I believe there is a syntax error in the daemonset configuration in all the beats example/refrence yaml's in the elastic beats repo on GitHub. see below for the issue with the filbeat config (though it looks like that section is repeated in all other examples given under beats/deploy/kubernetes at main · elastic/beats · GitHub )
on line 164 at https://raw.githubusercontent.com/elastic/beats/8.7/deploy/kubernetes/filebeat-kubernetes.yaml it reads:
spec:
serviceAccountname: filebeat
which is not the way to refrence the serviceaccount to run the daemonset, it should be:
spec:
serviceAccount: filebeat
Judging by the makefile in that repo the following files should be updated and make(looks like a jenkins job) rerun
deploy/kubernetes/metricbeat/metricbeat-daemonset.yaml
deploy/kubernetes/filebeat/filebeat-daemonset.yaml
deploy/kubernetes/auditbeat/auditbeat-daemonset.yaml
deploy/kubernetes/heartbeat/heartbeat-daemonset.yaml
I actually have a case with this open with elastic but this was a bit tricky as they seem to be more familiar with the support docs not git itself. FYI these files are referenced in the support documents:
I would normally open a GitHub pull to fix this but the default issue template appears to heavily imply I should report it here first.
can someone else here confirm and suggest what I should do next? (open a ticket and pull request?, Wait for an elastic engineer to update?, etc.)