Redis List scaler with no redis username

[IamJeffG]

This is my first time using Keda. I'm trying to scale-out a deployment based on redis list size (celery queue length).

I have tried every combination of how to provide the redis password/access key, including from a secret, from an env variable on the target, from authenticationRef to a TriggerAuthentication, and no matter what, the ScaledObject fails to start, giving an authentication error.

I am using Keda version 2.11. The redis cache is Azure Cache for Redis v6.0.14 (it is behind SSL, port 6380). I know I can connect to it from pods in this same k8s cluster.

Note that there is no username for my Azure Cache for Redis server, and I wonder if the Keda scaler might be attempting to authenticate with password and username even though it should only be passing password? The reason I am wondering about that is the scaler's source code appears to pass info.username to the redis client in all cases:

keda/pkg/scalers/redis_scaler.go

Lines 499 to 505 in 26c3451

	func getRedisClient(ctx context.Context, info redisConnectionInfo, dbIndex int) (*redis.Client, error) {
	options := &redis.Options{
	Addr: info.addresses[0],
	Username: info.username,
	Password: info.password,
	DB: dbIndex,
	}

That could be on the wrong track. Anyway are a couple different setups and their (slightly different) errors:

Using passwordFromEnv

apiVersion: v1
kind: Secret
metadata:
  name: votes-db-secret
type: Opaque
data:
  redis-password: base64-access-key   # REDACTED
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: celery-worker
spec:
  replicas: 1
  selector:
    matchLabels:
      app: celery-worker
  template:
    metadata:
      labels:
        app: celery-worker
        environment: prod
    spec:
      containers:
      - name: app
        image: wickerlabs/maintenance
        env:
        - name: REDIS_PASSWORD
          valueFrom:
            secretKeyRef:
              name: votes-db-secret
              key: redis-password
---
apiVersion: keda.sh/v1alpha1
kind: ScaledObject
metadata:
  name: celery-worker-autoscale
spec:
  scaleTargetRef:
    name: celery-worker
  minReplicaCount: 1
  maxReplicaCount: 4
  triggers:
  - type: redis
    metadata:
      address: mycachehere.redis.cache.windows.net:6380
      passwordFromEnv: REDIS_PASSWORD
      enableTLS: "true"
      listName: "celery"
      listLength: "4"

$ kubectl describe scaledobject.keda.sh/celery-worker-autoscale | tail
Events:
  Type     Reason                   Age                From           Message
  ----     ------                   ----               ----           -------
  Warning  KEDAScalerFailed         1s (x12 over 12s)  keda-operator  connection to redis failed: WRONGPASS invalid username-password pair
  Warning  ScaledObjectCheckFailed  1s (x12 over 12s)  keda-operator  failed to ensure HPA is correctly created for ScaledObject

Using TriggerAuthentication

apiVersion: v1
kind: Secret
metadata:
  name: votes-db-secret
type: Opaque
data:
  redis-password: base64-access-key  # REDACTED
---
apiVersion: keda.sh/v1alpha1
kind: TriggerAuthentication
metadata:
  name: keda-redis-auth
spec:
  secretTargetRef:
  - parameter: password
    name: votes-db-secret
    key: redis-password
---
apiVersion: keda.sh/v1alpha1
kind: ScaledObject
metadata:
  name: celery-worker-autoscale
spec:
  scaleTargetRef:
    name: celery-worker
  minReplicaCount: 1
  maxReplicaCount: 4
  triggers:
  - type: redis
    metadata:
      address: mycachehere.redis.cache.windows.net:6380
      enableTLS: "true"
      listName: "celery"
      listLength: "4"
    authenticationRef:
      name: keda-redis-auth

$ kubectl describe scaledobject.keda.sh/celery-worker-autoscale | tail
Events:
  Type     Reason                   Age                 From           Message
  ----     ------                   ----                ----           -------
  Warning  ScaledObjectCheckFailed  20s (x12 over 30s)  keda-operator  failed to ensure HPA is correctly created for ScaledObject
  Warning  KEDAScalerFailed         9s (x13 over 30s)   keda-operator  connection to redis failed: NOAUTH Authentication required.

Hopefully an easy fix! Thanks for taking a look.

[IamJeffG]

I got it working! The fault was mine:

When I was base64-encoding the Redis access key, as is required to store in a kubernetes secret that keda reads, I was inadvertently including a newline on the value being encoded. Redis saw the extra newline character in the access key and rejected authentication.

This is what I had been doing:

$ echo myaccesskey | base64 -w0   # WRONG

This is the fix: (-n omits trailing newline)

$ echo -n myaccesskey | base64 -w0

And the fact that the keda source code passes info.username to the Go redis client is not a problem, even when there is no username.