An Instana agent DaemonSet is deployed to a Kubernetes cluster and all agent pods show status Running. However, no Kubernetes node, pod, or namespace metadata appears in the Instana UI. Agent pod logs show repeated entries: io.kubernetes.client.openapi.ApiException: 403 Forbidden. What is the most likely cause?

A 403 Forbidden response from the Kubernetes API server is an authorization error, meaning the agent is reaching the API server successfully but the ServiceAccount it runs under lacks the required RBAC permissions. Instana requires a ClusterRole with get, list, and watch access across multiple resource types, bound to the agent ServiceAccount via a ClusterRoleBinding. The administrator should apply the RBAC manifests provided in the official Instana Kubernetes installation documentation. The correct answer is 'The agent ServiceAccount is missing a ClusterRoleBinding that grants read access to Kubernetes API resources such as nodes, pods, namespaces, and services'. The incorrect options — 'The DaemonSet is missing the correct tolerations to schedule on control-plane nodes', 'The Kubernetes cluster version is not listed as supported by the installed Instana agent version', 'The agent configuration file is missing the kubernetes.cluster.name property' — are wrong because they do not align with IBM Instana's architecture or recommended practices for this scenario. Understanding this concept is essential for the Domain 6: Troubleshooting domain of the IBM Instana Observability certification.