feat(http-add-on): add InterceptorRoute CRD and update RBAC permissions

[AtharvaPakade]

Provide a description of what has been changed
Adds the InterceptorRoute CRD to the http-add-on Helm chart and extends RBAC permissions for the
operator, interceptor, scaler, and aggregate cluster roles to manage the new resource.

Test checklist:

• interceptorroutes.http.keda.sh CRD is created in the cluster after chart install
• crds.install: false skips both HTTPScaledObject and InterceptorRoute CRDs
• operator, interceptor, and scaler service accounts can get/list/watch interceptorroutes
• operator can get/patch interceptorroutes/status and update interceptorroutes/finalizers
• helm template output includes interceptorroutes in all RBAC resources

Checklist

• I have verified that my change is according to the deprecations & breaking changes policy
• Commits are signed with Developer Certificate of Origin (DCO - learn more)
• README is updated with new configuration values (if applicable) learn more
• A PR is opened to update KEDA core (repo) (if applicable, ie. when deployment manifests are modified)

Fixes #835

cc @linkvt

[Copilot]

Pull request overview

Adds support for the new InterceptorRoute custom resource to the http-add-on Helm chart by shipping its CRD and extending RBAC so the operator/interceptor/scaler (and optional aggregate roles) can access it.

Changes:

• Add InterceptorRoute CRD to the chart’s CRD template (guarded by crds.install)
• Extend operator/interceptor/scaler RBAC rules to include interceptorroutes (plus /status and /finalizers for operator)
• Update chart README text for crds.install to mention both CRDs

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
http-add-on/templates/crd.yaml	Adds the InterceptorRoute CRD alongside the existing HTTPScaledObject CRD under the same install gate.
http-add-on/templates/operator/rbac.yml	Grants operator permissions for interceptorroutes, including status/finalizers management.
http-add-on/templates/interceptor/rbac.yml	Allows interceptor to get/list/watch interceptorroutes.
http-add-on/templates/scaler/rbac.yml	Allows scaler to get/list/watch interceptorroutes.
http-add-on/templates/rbac-aggregateclusterroles.yaml	Extends aggregated edit/view roles to include interceptorroutes.
http-add-on/README.md	Updates the crds.install description to reference both CRDs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[linkvt]

Hi, thanks for the PR, looks great in general, passing CI also is a good sign!

Besides the issue copilot found, could you also update CI for InterceptorRoute? I'm fine with having both the HTTPSO and IR checks for now with a TODO to remove them or so, see https://github.com/kedacore/charts/blob/main/.github/workflows/ci-http-add-on.yml
Otherwise we should solve that in a separate issue/PR, thanks!

[AtharvaPakade]

Thanks! Updated CI for InterceptorRoute as requested, addressed the Copilot findings, and added additional RBAC validation steps to the workflow.

[linkvt]

Hi @AtharvaPakade , thanks!

I noticed you added quite elaborative RBAC checks compared to the simple get and describe used for the HTTPSO - was that on purpose? Not sure if the detailed check has a benefit over a simple one for Helm Chart validation.

[AtharvaPakade]

@linkvt The component's operation depends on its ability to list those items, so I thought the extra validation was worthwhile. Happy to simplify it to basic get/describe if you'd prefer to keep the CI lighter!

[linkvt]

Yes I think we can keep it as simple as before, where it just verifies that the CRD is there and can be used in theory 👍

[linkvt]

Great, thank you!