{"record":{"id":"0e5f7d931c3a4ec9","repo":"apache/pulsar","slug":"namespace-namespace-does-not-match-policy","errorCode":null,"errorMessage":"Namespace ${namespace} does not match policy","messagePattern":"Namespace (.+?) does not match policy","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"pulsar-common/src/main/java/org/apache/pulsar/common/policies/impl/NamespaceIsolationPolicyImpl.java","lineNumber":90,"sourceCode":"    @Override\n    public List<String> getPrimaryBrokers() {\n        return this.primary;\n    }\n\n    @Override\n    public List<String> getSecondaryBrokers() {\n        return this.secondary;\n    }\n\n    @Override\n    public NamespaceIsolationPolicyUnloadScope getUnloadScope() {\n        return this.unloadScope;\n    }\n\n    @Override\n    public List<URL> findPrimaryBrokers(List<URL> availableBrokers, NamespaceName namespace) {\n        if (!this.matchNamespaces(namespace.toString())) {\n            throw new IllegalArgumentException(\"Namespace \" + namespace.toString() + \" does not match policy\");\n        }\n        // find the available brokers that matches primary brokers regex list\n        return this.getMatchedBrokers(this.primary, availableBrokers);\n    }\n\n    @Override\n    public List<URL> findSecondaryBrokers(List<URL> availableBrokers, NamespaceName namespace) {\n        if (!this.matchNamespaces(namespace.toString())) {\n            throw new IllegalArgumentException(\"Namespace \" + namespace.toString() + \" does not match policy\");\n        }\n        // find the available brokers that matches primary brokers regex list\n        return this.getMatchedBrokers(this.secondary, availableBrokers);\n    }\n\n    @Override\n    public boolean shouldFallback(SortedSet<BrokerStatus> primaryBrokers) {\n        // TODO Auto-generated method stub\n        return false;","sourceCodeStart":72,"sourceCodeEnd":108,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-common/src/main/java/org/apache/pulsar/common/policies/impl/NamespaceIsolationPolicyImpl.java#L72-L108","documentation":"NamespaceIsolationPolicyImpl.findPrimaryBrokers() first verifies the given namespace actually falls under this policy's namespace regex list. If matchNamespaces() fails, the policy is being applied to a namespace it doesn't own, so it throws IllegalArgumentException instead of returning an empty broker list. This guards against silently wrong failover decisions.","triggerScenarios":"Calling findPrimaryBrokers(availableBrokers, namespace) with a namespace string that matches none of the policy's 'namespaces?' regexes — typically by looking up a policy via a regex-keyed map and querying it with a different namespace.","commonSituations":" iterating all policies and applying each to one namespace; namespace renamed/created after policies were defined; case or tenant/cluster prefix mismatch between policy pattern and namespace string.","solutions":["Select the policy via namespaceIsolationPolicies.getPolicy(namespace) (which matches by regex) instead of applying an arbitrary policy object","Fix the namespace string passed in (full form: tenant/cluster/namespace)","Update the policy's namespace regex to cover the namespace in question","Add a matchNamespaces() check in caller code before invoking findPrimaryBrokers"],"exampleFix":"// before\npolicy.findPrimaryBrokers(brokers, ns); // policy may not cover ns\n// after\nif (policy != null && policy.matchNamespaces(ns.toString())) {\n    policy.findPrimaryBrokers(brokers, ns);\n}","handlingStrategy":"validation","validationCode":"// Only call findPrimaryBrokers on a policy that actually matches the namespace\nif (policy == null || !policy.matchNamespaces(ns.toString())) {\n    throw new IllegalStateException(\"Policy does not govern namespace \" + ns);\n}","typeGuard":"static boolean policyCovers(NamespaceIsolationPolicyImpl p, NamespaceName ns) {\n    return p != null && p.matchNamespaces(ns.toString());\n}","tryCatchPattern":"try {\n    List<URL> primaries = policy.findPrimaryBrokers(brokers, ns);\n} catch (IllegalArgumentException e) {\n    log.warn(\"Namespace {} not covered by this policy; resolving by match instead\", ns);\n    policy = nsPolicies.getPolicy(ns); // re-resolve correct policy\n}","preventionTips":["Always resolve policies via getPolicy(namespace) rather than iterating raw policy objects","Use the full tenant/cluster/namespace string when matching","Update namespace regexes when namespaces are renamed or added","Unit-test policy matching against real namespace identifiers"],"tags":["namespace-isolation","regex-mismatch","lookup"],"backgroundTag":"namespace-policy-mismatch","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}