kestra-io/kestra · error · ResourceAccessDeniedException

Namespace {namespace} is not allowed.

Error message

Namespace {namespace} is not allowed.

What it means

The `DefaultNamespaceService.checkAllowedNamespace()` method verifies that the caller's namespace (`fromNamespace` in tenant `fromTenant`) is permitted to access the target `namespace` (in `tenant`). If the access control check fails, a `ResourceAccessDeniedException` is thrown. This is Kestra's namespace-level ACL enforcement, used to prevent cross-namespace access without explicit permission.

Source

Thrown at core/src/main/java/io/kestra/core/services/DefaultNamespaceService.java:40

        this.flowMetaStore = flowMetaStore;
    }

    /**
     * {@inheritDoc}
     */
    @Override
    public boolean isNamespaceExists(String tenant, String namespace) {
        Objects.requireNonNull(namespace, "namespace cannot be null");
        return flowMetaStore.get().isNamespaceExists(tenant, namespace);
    }

    /**
     * {@inheritDoc}
     */
    @Override
    public void checkAllowedNamespace(String tenant, String namespace, String fromTenant, String fromNamespace) {
        if (!isAllowedNamespace(tenant, namespace, fromTenant, fromNamespace)) {
            throw new ResourceAccessDeniedException("Namespace " + namespace + " is not allowed.");
        }
    }

    /**
     * {@inheritDoc}
     */
    @Override
    public void checkAllowedAllNamespaces(String tenant, String fromTenant, String fromNamespace) {
        if (!areAllowedAllNamespaces(tenant, fromTenant, fromNamespace)) {
            throw new ResourceAccessDeniedException("All namespaces are not allowed, you should either filter on a namespace or configure all namespaces to allow your namespace.");
        }
    }
}

View on GitHub (pinned to 823fada927)

Solutions

1. Configure the target namespace to allow access from the caller's namespace (via namespace ACL settings in the UI or API).
2. Move the caller flow to a namespace that already has access.
3. If the access is intentional, ask the namespace owner to add the caller namespace to the allowed list.
4. Verify tenant IDs match if operating in a multi-tenant environment.

Example fix

# Configure namespace ACL to allow team.a to access team.b
# In the Kestra UI: Namespaces -> team.b -> Edit -> Allowed namespaces -> Add team.a
# Or via API:
curl -X PUT 'http://localhost:8080/api/v1/namespaces/team.b' \
  -H 'Content-Type: application/json' \
  -d '{"id":"team.b","config":{"allowedNamespaces":[{"namespace":"team.a"}]}}'

// Check namespace access before performing the operation
boolean allowed = namespaceService.isAllowedNamespace(tenantId, namespace, fromTenantId, fromNamespace);
if (!allowed) {
    throw new ResourceAccessDeniedException("Namespace " + namespace + " is not allowed for " + fromNamespace);
}

try {
    namespaceService.checkAllowedNamespace(tenantId, namespace, fromTenantId, fromNamespace);
    // proceed with cross-namespace operation
} catch (ResourceAccessDeniedException e) {
    log.warn("Access denied to namespace '{}': configure namespace ACL to allow '{}'", namespace, fromNamespace);
    throw e;
}

When it happens

Trigger: A flow in namespace `team.a` tries to reference a flow or resource in namespace `team.b` without `team.b` granting access to `team.a`. An API call attempts to access resources in a namespace the caller's namespace is not authorized for. In EE, cross-tenant namespace access is attempted without configuration.

Common situations: Multi-team setups where namespaces represent team boundaries. A flow uses a Subflow task or `subflow()` referencing another team's namespace. Namespace ACL configuration (`namespace-level` settings) has not been set up for the target namespace.

Related errors

• All namespaces are not allowed, you should either filter on
• Path must not contain '../'
• The URI {} is not in the configured allowed list (kestra.tas
• The URI {} is in the configured denied list (kestra.tasks.ht
• Both `namespace` and `flowId` must be set when `executionId`

AI-assisted analysis of kestra-io/kestra@823fada927 (2026-08-14). Data as JSON: /api/errors/d456e21bd7cb1558. Report an issue: GitHub.