trailing slash in RabbitMQ scaler (Details)
- Improved parsing of connection strings to support
BlobEndpoint
,QueueEndpoint
,TableEndpoint
&FileEndpoint
segments (Details) - Support scaling when no storage checkpoint exists in Azure Event Hubs scaler (Details)
- GCP Pub Scaler should not panic on invalid credentials (Details)
- Make
queueLength
optional in RabbitMQ scaler (Details)
None.
None.
None
- Fix for scale-to-zero for Prometheus scaler no longer working (#770)
- Fix for passing default VHost for Rabbit MQ scaler no longer working (#770)
- Provide capability to define time encoding for operator (#766)
None.
- Print version of metric adapter in logs (#770)
- Extend RabbitMQ scaler to support count unacked messages(#700)
- Fix scalers leaking (#684)
- Provide installation YAML package as release artifact (#740)
- Improve Azure Monitor scaler to handle queries without metrics (#680)
- Authenticate to AWS with dedicated role without AssumeRole permissions (#656)
- KEDA now respects label restrictions on Horizontal Pod Autoscaler to have max 63 chars (#707)
- KEDA will automatically assign
deploymentName
label if it was not defined inScaledObject
(#709)
None.
- Adding label for metrics service selection (#745)
- Filter returned metrics from api server based on queried name (#732)
- Add redis host and port parameter to the scaler with tests (#719)
- Remove go micro version (#718)
- Update zero result return to be non-error inducing (#695)
- Return if kafka offset response is nil (#689)
- Fix typos in MySQL scaler (#683)
- Update README to mention CNCF (#682)
- Add Azure monitor scaler (#584)
- Introduce changelog (#664)
- Introduce support for AWS pod identity (#499)
- Make targetQueryValue configurable in postgreSQL scaler (#643)
- Removed the need for deploymentName label (#644)
- Adding Kubernetes recommended labels to resources (#596)
None.
- Updating license to Apache per CNCF donation (#661)
- Introduce new Postgres scaler (#553)
- Introduce new MySQL scaler (#564)
- Provide SASL_SSL Plain authentication for Kafka trigger scalar to work with Event Hubs (#585)
- TLS parameter to Redis-scaler (#540)
- Redis db index option (#577)
- Optional param for ConfigMaps and Secrets (#562)
- Remove manually adding sslmode to connection string (#558)
- ScaledObject.Status update should handle stale resource (#582)
- Improve reconcile loop (#581)
- Address naming changes for postgresql scaler (#593)
None.
- Move Metrics adapter into the separate Deployment (#506)
- Fix gopls location (#574)
- Add instructions on local development and debugging (#583)
- Add a checkenv target (#600)
- Mentioning problem with checksum mismatch error (#605)
- Introduce new Huawei Cloud CloudEye scaler (#478)
- Introduce new kinesis stream scaler (#526)
- Introduce new Azure blob scaler (#514)
- Support for SASL authentication for Kafka scaler (#486)
- Event Hub scalar expansion to work with Java and C# applications (#517)
- Escape Prometheus querystring (#521)
- Change how number of pending messages is calculated and add more error handling. (#533)
- Service bus scaler pod identity fix (#534)
- Eventhub scalar fix (#537)
- Kafka scaler fix for SASL plaintext auth (#544)
None.
- ScaledObject Status clean up (#466)
- Add default log level for operator (#468)
- Ensure get the metrics that have been aggregated (#509)
- Scale from zero when minReplicaCount is > 0 (#524)
- Total running Jobs must not exceed maxScale - Running jobs (#528)
- Check deploymentName definition in ScaledObject (#532)
- Many more scalers added
- Scaler extensibility (run scalers in a different container and communicate with KEDA via gRPC)
- TriggerAuthentication and Pod Identity for identity based auth that can be shared across deployments
- Schedule jobs on events in addition scaling out deployments
- Additional tests and automation through GitHub Actions
- RabbitMQ
host
property now must resolve from a secret (#347)
None.