{"record":{"id":"87102038a4dc6ec2","repo":"apache/pulsar","slug":"s-s-cannot-be-admitted-s-871020","errorCode":null,"errorMessage":"%s %s cannot be admitted:- %s","messagePattern":"(.+?) (.+?) cannot be admitted:- (.+?)","errorType":"http","errorClass":"RestException","httpStatus":400,"severity":"error","filePath":"pulsar-functions/worker/src/main/java/org/apache/pulsar/functions/worker/rest/api/SinksImpl.java","lineNumber":189,"sourceCode":"                }\n            } catch (Exception e) {\n                log.error().attr(\"componentType\", ComponentTypeUtils.toString(componentType)).attr(\"tenant\", tenant)\n\n                        .attr(\"namespace\", namespace).attr(\"componentName\", sinkName).exception(e)\n\n                        .log(\"Invalid register request @ / / /\");\n                throw new RestException(Response.Status.BAD_REQUEST, e.getMessage());\n            }\n\n            try {\n                worker().getFunctionRuntimeManager().getRuntimeFactory().doAdmissionChecks(functionDetails);\n            } catch (Exception e) {\n                log.error().attr(\"componentType\", ComponentTypeUtils.toString(componentType)).attr(\"tenant\", tenant)\n\n                        .attr(\"namespace\", namespace).attr(\"componentName\", sinkName)\n\n                        .log(\"/ / cannot be admitted by the runtime factory\");\n                throw new RestException(Response.Status.BAD_REQUEST,\n                        String.format(\"%s %s cannot be admitted:- %s\", ComponentTypeUtils.toString(componentType),\n                                sinkName, e.getMessage()));\n            }\n\n            // function state\n            FunctionMetaData functionMetaDataObj = new FunctionMetaData();\n            functionMetaDataObj.setFunctionDetails().copyFrom(functionDetails);\n            functionMetaDataObj.setCreateTime(System.currentTimeMillis());\n            functionMetaDataObj.setVersion(0);\n\n            // cache auth if need\n            if (worker().getWorkerConfig().isAuthenticationEnabled()) {\n                FunctionDetails finalFunctionDetails = functionDetails;\n                worker().getFunctionRuntimeManager()\n                        .getRuntimeFactory()\n                        .getAuthProvider().ifPresent(functionAuthProvider -> {\n                    if (authParams.getClientAuthenticationDataSource() != null) {\n","sourceCodeStart":171,"sourceCodeEnd":207,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-functions/worker/src/main/java/org/apache/pulsar/functions/worker/rest/api/SinksImpl.java#L171-L207","documentation":"After basic validation, registerSink runs the runtime factory's doAdmissionChecks on the FunctionDetails. If the runtime factory (e.g. Kubernetes/thread/process runtime manager) rejects the function—resource limits, namespace restrictions, instance sizing, K8s-specific constraints—the worker returns HTTP 400 with 'Sink <name> cannot be admitted:- <reason>'.","triggerScenarios":"registerSink succeeding validation but failing doAdmissionChecks: requested CPU/RAM exceeds worker runtime limits, illegal instance count, namespace policy violations, or Kubernetes admission errors when functions-worker uses k8s runtime.","commonSituations":"Setting resources (cpu/ram) beyond worker's max in functionConfig; running with Kubernetes runtime but RBAC/image issues; submitting sinks with too many parallelism instances; worker config functionInstanceMinResources mismatch.","solutions":["Read the '- ' suffix in the error message and worker logs: it names the exact admission failure.","Lower sinkConfig resources (cpu, ram, disk) and parallelism/instance count within worker limits.","If using Kubernetes runtime, verify service account, namespace policies, and that the function image/RBAC allow scheduling.","Adjust worker.conf admission settings (allowed runtime, resource constraints) if the policy itself is too strict."],"exampleFix":"// before: oversized request\nsinkConfig.getResources().setCpu(8.0); sinkConfig.getResources().setRam(16L * 1024 * 1024 * 1024);\n// after: within worker admission limits\nsinkConfig.getResources().setCpu(0.5); sinkConfig.getResources().setRam(512L * 1024 * 1024); sinkConfig.setParallelism(1);","handlingStrategy":"validation","validationCode":"Resources r = cfg.getResources();\nif (r != null && (r.getCpu() > maxCpu || r.getRam() > maxRam)) throw new IllegalStateException(\"Resources exceed worker admission limits\");\nif (cfg.getParallelism() < 1 || cfg.getParallelism() > maxParallelism) throw new IllegalStateException(\"Parallelism out of allowed range\");","typeGuard":null,"tryCatchPattern":"try { admin.sinks().createSink(cfg, archive); } catch (PulsarAdminException e) { if (e.getStatusCode() == 400 && e.getMessage().contains(\"cannot be admitted\")) { /* adjust resources/parallelism per the suffix message and retry */ } }","preventionTips":["Keep CPU/RAM/disk requests within the worker's configured function resource limits","Match your Kubernetes runtime policies (namespace, service account, quotas) before submitting","Read the admission reason after the ':- ' in the message","Keep parallelism within worker-supported instance bounds"],"tags":["rest-api","admission-check","pulsar-functions","kubernetes","resources"],"backgroundTag":"admission-check-rejected","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}