<p>I am trying to set up fluent-bit in a custom namespace. I took the following steps (lots ellided here for clarity):</p>
<p>I created the serviceaccount like this:</p>
<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: k8s-logger
  namespace: efk
</code></pre>
<p>Then I bound that serviceaccount to the standard &quot;view&quot; ClusterRrole:</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: k8s-logger
subjects:
- kind: ServiceAccount
  name: k8s-logger
  namespace: efk
roleRef:
  kind: ClusterRole
  name: view
  apiGroup: rbac.authorization.k8s.io
</code></pre>
<p>Finally, I created the fluent-bit DaemonSet and told it to use the &quot;k8s-logger&quot; ServiceAccount:</p>
<pre><code>apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: fluent-bit
  namespace: efk
spec:
  template:
    spec:
      serviceAccount: k8s-logger
      serviceAccountName: k8s-logger
.
.
.
</code></pre>
<p>(As an aside, if anyone know the difference between serviceAccount and serviceAccountName I'd be interested to learn).</p>
<p>However, I got the following output in the fluent-bit logs:</p>
<pre><code>pods is forbidden: User &quot;system.serviceaccount:efk:k8s-logger&quot; cannot list resource &quot;pods/var&quot; in API group &quot;&quot; in the namespace &quot;work&quot;
</code></pre>
<p>When it didn't work, I started verifying:</p>
<ul>
<li>Fluent-bit is connecting using the custom ServiceAccount:
I believe it is because the error message references <code>system.serviceaccount:efk:k8s-logger</code></li>
<li>The serviceaccount exists and is in the correct namespace:
<pre><code>$ kubectl get serviceaccounts/k8s-logging --namespace=efk
NAME        SECRETS   AGE
k8s-logger  1         15h
</code></pre>
</li>
<li>The ClusterRoleBinding is correct (references the correct ServiceAccount and ClusterRole):
<pre><code>$ kubectl describe clusterrolebinding/k8s-logging
Name:         k8s-logger
Labels:       &lt;none&gt;
Annotations:  &lt;none&gt;
Role:
  Kind:  ClusterRole
  Name:  view
Subjects:
  Kind            Name        Namespace
  ----            ----        ---------
  ServiceAccount  k8s-logger  efk
</code></pre>
</li>
<li>Finally, verify that the default role &quot;view&quot; has the permissions I need:
<pre><code>$ kubectl describe clusterrole/view
Name:       view
Labels:     kubernetes.io/bootstrapping=rbac-defaults
PolicyRule:
  Resources           Non-Resource URLs   Resource Names  Verbs
  ---------           -----------------   --------------  -----
  pods                []                  []              [get list watch]
  pods/log            []                  []              [get list watch]
  pods/status         []                  []              [get list watch]
  .
  .
  .
</code></pre>
</li>
</ul>
<p>At this point I do not know how to debug further or to figure out what the problem is. I flailed about by:</p>
<ul>
<li>creating a custom ClusterRole with the permissions I need (just in case view doesn't work the way I thought it does)</li>
<li>Using only either serviceAccount or serviceAccountName in the DaemonSet spec (just in case one of those breaks the other)</li>
</ul>
<p>but these things didn't change anything. Does anyone have any other ideas?</p>

bsellersful
<p>Your error says <code>cannot list resource &quot;pods/var&quot;</code> -- and as a disclaimer: I've never seen that RBAC resource ever.</p>
<p>While the <code>view</code> ClusterRole, grants you read privileges over:</p>
<pre><code>pods                []                  []              [get list watch]
pods/log            []                  []              [get list watch]
pods/status         []                  []              [get list watch]
</code></pre>
<p>Try to create your own ClusterRole, adding <code>pods/var</code> to that list, assuming that's a thing? <code>pods/log</code>, <code>pods/status</code>, or <code>pods/exec</code> are more common, though based on that error, I guess <code>pods/var</code> is a thing?</p>
<p>One way to go about this would be to duplicate the <code>view</code> role, and add what you need:</p>
<pre><code>kubectl get -o yaml clusterrole view &gt;my-view-role.yaml
vi my-view-role.yaml
</code></pre>
<p>Reset its metadata, and rename the clusterrole, remove the aggregationRules if any:</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: view-plus
rules:
[...]
</code></pre>
<p>Keep the original rules in, locate a mentions of pods/status or pods/log, and insert pods/var, as suggested by your error message:</p>
<pre><code>- apiGroups:
  - &quot;&quot;
  resources:
  - bindings
  - events
  - limitranges
  - namespaces/status
  - pods/log
  - pods/status
  - pods/var
  - replicationcontrollers/status
  - resourcequotas
  - resourcequotas/status
  verbs:
  - get
  - list
  - watch
</code></pre>
<p>Create that ClusterRole, <code>kubectl create -f ...</code></p>
<p>Next, replace your ClusterRoleBinding, using your custom ClusterRole.</p>
