external-dns: Unknown Serviceaccount error

I have used the RBAC manifest for Digital Ocean, but get the following error when deployed to GKE.

external-dns	1 Jun 2018, 14:36:27	time=“2018-06-01T13:36:27Z” level=error msg=“services is forbidden: User "system:serviceaccount:default:default" cannot list services at the cluster scope: Unknown user "system:serviceaccount:default:default"”

Manifest

`apiVersion: v1 kind: ServiceAccount metadata: name: external-dns

apiVersion: rbac.authorization.k8s.io/v1beta1 kind: ClusterRole metadata: name: external-dns rules:

• apiGroups: [“”] resources: [“services”] verbs: [“get”,“watch”,“list”]
• apiGroups: [“”] resources: [“pods”] verbs: [“get”,“watch”,“list”]
• apiGroups: [“extensions”] resources: [“ingresses”] verbs: [“get”,“watch”,“list”]

---

apiVersion: rbac.authorization.k8s.io/v1beta1 kind: ClusterRoleBinding metadata: name: external-dns-viewer roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: external-dns subjects:

• kind: ServiceAccount name: external-dns namespace: default

---

apiVersion: extensions/v1beta1 kind: Deployment metadata: name: external-dns spec: strategy: type: Recreate template: metadata: labels: app: external-dns spec: containers: - name: external-dns image: registry.opensource.zalan.do/teapot/external-dns:v0.5.1 args: - --source=service # ingress is also possible - --domain-filter=xxx.mydomain.com # (optional) limit to only example.com domains; change to match the zone created above. - --provider=digitalocean env: - name: DO_TOKEN value: “KEY”`

What do I need to do to make it work?