apache/dolphinscheduler · warning · ServiceException

USER_NO_OPERATION_PERM

USER_NO_OPERATION_PERM

Error message

USER_NO_OPERATION_PERM

What it means

USER_NO_OPERATION_PERM is thrown by registerK8sNamespace when the logged-in user is not an admin. Creating K8s namespaces is an administrator-only operation, so any non-admin user attempting it is rejected with a permission error.

Source

Thrown at dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/K8SNamespaceServiceImpl.java:112

        pageInfo.setTotal(count);
        pageInfo.setTotalList(k8sNamespaceList.getRecords());
        result.setData(pageInfo);
        putMsg(result, Status.SUCCESS);

        return result;
    }

    /**
     * register namespace in db,need to create namespace in k8s first
     *
     * @param loginUser    login user
     * @param namespace    namespace
     * @param clusterCode  k8s not null
     */
    @Override
    public K8sNamespace registerK8sNamespace(User loginUser, String namespace, Long clusterCode) {
        if (isNotAdmin(loginUser)) {
            throw new ServiceException(Status.USER_NO_OPERATION_PERM);
        }

        if (StringUtils.isEmpty(namespace)) {
            log.warn("Parameter namespace is empty.");
            throw new ServiceException(Status.REQUEST_PARAMS_NOT_VALID_ERROR, Constants.NAMESPACE);
        }

        if (clusterCode == null) {
            log.warn("Parameter clusterCode is null.");
            throw new ServiceException(Status.REQUEST_PARAMS_NOT_VALID_ERROR, Constants.CLUSTER);
        }

        if (checkNamespaceExistInDb(namespace, clusterCode)) {
            log.warn("K8S namespace already exists.");
            throw new ServiceException(Status.K8S_NAMESPACE_EXIST, namespace, clusterCode);
        }

        Cluster cluster = clusterDao.queryByClusterCode(clusterCode);

View on GitHub (pinned to 02eac45a1b)

Solutions

1. Log in with an administrator account to register namespaces.
2. Grant the user admin role (update user_type to ADMIN) if legitimately required.
3. Have an admin perform the namespace registration on behalf of the user.

Example fix

// before (non-admin)
k8sService.registerK8sNamespace(normalUser, "ns", clusterCode); // permission error
// after
k8sService.registerK8sNamespace(adminUser, "ns", clusterCode);

if (!UserType.ADMIN_GENERAL_USER.equals(loginUser.getUserType())) { throw new IllegalStateException("admin required to register k8s namespace"); }

boolean isAdmin(User u) { return u != null && UserType.ADMIN_GENERAL_USER.equals(u.getUserType()); }

try { k8sService.registerK8sNamespace(loginUser, ns, clusterCode); } catch (ServiceException e) { if (e.getCode() == Status.USER_NO_OPERATION_PERM) { /* prompt for admin credentials or request admin action */ } else throw e; }

When it happens

Trigger: A non-admin user calls the K8s namespace create endpoint (registerK8sNamespace) — isNotAdmin(loginUser) returns true.

Common situations: A regular project user trying to register a namespace through the UI/API; service accounts lacking admin role used in automation scripts.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• REQUEST_PARAMS_NOT_VALID_ERROR
• 20016
• K8S task params is not valid
• no master server available
• Backfill workflow failed: %s

AI-assisted analysis of apache/dolphinscheduler@02eac45a1b (2026-09-06). Data as JSON: /api/errors/27b5006f139ac52b. Report an issue: GitHub.