kubectl "Forbidden: updates to statefulset spec ... are forbidden" in CI

A StatefulSet only allows a narrow set of fields to change after creation - replicas, template, ordinals, and updateStrategy. Editing anything else (its serviceName, selector, or volumeClaimTemplates) is forbidden in place.

What this error means

kubectl apply fails with Forbidden: updates to statefulset spec for fields other than 'replicas', 'ordinals', 'template', 'updateStrategy', 'persistentVolumeClaimRetentionPolicy' and 'minReadySeconds' are forbidden. The first create worked; the update touches a locked field.

kubectl output

The StatefulSet "db" is invalid: spec: Forbidden: updates to statefulset spec
for fields other than 'replicas', 'ordinals', 'template', 'updateStrategy',
'persistentVolumeClaimRetentionPolicy' and 'minReadySeconds' are forbidden

Common causes

Changing volumeClaimTemplates

Resizing or editing a StatefulSet’s volumeClaimTemplates is not allowed in place - the PVCs are created once per replica and the template is fixed after creation.

Changing serviceName or selector

The governing serviceName and the pod selector are immutable. Renaming either on an existing StatefulSet is rejected.

How to fix it

Recreate the StatefulSet, keep the PVCs

Delete the StatefulSet with an orphan cascade so the pods/PVCs survive, then re-create it with the new spec. The existing PVCs are re-adopted.

Terminal

kubectl delete statefulset db --cascade=orphan
kubectl apply -f statefulset.yaml

For PVC growth, patch the PVCs directly

If the StorageClass allows expansion, edit each PVC’s spec.resources.requests.storage to grow it.
Then update the StatefulSet’s volumeClaimTemplates via the orphan-recreate above so new replicas match.
Never shrink a volume - only expansion is supported.

How to prevent it

Decide serviceName, selector, and volumeClaimTemplates up front - treat them as permanent.
Use --cascade=orphan recreate for unavoidable immutable changes to keep data.
Catch immutable-field edits early with kubectl diff in CI.