Rabbitmq scaler with TLS enabled trigger not working for passwordless authentication

[jpulgar4]

Report

I have a Rabbitmq trigger configured with TLS. In our Rabbitmq setup we use TLS with passwordless auth, we extract the username from the CommonName field in the client certificate, thus our username is CN=username. We have the following setup:

apiVersion: keda.sh/v1alpha1
kind: ScaledObject
metadata:
  name: queue-consumers-scaledobject
  namespace: ml-serving
spec:
  scaleTargetRef:
    name: queue-consumers
  pollingInterval: 5
  cooldownPeriod: 60
  maxReplicaCount: 10
  minReplicaCount: 1
  triggers:
    - type: rabbitmq
      metadata:
        protocol: auto
        queueName: queue_name
        mode: QueueLength
        value: "1"
        tls: enable
      authenticationRef:
        name: rabbitmq-trigger-auth
---
apiVersion: v1
kind: Secret
metadata:
  name: keda-rabbitmq-secret
data:
  host: "amqps://CN=username@rabbit.namespace.svc:5671/" # Also tried without username to no avail.
  tls: "enable"
  ca: <our ca>
  cert: <our cert>
  key: <our key>
---
apiVersion: keda.sh/v1alpha1
kind: TriggerAuthentication
metadata:
  name: rabbitmq-trigger-auth
  namespace: ml-serving
spec:
  secretTargetRef:
    - parameter: host
      name: keda-rabbitmq-secret
      key: host
    - parameter: tls
      name: keda-rabbitmq-secret
      key: tls
    - parameter: ca
      name: keda-rabbitmq-secret
      key: ca
    - parameter: cert
      name: keda-rabbitmq-secret
      key: cert
    - parameter: key
      name: keda-rabbitmq-secret
      key: key

Expected Behavior

We expect the ScaledObject and the TriggerAuthentication to connect properly using External authentication methods in our Rabbitmq cluster and authenticate properly via TLS.

Actual Behavior

The ScaledObject refuses to connect using username and password instead of TLS authentication.

Warning KEDAScalerFailed ScaledObject/*** error establishing rabbitmq connection: Exception (403) Reason: "username or password not allowed"

Steps to Reproduce the Problem

1. Enable TLS and passwordless authentication to a Rabbitmq user in the cluster
2. Install the Keda objects above
3. Try to connect the rabbitmq Trigger and TriggerAuthentication using AMQPS

Logs from KEDA operator

2025-06-16T14:30:18Z    ERROR   Reconciler error        {"controller": "scaledobject", "controllerGroup": "keda.sh", "controllerKind": "ScaledObject", "ScaledObject": {"name":"***","namespace":"apps"}, "namespace": "apps", "name": "***", "reconcileID": "675f4b11-429d-4e91-9ae3-6cedf29b1d8b", "error": "error establishing rabbitmq connection: Exception (403) Reason: \"username or password not allowed\""}
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler
        /workspace/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:316
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem
        /workspace/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:263
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.2
        /workspace/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:224

KEDA Version

2.17.0

Kubernetes Version

1.31

Platform

Amazon Web Services

Scaler Details

Rabbitmq with TLS

Anything else?

No response

[JorTurFer]

Hello
Do you get any error or info on the RabbitMQ side? Currently, KEDA is using the host that you provide:

keda/pkg/scalers/rabbitmq_scaler.go

Lines 336 to 345 in 967c5d6

	if meta.EnableTLS == rmqTLSEnable {
	tlsConfig, err := kedautil.NewTLSConfigWithPassword(meta.Cert, meta.Key, meta.KeyPassword, meta.Ca, meta.UnsafeSsl)
	if err != nil {
	return nil, nil, err
	}
	amqpConfig.TLSClientConfig = tlsConfig
	}
	conn, err := amqp.DialConfig(host, amqpConfig)

As you don't provide user password, no modification to host are done:

keda/pkg/scalers/rabbitmq_scaler.go

Lines 274 to 294 in 967c5d6

	if meta.Protocol == amqpProtocol {
	// Override vhost if requested.
	host := meta.Host
	if meta.VhostName != "" || (meta.Username != "" && meta.Password != "") {
	hostURI, err := amqp.ParseURI(host)
	if err != nil {
	return nil, fmt.Errorf("error parsing rabbitmq connection string: %w", err)
	}
	if meta.VhostName != "" {
	hostURI.Vhost = meta.VhostName
	}
	if meta.Username != "" && meta.Password != "" {
	hostURI.Username = meta.Username
	hostURI.Password = meta.Password
	}
	host = hostURI.String()
	}
	conn, ch, err := getConnectionAndChannel(host, meta)

Does your passwordless approach requires something else than the certificate or it's just a mTLS authentication?

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 7 days if no further activity occurs. Thank you for your contributions.

[stale]

This issue has been automatically closed due to inactivity.

[jpulgar4]

@JorTurFer On the Rabbitmq server I get the following error when attempting to use the host string amqps://CN=username@rabbit.namespace.svc:5671/

Error on AMQP connection <0.2124090.0> (10.244.0.39:60858 -> 10.244.0.72:5671, state: starting):
PLAIN login refused: User 'CN=username' authentication failed with internal error. Enable debug logs to see the real error.

and my ScaledObject reports:

  Warning  ScaledObjectCheckFailed  5m8s (x12 over 5m51s)   keda-operator  failed to ensure HPA is correctly created for ScaledObject
  Warning  KEDAScalerFailed         4m54s (x13 over 5m51s)  keda-operator  error establishing rabbitmq connection: Exception (403) Reason: "username or password not allowed"

We have the rabbitmq_auth_mechanism_ssl rabbitmq auth plugin to authenticate via Certificate and we extract the username from the commonName property in the certificate, hence why we use CN=username as the actual username.

[JorTurFer]

is the username required on your side? Based on the code I sent, the username isn't added if the password is empty, so it can be a problem if your user is required