diff --git a/README.md b/README.md
index a63241f51..15163edcc 100644
--- a/README.md
+++ b/README.md
@@ -87,7 +87,7 @@ The detailed CRD documentation can be found [here](/docs/crds.md).
 ## Contents
 - Installation
   - [Deploy with Helm](./docs/deploy/README.md#deploy-logging-operator-with-helm)
-  - [Deploy with Kuberenetes Manifests](./docs/deploy/README.md#deploy-logging-operator-from-kubernetes-manifests)
+  - [Deploy with Kubernetes Manifests](./docs/deploy/README.md#deploy-logging-operator-from-kubernetes-manifests)
 - [Supported Plugins](#supported-plugins)
 - Examples
   - [S3 Output](./docs/example-s3.md)
@@ -96,6 +96,7 @@ The detailed CRD documentation can be found [here](/docs/crds.md).
   - [Nginx with Loki Output](./docs/example-loki-nginx.md)
   - [Nginx with Kafka Output](./docs/example-kafka-nginx.md)
 - [Monitoring](./docs/logging-operator-monitoring.md)
+- [Security](./docs/security/README.md)
 - [Troubleshooting](#troubleshooting)
 - [Contributing](#contributing)
 ---
diff --git a/api/v1beta1/common_types.go b/api/v1beta1/common_types.go
index a3a11f3ae..1ad322ab4 100644
--- a/api/v1beta1/common_types.go
+++ b/api/v1beta1/common_types.go
@@ -36,3 +36,10 @@ type Metrics struct {
 type KubernetesStorage struct {
 	HostPath *corev1.HostPathVolumeSource `json:"host_path,omitempty"`
 }
+
+// Security defines Fluentd, Fluentbit deployment security properties
+type Security struct {
+	ServiceAccount               string `json:"serviceAccount,omitempty"`
+	RoleBasedAccessControlCreate *bool  `json:"roleBasedAccessControlCreate,omitempty"`
+	PodSecurityPolicyCreate      bool   `json:"podSecurityPolicyCreate,omitempty"`
+}
diff --git a/api/v1beta1/fluentbit_types.go b/api/v1beta1/fluentbit_types.go
index 4313202c8..4d9db0557 100644
--- a/api/v1beta1/fluentbit_types.go
+++ b/api/v1beta1/fluentbit_types.go
@@ -33,6 +33,7 @@ type FluentbitSpec struct {
 	Parser      string                      `json:"parser,omitempty"`
 	Tolerations []corev1.Toleration         `json:"tolerations,omitempty"`
 	Metrics     *Metrics                    `json:"metrics,omitempty"`
+	Security    *Security                   `json:"security,omitempty"`
 	PositionDB  *KubernetesStorage          `json:"position_db,omitempty"`
 }
 
diff --git a/api/v1beta1/fluentd_types.go b/api/v1beta1/fluentd_types.go
index dfb24105f..8a3f2ee9f 100644
--- a/api/v1beta1/fluentd_types.go
+++ b/api/v1beta1/fluentd_types.go
@@ -34,6 +34,7 @@ type FluentdSpec struct {
 	Tolerations         []corev1.Toleration              `json:"tolerations,omitempty"`
 	NodeSelector        map[string]string                `json:"nodeSelector,omitempty"`
 	Metrics             *Metrics                         `json:"metrics,omitempty"`
+	Security            *Security                        `json:"security,omitempty"`
 }
 
 // +kubebuilder:object:generate=true
diff --git a/api/v1beta1/logging_types.go b/api/v1beta1/logging_types.go
index b27f32ee1..9920ed949 100644
--- a/api/v1beta1/logging_types.go
+++ b/api/v1beta1/logging_types.go
@@ -17,6 +17,7 @@ package v1beta1
 import (
 	"fmt"
 
+	"github.com/banzaicloud/logging-operator/pkg/util"
 	v1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -77,7 +78,7 @@ func (l *Logging) SetDefaults() *Logging {
 			copy.Spec.FluentdSpec.Image.Repository = "banzaicloud/fluentd"
 		}
 		if copy.Spec.FluentdSpec.Image.Tag == "" {
-			copy.Spec.FluentdSpec.Image.Tag = "v1.6.3-alpine-1"
+			copy.Spec.FluentdSpec.Image.Tag = "v1.6.3-alpine-2"
 		}
 		if copy.Spec.FluentdSpec.Image.PullPolicy == "" {
 			copy.Spec.FluentdSpec.Image.PullPolicy = "IfNotPresent"
@@ -85,6 +86,12 @@ func (l *Logging) SetDefaults() *Logging {
 		if copy.Spec.FluentdSpec.Annotations == nil {
 			copy.Spec.FluentdSpec.Annotations = make(map[string]string)
 		}
+		if copy.Spec.FluentdSpec.Security == nil {
+			copy.Spec.FluentdSpec.Security = &Security{}
+		}
+		if copy.Spec.FluentdSpec.Security.RoleBasedAccessControlCreate == nil {
+			copy.Spec.FluentdSpec.Security.RoleBasedAccessControlCreate = util.BoolPointer(true)
+		}
 		if copy.Spec.FluentdSpec.Metrics != nil {
 			if copy.Spec.FluentdSpec.Metrics.Path == "" {
 				copy.Spec.FluentdSpec.Metrics.Path = "/metrics"
@@ -181,6 +188,12 @@ func (l *Logging) SetDefaults() *Logging {
 			copy.Spec.FluentbitSpec.Annotations = make(map[string]string)
 		}
 
+		if copy.Spec.FluentbitSpec.Security == nil {
+			copy.Spec.FluentbitSpec.Security = &Security{}
+		}
+		if copy.Spec.FluentbitSpec.Security.RoleBasedAccessControlCreate == nil {
+			copy.Spec.FluentbitSpec.Security.RoleBasedAccessControlCreate = util.BoolPointer(true)
+		}
 		if copy.Spec.FluentbitSpec.Metrics != nil {
 			if copy.Spec.FluentbitSpec.Metrics.Path == "" {
 				copy.Spec.FluentbitSpec.Metrics.Path = "/api/v1/metrics/prometheus"
diff --git a/api/v1beta1/zz_generated.deepcopy.go b/api/v1beta1/zz_generated.deepcopy.go
index 9e22bb69c..cdd408654 100644
--- a/api/v1beta1/zz_generated.deepcopy.go
+++ b/api/v1beta1/zz_generated.deepcopy.go
@@ -342,6 +342,11 @@ func (in *FluentbitSpec) DeepCopyInto(out *FluentbitSpec) {
 		*out = new(Metrics)
 		**out = **in
 	}
+	if in.Security != nil {
+		in, out := &in.Security, &out.Security
+		*out = new(Security)
+		(*in).DeepCopyInto(*out)
+	}
 	if in.PositionDB != nil {
 		in, out := &in.PositionDB, &out.PositionDB
 		*out = new(KubernetesStorage)
@@ -409,6 +414,11 @@ func (in *FluentdSpec) DeepCopyInto(out *FluentdSpec) {
 		*out = new(Metrics)
 		**out = **in
 	}
+	if in.Security != nil {
+		in, out := &in.Security, &out.Security
+		*out = new(Security)
+		(*in).DeepCopyInto(*out)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FluentdSpec.
@@ -740,3 +750,23 @@ func (in *OutputStatus) DeepCopy() *OutputStatus {
 	in.DeepCopyInto(out)
 	return out
 }
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Security) DeepCopyInto(out *Security) {
+	*out = *in
+	if in.RoleBasedAccessControlCreate != nil {
+		in, out := &in.RoleBasedAccessControlCreate, &out.RoleBasedAccessControlCreate
+		*out = new(bool)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Security.
+func (in *Security) DeepCopy() *Security {
+	if in == nil {
+		return nil
+	}
+	out := new(Security)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/charts/logging-operator/templates/rbac.yaml b/charts/logging-operator/templates/rbac.yaml
index e89819e4f..db3444770 100644
--- a/charts/logging-operator/templates/rbac.yaml
+++ b/charts/logging-operator/templates/rbac.yaml
@@ -90,6 +90,7 @@ rules:
       - rolebindings
       - clusterroles
       - clusterrolebindings
+      - podsecuritypolicies
       - daemonsets
       - deployments
       - replicasets
@@ -97,6 +98,14 @@ rules:
       - jobs
     verbs:
       - "*"
+  - apiGroups:
+      - extensions
+      - policy
+    resources:
+      - podsecuritypolicies
+    verbs:
+      - list
+      - get
   {{- if .Values.rbac.psp.enabled }}
   - apiGroups:
       - extensions
diff --git a/charts/nginx-logging-demo/README.md b/charts/nginx-logging-demo/README.md
index 1311c9ead..6c9ffa6c3 100644
--- a/charts/nginx-logging-demo/README.md
+++ b/charts/nginx-logging-demo/README.md
@@ -40,29 +40,35 @@ The command removes all the Kubernetes components associated with the chart and
 
 The following tables lists the configurable parameters of the nginx-logging-demo chart and their default values.
 
-|                          Parameter                        |                        Description                      |     Default    |
-| --------------------------------------------------------- | ------------------------------------------------------- | -------------- |
-| `image.repository`                                        | Container image repository                              | `nginx`        |
-| `image.tag`                                               | Container image tag                                     | `stable`       |
-| `image.pullPolicy`                                        | Container pull policy                                   | `IfNotPresent` |
-| `nameOverride`                                            | Override name of app                                    | ``             |
-| `fullnameOverride`                                        | Override full name of app                               | ``             |
-| `affinity`                                                | Node Affinity                                           | `{}`           |
-| `resources`                                               | CPU/Memory resource requests/limits                     | `{}`           |
-| `tolerations`                                             | Node Tolerations                                        | `[]`           |
-| `nodeSelector`                                            | Define which Nodes the Pods are scheduled on.           | `{}`           |
-| `loggingOperator.fluentd.metrics.serviceMonitor`          | Enable to create ServiceMonitor for Prometheus operator | `false`        |
-| `loggingOperator.fluentd.metrics.prometheusAnnotations`   | Add prometheus labes to fluent pods.                    | `false`        |
-| `loggingOperator.fluentd.metrics.port`                    | Metrics Port.                                           | ``             |
-| `loggingOperator.fluentd.metrics.path`                    | Metrics Path                                            | ``             |
-| `loggingOperator.fluentd.metrics.timeout`                 | Scrape timeout.                                         | ``             |
-| `loggingOperator.fluentd.metrics.interval`                | Scrape interval.                                        | ``             |
-| `loggingOperator.fluentbit.metrics.serviceMonitor`        | Enable to create ServiceMonitor for Prometheus operator | `false`        |
-| `loggingOperator.fluentbit.metrics.prometheusAnnotations` | Add prometheus labes to fluent pods.                    | `false`        |
-| `loggingOperator.fluentbit.metrics.port`                  | Metrics Port.                                           | ``             |
-| `loggingOperator.fluentbit.metrics.path`                  | Metrics Path                                            | ``             |
-| `loggingOperator.fluentbit.metrics.timeout`               | Scrape timeout.                                         | ``             |
-| `loggingOperator.fluentbit.metrics.interval`              | Scrape interval.                                        | ``             |
+|                          Parameter                                |                        Description                      |     Default    |
+| ---------------------------------------------------------         | ------------------------------------------------------- | -------------- |
+| `image.repository`                                                | Container image repository                              | `nginx`        |
+| `image.tag`                                                       | Container image tag                                     | `stable`       |
+| `image.pullPolicy`                                                | Container pull policy                                   | `IfNotPresent` |
+| `nameOverride`                                                    | Override name of app                                    | ``             |
+| `fullnameOverride`                                                | Override full name of app                               | ``             |
+| `affinity`                                                        | Node Affinity                                           | `{}`           |
+| `resources`                                                       | CPU/Memory resource requests/limits                     | `{}`           |
+| `tolerations`                                                     | Node Toleration                                         | `[]`           |
+| `nodeSelector`                                                    | Define which Nodes the Pods are scheduled on.           | `{}`           |
+| `loggingOperator.fluentd.metrics.serviceMonitor`                  | Enable to create ServiceMonitor for Prometheus operator | `false`        |
+| `loggingOperator.fluentd.metrics.prometheusAnnotations`           | Add prometheus labels to fluent pods.                   | `false`        |
+| `loggingOperator.fluentd.metrics.port`                            | Metrics Port.                                           | ``             |
+| `loggingOperator.fluentd.metrics.path`                            | Metrics Path                                            | ``             |
+| `loggingOperator.fluentd.metrics.timeout`                         | Scrape timeout.                                         | ``             |
+| `loggingOperator.fluentd.metrics.interval`                        | Scrape interval.                                        | ``             |
+| `loggingOperator.fluentbit.metrics.serviceMonitor`                | Enable to create ServiceMonitor for Prometheus operator | `false`        |
+| `loggingOperator.fluentbit.metrics.prometheusAnnotations`         | Add prometheus labels to fluent pods.                   | `false`        |
+| `loggingOperator.fluentbit.metrics.port`                          | Metrics Port.                                           | ``             |
+| `loggingOperator.fluentbit.metrics.path`                          | Metrics Path                                            | ``             |
+| `loggingOperator.fluentbit.metrics.timeout`                       | Scrape timeout.                                         | ``             |
+| `loggingOperator.fluentbit.metrics.interval`                      | Scrape interval.                                        | ``             |
+| `loggingOperator.fluentd.security.roleBasedAccessControlCreate`   | Enable fluentd RBAC                                     | `true`         |
+| `loggingOperator.fluentd.security.podSecurityPolicyCreate`        | Enable fluentd PSP                                      | `true`         |
+| `loggingOperator.fluentd.security.serviceAccount`                 | Set fluentd Service Account                             | ``             |
+| `loggingOperator.fluentbit.security.roleBasedAccessControlCreate` | Enable fluentbit RBAC                                   | `true`         |
+| `loggingOperator.fluentbit.security.podSecurityPolicyCreate`      | Enable fluentbit PSP                                    | `true`         |
+| `loggingOperator.fluentbit.security.serviceAccount`               | Set fluentbit Service Account                           | ``             |
 
 
 Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example:
diff --git a/config/crd/bases/logging.banzaicloud.io_loggings.yaml b/config/crd/bases/logging.banzaicloud.io_loggings.yaml
index 64eb011ec..b9bbc9530 100644
--- a/config/crd/bases/logging.banzaicloud.io_loggings.yaml
+++ b/config/crd/bases/logging.banzaicloud.io_loggings.yaml
@@ -119,6 +119,17 @@ spec:
                         to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/'
                       type: object
                   type: object
+                security:
+                  description: Security defines Fluentd, Fluentbit deployment security
+                    properties
+                  properties:
+                    podSecurityPolicyCreate:
+                      type: boolean
+                    roleBasedAccessControlCreate:
+                      type: boolean
+                    serviceAccount:
+                      type: string
+                  type: object
                 targetHost:
                   type: string
                 targetPort:
@@ -372,6 +383,17 @@ spec:
                         to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/'
                       type: object
                   type: object
+                security:
+                  description: Security defines Fluentd, Fluentbit deployment security
+                    properties
+                  properties:
+                    podSecurityPolicyCreate:
+                      type: boolean
+                    roleBasedAccessControlCreate:
+                      type: boolean
+                    serviceAccount:
+                      type: string
+                  type: object
                 tls:
                   description: FluentdTLS defines the TLS configs
                   properties:
diff --git a/docs/deploy/manifests/rbac.yaml b/docs/deploy/manifests/rbac.yaml
index 6a2752105..3aac65018 100644
--- a/docs/deploy/manifests/rbac.yaml
+++ b/docs/deploy/manifests/rbac.yaml
@@ -79,6 +79,7 @@ rules:
       - rolebindings
       - clusterroles
       - clusterrolebindings
+      - podsecuritypolicies
       - daemonsets
       - deployments
       - replicasets
@@ -86,6 +87,7 @@ rules:
       - jobs
     verbs:
       - "*"
+
 ---
 # Source: logging-operator/templates/rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1beta1
diff --git a/docs/example-es-nginx.md b/docs/example-es-nginx.md
index 79bb3a46f..08d96057d 100644
--- a/docs/example-es-nginx.md
+++ b/docs/example-es-nginx.md
@@ -11,10 +11,10 @@
     - [Deploy with Helm](#example-es-nginx.md#deploy-elasticsearch)
   - **Logging Operator**
     - [Deploy with Helm](#install-with-helm)
-    - [Deploy with Kuberenetes Manifests](./deploy/README.md#deploy-logging-operator-from-kubernetes-manifests)
+    - [Deploy with Kubernetes Manifests](./deploy/README.md#deploy-logging-operator-from-kubernetes-manifests)
    - **Demo Application**  
     - [Deploy with Helm](#nginx-app-and-logging-definition)
-    - [Deploy with Kuberenetes Manifests](#install-from-kubernetes-manifests)
+    - [Deploy with Kubernetes Manifests](#install-from-kubernetes-manifests)
 - **Validation**
     - [Cerebro Dashboard](#forward-cerebro-dashboard)
     - [Kibana Dashboard](#forward-kibana-dashboard)
diff --git a/docs/example-kafka-nginx.md b/docs/example-kafka-nginx.md
index cecdc2222..0b91972f7 100644
--- a/docs/example-kafka-nginx.md
+++ b/docs/example-kafka-nginx.md
@@ -11,10 +11,10 @@
     - [Deploy with Helm](#deploy-kafka)
   - **Logging Operator**
     - [Deploy with Helm](#install-with-helm)
-    - [Deploy with Kuberenetes Manifests](./deploy/README.md#deploy-logging-operator-from-kubernetes-manifests)
+    - [Deploy with Kubernetes Manifests](./deploy/README.md#deploy-logging-operator-from-kubernetes-manifests)
    - **Demo Application**  
     - [Deploy with Helm](install-with-helm)
-    - [Deploy with Kuberenetes Manifests](#install-from-kubernetes-manifests)
+    - [Deploy with Kubernetes Manifests](#install-from-kubernetes-manifests)
 - **Validation**
     - [Kafkacat](#test-your-deployment-with-kafkacat)
 ---
diff --git a/docs/example-loki-nginx.md b/docs/example-loki-nginx.md
index 9b2422c2e..56fbef78b 100644
--- a/docs/example-loki-nginx.md
+++ b/docs/example-loki-nginx.md
@@ -11,10 +11,10 @@
     - [Deploy with Helm](#add-operator-chart-repository)
   - **Logging Operator**
     - [Deploy with Helm](#install-with-helm)
-    - [Deploy with Kuberenetes Manifests](./deploy/README.md#deploy-logging-operator-from-kubernetes-manifests)
+    - [Deploy with Kubernetes Manifests](./deploy/README.md#deploy-logging-operator-from-kubernetes-manifests)
    - **Demo Application**  
     - [Deploy with Helm](#nginx-app--logging-definition)
-    - [Deploy with Kuberenetes Manifests](#install-from-manifest)
+    - [Deploy with Kubernetes Manifests](#install-from-manifest)
 - **Validation**
     - [Grafana Dashboard](#grafana-dashboard)
 ---
diff --git a/docs/logging-operator-monitoring.md b/docs/logging-operator-monitoring.md
index c3f6246c7..9a77c67da 100644
--- a/docs/logging-operator-monitoring.md
+++ b/docs/logging-operator-monitoring.md
@@ -11,12 +11,12 @@
     - [Deploy with Helm](#install-prometheus-operator-with-helm)
   - **Logging Operator**
     - [Deploy with Helm](#install-with-helm)
-    - [Deploy with Kuberenetes Manifests](./deploy/README.md#deploy-logging-operator-from-kubernetes-manifests)
+    - [Deploy with Kubernetes Manifests](./deploy/README.md#deploy-logging-operator-from-kubernetes-manifests)
   - **Minio**  
-    - [Deploy with Kuberenetes Manifests](#install-minio)
+    - [Deploy with Kubernetes Manifests](#install-minio)
    - **Demo Application**  
     - [Deploy with Helm](#deploy-demo-nginx-app--logging-definition-with-metrics)
-    - [Deploy with Kuberenetes Manifests](#install-from-manifest)
+    - [Deploy with Kubernetes Manifests](#install-from-manifest)
 - **Validation**
     - [Prometheus Dashboard](#prometheus)
     - [Minio Dashboard](#minio)
diff --git a/docs/security/README.md b/docs/security/README.md
new file mode 100644
index 000000000..2ab30b85b
--- /dev/null
+++ b/docs/security/README.md
@@ -0,0 +1,297 @@
+<p align="center"><img src="../img/lo.svg" width="260"></p>
+<p align="center">
+
+# Logging-operator && Security
+
+---
+## Contents
+- **Using RBAC Authorization**
+    - [Deploy with Kubernetes Manifests](#deploy-with-kubernetes-manifests)
+    - [Deploy with Helm](#deploy-with-helm)
+    - [Output](#example-manifest-generated-by-the-operator)
+- **Service Account**  
+    - [Deploy with Kubernetes Manifests](#deploy-with-kubernetes-manifests-1)
+    - [Deploy with Helm](#deploy-with-helm-1)
+- **Pod Security Policy**
+    - [Deploy with Kubernetes Manifests](#create-logging-resource-with-psp)
+    - [Deploy with Helm](#deploy-with-helm-2)
+    - [Output](#example-manifest-generated-by-the-operator-1)
+---
+
+
+### Security Variables
+| Variable Name | Type | Required | Default | Description |
+|---|---|---|---|---|
+| roleBasedAccessControlCreate | bool | No | True | create RBAC resources |
+| podSecurityPolicyCreate | bool | No | False | create PSP resources |
+| serviceAccount | string | No | - | Set ServiceAccount |
+
+## Using [RBAC](https://kubernetes.io/docs/reference/access-authn-authz/rbac/) Authorization
+> By default the rbac is enabled.
+
+### Deploy with Kubernetes Manifests
+#### Create `logging` resource with RBAC
+```bash
+cat <<EOF | kubectl -n logging apply -f -
+apiVersion: logging.banzaicloud.io/v1beta1
+kind: Logging
+metadata:
+  name: default-logging-simple
+spec:
+  fluentd:
+    security:
+      roleBasedAccessControlCreate: true
+  fluentbit:
+    security:
+      roleBasedAccessControlCreate: true
+  controlNamespace: logging
+EOF
+```
+
+### Deploy with Helm
+```bash
+helm install --namespace logging --name nginx-demo banzaicloud-stable/nginx-logging-demo \
+    --set=loggingOperator.fluentd.security.roleBasedAccessControlCreate=True \
+    --set=loggingOperator.fluentbit.security.roleBasedAccessControlCreate=True
+```
+
+### Example Manifest Generated by the operator
+
+#### Fluentd Role & RoleBinding Output
+``` 
+- apiVersion: rbac.authorization.k8s.io/v1
+  kind: Role
+  metadata:
+    name: nginx-demo-nginx-logging-demo-logging-fluentd
+    namespace: logging
+    ownerReferences:
+    - apiVersion: logging.banzaicloud.io/v1beta1
+      controller: true
+      kind: Logging
+  rules:
+  - apiGroups:
+    - ""
+    resources:
+    - configmaps
+    - secrets
+    verbs:
+    - '*'
+
+--
+- apiVersion: rbac.authorization.k8s.io/v1
+  kind: RoleBinding
+  metadata:
+    annotations:
+    name: nginx-demo-nginx-logging-demo-logging-fluentd
+    namespace: logging
+    ownerReferences:
+    - apiVersion: logging.banzaicloud.io/v1beta1
+      controller: true
+      kind: Logging
+  roleRef:
+    apiGroup: rbac.authorization.k8s.io
+    kind: Role
+    name: nginx-demo-nginx-logging-demo-logging-fluentd
+  subjects:
+  - kind: ServiceAccount
+    name: nginx-demo-nginx-logging-demo-logging-fluentd
+    namespace: logging
+
+
+```
+
+#### Fluentbit ClusterRole & ClusterRoleBinding Output
+``` 
+kind: ClusterRole
+metadata:
+  annotations:
+  name: nginx-demo-nginx-logging-demo-logging-fluentbit
+  ownerReferences:
+  - apiVersion: logging.banzaicloud.io/v1beta1
+    controller: true
+    kind: Logging
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - namespaces
+  verbs:
+  - get
+  - list
+  - watch
+
+---
+kind: ClusterRoleBinding
+metadata:
+  annotations:
+  name: logging-nginx-demo-nginx-logging-demo-logging-fluentbit
+  ownerReferences:
+  - apiVersion: logging.banzaicloud.io/v1beta1
+    controller: true
+    kind: Logging
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: nginx-demo-nginx-logging-demo-logging-fluentbit
+subjects:
+- kind: ServiceAccount
+  name: nginx-demo-nginx-logging-demo-logging-fluentbit
+  namespace: logging
+
+```
+---
+
+## Service Account ([SA](https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/))
+### Deploy with Kubernetes Manifests
+#### Create `logging` resource with Service Account
+```bash
+cat <<EOF | kubectl -n logging apply -f -
+apiVersion: logging.banzaicloud.io/v1beta1
+kind: Logging
+metadata:
+  name: default-logging-simple
+spec:
+  fluentd:
+    security:
+      serviceAccount: fluentdUser1
+  fluentbit:
+    security:
+      serviceAccount: fluentbitUser1
+  controlNamespace: logging
+EOF
+```
+### Deploy with Helm
+```bash
+helm install --namespace logging --name nginx-demo banzaicloud-stable/nginx-logging-demo \
+    --set=loggingOperator.fluentd.security.serviceAccount=fluentdUser1 \
+    --set=loggingOperator.fluentbit.security.serviceAccount=fluentbitUser1
+```
+
+---
+## Enabling Pod Security Policies ([PSP](https://kubernetes.io/docs/concepts/policy/pod-security-policy/))
+> This option depends on the roleBasedAccessControlCreate enabled status because the psp require rbac roles also. 
+
+### Deploy with Kubernetes Manifests
+#### Create `logging` resource with PSP
+```bash
+cat <<EOF | kubectl -n logging apply -f -
+apiVersion: logging.banzaicloud.io/v1beta1
+kind: Logging
+metadata:
+  name: default-logging-simple
+spec:
+  fluentd:
+    security:
+      podSecurityPolicyCreate: true
+      roleBasedAccessControlCreate: true
+  fluentbit:
+    security:
+      podSecurityPolicyCreate: true
+      roleBasedAccessControlCreate: true
+  controlNamespace: logging
+EOF
+```
+### Deploy with Helm
+```bash
+helm install --namespace logging --name nginx-demo banzaicloud-stable/nginx-logging-demo \
+    --set=loggingOperator.fluentd.security.podSecurityPolicyCreate=True \
+    --set=loggingOperator.fluentd.security.roleBasedAccessControlCreate=True \
+    --set=loggingOperator.fluentbit.security.podSecurityPolicyCreate=True \
+    --set=loggingOperator.fluentbit.security.roleBasedAccessControlCreate=True 
+```
+
+### Example Manifest Generated by the operator
+
+#### Fluentd PSP+Role Output
+``` 
+kind: Role
+metadata:
+  name: nginx-demo-nginx-logging-demo-logging-fluentd-psp
+  namespace: logging
+rules:
+- apiGroups:
+  - policy
+  resources:
+  - nginx-demo-nginx-logging-demo-logging-fluentd
+  verbs:
+  - use
+
+---
+kind: PodSecurityPolicy
+metadata:
+  name: nginx-demo-nginx-logging-demo-logging-fluentd
+spec:
+  allowPrivilegeEscalation: false
+  fsGroup:
+    ranges:
+    - max: 65535
+      min: 1
+    rule: MustRunAs
+  runAsUser:
+    ranges:
+    - max: 65535
+      min: 1
+    rule: MustRunAs
+  seLinux:
+    rule: RunAsAny
+  supplementalGroups:
+    ranges:
+    - max: 65535
+      min: 1
+    rule: MustRunAs
+  volumes:
+  - configMap
+  - emptyDir
+  - secret
+  - persistentVolumeClaim
+
+
+```
+#### Fluentbit PSP+ClusterRole Output
+```
+kind: ClusterRole
+metadata:
+  name: nginx-demo-nginx-logging-demo-logging-fluentbit-psp
+rules:
+- apiGroups:
+  - policy
+  resources:
+  - nginx-demo-nginx-logging-demo-logging-fluentbit
+  verbs:
+  - use
+---
+kind: PodSecurityPolicy
+metadata:
+  name: nginx-demo-nginx-logging-demo-logging-fluentbit
+spec:
+  allowPrivilegeEscalation: false
+  allowedHostPaths:
+  - pathPrefix: /var/lib/docker/containers
+    readOnly: true
+  - pathPrefix: /var/log
+    readOnly: true
+  fsGroup:
+    ranges:
+    - max: 65535
+      min: 1
+    rule: MustRunAs
+  readOnlyRootFilesystem: true
+  runAsUser:
+    ranges:
+    - max: 65535
+      min: 1
+    rule: MustRunAs
+  seLinux:
+    rule: RunAsAny
+  supplementalGroups:
+    ranges:
+    - max: 65535
+      min: 1
+    rule: MustRunAs
+  volumes:
+  - configMap
+  - emptyDir
+  - secret
+  - hostPath
+```
diff --git a/docs/security/manifests/deployment.yaml b/docs/security/manifests/deployment.yaml
new file mode 100644
index 000000000..b49c2d526
--- /dev/null
+++ b/docs/security/manifests/deployment.yaml
@@ -0,0 +1,21 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: logging-operator
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: logging-operator
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: logging-operator
+    spec:
+      containers:
+        - name: logging-operator
+          image: "banzaicloud/logging-operator:2.1.0"
+          imagePullPolicy: IfNotPresent
+          resources:
+            {}
+      serviceAccountName: logging-operator
diff --git a/docs/security/manifests/rbac.yaml b/docs/security/manifests/rbac.yaml
new file mode 100644
index 000000000..3aac65018
--- /dev/null
+++ b/docs/security/manifests/rbac.yaml
@@ -0,0 +1,104 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: logging-operator
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRole
+metadata:
+  name: logging-operator
+rules:
+  - apiGroups:
+      - monitoring.coreos.com
+    resources:
+      - alertmanagers
+      - prometheuses
+      - prometheuses/finalizers
+      - alertmanagers/finalizers
+      - servicemonitors
+      - podmonitors
+      - prometheusrules
+      - podmonitors
+    verbs:
+      - '*'
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions
+    verbs:
+      - list
+      - watch
+  - apiGroups:
+      - logging.banzaicloud.io
+    resources:
+      - loggings
+      - flows
+      - clusterflows
+      - outputs
+      - clusteroutputs
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+  - apiGroups:
+      - logging.banzaicloud.io
+    resources:
+      - loggings/status
+    verbs:
+      - get
+      - patch
+      - update
+  - apiGroups:
+      - ""
+      - apps
+      - batch
+      - extensions
+      - policy
+      - rbac.authorization.k8s.io
+    resources:
+      - namespaces
+      - nodes
+      - persistentvolumeclaims
+      - pods
+      - services
+      - resourcequotas
+      - replicationcontrollers
+      - limitranges
+      - persistentvolumeclaims
+      - persistentvolumes
+      - endpoints
+      - secrets
+      - configmaps
+      - serviceaccounts
+      - roles
+      - rolebindings
+      - clusterroles
+      - clusterrolebindings
+      - podsecuritypolicies
+      - daemonsets
+      - deployments
+      - replicasets
+      - statefulsets
+      - jobs
+    verbs:
+      - "*"
+
+---
+# Source: logging-operator/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  name: logging-operator
+subjects:
+  - kind: ServiceAccount
+    name: logging-operator
+    namespace: logging
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: logging-operator
diff --git a/hack/test.sh b/hack/test.sh
index f984d7b3b..c02322f4e 100755
--- a/hack/test.sh
+++ b/hack/test.sh
@@ -64,6 +64,7 @@ function wait_for_log_files()
     done
 
     echo 'Cannot find any log files within timeout'
+    kubectl get pod,svc --namespace logging
     exit 1
 }
 
diff --git a/pkg/resources/fluentbit/daemonset.go b/pkg/resources/fluentbit/daemonset.go
index 2bd1a99ed..322b0b7b9 100644
--- a/pkg/resources/fluentbit/daemonset.go
+++ b/pkg/resources/fluentbit/daemonset.go
@@ -53,7 +53,7 @@ func (r *Reconciler) daemonSet() (runtime.Object, k8sutil.DesiredState) {
 					Annotations: r.Logging.Spec.FluentbitSpec.Annotations,
 				},
 				Spec: corev1.PodSpec{
-					ServiceAccountName: r.Logging.QualifiedName(serviceAccountName),
+					ServiceAccountName: r.getServiceAccount(),
 					Volumes:            r.generateVolume(),
 					Tolerations:        r.Logging.Spec.FluentbitSpec.Tolerations,
 					Containers: []corev1.Container{
diff --git a/pkg/resources/fluentbit/fluentbit.go b/pkg/resources/fluentbit/fluentbit.go
index 6c3ac2b74..1d26ceb9c 100644
--- a/pkg/resources/fluentbit/fluentbit.go
+++ b/pkg/resources/fluentbit/fluentbit.go
@@ -15,6 +15,8 @@
 package fluentbit
 
 import (
+	"emperror.dev/errors"
+
 	"github.com/banzaicloud/logging-operator/api/v1beta1"
 	"github.com/banzaicloud/logging-operator/pkg/k8sutil"
 	"github.com/banzaicloud/logging-operator/pkg/resources"
@@ -26,12 +28,13 @@ import (
 )
 
 const (
-	serviceAccountName        = "logging"
-	clusterRoleBindingName    = "logging"
-	clusterRoleName           = "logging"
-	fluentBitSecretConfigName = "fluentbit"
-	fluentbitDaemonSetName    = "fluentbit"
-	fluentbitServiceName      = "fluentbit"
+	defaultServiceAccountName      = "fluentbit"
+	clusterRoleBindingName         = "fluentbit"
+	clusterRoleName                = "fluentbit"
+	fluentBitSecretConfigName      = "fluentbit"
+	fluentbitDaemonSetName         = "fluentbit"
+	fluentbitPodSecurityPolicyName = "fluentbit"
+	fluentbitServiceName           = "fluentbit"
 )
 
 func generataLoggingRefLabels(loggingRef string) map[string]string {
@@ -43,6 +46,13 @@ func (r *Reconciler) getFluentBitLabels() map[string]string {
 		"app.kubernetes.io/name": "fluentbit"}, generataLoggingRefLabels(r.Logging.ObjectMeta.GetName()))
 }
 
+func (r *Reconciler) getServiceAccount() string {
+	if r.Logging.Spec.FluentbitSpec.Security.ServiceAccount != "" {
+		return r.Logging.Spec.FluentbitSpec.Security.ServiceAccount
+	}
+	return r.Logging.QualifiedName(defaultServiceAccountName)
+}
+
 // Reconciler holds info what resource to reconcile
 type Reconciler struct {
 	Logging *v1beta1.Logging
@@ -63,12 +73,18 @@ func (r *Reconciler) Reconcile() (*reconcile.Result, error) {
 		r.serviceAccount,
 		r.clusterRole,
 		r.clusterRoleBinding,
+		r.clusterPodSecurityPolicy,
+		r.pspClusterRole,
+		r.pspClusterRoleBinding,
 		r.configSecret,
 		r.daemonSet,
 		r.serviceMetrics,
 		r.monitorServiceMetrics,
 	} {
 		o, state := res()
+		if o == nil {
+			return nil, errors.Errorf("Reconcile error! Resource %#v returns with nil object", res)
+		}
 		err := r.ReconcileResource(o, state)
 		if err != nil {
 			return nil, emperror.WrapWith(err, "failed to reconcile resource", "resource", o.GetObjectKind().GroupVersionKind())
diff --git a/pkg/resources/fluentbit/psp.go b/pkg/resources/fluentbit/psp.go
new file mode 100644
index 000000000..b60671ce7
--- /dev/null
+++ b/pkg/resources/fluentbit/psp.go
@@ -0,0 +1,128 @@
+// Copyright © 2019 Banzai Cloud
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package fluentbit
+
+import (
+	"github.com/banzaicloud/logging-operator/pkg/k8sutil"
+	"github.com/banzaicloud/logging-operator/pkg/resources/templates"
+	"github.com/banzaicloud/logging-operator/pkg/util"
+	policyv1beta1 "k8s.io/api/policy/v1beta1"
+	rbacv1 "k8s.io/api/rbac/v1"
+
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+func (r *Reconciler) clusterPodSecurityPolicy() (runtime.Object, k8sutil.DesiredState) {
+	if r.Logging.Spec.FluentbitSpec.Security.PodSecurityPolicyCreate {
+
+		return &policyv1beta1.PodSecurityPolicy{
+			ObjectMeta: templates.FluentbitObjectMetaClusterScope(
+				r.Logging.QualifiedName(fluentbitPodSecurityPolicyName),
+				util.MergeLabels(r.Logging.Labels, r.getFluentBitLabels()),
+				r.Logging),
+			Spec: policyv1beta1.PodSecurityPolicySpec{
+				Volumes: []policyv1beta1.FSType{
+					"configMap",
+					"emptyDir",
+					"secret",
+					"hostPath"},
+				SELinux: policyv1beta1.SELinuxStrategyOptions{
+					Rule: policyv1beta1.SELinuxStrategyRunAsAny,
+				},
+				RunAsUser: policyv1beta1.RunAsUserStrategyOptions{
+					Rule:   policyv1beta1.RunAsUserStrategyMustRunAs,
+					Ranges: []policyv1beta1.IDRange{{Min: 1, Max: 65535}}},
+				RunAsGroup: nil,
+				SupplementalGroups: policyv1beta1.SupplementalGroupsStrategyOptions{
+					Rule:   policyv1beta1.SupplementalGroupsStrategyMustRunAs,
+					Ranges: []policyv1beta1.IDRange{{Min: 1, Max: 65535}},
+				},
+				FSGroup: policyv1beta1.FSGroupStrategyOptions{
+					Rule:   policyv1beta1.FSGroupStrategyMustRunAs,
+					Ranges: []policyv1beta1.IDRange{{Min: 1, Max: 65535}},
+				},
+				ReadOnlyRootFilesystem:   true,
+				AllowPrivilegeEscalation: util.BoolPointer(false),
+				AllowedHostPaths: []policyv1beta1.AllowedHostPath{{
+					PathPrefix: "/var/lib/docker/containers",
+					ReadOnly:   true,
+				}, {
+					PathPrefix: "/var/log",
+					ReadOnly:   true,
+				}},
+			},
+		}, k8sutil.StatePresent
+
+	}
+	return &policyv1beta1.PodSecurityPolicy{
+		ObjectMeta: templates.FluentbitObjectMeta(
+			r.Logging.QualifiedName(fluentbitPodSecurityPolicyName),
+			util.MergeLabels(r.Logging.Labels, r.getFluentBitLabels()),
+			r.Logging),
+		Spec: policyv1beta1.PodSecurityPolicySpec{},
+	}, k8sutil.StateAbsent
+
+}
+
+func (r *Reconciler) pspClusterRole() (runtime.Object, k8sutil.DesiredState) {
+	if *r.Logging.Spec.FluentbitSpec.Security.RoleBasedAccessControlCreate && r.Logging.Spec.FluentbitSpec.Security.PodSecurityPolicyCreate {
+		return &rbacv1.ClusterRole{
+			ObjectMeta: templates.FluentbitObjectMetaClusterScope(
+				r.Logging.QualifiedName(clusterRoleName+"-psp"), r.Logging.Labels, r.Logging),
+			Rules: []rbacv1.PolicyRule{
+				{
+					APIGroups: []string{"policy"},
+					Resources: []string{r.Logging.QualifiedName(fluentbitPodSecurityPolicyName)},
+					Verbs:     []string{"use"},
+				},
+			},
+		}, k8sutil.StatePresent
+	}
+	return &rbacv1.ClusterRole{
+		ObjectMeta: templates.FluentbitObjectMetaClusterScope(
+			r.Logging.QualifiedName(clusterRoleName+"-psp"),
+			r.Logging.Labels, r.Logging,
+		),
+		Rules: []rbacv1.PolicyRule{}}, k8sutil.StateAbsent
+}
+
+func (r *Reconciler) pspClusterRoleBinding() (runtime.Object, k8sutil.DesiredState) {
+	if *r.Logging.Spec.FluentbitSpec.Security.RoleBasedAccessControlCreate && r.Logging.Spec.FluentbitSpec.Security.PodSecurityPolicyCreate {
+		return &rbacv1.ClusterRoleBinding{
+			ObjectMeta: templates.FluentbitObjectMetaClusterScope(
+				r.Logging.QualifiedNamespacedName(clusterRoleBindingName+"-psp"), r.Logging.Labels, r.Logging),
+			RoleRef: rbacv1.RoleRef{
+				Kind:     "ClusterRole",
+				APIGroup: "rbac.authorization.k8s.io",
+				Name:     r.Logging.QualifiedName(clusterRoleName + "-psp"),
+			},
+			Subjects: []rbacv1.Subject{
+				{
+					Kind:      "ServiceAccount",
+					Name:      r.Logging.QualifiedName(defaultServiceAccountName),
+					Namespace: r.Logging.Spec.ControlNamespace,
+				},
+			},
+		}, k8sutil.StatePresent
+	}
+	return &rbacv1.ClusterRoleBinding{
+		ObjectMeta: templates.FluentbitObjectMetaClusterScope(
+			r.Logging.QualifiedNamespacedName(
+				clusterRoleBindingName+"-psp"),
+			r.Logging.Labels,
+			r.Logging,
+		),
+		RoleRef: rbacv1.RoleRef{}}, k8sutil.StateAbsent
+}
diff --git a/pkg/resources/fluentbit/rbac.go b/pkg/resources/fluentbit/rbac.go
index 6acb1679c..c3b9635e7 100644
--- a/pkg/resources/fluentbit/rbac.go
+++ b/pkg/resources/fluentbit/rbac.go
@@ -23,41 +23,71 @@ import (
 )
 
 func (r *Reconciler) clusterRole() (runtime.Object, k8sutil.DesiredState) {
+	if *r.Logging.Spec.FluentbitSpec.Security.RoleBasedAccessControlCreate {
+		return &rbacv1.ClusterRole{
+			ObjectMeta: templates.FluentbitObjectMetaClusterScope(
+				r.Logging.QualifiedName(clusterRoleName), r.Logging.Labels, r.Logging),
+			Rules: []rbacv1.PolicyRule{
+				{
+					APIGroups: []string{""},
+					Resources: []string{"pods", "namespaces"},
+					Verbs:     []string{"get", "list", "watch"},
+				},
+			},
+		}, k8sutil.StatePresent
+	}
 	return &rbacv1.ClusterRole{
 		ObjectMeta: templates.FluentbitObjectMetaClusterScope(
-			r.Logging.QualifiedName(clusterRoleName), r.Logging.Labels, r.Logging),
-		Rules: []rbacv1.PolicyRule{
-			{
-				APIGroups: []string{""},
-				Resources: []string{"pods", "namespaces"},
-				Verbs:     []string{"get", "list", "watch"},
-			},
-		},
-	}, k8sutil.StatePresent
+			r.Logging.QualifiedName(clusterRoleName),
+			r.Logging.Labels,
+			r.Logging,
+		),
+		Rules: []rbacv1.PolicyRule{}}, k8sutil.StateAbsent
 }
 
 func (r *Reconciler) clusterRoleBinding() (runtime.Object, k8sutil.DesiredState) {
+	if *r.Logging.Spec.FluentbitSpec.Security.RoleBasedAccessControlCreate {
+		return &rbacv1.ClusterRoleBinding{
+			ObjectMeta: templates.FluentbitObjectMetaClusterScope(
+				r.Logging.QualifiedNamespacedName(clusterRoleBindingName), r.Logging.Labels, r.Logging),
+			RoleRef: rbacv1.RoleRef{
+				Kind:     "ClusterRole",
+				APIGroup: "rbac.authorization.k8s.io",
+				Name:     r.Logging.QualifiedName(clusterRoleName),
+			},
+			Subjects: []rbacv1.Subject{
+				{
+					Kind:      "ServiceAccount",
+					Name:      r.Logging.QualifiedName(defaultServiceAccountName),
+					Namespace: r.Logging.Spec.ControlNamespace,
+				},
+			},
+		}, k8sutil.StatePresent
+	}
 	return &rbacv1.ClusterRoleBinding{
 		ObjectMeta: templates.FluentbitObjectMetaClusterScope(
-			r.Logging.QualifiedNamespacedName(clusterRoleBindingName), r.Logging.Labels, r.Logging),
-		RoleRef: rbacv1.RoleRef{
-			Kind:     "ClusterRole",
-			APIGroup: "rbac.authorization.k8s.io",
-			Name:     r.Logging.QualifiedName(clusterRoleName),
-		},
-		Subjects: []rbacv1.Subject{
-			{
-				Kind:      "ServiceAccount",
-				Name:      r.Logging.QualifiedName(serviceAccountName),
-				Namespace: r.Logging.Spec.ControlNamespace,
-			},
-		},
-	}, k8sutil.StatePresent
+			r.Logging.QualifiedNamespacedName(clusterRoleBindingName),
+			r.Logging.Labels,
+			r.Logging,
+		),
+		RoleRef: rbacv1.RoleRef{}}, k8sutil.StateAbsent
 }
 
 func (r *Reconciler) serviceAccount() (runtime.Object, k8sutil.DesiredState) {
+	if *r.Logging.Spec.FluentbitSpec.Security.RoleBasedAccessControlCreate && r.Logging.Spec.FluentbitSpec.Security.ServiceAccount == "" {
+		return &corev1.ServiceAccount{
+			ObjectMeta: templates.FluentbitObjectMeta(
+				r.Logging.QualifiedName(defaultServiceAccountName),
+				r.Logging.Labels,
+				r.Logging,
+			),
+		}, k8sutil.StatePresent
+	}
 	return &corev1.ServiceAccount{
 		ObjectMeta: templates.FluentbitObjectMeta(
-			r.Logging.QualifiedName(serviceAccountName), r.Logging.Labels, r.Logging),
-	}, k8sutil.StatePresent
+			r.Logging.QualifiedName(defaultServiceAccountName),
+			r.Logging.Labels,
+			r.Logging,
+		),
+	}, k8sutil.StateAbsent
 }
diff --git a/pkg/resources/fluentd/fluentd.go b/pkg/resources/fluentd/fluentd.go
index bc8e99c78..daf24d89c 100644
--- a/pkg/resources/fluentd/fluentd.go
+++ b/pkg/resources/fluentd/fluentd.go
@@ -30,18 +30,19 @@ import (
 )
 
 const (
-	SecretConfigName    = "fluentd"
-	AppSecretConfigName = "fluentd-app"
-	AppConfigKey        = "fluentd.conf"
-	StatefulSetName     = "fluentd"
-	ServiceName         = "fluentd"
-	OutputSecretName    = "fluentd-output"
-	OutputSecretPath    = "/fluentd/secret"
+	SecretConfigName      = "fluentd"
+	AppSecretConfigName   = "fluentd-app"
+	AppConfigKey          = "fluentd.conf"
+	StatefulSetName       = "fluentd"
+	PodSecurityPolicyName = "fluentd"
+	ServiceName           = "fluentd"
+	OutputSecretName      = "fluentd-output"
+	OutputSecretPath      = "/fluentd/secret"
 
-	bufferVolumeName   = "fluentd-buffer"
-	serviceAccountName = "fluentd"
-	roleBindingName    = "fluentd"
-	roleName           = "fluentd"
+	bufferVolumeName          = "fluentd-buffer"
+	defaultServiceAccountName = "fluentd"
+	roleBindingName           = "fluentd"
+	roleName                  = "fluentd"
 )
 
 // Reconciler holds info what resource to reconcile
@@ -57,6 +58,13 @@ func (r *Reconciler) getFluentdLabels() map[string]string {
 		"app.kubernetes.io/name": "fluentd"}, generataLoggingRefLabels(r.Logging.ObjectMeta.GetName()))
 }
 
+func (r *Reconciler) getServiceAccount() string {
+	if r.Logging.Spec.FluentdSpec.Security.ServiceAccount != "" {
+		return r.Logging.Spec.FluentdSpec.Security.ServiceAccount
+	}
+	return r.Logging.QualifiedName(defaultServiceAccountName)
+}
+
 func New(client client.Client, log logr.Logger, logging *v1beta1.Logging, config *string, secrets *secret.MountSecrets) *Reconciler {
 	return &Reconciler{
 		Logging:                   logging,
@@ -133,8 +141,11 @@ func (r *Reconciler) Reconcile() (*reconcile.Result, error) {
 	}
 	for _, res := range []resources.Resource{
 		r.serviceAccount,
-		r.clusterRole,
-		r.clusterRoleBinding,
+		r.role,
+		r.roleBinding,
+		r.clusterPodSecurityPolicy,
+		r.pspRole,
+		r.pspRoleBinding,
 		r.secretConfig,
 		r.appconfigMap,
 		r.statefulset,
@@ -143,6 +154,9 @@ func (r *Reconciler) Reconcile() (*reconcile.Result, error) {
 		r.monitorServiceMetrics,
 	} {
 		o, state := res()
+		if o == nil {
+			return nil, errors.Errorf("Reconcile error! Resource %#v returns with nil object", res)
+		}
 		err := r.ReconcileResource(o, state)
 		if err != nil {
 			return nil, errors.WrapIf(err, "failed to reconcile resource")
diff --git a/pkg/resources/fluentd/psp.go b/pkg/resources/fluentd/psp.go
new file mode 100644
index 000000000..84e2ee0fe
--- /dev/null
+++ b/pkg/resources/fluentd/psp.go
@@ -0,0 +1,114 @@
+// Copyright © 2019 Banzai Cloud
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package fluentd
+
+import (
+	"github.com/banzaicloud/logging-operator/pkg/k8sutil"
+	"github.com/banzaicloud/logging-operator/pkg/resources/templates"
+	"github.com/banzaicloud/logging-operator/pkg/util"
+	policyv1beta1 "k8s.io/api/policy/v1beta1"
+	rbacv1 "k8s.io/api/rbac/v1"
+
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+func (r *Reconciler) clusterPodSecurityPolicy() (runtime.Object, k8sutil.DesiredState) {
+	if r.Logging.Spec.FluentdSpec.Security.PodSecurityPolicyCreate {
+
+		return &policyv1beta1.PodSecurityPolicy{
+			ObjectMeta: templates.FluentdObjectMetaClusterScope(
+				r.Logging.QualifiedName(PodSecurityPolicyName),
+				util.MergeLabels(r.Logging.Labels, r.getFluentdLabels()), r.Logging),
+			Spec: policyv1beta1.PodSecurityPolicySpec{
+				Volumes: []policyv1beta1.FSType{
+					"configMap",
+					"emptyDir",
+					"secret",
+					"persistentVolumeClaim"},
+				SELinux: policyv1beta1.SELinuxStrategyOptions{
+					Rule: policyv1beta1.SELinuxStrategyRunAsAny,
+				},
+				RunAsUser: policyv1beta1.RunAsUserStrategyOptions{
+					Rule:   policyv1beta1.RunAsUserStrategyMustRunAs,
+					Ranges: []policyv1beta1.IDRange{{Min: 1, Max: 65535}}},
+				SupplementalGroups: policyv1beta1.SupplementalGroupsStrategyOptions{
+					Rule:   policyv1beta1.SupplementalGroupsStrategyMustRunAs,
+					Ranges: []policyv1beta1.IDRange{{Min: 1, Max: 65535}},
+				},
+				FSGroup: policyv1beta1.FSGroupStrategyOptions{
+					Rule:   policyv1beta1.FSGroupStrategyMustRunAs,
+					Ranges: []policyv1beta1.IDRange{{Min: 1, Max: 65535}},
+				},
+				AllowPrivilegeEscalation: util.BoolPointer(false),
+			},
+		}, k8sutil.StatePresent
+
+	}
+	return &policyv1beta1.PodSecurityPolicy{
+		ObjectMeta: templates.FluentdObjectMeta(
+			r.Logging.QualifiedName(PodSecurityPolicyName),
+			util.MergeLabels(r.Logging.Labels, r.getFluentdLabels()), r.Logging),
+		Spec: policyv1beta1.PodSecurityPolicySpec{},
+	}, k8sutil.StateAbsent
+}
+
+func (r *Reconciler) pspRole() (runtime.Object, k8sutil.DesiredState) {
+	if *r.Logging.Spec.FluentdSpec.Security.RoleBasedAccessControlCreate && r.Logging.Spec.FluentdSpec.Security.PodSecurityPolicyCreate {
+
+		return &rbacv1.Role{
+			ObjectMeta: templates.FluentdObjectMeta(r.Logging.QualifiedName(roleName+"-psp"), r.Logging.Labels, r.Logging),
+			Rules: []rbacv1.PolicyRule{
+				{
+					APIGroups: []string{"policy"},
+					Resources: []string{r.Logging.QualifiedName(PodSecurityPolicyName)},
+					Verbs:     []string{"use"},
+				},
+			},
+		}, k8sutil.StatePresent
+	}
+	return &rbacv1.Role{
+		ObjectMeta: templates.FluentdObjectMeta(
+			r.Logging.QualifiedName(roleName+"-psp"),
+			r.Logging.Labels, r.Logging,
+		),
+		Rules: []rbacv1.PolicyRule{}}, k8sutil.StateAbsent
+}
+
+func (r *Reconciler) pspRoleBinding() (runtime.Object, k8sutil.DesiredState) {
+	if *r.Logging.Spec.FluentdSpec.Security.RoleBasedAccessControlCreate && r.Logging.Spec.FluentdSpec.Security.PodSecurityPolicyCreate {
+
+		return &rbacv1.RoleBinding{
+			ObjectMeta: templates.FluentdObjectMeta(r.Logging.QualifiedName(roleBindingName+"-psp"), r.Logging.Labels, r.Logging),
+			RoleRef: rbacv1.RoleRef{
+				Kind:     "Role",
+				APIGroup: "rbac.authorization.k8s.io",
+				Name:     r.Logging.QualifiedName(roleName + "-psp"),
+			},
+			Subjects: []rbacv1.Subject{
+				{
+					Kind:      "ServiceAccount",
+					Name:      r.Logging.QualifiedName(defaultServiceAccountName),
+					Namespace: r.Logging.Spec.ControlNamespace,
+				},
+			},
+		}, k8sutil.StatePresent
+	}
+	return &rbacv1.RoleBinding{
+		ObjectMeta: templates.FluentdObjectMeta(
+			r.Logging.QualifiedName(roleBindingName+"-psp"),
+			r.Logging.Labels, r.Logging,
+		),
+		RoleRef: rbacv1.RoleRef{}}, k8sutil.StateAbsent
+}
diff --git a/pkg/resources/fluentd/rbac.go b/pkg/resources/fluentd/rbac.go
index 73e3d5c40..46245f4dc 100644
--- a/pkg/resources/fluentd/rbac.go
+++ b/pkg/resources/fluentd/rbac.go
@@ -22,39 +22,71 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 )
 
-func (r *Reconciler) clusterRole() (runtime.Object, k8sutil.DesiredState) {
-	return &rbacv1.Role{
-		ObjectMeta: templates.FluentdObjectMeta(r.Logging.QualifiedName(roleName), r.Logging.Labels, r.Logging),
-		Rules: []rbacv1.PolicyRule{
-			{
-				APIGroups: []string{""},
-				Resources: []string{"configmaps", "secrets"},
-				Verbs:     []string{"*"},
+func (r *Reconciler) role() (runtime.Object, k8sutil.DesiredState) {
+	if *r.Logging.Spec.FluentdSpec.Security.RoleBasedAccessControlCreate {
+
+		return &rbacv1.Role{
+			ObjectMeta: templates.FluentdObjectMeta(r.Logging.QualifiedName(roleName), r.Logging.Labels, r.Logging),
+			Rules: []rbacv1.PolicyRule{
+				{
+					APIGroups: []string{""},
+					Resources: []string{"configmaps", "secrets"},
+					Verbs:     []string{"*"},
+				},
 			},
-		},
-	}, k8sutil.StatePresent
+		}, k8sutil.StatePresent
+	}
+	return &rbacv1.Role{
+		ObjectMeta: templates.FluentdObjectMeta(
+			r.Logging.QualifiedName(roleName),
+			r.Logging.Labels, r.Logging,
+		),
+		Rules: []rbacv1.PolicyRule{}}, k8sutil.StateAbsent
 }
 
-func (r *Reconciler) clusterRoleBinding() (runtime.Object, k8sutil.DesiredState) {
-	return &rbacv1.RoleBinding{
-		ObjectMeta: templates.FluentdObjectMeta(r.Logging.QualifiedName(roleBindingName), r.Logging.Labels, r.Logging),
-		RoleRef: rbacv1.RoleRef{
-			Kind:     "Role",
-			APIGroup: "rbac.authorization.k8s.io",
-			Name:     r.Logging.QualifiedName(roleName),
-		},
-		Subjects: []rbacv1.Subject{
-			{
-				Kind:      "ServiceAccount",
-				Name:      r.Logging.QualifiedName(serviceAccountName),
-				Namespace: r.Logging.Spec.ControlNamespace,
+func (r *Reconciler) roleBinding() (runtime.Object, k8sutil.DesiredState) {
+	if *r.Logging.Spec.FluentdSpec.Security.RoleBasedAccessControlCreate {
+
+		return &rbacv1.RoleBinding{
+			ObjectMeta: templates.FluentdObjectMeta(r.Logging.QualifiedName(roleBindingName), r.Logging.Labels, r.Logging),
+			RoleRef: rbacv1.RoleRef{
+				Kind:     "Role",
+				APIGroup: "rbac.authorization.k8s.io",
+				Name:     r.Logging.QualifiedName(roleName),
+			},
+			Subjects: []rbacv1.Subject{
+				{
+					Kind:      "ServiceAccount",
+					Name:      r.Logging.QualifiedName(defaultServiceAccountName),
+					Namespace: r.Logging.Spec.ControlNamespace,
+				},
 			},
-		},
-	}, k8sutil.StatePresent
+		}, k8sutil.StatePresent
+	}
+	return &rbacv1.RoleBinding{
+		ObjectMeta: templates.FluentdObjectMeta(
+			r.Logging.QualifiedName(roleBindingName),
+			r.Logging.Labels, r.Logging,
+		),
+		RoleRef: rbacv1.RoleRef{}}, k8sutil.StateAbsent
 }
 
 func (r *Reconciler) serviceAccount() (runtime.Object, k8sutil.DesiredState) {
+	if *r.Logging.Spec.FluentdSpec.Security.RoleBasedAccessControlCreate && r.Logging.Spec.FluentdSpec.Security.ServiceAccount == "" {
+
+		return &corev1.ServiceAccount{
+			ObjectMeta: templates.FluentdObjectMeta(
+				r.Logging.QualifiedName(defaultServiceAccountName),
+				r.Logging.Labels,
+				r.Logging,
+			),
+		}, k8sutil.StatePresent
+	}
 	return &corev1.ServiceAccount{
-		ObjectMeta: templates.FluentdObjectMeta(r.Logging.QualifiedName(serviceAccountName), r.Logging.Labels, r.Logging),
-	}, k8sutil.StatePresent
+		ObjectMeta: templates.FluentdObjectMeta(
+			r.Logging.QualifiedName(defaultServiceAccountName),
+			r.Logging.Labels,
+			r.Logging,
+		),
+	}, k8sutil.StateAbsent
 }
diff --git a/pkg/resources/fluentd/statefulset.go b/pkg/resources/fluentd/statefulset.go
index 6bc53eb0f..32847a30e 100644
--- a/pkg/resources/fluentd/statefulset.go
+++ b/pkg/resources/fluentd/statefulset.go
@@ -55,7 +55,8 @@ func (r *Reconciler) statefulsetSpec() *appsv1.StatefulSetSpec {
 		Template: corev1.PodTemplateSpec{
 			ObjectMeta: r.generatePodMeta(),
 			Spec: corev1.PodSpec{
-				Volumes: r.generateVolume(),
+				Volumes:            r.generateVolume(),
+				ServiceAccountName: r.getServiceAccount(),
 				InitContainers: []corev1.Container{
 					{
 						Name:            "volume-mount-hack",
diff --git a/pkg/resources/templates/templates.go b/pkg/resources/templates/templates.go
index aeac82ec4..3c7bc1bd5 100644
--- a/pkg/resources/templates/templates.go
+++ b/pkg/resources/templates/templates.go
@@ -75,3 +75,21 @@ func FluentdObjectMeta(name string, labels map[string]string, logging *v1beta1.L
 	}
 	return o
 }
+
+// FluentdObjectMetaClusterScope creates an objectMeta for resource fluentd
+func FluentdObjectMetaClusterScope(name string, labels map[string]string, logging *v1beta1.Logging) metav1.ObjectMeta {
+	o := metav1.ObjectMeta{
+		Name:   name,
+		Labels: labels,
+		OwnerReferences: []metav1.OwnerReference{
+			{
+				APIVersion: logging.APIVersion,
+				Kind:       logging.Kind,
+				Name:       logging.Name,
+				UID:        logging.UID,
+				Controller: util.BoolPointer(true),
+			},
+		},
+	}
+	return o
+}