<p>We're trying to use nextflow on a k8s namespace other than our default, the namespace we're using is <code>nextflownamespace</code>. We've created our PVC and ensured the default service account has an admin rolebinding. We're getting an error that nextflow can't access the PVC:</p>
<pre><code>&quot;message&quot;: &quot;persistentvolumeclaims \&quot;my-nextflow-pvc\&quot; is forbidden: 
User \&quot;system:serviceaccount:mynamespace:default\&quot; cannot get resource 
\&quot;persistentvolumeclaims\&quot; in API group \&quot;\&quot; in the namespace \&quot;nextflownamespace\&quot;&quot;,
</code></pre>
<p>In that error we see that <code>system:serviceaccount:mynamespace:default</code> is incorrectly pointing to our default namespace, <code>mynamespace</code>, not <code>nextflownamespace</code> which we created for nextflow use.</p>
<p>We tried adding <code>debug.yaml = true</code> to our <code>nextflow.config</code> but couldn't find the YAML it submits to k8s to validate the error. Our config file looks like this:</p>
<pre><code>profiles {
  standard { 
    k8s {
          executor = &quot;k8s&quot;
          namespace = &quot;nextflownamespace&quot;
          cpus = 1
          memory = 1.GB
          debug.yaml = true
        }
    aws{ 
          endpoint = &quot;https://s3.nautilus.optiputer.net&quot;
       }
  }
</code></pre>
<p>We did verify that when we change the namespace to another arbitrary value the error message used the new arbitrary namespace, but the service account name continued to point to the users default namespace erroneously.</p>
<p>We've tried every variant of <code>profiles.standard.k8s.serviceAccount = &quot;system:serviceaccount:nextflownamespace:default&quot;</code> that we could think of but didn't get any change with those attempts.</p>

<p>I think it's best to avoid using nested <a href="https://www.nextflow.io/docs/latest/config.html#config-profiles" rel="nofollow noreferrer">config profiles</a> with Nextflow. I would either remove the 'standard' layer from your profile or just make 'standard' a separate profile:</p>
<pre><code>profiles {

    standard {
      process.executor = 'local'
    }

    k8s {
        executor = &quot;k8s&quot;
        namespace = &quot;nextflownamespace&quot;
        cpus = 1
        memory = 1.GB
        debug.yaml = true
    }

    aws{ 
        endpoint = &quot;https://s3.nautilus.optiputer.net&quot;
    }
}
</code></pre>
