apache/hadoop · error · IOException

Can't add delegation key to a running SecretManager.

Error message

Can't add delegation key to a running SecretManager.

What it means

Error "Can't add delegation key to a running SecretManager." thrown in apache/hadoop.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/AbstractDelegationTokenSecretManager.java:226

  /**
   * Interval for tokens to be renewed.
   * @return Renew interval in milliseconds.
   */
  protected long getTokenRenewInterval() {
    return this.tokenRenewInterval;
  }

  /** 
   * Add a previously used master key to cache (when NN restarts), 
   * should be called before activate().
   *
   * @param key delegation key.
   * @throws IOException raised on errors performing I/O.
   */
  public void addKey(DelegationKey key) throws IOException {
    if (running) // a safety check
      throw new IOException("Can't add delegation key to a running SecretManager.");
    this.apiLock.writeLock().lock();
    try {
      if (key.getKeyId() > getCurrentKeyId()) {
        setCurrentKeyId(key.getKeyId());
      }
      allKeys.put(key.getKeyId(), key);
    } finally {
      this.apiLock.writeLock().unlock();
    }
  }

  public DelegationKey[] getAllKeys() {
    this.apiLock.readLock().lock();
    try {
      return allKeys.values().toArray(new DelegationKey[0]);
    } finally {
      this.apiLock.readLock().unlock();
    }

View on GitHub (pinned to 2add963021)

Solutions

1. Load all persisted delegation keys before calling startThreads()/starting the SecretManager. Keys cannot be added once the manager is running; restart the service to load new keys at startup.

When it happens

Trigger: Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/AbstractDelegationTokenSecretManager.java:226 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/6f4ee659b88e2b15. Report an issue: GitHub.