apache/pulsar · error · RestException

%s %s cannot be admitted:- %s

Error message

%s %s cannot be admitted:- %s

What it means

After parameter validation succeeds, the registration runs doAdmissionChecks on the FunctionDetails via the configured runtime factory (e.g. KubernetesRuntimeFactory). If admission fails (resource limits, forbidden settings, admission controllers), the worker throws a 400 BAD_REQUEST RestException formatted as '<ComponentType> <name> cannot be admitted:- <reason>'. The reason text after ':-' comes from the runtime factory.

Source

Thrown at pulsar-functions/worker/src/main/java/org/apache/pulsar/functions/worker/rest/api/SourcesImpl.java:189

                }
            } catch (Exception e) {
                log.error().attr("componentType", ComponentTypeUtils.toString(componentType)).attr("tenant", tenant)

                        .attr("namespace", namespace).attr("componentName", sourceName).exception(e)

                        .log("Invalid register request @ / / /");
                throw new RestException(Response.Status.BAD_REQUEST, e.getMessage());
            }

            try {
                worker().getFunctionRuntimeManager().getRuntimeFactory().doAdmissionChecks(functionDetails);
            } catch (Exception e) {
                log.error().attr("componentType", ComponentTypeUtils.toString(componentType)).attr("tenant", tenant)

                        .attr("namespace", namespace).attr("componentName", sourceName)

                        .log("/ / cannot be admitted by the runtime factory");
                throw new RestException(Response.Status.BAD_REQUEST,
                        String.format("%s %s cannot be admitted:- %s", ComponentTypeUtils.toString(componentType),
                                sourceName, e.getMessage()));
            }

            // function state
            FunctionMetaData functionMetaDataObj = new FunctionMetaData();
            functionMetaDataObj.setFunctionDetails().copyFrom(functionDetails);
            functionMetaDataObj.setCreateTime(System.currentTimeMillis());
            functionMetaDataObj.setVersion(0);

            // cache auth if need
            if (worker().getWorkerConfig().isAuthenticationEnabled()) {
                FunctionDetails finalFunctionDetails = functionDetails;
                worker().getFunctionRuntimeManager()
                        .getRuntimeFactory()
                        .getAuthProvider().ifPresent(functionAuthProvider -> {
                    if (authParams.getClientAuthenticationDataSource() != null) {

View on GitHub (pinned to 820761864e)

Solutions

1. Parse the message after ':-' for the admission-check failure reason from the runtime factory.
2. If resource-related, lower CPU/memory in sourceConfig.resources (or the instanceResource config) to fit the namespace quota.
3. Check the worker's functions_worker.yml runtime configuration and any KubernetesRuntimeFactory admission settings/labels.
4. Verify the Kubernetes namespace, RBAC, and any installed admission webhooks allow creating the function pods.

Example fix

// before: sourceConfig requesting resources above quota
"resources": { "cpu": 4, "ram": 8589934592 }

// after: fit within the k8s namespace quota
"resources": { "cpu": 1, "ram": 1073741824 }

// Client side: keep requested resources within cluster quota before registering
if (cfg.getResources() != null) {
    double cpu = cfg.getResources().getCpu();
    long ram = cfg.getResources().getRam();
    if (cpu > 2 || ram > 4L * 1024 * 1024 * 1024) {
        throw new IllegalArgumentException("requested resources exceed namespace quota");
    }
}

static boolean withinQuota(Resources resources, double maxCpu, long maxRam) {
    return resources == null || (resources.getCpu() <= maxCpu && resources.getRam() <= maxRam);
}

try {
    admin.sources().createSource(cfg, pkgUrl, archive);
} catch (PulsarAdminException e) {
    if (e.getMessage() != null && e.getMessage().contains("cannot be admitted")) {
        // adjust resources/runtime settings per the reason after ":-"
    } else {
        throw e;
    }
}

When it happens

Trigger: registerSource on a worker whose RuntimeFactory's doAdmissionChecks throws — e.g. Kubernetes runtime rejecting requested CPU/memory resources, namespace/labels not allowed, or function runtime policy violations.

Common situations: K8s runtime factory with admission checks rejecting a source requesting more resources than the namespace quota; running on a worker configured with kubernetes but missing required runtime customization; function instanceResource specs exceeding cluster limits.

Related errors

• <validation message from IllegalArgumentException>
• %s %s doesn't have instance with id %s
• Function in trigger function has more than 1 input topics
• Function in trigger function has unidentified topic
• %s Package is not provided

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/5b49a80b93cab7a4. Report an issue: GitHub.