Set up event-driven auto scaling in Amazon EKS by using Amazon EKS Pod Identity and KEDA

Sign in to the AWS Management Console, and then open the IAM console.

In the navigation pane, choose Roles.

Choose Create role.

Choose the Custom trust policy role type.

In the Custom trust policy section, enter the following custom trust policy for this role:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "pods.eks.amazonaws.com"
            },
            "Action": [
                "sts:AssumeRole",
                "sts:TagSession"
            ]
        }
    ]
}

On the Add permissions page, choose Next. You do not add any policies to this role.

For Role name, enter keda-operator.

Choose Create role.

In the IAM console, in the navigation pane, choose Roles.

Choose Create role.

Choose the Custom trust policy role type.

In the Custom trust policy section, enter the following custom trust policy for this role. Replace <account number> with your target account number:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "pods.eks.amazonaws.com",
                "AWS": "arn:aws:iam::<account number>:role/keda-operator"
            },
            "Action": [
                "sts:AssumeRole",
                "sts:TagSession"
            ]
        }
    ]
}

On the Add permissions page, add the following AWS managed polices to the role:

Choose Next.

For Role name, enter keda-identity.

Choose Create role.

Open the Amazon SQS console.

Choose Create queue.

For Type, choose Standard.

On Create queue page, for Name, enter event-messages-queue.

Choose Create queue. You do not change any of the default settings for this queue.

Open the Amazon ECR console.

Choose Create repository.

For Repository name, enter keda-pod-identity-registry.

Choose Create repository. You do not change any of the default settings for this repository.

Enter the following commands to deploy KEDA on the target Amazon EKS cluster:

# Add Helm Repo for Keda
helm repo add kedacore https://kedacore.github.io/charts
# Update Helm repo
helm repo update
# Install Keda
helm install keda kedacore/keda --namespace keda --create-namespace

For more information, see Deploying with Helm in the KEDA documentation.

After successful deployment, in the output, validate that three deployments are created for the KEDA operator. The following is a sample output:

NAME                              READY   UP-TO-DATE   AVAILABLE   AGE
keda-admission-webhooks           1/1     1            1           89s
keda-operator                     1/1     1            1           89s
keda-operator-metrics-apiserver   1/1     1            1           89s

Enter the following command to navigate into the cloned repository:

cd event-driven-autoscaling-using-podidentity-and-keda

Enter the following command to build the Docker image for the sample application:

docker build -t keda-pod-identity-registry .

In the terminal where you built the Docker image, enter the following command to log in to Amazon ECR. Replace <AWS_REGION> and <AWS_ACCOUNT_ID> with values from your AWS environment:

aws ecr get-login-password \
   --region <AWS_REGION> | docker login \
   --username AWS \
   --password-stdin <AWS_ACCOUNT_ID>.dkr.ecr.<AWS_REGION>.amazonaws.com

Enter the following command to tag the image. Replace <AWS_REGION> and <AWS_ACCOUNT_ID> with values from your AWS environment:

docker tag keda-pod-identity-registry:latest <AWS_ACCOUNT_ID>.dkr.ecr.<AWS_REGION>.amazonaws.com/keda-pod-identity-registry:latest

Enter the following command to push the image to Amazon ECR. Replace <AWS_REGION> and <AWS_ACCOUNT_ID> with values from your AWS environment:

docker push <AWS_ACCOUNT_ID>.dkr.ecr.<AWS_REGION>.amazonaws.com/keda-pod-identity-registry:latest

In the cloned repository, open the deploy.yaml file.

Replace <AWS_ACCOUNT_ID> and <AWS_REGION> with values from your environment.

Save and close the deploy.yaml file.

Enter the following command to deploy the sample application on the target Amazon EKS cluster:

kubectl apply -f deploy.yaml

This command creates a deployment and service account in the cluster.

In the cloned repository, open the keda.yaml file.

Replace {{AWS_ACCOUNT_ID}} with the ID of your target AWS account.

Replace {{AWS_REGION}} with your target AWS Region.

(Optional) In lines 21–24, update the parameters for the ScaledObject scaling policy. See the following for more information about these parameters:

Save and close the keda.yaml file.

Enter the following command to deploy the ScaledObject and TriggerAuthentication resources:

kubectl -n security apply -f keda.yaml

Enter the following command to navigate into the cloned repository:

cd event-driven-autoscaling-using-podidentity-and-keda

Enter the following command to send test messages to the Amazon SQS queue:

python sqs_send_msg.py

The sqs_send_msg.py script acts as an application that generates messages for testing auto scaling.

In different terminal, enter the following command to monitor the pods:

kubectl -n security get po 

For every 5 unread messages in the Amazon SQS queue, KEDA adds one pod. In the output of the previous command, confirm that new pods are being added. The following is a sample output:

kubectl -n security get po
NAME                      READY   STATUS    RESTARTS   AGE
q-read-797f4c7589-2bj76   1/1     Running   0          2s
q-read-797f4c7589-4zxph   1/1     Running   0          49s
q-read-797f4c7589-cg9dt   1/1     Running   0          18s
q-read-797f4c7589-slc69   1/1     Running   0          33s

When you are finished testing, in the original terminal, enter CTRL + C (Windows) or CMD + C (macOS). This stops the python sqs_send_msg.py script.