Operation returned an invalid status code 'Unauthorized' while trying to do json patch for custom resource objects

[srinivasmummareddy]

The following is the stack trace of exception

"Error","@x":"k8s.Autorest.HttpOperationException: Operation returned an invalid status code 'Unauthorized'\n at k8s.Kubernetes.SendRequestRaw(String requestContent, HttpRequestMessage httpRequest, CancellationToken cancellationToken)\n at k8s.AbstractKubernetes.k8s.ICustomObjectsOperations.PatchNamespacedCustomObjectWithHttpMessagesAsync(Object body, String group, String version, String namespaceParameter, String plural, String name, String dryRun, String fieldManager, Nullable1 force, IReadOnlyDictionary2 customHeaders, CancellationToken cancellationToken)\n at k8s.CustomObjectsOperationsExtensions.PatchNamespacedCustomObjectAsync(ICustomObjectsOperations operations, Object body, String group, String version, String namespaceParameter, String plural, String name, String dryRun, String fieldManager, Nullable`1 force, CancellationToken cancellationToken)

Note: The particular pod has a service account which has permission to patch the crd.

Not able to figure out the exact reason

I'm using Kubernetes client : 8.0.68

[tg123]

are you using BuildDefaultConfig?

[tg123]

i mean patch your crd

[srinivasmummareddy]

[tg123]

hmm next step would be checking logs of api server or capture http pkg

[srinivasmummareddy]

Can you elaborate more or give some commands to do this

[tg123]

https://kubernetes.io/docs/tasks/debug/debug-cluster/#control-plane-nodes
check api server to verify what user is actually using

you can also use audit
https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/

[tg123]

check if it helps
#971 (comment)

[srinivasmummareddy]

@tg123 nope its giving the same error...no luck

[srinivasmummareddy]

#624
Is it something interlinked? Even I'm getting a similar issue not the exact scenario but pattern is bit similar
I'm getting unauthorized using c# client but its working fine with kubectl

[tg123]

did you capture net pkg? any detailed response from server side?

[srinivasmummareddy]

not seeing any audit logs while doing that operation using c# sharp client. If I'm doing the same with kubectl I'm able to see the audit logs and patch operation is working
Note: I have executed that particular patch command using same service account used in my pod
ex: kubectl --as system:serviceaccount:security:security-sa patch keycloakrealms kdiedge --type "json" -p="[{"op": "replace", "path":"/spec/realm/users/0/credentials/0/value", "value":"srinivas"}]" -n keycloak