{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/23713","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/23713/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/23713/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/23713/events","html_url":"https://github.com/kubernetes/kubernetes/issues/23713","id":145038449,"number":23713,"title":"Kubernetes allows to create pods in a namespace when namespace object doesn't exist.","user":{"login":"flashvoid","id":446328,"avatar_url":"https://avatars.githubusercontent.com/u/446328?v=3","gravatar_id":"","url":"https://api.github.com/users/flashvoid","html_url":"https://github.com/flashvoid","followers_url":"https://api.github.com/users/flashvoid/followers","following_url":"https://api.github.com/users/flashvoid/following{/other_user}","gists_url":"https://api.github.com/users/flashvoid/gists{/gist_id}","starred_url":"https://api.github.com/users/flashvoid/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/flashvoid/subscriptions","organizations_url":"https://api.github.com/users/flashvoid/orgs","repos_url":"https://api.github.com/users/flashvoid/repos","events_url":"https://api.github.com/users/flashvoid/events{/privacy}","received_events_url":"https://api.github.com/users/flashvoid/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/kind/bug","name":"kind/bug","color":"e11d21"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/team/api","name":"team/api","color":"d2b48c"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/team/control-plane","name":"team/control-plane","color":"d2b48c"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2016-03-31T22:47:00Z","updated_at":"2016-04-04T18:53:39Z","closed_at":null,"body":"So, just discovered that kubernetes allows to create a pod in a namespace when namespace object itself doesn't exist.\r\n\r\n```\r\nroot@ip-192-168-0-10:/home/ubuntu# kubectl get pods -o wide --namespace=tenant-a\r\nNAME             READY     STATUS    RESTARTS   AGE       NODE\r\nnginx-frontend   1/1       Running   0          33m       i-b6cd1203\r\n\r\nroot@ip-192-168-0-10:/home/ubuntu# kubectl get namespaces \r\nNAME      LABELS    STATUS    AGE\r\ndefault   <none>    Active    34m\r\n\r\nroot@ip-192-168-0-10:/home/ubuntu# cat romana/kubernetes/pod-frontend.yaml \r\napiVersion: v1\r\nkind: Pod\r\nmetadata:\r\n  name: nginx-frontend\r\n  namespace: tenant-a\r\n  labels:\r\n    app: nginx\r\n    segment: frontend\r\nspec:\r\n  containers:\r\n  - name: nginx\r\n    image: nginx\r\n    ports:\r\n    - containerPort: 80\r\n\r\n\r\nroot@ip-192-168-0-10:/home/ubuntu# kubectl version\r\nClient Version: version.Info{Major:\"1\", Minor:\"1\", GitVersion:\"v1.1.2\", GitCommit:\"3085895b8a70a3d985e9320a098e74f545546171\", GitTreeState:\"clean\"}\r\nServer Version: version.Info{Major:\"1\", Minor:\"1\", GitVersion:\"v1.1.2\", GitCommit:\"3085895b8a70a3d985e9320a098e74f545546171\", GitTreeState:\"clean\"}\r\n```\r\n\r\nWith multi-tenancy coming to kubernetes and namespaces representing tenants - having pods running outside of namespaces, let alone in a namespace that doesn't exist, isn't something that should be allowed, is it ?"},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/205445910","html_url":"https://github.com/kubernetes/kubernetes/issues/23713#issuecomment-205445910","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/23713","id":205445910,"user":{"login":"derekwaynecarr","id":6233452,"avatar_url":"https://avatars.githubusercontent.com/u/6233452?v=3","gravatar_id":"","url":"https://api.github.com/users/derekwaynecarr","html_url":"https://github.com/derekwaynecarr","followers_url":"https://api.github.com/users/derekwaynecarr/followers","following_url":"https://api.github.com/users/derekwaynecarr/following{/other_user}","gists_url":"https://api.github.com/users/derekwaynecarr/gists{/gist_id}","starred_url":"https://api.github.com/users/derekwaynecarr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/derekwaynecarr/subscriptions","organizations_url":"https://api.github.com/users/derekwaynecarr/orgs","repos_url":"https://api.github.com/users/derekwaynecarr/repos","events_url":"https://api.github.com/users/derekwaynecarr/events{/privacy}","received_events_url":"https://api.github.com/users/derekwaynecarr/received_events","type":"User","site_admin":false},"created_at":"2016-04-04T18:53:39Z","updated_at":"2016-04-04T18:53:39Z","body":"How is your cluster configured?\r\n\r\nAre you running with the recommended set of admission controllers?\r\n\r\nSee: http://kubernetes.io/docs/admin/admission-controllers/#namespacelifecycle\r\n\r\nPlease re-open if you are using a project supported getting started guide so we can update its documentation error in how to bootstrap the cluster."}}