diff --git a/kubernetes/files/kube-addons/dns/kubedns-clusterrole.yaml b/kubernetes/files/kube-addons/dns/kubedns-clusterrole.yaml
new file mode 100644
index 0000000..e977571
--- /dev/null
+++ b/kubernetes/files/kube-addons/dns/kubedns-clusterrole.yaml
@@ -0,0 +1,25 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    addonmanager.kubernetes.io/mode: Reconcile
+    kubernetes.io/bootstrapping: rbac-defaults
+  name: "system:kube-dns"
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - endpoints
+  - services
+  verbs:
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  verbs:
+  - get
+  - list
+  - watch
diff --git a/kubernetes/master/kube-addons.sls b/kubernetes/master/kube-addons.sls
index 43d81d9..81cb768 100644
--- a/kubernetes/master/kube-addons.sls
+++ b/kubernetes/master/kube-addons.sls
@@ -198,6 +198,14 @@
     - dir_mode: 755
     - makedirs: True
 
+/etc/kubernetes/addons/dns/kubedns-clusterrole.yaml:
+  file.managed:
+    - source: salt://kubernetes/files/kube-addons/dns/kubedns-clusterrole.yaml
+    - template: jinja
+    - group: root
+    - dir_mode: 755
+    - makedirs: True
+
 {% endif %}
 
 {% endif %}