Hoi, I have two questions regarding the fluent-bit Collector feature. 1st: The operator is deployed in the

logging

namespace and I created a

Collector

resource in the

network-monitoring

namespace, but the operator does not register it even though it is configured to watch all namespaces. The SA can watch and get Collectors from the different namespace and also create a

StatefulSet

according to

kubectl auth can-i

$ k auth can-i get collectors.fluentbit.fluent.io --as system:serviceaccount:logging:fluent-operator -n network-monitoring
yes
$ k auth can-i watch collectors.fluentbit.fluent.io --as system:serviceaccount:logging:fluent-operator -n network-monitoring
yes
$ k auth can-i create statefulset --as system:serviceaccount:logging:fluent-operator -n network-monitoring
yes

The manifest looks like this:

apiVersion: fluentbit.fluent.io/v1alpha2
kind: Collector
metadata:
  labels:
    app.kubernetes.io/instance: network
    app.kubernetes.io/name: syslog-receiver
  name: syslog-receiver
  namespace: network-monitoring
spec:
  fluentBitConfigName: syslog-receiver-config
  image: kubesphere/fluent-bit:v2.2.0

It's very basic for now as the documentation for this feature is not that good (I'm going through the operator code instead). The operator (Version 2.7.0) has been deployed via the Helm chart with these values:

containerRuntime: containerd
Kubernetes: true
fluentbit:
  input:
    tail:
      enable: true
      memBufLimit: 50MB
    systemd:
      enable: false
  output: {}
  annotations:
    prometheus.io/scrape: "true"
    prometheus.io/port: "2020"
    prometheus.io/path: "/api/v1/metrics/prometheus"
  filter:
    systemd:
      enable: false
    kubernetes:
      enable: false

And idea how I could debug this further? 2nd: According to the

Collector

controller in collector_controller.go, every

Collector

resources' SA (which should only reach its own namespace if I understand the resource correct) receives a

ClusterRole

to get all pods from every namespace. From an RBAC perspective this sounds a bit too open. Wouldn't it make sense to create scoped RBAC objects instead for the

Collector

?