<p>I am trying to create a daemonset that will collect logs from all the pods in a node from a specific namespace. I am not sure how I would specify a namespace name.</p>

<p>I have a namespace logging in which i deploy the daemonset. I created a serviceccount as below </p>

<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: fluent-bit
  namespace: logging
</code></pre>

<p>My cluster role looks like this </p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: fluent-bit-read
rules:
- apiGroups: [""]
  resources:
  - namespaces
  - pods
  verbs: ["get", "list", "watch"]
</code></pre>

<p>role binding </p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: fluent-bit-read
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: fluent-bit-read
subjects:
- kind: ServiceAccount
  name: fluent-bit
  namespace: logging
</code></pre>

<p>Right now the daemonset collects logs from the path <code>/var/log/containers/*.log</code> which currently has log files from containers running in all namespaces.  Is there a way I could restrict this daemonset to just collect logs from namespaces i need ?</p>

<p>Here is what we have in k8s documentation (<a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole" rel="nofollow noreferrer">link</a>).</p>
<blockquote>
<p>A Role always sets permissions within a particular namespace; when you create a Role, you have to specify the namespace it belongs in.</p>
<p>ClusterRole, by contrast, is a non-namespaced resource. The resources have different names (Role and ClusterRole) because a Kubernetes object always has to be either namespaced or not namespaced; it can’t be both.</p>
</blockquote>
<p>So, in your case you need to make use of a <strong>Role</strong> and a <strong>RoleBinding</strong> instead of a ClusterRole and ClusterRoleBinding.</p>
