I'm trying to configure a Keda Scaler with gcp-storage as trigger, using workload identity as authentication. I have verified my service account has both Storage Admin & Storage Object Admin Roles in my IAM roles. Here is the YAML File with the TriggerAuthentication and ScaledJob
I'm maintaining the values file to fetch the service account details and other key values.
TriggerAuthentication
apiVersion: keda.sh/v1alpha1
kind: TriggerAuthentication
metadata:
name: keda-trigger-auth-gcp-credentials
spec:
podIdentity:
provider: gcp
ScaledJob
apiVersion: keda.sh/v1alpha1
kind: ScaledJob
metadata:
name: sample-scaled-job
namespace: default
labels:
{{- include "app.labels" . | nindent 4 }}
spec:
jobTargetRef:
template:
metadata:
labels:
app.kubernetes.io/name: sample-scaled-job
app.kubernetes.io/instance: sample-scaled-job
spec:
imagePullSecrets: {{ .Values.deployment.imagePullSecrets | toYaml | nindent 8 }}
serviceAccountName: {{ .Values.serviceaccount.name }}
containers:
- name: sample-job-container
image: nginx
imagePullPolicy: Always
command: ["echo","Mukesh"]
pollingInterval: 5 # Optional. Default: 5 seconds
minReplicaCount: 0 # Optional. Default: 0
maxReplicaCount: 2 # Optional. Default: 100
successfulJobsHistoryLimit: 2
failedJobsHistoryLimit: 2
rollout:
strategy: gradual
propagationPolicy: foreground
triggers:
- type: gcp-storage
authenticationRef:
name: keda-trigger-auth-gcp-credentials
metadata:
bucketName: "ccon-ap-core-pilot-us-east4-gcs"
targetObjectCount: "5"
blobPrefix: "inputs/"
I'm getting the following error:
Type Reason Age From Message │
│ ---- ------ ---- ---- ------- │
│ Normal KEDAScalersStarted 38m scale-handler Started scalers watch │
│ Warning KEDAScalerFailed 38m scale-handler context canceled │
│ Warning KEDAScalerFailed 38m scale-handler scaler with id 0 not found, len = 0, cache has been probably already invalidated │
│ Normal ScaledJobReady 36m (x3 over 38m) keda-operator ScaledJob is ready for scaling │
│ Warning KEDAScalerFailed 3m44s (x420 over 38m) scale-handler googleapi: Error 403: Caller does not have storage.objects.list access to the Google Cloud Stora │
│ ge bucket. Permission 'storage.objects.list' denied on resource (or it may not exist)., forbidden