Need Help with configuring gcp-storage trigger

[mukeshpanch14]

Discussed in #5098

^{Originally posted by mukeshpanch14 October 19, 2023}
I'm trying to configure a Keda Scaler with gcp-storage as trigger, using workload identity as authentication. I have verified my service account has both Storage Admin & Storage Object Admin Roles in my IAM roles. Here is the YAML File with the TriggerAuthentication and ScaledJob

I'm maintaining the values file to fetch the service account details and other key values.

TriggerAuthentication

apiVersion: keda.sh/v1alpha1
kind: TriggerAuthentication
metadata:
  name: keda-trigger-auth-gcp-credentials
spec:
  podIdentity:
    provider: gcp

ScaledJob

apiVersion: keda.sh/v1alpha1
kind: ScaledJob
metadata:
  name: sample-scaled-job
  namespace: default
  labels:
      {{- include "app.labels" . | nindent 4 }}
spec:
  jobTargetRef:
    template:
      metadata:
        labels:
          app.kubernetes.io/name: sample-scaled-job
          app.kubernetes.io/instance: sample-scaled-job
      spec:
        imagePullSecrets: {{ .Values.deployment.imagePullSecrets | toYaml | nindent 8 }}
        serviceAccountName: {{ .Values.serviceaccount.name }}
        containers:
          - name: sample-job-container
            image: nginx
            imagePullPolicy: Always
            command: ["echo","Mukesh"]
  pollingInterval:  5                    # Optional. Default: 5 seconds
  minReplicaCount:  0                   # Optional. Default: 0
  maxReplicaCount:  2                    # Optional. Default: 100
  successfulJobsHistoryLimit: 2
  failedJobsHistoryLimit: 2
  rollout:
    strategy: gradual
    propagationPolicy: foreground
  triggers:
  - type: gcp-storage
    authenticationRef:
      name: keda-trigger-auth-gcp-credentials
    metadata:
      bucketName: "bucket_name"
      targetObjectCount: "5"
      blobPrefix: "inputs/"

I'm getting the following error in the job:

 Type     Reason              Age                    From           Message                                                                                          │
│   ----     ------              ----                   ----           -------                                                                                          │
│   Normal   KEDAScalersStarted  38m                    scale-handler  Started scalers watch                                                                            │
│   Warning  KEDAScalerFailed    38m                    scale-handler  context canceled                                                                                 │
│   Warning  KEDAScalerFailed    38m                    scale-handler  scaler with id 0 not found, len = 0, cache has been probably already invalidated                 │
│   Normal   ScaledJobReady      36m (x3 over 38m)      keda-operator  ScaledJob is ready for scaling                                                                   │
│   Warning  KEDAScalerFailed    3m44s (x420 over 38m)  scale-handler  googleapi: Error 403: Caller does not have storage.objects.list access to the Google Cloud Stora │
│ ge bucket. Permission 'storage.objects.list' denied on resource (or it may not exist)., forbidden          
```</div>

[JorTurFer]

Hello,
I think that KEDA is working as expected as you are getting 403, so KEDA is using the identity but it doesn't have access. I'd check the role assignment on GCP side. Maybe it needs some other roles?

[JorTurFer]

IDK if the roles you have already assigned include the permission storage.objects.list