connectionStringFromSecret

[ianadavies]

Proposal

Need the ability to set connection string from a source other than the deployment environment variables.

Use-Case

I am using KEDA with Azure functions (Queue Trigger) + ACI (Virtual Nodes). The problem is that ACI Virtual Nodes do not support ENV variables and these need to be baked into the docker image.

This is means that I cannot use KEDA scaled objects with deployments that target ACI virtual nodes.

NB : The nodes will not start if the ENV variables exist :/

Anything else?

Nothing else, unless there is something I have missed or there is another way to achieve this ?

[tomkerkhove]

The problem is that ACI Virtual Nodes do not support ENV variables and these need to be baked into the docker image.

Are you sure about that? As far as I know that is not the case.

[tomkerkhove]

Also, what queue are you using? Depending on it, they provide various ways to authenticate.

[tomkerkhove]

I presume you are referring to Azure Storage Queue?

You can then use TriggerAuthentication spec - https://keda.sh/docs/latest/scalers/azure-storage-queue/#authentication-parameters

It allows you to re-use authentication information and pull from various secret sources: https://keda.sh/docs/2.3/concepts/authentication/#re-use-credentials-and-delegate-auth-with-triggerauthentication

[ianadavies]

Ok so # authenticationRef would need either podIdentity or define a connection parameter
How do i define a connection parameter? There is no example in these docs

The secretTargetRef looks promising

secretTargetRef: # Optional.

• parameter: connectionString # Required - Defined by the scale trigger
  name: my-keda-secret-entity # Required.
  key: azure-storage-connectionstring # Required.

But no example of how to reference it.

[ianadavies]

Even the pod identity does not have good examples

[ianadavies]

You can tell KEDA to use Azure AD Pod Identity via podIdentity.provider ?? and no link or example of what podidentiy.provider is or how to use it

[tomkerkhove]

The secretTargetRef looks promising

secretTargetRef: # Optional.

parameter: connectionString # Required - Defined by the scale trigger
name: my-keda-secret-entity # Required.
key: azure-storage-connectionstring # Required.
But no example of how to reference it.

The connection parameter is defined by the trigger, hence the comment. Then you use whatever secret name/key you have in the cluster.

Even the pod identity does not have good examples

I think that's a bit unfair after only checking a few minutes.

https://github.com/kedacore/sample-dotnet-worker-servicebus-queue has a full guide for pod identity. It uses the Service Bus scaler but it's the same across all scalers.

You can tell KEDA to use Azure AD Pod Identity via podIdentity.provider ?? and no link or example of what podidentiy.provider is or how to use it

What are you looking for then? podIdentity.provider is the way to configure it such as in the example and uses Azure AD Pod Identity.

Here is a full sample of TriggerAuthentication

With docs per provider below it: https://keda.sh/docs/2.3/concepts/authentication/#authentication-parameters