apache/hadoop · error · IOException

"Can't create an encryption zone for " + src + " since no ke

Error message

"Can't create an encryption zone for " + src + " since no key provider is available."

What it means

Creating an encryption zone requires a KeyProvider on the NameNode: FSDirEncryptionZoneOp.ensureKeyIsInitialized reads fsd.getProvider() and throws IOException when it is null. The provider is built from the key provider URI configuration (hadoop.security.key.provider.path, or dfs.encryption.key.provider.uri), so a null provider means the NameNode was never given (or could not build) a KMS address. Without a provider the NameNode cannot validate keys or generate EDEKs, so all zone creation stops here.

Source

Thrown at hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSDirEncryptionZoneOp.java:118

          public EncryptedKeyVersion run() throws IOException {
            try {
              return fsd.getProvider().generateEncryptedKey(ezKeyName);
            } catch (GeneralSecurityException e) {
              throw new IOException(e);
            }
          }
        });
    long generateEDEKTime = monotonicNow() - generateEDEKStartTime;
    NameNode.getNameNodeMetrics().addGenerateEDEKTime(generateEDEKTime);
    Preconditions.checkNotNull(edek);
    return edek;
  }

  static KeyProvider.Metadata ensureKeyIsInitialized(final FSDirectory fsd,
      final String keyName, final String src) throws IOException {
    KeyProviderCryptoExtension provider = fsd.getProvider();
    if (provider == null) {
      throw new IOException("Can't create an encryption zone for " + src
          + " since no key provider is available.");
    }
    if (keyName == null || keyName.isEmpty()) {
      throw new IOException("Must specify a key name when creating an "
          + "encryption zone");
    }
    EncryptionFaultInjector.getInstance().ensureKeyIsInitialized();
    KeyProvider.Metadata metadata = provider.getMetadata(keyName);
    if (metadata == null) {
      /*
       * It would be nice if we threw something more specific than
       * IOException when the key is not found, but the KeyProvider API
       * doesn't provide for that. If that API is ever changed to throw
       * something more specific (e.g. UnknownKeyException) then we can
       * update this to match it, or better yet, just rethrow the
       * KeyProvider's exception.
       */
      throw new IOException("Key " + keyName + " doesn't exist.");

View on GitHub (pinned to 2add963021)

Solutions

1. Set hadoop.security.key.provider.path (core-site.xml) on the NameNode to the KMS URI, e.g. kms://https@kms-host:9600/kms, and restart the NameNode.
2. Verify the KMS is actually serving (curl the KMS endpoint / check kms.log) — a dead KMS makes provider construction fail the same way.
3. Confirm the property is in the NameNode's effective config, not just the client's (hdfs getconf -confKey hadoop.security.key.provider.path against the NN).
4. For HA KMS use kms://https@HOST1;HOST2:9600/kms and check hadoop.kms.authentication settings.

Example fix

# before (no provider configured)
hdfs crypto -createZone -key mykey -path /secure  # -> IOException: no key provider available

# after (NameNode core-site.xml, then restart NameNode)
<property>
  <name>hadoop.security.key.provider.path</name>
  <value>kms://https@kms1.example.com:9600/kms</value>
</property>

String providerUri = conf.get("hadoop.security.key.provider.path",
    conf.get("dfs.encryption.key.provider.uri"));
if (providerUri == null) {
  throw new IllegalStateException(
      "No KMS key provider configured for the NameNode; cannot create encryption zones");
}

try {
  admin.createEncryptionZone(path, keyName);
} catch (IOException e) {
  if (e.getMessage() != null && e.getMessage().contains("no key provider")) {
    throw new IllegalStateException(
        "Configure hadoop.security.key.provider.path on the NameNode (KMS URI) and restart it", e);
  }
  throw e;
}

When it happens

Trigger: Running 'hdfs crypto -createZone -key <k> -path <p>' or HdfsAdmin.createEncryptionZone before configuring the KMS provider URI in the NameNode's core-site.xml; pointing the URI at a KMS that failed to start (provider construction fails, FSDirectory ends up with null); adding the property to the client's config only.

Common situations: First-time HDFS TDE setup where KMS is installed but the URI property was added to hdfs-site.xml of the client or omitted entirely; config management (Ansible/Chef) rolling out the property to data nodes but not the NameNode; KMS HA URI typo so provider initialization fails silently at NN boot.

Related errors

• No KeyProvider is configured, cannot access an encrypted fil
• "Key " + keyName + " doesn't exist."
• {} is not an encryption zone.
• Too many retries because of encryption zone operations
• No configuration found for the cipher suite {} prefixed with

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/fd105930dcc31c07. Report an issue: GitHub.