## TL;DR

The agent's service account lacks permission to update Secrets in the target namespace. Create a Role with get, update, and patch on secrets, bind it to the service account, and retry.

## Error

```text
agent failed to update the k8s secret after rotation: rbac error
```

## Steps

1. Identify the service account the agent runs as. Expected: the exact account.
2. Check its roles in the target namespace for secrets permissions. Expected: the missing verb found.
3. Create or update a Role granting get, update, and patch on secrets in that namespace. Expected: the permission exists.
4. Bind the Role to the service account. Expected: the binding is live.
5. Retry the rotation step. Expected: the Secret updates.

## When to use

- Rotation agents failing on Kubernetes Secret writes.
- Setting up secret-managing service accounts.

## When not to use

- Vault or cloud permission errors.
- Read failures (different verb).

## Tool compatibility

- Kubernetes RBAC; ServiceAccounts, Roles, RoleBindings.

## Variant phrasings

### rbac denied updating k8s secret

Grant the verbs.

### serviceaccount cannot patch secrets

Bind a role.

## Why it happens

Default service accounts have no secret write rights; every writer needs an explicit grant, scoped per namespace.

## Edge cases

- Cluster-wide rotations need ClusterRoles; namespace roles do not reach.
- The agent may need create too if it makes new Secrets.
- Audit who holds secret-write roles; they are powerful.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_TaBQON6ADuyuzcOQaDCh5g