Test if sa have sufficient rights

serviceaccount can-i

kubectl auth can-i --as=system:serviceaccount:vault:vault patch pod                                                                                                       altenar-x001-vault
yes