{"record":{"id":"3fc720ab30005749","repo":"vitessio/vitess","slug":"not-allowed-deny-all-security-policy-enforced","errorCode":null,"errorMessage":"not allowed: deny-all security-policy enforced","messagePattern":"not allowed: deny-all security-policy enforced","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"go/acl/deny_all_policy.go","lineNumber":24,"sourceCode":"You may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\npackage acl\n\nimport (\n\t\"errors\"\n\t\"net/http\"\n)\n\nvar errDenyAll = errors.New(\"not allowed: deny-all security-policy enforced\")\n\n// denyAllPolicy rejects all access.\ntype denyAllPolicy struct{}\n\n// CheckAccessHTTP disallows all HTTP access.\nfunc (denyAllPolicy) CheckAccessHTTP(req *http.Request, role string) error {\n\treturn errDenyAll\n}\n\nfunc init() {\n\tRegisterPolicy(\"deny-all\", denyAllPolicy{})\n}\n","sourceCodeStart":6,"sourceCodeEnd":37,"githubUrl":"https://github.com/vitessio/vitess/blob/01a25a7d176f94613b8d59d799f438380a8760e4/go/acl/deny_all_policy.go#L6-L37","documentation":"Vitess vtadmin detects that the same table on the same shard was queried more than once while collecting table size information for a keyspace schema. This indicates duplicated tablets for a shard in the internal iteration, which should be impossible under normal operation. It is recorded per-keyspace via the error recorder and aborts that table's size aggregation.","triggerScenarios":"Calling Cluster.GetSchema (table size collection) when the tablet list contains two entries for the same table and the same keyspace/shard, e.g. duplicate tablets in discovery results or a shard being visited twice.","commonSituations":"Stale or duplicated entries in the topology discovery cache; a discovery implementation returning the same tablet twice; race between topo watches producing duplicate tablet records.","solutions":["Check the topology for duplicate tablet records for the affected shard and remove/repair stale entries","Restart vtadmin so tablet discovery refreshes and deduplicates the tablet list","File an issue with the vtadmin logs (search for 'Impossible: duplicate shard queries') since this signals an internal invariant violation"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"seen := map[string]bool{}\nfor _, t := range tablets {\n\tkey := t.Tablet.Keyspace + \"/\" + t.Tablet.Shard\n\tif seen[key] { continue }\n\tseen[key] = true\n}\n// deduplicate tablet list before calling GetSchema","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Deduplicate tablet lists from discovery before passing them to schema calls","Monitor for 'Impossible: duplicate shard queries' warnings in vtadmin logs","Refresh discovery caches periodically to avoid stale duplicate entries"],"tags":["vtadmin","schema","topology","duplicate-data"],"backgroundTag":"duplicate-tablet-discovery","analyzedSha":"01a25a7d176f94613b8d59d799f438380a8760e4","analyzedAt":"2026-09-01T17:28:30.605Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}