<p>We are setting up a fleet server in Kubernetes.
It has been given a CA and states its running but we cannot shell into it, and the logs are nothing but the following:</p>
<blockquote>
<p>E0817 09:12:10.074969 927 leaderelection.go:330] error retrieving
resource lock default/elastic-agent-cluster-leader:
leases.coordination.k8s.io &quot;elastic-agent-cluster-leader&quot; is
forbidden: User &quot;system:serviceaccount:default:elastic-agent&quot; cannot
get resource &quot;leases&quot; in API group &quot;coordination.k8s.io&quot; in the
namespace &quot;default&quot;</p>
</blockquote>
<p>I can find very little information on this ever happening let alone a resolution. Any information pointing to a possible resolution would be massively helpful!</p>

Aaron Gibson
<p>You need to make sure that you have applied the <code>ServiceAccount</code>, <code>ClusterRoles</code> and <code>ClusterRoleBindings</code> from the setup files.</p>
<p>An example of these can be found in the quickstart documentation.</p>
<p><a href="https://www.elastic.co/guide/en/cloud-on-k8s/2.2/k8s-elastic-agent-fleet-quickstart.html" rel="nofollow noreferrer">https://www.elastic.co/guide/en/cloud-on-k8s/2.2/k8s-elastic-agent-fleet-quickstart.html</a></p>
<p>Service Account</p>
<pre><code>kind: ServiceAccount
metadata:
  name: elastic-agent
  namespace: default
</code></pre>
<p>Cluster Role</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: elastic-agent
rules:
- apiGroups: [&quot;&quot;] # &quot;&quot; indicates the core API group
  resources:
  - pods
  - nodes
  - namespaces
  verbs:
  - get
  - watch
  - list
- apiGroups: [&quot;coordination.k8s.io&quot;]
  resources:
  - leases
  verbs:
  - get
  - create
  - update
</code></pre>
<p>Cluster Role Binding</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: elastic-agent
subjects:
- kind: ServiceAccount
  name: elastic-agent
  namespace: default
roleRef:
  kind: ClusterRole
  name: elastic-agent
  apiGroup: rbac.authorization.k8s.io
</code></pre>
