<p>I was trying to create a namespace using <code>kubectl</code>, but I got this error:</p>

<blockquote>
  <p>Error from server (Forbidden): error when creating "namespacefoo": namespaces is forbidden: User "xyz@pqr.com" cannot create namespaces at the cluster scope</p>
</blockquote>

<p>Is there a concept of "scope" in Kubernetes? I couldn't find any information about different types of scope. If I cannot create namespace at the cluster scope, where can I create the namespace? How can I check which "scopes" do I have access to?</p>

<p>That depends on your Kubernetes environment.</p>
<p>This <a href="https://stackoverflow.com/a/49094802/6309">answer suggest</a> (in a <a href="https://cloud.google.com/" rel="nofollow noreferrer">Google Cloud environment</a>):</p>
<blockquote>
<p>That suggests that <code>gcloud config set container/use_client_certificate</code> is set to <code>true</code> i.e. that <code>gcloud</code> is expecting a client cluster certificate to authenticate to the cluster (this is what the 'client' in the error message refers to).</p>
<p>Unsetting <code>container/use_client_certificate</code> by issuing the following command in the <code>glcoud config</code> ends the need for a legacy certificate or credentials and prevents the error message:</p>
<pre><code>gcloud config unset container/use_client_certificate
</code></pre>
<p>Issues such as this may be more likely if you are using an older version of <code>gcloud</code> on your home workstation or elsewhere.</p>
</blockquote>
<p>Still, <a href="https://github.com/kubernetes/kubernetes/issues/62361#issuecomment-397215728" rel="nofollow noreferrer">kubernetes/kubernetes issue 62361</a> mentions the same error message.</p>
