<p>I have a pod in my EKS cluster and I want to edit it's yaml so that I can change the <code>read-only</code> values from <code>true</code> to <code>false</code> . This way I want to be able to make changes to the pod's system/image (haven't exactly figured out it's name) that at the moment it <code>read-only file system</code>.</p>

<p>Is that possible ? Can I do that ? </p>

<p>I tried copying the current yaml contents and creating a new yaml file with the read-only values setted to false ,in order to use it as a replacement for the current one. </p>

<p>The command I tried to use is:</p>

<pre><code>kubectl apply -f telegraf-new.yaml  --namespace examplenamespace -l app=polling-telegraf-s
</code></pre>

<p>and the error I get is:</p>

<blockquote>
  <p>Warning: kubectl apply should be used on resource created by either kubectl create --save-config or kubectl apply
  The Pod "polling-telegraf-s-79f44d578f-khdjf" is invalid: spec: Forbidden: pod updates may not change fields other than <code>spec.containers[*].image</code>, <code>spec.initContainers[*].image</code>, <code>spec.activeDeadlineSeconds</code> or <code>spec.tolerations</code> (only additions to existing tolerations)</p>
</blockquote>

<p>I am not sure that this is a good way to approach my problem but I spend the last few days researching about it and the results are not so encouraging.<br> 
Any help,tip,advice to the correct direction would be appreciated.</p>

<p>Edit: <br>
My yaml from the <code>kubectl get pod --namespace tick -l app=polling-telegraf-s -o yaml</code> is : <br></p>

<pre><code>apiVersion: v1
items:
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      checksum/config: 45cc44098254d90e88878e037f6eb5803be739890e26d9070e21ac0c0650debd
      kubectl.kubernetes.io/last-applied-configuration: |
        {"apiVersion":"v1","kind":"Pod","metadata":{"annotations":{"checksum/config":"45cc44098254d90e88878e037f6eb5803be739890e26d9070e21ac0c0650debd","kubernetes.io/psp":"eks.privileged"},"creationTimestamp":"2019-10-30T15:49:57Z","generateName":"polling-telegraf-s-79f44d578f-","labels":{"app":"polling-telegraf-s","pod-template-hash":"79f44d578f"},"name":"polling-telegraf-s-79f44d578f-khdjf","namespace":"tick","ownerReferences":[{"apiVersion":"apps/v1","blockOwnerDeletion":true,"controller":true,"kind":"ReplicaSet","name":"polling-telegraf-s-79f44d578f","uid":"ec1e6988-fb2c-11e9-bdf2-02b7fbdf557a"}],"resourceVersion":"134887","selfLink":"/api/v1/namespaces/tick/pods/polling-telegraf-s-79f44d578f-khdjf","uid":"ec1fa8a5-fb2c-11e9-bdf2-02b7fbdf557a"},"spec":{"containers":[{"image":"telegraf:1.10.3-alpine","imagePullPolicy":"IfNotPresent","name":"polling-telegraf-s","resources":{"limits":{"cpu":"1","memory":"2Gi"},"requests":{"cpu":"100m","memory":"256Mi"}},"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File","volumeMounts":[{"mountPath":"/etc/telegraf","name":"config"},{"mountPath":"/var/run/utmp","name":"varrunutmpro","readOnly":true},{"mountPath":"/var/run/secrets/kubernetes.io/serviceaccount","name":"default-token-htxsr","readOnly":true}]}],"dnsPolicy":"ClusterFirst","enableServiceLinks":true,"nodeName":"ip-192-168-179-5.eu-west-2.compute.internal","priority":0,"restartPolicy":"Always","schedulerName":"default-scheduler","securityContext":{},"serviceAccount":"default","serviceAccountName":"default","terminationGracePeriodSeconds":30,"tolerations":[{"effect":"NoExecute","key":"node.kubernetes.io/not-ready","operator":"Exists","tolerationSeconds":300},{"effect":"NoExecute","key":"node.kubernetes.io/unreachable","operator":"Exists","tolerationSeconds":300}],"volumes":[{"hostPath":{"path":"/var/run/utmp","type":""},"name":"varrunutmpro"},{"configMap":{"defaultMode":420,"name":"polling-telegraf-s"},"name":"config"},{"name":"default-token-htxsr","secret":{"defaultMode":420,"secretName":"default-token-htxsr"}}]},"status":{"conditions":[{"lastProbeTime":null,"lastTransitionTime":"2019-10-30T15:49:57Z","status":"True","type":"Initialized"},{"lastProbeTime":null,"lastTransitionTime":"2019-10-30T15:49:58Z","status":"True","type":"Ready"},{"lastProbeTime":null,"lastTransitionTime":"2019-10-30T15:49:58Z","status":"True","type":"ContainersReady"},{"lastProbeTime":null,"lastTransitionTime":"2019-10-30T15:49:57Z","status":"True","type":"PodScheduled"}],"containerStatuses":[{"containerID":"docker://a66f40111474ea28d1b1b7adf6d9e0278adb6d6aefa23b345cc1559174018f27","image":"telegraf:1.10.3-alpine","imageID":"docker-pullable://telegraf@sha256:9106295bc67459633b4d6151c2e1b9949e501560b2e659fe541bda691c566bcf","lastState":{},"name":"polling-telegraf-s","ready":true,"restartCount":0,"state":{"running":{"startedAt":"2019-10-30T15:49:58Z"}}}],"hostIP":"192.168.179.5","phase":"Running","podIP":"192.168.159.179","qosClass":"Burstable","startTime":"2019-10-30T15:49:57Z"}}
      kubernetes.io/psp: eks.privileged
    creationTimestamp: "2019-10-30T15:49:57Z"
    generateName: polling-telegraf-s-79f44d578f-
    labels:
      app: polling-telegraf-s
      pod-template-hash: 79f44d578f
    name: polling-telegraf-s-79f44d578f-khdjf
    namespace: tick
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: polling-telegraf-s-79f44d578f
      uid: ec1e6988-fb2c-11e9-bdf2-02b7fbdf557a
    resourceVersion: "409255"
    selfLink: /api/v1/namespaces/tick/pods/polling-telegraf-s-79f44d578f-khdjf
    uid: ec1fa8a5-fb2c-11e9-bdf2-02b7fbdf557a
  spec:
    containers:
    - image: telegraf:1.10.3-alpine
      imagePullPolicy: IfNotPresent
      name: polling-telegraf-s
      resources:
        limits:
          cpu: "1"
          memory: 2Gi
        requests:
          cpu: 100m
          memory: 256Mi
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /etc/telegraf
        name: config
      - mountPath: /var/run/utmp
        name: varrunutmpro
        readOnly: true
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: default-token-htxsr
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    nodeName: ip-192-168-179-5.eu-west-2.compute.internal
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext: {}
    serviceAccount: default
    serviceAccountName: default
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    volumes:
    - hostPath:
        path: /var/run/utmp
        type: ""
      name: varrunutmpro
    - configMap:
        defaultMode: 420
        name: polling-telegraf-s
      name: config
    - name: default-token-htxsr
      secret:
        defaultMode: 420
        secretName: default-token-htxsr
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2019-10-30T15:49:57Z"
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2019-10-30T15:49:58Z"
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2019-10-30T15:49:58Z"
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2019-10-30T15:49:57Z"
      status: "True"
      type: PodScheduled
    containerStatuses:
    - containerID: docker://a66f40111474ea28d1b1b7adf6d9e0278adb6d6aefa23b345cc1559174018f27
      image: telegraf:1.10.3-alpine
      imageID: docker-pullable://telegraf@sha256:9106295bc67459633b4d6151c2e1b9949e501560b2e659fe541bda691c566bcf
      lastState: {}
      name: polling-telegraf-s
      ready: true
      restartCount: 0
      state:
        running:
          startedAt: "2019-10-30T15:49:58Z"
    hostIP: 192.168.179.5
    phase: Running
    podIP: 192.168.159.179
    qosClass: Burstable
    startTime: "2019-10-30T15:49:57Z"
kind: List
metadata:
  resourceVersion: ""
  selfLink: ""
</code></pre>

<p>and I want to change the <code>readOnly</code> values from true to false . </p>

<p>You can edit a kubernetes resource yaml using the command <code>kubectl edit [resource] [UID]</code>. For instance, to change the yaml of a pod, you would run <code>kubectl edit $POD_UID</code></p>

<p>However this won't work in your case because you are editing a <code>mount</code> and that requires the <code>pod</code> to be restarted. In this sense, the best approach would be what you already did. Start by extracting the yaml from the api by running <code>kubectl get pod $POD_UID -o yaml</code> and then editing its content to deploy it again. However as the error depicts, you are not allowed to edit some parts of the yaml. So you have to remove those parts. </p>

<p>Only keep the parts that the log has already pointed to: <code>spec.containers[*].image, spec.initContainers[*].image, spec.activeDeadlineSeconds or spec.tolerations</code></p>

<p>Otherwise, here are the sections you would have to remove:</p>

<pre><code>metadata:
  creationTimestamp: 2019-11-01T13:22:50Z
  generateName:
  ownerReferences:
  - apiVersion: apps/v1
    blockOwnerDeletion: true
    controller: true
    kind: ReplicaSet
    name:
    uid: 947fb7b7-f1ab-11e9-adfb-42010a8001b2
  resourceVersion: "103002009"
  selfLink:
  uid: b3f96ba4-fcaa-11e9-adfb-42010a8001b2
spec:
    terminationMessagePath: /dev/termination-log
    terminationMessagePolicy: File
    volumeMounts:
    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      name: default-token-ff27n
      readOnly: true
  nodeName:
  priority: 0
  schedulerName: default-scheduler
  securityContext: {}
  serviceAccount: default
  serviceAccountName: default
  terminationGracePeriodSeconds: 30
  tolerations:
  - effect: NoExecute
    key: node.kubernetes.io/not-ready
    operator: Exists
    tolerationSeconds: 300
  - effect: NoExecute
    key: node.kubernetes.io/unreachable
    operator: Exists
    tolerationSeconds: 300
  volumes:
  - name: default-token-ff27n
    secret:
      defaultMode: 420
      secretName: default-token-ff27n
status:
  conditions:
  - lastProbeTime: null
    lastTransitionTime: 2019-11-01T13:22:50Z
    status: "True"
    type: Initialized
  - lastProbeTime: null
    lastTransitionTime: 2019-11-01T13:22:55Z
    status: "True"
    type: Ready
  - lastProbeTime: null
    lastTransitionTime: null
    status: "True"
    type: ContainersReady
  - lastProbeTime: null
    lastTransitionTime: 2019-11-01T13:22:50Z
    status: "True"
    type: PodScheduled
  containerStatuses:
  - containerID:
    image:
    imageID:
    lastState: {}
    name: proxy
    ready: true
    restartCount: 0
    state:
      running:
        startedAt: 2019-11-01T13:22:55Z
  hostIP:
  phase: Running
  podIP:
  qosClass: Burstable
  startTime: 2019-11-01T13:22:50Z
</code></pre>
