External Secrets Operator: The Reference Architecture for Hybrid Secrets Management
TL;DR Secrets (API keys, database passwords) do not belong in Git code, but their runtime …

The classic Horizontal Pod Autoscaler (HPA) of Kubernetes is like a thermostat: When the room gets too warm (CPU > 80%), the air conditioning kicks in. This works well for standard web apps but fails in modern, event-driven architectures.
What if your CPU load is low, but there are 10,000 unprocessed jobs in your Kafka queue? Or if your system needs to respond to a sudden spike of webhooks? This is where standard scaling reaches its limits. The solution for 2026 is KEDA (Kubernetes Event-driven Autoscaling).
Standard scaling is reactive. It waits until the hardware “sweats.” In data-intensive scenarios, this leads to problems:
KEDA is a lightweight operator that doesn’t replace the HPA but gives it “eyes and ears” for the outside world. KEDA observes external sources (scalers) and tells the HPA exactly how many instances are needed.
| Feature | Standard HPA | KEDA |
|---|---|---|
| Metrics | Only resources (CPU/RAM) | Over 60+ event sources (S3, Kafka, SQL, …) |
| Scale-to-Zero | No (Minimum 1 Pod) | Yes (massively saves costs) |
| Response Time | Sluggish (waits for load) | Immediate (reacts to the event) |
| Complexity | Very low | Medium (configuration of scalers needed) |
Export to Google Sheets
For medium-sized businesses, the potential of KEDA in cloud costs is enormous. Many background processes (cron jobs, import workers, PDF generators) are only needed sporadically. With KEDA, these services consume exactly zero resources as long as there is no work in the queue. Once a message arrives, KEDA “wakes up” the service. That’s serverless feeling on your own Kubernetes infrastructure.
[Image showing a scaling graph: CPU-based scaling (delayed, staircase) vs. Event-based scaling with KEDA (aligned with message peaks)]
True autoscaling should align with your business success, not the temperature of your processors. KEDA makes your infrastructure intelligent and responsive. Anyone operating modern backend architectures in 2026 cannot ignore event-driven scaling.
Is KEDA a replacement for the Cluster Autoscaler? No. KEDA scales the pods. If there is no more space on the physical nodes, the Cluster Autoscaler (or Karpenter) still needs to add new nodes. KEDA merely ensures that the demand is reported faster and more precisely.
Can KEDA also scale with Prometheus metrics? Yes, this is one of the most powerful scalers. You can use any metric you are already collecting in Prometheus (e.g., error rates or business KPIs) as a trigger for scaling your pods.
Is there a delay when waking up from zero scaling? Yes, the so-called “Cold Start.” Since the pod must first be started when the first message arrives, there is a short latency. For real-time user interfaces, scale-to-zero is often not ideal, but for asynchronous workers, it is perfect.
TL;DR Secrets (API keys, database passwords) do not belong in Git code, but their runtime …
Until now, monitoring was often a compromise: Those who wanted to know exactly what was happening …
“We can’t move that to the cloud, it’s a monolith.” We hear this sentence …