Apache Kafka scaler throwing errors when trying to use with AWS MSK

[zeeamd]

The keda-operator service account has a AWS IAM role which has access to AWS MSK

keda helm chart version - keda-2.15.2
Scaler - AWS MSK

Now when I add a scaler in app namespace it is throwing in scaledobject events I notice

error getting metadata: kafka.(*Client).Metadata: unexpected EOF

scaledobject manifest

apiVersion: keda.sh/v1alpha1
kind: ScaledObject
metadata:
  name: kafka-so-test
  namespace: appns
spec:
  scaleTargetRef:
    name : my-app-deploy
  minReplicaCount: 1
  maxReplicaCount: 4
  triggers:
    - type: apache-kafka
      metadata:
        bootstrapServers: "b-3.xxx.c6.kafka.us-east-2.amazonaws.com:9098,b-1.xxx.c6.kafka.us-east-2.amazonaws.com:9098,b-2.xxx.c6.kafka.us-east-2.amazonaws.com:9098"
        consumerGroup: console-consumer-2139
        topic: alert_data_topic
        lagThreshold: '1'
        offsetResetPolicy: latest
        saslMechanism: "AWS_MSK_IAM"
        securityProtocol: "SASL_SSL"
        tls: enable
        awsRegion: "us-east-2"

The hpa was created but with following errors

Warning  FailedGetExternalMetric       4m (x40 over 14m)   horizontal-pod-autoscaler  unable to get external metric sowct/s0-kafka-alert_data_ngps_sowct/&LabelSelector{MatchLabels:map[string]string{scaledobject.keda.sh/name: kafka-so-test,},MatchExpressions:[]LabelSelectorRequirement{},}: unable to fetch metrics from external metrics API: rpc error: code = Unknown desc = error when getting metric values metric:s0-kafka-alert_data_ngps_sowct encountered error

Using https://keda.sh/docs/2.12/scalers/apache-kafka-go/
Is there anything missing here ?

[rickbrouwer]

Viewed purely from the documentation.
I don't see this parameter in the docs. I suspect you mean this one

saslMechanism: "AWS_MSK_IAM" --> sasl: "aws_msk_iam"

I can't find this one anyway:

securityProtocol: "SASL_SSL"

The “unexpected EOF” issue likely arises because the AWS MSK IAM authentication is not set up correctly due to the incorrect parameter names, causing the connection to close prematurely.

sasl can have the following values: none;plaintext;scram_sha256;scram_sha512;gssapi;aws_msk_iam
This seems to be wrong in the documentation now, I will change that.

[zeeamd]

Yes this was just test it's not on the doc
securityProtocol: "SASL_SSL"

I did try the sasl: "aws_msk_iam" but it's giving the same issues.

The keda-operator user has full access to AWS MSK

ScaledObject (Failed)

apiVersion: keda.sh/v1alpha1
kind: ScaledObject
metadata:
  name: kso
  namespace: sct
spec:
  scaleTargetRef:
    name: inflate
  triggers:
  - type: apache-kafka
    authenticationRef:
      name: kta
    metadata:
      bootstrapServers: "b-3.xxx.z3w2gx.c6.kafka.us-east-2.amazonaws.com:9098,b-1.aaa.vv.c6.kafka.us-east-2.amazonaws.com:9098,b-2.ccc.vv.c6.kafka.us-east-2.amazonaws.com:9098"
      consumerGroup: t_consumer
      topic: b_data
      lagThreshold: '1'
      awsRegion: "us-east-2"
      tls: enable
    authenticationRef:
      name: kta

Auth object (Failed)

apiVersion: keda.sh/v1alpha1
kind: TriggerAuthentication
metadata:
  name: kta
  namespace: sct
spec:
  podIdentity:
    provider: aws

Tried passing role arn as a secret but that did not work as well

apiVersion: keda.sh/v1alpha1
kind: TriggerAuthentication
metadata:
  name: kta
  namespace: sct
spec:
  secretTargetRef:
  - parameter: awsRoleArn
    name: ksecret
    key: AWS_ROLE_ARN