Filebeat Demonset error while deploying on Azure Kubernetes services

Question

I am trying to deploy Filebeat demonset on Azure Kubernetes services

I have grabbed my code from : https://github.com/elastic/beats/tree/master/deploy/kubernetes/filebeat

Below is the error i am facing, Kindly let me know if am missing something here

Error:

{
    "kind": "Event",
    "apiVersion": "v1",
    "metadata": {
        "name": "filebeat.1686897c8d8bxxxx",
        "namespace": "kube-system",
        "selfLink": "/api/v1/namespaces/kube-system/events/filebeat.1686897c8d8bxxxx",
        "uid": "5b94cf20-b432-4d77-b20b-f45fd91xxxxx",
        "resourceVersion": "708810xx",
        "creationTimestamp": "2021-06-08T07:04:43Z",
        "managedFields": [
            {
                "manager": "kube-controller-manager",
                "operation": "Update",
                "apiVersion": "v1",
                "time": "2021-06-08T07:04:45Z",
                "fieldsType": "FieldsV1",
                "fieldsV1": {
                    "f:count": {},
                    "f:firstTimestamp": {},
                    "f:involvedObject": {
                        "f:apiVersion": {},
                        "f:kind": {},
                        "f:name": {},
                        "f:namespace": {},
                        "f:resourceVersion": {},
                        "f:uid": {}
                    },
                    "f:lastTimestamp": {},
                    "f:message": {},
                    "f:reason": {},
                    "f:source": {
                        "f:component": {}
                    },
                    "f:type": {}
                }
            }
        ]
    },
    "involvedObject": {
        "kind": "DaemonSet",
        "namespace": "kube-system",
        "name": "filebeat",
        "uid": "80f770e5-2b8b-xxxx-bcea-2c2dfba5xxxx",
        "apiVersion": "apps/v1",
        "resourceVersion": "7088xxxx"
    },
    "reason": "FailedCreate",
    "message": "Error creating: pods \"filebeat-\" is forbidden: error looking up service account kube-system/filebeat: serviceaccount \"filebeat\" not found",
    "source": {
        "component": "daemonset-controller"
    },
    "firstTimestamp": "2021-06-08T07:04:43Z",
    "lastTimestamp": "2021-06-08T07:04:45Z",
    "count": 9,
    "type": "Warning",
    "eventTime": null,
    "reportingComponent": "",
    "reportingInstance": ""
}

Any updates on this question? Does it solve your problem? Please let me know if you have any responses. — Charles Xu

whites11 whites11 · Accepted Answer · 2021-06-08T07:51:45

Kubernetes is failing to create your pod because it references a Service Account that does not exist. Please ensure to apply all the yaml files in the page you mentioned:

https://github.com/elastic/beats/tree/master/deploy/kubernetes/filebeat

As a basic example:

kubectl apply -f filebeat-configmap.yaml
kubectl apply -f filebeat-daemonset.yaml
kubectl apply -f filebeat-role-binding.yaml
kubectl apply -f filebeat-role.yaml
kubectl apply -f filebeat-service-account.yaml

Filebeat Demonset error while deploying on Azure Kubernetes services

2 Answers