Reading logs is its own RBAC subresource - pods/log - and whoever runs stern does not have it. Granting get on pods is not enough. Bind a ClusterRole (or Role) with get, watch, list on pods and pods/log to the identity, then stern tails normally. The stern docs publish exactly this ClusterRole for in-cluster use.

## The error
```text
pods/log "[pod]" is forbidden: User "system:serviceaccount:[ns]:[sa]" cannot get resource "pods/log" in API group "" in the namespace "[ns]"
```

## What to do
1. Confirm the gap:
```bash
kubectl auth can-i get pods/log -n [ns]
```
   Expected: Prints `no`.
2. Create and bind the documented role:
```yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: stern
rules:
- apiGroups: [""]
  resources: ["pods", "pods/log"]
  verbs: ["get", "watch", "list"]
```
then bind it to the user or ServiceAccount.
   Expected: ClusterRole and binding created.
3. Re-check:
```bash
kubectl auth can-i get pods/log -n [ns]
```
   Expected: Prints `yes`.
4. Re-run stern.
   Expected: Logs stream instead of the forbidden error.

## When this applies
- stern failing with pods/log is forbidden
- stern running inside a pod on a ServiceAccount
- locked-down namespaces where log access was never granted

## When it does NOT apply
- forbidden on pods (list) itself - grant pods too, same role covers it
- stern can not connect at all (kubeconfig problem)

## Works with
stern 1.x; RBAC-enabled clusters

### kubectl logs failing with the same pods/log forbidden
Same missing subresource. Same role fix; kubectl and stern need the identical grant.

## Why it happens
Kubernetes models log access as the pods/log subresource, separate from the pod object. Roles that grant everything on pods still deny logs until pods/log is listed explicitly.

## Edge cases
- The built-in view ClusterRole already includes pods/log - binding view is the quick fix when a custom role is overkill.
- stern also needs list/watch on pods to discover targets; a get-only grant fails at the next step.

## Resolved from
gh:shyuan/skills (stern-logs recipes) - https://github.com/shyuan/skills/blob/HEAD/skills/stern-logs/references/recipes.md