<p>I am trying to use workflow identity for my kubernetes cluster. I have created the service account on a new namespace. My issue is that I am not able to specify the name space when I am trying to add the service account name on the pod deployment YML.</p>
<p>Following is my pod spect file:</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: test-scheduler
spec:
  replicas: 1
  selector:
    matchLabels:
      app: test-scheduler
  template:
    metadata:
      labels:
        app: test-scheduler
    spec:
      serviceAccountName: test-na/test-k8-sa
      nodeSelector:
        iam.gke.io/gke-metadata-server-enabled: &quot;true&quot;
      containers:
        - name: test-scheduler
          image: gcr.io/PROJECT_ID/IMAGE:TAG
          ports:
            - name: scheduler-port
              containerPort: 8002
              protocol: TCP
          env:
            - name: NAMESPACE
              value: test-scheduler
            - name: CONTAINER_NAME
              value: test-scheduler
---
apiVersion: v1
kind: Service
metadata:
  name: test-scheduler
spec:
  selector:
    app: test-scheduler
  ports:
    - port: 8002
      protocol: TCP
      targetPort: scheduler-port 

</code></pre>
<p>When I deploy this code using github actions I get this error:</p>
<pre><code>The Deployment &quot;test-scheduler&quot; is invalid: spec.template.spec.serviceAccountName: Invalid value: &quot;test-na/test-k8-sa&quot;: a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.',
</code></pre>
<p>When I remove the namespace in a file like this:</p>
<pre><code>serviceAccountName: test-k8-sa
</code></pre>
<p>It searches for the service account on default name space and fails.</p>
<p>My question here is what is the right way to specify the custom namespace with the service account in kubernetes?</p>
<p>I can start using the default but I am inclined to keep the namespace. I saw some reference to service account file but I don't really understand how to use them.</p>
<p>By the way, I am using this guide <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity#gcloud_3" rel="nofollow noreferrer">https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity#gcloud_3</a></p>

<p><code>...I have created the service account on a new namespace. My issue is that I am not able to specify the name space when I am trying to add the service account name on the pod deployment YML.</code></p>
<p>To assign the created service account to your deployment, you can create the deployment in the same namespace as the service account:</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: test-scheduler
  namespace: test-na  # &lt;-- add this line with the namespace where the service account resides
spec:
  ...
  template:
    ...
    spec:
      serviceAccountName: test-k8-sa
      ...
</code></pre>
