kestra-io/kestra · error · ResourceAccessDeniedException

All namespaces are not allowed, you should either filter on

Error message

All namespaces are not allowed, you should either filter on a namespace or configure all namespaces to allow your namespace.

What it means

The `DefaultNamespaceService.checkAllowedAllNamespaces()` method verifies that the caller's namespace is permitted to access ALL namespaces (i.e., perform an unfiltered/wildcard query). If the caller does not have blanket namespace access, a `ResourceAccessDeniedException` is thrown. This prevents a namespace from enumerating or accessing resources across all namespaces without explicit wildcard permission.

Source

Thrown at core/src/main/java/io/kestra/core/services/DefaultNamespaceService.java:50

    }

    /**
     * {@inheritDoc}
     */
    @Override
    public void checkAllowedNamespace(String tenant, String namespace, String fromTenant, String fromNamespace) {
        if (!isAllowedNamespace(tenant, namespace, fromTenant, fromNamespace)) {
            throw new ResourceAccessDeniedException("Namespace " + namespace + " is not allowed.");
        }
    }

    /**
     * {@inheritDoc}
     */
    @Override
    public void checkAllowedAllNamespaces(String tenant, String fromTenant, String fromNamespace) {
        if (!areAllowedAllNamespaces(tenant, fromTenant, fromNamespace)) {
            throw new ResourceAccessDeniedException("All namespaces are not allowed, you should either filter on a namespace or configure all namespaces to allow your namespace.");
        }
    }
}

View on GitHub (pinned to 823fada927)

Solutions

1. Filter the query on a specific namespace instead of querying all namespaces.
2. Configure the caller's namespace to allow all-namespace access (via namespace ACL with a wildcard or the admin-level `allNamespaces` setting).
3. Use an admin/service account that has been granted all-namespace access.

Example fix

# before: query all namespaces without permission
GET /api/v1/executions/search  (no namespace filter)
# after: filter on a specific namespace
GET /api/v1/executions/search?namespace=team.a
# or configure wildcard access in namespace settings
# In namespace ACL for the caller: set allowedNamespaces to include "*"

// Check all-namespace access before performing an unfiltered query
boolean allAllowed = namespaceService.areAllowedAllNamespaces(tenantId, fromTenantId, fromNamespace);
if (!allAllowed) {
    // fall back to filtering on the caller's own namespace
    filters.add(QueryFilter.of(QueryFilter.Field.NAMESPACE, QueryFilter.Op.EQUALS, fromNamespace));
}

try {
    namespaceService.checkAllowedAllNamespaces(tenantId, fromTenantId, fromNamespace);
    // perform unfiltered query
} catch (ResourceAccessDeniedException e) {
    log.info("All-namespace access denied for '{}', falling back to own namespace", fromNamespace);
    // retry with namespace filter
}

When it happens

Trigger: An API call (e.g., listing executions, searching flows) with no namespace filter from a namespace that is not configured for all-namespace access. A query with `namespace=null` or `namespace=*` from an unauthorized caller.

Common situations: A dashboard or monitoring tool queries executions across all namespaces. A flow in `team.a` tries to list all executions without specifying a namespace filter. The all-namespaces permission (`allowedNamespaces` with wildcard or the `allNamespaces` config) is not set.

Related errors

• Namespace {namespace} is not allowed.
• Path must not contain '../'
• The URI {} is not in the configured allowed list (kestra.tas
• The URI {} is in the configured denied list (kestra.tasks.ht
• Both `namespace` and `flowId` must be set when `executionId`

AI-assisted analysis of kestra-io/kestra@823fada927 (2026-08-14). Data as JSON: /api/errors/b3242657dd1093fe. Report an issue: GitHub.