Merge pull request #983 from alphagov/sengi/filebeat-clusterrole

Fix permissions for filebeat (log sender daemonset).
alphagov · Oct 31, 2023 · 6b6fe37 · 6b6fe37
2 parents a3a70e9 + 249d1ef
commit 6b6fe37
Showing 1 changed file with 17 additions and 0 deletions.
diff --git a/terraform/deployments/cluster-services/logging.tf b/terraform/deployments/cluster-services/logging.tf
@@ -18,6 +18,23 @@ resource "helm_release" "filebeat" {
       "filebeat.yml" = yamlencode(yamldecode(file("${path.module}/filebeat.yml")))
     }
     imageTag = "8.10.4" # TODO: Dependabot or equivalent so this doesn't get neglected.
+    clusterRoleRules = [
+      {
+        apiGroups = [""]
+        resources = ["namespaces", "nodes", "pods"]
+        verbs     = ["get", "list", "watch"]
+      },
+      {
+        apiGroups = ["apps"]
+        resources = ["replicasets"]
+        verbs     = ["get", "list", "watch"]
+      },
+      {
+        apiGroups = ["batch"]
+        resources = ["jobs"]
+        verbs     = ["get", "list", "watch"]
+      }
+    ]
     extraEnvs = [
       {
         name = "LOGSTASH_HOST"