Deploying https://github.com/elastic/endpoint/tree/main/releases/8.5.0/kubernetes/deploy on GKE, we can see this error from elastic-agent

metricbeat stderr: "E1108 07:59:03.061004 1702055 reflector.go:138] pkg/mod/k8s.io/client-go@v0.23.4/tools/cache/reflector.go:167: Failed to watch *v1.StorageClass: failed to list *v1.StorageClass: storageclasses.storage.k8s.io is forbidden: User \"system:serviceaccount:kube-system:elastic-agent\" cannot list resource \"storageclasses\" in API group \"storage.k8s.io\" at the cluster scope\n"

I think this should be added in the manifest

• apiGroups: ["rbac.authorization.k8s.io"]
  resources:
  - clusterrolebindings
  - clusterroles
  - rolebindings
  - roles
  verbs: ["get", "list", "watch"]