<p>I want to run patching of statefulsets for a specific use case from a Pod via a cronjob. To do so I created the following plan with a custom service account, role and rolebinding to permit the Pod access to the apps api group with the patch verb but I keep running into the following error:</p>
<pre><code>Error from server (Forbidden): statefulsets.apps &quot;test-statefulset&quot; is forbidden: User &quot;system:serviceaccount:test-namespace:test-serviceaccount&quot; cannot get resource &quot;statefulsets&quot; in API group &quot;apps&quot; in the namespace &quot;test-namespace&quot;
</code></pre>
<p>my k8s plan:</p>
<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    env: test
  name: test-serviceaccount
  namespace: test-namespace
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    env: test
  name: test-role
  namespace: test-namespace
rules:
- apiGroups:
  - apps/v1
  resourceNames:
  - test-statefulset
  resources:
  - statefulsets
  verbs:
  - patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
  name: test-binding
  namespace: test-namespace
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: test-role
subjects:
- kind: ServiceAccount
  name: test-serviceaccount
  namespace: test-namespace
---
apiVersion: batch/v1beta1
kind: CronJob
metadata:
  labels:
  name:test-job
  namespace: test-namespace
spec:
  concurrencyPolicy: Forbid
  failedJobsHistoryLimit: 3
  jobTemplate:
    metadata:
      labels:
        env: test
    spec:
      activeDeadlineSeconds: 900
      backoffLimit: 1
      parallelism: 1
      template:
        metadata:
          labels:
            env: test
        spec:
          containers:
          - args:
            - kubectl -n test-namespace patch statefulset test-statefulset -p '{&quot;spec&quot;:{&quot;replicas&quot;:0}}'
            - kubectl -n test-namespace patch statefulset test-statefulset -p '{&quot;spec&quot;:{&quot;replicas&quot;:1}}'
            command:
            - /bin/sh
            - -c
            image: bitnami/kubectl
          restartPolicy: Never
          serviceAccountName: test-serviceaccount
  schedule: '*/5 * * * *'
  startingDeadlineSeconds: 300
  successfulJobsHistoryLimit: 3
  suspend: false
</code></pre>
<p>So far to debug:</p>
<ol>
<li><p>I have checked if the pod and serviceaccount association worked as expected and it looks like it did. I see the name of secret mounted on the Pod the cronjob starts is correct.</p>
</li>
<li><p>Used a simpler role where apiGroups was &quot;&quot; i.e. all core groups and tried to &quot;get pods&quot; from that pod, same error</p>
</li>
</ol>
<p>role description:</p>
<pre><code>Name:         test-role
Labels:       env=test
Annotations:  &lt;none&gt;
PolicyRule:
  Resources             Non-Resource URLs  Resource Names   Verbs
  ---------             -----------------  --------------   -----
  statefulsets.apps/v1  []                 [test-statefulset]  [patch]
</code></pre>
<p>rolebinding description:</p>
<pre><code>Name:         test-binding
Labels:       env=test
Annotations:  &lt;none&gt;
Role:
  Kind:  Role
  Name:  test-role
Subjects:
  Kind            Name                Namespace
  ----            ----                ---------
  ServiceAccount  test-serviceaccount  test-namespace
</code></pre>

<p>Stateful sets need two verbs to apply a patch :
GET and PATCH. PATCH alone wont work</p>
