Does keda-operator ClusterRole need access to serviceaccounts?

[dominhhai]

Discussed in #2348

^{Originally posted by gdamjan-loka November 25, 2021}
Does the the keda-operator ClusterRole need access to serviceaccounts resources too?

I was getting these errors:

E1125 13:48:04.476470       1 reflector.go:138] pkg/mod/k8s.io/client-go@v0.20.8/tools/cache/reflector.go:167: Failed to watch *v1.ServiceAccount: failed to list *v1.ServiceAccount: serviceaccounts is forbidden: User "system:serviceaccount:keda:keda-operator" cannot list resource "serviceaccounts" in API group "" at the cluster scope

To get rid of the error I had to add serviceaccount here somewhere (I edited the release yaml file):
https://github.com/kedacore/keda/blob/main/config/rbac/role.yaml#L19-L23

[dominhhai]

may be related to #837 (comment)

[JorTurFer]

Hi @dominhhai
I have several clusters with KEDA running there so I believe that it's not necessary.
Could you run kubectl get pods -n {KEDA_NAMESPACE} -o jsonpath="{..imageID}" and paste the output please?

[zroubalik]

What type of triggers are you using?

[zroubalik]

And how did you install KEDA? via HELM?

[mKeRix]

FWIW, we also ran into this issue on our test cluster with a fresh Keda installation. We install Keda via Helm (chart version 2.5.0) and tried to use the TriggerAuthentication pointing to a service account with IAM permissions (via IRSA). The ScaledObject had a trigger of type aws-sqs-queue. This failed in the error described above. Once we gave the operator access to read our queue, removed the TriggerAuthentication and instead used identityOwner: operator the scaling worked.

If possible, we'd like to use the aws-eks pod identity in Keda in the future, so that permissions can be given granularly by the teams operating their services.

[tomkerkhove]

If @zroubalik agrees, are you open to send a PR for this @mKeRix ?

[tomasspi]

I comment on this because I had the same issue and solved it by giving permissions to list and watch service accounts to the keda-operator cluster role.
I deployed KEDA via Helm (v2.5.0) and ran into this when when using ClusterTriggerAuthentication with identityOwner: oeprator.

[tomkerkhove]

Are you open to send a PR for this?

[tomasspi]

sure thing!

[tomkerkhove]

A new Helm chart is out - https://github.com/kedacore/charts/releases/tag/v2.5.1

Thanks for reporting and fixing!