azure aadpodidbinding totally working with azure queues and ScaledJob?

[gulbrand]

I am building a ScaledJob using an azure-queue trigger. I believe everything is working except the job created by the scaleexecutor doesn't have the aadpodidbinding label (even though it exists on my app chart), and hence doesn't have the id bound to its pod. Therefore, the app can't authenticate via MSI and can't process messages on the queue.

The trigger works totally fine and drives the scaler to create a job pod. I see the scaler reporting in logs that it sees messages in the configured azure queue and that it creates a pod.

I also see that the id gets bound to the keda pod. So everything is working up until the scaler creates a job instance.

The problem is, the job pod doesn't have the aadidpodbinding and hence the job can't connect to the MSI endpoint on local-link.

Is it possible this just isn't totally supported yet?

Thanks,

Mark

helm template output

---
# redacted
apiVersion: keda.sh/v1alpha1
kind: ScaledJob
metadata:
  name: redacted_1-consumer-scaled-job
  namespace: redacted_2-redacted_1
  labels:
    aadpodidbinding: redacted_2-dev-redacted_1-consumer-id
spec:
  pollingInterval: 10                         # Optional. Default: 30 seconds
  maxReplicaCount: 1                          # Optional. Default: 100
  jobTargetRef:
    parallelism: 1
    template:
      metadata:
        name: redacted_1-consumer-job
        labels:
          someAwesomeLabel: testing-this-out
          app: redacted_1-consumer-job
          aadpodidbinding: redacted_2-dev-redacted_1-consumer-id
          namespace: redacted_2-redacted_1
      spec:
        securityContext:
          supplementalGroups: [1000]
          fsGroup: 1000
        containers:
        - name: redacted_1-consumer-job
          image: redacted_2acr.azurecr.io/redacted_2/redacted_1-batch-consumer:0.0.0
          imagePullPolicy: Always
          env:
            - name: TIER
              value: dev
            - name: MIGRATION_MODE
              value: logging
            - name: DD_DOGSTATSD_PORT
              value: "8125"
            - name: DD_ENV
              value: dev
            - name: DD_SERVICE
              value: "redacted_1-consumer-job"
            - name: DD_VERSION
              value: 0.0.0
            - name: DD_AGENT_HOST
              valueFrom:
                fieldRef:
                  fieldPath: status.hostIP
          securityContext:
              runAsUser: 1000
              runAsGroup: 1000
              runAsNonRoot: true
              allowPrivilegeEscalation: false
          resources:
              requests:
                memory: "1Gi"
                cpu: "400m"
              limits:
                memory: "1Gi"
                cpu: "400m"
        restartPolicy: Never
  triggers:
    - name: redacted_1-batch-consumer-scaler
      type: azure-queue
      metadata:
        queueName: batches
        accountName: redacted_2redacted_3storagedev
        namespace: redacted_2-redacted_1
        useAAdPodIdentity: "true"
      authenticationRef:
        name: redacted_1-consumer-job-trigger-auth
---
# redacted
apiVersion: keda.sh/v1alpha1
kind: TriggerAuthentication
metadata:
    name: redacted_1-consumer-job-trigger-auth
    namespace: redacted_2-redacted_1
spec:
    podIdentity:
        provider: azure

[tomkerkhove]

Adding @TsuyoshiUshio

[TsuyoshiUshio]

Probably related this discussion? #1742
Could you try this solution?

#1742 (reply in thread)

[tomkerkhove]

@gulbrand can you give ☝ a go and let us know if it works?