apache/hadoop · error · RuntimeException

Cannot rename KDC's krb5conf to %s

Error message

Cannot rename KDC's krb5conf to %s

What it means

After starting the embedded KDC, standalone MiniKdc.main() renames the generated krb5.conf from inside the KDC's timestamped work directory to <WORKDIR>/krb5.conf (MiniKdc.java:112). If File.renameTo returns false — target could not be created/replaced — it throws RuntimeException 'Cannot rename KDC's krb5conf to <path>' and the standalone KDC aborts.

Source

Thrown at hadoop-common-project/hadoop-minikdc/src/main/java/org/apache/hadoop/minikdc/MiniKdc.java:138

      System.out.println("  Realm           : " + miniKdc.getRealm());
      System.out.println("  Running at      : " + miniKdc.getHost() + ":" +
              miniKdc.getHost());
      System.out.println("  krb5conf        : " + krb5conf);
      System.out.println();
      System.out.println("  created keytab  : " + keytabFile);
      System.out.println("  with principals : " + Arrays.asList(principals));
      System.out.println();
      System.out.println(" Do <CTRL-C> or kill <PID> to stop it");
      System.out.println("---------------------------------------------------");
      System.out.println();
      Runtime.getRuntime().addShutdownHook(new Thread() {
        @Override
        public void run() {
          miniKdc.stop();
        }
      });
    } else {
      throw new RuntimeException("Cannot rename KDC's krb5conf to "
              + krb5conf.getAbsolutePath());
    }
  }

  private static final Logger LOG = LoggerFactory.getLogger(MiniKdc.class);

  public static final String ORG_NAME = "org.name";
  public static final String ORG_DOMAIN = "org.domain";
  public static final String KDC_BIND_ADDRESS = "kdc.bind.address";
  public static final String KDC_PORT = "kdc.port";
  public static final String INSTANCE = "instance";
  public static final String MAX_TICKET_LIFETIME = "max.ticket.lifetime";
  public static final String MIN_TICKET_LIFETIME = "min.ticket.lifetime";
  public static final String MAX_RENEWABLE_LIFETIME = "max.renewable.lifetime";
  public static final String TRANSPORT = "transport";
  public static final String DEBUG = "debug";

  private static final Set<String> PROPERTIES = new HashSet<String>();

View on GitHub (pinned to 2add963021)

Solutions

1. Delete any stale <WORKDIR>/krb5.conf (and stop processes holding it) before starting
2. Ensure the JVM user has write permission on the workdir and sufficient disk space
3. Use a fresh workdir per run (the JUnit harness does this via target/test-dir/<timestamp>)
4. On Windows, close handles to krb5.conf — renameTo cannot replace an open file there

Example fix

# before
java ... MiniKdc /tmp/kdc ... # second run, stale krb5.conf
# after
rm -f /tmp/kdc/krb5.conf && java ... MiniKdc /tmp/kdc ...

File target = new File(workDir, "krb5.conf");
if (target.exists() && !target.delete())
  throw new IllegalStateException("cannot clear stale " + target + " — close holders and retry");
if (!workDir.canWrite()) throw new IllegalStateException("workdir not writable: " + workDir);

When it happens

Trigger: An existing workDir/krb5.conf that cannot be replaced (locked by another process, read-only permissions, or Windows rename-over-existing semantics), a work directory without write permission, or the source krb5.conf missing because the KDC failed to write it.

Common situations: Running the standalone MiniKdc twice in the same workdir where the first run's file is held open; antivirus/file locks on Windows; read-only or root-owned workdir under CI; disk full.

Related errors

• Specified work directory does not exists: %s
• Specified configuration does not exists: %s
• Missing configuration properties: %s
• Cannot create directory %s
• Already started

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/13b986459aa6b608. Report an issue: GitHub.