I have a pod in namespace Foo and a service account in namespace Bar. Can I run the pod as the service account from the other namespace? Or will the fact that the pod & service account belong to different namespaces block me?
1 Answer
No, you cannot. Your pod and service account need to be in the same namespace. As, Service accounts and Pods are namespaced.
As far the k8s doc:
When you create a pod, if you do not specify a service account, it is automatically assigned the default service account in the same namespace. The service account has to exist at the time the pod is created, or it will be rejected.
It is also a logical thing, as they are namespaced object. So they need to be in the same namespace.
You cannot update the service account of an already created pod.
-
Thanks! That's what I figured, but I couldn't find documentation that called this out. Do you happen to have a link to the doc? Mar 22, 2021 at 15:00
-
You can see the k8s doc that I have added. Btw, it is also a logical thing, as they are namespaced object. So they need to be in the same namespace. Mar 22, 2021 at 15:04
-
2Thanks for that - however, the documentation does not state that you cannot use service accounts from another namespace. Do you happen to have a reference that states that cross-namespace usage of service accounts is not allowed? With that reference, we can accept the answer. Mar 22, 2021 at 18:22
-
A Kubernetes namespace provides the scope for Pods, Services, and Deployments in the cluster. Users interacting with one namespace do not see the content in another namespace. Doc Mar 23, 2021 at 1:56
-
1Following the same logic that they are namespace resources, you would think that you could not create a role binding (not a cluster role binding) between a role (not a cluster role) in one namespace and a service account in another namespace, yet that is perfectly possible. So, whie I also cannot find a way to do this, I agree with Thomas that any reference that actually says it cannot be done would be useful. Mar 29, 2022 at 15:07