Why do I have a Kubernetes api permission problem? - api

Question

I have a python script that tries to scale a statefulset from inside a pod, but get a forbidden error from the API server. The following yml file shows my role and rolebinding:
apiVersion: rbac.authorization.k8s.io/v1
Kind: Role
metadata:
name: server-controller
namespace: code-server
roles:
- apiGroups: ["*"]
resources:
- statefulsets
verbs: ["update", "patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
Kind: RoleBinding
metadata:
name: server-controller
namespace: code-server
subjects:
-kind: ServiceAccount
name: server-controller
namespace: code-server
roleRef:
kind: Role
name server-controller
apiGroup: rbac.authorization.k8s.io
The following python code snippet shows my access to the API:
kubernetes.config.load_incluster_config()
app = kubernetes.client.AppsV1Api()
body = {"spec": {"replicas": 1}}
app.patch_namespaced_stateful_set_scale(
name="jim",
namespace="code-server",
body=body)
I get the following error:
kubernetes.client.exceptions.ApiException: (403)
Reason: Forbidden
HTTP response headers: HTTPHeaderDict({'Cache-Control': 'no-cache", 'Content-Type': 'application/json', 'X-Content-Type-Options': 'nosniff', 'Date': 'Fri, 15 Oct 2021 15:25:24 GMT', 'Content-Length': '469'})
HTTP response Body: {
"kind": "Status",
"apiVersion": "v1"
"metadata": {
}
"status": "Failure",
"message": "statefulsets.apps \"jim\" is forbidden: User \"system:serviceaccount:code-server:server-controller\" cannot patch resource \"statefulsets/scale\" in API group \"apps\" in the namespace \"code-server\"",
"reason": "Forbidden",
"details": {
"name": "jim",
"group": "apps",
"kind": "statefulesets"
}
"code": 403
}

Answer 1

The solution was to change "statefulsets" to "statefulsets/scale" in the "resources" field under "role".