{"record":{"id":"27b5006f139ac52b","repo":"apache/dolphinscheduler","slug":"user-no-operation-perm-27b500","errorCode":"USER_NO_OPERATION_PERM","errorMessage":"USER_NO_OPERATION_PERM","messagePattern":"USER_NO_OPERATION_PERM","errorType":"error_code","errorClass":"ServiceException","httpStatus":null,"severity":"warning","filePath":"dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/K8SNamespaceServiceImpl.java","lineNumber":112,"sourceCode":"        pageInfo.setTotal(count);\n        pageInfo.setTotalList(k8sNamespaceList.getRecords());\n        result.setData(pageInfo);\n        putMsg(result, Status.SUCCESS);\n\n        return result;\n    }\n\n    /**\n     * register namespace in db,need to create namespace in k8s first\n     *\n     * @param loginUser    login user\n     * @param namespace    namespace\n     * @param clusterCode  k8s not null\n     */\n    @Override\n    public K8sNamespace registerK8sNamespace(User loginUser, String namespace, Long clusterCode) {\n        if (isNotAdmin(loginUser)) {\n            throw new ServiceException(Status.USER_NO_OPERATION_PERM);\n        }\n\n        if (StringUtils.isEmpty(namespace)) {\n            log.warn(\"Parameter namespace is empty.\");\n            throw new ServiceException(Status.REQUEST_PARAMS_NOT_VALID_ERROR, Constants.NAMESPACE);\n        }\n\n        if (clusterCode == null) {\n            log.warn(\"Parameter clusterCode is null.\");\n            throw new ServiceException(Status.REQUEST_PARAMS_NOT_VALID_ERROR, Constants.CLUSTER);\n        }\n\n        if (checkNamespaceExistInDb(namespace, clusterCode)) {\n            log.warn(\"K8S namespace already exists.\");\n            throw new ServiceException(Status.K8S_NAMESPACE_EXIST, namespace, clusterCode);\n        }\n\n        Cluster cluster = clusterDao.queryByClusterCode(clusterCode);","sourceCodeStart":94,"sourceCodeEnd":130,"githubUrl":"https://github.com/apache/dolphinscheduler/blob/02eac45a1b6676e639fcbfb4be2243de5771b05d/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/K8SNamespaceServiceImpl.java#L94-L130","documentation":"USER_NO_OPERATION_PERM is thrown by registerK8sNamespace when the logged-in user is not an admin. Creating K8s namespaces is an administrator-only operation, so any non-admin user attempting it is rejected with a permission error.","triggerScenarios":"A non-admin user calls the K8s namespace create endpoint (registerK8sNamespace) — isNotAdmin(loginUser) returns true.","commonSituations":"A regular project user trying to register a namespace through the UI/API; service accounts lacking admin role used in automation scripts.","solutions":["Log in with an administrator account to register namespaces.","Grant the user admin role (update user_type to ADMIN) if legitimately required.","Have an admin perform the namespace registration on behalf of the user."],"exampleFix":"// before (non-admin)\nk8sService.registerK8sNamespace(normalUser, \"ns\", clusterCode); // permission error\n// after\nk8sService.registerK8sNamespace(adminUser, \"ns\", clusterCode);","handlingStrategy":"validation","validationCode":"if (!UserType.ADMIN_GENERAL_USER.equals(loginUser.getUserType())) { throw new IllegalStateException(\"admin required to register k8s namespace\"); }","typeGuard":"boolean isAdmin(User u) { return u != null && UserType.ADMIN_GENERAL_USER.equals(u.getUserType()); }","tryCatchPattern":"try { k8sService.registerK8sNamespace(loginUser, ns, clusterCode); } catch (ServiceException e) { if (e.getCode() == Status.USER_NO_OPERATION_PERM) { /* prompt for admin credentials or request admin action */ } else throw e; }","preventionTips":["Perform K8s namespace operations only with admin accounts.","Check user role before exposing admin-only UI actions.","Grant admin role deliberately and audit it."],"tags":["permission","k8s","admin-only","dolphinscheduler"],"backgroundTag":"permission-denied","analyzedSha":"02eac45a1b6676e639fcbfb4be2243de5771b05d","analyzedAt":"2026-09-06T17:43:00.555Z","contentChangedAt":"2026-09-06T17:43:00.555Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}