{"record":{"id":"24b3318c00589d42","repo":"apache/pulsar","slug":"cluster-clusterid-is-not-in-the-list-of-allow","errorCode":null,"errorMessage":"Cluster [${clusterId}] is not in the list of allowed clusters list for namespace [${namespaceName}]","messagePattern":"Cluster \\[(.+?)\\] is not in the list of allowed clusters list for namespace \\[(.+?)\\]","errorType":"http","errorClass":"RestException","httpStatus":400,"severity":"error","filePath":"pulsar-broker/src/main/java/org/apache/pulsar/broker/admin/impl/NamespacesBase.java","lineNumber":877,"sourceCode":"                    return Sets.newHashSet(clusterIds);\n                }).thenCompose(replicationClusterSet -> clustersAsync()\n                        .thenCompose(clusters -> {\n                            List<CompletableFuture<Void>> futures =\n                                    replicationClusterSet.stream().map(clusterId -> {\n                                        if (!clusters.contains(clusterId)) {\n                                            throw new RestException(Status.FORBIDDEN,\n                                                    \"Invalid cluster id: \" + clusterId);\n                                        }\n                                        return validatePeerClusterConflictAsync(clusterId, replicationClusterSet)\n                                            .thenCompose(__ -> getNamespacePoliciesAsync(this.namespaceName)\n                                                .thenCompose(nsPolicies -> {\n                                                    if (!Policies.checkNewReplicationClusters(nsPolicies,\n                                                            replicationClusterSet)) {\n                                                        String msg = String.format(\"Cluster [%s] is not in the \"\n                                                                + \"list of allowed clusters list for namespace \"\n                                                                + \"[%s]\", clusterId, namespaceName.toString());\n                                                        log.info(msg);\n                                                        throw new RestException(Status.BAD_REQUEST, msg);\n                                                    }\n                                                    return validateClusterForTenantAsync(\n                                                            namespaceName.getTenant(), clusterId);\n                                                }));\n                                    }).collect(Collectors.toList());\n                            return FutureUtil.waitForAll(futures).thenApply(__ -> replicationClusterSet);\n                        }))\n                .thenCompose(replicationClusterSet -> {\n                    if (!compareTopicPartitions) {\n                        return CompletableFuture.completedFuture(replicationClusterSet);\n                    }\n                    return getNamespacePoliciesAsync(namespaceName)\n                        .thenCompose(policies ->\n                            validateReplicationClusterCompatibility(replicationClusterSet,\n                            policies.replication_clusters))\n                        .thenApply(__ -> replicationClusterSet);\n                }).thenCompose(replicationClusterSet -> updatePoliciesAsync(namespaceName, policies -> {\n                    policies.replication_clusters = replicationClusterSet;","sourceCodeStart":859,"sourceCodeEnd":895,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-broker/src/main/java/org/apache/pulsar/broker/admin/impl/NamespacesBase.java#L859-L895","documentation":"HTTP 400 (BAD_REQUEST) returned by the set-replication-clusters API when a requested cluster is not part of the namespace's allowed-cluster list — Policies.checkNewReplicationClusters fails because the namespace's is_allow_auto_update or allowed_clusters policy does not include the target cluster. This is a tenant/namespace policy restriction, not a cluster-registration problem.","triggerScenarios":"POST /namespaces/{tenant}/{namespace}/replication where a clusterId passes cluster registration but is absent from nsPolicies.replication_clusters / allowed cluster list enforced by checkNewReplicationClusters in internalSetNamespaceReplicationClusters.","commonSituations":"Tenant geo-restriction policies blocking clusters outside an approved set; namespace created with allowed_clusters that was later narrowed; operator assumes any registered cluster is usable; policy updated by governance automation between operations.","solutions":["Inspect namespace policy (GET /namespaces/{ns}) and add the cluster to the allowed clusters list first (POST .../replication or the cluster-allowed API).","Pick a different cluster that is already in the namespace's allowed list.","Update tenant-level allowed-cluster policy if the namespace policy inherits it.","Align your deployment tooling with the namespace's allowedClusters setting before emitting replication changes."],"exampleFix":"// before\nsetReplicationClusters(ns, List.of(\"cluster-c\")); // not in allowed list\n// after\nadmin.namespaces().setNamespaceReplicationClusters(ns, List.of(\"cluster-c\")); // first allow it\nsetReplicationClusters(ns, List.of(\"cluster-c\"));","handlingStrategy":"validation","validationCode":"Set<String> allowed = new HashSet<>(admin.namespaces().getNamespaceReplicationClusters(ns));\n// and tenant-level allowed clusters:\nSet<String> tenantAllowed = admin.tenants().getTenantInfo(tenant).getAllowedClusters();\nList<String> disallowed = clusterIds.stream().filter(c -> !tenantAllowed.contains(c)).toList();\nif (!disallowed.isEmpty()) throw new IllegalArgumentException(\"Clusters not allowed for tenant: \" + disallowed);","typeGuard":null,"tryCatchPattern":"try {\n    admin.namespaces().setNamespaceReplicationClusters(ns, clusterIds);\n} catch (PulsarAdminException.BadRequestException e) {\n    // cluster not in allowed list — update policy or choose another cluster\n}","preventionTips":["Check the tenant's allowed_clusters before adding a cluster to replication","Update namespace/tenant policy first, then set replication clusters","Keep geo-restriction policy docs in sync with deployment automation","Prefer clusters already in the allowed list when designing failover plans"],"tags":["rest-api","admin","policy","replication","cluster"],"backgroundTag":"cluster-not-allowed","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}