Elasticsearch scaler issue - IRSA Auth

[lalbinati]

Hi,

I am currently exploring the possibility of using keda to escalate based on an opensearch query.
I've read the documentation and I believe I'm doing things right but I think I might've hit a wall.

Main blocker right now is that I am not using plain auth, I'm trying to use IRSA to authenticate the OS query and its not working, or the elasticsearch scaler does not support it.

I have a working microservice which uses IRSA to access the opensearch domain, that part works fine.

Here's what I tried.

• I added keda-operator service acct in the trust relationship of the role used with IRSA.
• I've defined a TriggerAuthentication object with this content:

apiVersion: keda.sh/v1alpha1
kind: TriggerAuthentication
metadata:
  name: irsa-test
  namespace: default
spec:
  podIdentity:
    provider: aws
    identityOwner: workload

• Finally, I added a new trigger to an existing ScaledObject for the mentioned microservice, and I'm referencing the TriggerAuth name using authenticationRef.name.

I'm getting this error:
2025-02-07T20:29:19Z ERROR scale_handler error resolving auth params {"type": "ScaledObject", "namespace": "default", "name": "xxxx-xxxx", "triggerIndex": 2, "error": "error parsing elasticsearch metadata: both username and password must be provided when addresses is used"}

Am I missing something or elasticsearch scaler does not support this yet?

Regards,
Luis

[rickbrouwer]

The Elastisearch scaler does not currently work with a workload identity

[lalbinati]

So if I change identityOwner to "keda" and map the iam role to keda s.a. it should work?

[rickbrouwer]

You can only authenticate by using a username/password or apiKey/cloudID if you’re using using ElasticSearch on Elastic Cloud. (https://keda.sh/docs/2.16/scalers/elasticsearch/#authentication-parameters)

When using addresses, both username and password must be provided. You can't provide both cloud config and endpoint addresses.

[lalbinati]

Oh ok, that's what I suspected.

I'm using AWS Opensearch and my apps are using IRSA IAM authentication, which is neither user/app nor apiKey/cloudID.

In my scenario (which is quite common) it would seem logical to define both addresses and auth based on whatever is set in the TriggerAuthentication object.

Do you know if its planned to incorporate such feature into the scaler?

Thanks for the clarification.
L

[rickbrouwer]

As far as i know that is not in the planning yet. But under issues you can possibly make a new feature request, and even if you like, create and contribute :)