apache/hadoop · error · IOException

Can't get key ${versionName} from ${path}

Error message

Can't get key ${versionName} from ${path}

What it means

getKeyVersion() looks up a key version by alias in the JCEKS keystore. The keystore threw KeyStoreException during containsAlias()/getKey() — typically meaning the keystore object was never initialized or is in a bad internal state. Wrapped as IOException with the version name and keystore path.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java:338

  @Override
  public String noPasswordError() {
    return ProviderUtils.noPasswordError(KEYSTORE_PASSWORD_ENV_VAR,
        KEYSTORE_PASSWORD_FILE_KEY);
  }

  @Override
  public KeyVersion getKeyVersion(String versionName) throws IOException {
    readLock.lock();
    try {
      SecretKeySpec key = null;
      try {
        if (!keyStore.containsAlias(versionName)) {
          return null;
        }
        key = (SecretKeySpec) keyStore.getKey(versionName, password);
      } catch (KeyStoreException e) {
        throw new IOException("Can't get key " + versionName + " from " +
                              path, e);
      } catch (NoSuchAlgorithmException e) {
        throw new IOException("Can't get algorithm for key " + key + " from " +
                              path, e);
      } catch (UnrecoverableKeyException e) {
        throw new IOException("Can't recover key " + key + " from " + path, e);
      }
      return new KeyVersion(getBaseName(versionName), versionName, key.getEncoded());
    } finally {
      readLock.unlock();
    }
  }

  @Override
  public List<String> getKeys() throws IOException {
    readLock.lock();
    try {
      ArrayList<String> list = new ArrayList<String>();

View on GitHub (pinned to 2add963021)

Solutions

1. Restart KMS so the provider reloads the keystore cleanly
2. Check keystore health with keytool -list; repair from _OLD backup if damaged
3. In tests, fully initialize the keystore (load a real jceks file) instead of mocking the KeyStore object

// Check alias presence before fetching a version
if (!kp.getKeys().contains(baseName(versionName))) {
  return null; // key absent, avoid lookup failure
}

try {
  KeyVersion kv = provider.getKeyVersion(versionName);
} catch (IOException e) {
  Throwable c = e.getCause();
  if (c instanceof KeyStoreException) {
    // keystore state broken: restart/reload provider rather than retry
  }
}

When it happens

Trigger: Calling KeyProvider.getKeyVersion(versionName) when the underlying KeyStore is uninitialized or internally inconsistent — rare after a successful load, more common in tests using mock/uninitialized providers, or when the keystore file was swapped underneath a live provider instance.

Common situations: Unit tests with partially mocked keystores; the keystore file replaced on disk while KMS held an old handle; provider state corruption after a failed flush

Related errors

• Can't get key ${alias} from ${path}
• Can't get metadata for ${name} from keystore ${path}
• Problem looking up key ${name} in ${this}
• Keystore not loaded due to some inconsistency ('%s' and '%s'
• Can't create keystore: ${e}

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/dd27bac96f3542fd. Report an issue: GitHub.