agent failed to update the k8s secret after rotation: rbac error
Fixes an agent failing to update a Kubernetes Secret after rotation with an RBAC error: grant the service account secret write rights. Use when rotation agents hit 403 on secrets. Not for Vault-side errors.
TL;DR
The agent's service account lacks permission to update Secrets in the target namespace. Create a Role with get, update, and patch on secrets, bind it to the service account, and retry.
Error
agent failed to update the k8s secret after rotation: rbac errorSteps
- Identify the service account the agent runs as. Expected: the exact account.
- Check its roles in the target namespace for secrets permissions. Expected: the missing verb found.
- Create or update a Role granting get, update, and patch on secrets in that namespace. Expected: the permission exists.
- Bind the Role to the service account. Expected: the binding is live.
- Retry the rotation step. Expected: the Secret updates.
When to use
- Rotation agents failing on Kubernetes Secret writes.
- Setting up secret-managing service accounts.
When not to use
- Vault or cloud permission errors.
- Read failures (different verb).
Tool compatibility
- Kubernetes RBAC; ServiceAccounts, Roles, RoleBindings.
Variant phrasings
rbac denied updating k8s secret
Grant the verbs.
serviceaccount cannot patch secrets
Bind a role.
Why it happens
Default service accounts have no secret write rights; every writer needs an explicit grant, scoped per namespace.
Edge cases
- Cluster-wide rotations need ClusterRoles; namespace roles do not reach.
- The agent may need create too if it makes new Secrets.
- Audit who holds secret-write roles; they are powerful.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_TaBQON6ADuyuzcOQaDCh5g