<p>My Kubernetes user is not admin in the cluster. So I just cannot create a cluster role binding for filebeat service account. I am using auto discover  in filebeat. Can someone help how can I achieve this without clusterrole.</p>
<pre><code>apiVersion: v1
kind: ConfigMap
metadata:
  name: filebeat-config
  namespace: logging
  labels:
    k8s-app: filebeat
    kubernetes.io/cluster-service: &quot;true&quot;
data:
  filebeat.yml: |-
    setup.dashboards.enabled: false
    setup.template.enabled: true
    setup.template.settings:
      index.number_of_shards: 1
    filebeat.modules:
      - module: system
        syslog:
          enabled: true
          #var.paths: [&quot;/var/log/syslog&quot;]
        auth:
          enabled: true
          #var.paths: [&quot;/var/log/authlog&quot;]
    filebeat.autodiscover:
      providers:
        - type: kubernetes
          templates:
            - condition:
                equals:
                  kubernetes.namespace: microsrv-test
              config:
                - type: docker
                  json.keys_under_root: true
                  json.add_error_key: true
                  json.message_key: log
                  containers:
                    ids:
                      - &quot;${data.kubernetes.container.id}&quot;
    processors:
      - drop_event:
          when.or:
              - and:
                  - regexp:
                      message: '^\d+\.\d+\.\d+\.\d+ '
                  - equals:
                      fileset.name: error
              - and:
                  - not:
                      regexp:
                          message: '^\d+\.\d+\.\d+\.\d+ '
                  - equals:
                      fileset.name: access
      - add_cloud_metadata:
      - add_kubernetes_metadata:
      - add_docker_metadata:
    output.elasticsearch:
      hosts: [&quot;elasticsearch:9200&quot;]
---

apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
  name: filebeat
  namespace: logging
  labels:
    k8s-app: filebeat
    kubernetes.io/cluster-service: &quot;true&quot;
spec:
  template:
    metadata:
      labels:
        k8s-app: filebeat
        kubernetes.io/cluster-service: &quot;true&quot;
    spec:
      serviceAccountName: filebeat
      terminationGracePeriodSeconds: 30
      containers:
      - name: filebeat
        image: docker.elastic.co/beats/filebeat:7.3.2
        imagePullPolicy: Always
        args: [
          &quot;-c&quot;, &quot;/etc/filebeat.yml&quot;,
          &quot;-e&quot;,
        ]
        env:
        - name: ELASTICSEARCH_HOST
          value: elasticsearch
        - name: ELASTICSEARCH_PORT
          value: &quot;9200&quot;
        - name: KIBANA_HOST
          value: kibana
        - name: KIBANA_PORT
          value: &quot;5601&quot;
        securityContext:
          runAsUser: 0
        volumeMounts:
        - name: config
          mountPath: /etc/filebeat.yml
          readOnly: true
          subPath: filebeat.yml
        - name: data
          mountPath: /usr/share/filebeat/data
        - name: varlog
          mountPath: /var/log
          readOnly: true
        - name: varlibdockercontainers
          mountPath: /var/lib/docker/containers
          readOnly: true
        - name: dockersock
          mountPath: /var/run/docker.sock
      volumes:
      - name: config
        configMap:
          defaultMode: 0600
          name: filebeat-config
      - name: varlog
        hostPath:
          path: /var/log
      - name: varlibdockercontainers
        hostPath:
          path: /var/lib/docker/containers
      - name: dockersock
        hostPath:
          path: /var/run/docker.sock
      - name: data
        emptyDir: {}

---
</code></pre>
<p>Cluster Roles and role bindings</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: filebeat
subjects:
- kind: ServiceAccount
  name: filebeat
  namespace: logging
roleRef:
  kind: ClusterRole
  name: filebeat
  apiGroup: rbac.authorization.k8s.io

---

apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: filebeat
  labels:
    k8s-app: filebeat
rules:
- apiGroups: [&quot;&quot;] # &quot;&quot; indicates the core API group
  resources:
  - namespaces
  - pods
  verbs:
  - get
  - watch
  - list
  
---

apiVersion: v1
kind: ServiceAccount
metadata:
  name: filebeat
  namespace: logging
  labels:
    k8s-app: filebeat
</code></pre>
<p>I have tried creating non cluster role and rolebinding as below,</p>
<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: filebeat
  namespace: logging
  labels:
    k8s-app: filebeat
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: filebeat
  namespace: logging
  labels:
    k8s-app: filebeat
rules:
  - apiGroups: [&quot;&quot;] # &quot;&quot; indicates the core API group
    resources:
      - pods
    verbs:
      - get
      - watch
      - list
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: filebeat
  namespace: logging
subjects:
  - kind: ServiceAccount
    name: filebeat
    namespace: logging
roleRef:
  kind: Role
  name: filebeat
  apiGroup: rbac.authorization.k8s.io
</code></pre>
<p>but I am getting error.</p>
<blockquote>
<p>Performing a resource sync err kubernetes api: Failure 403 pods is
forbidden: User &quot;system:serviceaccount:xxxxx:filebeat&quot; cannot list
resource &quot;pods&quot; in API group &quot;&quot; at the cluster scope for *v1.PodList|</p>
</blockquote>

<p>Unfortunately, it will not work the way you want it and the error you are getting indicates it perfectly:</p>
<pre><code>Performing a resource sync err kubernetes api: Failure 403 pods is forbidden: User &quot;system:serviceaccount:xxxxx:filebeat&quot; cannot list resource &quot;pods&quot; in API group &quot;&quot; at the cluster scope for *v1.PodList|
</code></pre>
<p>Notice the most important part which is: <code>at the cluster scope</code>. You could also check whether an action is allowed by executing the <a href="https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands" rel="nofollow noreferrer">kubectl auth can-i</a> command. More about that can be found in the <a href="https://kubernetes.io/docs/reference/access-authn-authz/authorization/" rel="nofollow noreferrer">Authorization Overview</a>.</p>
<p>This brings us to the differences between <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole" rel="nofollow noreferrer">Role and ClusterRole</a>:</p>
<blockquote>
<p>An RBAC <code>Role</code> or <code>ClusterRole</code> contains rules that represent a set of
permissions. Permissions are purely additive (there are no &quot;deny&quot;
rules).</p>
<p>A <code>Role</code> always sets permissions <strong>within a particular namespace</strong>;
when you create a <code>Role</code>, you have to specify the namespace it belongs
in.</p>
<p><code>ClusterRole</code>, by contrast, <strong>is a non-namespaced resource</strong>. The
resources have different names (<code>Role</code> and <code>ClusterRole</code>) because a
Kubernetes object always has to be either namespaced or not
namespaced; it can't be both.</p>
<p><code>ClusterRoles</code> have several uses. You can use a <code>ClusterRole</code> to:</p>
<ul>
<li><p>define permissions on namespaced resources and be granted within individual namespace(s)</p>
</li>
<li><p>define permissions on namespaced resources and be granted across all namespaces</p>
</li>
<li><p>define permissions on cluster-scoped resources</p>
</li>
</ul>
<p>If you want to define a role within a namespace, use a Role; if you
want to define a role cluster-wide, use a <code>ClusterRole</code>.</p>
</blockquote>
<p>And between <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#rolebinding-and-clusterrolebinding" rel="nofollow noreferrer">RoleBinding and ClusterRoleBinding</a>:</p>
<blockquote>
<p>A role binding grants the permissions defined in a role to a user or
set of users. It holds a list of subjects (users, groups, or service
accounts), and a reference to the role being granted. A <code>RoleBinding</code>
grants permissions within a specific namespace whereas a
<code>ClusterRoleBinding</code> grants that access cluster-wide.</p>
<p>A <code>RoleBinding</code> may reference any Role in the same namespace.
Alternatively, a <code>RoleBinding</code> can reference a <code>ClusterRole</code> and bind that
<code>ClusterRole</code> to the namespace of the <code>RoleBinding</code>. If you want to bind a
<code>ClusterRole</code> to all the namespaces in your cluster, you use a
<code>ClusterRoleBinding</code>.</p>
</blockquote>
<p>So it is impossible to get the cluster scope permissions by using <code>Role</code> and <code>RoleBinding</code>.</p>
<p>You will most likely have to ask your Admin to help you solve this issue.</p>
