Change:
This is similar to , but that report (and fix) focussed on the in-cluster namespace vs configured .kube/config context namespace. I have a similar issue with the in-cluster namespace vs an explicit in the JSON/YAML file I'm passing to When run in-cluster, 1.5+ (including 1.6.0) refuses to allow me to create a resource in another namespace via an explicit property on a resource. 1.4.x honours when run in-cluster as expected. All versions honour when run out-of-cluster. I don't want to / can't provide an explicit arg or context declaration as suggested by the error text, because this is an automated deployment pipeline that creates resources in multiple namespaces. I just want the client to do-what-I-say without imposing additional client-side restrictions :stuckouttongue:
Fixed in

Discussion:
// This way assumes you've set the POD_NAMESPACE environment variable using the downward API. // This check has to be done first for backwards compatibility with the way InClusterConfig was originally set up if ns := os.Getenv("POD_NAMESPACE"); ns != "" { <del> return ns, true, nil </del> <ins> return ns, false, nil </ins> } // Fall back to the namespace associated with the service account token, if available if data, err := ioutil.ReadFile("/var/run/secrets/kubernetes.io/serviceaccount/namespace"); err == nil { if ns := strings.TrimSpace(string(data)); len(ns) > 0 { <del> return ns, true, nil </del> <ins> return ns, false, nil </ins> } }

tokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token `), os.FileMode(0755))) framework.Logf("copying override kubeconfig to the %s pod", simplePodName) <del> framework.RunKubectlOrDie("cp", filepath.Join(tmpDir, overrideKubeconfigName), ns+"/"+simplePodName+":/tmp/"+overrideKubeconfigName) </del> <ins> framework.RunKubectlOrDie("cp", filepath.Join(tmpDir, overrideKubeconfigName), ns+"/"+simplePodName+":/tmp/") framework.ExpectNoError(ioutil.WriteFile(filepath.Join(tmpDir, "invalid-configmap-with-namespace.yaml"), []byte(` kind: ConfigMap apiVersion: v1 metadata: name: "configmap with namespace and invalid name" namespace: configmap-namespace `), os.FileMode(0755))) framework.ExpectNoError(ioutil.WriteFile(filepath.Join(tmpDir, "invalid-configmap-without-namespace.yaml"), []byte(` kind: ConfigMap apiVersion: v1 metadata: name: "configmap without namespace and invalid name" `), os.FileMode(0755))) framework.Logf("copying configmap manifests to the %s pod", simplePodName) framework.RunKubectlOrDie("cp", filepath.Join(tmpDir, "invalid-configmap-with-namespace.yaml"), ns+"/"+simplePodName+":/tmp/") framework.RunKubectlOrDie("cp", filepath.Join(tmpDir, "invalid-configmap-without-namespace.yaml"), ns+"/"+simplePodName+":/tmp/") </ins> By("getting pods with in-cluster configs") execOutput := framework.RunHostCmdOrDie(ns, simplePodName, "/tmp/kubectl get pods --v=7 2>&1")

Expect(execOutput).To(ContainSubstring("Using in-cluster namespace")) Expect(execOutput).To(ContainSubstring("Using in-cluster configuration")) <ins> By("creating an object containing a namespace with in-cluster config") _, err = framework.RunHostCmd(ns, simplePodName, "/tmp/kubectl create -f /tmp/invalid-configmap-with-namespace.yaml --v=7 2>&1") Expect(err).To(ContainSubstring("Using in-cluster namespace")) Expect(err).To(ContainSubstring("Using in-cluster configuration")) Expect(err).To(ContainSubstring(fmt.Sprintf("POST https://%s:%s/api/v1/namespaces/configmap-namespace/configmaps", inClusterHost, inClusterPort))) By("creating an object not containing a namespace with in-cluster config") _, err = framework.RunHostCmd(ns, simplePodName, "/tmp/kubectl create -f /tmp/invalid-configmap-without-namespace.yaml --v=7 2>&1") Expect(err).To(ContainSubstring("Using in-cluster namespace")) Expect(err).To(ContainSubstring("Using in-cluster configuration")) Expect(err).To(ContainSubstring(fmt.Sprintf("POST https://%s:%s/api/v1/namespaces/%s/configmaps", inClusterHost, inClusterPort, f.Namespace.Name))) </ins> By("trying to use kubectl with invalid token") _, err = framework.RunHostCmd(ns, simplePodName, "/tmp/kubectl get pods --token=invalid --v=7 2>&1") framework.Logf("got err %v", err)