<p>KEDA scaler not scales with scaled object defined with trigger using pod identity for authentication for service bus queue.
I'm following <a href="https://github.com/kedacore/sample-dotnet-worker-servicebus-queue/blob/main/pod-identity.md" rel="nofollow noreferrer">this</a> KEDA service bus triggered scaling project.<br />
The scaling works fine with the connection string, but when I try to scale using the pod identity for KEDA scaler the keda operator fails to get the azure identity bound to it with the following keda operator error message log:</p>
<pre><code>github.com/kedacore/keda/v2/pkg/scaling.(*scaleHandler).isScaledObjectActive
        /workspace/pkg/scaling/scale_handler.go:228
github.com/kedacore/keda/v2/pkg/scaling.(*scaleHandler).checkScalers
        /workspace/pkg/scaling/scale_handler.go:211
github.com/kedacore/keda/v2/pkg/scaling.(*scaleHandler).startScaleLoop
        /workspace/pkg/scaling/scale_handler.go:145
2021-10-10T17:35:53.916Z        ERROR   azure_servicebus_scaler error   {&quot;error&quot;: &quot;failed to refresh token, error: adal: Refresh request failed. Status Code = '400'. Response body: {\&quot;error\&quot;:\&quot;invalid_request\&quot;,\&quot;error_description\&quot;:\&quot;Identity not found\&quot;}\n&quot;}

</code></pre>
<p>Edited on 11/09/2021
I opened a github issue at keda, and we did some troubleshoot. But it seems like an issue with AAD Pod Identity as @Tom suggests. The AD Pod Identity MIC pod gives logs like this:</p>
<pre><code>E1109 03:15:34.391759       1 mic.go:1111] failed to update user-assigned identities on node aks-agentpool-14229154-vmss (add [2], del [0], update[0]), error: failed to update identities for aks-agentpool-14229154-vmss in MC_Arun_democluster_westeurope, error: compute.VirtualMachineScaleSetsClient#Update: Failure sending request: StatusCode=0 -- Original Error: Code=&quot;LinkedAuthorizationFailed&quot; Message=&quot;The client 'fe0d7679-8477-48e3-ae7d-43e2a6fdb957' with object id 'fe0d7679-8477-48e3-ae7d-43e2a6fdb957' has permission to perform action 'Microsoft.Compute/virtualMachineScaleSets/write' on scope '/subscriptions/f3786c6b-8dca-417d-af3f-23929e8b4129/resourceGroups/MC_Arun_democluster_westeurope/providers/Microsoft.Compute/virtualMachineScaleSets/aks-agentpool-14229154-vmss'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/f3786c6b-8dca-417d-af3f-23929e8b4129/resourcegroups/arun/providers/microsoft.managedidentity/userassignedidentities/autoscaler-id' or the linked scope(s) are invalid.&quot;

</code></pre>
<p>Any clues how to fix it?</p>
<p>My scaler objects' definition is as below:</p>
<pre><code>apiVersion: keda.sh/v1alpha1
kind: TriggerAuthentication
metadata:
  name: trigger-auth-service-bus-orders
spec:
  podIdentity:
    provider: azure
---
apiVersion: keda.sh/v1alpha1 
kind: ScaledObject
metadata:
  name: order-scaler
spec:
  scaleTargetRef:
    name: order-processor
  # minReplicaCount: 0 Change to define how many minimum replicas you want
  maxReplicaCount: 10
  triggers:
  - type: azure-servicebus
    metadata:
      namespace: demodemobus
      queueName: orders
      messageCount: '5'
    authenticationRef:
      name: trigger-auth-service-bus-orders
</code></pre>
<p>Im deploying the azure identity to the <code>namespace keda</code> where my keda deployment resides.
And installs KEDA with the following command to set the <code>pod identity binding</code> using helm:</p>
<pre><code>helm install keda kedacore/keda --set podIdentity.activeDirectory.identity=app-autoscaler --namespace keda
</code></pre>
<p><strong>Expected Behavior</strong>
The KEDA scaler should have worked fine with the assigned pod identity and access token to perform scaling</p>
<p><strong>Actual Behavior</strong>
The KEDA operator could not be able to find the azure identity assigned and scaling fails</p>
<p><strong>Scaler Used</strong>
Azure Service Bus</p>
<p><strong>Steps to Reproduce the Problem</strong></p>
<ol>
<li>Create the azure identity and bindings for the KEDA</li>
<li>Install KEDA with the aadpodidentitybinding</li>
<li>Create the scaledobject and triggerauthentication using KEDA pod identity</li>
<li>The scaler fails to authenticate and scale</li>
</ol>

iarunpaul
<p>Unfortunately this looks like an issue with the identity itself and with AD Pod identities, they can be a bit flaky (based on my experiences)</p>
