I am trying to set up KEDA in my AKS cluster. I have an application running in a pod. I am using workload identity. Everything is set up correctly in that respect, because all the other Azure services work (send and receiving messages service bus, blob storage, key vault, etc.)

Now when I install KEDA using the az az aks update --resource-group myResourceGroup --name myAKSCluster --enable-keda command, it successfully runs and I see KEDA pods running in the kube-system namespace.

Then I see the following error message appearing in the logs of the KEDA operator pod: "error_description": "AADSTS700213: No matching federated identity record found for presented assertion subject 'system:serviceaccount:kube-system:keda-operator'. Please check your federated identity credential Subject, Audience and Issuer against the presented assertion.

I checked the service account template of my application, and that looks fine.

apiVersion: v1
kind: ServiceAccount
metadata:
  annotations:
    azure.workload.identity/client-id: xxx
    azure.workload.identity/tenant-id: xxx
  name: xxx-sa
  namespace: xxx
  labels:
    app-name: xxx

The templates of the scaled object and trigger authentication also look fine I believe:

apiVersion: keda.sh/v1alpha1
kind: TriggerAuthentication
metadata:
  name: scaling-trigger-auth
  namespace: xxx
spec:
  podIdentity:
    provider: azure-workload
    identityId: xxx

---

apiVersion: keda.sh/v1alpha1
kind: ScaledObject
metadata:
  name: xxx-scaledobject
  namespace: xxx
spec:
  scaleTargetRef:
    kind: Deployment
    name: xxx-deployment
  minReplicaCount: 1
  maxReplicaCount: 10
  triggers:
    - type: azure-servicebus
      metadata:
        namespace: xxx.servicebus.windows.net
        queueName: xxx
        messageCount: "5"
      authenticationRef:
        name: scaling-trigger-auth

I also uninstalled and installed KEDA, but same issue.

I checked the subject identifier of the managed ID I want to use, and that is different from the subject identifier shown in the error message. I do want to use the managed ID I created for the application, instead of some KEDA managed ID that I need to make.

Does anyone know how I can fix this?