{"record":{"id":"d456e21bd7cb1558","repo":"kestra-io/kestra","slug":"namespace-namespace-is-not-allowed","errorCode":null,"errorMessage":"Namespace {namespace} is not allowed.","messagePattern":"Namespace (.+?) is not allowed\\.","errorType":"exception","errorClass":"ResourceAccessDeniedException","httpStatus":403,"severity":"error","filePath":"core/src/main/java/io/kestra/core/services/DefaultNamespaceService.java","lineNumber":40,"sourceCode":"        this.flowMetaStore = flowMetaStore;\n    }\n\n    /**\n     * {@inheritDoc}\n     */\n    @Override\n    public boolean isNamespaceExists(String tenant, String namespace) {\n        Objects.requireNonNull(namespace, \"namespace cannot be null\");\n        return flowMetaStore.get().isNamespaceExists(tenant, namespace);\n    }\n\n    /**\n     * {@inheritDoc}\n     */\n    @Override\n    public void checkAllowedNamespace(String tenant, String namespace, String fromTenant, String fromNamespace) {\n        if (!isAllowedNamespace(tenant, namespace, fromTenant, fromNamespace)) {\n            throw new ResourceAccessDeniedException(\"Namespace \" + namespace + \" is not allowed.\");\n        }\n    }\n\n    /**\n     * {@inheritDoc}\n     */\n    @Override\n    public void checkAllowedAllNamespaces(String tenant, String fromTenant, String fromNamespace) {\n        if (!areAllowedAllNamespaces(tenant, fromTenant, fromNamespace)) {\n            throw new ResourceAccessDeniedException(\"All namespaces are not allowed, you should either filter on a namespace or configure all namespaces to allow your namespace.\");\n        }\n    }\n}\n","sourceCodeStart":22,"sourceCodeEnd":54,"githubUrl":"https://github.com/kestra-io/kestra/blob/823fada9274c4f9c251ea0a516460a4f7d958032/core/src/main/java/io/kestra/core/services/DefaultNamespaceService.java#L22-L54","documentation":"The `DefaultNamespaceService.checkAllowedNamespace()` method verifies that the caller's namespace (`fromNamespace` in tenant `fromTenant`) is permitted to access the target `namespace` (in `tenant`). If the access control check fails, a `ResourceAccessDeniedException` is thrown. This is Kestra's namespace-level ACL enforcement, used to prevent cross-namespace access without explicit permission.","triggerScenarios":"A flow in namespace `team.a` tries to reference a flow or resource in namespace `team.b` without `team.b` granting access to `team.a`. An API call attempts to access resources in a namespace the caller's namespace is not authorized for. In EE, cross-tenant namespace access is attempted without configuration.","commonSituations":"Multi-team setups where namespaces represent team boundaries. A flow uses a Subflow task or `subflow()` referencing another team's namespace. Namespace ACL configuration (`namespace-level` settings) has not been set up for the target namespace.","solutions":["Configure the target namespace to allow access from the caller's namespace (via namespace ACL settings in the UI or API).","Move the caller flow to a namespace that already has access.","If the access is intentional, ask the namespace owner to add the caller namespace to the allowed list.","Verify tenant IDs match if operating in a multi-tenant environment."],"exampleFix":"# Configure namespace ACL to allow team.a to access team.b\n# In the Kestra UI: Namespaces -> team.b -> Edit -> Allowed namespaces -> Add team.a\n# Or via API:\ncurl -X PUT 'http://localhost:8080/api/v1/namespaces/team.b' \\\n  -H 'Content-Type: application/json' \\\n  -d '{\"id\":\"team.b\",\"config\":{\"allowedNamespaces\":[{\"namespace\":\"team.a\"}]}}'","handlingStrategy":"try-catch","validationCode":"// Check namespace access before performing the operation\nboolean allowed = namespaceService.isAllowedNamespace(tenantId, namespace, fromTenantId, fromNamespace);\nif (!allowed) {\n    throw new ResourceAccessDeniedException(\"Namespace \" + namespace + \" is not allowed for \" + fromNamespace);\n}","typeGuard":null,"tryCatchPattern":"try {\n    namespaceService.checkAllowedNamespace(tenantId, namespace, fromTenantId, fromNamespace);\n    // proceed with cross-namespace operation\n} catch (ResourceAccessDeniedException e) {\n    log.warn(\"Access denied to namespace '{}': configure namespace ACL to allow '{}'\", namespace, fromNamespace);\n    throw e;\n}","preventionTips":["Configure namespace ACLs proactively when designing cross-namespace flows.","Use `isAllowedNamespace()` for a non-throwing check before critical operations.","Document which namespaces need access to which, and keep the ACL configuration in version control.","In multi-tenant setups, verify tenant IDs as well as namespace names."],"tags":["namespace","acl","security","access-denied"],"backgroundTag":null,"analyzedSha":"823fada9274c4f9c251ea0a516460a4f7d958032","analyzedAt":"2026-08-14T06:15:17.947Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}