Does keda-operator ClusterRole need access to serviceaccounts?

[gdamjan-loka]

Does the the keda-operator ClusterRole need access to serviceaccounts resources too?

I was getting these errors:

E1125 13:48:04.476470       1 reflector.go:138] pkg/mod/k8s.io/client-go@v0.20.8/tools/cache/reflector.go:167: Failed to watch *v1.ServiceAccount: failed to list *v1.ServiceAccount: serviceaccounts is forbidden: User "system:serviceaccount:keda:keda-operator" cannot list resource "serviceaccounts" in API group "" at the cluster scope

To get rid of the error I had to add serviceaccount here somewhere (I edited the release yaml file):
https://github.com/kedacore/keda/blob/main/config/rbac/role.yaml#L19-L23

[tomkerkhove]

What version of KEDA are you running?

[gdamjan-loka]

What version of KEDA are you running?

2.4.0

[tomkerkhove]

Would you mind giving 2.5 a quick try please?

However, this looks like a bug given it was removed in our latest Helm resource update (link, which was not fully aligned for v2.4 as well) - Thoughts @zroubalik ?

[dominhhai]

v2.5.0 has same error here

E1204 14:51:09.838845       1 reflector.go:138] pkg/mod/k8s.io/client-go@v0.22.4/tools/cache/reflector.go:167: Failed to watch *v1.ServiceAccount: failed to list *v1.ServiceAccount: serviceaccounts is forbidden: User "system:serviceaccount:keda:keda-operator" cannot list resource "serviceaccounts" in API group "" at the cluster scope

How can I pass this error?

[eidmantas]

@tomkerkhove With 2.5.0 same error here as well. Can not list serviceaccounts. What should be the correct action here? Is it really necessary?

[tomkerkhove]

@zroubalik I think we need it, no?

[gdamjan-loka]

Didn't have the chance to test this, but I believe it's fixed with this PR #2406