为什么我在Kubernetes中调整StatefulSet时出现API权限403报错？

错误原因 #

• Role配置字段错误：Kubernetes RBAC Role的权限规则字段为rules，你配置中误写为roles，导致全部权限规则未生效
• 缺少子资源权限：调整StatefulSet副本数调用的是statefulsets/scale子资源接口，原有配置仅授权了statefulsets主资源的操作权限，未覆盖子资源
• RoleBinding存在语法错误：subjects下的-kind缺少空格应为- kind，roleRef下的name字段缺少冒号分隔符应为name: server-controller，语法错误会导致RBAC绑定未正常创建

修复后的RBAC配置 #

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: server-controller
  namespace: code-server
rules:
  - apiGroups: ["apps"]
    resources:
      - statefulsets
      - statefulsets/scale
    verbs: ["update", "patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: server-controller
  namespace: code-server
subjects:
  - kind: ServiceAccount
    name: server-controller
    namespace: code-server
roleRef:
  kind: Role
  name: server-controller
  apiGroup: rbac.authorization.k8s.io

将上述配置重新apply到集群后，原有Python代码即可正常执行。

内容的提问来源于stack exchange，提问作者J. Ike