Addon logging-elasticsearch does not work with RBAC enabled

[thoslin]

What kops version are you running? use kops version
1.7.1

What Kubernetes version are you running? use kubectl version

Client Version: version.Info{Major:"1", Minor:"8", GitVersion:"v1.8.1", GitCommit:"f38e43b221d08850172a9a4ea785a86a3ffa3b3a", GitTreeState:"clean", BuildDate:"2017-10-11T23:27:35Z", GoVersion:"go1.8.3", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"7", GitVersion:"v1.7.4", GitCommit:"793658f2d7ca7f064d2bdf606519f9fe1229c381", GitTreeState:"clean", BuildDate:"2017-08-17T08:30:51Z", GoVersion:"go1.8.3", Compiler:"gc", Platform:"linux/amd64"}

What cloud provider are you using?
AWS

What went wrong?

• Create cluster with RBAC enabled.
• Install EFK stack from addon: https://github.com/kubernetes/kops/tree/master/addons/logging-elasticsearch.
• Elasticsearch failed to start with following logs:

F1030 06:32:57.828076       6 elasticsearch_logging_discovery.go:60] kube-system namespace doesn't exist: User "system:serviceaccount:kube-system:default" cannot get namespaces in the namespace "kube-system". (get namespaces kube-system)

It looks like the default service account is unable to access namespaces.

What do you expect?
RBAC is setup and EFK is working.

[chrislovecnm]

We are missing the rbac roles for elk. Contributions are always appreciated!

[robinpercy]

@thoslin @chrislovecnm looks like this can be closed

[thoslin]

Closing