serviceaccount goldilocks-vpa-updater cannot patch resource "pods/resize"

[ceastman-r7]

What happened?

I am trying to do an in-place pod resize but am getting this error in the updater pod logs:

1 updater.go:286] "In-place update failed" error="pods \"gkm-alloy-singleton-8dcc86794-rlp4m\" is forbidden: User \"system:serviceaccount:platform-delivery:goldilocks-vpa-updater\" cannot patch resource \"pods/resize\" in API group \"\" in the namespace \"platform-delivery\"" pod="platform-delivery/gkm-alloy-singleton-8dcc86794-rlp4m"

What did you expect to happen?

For the pod to be resized

How can we reproduce this?

Goldilocks helm chart 10.3.0
AWS EKS Kubernetes cluster 1.33
Grafana alloy singleton pod

Version

10.3.0

Search

• I did search for other open and closed issues before opening this.

Code of Conduct

• I agree to follow this project's Code of Conduct

Additional context

No response

[ceastman-r7]

Updating the clusterrole vpa-evictioner resolved the error:

rules:

• apiGroups: [""]
  resources:
  • pods # <--- Add this line
  • pods/eviction
  • pods/resize # <--- Add this line
    verbs:
  • get # <--- Add this line
  • list # <--- Add this line
  • watch # <--- Add this line
  • patch # <--- Add this line
  • update # <--- Add this line
  • create # Usually needed for eviction