svc pacth 修改port不行

It's intended behavior. patch_namespaced_service sends strategic-merge-patch (also please refer to this doc) by default, service.spec.ports uses "merge" patchStrategy and "port" as patchMergeKey. Therefore:

service.spec.ports[0].target_port = 3321 sends a patch that contains {"port":3315, "targetPort":3321}-- apiserver sees patchMergeKey is the same as existing ports[0], so ports[0].target_port gets updated.
service.spec.ports[0].port = 3309 sends a patch that contains {"port":3309, "targetPort":XXXX(previous value)}-- apiserver sees patchMergeKey is different from existing ports[0], so it tries appending ports[1] to the list, but fails validation.
You could try enable debugging log but passing debug=True to configuration, to see the HTTP response from apiserver. The request is likely to fail the validation in apiserver:

HTTP response body: {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"Service "my-service" is invalid: spec.ports[1].name: Duplicate value: "tests"","reason":"Invalid","details":{"name":"my-service","kind":"Service","causes":[{"reason":"FieldValueDuplicate","message":"Duplicate value: "tests"","field":"spec.ports[1].name"}]},"code":422}
kubectl edit performs client-side apply (three-way diff) and calculates the needed patch body (the python client library currently doesn't have this functionality):

{"nodePort":30005,"port":3315,"protocol":"TCP","targetPort":3321} appends a ports[1] with same fields except port
{"$patch":"delete","port":3310}]} deletes the existing ports[0]
The result appears to be spec.ports[0].port getting updated.

https://github.com/kubernetes-client/python/issues/641

就是说通过port找不到和原来一样的了，就会在ports后面追加一个，追加之后和原来的又冲突，所以报错，修改targetport当然就没问题。

但是如何解决那？博友还请多留言