# Container Groups and Namespaces

**URL:** <https://forum.ansible.com/t/container-groups-and-namespaces/44195>\
**Category:** Get Help\
**Tags:** awx, ee, kubernetes\
**Created:** [August 2, 2025, 4:18am UTC](https://forum.ansible.com/t/container-groups-and-namespaces/44195 "2025-08-02T04:18:38Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jake\_K](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jake_k/32/7094_2.png) [@Jake\_K](https://forum.ansible.com/u/Jake_K)\
**Post date:** [August 2, 2025, 4:18am UTC](https://forum.ansible.com/t/container-groups-and-namespaces/44195/1 "2025-08-02T04:18:38Z")

</div>

I want to use a custom pod specification with a container group.

The AWX install is in namespace **1**

I have created a second namespace namespace **2** where I want to run container group jobs.

Both namespaces are on the same Kubernetes cluster.

I created a service account with secret in namespace **2**. It has the rights to create secrets and run pods in namespace **2**

I created a credential of type Kubernetes Bearer Token using the certificate data and token of the service account from namespace **2**

I also created a container group that is linked to this credential

My expectation is that when the EE image runs, it uses this service account credential and creates a pod in namespace **2**

However, when running I get this error,

```auto
Error creating pod: pods is forbidden: User "system:serviceaccount:namespace2:serviceaccountname" cannot create resource "pods" in API group "" in the namespace "namespace1"

```

Why is it trying to create a pod in namespace **1** instead of namespace **2**???

Bit frustrated. Any guidance is most appreciated!!

---

<div class="post-metadata">

**Author:** ![iwt-cmd](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/iwt-cmd/32/9120_2.png) [@iwt-cmd](https://forum.ansible.com/u/iwt-cmd)\
**Post date:** [August 4, 2025, 11:48am UTC](https://forum.ansible.com/t/container-groups-and-namespaces/44195/2 "2025-08-04T11:48:30Z")

</div>

Hi @Jake_K

Have you modified the container group pod spec with the desired namespace?

> **[7. Container and Instance Groups — Ansible AWX community documentation](https://ansible.readthedocs.io/projects/awx/en/24.6.1/administration/containers_instance_groups.html#customize-the-pod-spec)**

Best regards,

Joe

---

<div class="post-metadata">

**Author:** ![Jake\_K](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jake_k/32/7094_2.png) [@Jake\_K](https://forum.ansible.com/u/Jake_K)\
**Post date:** [August 4, 2025, 6:33pm UTC](https://forum.ansible.com/t/container-groups-and-namespaces/44195/3 "2025-08-04T18:33:11Z")

</div>

Hi Joe,

Thanks for the response. Yes, I did update the namespace in the pod spec to the new namespace.

```auto
apiVersion: v1
kind: Pod
metadata:
  namespace: namespace2
spec:
  serviceAccountName: serviceaccountname
  automountServiceAccountToken: true

```

I have tried the following variations without success,

serviceAccountName: serviceaccountname and also serviceAccountName: default  
automountServiceAccountToken: true and also automountServiceAccountToken: false

I also granted serviceaccountname pretty much all rights just to rule that out as the issue.

Does not seem to pick the right namespace ☹

Jake.

---

<div class="post-metadata">

**Author:** ![anon81884396](https://avatars.discourse-cdn.com/v4/letter/a/b782af/32.png) [@anon81884396](https://forum.ansible.com/u/anon81884396)\
**Post date:** [August 4, 2025, 6:41pm UTC](https://forum.ansible.com/t/container-groups-and-namespaces/44195/4 "2025-08-04T18:41:14Z")

</div>

I have a setup similar to yours and it functions correctly. My spec is this

```auto
apiVersion: v1
kind: Pod
metadata:
  namespace: from-prod-awx
spec:
  serviceAccountName: default
  automountServiceAccountToken: false
  containers:
    - image: 'quay.io/ansible/awx-ee:latest'
      name: worker
      args:
        - ansible-runner
        - worker
        - '--private-data-dir=/runner'
      resources:
        requests:
          cpu: 250m
          memory: 100Mi

```

I have attached to it a credential of type “OpenShift or Kubernetes API Bearer Token” with my kubernetes API endpoint defined in that cred.

This works as expected in my own AWX deployment, so all I can think of is to double check your AWX job template is configured to use the correct instance group for the namespace you want to use.

---

<div class="post-metadata">

**Author:** ![Jake\_K](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jake_k/32/7094_2.png) [@Jake\_K](https://forum.ansible.com/u/Jake_K)\
**Post date:** [August 4, 2025, 6:50pm UTC](https://forum.ansible.com/t/container-groups-and-namespaces/44195/5 "2025-08-04T18:50:28Z")

</div>

@anon81884396 - Thanks for testing! So I assume the “from-prod-awx” namespace is a different namespace from the one that the AWX tower is deployed to?

---

<div class="post-metadata">

**Author:** ![anon81884396](https://avatars.discourse-cdn.com/v4/letter/a/b782af/32.png) [@anon81884396](https://forum.ansible.com/u/anon81884396)\
**Post date:** [August 4, 2025, 6:52pm UTC](https://forum.ansible.com/t/container-groups-and-namespaces/44195/6 "2025-08-04T18:52:01Z")

</div>

Different remote cluster and namespace, yes. I have a namespace for prod and nonprod and both work as expected.

---

<div class="post-metadata">

**Author:** ![Jake\_K](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jake_k/32/7094_2.png) [@Jake\_K](https://forum.ansible.com/u/Jake_K)\
**Post date:** [August 4, 2025, 6:59pm UTC](https://forum.ansible.com/t/container-groups-and-namespaces/44195/7 "2025-08-04T18:59:39Z")

</div>

@anon81884396 - I have the same Credential (k8s API bearer token) configured both on the container group definition as well as on the template definition. Should I be only specifying it on the template and not on the container group? Or vice-versa? But otherwise, I do have the credential connected to both the template as well as the container group.

---

<div class="post-metadata">

**Author:** ![anon81884396](https://avatars.discourse-cdn.com/v4/letter/a/b782af/32.png) [@anon81884396](https://forum.ansible.com/u/anon81884396)\
**Post date:** [August 4, 2025, 7:06pm UTC](https://forum.ansible.com/t/container-groups-and-namespaces/44195/8 "2025-08-04T19:06:31Z")

</div>

You don’t need the credential on the job template, just associated with the instance group. Since you are not seeing the right namespace, I suspect your job template isn’t configured to use that instance group and is just defaulting to the default instance group.

 ![image](https://us1.discourse-cdn.com/ansible/original/2X/d/d2d5c7d468188f4b9a1dadf64e4fd3d0962705d8.png)

If you had an incorrect cred or one with insufficient permissions, you’d see an error about being unable to connect or create a pod or some other aspect of the necessary permissions. Your seeing pods in the wrong namespace seems to me like something simple is missing right now for you.

Try posting your job template with any sensitive info redacted, also the kubernetes cred you’re using too.

---

<div class="post-metadata">

**Author:** ![Jake\_K](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jake_k/32/7094_2.png) [@Jake\_K](https://forum.ansible.com/u/Jake_K)\
**Post date:** [August 4, 2025, 7:41pm UTC](https://forum.ansible.com/t/container-groups-and-namespaces/44195/9 "2025-08-04T19:41:55Z")

</div>

@anon81884396 - Here are the screenshots:

Firstly, the credential configuration

 ![ContainerGroup02](https://us1.discourse-cdn.com/ansible/original/2X/d/d69e67b5dafcf8bb356438ef7e57e16c35ad5130.png)

And here is the Container Group. Please note that the XXX-awxexecution-dv-ns is the namespace where I want it to run

 ![ContainerGroup03](https://us1.discourse-cdn.com/ansible/original/2X/1/141600396dd84023f54c41233a81734c14c635ec.png)

And finally the template itself

 ![ContainerGroup01](https://us1.discourse-cdn.com/ansible/original/2X/a/ac16c6c722940244331b33279d791d2c965eb5f5.png)

Thanks!

---

<div class="post-metadata">

**Author:** ![anon81884396](https://avatars.discourse-cdn.com/v4/letter/a/b782af/32.png) [@anon81884396](https://forum.ansible.com/u/anon81884396)\
**Post date:** [August 4, 2025, 9:14pm UTC](https://forum.ansible.com/t/container-groups-and-namespaces/44195/10 "2025-08-04T21:14:04Z")

</div>

Hmm, everything looks correct to me. Try running your job template with very high verbosity and see if it yields any insights.

---

<div class="post-metadata">

**Author:** ![Jake\_K](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jake_k/32/7094_2.png) [@Jake\_K](https://forum.ansible.com/u/Jake_K)\
**Post date:** [August 4, 2025, 9:22pm UTC](https://forum.ansible.com/t/container-groups-and-namespaces/44195/11 "2025-08-04T21:22:36Z")

</div>

Didnt realize there was a verbosity switch on the Template 🙂 Tried that. But the output message is exactly the same. No extra details than in Normal mode of logging.

---

<div class="post-metadata">

**Author:** ![anon81884396](https://avatars.discourse-cdn.com/v4/letter/a/b782af/32.png) [@anon81884396](https://forum.ansible.com/u/anon81884396)\
**Post date:** [August 4, 2025, 9:37pm UTC](https://forum.ansible.com/t/container-groups-and-namespaces/44195/12 "2025-08-04T21:37:30Z")

</div>

What is the contents of your inventory associated to the template, MyContainerGroup01Inventory?

---

<div class="post-metadata">

**Author:** ![Jake\_K](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jake_k/32/7094_2.png) [@Jake\_K](https://forum.ansible.com/u/Jake_K)\
**Post date:** [August 4, 2025, 9:40pm UTC](https://forum.ansible.com/t/container-groups-and-namespaces/44195/13 "2025-08-04T21:40:56Z")

</div>

The “Instance Groups” is set to Mycontainergroup01…which is the name of my Container Group. I just have a dummy host called localhost with this variable yaml

{‘ansible\_host’: ‘127.0.0.1’, ‘ansible\_connection’: ‘local’}

---

<div class="post-metadata">

**Author:** ![anon81884396](https://avatars.discourse-cdn.com/v4/letter/a/b782af/32.png) [@anon81884396](https://forum.ansible.com/u/anon81884396)\
**Post date:** [August 4, 2025, 9:52pm UTC](https://forum.ansible.com/t/container-groups-and-namespaces/44195/14 "2025-08-04T21:52:32Z")

</div>

Gotcha. I’m out of ideas on things to check, your setup looks correct to me. Maybe there’s some deep kubernetes/awx lore I’m missing out on that made mine work

---

<div class="post-metadata">

**Author:** ![Jake\_K](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jake_k/32/7094_2.png) [@Jake\_K](https://forum.ansible.com/u/Jake_K)\
**Post date:** [August 4, 2025, 9:58pm UTC](https://forum.ansible.com/t/container-groups-and-namespaces/44195/15 "2025-08-04T21:58:19Z")

</div>

Hey @anon81884396, I really appreciate that you took the time to review my configuration!!! I’ll keep troubleshooting! 🙂 Cheers!!

---

<div class="post-metadata">

**Author:** ![Jake\_K](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jake_k/32/7094_2.png) [@Jake\_K](https://forum.ansible.com/u/Jake_K)\
**Post date:** [August 7, 2025, 11:02pm UTC](https://forum.ansible.com/t/container-groups-and-namespaces/44195/16 "2025-08-07T23:02:59Z")

</div>

Still no success. What I am concluding is that the container group set on the template is not getting used. Although the completed jobs show up with the correct container group name, I don’t think its really using the container group. That would explain why it is not using the right namespace. Also, other changes in my customized pod specification do not seem to be getting applied. Any thoughts on why it might be ignoring my container group??

---

<div class="post-metadata">

**Author:** ![anon81884396](https://avatars.discourse-cdn.com/v4/letter/a/b782af/32.png) [@anon81884396](https://forum.ansible.com/u/anon81884396)\
**Post date:** [August 7, 2025, 11:22pm UTC](https://forum.ansible.com/t/container-groups-and-namespaces/44195/17 "2025-08-07T23:22:29Z")

</div>

Don’t know why it would be happening like what you’re describing. Just for giggles, in the AWX UI, go to instance groups and click on the “default” container group, then click on the Jobs tab. See if your jobs are landing in the default container group instead of your desired container group.

---

<div class="post-metadata">

**Author:** ![Jake\_K](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jake_k/32/7094_2.png) [@Jake\_K](https://forum.ansible.com/u/Jake_K)\
**Post date:** [August 7, 2025, 11:34pm UTC](https://forum.ansible.com/t/container-groups-and-namespaces/44195/18 "2025-08-07T23:34:17Z")

</div>

Good suggestion. I checked that also. The executed jobs all appear under the right container group instance…but I dont feel its using the custom pod specification. Reason I am suspecting this is because,

- There is a custom namespace that it is ignoring
- There is a volume mount I am trying to add. But when I query for mounts, it doesnt show up in the Ansible playbook

So I feel its either picking the right container group but then ignoring the custom pod spec. OR its not using the container group at all. Since the jobs show up on the right container group, I am thinking its more the former where its not applying the custom pod spec.

In this [link](https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.3/html/red_hat_ansible_automation_platform_performance_considerations_for_operator_based_installations/assembly-pod-spec-modifications#proc-enable-pods-ref-images) it states,  
_Note that the image used by a job running in a container group is always overridden by the Execution Environment associated with the job._

Does that mean it will also ignore the custom pod spec? If I blank out the Execution environment on the template, it still picks “AWX EE (24.6.1)” as default.

---

<div class="post-metadata">

**Author:** ![anon81884396](https://avatars.discourse-cdn.com/v4/letter/a/b782af/32.png) [@anon81884396](https://forum.ansible.com/u/anon81884396)\
**Post date:** [August 7, 2025, 11:42pm UTC](https://forum.ansible.com/t/container-groups-and-namespaces/44195/19 "2025-08-07T23:42:11Z")

</div>

Interesting…

What version of AWX are you running?

Also, if you look at a recent job run from your job template’s “Job” history tab and click on it, do you see that job run indeed used the container group you expected it to in the “job details” tab (see pic below)? If so, can you click on container group name’s link from that piece of the UI and validate the container group is the one with your desired pod spec?

 ![image](https://us1.discourse-cdn.com/ansible/original/2X/e/e673fcd10088baebcafbc170f0358c6ec39db401.png)

Your issue is very odd and I’m academically curious what may be going wrong. I can’t think of solutions, only some other ideas for troubleshooting.

---

<div class="post-metadata">

**Author:** ![Jake\_K](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jake_k/32/7094_2.png) [@Jake\_K](https://forum.ansible.com/u/Jake_K)\
**Post date:** [August 7, 2025, 11:51pm UTC](https://forum.ansible.com/t/container-groups-and-namespaces/44195/20 "2025-08-07T23:51:07Z")

</div>

And I really appreciate all the interest and troubleshooting advice you have provided! Otherwise, its so easy to lose heart and walk away if community support is lacking 🙂 So thanks again!

Version is core 2.18.7

Yes, the container group its showing on the job is the right one.

[Next page](https://forum.ansible.com/t/container-groups-and-namespaces/44195.md?page=2)