error reading service account token - open : no such file or directory

[chrism-hutch]

I'm trying to use Azure Workload, with Azure Queue as a trigger

apiVersion: keda.sh/v1alpha1
kind: TriggerAuthentication
metadata:
  name: crates
  namespace: default
spec:
  podIdentity:
    provider: azure-workload
    identityId: 0f71ba26-87c8-4b25-a9a7-e5085fbe9c3a

apiVersion: keda.sh/v1alpha1
kind: ScaledObject
metadata:
  name: crates
  namespace: default
spec:
  scaleTargetRef:
    name: crates
  triggers:
  - type: azure-queue
    metadata:
      # Required
      queueName: somequeue
      # Optional, required when pod identity is used
      accountName: somehwere

      # Optional
      queueLength: "5" # default 5
    authenticationRef:
        name: crates

And this what the oprator logs, I've created my federated credentials which are tied to 0f71ba26-87c8-4b25-a9a7-e5085fbe9c3a:

2022-10-17T12:35:34Z   INFO    Reconciling ScaledObject        {"controller": "scaledobject", "controllerGroup": "keda.sh", "controllerKind": "ScaledObject", "scaledObject": {"name":"crate│
│2022-10-17T12:36:04Z   ERROR   azure_queue_scaler      error)  {"type": "ScaledObject", "namespace": "default", "name": "cratedroprates", "error": "error reading service account token - open : │
│github.com/kedacore/keda/v2/pkg/scaling/cache.(*ScalersCache).IsScaledObjectActive                                                                                                            │
│       /workspace/pkg/scaling/cache/scalers_cache.go:89                                                                                                                                       │
│github.com/kedacore/keda/v2/pkg/scaling.(*scaleHandler).checkScalers                                                                                                                          │
│       /workspace/pkg/scaling/scale_handler.go:278                                                                                                                                            │
│github.com/kedacore/keda/v2/pkg/scaling.(*scaleHandler).startScaleLoop                                                                                                                        │
│       /workspace/pkg/scaling/scale_handler.go:149

Not sure what to think of this error, am I misusing Keda?

[chrism-hutch]

Alright, enabling workload (--enable-workload-identity) on my AKS cluster solved this

[remyletient]

It seems this option is no longer available in the latest version of azure-cli: https://learn.microsoft.com/en-us/cli/azure/aks?view=azure-cli-latest#az-aks-update

[piroinno]

Did not work for me sadly. Can you confirm if you installed keda with a service account

[JorTurFer]

yw!

[stephenleecariad]

I ran into the original error and was only able to get around it by patching the keda operator deployment and adding the 'azure.workload.identity/use: "true"' label.

ex: KedaCorePatch.yml:
spec:
template:
metadata:
labels:
azure.workload.identity/use: "true"

deploy step:
- task: Kubernetes@1
displayName: Patch Keda Deployment
inputs:
connectionType: "Azure Resource Manager"
azureSubscriptionEndpoint: "xxxxxxxxxxxxxxxxxx"
azureResourceGroup: "$(RESOURCE_GROUP_NAME)"
kubernetesCluster: "$(RESOURCE_GROUP_NAME)-aks"
useClusterAdmin: true
command: patch
arguments: deployment keda-operator -n keda --patch-file ./KedaCorePatch.yml

[JorTurFer]

Hey,
That's because they changed the required labels for being injected in the workload identity webhook, but we update them too in KEDA chart, if you use latest versions of KEDA using the helm chart, your patch is already included

[stephenleecariad]

Ah that would explain my problems then, I wasn't using a helm chart due to our company's reluctance to embrace it. I'll have to look into that!

[JorTurFer]

You aren't forced to use the chart at all, but you need to patch the required resources from your side. The best part of the chart here is that we update is with required stuff, but it's also true that it's another dep (I'm talking about helm)