Skip to content

Commit 51afa20

Browse files
EdB-MSFTEdB-MSFT
committed
acrolinx
1 parent c2afe60 commit 51afa20

File tree

1 file changed

+130
-125
lines changed

1 file changed

+130
-125
lines changed

‎articles/azure-monitor/essentials/integrating-keda.md

Lines changed: 130 additions & 125 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
# Integrate KEDA with your Azure Kubernetes Service cluster
22

3-
KEDA is a Kubernetes-based Event Driven Autoscaler. KEDA lets you can drive the scaling of any container in Kubernetes based on the number of events needing to be processed, by querying metrics from systems such as Prometheus. Integrate KEDA with your Azure Kubernetes Service (AKS) cluster to scale your workloads based on Prometheus metrics from your Azure Monitor workspace.
3+
KEDA is a Kubernetes-based Event Driven Autoscaler. KEDA lets you can drive the scaling of any container in Kubernetes based on the load to be processed, by querying metrics from systems such as Prometheus. Integrate KEDA with your Azure Kubernetes Service (AKS) cluster to scale your workloads based on Prometheus metrics from your Azure Monitor workspace.
44

5-
To integrate KEDA into your Azure Kubernetes Service, you need to deploy and configure a workload identity or pod identity on your cluster. This allows KEDA to authenticate with Azure and retrieve metrics for scaling from your Monitor workspace.
5+
To integrate KEDA into your Azure Kubernetes Service, you have to deploy and configure a workload identity or pod identity on your cluster. The identity allows KEDA to authenticate with Azure and retrieve metrics for scaling from your Monitor workspace.
66

7-
This article will walk you through the steps to integrate KEDA into your AKS cluster using a workload identity.
7+
This article walks you through the steps to integrate KEDA into your AKS cluster using a workload identity.
88

99
## Prerequisites
1010

@@ -19,143 +19,142 @@ This article will walk you through the steps to integrate KEDA into your AKS clu
1919

2020
1. Start by setting up some environment variables. Change the values to suit your AKS cluster.
2121

22-
Don't change the values for `SERVICE_ACCOUNT_NAMESPACE` and `SERVICE_ACCOUNT_NAME`. They are the namespace and name of the kubernetes service account that KEDA will use to authenticate with Azure Monitor.
23-
24-
`USER_ASSIGNED_IDENTITY_NAME` is the name of the Azure Active directory identity that will be created for KEDA.
25-
`FEDERATED_IDENTITY_CREDENTIAL_NAME` is the name of the credential that will be created for KEDA to use to authenticate with Azure.
26-
27-
```bash
28-
export RESOURCE_GROUP="rg-keda-integration"
29-
export LOCATION="eastus"
30-
export SUBSCRIPTION="$(az account show --query id --output tsv)"
31-
export USER_ASSIGNED_IDENTITY_NAME="keda-int-identity"
32-
export FEDERATED_IDENTITY_CREDENTIAL_NAME="kedaFedIdentity"
33-
export SERVICE_ACCOUNT_NAMESPACE="keda"
34-
export SERVICE_ACCOUNT_NAME="keda-operator"
35-
```
36-
37-
1. If your AKS cluster has not been created with workload-identity or oidc-issuer enabled, you will need to enable it. If you are not sure, you can run the following command to check if it is enabled.
38-
39-
```azurecli
40-
az aks show --resource-group $RESOURCE_GROUP --name $AKS_CLUSTER_NAME --query oidcIssuerProfile
41-
az aks show --resource-group $RESOURCE_GROUP --name $AKS_CLUSTER_NAME --query securityProfile.workloadIdentity
42-
```
43-
44-
To enable workload identity and oidc-issuer , run the following command.
45-
46-
```azurecli
47-
az aks update -g $RESOURCE_GROUP -n $AKS_CLUSTER_NAME --enable-managed-identity --enable-oidc-issuer
48-
```
49-
50-
1. Store the OIDC issuer url in an environment variable. This will be used later.
51-
52-
```bash
53-
export AKS_OIDC_ISSUER="$(az aks show -n $CLUSTER_NAME -g $RESOURCE_GROUP --query "oidcIssuerProfile.issuerUrl" -otsv)"
54-
```
22+
Don't change the values for `SERVICE_ACCOUNT_NAMESPACE` and `SERVICE_ACCOUNT_NAME`. They're the namespace and name of the kubernetes service account that KEDA uses to authenticate with Azure.
23+
24+
`USER_ASSIGNED_IDENTITY_NAME` is the name of the Azure Active directory identity that's created for KEDA.
25+
`FEDERATED_IDENTITY_CREDENTIAL_NAME` is the name of the credential that's created for KEDA to use to authenticate with Azure.
26+
27+
```bash
28+
export RESOURCE_GROUP="rg-keda-integration"
29+
export LOCATION="eastus"
30+
export SUBSCRIPTION="$(az account show --query id --output tsv)"
31+
export USER_ASSIGNED_IDENTITY_NAME="keda-int-identity"
32+
export FEDERATED_IDENTITY_CREDENTIAL_NAME="kedaFedIdentity"
33+
export SERVICE_ACCOUNT_NAMESPACE="keda"
34+
export SERVICE_ACCOUNT_NAME="keda-operator"
35+
```
36+
37+
1. If your AKS cluster hasn't been created with workload-identity or oidc-issuer enabled, you'll need to enable it. If you aren't sure, you can run the following command to check if it's enabled.
38+
39+
```azurecli
40+
az aks show --resource-group $RESOURCE_GROUP --name $AKS_CLUSTER_NAME --query oidcIssuerProfile
41+
az aks show --resource-group $RESOURCE_GROUP --name $AKS_CLUSTER_NAME --query securityProfile.workloadIdentity
42+
```
43+
44+
To enable workload identity and oidc-issuer, run the following command.
45+
46+
```azurecli
47+
az aks update -g $RESOURCE_GROUP -n $AKS_CLUSTER_NAME --enable-managed-identity --enable-oidc-issuer
48+
```
49+
50+
1. Store the OIDC issuer url in an environment variable to be used later.
51+
52+
```bash
53+
export AKS_OIDC_ISSUER="$(az aks show -n $CLUSTER_NAME -g $RESOURCE_GROUP --query "oidcIssuerProfile.issuerUrl" -otsv)"
54+
```
55+
56+
1. Create a user assigned identity for KEDA. This identity is used by KEDA to authenticate with Azure Monitor.
57+
58+
```azurecli
59+
az identity create --name $USER_ASSIGNED_IDENTITY_NAME --resource-group $RESOURCE_GROUP --location $LOCATION --subscription $SUBSCRIPTION
60+
```
61+
62+
The output will be similar to the following:
63+
64+
```json
65+
{
66+
"clientId": "abcd1234-abcd-abcd-abcd-9876543210ab",
67+
"id": "/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourcegroups/rg-keda-integration/providers/Microsoft. ManagedIdentity/userAssignedIdentities/keda-int-identity",
68+
"location": "eastus",
69+
"name": "keda-int-identity",
70+
"principalId": "12345678-abcd-abcd-abcd-1234567890ab",
71+
"resourceGroup": "rg-keda-integration",
72+
"systemData": null,
73+
"tags": {},
74+
"tenantId": "1234abcd-9876-9876-9876-abcdef012345",
75+
"type": "Microsoft.ManagedIdentity/userAssignedIdentities"
76+
}
77+
```
5578

56-
1. Create a user assigned identity for KEDA. This identity will be used by KEDA to authenticate with Azure Monitor.
57-
58-
```azurecli
59-
az identity create --name $USER_ASSIGNED_IDENTITY_NAME --resource-group $RESOURCE_GROUP --location $LOCATION --subscription $SUBSCRIPTION
60-
```
61-
62-
The output will be similar to the following:
63-
64-
```json
65-
{
66-
"clientId": "abcd1234-abcd-abcd-abcd-9876543210ab",
67-
"id": "/subscriptions/abcdef01-2345-6789-0abc-def012345678/resourcegroups/rg-keda-integration/providers/Microsoft.ManagedIdentity/userAssignedIdentities/keda-int-identity",
68-
"location": "eastus",
69-
"name": "keda-int-identity",
70-
"principalId": "12345678-abcd-abcd-abcd-1234567890ab",
71-
"resourceGroup": "rg-keda-integration",
72-
"systemData": null,
73-
"tags": {},
74-
"tenantId": "1234abcd-9876-9876-9876-abcdef012345",
75-
"type": "Microsoft.ManagedIdentity/userAssignedIdentities"
76-
}
77-
```
7879
1. Store the `clientId` and `tenantId` in environment variables to use later.
79-
```bash
80-
export USER_ASSIGNED_CLIENT_ID="$(az identity show --resource-group $RESOURCE_GROUP --name $USER_ASSIGNED_IDENTITY_NAME --query 'clientId' -otsv)"
81-
export TENANT_ID="$(az identity show --resource-group $RESOURCE_GROUP --name $USER_ASSIGNED_IDENTITY_NAME --query 'tenantId' -otsv)"
82-
```
83-
84-
1. Assign the *Monitoring Data Reader* role user to identity for your Azure Monitor workspace. This will allow KEDA to read metrics from you workspace.
85-
86-
```azurecli
87-
az role assignment create \
88-
--assignee $USER_ASSIGNED_CLIENT_ID \
89-
--role "Monitoring Data Reader" \
90-
--scope /subscriptions/$SUBSCRIPTION/resourceGroups/<Azure Monitor Workspace resource group>/providers/microsoft.monitor/accounts/<Azure monitor workspace name>
91-
```
92-
93-
94-
1. Create the KEDA namespace, then create Kubernetes service account. This service account will be used by KEDA to authenticate with Azure.
95-
96-
```azurecli
97-
98-
az aks get-credentials -n $CLUSTER_NAME -g $RESOURCE_GROUP
99-
100-
kubectl create namespace keda
80+
```bash
81+
export USER_ASSIGNED_CLIENT_ID="$(az identity show --resource-group $RESOURCE_GROUP --name $USER_ASSIGNED_IDENTITY_NAME --query 'clientId' -otsv)"
82+
export TENANT_ID="$(az identity show --resource-group $RESOURCE_GROUP --name $USER_ASSIGNED_IDENTITY_NAME --query 'tenantId' -otsv)"
83+
```
84+
85+
1. Assign the *Monitoring Data Reader* role to the identity for your Azure Monitor workspace. This role allows the identity to read metrics from your workspace.
86+
87+
```azurecli
88+
az role assignment create \
89+
--assignee $USER_ASSIGNED_CLIENT_ID \
90+
--role "Monitoring Data Reader" \
91+
--scope /subscriptions/$SUBSCRIPTION/resourceGroups/<Azure Monitor Workspace resource group>/providers/microsoft.monitor/accounts/ <Azure monitor workspace name>
92+
```
93+
94+
95+
1. Create the KEDA namespace, then create Kubernetes service account. This service account is used by KEDA to authenticate with Azure.
96+
97+
```azurecli
98+
99+
az aks get-credentials -n $CLUSTER_NAME -g $RESOURCE_GROUP
100+
101+
kubectl create namespace keda
102+
103+
cat <<EOF | kubectl apply -f -
104+
apiVersion: v1
105+
kind: ServiceAccount
106+
metadata:
107+
annotations:
108+
azure.workload.identity/client-id: $USER_ASSIGNED_CLIENT_ID
109+
name: $SERVICE_ACCOUNT_NAME
110+
namespace: $SERVICE_ACCOUNT_NAMESPACE
111+
EOF
112+
```
101113
102-
cat <<EOF | kubectl apply -f -
103-
apiVersion: v1
104-
kind: ServiceAccount
105-
metadata:
106-
annotations:
107-
azure.workload.identity/client-id: $USER_ASSIGNED_CLIENT_ID
108-
name: $SERVICE_ACCOUNT_NAME
109-
namespace: $SERVICE_ACCOUNT_NAMESPACE
110-
EOF
111-
```
112114
1. Check your service account by running
113-
```bash
114-
kubectl describe serviceaccount workload-identity-sa -n keda
115-
```
115+
```bash
116+
kubectl describe serviceaccount workload-identity-sa -n keda
117+
```
116118
117-
1. Establish the federated identity between the service account and the user assigned identity. This will allow the service account to use the user assigned identity to authenticate with Azure.
118-
119-
```azurecli
120-
az identity federated-credential create --name $FEDERATED_IDENTITY_CREDENTIAL_NAME --identity-name $USER_ASSIGNED_IDENTITY_NAME --resource-group $RESOURCE_GROUP --issuer $AKS_OIDC_ISSUER --subject system:serviceaccount:$SERVICE_ACCOUNT_NAMESPACE:$SERVICE_ACCOUNT_NAME --audience api://AzureADTokenExchange
121-
```
119+
1. Establish a federated credential between the service account and the user assigned identity. The federated credential allows the service account to use the user assigned identity to authenticate with Azure.
122120
121+
```azurecli
122+
az identity federated-credential create --name $FEDERATED_IDENTITY_CREDENTIAL_NAME --identity-name $USER_ASSIGNED_IDENTITY_NAME --resource-group $RESOURCE_GROUP --issuer $AKS_OIDC_ISSUER --subject system:serviceaccount:$SERVICE_ACCOUNT_NAMESPACE:$SERVICE_ACCOUNT_NAME --audience api://AzureADTokenExchange
123+
```
123124
124125
## Deploy KEDA
125126
126-
KEDA can be deployed using YAML manifests or Helm charts. This article will use Helm charts. For more information on deploying KEDA, see [Deploying KEDA](https://keda.sh/docs/2.10/deploy/)
127+
KEDA can be deployed using YAML manifests or Helm charts. This article uses Helm charts. For more information on deploying KEDA, see [Deploying KEDA](https://keda.sh/docs/2.10/deploy/)
127128
128129
1. Deply KEDA using the following command.
129130
130131
131-
```bash
132-
helm install keda kedacore/keda --namespace keda \
133-
--set podIdentity.azureWorkload.enabled=true \
134-
--set podIdentity.azureWorkload.clientId=$USER_ASSIGNED_CLIENT_ID \
135-
--set podIdentity.azureWorkload.tenantId=$TENANT_ID
136-
```
137-
132+
```bash
133+
helm install keda kedacore/keda --namespace keda \
134+
--set podIdentity.azureWorkload.enabled=true \
135+
--set podIdentity.azureWorkload.clientId=$USER_ASSIGNED_CLIENT_ID \
136+
--set podIdentity.azureWorkload.tenantId=$TENANT_ID
137+
```
138+
138139
1. Check your deployment by running the following command.
139-
```bash
140-
kubectl get pods -n keda
141-
```
142-
The outpout will be similar to the following:
143-
144-
```bash
145-
NAME READY STATUS RESTARTS AGE
146-
keda-admission-webhooks-ffcb8f688-kqlxp 1/1 Running 0 4m
147-
keda-operator-5d9f7d975-mgv7r 1/1 Running 1 (4m ago) 4m
148-
keda-operator-metrics-apiserver-7dc6f59678-745nz 1/1 Running 0 4m
149-
```
140+
```bash
141+
kubectl get pods -n keda
142+
```
143+
The output will be similar to the following:
144+
145+
```bash
146+
NAME READY STATUS RESTARTS AGE
147+
keda-admission-webhooks-ffcb8f688-kqlxp 1/1 Running 0 4m
148+
keda-operator-5d9f7d975-mgv7r 1/1 Running 1 (4m ago) 4m
149+
keda-operator-metrics-apiserver-7dc6f59678-745nz 1/1 Running 0 4m
150+
```
150151
151152
## Scalers
152153
153154
Scalers define how and when KEDA should scale a deployment. KEDA supports a variety of scalers. For more information on scalers, see [Scalers](https://keda.sh/docs/2.10/scalers/prometheus/)
154155
155156
The following yaml file defines a scaler.
156157
157-
The `serverAddress` is the Query endpoint of your Azure Monitor workspace. `metricName` is the name of the metric you want to scale on. The `query` is the query used to retrieve the metric. The `threshold` is the value at which the deployment will scale. Set thee `podIdentity.provider` according to the type of identity you are using.
158-
159158
```yml
160159
apiVersion: keda.sh/v1alpha1
161160
kind: TriggerAuthentication
@@ -186,17 +185,23 @@ spec:
186185
authenticationRef:
187186
name: azure-managed-prometheus-trigger-auth
188187
```
188+
+ `serverAddress` is the Query endpoint of your Azure Monitor workspace.
189+
+ `metricName` is the name of the metric you want to scale on.
190+
+ `query` is the query used to retrieve the metric.
191+
+ `threshold` is the value at which the deployment scales.
192+
+ Set the `podIdentity.provider` according to the type of identity you're using.
189193
190194
## Troubleshooting
191195
196+
The following section provides troubleshooting tips for common issues.
192197
193198
### Federated credentials
194199
195-
Federated credentials can take up to 10 minutes to propagate. If you are having issues with KEDA authenticating with Azure, try the following steps.
200+
Federated credentials can take up to 10 minutes to propagate. If you're having issues with KEDA authenticating with Azure, try the following steps.
196201
197202
The following log excerpt shows an error with the federated credentials.
198203
199-
```bash
204+
```
200205
kubectl logs -n keda keda-operator-5d9f7d975-mgv7r
201206
202207
{
@@ -214,12 +219,12 @@ Trace ID: 12dd9ea0-3a65-408f-a41f-5d0403a25100\\r\\nCorrelation ID: 8a2dce68-17f
214219
215220
Check the values used to create the ServiceAccount and the credentials created with `az identity federated-credential create` and ensure the `subject` value matches the `system:serviceaccount` value.
216221
217-
### Azure Monitor workspace persmissions
222+
### Azure Monitor workspace permissions
218223
219-
If you are having issues with KEDA authenticating with Azure, check the permissions for the Azure Monitor workspace.
220-
The following log excerpt shows that the identity does not have read permissions for the Azure Monitor workspace.
224+
If you're having issues with KEDA authenticating with Azure, check the permissions for the Azure Monitor workspace.
225+
The following log excerpt shows that the identity doesn't have read permissions for the Azure Monitor workspace.
221226
222-
```bash
227+
```
223228
kubectl logs -n keda keda-operator-5d9f7d975-mgv7r
224229
225230
2023-05-30T11:15:45Z ERROR scale_handler error getting metric for scaler

0 commit comments

Comments
 (0)