<p>Follow the mysql example,</p>
<p><a href="https://kubernetes.io/docs/tasks/run-application/run-single-instance-stateful-application/" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/run-application/run-single-instance-stateful-application/</a></p>
<blockquote>
<p>kubectl describe deployment mysql</p>
</blockquote>
<pre><code>Events:
  Type     Reason                 Age   From                   Message
  ----     ------                 ----  ----                   -------
  Warning  ReplicaSetCreateError  15m   deployment-controller  Failed to create new replica set &quot;mysql-79c846684f&quot;: Unauthorized
  Normal   ScalingReplicaSet      15m   deployment-controller  Scaled up replica set mysql-79c846684f to 1
</code></pre>
<p>Unauthorized? what might be the cause?</p>
<p>Kubectl: v1.27.1</p>
<p>Server: v1.25.9</p>

eastwater
<p><strong>Unauthorized :</strong> Indicates that the server can be reached and understands the request, but refuses to take any further action without the client providing appropriate authorization. If the client has provided authorization, this error indicates the provided credentials are insufficient or invalid.</p>
<p>The Kubeconfig Authentication method does not support external identity providers or certificate-based authentication. Verify whether RBAC has been implemented correctly in your deployment configuration. See <a href="https://github.com/kubernetes/dashboard#create-an-authentication-token-rbac" rel="nofollow noreferrer">Create An Authentication Token (RBAC)</a>.</p>
<p><strong>Try restarting the kube-apiserver pods in UserCluster Controlplane namespaces cluster certificate renewal. Restarting kube-apiserver pods.</strong></p>
<p><strong>Refer official Kubernetes <a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/" rel="nofollow noreferrer">Authenticating</a> :</strong></p>
<blockquote>
<p>API requests are tied to a normal user or service account or treated
as <code>anonymous requests</code>. This means every process inside or outside the
cluster, from a human user typing <code>kubectl</code> on a workstation, to
<code>kubelets</code> on nodes, to members of the control plane, must authenticate
when making requests to the API server, or be treated as an anonymous
user.</p>
</blockquote>
<p><strong>Refer official Kubernetes <a href="https://kubernetes.io/docs/concepts/workloads/controllers/replicaset/#writing-a-replicaset-manifest" rel="nofollow noreferrer">Writing a ReplicaSet manifest</a> :</strong></p>
<blockquote>
<p>When the control plane creates new Pods for a ReplicaSet, the
<code>.metadata.name</code> of the ReplicaSet is part of the basis for naming
those Pods. The name of a ReplicaSet must be a valid <code>DNS subdomain</code>
value, but this can produce unexpected results for the Pod hostnames.
For best compatibility, the name should follow the more restrictive
rules for a <code>DNS label</code>.</p>
</blockquote>
<p>Also refer to <strong>Matt Mickiewicz's Sitepoint Blog</strong> on <a href="https://www.sitepoint.com/troubleshooting-kubernetes-unauthorized-access-and-more/" rel="nofollow noreferrer">Troubleshooting Kubernetes: Unauthorized Access</a></p>
