I was trying to create a namespace using kubectl, but I got this error:
Error from server (Forbidden): error when creating "namespacefoo": namespaces is forbidden: User "xyz@pqr.com" cannot create namespaces at the cluster scope
Is there a concept of "scope" in Kubernetes? I couldn't find any information about different types of scope. If I cannot create namespace at the cluster scope, where can I create the namespace? How can I check which "scopes" do I have access to?
That depends on your Kubernetes environment.
This answer suggest (in a Google Cloud environment):
That suggests that
gcloud config set container/use_client_certificateis set totruei.e. thatgcloudis expecting a client cluster certificate to authenticate to the cluster (this is what the 'client' in the error message refers to).Unsetting
container/use_client_certificateby issuing the following command in theglcoud configends the need for a legacy certificate or credentials and prevents the error message:gcloud config unset container/use_client_certificateIssues such as this may be more likely if you are using an older version of
gcloudon your home workstation or elsewhere.
Still, kubernetes/kubernetes issue 62361 mentions the same error message.
Is this GKE? If so RBAC is enabled by default - you may need to grant yourself cluster-admin role to create namespaces.
Resources within kubernetes are either namespaced (exist within a containing namespace) or cluster scoped (are not contained within a namespace). Examples of namespaced resources are pods, configmaps, and serviceaccounts. Examples of cluster scoped resources are nodes, persistentvolumes, and namespaces themselves.
When an operation is forbidden, the message indicates which scope the operation was forbidden at, and if the resource is namespaced, which namespace the operation was attempted within.
"Cannot create namespaces at the cluster scope" is not in contrast to creating namespaces at some other scope, it is just attempting to indicate at what scope you would need to grant permissions to allow that operation.