apache/hadoop · error · IOException

Can't find Metadata for key ${name}

Error message

Can't find Metadata for key ${name}

What it means

The convenience method KeyProvider.rollNewVersion(String) generates fresh material from the key's stored Metadata and then delegates to rollNewVersion(name, material). If getMetadata(name) returns null - no such key in this provider - it throws 'Can't find Metadata for key <name>' before any material is generated.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/KeyProvider.java:611

  /**
   * Roll a new version of the given key generating the material for it.
   * <p>
   * This implementation generates the key material and calls the
   * {@link #rollNewVersion(String, byte[])} method.
   *
   * @param name the basename of the key
   * @return the name of the new version of the key
   * @throws IOException              raised on errors performing I/O.
   * @throws NoSuchAlgorithmException This exception is thrown when a particular
   *                                  cryptographic algorithm is requested
   *                                  but is not available in the environment.
   */
  public KeyVersion rollNewVersion(String name) throws NoSuchAlgorithmException,
                                                       IOException {
    Metadata meta = getMetadata(name);
    if (meta == null) {
      throw new IOException("Can't find Metadata for key " + name);
    }

    byte[] material = generateKey(meta.getBitLength(), meta.getCipher());
    return rollNewVersion(name, material);
  }

  /**
   * Can be used by implementing classes to invalidate the caches. This could be
   * used after rollNewVersion to provide a strong guarantee to return the new
   * version of the given key.
   *
   * @param name the basename of the key
   * @throws IOException raised on errors performing I/O.
   */
  public void invalidateCache(String name) throws IOException {
    // NOP
  }

View on GitHub (pinned to 2add963021)

Solutions

1. Create the key first with createKey (or `hadoop key create`)
2. Guard the call with getMetadata(name) != null
3. Verify the key exists in this specific provider with `hadoop key list -provider <uri>`

Example fix

// before
provider.rollNewVersion(name);

// after
if (provider.getMetadata(name) == null) {
  provider.createKey(name, new Options(conf).setCipher("AES").setBitLength(128));
}
provider.rollNewVersion(name);

if (provider.getMetadata(name) == null) {
  provider.createKey(name, new KeyProvider.Options(conf).setCipher("AES").setBitLength(128));
}
provider.rollNewVersion(name);

try { provider.rollNewVersion(name); } catch (IOException e) { if (String.valueOf(e.getMessage()).startsWith("Can't find Metadata")) { provider.createKey(name, new KeyProvider.Options(conf).setCipher("AES").setBitLength(128)); } else { throw e; } }

When it happens

Trigger: Calling rollNewVersion(name) before createKey; a typo'd or already-deleted key name; provider chain that does not include the provider actually holding the key.

Common situations: Automation on a fresh cluster assuming keys exist; wrong provider URI; key deleted concurrently by another admin.

Related errors

• Key ${name} does not exist in ${this}
• Key ${name} not found
• Wrong key length. Required ${options.getBitLength()}, but go
• Wrong key length. Required ${meta.getBitLength()}, but got $
• Can't find KeyProvider for key ${keyName}

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/a12f18e0a7b879ad. Report an issue: GitHub.