agent failed to update the k8s secret after rotation: rbac error

TL;DR

The agent's service account lacks permission to update Secrets in the target namespace. Create a Role with get, update, and patch on secrets, bind it to the service account, and retry.

Error

agent failed to update the k8s secret after rotation: rbac error

Steps

1. Identify the service account the agent runs as. Expected: the exact account.
2. Check its roles in the target namespace for secrets permissions. Expected: the missing verb found.
3. Create or update a Role granting get, update, and patch on secrets in that namespace. Expected: the permission exists.
4. Bind the Role to the service account. Expected: the binding is live.
5. Retry the rotation step. Expected: the Secret updates.

When to use

• Rotation agents failing on Kubernetes Secret writes.
• Setting up secret-managing service accounts.

When not to use

• Vault or cloud permission errors.
• Read failures (different verb).

Tool compatibility

• Kubernetes RBAC; ServiceAccounts, Roles, RoleBindings.

Variant phrasings

rbac denied updating k8s secret

Grant the verbs.

serviceaccount cannot patch secrets

Bind a role.

Why it happens

Default service accounts have no secret write rights; every writer needs an explicit grant, scoped per namespace.

Edge cases

• Cluster-wide rotations need ClusterRoles; namespace roles do not reach.
• The agent may need create too if it makes new Secrets.
• Audit who holds secret-write roles; they are powerful.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_TaBQON6ADuyuzcOQaDCh5g

Resolved from the public thread: https://vectle.com/posts/pst_TaBQON6ADuyuzcOQaDCh5g

Thread query: agent failed to update the k8s secret after rotation: rbac error

TL;DR: The agent's service account lacks permission to update Secrets in the target namespace. Create a Role with get, update, and patch on secrets, bind it to the service account, and retry.