KEDA Hashicorp Vault TLS Authentication

[jackhernandez92]

Hey guys, I've been stuck on this for a couple of days now and wondered if anyone can point me in the right direction.

If my understanding is correct, I need to leverage the hashiCorpVaultTLS parameter in the Helm chart for the keda operator, which I've done and it points to my k8s secret which contains my vault CA. It looks like this gets mounted to /hashicorp-vaultcerts in the container. Is this automatically sourced by the TriggerAuthentication resource? The secret contains my vault ca.crt, tls.crt and tls.key and I use these on other services for injecting vault credentials just fine, but for some reason I get the following:

ERROR	scale_handler	error authenticate to Vault	{"type": "ScaledObject", "namespace": "mynamespace", "name": "deployment-deployment-scaledobject", "triggerAuthRef.Name": "deployment-deployment-vault-triggerauth", "error": "Put \"https://vault.default.svc.cluster.local:8200/v1/auth/kubernetes/login\": tls: failed to verify certificate: x509: certificate signed by unknown authority"}
github.com/kedacore/keda/v2/pkg/scaling/resolver.resolveAuthRef
	/workspace/pkg/scaling/resolver/scale_resolvers.go:252
github.com/kedacore/keda/v2/pkg/scaling/resolver.ResolveAuthRefAndPodIdentity
	/workspace/pkg/scaling/resolver/scale_resolvers.go:183
github.com/kedacore/keda/v2/pkg/scaling.(*scaleHandler).buildScalers.func1
	/workspace/pkg/scaling/scalers_builder.go:70
github.com/kedacore/keda/v2/pkg/scaling.(*scaleHandler).buildScalers
	/workspace/pkg/scaling/scalers_builder.go:80
github.com/kedacore/keda/v2/pkg/scaling.(*scaleHandler).performGetScalersCache
	/workspace/pkg/scaling/scale_handler.go:355
github.com/kedacore/keda/v2/pkg/scaling.(*scaleHandler).GetScalersCache
	/workspace/pkg/scaling/scale_handler.go:280
github.com/kedacore/keda/v2/controllers/keda.(*ScaledObjectReconciler).getScaledObjectMetricSpecs
	/workspace/controllers/keda/hpa.go:211
github.com/kedacore/keda/v2/controllers/keda.(*ScaledObjectReconciler).newHPAForScaledObject
	/workspace/controllers/keda/hpa.go:77
github.com/kedacore/keda/v2/controllers/keda.(*ScaledObjectReconciler).createAndDeployNewHPA
	/workspace/controllers/keda/hpa.go:50
github.com/kedacore/keda/v2/controllers/keda.(*ScaledObjectReconciler).ensureHPAForScaledObjectExists
	/workspace/controllers/keda/scaledobject_controller.go:438
github.com/kedacore/keda/v2/controllers/keda.(*ScaledObjectReconciler).reconcileScaledObject
	/workspace/controllers/keda/scaledobject_controller.go:267
github.com/kedacore/keda/v2/controllers/keda.(*ScaledObjectReconciler).Reconcile
	/workspace/controllers/keda/scaledobject_controller.go:180
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile
	/workspace/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:119
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler
	/workspace/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:316
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
	/workspace/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:266
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
	/workspace/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:227

It feels like maybe the vault cert I'm passing to the KEDA operator isn't being used by TriggerAuthentication but it doesn't look like there's much to configure here other than setting hashiCorpVaultTLS.

Here's my TriggerAuthentication:

apiVersion: keda.sh/v1alpha1
kind: TriggerAuthentication
metadata:
  name: deployment-deployment-vault-triggerauth
  namespace: mynamespace
spec:
  hashiCorpVault:
    address: https://vault.default.svc.cluster.local:8200
    authentication: kubernetes
    role: keda-operator
    mount: kubernetes
    credential:
      serviceAccount: /var/run/secrets/kubernetes.io/serviceaccount/token
    secrets:
    - parameter: queryKey
      key: new_relic_api_key
      path: kv/secrets/parameters/NEW_RELIC_API_KEY
    - parameter: account
      key: new_relic_account_number
      path: kv/secrets/parameters/NEW_RELIC_ACCOUNT_NUMBER
    - parameter: region
      key: new_relic_region
      path: kv/secrets/parameters/NEW_RELIC_REGION

The keda-operator vault role is bound to the keda-operator service account and has a policy that allows it to read those secrets. I've tested on a dummy pod and this part works just fine.

Any help would be much appreciated. Thanks! :)