bugfix: Give kube-scheduler permission to update/patch pod status

[cofyc]

What problem does this PR solve?

kube-scheduler needs this permission to update/patch pod status. This is required to record pod schedule status in pod object.

The condition of v1.PodScheduled is used in scheduling queue to sort active pods: https://github.com/kubernetes/kubernetes/blob/v1.12.5/pkg/scheduler/core/scheduling_queue.go#L205-L227

// podTimeStamp returns pod's last schedule time or its creation time if the
// scheduler has never tried scheduling it.
func podTimestamp(pod *v1.Pod) *metav1.Time {
	_, condition := podutil.GetPodCondition(&pod.Status, v1.PodScheduled)
	if condition == nil {
		return &pod.CreationTimestamp
	}
	if condition.LastProbeTime.IsZero() {
		return &condition.LastTransitionTime
	}
	return &condition.LastProbeTime
}


// activeQComp is the function used by the activeQ heap algorithm to sort pods.
// It sorts pods based on their priority. When priorities are equal, it uses
// podTimestamp.
func activeQComp(pod1, pod2 interface{}) bool {
	p1 := pod1.(*v1.Pod)
	p2 := pod2.(*v1.Pod)
	prio1 := util.GetPodPriority(p1)
	prio2 := util.GetPodPriority(p2)
	return (prio1 > prio2) || (prio1 == prio2 && podTimestamp(p1).Before(podTimestamp(p2)))
}

This permission is also in builtin scheduler cluster role. View full permission of builtin scheduler cluster role: kubectl get clusterrole system:kube-scheduler -o yaml.

What is changed and how does it work?

Check List

Code changes

• Has Helm charts change

Does this PR introduce a user-facing change?:

Give tidb-scheduler (kube-scheduler) permission to update pod status. This fixes some scheduling issues.

[weekface]

/run-e2e-tests

[cofyc]

/run-e2e-tests

[gregwebs]

/run-e2e-tests

[aylei]

LGTM

[cofyc]

/run-e2e-tests