apache/pulsar · error · RestException

Cannot find NamespaceIsolationPolicy ${policyName} for clust

Error message

Cannot find NamespaceIsolationPolicy ${policyName} for cluster ${cluster}

What it means

HTTP 404 (NOT_FOUND) thrown by getNamespaceIsolationPolicy when the cluster exists and has isolation policies, but no policy with the requested policyName is present in that map. The check is policies.containsKey(policyName) after loading all policies for the cluster.

Source

Thrown at pulsar-broker/src/main/java/org/apache/pulsar/broker/admin/impl/ClustersBase.java:627

                    content = @Content(schema = @Schema(implementation = NamespaceIsolationDataImpl.class))),
            @ApiResponse(responseCode = "403", description = "Don't have admin permission."),
            @ApiResponse(responseCode = "404", description = "Policy doesn't exist."),
            @ApiResponse(responseCode = "412", description = "Cluster doesn't exist."),
            @ApiResponse(responseCode = "500", description = "Internal server error.")
    })
    public void getNamespaceIsolationPolicy(
        @Suspended AsyncResponse asyncResponse,
        @Parameter(description = "The cluster name", required = true) @PathParam("cluster") String cluster,
        @Parameter(description = "The name of the namespace isolation policy", required = true)
        @PathParam("policyName") String policyName
    ) {
        validateBothSuperuserAndClusterPolicyOperation(cluster, PolicyName.NAMESPACE_ISOLATION, PolicyOperation.READ)
                .thenCompose(__ -> validateClusterExistAsync(cluster, Status.PRECONDITION_FAILED))
                .thenCompose(__ -> internalGetNamespaceIsolationPolicies(cluster))
                .thenAccept(policies -> {
                    // construct the response to Namespace isolation data map
                    if (!policies.containsKey(policyName)) {
                        throw new RestException(Status.NOT_FOUND,
                                "Cannot find NamespaceIsolationPolicy " + policyName + " for cluster " + cluster);
                    }
                    asyncResponse.resume(policies.get(policyName));
                }).exceptionally(ex -> {
                    log.error()
                            .attr("cluster", cluster)
                            .exception(ex)
                            .log("Failed to get namespace isolation policies");
                    resumeAsyncResponseExceptionally(asyncResponse, ex);
                    return null;
                });
    }

    @GET
    @Path("/{cluster}/namespaceIsolationPolicies/brokers")
    @Operation(
        summary = "Get list of brokers with namespace-isolation policies attached to them.",
        description = "This operation requires Pulsar superuser privileges."

View on GitHub (pinned to 820761864e)

Solutions

List available policies with GET /admin/v3/clusters/{cluster}/namespaceIsolationPolicies and use an exact existing name.
Create the policy first with POST .../namespaceIsolationPolicies/{policyName} if it should exist.
Check name spelling and case-sensitivity against the stored policy.

Example fix

// before
NamespaceIsolationData d = admin.namespaces().getNamespaceIsolationPolicy("c1", "prod_only"); // 404
// after
Map<String, NamespaceIsolationData> all = admin.namespaces().getNamespaceIsolationPolicies("c1");
if (all.containsKey("prod_only")) {
    NamespaceIsolationData d = all.get("prod_only");
}

Defensive patterns

Strategy: validation

Validate before calling

Map<String, NamespaceIsolationData> all =
        admin.namespaces().getNamespaceIsolationPolicies(cluster); // may 404 -> empty
if (!all.containsKey(policyName)) {
    throw new IllegalArgumentException("Policy " + policyName + " not in " + all.keySet());
}
NamespaceIsolationData d = admin.namespaces().getNamespaceIsolationPolicy(cluster, policyName);

Try / catch

try {
    admin.namespaces().getNamespaceIsolationPolicy(cluster, policyName);
} catch (PulsarAdminException.NotFoundException e) {
    // list existing policies and pick/create the correct name
}

Prevention

Fetch the policy map first and use exact keys from it.
Watch case-sensitivity in policy names; standardize naming conventions.
Create policies per cluster where needed rather than assuming global policy names.

When it happens

Trigger: GET /admin/v3/clusters/{cluster}/namespaceIsolationPolicies/{policyName} with a policy name that was never created or already deleted; case mismatch in policy name; querying a policy defined on a different cluster.

Common situations: Renamed policies in newer config management code; per-cluster policy sets where the name exists only on one cluster; typos in policy name in dashboards/automation.

Related errors

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/cf1ad82da3a64350. Report an issue: GitHub.