问Kubernetes ClusterRole API资源读取日志

EN

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: devops-tools-role
  namespace: devops-tools
rules:
  - apiGroups:
        - ""
        - apps
        - autoscaling
        - batch
        - extensions
        - policy
        - rbac.authorization.k8s.io
        - networking.k8s.io
    resources:
      - pods
      - componentstatuses
      - configmaps
      - daemonsets
      - deployments
      - events
      - endpoints
      - horizontalpodautoscalers
      - ingress
      - ingresses
      - jobs
      - limitranges
      - namespaces
      - nodes
      - pods
      - persistentvolumes
      - persistentvolumeclaims
      - resourcequotas
      - replicasets
      - replicationcontrollers
      - serviceaccounts
      - services
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

kubectl -n dfg02 logs postgres-69c7bb5cf7-dstzt

Error from server (Forbidden): pods "postgres-69c7bb5cf7-dstzt" is forbidden: User "system:serviceaccount:devops-tools:bino" cannot get resource "pods/log" in API group "" in the namespace "dfg02"

 ✘ bino@corobalap  ~/gitjece  kubectl config use-context k0s-cluster          
Switched to context "k0s-cluster".
 bino@corobalap  ~/gitjece  kubectl api-resources |grep log