{"record":{"id":"5b49a80b93cab7a4","repo":"apache/pulsar","slug":"s-s-cannot-be-admitted-s-5b49a8","errorCode":null,"errorMessage":"%s %s cannot be admitted:- %s","messagePattern":"(.+?) (.+?) cannot be admitted:- (.+?)","errorType":"http","errorClass":"RestException","httpStatus":400,"severity":"error","filePath":"pulsar-functions/worker/src/main/java/org/apache/pulsar/functions/worker/rest/api/SourcesImpl.java","lineNumber":189,"sourceCode":"                }\n            } catch (Exception e) {\n                log.error().attr(\"componentType\", ComponentTypeUtils.toString(componentType)).attr(\"tenant\", tenant)\n\n                        .attr(\"namespace\", namespace).attr(\"componentName\", sourceName).exception(e)\n\n                        .log(\"Invalid register request @ / / /\");\n                throw new RestException(Response.Status.BAD_REQUEST, e.getMessage());\n            }\n\n            try {\n                worker().getFunctionRuntimeManager().getRuntimeFactory().doAdmissionChecks(functionDetails);\n            } catch (Exception e) {\n                log.error().attr(\"componentType\", ComponentTypeUtils.toString(componentType)).attr(\"tenant\", tenant)\n\n                        .attr(\"namespace\", namespace).attr(\"componentName\", sourceName)\n\n                        .log(\"/ / cannot be admitted by the runtime factory\");\n                throw new RestException(Response.Status.BAD_REQUEST,\n                        String.format(\"%s %s cannot be admitted:- %s\", ComponentTypeUtils.toString(componentType),\n                                sourceName, e.getMessage()));\n            }\n\n            // function state\n            FunctionMetaData functionMetaDataObj = new FunctionMetaData();\n            functionMetaDataObj.setFunctionDetails().copyFrom(functionDetails);\n            functionMetaDataObj.setCreateTime(System.currentTimeMillis());\n            functionMetaDataObj.setVersion(0);\n\n            // cache auth if need\n            if (worker().getWorkerConfig().isAuthenticationEnabled()) {\n                FunctionDetails finalFunctionDetails = functionDetails;\n                worker().getFunctionRuntimeManager()\n                        .getRuntimeFactory()\n                        .getAuthProvider().ifPresent(functionAuthProvider -> {\n                    if (authParams.getClientAuthenticationDataSource() != null) {\n","sourceCodeStart":171,"sourceCodeEnd":207,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-functions/worker/src/main/java/org/apache/pulsar/functions/worker/rest/api/SourcesImpl.java#L171-L207","documentation":"After parameter validation succeeds, the registration runs doAdmissionChecks on the FunctionDetails via the configured runtime factory (e.g. KubernetesRuntimeFactory). If admission fails (resource limits, forbidden settings, admission controllers), the worker throws a 400 BAD_REQUEST RestException formatted as '<ComponentType> <name> cannot be admitted:- <reason>'. The reason text after ':-' comes from the runtime factory.","triggerScenarios":"registerSource on a worker whose RuntimeFactory's doAdmissionChecks throws — e.g. Kubernetes runtime rejecting requested CPU/memory resources, namespace/labels not allowed, or function runtime policy violations.","commonSituations":"K8s runtime factory with admission checks rejecting a source requesting more resources than the namespace quota; running on a worker configured with kubernetes but missing required runtime customization; function instanceResource specs exceeding cluster limits.","solutions":["Parse the message after ':-' for the admission-check failure reason from the runtime factory.","If resource-related, lower CPU/memory in sourceConfig.resources (or the instanceResource config) to fit the namespace quota.","Check the worker's functions_worker.yml runtime configuration and any KubernetesRuntimeFactory admission settings/labels.","Verify the Kubernetes namespace, RBAC, and any installed admission webhooks allow creating the function pods."],"exampleFix":"// before: sourceConfig requesting resources above quota\n\"resources\": { \"cpu\": 4, \"ram\": 8589934592 }\n\n// after: fit within the k8s namespace quota\n\"resources\": { \"cpu\": 1, \"ram\": 1073741824 }","handlingStrategy":"validation","validationCode":"// Client side: keep requested resources within cluster quota before registering\nif (cfg.getResources() != null) {\n    double cpu = cfg.getResources().getCpu();\n    long ram = cfg.getResources().getRam();\n    if (cpu > 2 || ram > 4L * 1024 * 1024 * 1024) {\n        throw new IllegalArgumentException(\"requested resources exceed namespace quota\");\n    }\n}","typeGuard":"static boolean withinQuota(Resources resources, double maxCpu, long maxRam) {\n    return resources == null || (resources.getCpu() <= maxCpu && resources.getRam() <= maxRam);\n}","tryCatchPattern":"try {\n    admin.sources().createSource(cfg, pkgUrl, archive);\n} catch (PulsarAdminException e) {\n    if (e.getMessage() != null && e.getMessage().contains(\"cannot be admitted\")) {\n        // adjust resources/runtime settings per the reason after \":-\"\n    } else {\n        throw e;\n    }\n}","preventionTips":["Know your Kubernetes namespace resource quotas and size source resources under them.","Keep worker runtime-factory settings (admission checks, labels, annotations) documented for your cluster.","Start with small resources and scale up after admission succeeds."],"tags":["rest-api","bad-request","admission-checks","kubernetes","pulsar-functions"],"backgroundTag":"admission-check-rejected","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}