<p>I'm trying to scale up &amp; down deployments from within a pod.<br />
To do that, I've created a service account, clusterrolebinding with the following rbac:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  namespace: backups-scripts
  name: backups-roles
rules:
  - apiGroups: [&quot;&quot;]
    resources:
      - pods
    verbs:
      - get
      - list
      - delete
      - watch
  - apiGroups: [&quot;apps&quot;,&quot;extensions&quot;]
    resources:
      - deployments
      - replicasets
      - statefulsets
    verbs:
      - get
      - list
      - patch
      - update
      - watch
      - scale

</code></pre>
<p>When testing with <code>auth can-i</code> kube say everything is ok:</p>
<pre class="lang-sh prettyprint-override"><code>$ kubectl auth can-i delete deployment  --namespace vm-catalogue --as system:serviceaccount:backups-scripts:backups-sa
no - no RBAC policy matched
$ kubectl auth can-i list deployment  --namespace vm-catalogue --as system:serviceaccount:backups-scripts:backups-sa
yes
$ kubectl auth can-i scale deployment  --namespace vm-catalogue --as system:serviceaccount:backups-scripts:backups-sa
yes
$ kubectl auth can-i update deployment  --namespace vm-catalogue --as system:serviceaccount:backups-scripts:backups-sa
yes
$ kubectl auth can-i patch deployment  --namespace vm-catalogue --as system:serviceaccount:backups-scripts:backups-sa
yes
</code></pre>
<p>But now when within the pod the kubectl command is executed I get the following error:</p>
<pre class="lang-sh prettyprint-override"><code>$ kubectl scale --replicas=&quot;$replicas&quot; deployment -n &quot;vm-catalogue&quot; &quot;mysql&quot;
 Error from server (Forbidden): deployments.extensions &quot;mysql&quot; is forbidden: User &quot;system:serviceaccount:backups-scripts:backups-sa&quot; cannot get resource &quot;deployments/scale&quot; in API group &quot;extensions&quot; in the namespace &quot;vm-catalogue&quot;
</code></pre>
<p>I known the &quot;list&quot; and &quot;get&quot; verbs works because I'm extracting those information within the script (and that part works).</p>
<p>So.. I don't get it, what did I missed?</p>

<p>I think the error message you pasted suggests it well:</p>
<pre><code>$ kubectl scale --replicas=&quot;$replicas&quot; deployment -n &quot;vm-catalogue&quot; &quot;mysql&quot;
 Error from server (Forbidden): deployments.extensions &quot;mysql&quot; is forbidden: User &quot;system:serviceaccount:backups-scripts:backups-sa&quot; cannot get resource &quot;deployments/scale&quot; in API group &quot;extensions&quot; in the namespace &quot;vm-catalogue&quot;
</code></pre>
<p><strong>cannot get resource &quot;deployments/scale&quot;</strong></p>
<p>According to <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#referring-to-resources" rel="nofollow noreferrer">Kubernetes rbac docs #referring to resources</a></p>
<p><strong>&quot;To represent this in an RBAC role, use a slash (/) to delimit the resource and subresource&quot;</strong>.</p>
<p>Such as:</p>
<pre><code>- deployments/scale
- deployments/status
- pods/log
</code></pre>
