I am trying to set up KEDA in my AKS cluster. I have an application running in a pod. I am using workload identity. Everything is set up correctly in that respect, because all the other Azure services work (send and receiving messages service bus, blob storage, key vault, etc.)
Now when I install KEDA using the az az aks update --resource-group myResourceGroup --name myAKSCluster --enable-keda
command, it successfully runs and I see KEDA pods running in the kube-system namespace.
Then I see the following error message appearing in the logs of the KEDA operator pod: "error_description": "AADSTS700213: No matching federated identity record found for presented assertion subject 'system:serviceaccount:kube-system:keda-operator'. Please check your federated identity credential Subject, Audience and Issuer against the presented assertion.
I checked the service account template of my application, and that looks fine.
apiVersion: v1
kind: ServiceAccount
metadata:
annotations:
azure.workload.identity/client-id: xxx
azure.workload.identity/tenant-id: xxx
name: xxx-sa
namespace: xxx
labels:
app-name: xxx
The templates of the scaled object and trigger authentication also look fine I believe:
apiVersion: keda.sh/v1alpha1
kind: TriggerAuthentication
metadata:
name: scaling-trigger-auth
namespace: xxx
spec:
podIdentity:
provider: azure-workload
identityId: xxx
---
apiVersion: keda.sh/v1alpha1
kind: ScaledObject
metadata:
name: xxx-scaledobject
namespace: xxx
spec:
scaleTargetRef:
kind: Deployment
name: xxx-deployment
minReplicaCount: 1
maxReplicaCount: 10
triggers:
- type: azure-servicebus
metadata:
namespace: xxx.servicebus.windows.net
queueName: xxx
messageCount: "5"
authenticationRef:
name: scaling-trigger-auth
I also uninstalled and installed KEDA, but same issue.
I checked the subject identifier of the managed ID I want to use, and that is different from the subject identifier shown in the error message. I do want to use the managed ID I created for the application, instead of some KEDA managed ID that I need to make.
Does anyone know how I can fix this?