Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Auditbeat] Kubernetes enrichment not working without cronjob metadata #36674

Closed
ynirk opened this issue Sep 25, 2023 · 0 comments · Fixed by #36703
Closed

[Auditbeat] Kubernetes enrichment not working without cronjob metadata #36674

ynirk opened this issue Sep 25, 2023 · 0 comments · Fixed by #36703
Assignees
@mjwolf
Labels
Auditbeat bug Team:Security-Linux Platform Linux Platform Team in Security Solution

Comments

@ynirk
Copy link

ynirk commented Sep 25, 2023

When deploying auditbeat on kubernetes with the provided manifest, the K8s enrichment is not working with the following error message:

failed to list *v1.Job: jobs.batch is forbidden: User "system:serviceaccount:kube-system:auditbeat" cannot list resource "jobs" in API group "batch" at the cluster scope

The requirements have been added to most beats in #30637 but it looks like auditbeat was missed
@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Sep 25, 2023
@andrewkroh andrewkroh added bug Auditbeat Team:Security-Linux Platform Linux Platform Team in Security Solution labels Sep 25, 2023
@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Sep 25, 2023
@mjwolf mjwolf self-assigned this Sep 27, 2023
@mjwolf mjwolf mentioned this issue Sep 28, 2023
Merged
2 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@mjwolf mjwolf

Labels
Auditbeat bug Team:Security-Linux Platform Linux Platform Team in Security Solution
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Give Auditbeat k8s Clusterrole job permissions mjwolf/beats
3 participants
@mjwolf @andrewkroh @ynirk