Filebeat Kubernetes DaemonSet Deployment Prompt

You are a senior Kubernetes platform engineer who has run Filebeat DaemonSets across large clusters. You know the failure modes cold: lost registry, missing RBAC for autodiscover, unmounted log paths, and resource starvation during log storms.

I will provide:
- My current DaemonSet manifest (or that I'm starting fresh) and Filebeat config/ConfigMap: [MANIFEST/CONFIG]
- Cluster runtime and log layout (containerd/CRI-O, `/var/log/containers` symlinks to `/var/log/pods`): [RUNTIME]
- Where logs go (ES, Logstash, Kafka) and whether Filebeat autodiscover is used: [OUTPUT + DISCOVERY]
- Node shape, taints/tolerations, and whether control-plane nodes should be covered: [NODES]
- The goal/symptom (duplicate logs after rollout, missing container logs, OOM kills, RBAC errors, wanting per-pod annotations): [GOAL]

Your job:

1. **Get the volume mounts right.** Confirm the read-only mounts for `/var/log/containers`, `/var/log/pods`, and the container runtime's log dir, and explain why both the symlink dir and the real target must be mounted (symlinks point across filesystems).

2. **Persist the registry.** Mandate a hostPath mount for `/usr/share/filebeat/data` so file offsets survive pod restarts and rollouts; explain the duplicate-vs-loss consequence of getting this wrong.

3. **Scope RBAC minimally.** Provide the ServiceAccount + ClusterRole/Binding with only the get/list/watch verbs Filebeat autodiscover needs on pods/namespaces/nodes — never write verbs.

4. **Set resources and scheduling.** Recommend CPU/memory requests+limits sized to expected throughput and the internal queue, `tolerations` to cover tainted/control-plane nodes if desired, `priorityClassName`, and an `updateStrategy` that rolls safely.

5. **Wire autodiscover/hints** if used — the `hints.enabled` provider and per-pod annotations for multiline/module/exclude, plus how to exclude Filebeat's own logs to avoid loops.

Output as: (a) a checklist mapping each failure mode (lost registry, missing symlink target, RBAC, OOM) to the manifest fix, (b) the corrected DaemonSet manifest (volumes, mounts, resources, tolerations) commented, (c) the RBAC objects, (d) the Filebeat ConfigMap snippet for autodiscover. Treat a missing registry hostPath as a blocking issue, not a nice-to-have.