apache/hadoop · error · IOException

Can't get metadata for ${name} from keystore ${path}

Error message

Can't get metadata for ${name} from keystore ${path}

What it means

In getMetadata(), the keystore threw KeyStoreException during containsAlias()/getKey() — the keystore object was never initialized or is in a failed internal state. Wrapped as IOException naming the key and keystore path.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java:419

  public Metadata getMetadata(String name) throws IOException {
    readLock.lock();
    try {
      if (cache.containsKey(name)) {
        return cache.get(name);
      }
      try {
        if (!keyStore.containsAlias(name)) {
          return null;
        }
        Metadata meta = ((KeyMetadata) keyStore.getKey(name, password)).metadata;
        cache.put(name, meta);
        return meta;
      } catch (ClassCastException e) {
        throw new IOException("Can't cast key for " + name + " in keystore " +
            path + " to a KeyMetadata. Key may have been added using " +
            " keytool or some other non-Hadoop method.", e);
      } catch (KeyStoreException e) {
        throw new IOException("Can't get metadata for " + name +
            " from keystore " + path, e);
      } catch (NoSuchAlgorithmException e) {
        throw new IOException("Can't get algorithm for " + name +
            " from keystore " + path, e);
      } catch (UnrecoverableKeyException e) {
        throw new IOException("Can't recover key for " + name +
            " from keystore " + path, e);
      }
    } finally {
      readLock.unlock();
    }
  }

  @Override
  public KeyVersion createKey(String name, byte[] material,
                               Options options) throws IOException {
    Preconditions.checkArgument(name.equals(StringUtils.toLowerCase(name)),
        "Uppercase key names are unsupported: %s", name);

View on GitHub (pinned to 2add963021)

Solutions

1. Restart KMS so the provider performs a full load; a clean load either succeeds or surfaces the real root error (password/format)
2. Check the keystore file exists and passes keytool -list
3. Fix or remove stale _NEW/_OLD artifacts per the load-inconsistency guidance

// Health-check provider before metadata-dependent ops
try {
  provider.getKeys();
} catch (IOException e) {
  throw new IllegalStateException("Keystore provider unhealthy: " + e, e);
}

try {
  meta = provider.getMetadata(name);
} catch (IOException e) {
  if (e.getCause() instanceof KeyStoreException) {
    // reload provider (new instance) once; if it persists, restart KMS
  }
}

When it happens

Trigger: Any metadata-touching operation (getMetadata, createKey pre-checks, rollover, delete) against an uninitialized or broken KeyStore instance — typically after a load failure left the provider half-initialized, or in tests with mock keystores.

Common situations: KMS startup after a partially failed keystore load; unit tests mocking KeyStore without init/load; keystore file removed under a running process

Related errors

• Can't get key ${versionName} from ${path}
• Can't get key ${alias} from ${path}
• Can't cast key for ${name} in keystore ${path} to a KeyMetad
• Can't recover key for ${name} from keystore ${path}
• Problem looking up key ${name} in ${this}

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/64b571f10aa05021. Report an issue: GitHub.