<p>I've tried to setup a cron job to patch a horizontal pod autoscaler, but the job returns <code>horizontalpodautoscalers.autoscaling &quot;my-web-service&quot; is forbidden: User &quot;system:serviceaccount:staging:sa-cron-runner&quot; cannot get resource &quot;horizontalpodautoscalers&quot; in API group &quot;autoscaling&quot; in the namespace &quot;staging&quot;</code></p>
<p>I've tried setting up all the role permissions as below:</p>
<pre><code>kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: staging
  name: cron-runner
rules:
- apiGroups: [&quot;autoscaling&quot;]
  resources: [&quot;horizontalpodautoscalers&quot;]
  verbs: [&quot;patch&quot;]

---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: cron-runner
  namespace: staging
subjects:
- kind: ServiceAccount
  name: sa-cron-runner
  namespace: staging
roleRef:
  kind: Role
  name: cron-runner
  apiGroup: rbac.authorization.k8s.io

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: sa-cron-runner
  namespace: staging
---

apiVersion: batch/v1beta1
kind: CronJob
metadata:
  name: scale-up-job
  namespace: staging
spec:
  schedule: &quot;16 20 * * 1-6&quot;
  concurrencyPolicy: Forbid
  jobTemplate:
    spec:
      template:
        spec:
          serviceAccountName: sa-cron-runner
          containers:
          - name: scale-up-job
            image: bitnami/kubectl:latest
            command:
            - /bin/sh
            - -c
            - kubectl patch hpa my-web-service --patch '{\&quot;spec\&quot;:{\&quot;minReplicas\&quot;:6}}'
          restartPolicy: OnFailure
</code></pre>
<p><code>kubectl auth can-i patch horizontalpodautoscalers -n staging --as sa-cron-runner </code> also returns <code>no</code>, so the permissions can't be setup correctly.</p>
<p>How can I debug this? I can't see how this is setup incorrectly</p>

MDalt
<p>I think that the problem is that the cronjob needs to first get the resource and then <code>Patch</code> the same. So, you need to explicitly specify the permission to <code>get</code> in the <code>Role</code> spec.</p>
<p>The error also mentions authentication problem with getting the resource:</p>
<pre><code>horizontalpodautoscalers.autoscaling &quot;my-web-service&quot; is forbidden: User &quot;system:serviceaccount:staging:sa-cron-runner&quot; cannot get resource &quot;horizontalpodautoscalers&quot; in API group &quot;autoscaling&quot; in the namespace &quot;staging&quot;
</code></pre>
<p>Try modifying the <code>verbs</code> part of the <code>Role</code> as:</p>
<pre><code>verbs: [&quot;patch&quot;, &quot;get&quot;]
</code></pre>
<p>You could also include <code>list</code> and <code>watch</code> depending on the requirements in the scripts that is run inside the cronjob.</p>
