apache/hadoop · error · IOException

Can't get key ${alias} from ${path}

Error message

Can't get key ${alias} from ${path}

What it means

While enumerating all aliases for getKeys(), the keystore threw KeyStoreException — the keystore is uninitialized or in a failed state. The message interpolates the alias variable, which is null when aliases() itself throws before any element is returned.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java:368

  }

  @Override
  public List<String> getKeys() throws IOException {
    readLock.lock();
    try {
      ArrayList<String> list = new ArrayList<String>();
      String alias = null;
      try {
        Enumeration<String> e = keyStore.aliases();
        while (e.hasMoreElements()) {
           alias = e.nextElement();
           // only include the metadata key names in the list of names
           if (!alias.contains("@")) {
               list.add(alias);
           }
        }
      } catch (KeyStoreException e) {
        throw new IOException("Can't get key " + alias + " from " + path, e);
      }
      return list;
    } finally {
      readLock.unlock();
    }
  }

  @Override
  public List<KeyVersion> getKeyVersions(String name) throws IOException {
    readLock.lock();
    try {
      List<KeyVersion> list = new ArrayList<KeyVersion>();
      Metadata km = getMetadata(name);
      if (km != null) {
        int latestVersion = km.getVersions();
        KeyVersion v = null;
        String versionName = null;
        for (int i = 0; i < latestVersion; i++) {

View on GitHub (pinned to 2add963021)

Solutions

1. Restart KMS to force a clean provider load, then retry the list
2. Validate the keystore file exists and loads: keytool -list -keystore <path> -storetype jceks
3. In tests, initialize a real keystore rather than a bare KeyStore mock

// Cheap pre-flight: does the provider load and enumerate at all?
List<String> names = provider.getKeys(); // fail here in a controlled place

try {
  List<String> keys = provider.getKeys();
} catch (IOException e) {
  if (e.getCause() instanceof KeyStoreException) {
    // structural keystore failure: reload provider / restart KMS
  }
}

When it happens

Trigger: Calling KeyProvider.getKeys() when keyStore.aliases() fails — an uninitialized KeyStore instance or one left in a bad state (e.g. after a failed load that was swallowed). Distinct from a missing-key case; it is a structural keystore failure.

Common situations: List-keys (KMS GET /keys) after partial provider initialization; test providers with mock keystores; keystore file deleted/replaced while KMS holds a stale handle

Related errors

• Can't get key ${versionName} from ${path}
• Can't get metadata for ${name} from keystore ${path}
• Problem looking up key ${name} in ${this}
• Keystore not loaded due to some inconsistency ('%s' and '%s'
• Can't create keystore: ${e}

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/cdf62df110d4891a. Report an issue: GitHub.