[release-v0.50.x] Make sure we use the correct namespace for remote Pipeline validation

pkg/reconciler/pipelinerun/resources/pipelineref.go

@@ -37,9 +37,11 @@ import (
 	"k8s.io/client-go/kubernetes"
 )
 
-var ErrReferencedPipelineValidationFailed = errors.New("validation failed for referenced Pipeline")
-var ErrCouldntValidatePipelineRetryable = errors.New("retryable error validating referenced Pipeline")
-var ErrCouldntValidatePipelinePermanent = errors.New("permanent error validating referenced Pipeline")
+var (
+	ErrReferencedPipelineValidationFailed = errors.New("validation failed for referenced Pipeline")
+	ErrCouldntValidatePipelineRetryable   = errors.New("retryable error validating referenced Pipeline")
+	ErrCouldntValidatePipelinePermanent   = errors.New("permanent error validating referenced Pipeline")
+)
 
 // GetPipelineFunc is a factory function that will use the given PipelineRef to return a valid GetPipeline function that
 // looks up the pipeline. It uses as context a k8s client, tekton client, namespace, and service account name to return
@@ -150,6 +152,7 @@ func readRuntimeObjectAsPipeline(ctx context.Context, namespace string, obj runt
 		// TODO(#6592): Decouple API versioning from feature versioning
 		dryRunObj := obj.DeepCopy()
 		dryRunObj.Name = uuid.NewString() // Use a randomized name for the Pipeline in case there is already another Pipeline of the same name
+		dryRunObj.Namespace = namespace   // Make sure the namespace is the same as the PipelineRun
 		if _, err := tekton.TektonV1beta1().Pipelines(namespace).Create(ctx, dryRunObj, metav1.CreateOptions{DryRun: []string{metav1.DryRunAll}}); err != nil {
 			return nil, nil, handleDryRunCreateErr(err, obj.Name)
 		}
@@ -169,6 +172,7 @@ func readRuntimeObjectAsPipeline(ctx context.Context, namespace string, obj runt
 		// without actually creating the Pipeline on the cluster
 		dryRunObj := obj.DeepCopy()
 		dryRunObj.Name = uuid.NewString() // Use a randomized name for the Pipeline in case there is already another Pipeline of the same name
+		dryRunObj.Namespace = namespace   // Make sure the namespace is the same as the PipelineRun
 		if _, err := tekton.TektonV1().Pipelines(namespace).Create(ctx, dryRunObj, metav1.CreateOptions{DryRun: []string{metav1.DryRunAll}}); err != nil {
 			return nil, nil, handleDryRunCreateErr(err, obj.Name)
 		}

pkg/reconciler/pipelinerun/resources/pipelineref_test.go

@@ -74,7 +74,8 @@ var (
 	unsignedV1Pipeline = &v1.Pipeline{
 		TypeMeta: metav1.TypeMeta{
 			APIVersion: "tekton.dev/v1",
-			Kind:       "Pipeline"},
+			Kind:       "Pipeline",
+		},
 		ObjectMeta: metav1.ObjectMeta{
 			Name:        "pipeline",
 			Namespace:   "trusted-resources",
@@ -313,6 +314,14 @@ func TestGetPipelineFunc_RemoteResolution(t *testing.T) {
 			pipelineYAMLStringWithoutDefaults,
 		}, "\n"),
 		wantPipeline: parse.MustParseV1Pipeline(t, pipelineYAMLStringWithoutDefaults),
+	}, {
+		name: "v1 remote pipeline with different namespace",
+		pipelineYAML: strings.Join([]string{
+			"kind: Pipeline",
+			"apiVersion: tekton.dev/v1",
+			pipelineYAMLStringNamespaceFoo,
+		}, "\n"),
+		wantPipeline: parse.MustParseV1Pipeline(t, pipelineYAMLStringNamespaceFoo),
 	}}
 	for _, tc := range testcases {
 		t.Run(tc.name, func(t *testing.T) {
@@ -1303,6 +1312,21 @@ spec:
     type: ""
 `
 
+var pipelineYAMLStringNamespaceFoo = `
+metadata:
+  name: foo
+  namespace: foo
+spec:
+  tasks:
+  - name: task1
+    taskSpec:
+      steps:
+      - name: step1
+        image: ubuntu
+        script: |
+          echo "hello world!"
+`
+
 func getSignedV1Pipeline(unsigned *v1.Pipeline, signer signature.Signer, name string) (*v1.Pipeline, error) {
 	signed := unsigned.DeepCopy()
 	signed.Name = name