Granted the autocoder-engine-ci ServiceAccount narrowly scoped access to update Secret/autocoder-secrets in the autocoder-engine namespace.
The AutoCoder deployment pipeline failed while syncing runtime secrets because client-side kubectl apply attempted to retrieve the existing Secret before patching it:
User "system:serviceaccount:autocoder-engine:autocoder-engine-ci" cannot get resource "secrets" in API group "" in the namespace "autocoder-engine"
Applied /home/ax_julian/temp/autocoder-engine-ci-secret-rbac-20260506.yaml, updating Role/autocoder-engine-ci with this named-resource rule:
- apiGroups: [""]
resources: ["secrets"]
resourceNames: ["autocoder-secrets"]
verbs: ["get", "patch", "update"]
The repository source was also updated in AutoCoder-Engine/k8s/07-ci-deployer-rbac.yaml so the permission is not lost on future manual RBAC applies.
Verified with kubectl auth can-i as system:serviceaccount:autocoder-engine:autocoder-engine-ci:
get secret/autocoder-secrets: yes
patch secret/autocoder-secrets: yes
update secret/autocoder-secrets: yes
get secrets: no
create secrets: no
delete secret/autocoder-secrets: no
This does not grant broad Secret listing or Secret creation. The CI identity can read and modify only the named runtime Secret autocoder-secrets.