<p>I have a python script that tries to scale a statefulset from inside a pod, but get a forbidden error from the API server. The following yml file shows my role and rolebinding:</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
Kind: Role
metadata:
  name: server-controller
  namespace: code-server
roles:
  - apiGroups: [&quot;*&quot;]
    resources:
      - statefulsets
    verbs: [&quot;update&quot;, &quot;patch&quot;]
---
apiVersion: rbac.authorization.k8s.io/v1
Kind: RoleBinding
metadata:
  name: server-controller
  namespace: code-server
subjects:
  -kind: ServiceAccount
   name: server-controller
   namespace: code-server
roleRef:
  kind: Role
  name server-controller
  apiGroup: rbac.authorization.k8s.io
</code></pre>
<p>The following python code snippet shows my access to the API:</p>
<pre><code>kubernetes.config.load_incluster_config()
app = kubernetes.client.AppsV1Api()
body = {&quot;spec&quot;: {&quot;replicas&quot;: 1}}
app.patch_namespaced_stateful_set_scale(
      name=&quot;jim&quot;,
      namespace=&quot;code-server&quot;,
      body=body)
</code></pre>
<p>I get the following error:</p>
<pre><code>kubernetes.client.exceptions.ApiException: (403)
Reason: Forbidden
HTTP response headers: HTTPHeaderDict({'Cache-Control': 'no-cache&quot;, 'Content-Type': 'application/json', 'X-Content-Type-Options': 'nosniff', 'Date': 'Fri, 15 Oct 2021 15:25:24 GMT', 'Content-Length': '469'})
HTTP response Body: {
   &quot;kind&quot;: &quot;Status&quot;,
   &quot;apiVersion&quot;: &quot;v1&quot;
   &quot;metadata&quot;: {

    }
   &quot;status&quot;: &quot;Failure&quot;,
   &quot;message&quot;: &quot;statefulsets.apps \&quot;jim\&quot; is forbidden: User \&quot;system:serviceaccount:code-server:server-controller\&quot; cannot patch resource \&quot;statefulsets/scale\&quot; in API group \&quot;apps\&quot; in the namespace \&quot;code-server\&quot;&quot;,
   &quot;reason&quot;: &quot;Forbidden&quot;,
   &quot;details&quot;: {
     &quot;name&quot;: &quot;jim&quot;,
     &quot;group&quot;: &quot;apps&quot;,
     &quot;kind&quot;: &quot;statefulesets&quot;
   }
   &quot;code&quot;: 403
}
</code></pre>

J. Ike
<p>The solution was to change &quot;statefulsets&quot; to &quot;statefulsets/scale&quot; in the &quot;resources&quot; field under &quot;role&quot;.</p>
