Running Promtail in a pod controlled by a DaemonSet allows it to access the Kubernetes API via a ServiceAccount token. Since it needs the API in order to discover the Pods running on the current node in order to find their log files, this makes the authentication process a lot simpler.