为什么会有Kubernetes api权限问题？

Question

我有一个python脚本，它试图从pod内部扩展statefulset，但是从API服务器得到一个禁止的错误。下面的yml文件显示了我的角色和角色绑定：

apiVersion: rbac.authorization.k8s.io/v1
Kind: Role
metadata:
  name: server-controller
  namespace: code-server
roles:
  - apiGroups: ["*"]
    resources:
      - statefulsets
    verbs: ["update", "patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
Kind: RoleBinding
metadata:
  name: server-controller
  namespace: code-server
subjects:
  -kind: ServiceAccount
   name: server-controller
   namespace: code-server
roleRef:
  kind: Role
  name server-controller
  apiGroup: rbac.authorization.k8s.io

下面的python代码片段显示了我对API的访问权限：

kubernetes.config.load_incluster_config()
app = kubernetes.client.AppsV1Api()
body = {"spec": {"replicas": 1}}
app.patch_namespaced_stateful_set_scale(
      name="jim",
      namespace="code-server",
      body=body)

我得到以下错误：

kubernetes.client.exceptions.ApiException: (403)
Reason: Forbidden
HTTP response headers: HTTPHeaderDict({'Cache-Control': 'no-cache", 'Content-Type': 'application/json', 'X-Content-Type-Options': 'nosniff', 'Date': 'Fri, 15 Oct 2021 15:25:24 GMT', 'Content-Length': '469'})
HTTP response Body: {
   "kind": "Status",
   "apiVersion": "v1"
   "metadata": {

    }
   "status": "Failure",
   "message": "statefulsets.apps \"jim\" is forbidden: User \"system:serviceaccount:code-server:server-controller\" cannot patch resource \"statefulsets/scale\" in API group \"apps\" in the namespace \"code-server\"",
   "reason": "Forbidden",
   "details": {
     "name": "jim",
     "group": "apps",
     "kind": "statefulesets"
   }
   "code": 403
}

Answer 1

解决方案是将“角色”下“资源”字段中的"statefulsets“更改为"statefulsets/scale”。