PatchNamespacedDeploymentScaleAsync returns "Forbidden" error

[amit-kumar-absg]

I am using the C# client to scale down a deployment using the following method:
await _client.AppsV1.PatchNamespacedDeploymentScaleAsync(scalePatch, name, @namespace);

I have associated the deployment of this C# code in the cluster with a custom service account with the following permissions, but I am still receiving the Forbidden error.

- apiGroups: ["apps"]
  resources: [ "deployments"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete", "scale"]

If I use this different method to scale the deployment, then it works fine with the same account permissions:

await _client.AppsV1.PatchNamespacedDeploymentAsync

Can you please help me identify the permissions required to make the PatchNamespacedDeploymentScaleAsync method work?

Also, between the two options, which one is a recommended option to scale the deployment size?

[tg123]

kubectl can-i to check your service account

[amit-kumar-absg]

Thanks, Can you please share which action/verb is being used by PatchNamespacedDeploymentScaleAsync. I am getting a yes on all the following:

k auth can-i list deployment --as=system:serviceaccount:default:my-svc-account
yes


❯ k auth can-i scale deployment --as=system:serviceaccount:default:my-svc-account
Warning: verb 'scale' is not a known verb
yes

❯ k auth can-i update deployment --as=system:serviceaccount:default:my-svc-account
yes


❯ k auth can-i delete deployment --as=system:serviceaccount:default:my-svc-account
yes


❯ k auth can-i patch deployment --as=system:serviceaccount:default:my-svc-account
yes


❯ k auth can-i list deployment --as=system:serviceaccount:default:my-svc-account
yes

[amit-kumar-absg]

@tg123 , Can you please advise on the underlying kubectl command sent by PatchNamespacedDeploymentScaleAsync?
All the ones that I tried on deployment returned as yes.

I am definitely not doing kubectl can-i on the one used by PatchNamespacedDeploymentScaleAsync method.

[tg123]

i believe your question is what is the equivalent command to PatchNamespacedDeploymentScaleAsync?
it is kubectl scale deployment xxx

and internally, kubectl will send PATCH server/.../deployment/xxxxx/scale
you should check the version of your k8s server, this object group changed many times

just checked latest (1.26) version

        "x-kubernetes-group-version-kind": {
          "group": "autoscaling",
          "kind": "Scale",
          "version": "v1"
        }

so make sure you have permissions to that group

[amit-kumar-absg]

Thank you @tg123 for the help! The information that you provided above and the suggestion here https://stackoverflow.com/a/72282804 helped me get to a working state with PatchNamespacedDeploymentScaleAsync!!

The following defintion for the ClusterRole is working fine for me. Setting the resources to ["deployments/scale"] instead of ["deployments"] was the key change needed!

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: default
  name: my-svc-account-role
rules:
- apiGroups: ["apps"]
  resources: ["deployments/scale"]
  verbs: ["patch"]