diff --git a/CHANGELOG.md b/CHANGELOG.md index 017386a2c3e..51ee6491c19 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -56,6 +56,7 @@ To learn more about active deprecations, we recommend checking [GitHub Discussio ### Fixes +- **AWS Pod Identity Authentication**: Use `default` service account if the workload doesn't set it ([#4767](https://github.com/kedacore/keda/issues/4767)) - **Pulsar Scaler**: Fix `msgBacklogThreshold` field being named wrongly as `msgBacklog` ([#4681](https://github.com/kedacore/keda/issues/4681)) ### Deprecations diff --git a/pkg/scaling/resolver/scale_resolvers.go b/pkg/scaling/resolver/scale_resolvers.go index d21a273c2ce..9d18eeb20c0 100644 --- a/pkg/scaling/resolver/scale_resolvers.go +++ b/pkg/scaling/resolver/scale_resolvers.go @@ -39,11 +39,12 @@ import ( ) const ( - referenceOperator = '$' - referenceOpener = '(' - referenceCloser = ')' - boolTrue = true - boolFalse = false + referenceOperator = '$' + referenceOpener = '(' + referenceCloser = ')' + boolTrue = true + boolFalse = false + defaultServiceAccount = "default" ) var ( @@ -181,7 +182,10 @@ func ResolveAuthRefAndPodIdentity(ctx context.Context, client client.Client, log authParams, podIdentity := resolveAuthRef(ctx, client, logger, triggerAuthRef, &podTemplateSpec.Spec, namespace, secretsLister) if podIdentity.Provider == kedav1alpha1.PodIdentityProviderAwsEKS { - serviceAccountName := podTemplateSpec.Spec.ServiceAccountName + serviceAccountName := defaultServiceAccount + if podTemplateSpec.Spec.ServiceAccountName != "" { + serviceAccountName = podTemplateSpec.Spec.ServiceAccountName + } serviceAccount := &corev1.ServiceAccount{} err := client.Get(ctx, types.NamespacedName{Name: serviceAccountName, Namespace: namespace}, serviceAccount) if err != nil { diff --git a/tests/scalers/aws/aws_cloudwatch_pod_identity/aws_cloudwatch_pod_identity_test.go b/tests/scalers/aws/aws_cloudwatch_pod_identity/aws_cloudwatch_pod_identity_test.go index 0a2c832cb99..14aaf920365 100644 --- a/tests/scalers/aws/aws_cloudwatch_pod_identity/aws_cloudwatch_pod_identity_test.go +++ b/tests/scalers/aws/aws_cloudwatch_pod_identity/aws_cloudwatch_pod_identity_test.go @@ -71,7 +71,6 @@ spec: labels: app: {{.DeploymentName}} spec: - serviceAccountName: default containers: - name: nginx image: nginxinc/nginx-unprivileged diff --git a/tests/scalers/aws/aws_dynamodb_pod_identity/aws_dynamodb_pod_identity_test.go b/tests/scalers/aws/aws_dynamodb_pod_identity/aws_dynamodb_pod_identity_test.go index 19cfdba5c89..c39d9bb223f 100644 --- a/tests/scalers/aws/aws_dynamodb_pod_identity/aws_dynamodb_pod_identity_test.go +++ b/tests/scalers/aws/aws_dynamodb_pod_identity/aws_dynamodb_pod_identity_test.go @@ -73,7 +73,6 @@ spec: labels: app: {{.DeploymentName}} spec: - serviceAccountName: default containers: - name: nginx image: nginxinc/nginx-unprivileged diff --git a/tests/scalers/aws/aws_dynamodb_streams_pod_identity/aws_dynamodb_streams_pod_identity_test.go b/tests/scalers/aws/aws_dynamodb_streams_pod_identity/aws_dynamodb_streams_pod_identity_test.go index 0c0547d34d5..de5dc1017d6 100644 --- a/tests/scalers/aws/aws_dynamodb_streams_pod_identity/aws_dynamodb_streams_pod_identity_test.go +++ b/tests/scalers/aws/aws_dynamodb_streams_pod_identity/aws_dynamodb_streams_pod_identity_test.go @@ -79,7 +79,6 @@ spec: labels: app: {{.DeploymentName}} spec: - serviceAccountName: default containers: - name: nginx image: nginxinc/nginx-unprivileged diff --git a/tests/scalers/aws/aws_kinesis_stream_pod_identity/aws_kinesis_stream_pod_identity_test.go b/tests/scalers/aws/aws_kinesis_stream_pod_identity/aws_kinesis_stream_pod_identity_test.go index 40b48dcef07..07d54c02d14 100644 --- a/tests/scalers/aws/aws_kinesis_stream_pod_identity/aws_kinesis_stream_pod_identity_test.go +++ b/tests/scalers/aws/aws_kinesis_stream_pod_identity/aws_kinesis_stream_pod_identity_test.go @@ -69,7 +69,6 @@ spec: labels: app: {{.DeploymentName}} spec: - serviceAccountName: default containers: - name: nginx image: nginxinc/nginx-unprivileged diff --git a/tests/scalers/aws/aws_sqs_queue_pod_identity/aws_sqs_queue_pod_identity_test.go b/tests/scalers/aws/aws_sqs_queue_pod_identity/aws_sqs_queue_pod_identity_test.go index 2c63e1c54d2..01e8daaebc3 100644 --- a/tests/scalers/aws/aws_sqs_queue_pod_identity/aws_sqs_queue_pod_identity_test.go +++ b/tests/scalers/aws/aws_sqs_queue_pod_identity/aws_sqs_queue_pod_identity_test.go @@ -68,7 +68,6 @@ spec: labels: app: {{.DeploymentName}} spec: - serviceAccountName: default containers: - name: nginx image: nginxinc/nginx-unprivileged