{"record":{"id":"b3242657dd1093fe","repo":"kestra-io/kestra","slug":"all-namespaces-are-not-allowed-you-should-either","errorCode":null,"errorMessage":"All namespaces are not allowed, you should either filter on a namespace or configure all namespaces to allow your namespace.","messagePattern":"All namespaces are not allowed, you should either filter on a namespace or configure all namespaces to allow your namespace\\.","errorType":"exception","errorClass":"ResourceAccessDeniedException","httpStatus":403,"severity":"error","filePath":"core/src/main/java/io/kestra/core/services/DefaultNamespaceService.java","lineNumber":50,"sourceCode":"    }\n\n    /**\n     * {@inheritDoc}\n     */\n    @Override\n    public void checkAllowedNamespace(String tenant, String namespace, String fromTenant, String fromNamespace) {\n        if (!isAllowedNamespace(tenant, namespace, fromTenant, fromNamespace)) {\n            throw new ResourceAccessDeniedException(\"Namespace \" + namespace + \" is not allowed.\");\n        }\n    }\n\n    /**\n     * {@inheritDoc}\n     */\n    @Override\n    public void checkAllowedAllNamespaces(String tenant, String fromTenant, String fromNamespace) {\n        if (!areAllowedAllNamespaces(tenant, fromTenant, fromNamespace)) {\n            throw new ResourceAccessDeniedException(\"All namespaces are not allowed, you should either filter on a namespace or configure all namespaces to allow your namespace.\");\n        }\n    }\n}\n","sourceCodeStart":32,"sourceCodeEnd":54,"githubUrl":"https://github.com/kestra-io/kestra/blob/823fada9274c4f9c251ea0a516460a4f7d958032/core/src/main/java/io/kestra/core/services/DefaultNamespaceService.java#L32-L54","documentation":"The `DefaultNamespaceService.checkAllowedAllNamespaces()` method verifies that the caller's namespace is permitted to access ALL namespaces (i.e., perform an unfiltered/wildcard query). If the caller does not have blanket namespace access, a `ResourceAccessDeniedException` is thrown. This prevents a namespace from enumerating or accessing resources across all namespaces without explicit wildcard permission.","triggerScenarios":"An API call (e.g., listing executions, searching flows) with no namespace filter from a namespace that is not configured for all-namespace access. A query with `namespace=null` or `namespace=*` from an unauthorized caller.","commonSituations":"A dashboard or monitoring tool queries executions across all namespaces. A flow in `team.a` tries to list all executions without specifying a namespace filter. The all-namespaces permission (`allowedNamespaces` with wildcard or the `allNamespaces` config) is not set.","solutions":["Filter the query on a specific namespace instead of querying all namespaces.","Configure the caller's namespace to allow all-namespace access (via namespace ACL with a wildcard or the admin-level `allNamespaces` setting).","Use an admin/service account that has been granted all-namespace access."],"exampleFix":"# before: query all namespaces without permission\nGET /api/v1/executions/search  (no namespace filter)\n# after: filter on a specific namespace\nGET /api/v1/executions/search?namespace=team.a\n# or configure wildcard access in namespace settings\n# In namespace ACL for the caller: set allowedNamespaces to include \"*\"","handlingStrategy":"validation","validationCode":"// Check all-namespace access before performing an unfiltered query\nboolean allAllowed = namespaceService.areAllowedAllNamespaces(tenantId, fromTenantId, fromNamespace);\nif (!allAllowed) {\n    // fall back to filtering on the caller's own namespace\n    filters.add(QueryFilter.of(QueryFilter.Field.NAMESPACE, QueryFilter.Op.EQUALS, fromNamespace));\n}","typeGuard":null,"tryCatchPattern":"try {\n    namespaceService.checkAllowedAllNamespaces(tenantId, fromTenantId, fromNamespace);\n    // perform unfiltered query\n} catch (ResourceAccessDeniedException e) {\n    log.info(\"All-namespace access denied for '{}', falling back to own namespace\", fromNamespace);\n    // retry with namespace filter\n}","preventionTips":["Default to namespace-filtered queries in multi-tenant environments.","Only request all-namespace access for admin/monitoring use cases.","Configure the all-namespaces ACL explicitly for namespaces that need it.","Log the access-denied event so administrators can identify misconfigured ACLs."],"tags":["namespace","acl","security","access-denied","wildcard"],"backgroundTag":null,"analyzedSha":"823fada9274c4f9c251ea0a516460a4f7d958032","analyzedAt":"2026-08-14T06:15:17.947Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}