<p>I made a service account that bound to clusterRole.</p>
<p>Here is the clusterRole</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: devops-tools-role
  namespace: devops-tools
rules:
  - apiGroups:
        - &quot;&quot;
        - apps
        - autoscaling
        - batch
        - extensions
        - policy
        - rbac.authorization.k8s.io
        - networking.k8s.io
    resources:
      - pods
      - componentstatuses
      - configmaps
      - daemonsets
      - deployments
      - events
      - endpoints
      - horizontalpodautoscalers
      - ingress
      - ingresses
      - jobs
      - limitranges
      - namespaces
      - nodes
      - pods
      - persistentvolumes
      - persistentvolumeclaims
      - resourcequotas
      - replicasets
      - replicationcontrollers
      - serviceaccounts
      - services
    verbs: [&quot;get&quot;, &quot;list&quot;, &quot;watch&quot;, &quot;create&quot;, &quot;update&quot;, &quot;patch&quot;, &quot;delete&quot;]

</code></pre>
<p>I try to read logs from a pod</p>
<pre><code>kubectl -n dfg02 logs postgres-69c7bb5cf7-dstzt
</code></pre>
<p>, and got :</p>
<pre><code>Error from server (Forbidden): pods &quot;postgres-69c7bb5cf7-dstzt&quot; is forbidden: User &quot;system:serviceaccount:devops-tools:bino&quot; cannot get resource &quot;pods/log&quot; in API group &quot;&quot; in the namespace &quot;dfg02&quot;

</code></pre>
<p>So I switch to 'admin' account anda try to find which resource to add to the cluster role</p>
<pre><code> ✘ bino@corobalap  ~/gitjece  kubectl config use-context k0s-cluster          
Switched to context &quot;k0s-cluster&quot;.
 bino@corobalap  ~/gitjece  kubectl api-resources |grep log
</code></pre>
<p>and got nothing.</p>
<p>My question is how to add 'logs read rights' to a ClusterRole.</p>
<p>Sincerely<br />
-bino-</p>

Bino Oetomo
<p>Logs are a sub-resource of Pods and by just specifying pods in the resource sections isn't enough.</p>
<p>So simply add the following to your yaml then it should work.</p>
<pre><code>resources:
  - pods
  - pods/log
</code></pre>
<p>PS: You've specified <code>pods</code> twice in your <code>resources</code> section, not that it does anything but just wanted to point it out.</p>
