← Permission Reference
T1
update secrets
Overwriting an existing Secret replaces the material something already trusts, with no new object to notice.
Swapping a TLS key or a CA bundle turns a component into an attacker-controlled endpoint, and rewriting a token to a known value grants an identity without reading the old one, so this does not require get.
Contextual upgrade to T0:
T0 where the Secret backs a trust decision, such as a webhook serving certificate, an aggregated APIService CA bundle, or a component kubeconfig.
Replacing that material redirects or forges the trust rather than merely corrupting a workload.
- API Group
- (core)
- Scope
- namespaced
- Audit Level
- RequestResponse