vitessio/vitess · error

not allowed: deny-all security-policy enforced

Error message

not allowed: deny-all security-policy enforced

What it means

Vitess vtadmin detects that the same table on the same shard was queried more than once while collecting table size information for a keyspace schema. This indicates duplicated tablets for a shard in the internal iteration, which should be impossible under normal operation. It is recorded per-keyspace via the error recorder and aborts that table's size aggregation.

Source

Thrown at go/acl/deny_all_policy.go:24

You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package acl

import (
	"errors"
	"net/http"
)

var errDenyAll = errors.New("not allowed: deny-all security-policy enforced")

// denyAllPolicy rejects all access.
type denyAllPolicy struct{}

// CheckAccessHTTP disallows all HTTP access.
func (denyAllPolicy) CheckAccessHTTP(req *http.Request, role string) error {
	return errDenyAll
}

func init() {
	RegisterPolicy("deny-all", denyAllPolicy{})
}

View on GitHub (pinned to 01a25a7d17)

Solutions

1. Check the topology for duplicate tablet records for the affected shard and remove/repair stale entries
2. Restart vtadmin so tablet discovery refreshes and deduplicates the tablet list
3. File an issue with the vtadmin logs (search for 'Impossible: duplicate shard queries') since this signals an internal invariant violation

seen := map[string]bool{}
for _, t := range tablets {
	key := t.Tablet.Keyspace + "/" + t.Tablet.Shard
	if seen[key] { continue }
	seen[key] = true
}
// deduplicate tablet list before calling GetSchema

When it happens

Trigger: Calling Cluster.GetSchema (table size collection) when the tablet list contains two entries for the same table and the same keyspace/shard, e.g. duplicate tablets in discovery results or a shard being visited twice.

Common situations: Stale or duplicated entries in the topology discovery cache; a discovery implementation returning the same tablet twice; race between topo watches producing duplicate tablet records.

Related errors

• ErrNoTablet
• opts %+v, err: %w
• not allowed: read-only security-policy enforced
• invalid choice for enum
• value must be either a float64 (interpreted as seconds) or a

AI-assisted analysis of vitessio/vitess@01a25a7d17 (2026-09-01). Data as JSON: /api/errors/3fc720ab30005749. Report an issue: GitHub.