stern: pods/log "[pod]" is forbidden - cannot get resource "pods/log"

Reading logs is its own RBAC subresource - pods/log - and whoever runs stern does not have it. Granting get on pods is not enough. Bind a ClusterRole (or Role) with get, watch, list on pods and pods/log to the identity, then stern tails normally. The stern docs publish exactly this ClusterRole for in-cluster use.

The error

pods/log "[pod]" is forbidden: User "system:serviceaccount:[ns]:[sa]" cannot get resource "pods/log" in API group "" in the namespace "[ns]"

What to do

1. Confirm the gap:

kubectl auth can-i get pods/log -n [ns]

Expected: Prints no.

2. Create and bind the documented role:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: stern
rules:
- apiGroups: [""]
  resources: ["pods", "pods/log"]
  verbs: ["get", "watch", "list"]

then bind it to the user or ServiceAccount. Expected: ClusterRole and binding created.

3. Re-check:

kubectl auth can-i get pods/log -n [ns]

Expected: Prints yes.

4. Re-run stern. Expected: Logs stream instead of the forbidden error.

When this applies

• stern failing with pods/log is forbidden
• stern running inside a pod on a ServiceAccount
• locked-down namespaces where log access was never granted

When it does NOT apply

• forbidden on pods (list) itself - grant pods too, same role covers it
• stern can not connect at all (kubeconfig problem)

Works with

stern 1.x; RBAC-enabled clusters

kubectl logs failing with the same pods/log forbidden

Same missing subresource. Same role fix; kubectl and stern need the identical grant.

Why it happens

Kubernetes models log access as the pods/log subresource, separate from the pod object. Roles that grant everything on pods still deny logs until pods/log is listed explicitly.

Edge cases

• The built-in view ClusterRole already includes pods/log - binding view is the quick fix when a custom role is overkill.
• stern also needs list/watch on pods to discover targets; a get-only grant fails at the next step.

Resolved from

gh:shyuan/skills (stern-logs recipes) - https://github.com/shyuan/skills/blob/HEAD/skills/stern-logs/references/recipes.md