AzureAssignedIdentity Not Found

[kmatthews3-zz]

Hi,

Ive created a servicebus trigger and used the authenticationRef with the triggerAuthentication object. When I bring the pods up they scale down to 0 but never up again. When I look at the keda logs, i'm receiving this:

{"level":"error","ts":1596103787.6685004,"logger":"azure_servicebus_scaler","msg":"error","error":"no AzureAssignedIdentity found for pod:keda/keda-operator-784dc6f647-75pn2 in assigned state\n","stacktrace":"github.com/go-logr/zapr.(*zapLogger).Error\n\t/Users/zroubali/go/pkg/mod/github.com/go-logr/zapr@v0.1.1/zapr.go:128\ngithub.com/kedacore/keda/pkg/scalers.(*azureServiceBusScaler).IsActive\n\tkeda/pkg/scalers/azure_servicebus_scaler.go:134\ngithub.com/kedacore/keda/pkg/handler.(*ScaleHandler).handleScaleDeployment\n\tkeda/pkg/handler/scale_loop.go:119\ngithub.com/kedacore/keda/pkg/handler.(*ScaleHandler).handleScale\n\tkeda/pkg/handler/scale_loop.go:45\ngithub.com/kedacore/keda/pkg/handler.(*ScaleHandler).HandleScaleLoop\n\tkeda/pkg/handler/scale_loop.go:28"}

Keda is installed in the keda namespace, the deployment/ScaledObject/TriggerAuthentication/AzureIdentity/AzureIdentityBinding are all the namespace of the deployment so different to keda. I'm not sure what it is asking for in the above error though - I didn't have this last time when I used the connection rather than the authenticationRef.

Thanks
Kevin

[tomkerkhove]

I'll need @ahmelsayed to confirm but AFAIK KEDA needs access to the identity as well given it needs to be able to check the metrics for your trigger.

[kmatthews3-zz]

Yes thats fine, I appreciate the help though as i've literally been staring at it for the past few hours... so what your saying is I create a new AzureIdentity (not any that i have now) and use the --set aadPodIdentity to that one, and grant permissions to the SP to do whatever I need it to do (read queues/blobs etc)... but the authenticationRef in the actual scaled object... should that point at the pods Azure Identity or to the new Azure Identity thats just been created?

[kmatthews3-zz]

Just in case anyone is in the same boat...

1. I created a user assigned identity in azure
2. I then created an AzureIdentity and AzureIdentityBinding in Kubernetes and associated them with the user assigned identity
3. I then use the --set aadpodIdentity on the keda installation and set it to the newly created azure identity
4. I gave that identity the permissions on the service bus

This now worked.

Could do with a little documentation on this on the keda site when wanting to use the authenticationRef instead of the connection strings though.

Thanks for your help @tomkerkhove

[tomkerkhove]

Good to hear that it worked! So what was not clear in the docs was that the identity has to be on the operator next to the deployment; is that a good summary?

[tomkerkhove]

Next to that, I'll update one of our samples to show how you can use Pod identity: kedacore/sample-dotnet-worker-servicebus-queue#18

But that's a bit more down the line.

[kmatthews3-zz]

Yea it was that the operator needs it own identity seperate to the individual pods primarily, when you use connection strings it doesn't, so it just needs to be added that if you want to use authenticationRef, ensure you set up a seperate user assigned identity that you assign to the keda operator via the helm --set command and assign that the one the permissions to manage the queues.

Cheers