apache/hadoop · error · IOException

Can't set metadata key ${entry.getKey()}

Error message

Can't set metadata key ${entry.getKey()}

What it means

During flush(), every entry in the metadata cache is written back into the keystore as a KeyMetadata password entry via setKeyEntry; if any of those writes throws KeyStoreException, flush aborts with 'Can't set metadata key <name>'. At this stage nothing has been committed to disk yet (the file write happens later), so the on-disk store is unchanged but in-memory updates go unsaved.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java:556

      }
      // Might exist if a backup has been restored etc.
      try {
        renameOrFail(newPath, new Path(newPath.toString()
            + "_ORPHANED_" + System.currentTimeMillis()));
      } catch (FileNotFoundException ignored) {
      }
      try {
        renameOrFail(oldPath, new Path(oldPath.toString()
            + "_ORPHANED_" + System.currentTimeMillis()));
      } catch (FileNotFoundException ignored) {
      }
      // put all of the updates into the keystore
      for(Map.Entry<String, Metadata> entry: cache.entrySet()) {
        try {
          keyStore.setKeyEntry(entry.getKey(), new KeyMetadata(entry.getValue()),
              password, null);
        } catch (KeyStoreException e) {
          throw new IOException("Can't set metadata key " + entry.getKey(),e );
        }
      }

      // Save old File first
      boolean fileExisted = backupToOld(oldPath);
      if (fileExisted) {
        resetPath = oldPath;
      }
      // write out the keystore
      // Write to _NEW path first :
      try {
        writeToNew(newPath);
      } catch (IOException ioe) {
        // rename _OLD back to curent and throw Exception
        revertFromOld(oldPath, fileExisted);
        resetPath = path;
        throw ioe;
      }

View on GitHub (pinned to 2add963021)

Solutions

1. Verify the keystore loads and lists cleanly (`hadoop key list -provider <uri>`)
2. Clear stale *_NEW/_OLD artifacts from an interrupted flush, then retry flush
3. Enforce single-writer access per keystore file
4. Restore the keystore from backup if the store itself is damaged

try { provider.flush(); } catch (IOException e) { if (String.valueOf(e.getMessage()).startsWith("Can't set metadata key")) { // store-level fault: alert, verify store health; on-disk state unchanged, safe to retry after repair } else { throw e; } }

When it happens

Trigger: Keystore loaded in a degraded or corrupt state; a security-provider configuration that rejects the entry; the keystore file replaced underneath by a concurrent writer since load.

Common situations: Two daemons flushing the same jceks file; disk corruption; JVM security configuration changed under a long-lived process.

Related errors

• Can't store keystore ${this}
• Problem removing ${versionName} from ${this}
• Problem removing ${name} from ${this}
• Can't store key ${versionName} in ${this}
• Certificate exception storing keystore ${this}

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/f798770266a01669. Report an issue: GitHub.