apolloconfig/apollo · error · AccessDeniedException

Super admin permission is required

Error message

Super admin permission is required

What it means

Thrown by ClusterController.requireDeleteClusterPermission in the USER branch when an interactive Portal UI user attempts to delete a cluster but is not a super admin. Apollo intentionally aligns this path with the legacy WebAPI behavior that required super-admin for cluster deletion. Maps to HTTP 403 AccessDeniedException.

Source

Thrown at apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/ClusterController.java:112

  @Override
  public ResponseEntity<Void> deleteCluster(String env, String appId, String clusterName,
      String operator) {
    requireDeleteClusterPermission(appId);
    String resolvedOperator = resolveOperator(operator);

    clusterOpenApiService.deleteCluster(env, appId, clusterName, resolvedOperator);
    return ResponseEntity.ok().build();
  }

  private void requireDeleteClusterPermission(String appId) {
    String authType = UserIdentityContextHolder.getAuthType();
    if (UserIdentityConstants.USER.equals(authType)) {
      // Keep Portal UI behavior aligned with the legacy WebAPI delete path, which required
      // super-admin permission for cluster deletion.
      if (unifiedPermissionValidator.isSuperAdmin()) {
        return;
      }
      throw new AccessDeniedException("Super admin permission is required");
    }
    if (UserIdentityConstants.CONSUMER.equals(authType)) {
      // Existing OpenAPI consumers use app-scoped authorization here. Preserve that public
      // token boundary while keeping the Portal USER path compatible with the legacy WebAPI.
      if (unifiedPermissionValidator.isAppAdmin(appId)) {
        return;
      }
      throw new AccessDeniedException("App admin permission is required");
    }
    if (UserIdentityConstants.USER_TOKEN.equals(authType)) {
      if (unifiedPermissionValidator.isSuperAdmin()) {
        return;
      }
      throw new AccessDeniedException("Super admin permission is required");
    }
    throw new AccessDeniedException("Access is denied");
  }

View on GitHub (pinned to d95fc18d11)

Solutions

1. Request super-admin role for the user from the Apollo system administrator, or have a super admin perform the deletion.
2. If cluster deletion is genuinely needed by non-super-admins, consider whether the resource can be disabled instead of deleted.
3. Verify the user is logged in under the correct account — sometimes a test or service account session is active instead of the admin account.

// Before calling delete cluster via Portal session, check super-admin status
// This requires a separate API or Portal permission check
if (!currentUserIsSuperAdmin()) {
    // surface a clear message to the user or skip the operation
    throw new IllegalStateException("Cluster deletion requires super-admin role. Contact your Apollo administrator.");
}

// Catch AccessDeniedException from the delete call
try {
    client.delete("/openapi/v1/envs/" + env + "/apps/" + appId + "/clusters/" + clusterName);
} catch (AccessDeniedException e) {
    // Inform the user they need super-admin privileges
    showUserError("Cluster deletion requires super-admin permission. Please contact your system administrator.");
}

When it happens

Trigger: DELETE /openapi/v1/envs/{env}/apps/{appId}/clusters/{clusterName} called through the Portal session (authType=USER) by a user who does not pass unifiedPermissionValidator.isSuperAdmin().

Common situations: A regular app admin or namespace editor attempts to delete a cluster via the Portal UI or an API call using their browser session. Cluster deletion is intentionally restricted to super admins because it cascades across all environments and namespaces.

Related errors

• App admin permission is required
• Create cluster permission is required
• Access is denied
• Metadata read permission is required
• Access is denied

AI-assisted analysis of apolloconfig/apollo@d95fc18d11 (2026-08-14). Data as JSON: /api/errors/dbcc5658d72897a9. Report an issue: GitHub.