title: How to configure fluentd daemonset for RBAC
body: <h2>Issue</h2>
  
  <p>The fluentd daemonset manifest in <a href="https://docs.fluentd.org/v0.12/articles/kubernetes-fluentd" rel="noreferrer">Kubernetes Logging with Fluentd</a> will cause an authorization error if RBAC is enabled.</p>
  
  <pre><code>$ kubectl logs fluentd-4nzv7 -n kube-system
  2018-01-06 11:28:10 +0000 [info]: reading config file path="/fluentd/etc/fluent.conf"
  2018-01-06 11:28:10 +0000 [info]: starting fluentd-0.12.33
  2018-01-06 11:28:10 +0000 [info]: gem 'fluent-plugin-elasticsearch' version '1.10.0'
  2018-01-06 11:28:10 +0000 [info]: gem 'fluent-plugin-kubernetes_metadata_filter' version '0.29.0'
  2018-01-06 11:28:10 +0000 [info]: gem 'fluent-plugin-record-reformer' version '0.9.1'
  2018-01-06 11:28:10 +0000 [info]: gem 'fluent-plugin-secure-forward' version '0.4.5'
  2018-01-06 11:28:10 +0000 [info]: gem 'fluentd' version '0.12.33'
  2018-01-06 11:28:10 +0000 [info]: adding match pattern="fluent.**" type="null"
  2018-01-06 11:28:10 +0000 [info]: adding filter pattern="kubernetes.**" type="kubernetes_metadata"
  2018-01-06 11:28:11 +0000 [info]: adding match pattern="**" type="elasticsearch"
  2018-01-06 11:28:11 +0000 [error]: config error file="/fluentd/etc/fluent.conf" error="Exception encountered fetching metadata from Kubernetes API endpoint: pods is forbidden: User \"system:serviceaccount:kube-system:default\" cannot list pods at the cluster scope ({\"kind\":\"Status\",\"apiVersion\":\"v1\",\"metadata\":{},\"status\":\"Failure\",\"message\":\"pods is forbidden: User \\\"system:serviceaccount:kube-system:default\\\" cannot list pods at the cluster scope\",\"reason\":\"Forbidden\",\"details\":{\"kind\":\"pods\"},\"code\":403}\n)"
  2018-01-06 11:28:11 +0000 [info]: process finished code=256
  2018-01-06 11:28:11 +0000 [warn]: process died within 1 second. exit.
  </code></pre>