Trouble combining ScaledObject and ClusterTriggerAuthentication with influxdb scaler

[acobaugh]

I'm running the latest version of keda. I've poured over the documentation and read the code, and I can't quite fathom why this isn't working the way I expect it to. I'll summarize the resources I have and the error I'm seeing below:

resources

apiVersion: keda.sh/v1alpha1
kind: ClusterTriggerAuthentication
metadata:
  name: influx-blue
spec:
  secretTargetRef:
  - key: authToken2
    name: influx-blue-auth
    parameter: authToken
  - key: serverURL
    name: influx-blue-auth
    parameter: serverURL

apiVersion: v1
data:
  authToken: REDACTED
  serverURL: REDACTED
kind: Secret
  name: influx-blue-auth
  namespace: keda
type: Opaque

apiVersion: keda.sh/v1alpha1
kind: ScaledObject
metadata:
  name: course-group-jms-processor
  namespace: swe-develop
spec:
  maxReplicaCount: 3
  minReplicaCount: 1
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: course-group-jms-processor
  triggers:
  - authenticationRef:
      kind: ClusterTriggerAuthentication
      name: influx-blue
    metadata:
      query: |
        from(bucket:"telegraf")
        |> range(start:-300s)
        |> filter(fn:(r) =>
          r._measurement == "ActiveMQ" and
          r.destinationName == "dev.notifications.courseGroupProc.in_q" and
          r.host =~ /amq-d.*.test.REDACTED/ and
          r._field == "QueueSize"
      thresholdValue: "1"
    type: influxdb

errors

keda-operator-6b676d8c87-4hrxn keda-operator 2021-06-15T14:14:00.295Z	ERROR	controllers.ScaledObject	Failed to ensure HPA is correctly created for ScaledObject	{"ScaledObject.Namespace": "swe-develop", "ScaledObject.Name": "course-group-jms-processor", "error": "error getting scaler for trigger #0: error parsing influxdb metadata: no auth token given"}
keda-operator-6b676d8c87-4hrxn keda-operator sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler
keda-operator-6b676d8c87-4hrxn keda-operator 	/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:244
keda-operator-6b676d8c87-4hrxn keda-operator sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
keda-operator-6b676d8c87-4hrxn keda-operator 	/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:218
keda-operator-6b676d8c87-4hrxn keda-operator sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).worker
keda-operator-6b676d8c87-4hrxn keda-operator 	/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:197
keda-operator-6b676d8c87-4hrxn keda-operator k8s.io/apimachinery/pkg/util/wait.BackoffUntil.func1
keda-operator-6b676d8c87-4hrxn keda-operator 	/go/pkg/mod/k8s.io/[email protected]/pkg/util/wait/wait.go:155
keda-operator-6b676d8c87-4hrxn keda-operator k8s.io/apimachinery/pkg/util/wait.BackoffUntil
keda-operator-6b676d8c87-4hrxn keda-operator 	/go/pkg/mod/k8s.io/[email protected]/pkg/util/wait/wait.go:156
keda-operator-6b676d8c87-4hrxn keda-operator k8s.io/apimachinery/pkg/util/wait.JitterUntil
keda-operator-6b676d8c87-4hrxn keda-operator 	/go/pkg/mod/k8s.io/[email protected]/pkg/util/wait/wait.go:133
keda-operator-6b676d8c87-4hrxn keda-operator k8s.io/apimachinery/pkg/util/wait.Until
keda-operator-6b676d8c87-4hrxn keda-operator 	/go/pkg/mod/k8s.io/[email protected]/pkg/util/wait/wait.go:90```

[tomkerkhove]

First of all, sorry that I've missed this one!

serverURL is not supported through trigger authentication as per https://keda.sh/docs/2.3/scalers/influxdb/#authentication-parameters

Can you move it to your scaled object and see if that fixes it? If so, we need to fix the error.

If it doesn't, then I think this is a doc bug where authToken is documented as trigger authentication but can't find that logic in https://github.com/kedacore/keda/blob/main/pkg/scalers/influxdb_scaler.go but I'm no Go dev so adding @zroubalik

[acobaugh]

I moved serverURL to the ScaledObject with no change in behavior - it's still complaining about authToken not being set, so I don't think the problem is the serverURL. In my reading of the code, it looks like anything that can be set in metadata on a ScaledObject can also be set in a CTA. I don't think any of this logic lives in the scaler itself, but rather in the resolver code.

My hope was I could put both serverURL and authToken in the CTA so each ScaledObject could be set up independent of how influxdb is actually configured. Ops could set up a CTA, then devs could just consume it by reference.

[zroubalik]

Your usecase is completely valid.

I am looking at the code and the way it is currently implemented, it is looking up this value only in trigger metadata (config.TriggerMetadata) and not in TriggerAuthentication or CTA (config.AuthParams).

keda/pkg/scalers/influxdb_scaler.go

Lines 60 to 72 in 9b59d0b

	val, ok := config.TriggerMetadata["authToken"]
	switch {
	case ok && val != "":
	authToken = val
	case config.TriggerMetadata["authTokenFromEnv"] != "":
	if val, ok := config.ResolvedEnv[config.TriggerMetadata["authTokenFromEnv"]]; ok {
	authToken = val
	} else {
	return nil, fmt.Errorf("no auth token given")
	}
	default:
	return nil, fmt.Errorf("no auth token given")
	}

Here would be needed code like this:

if val, ok := config.AuthParams["authToken"]; ok {
		authToken = val
	}

You can check other scalers, how is it implemented, eg:

keda/pkg/scalers/rabbitmq_scaler.go

Line 112 in 9b59d0b

func parseRabbitMQMetadata(config *ScalerConfig) (*rabbitMQMetadata, error) {

Are you willing to contribute this? It should be quite an easy one. If so, open an issue for this. Thanks

[Shubham82]

Hi @zroubalik @tomkerkhove
I also Encountered this issue early, it is on my to-do.
If you are ok should I raise a separate issue and PR for it?

[acobaugh]

I'm actually working on a PR for this as we speak.

…

On Thu, Jun 24, 2021, 12:25 Shubham ***@***.***> wrote: Hi @zroubalik <https://github.com/zroubalik> @tomkerkhove <https://github.com/tomkerkhove> I also Encountered this issue early, it is on my to-do. If you are ok should I raise a separate issue and PR for it? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#1892 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAA3T3FYZ7G34USWIADY6ZLTUNMA5ANCNFSM46XMLVUQ> .

[Shubham82]

Great!
Thanks for the information.

[acobaugh]

PR is here: #1904

[tomkerkhove]

Tracking this in #1905