apache/hadoop · error · RuntimeException

Cannot start secure DataNode due to incorrect config. See ht

Error message

Cannot start secure DataNode due to incorrect config. See https://cwiki.apache.org/confluence/display/HADOOP/Secure+DataNode for details.

What it means

Error "Cannot start secure DataNode due to incorrect config. See https://cwiki.apache.org/confluence/display/HADOOP/Secure+DataNode for details." thrown in apache/hadoop.

Source

Thrown at hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/datanode/DataNode.java:2041

          || resources.isSaslEnabled();

      // Allow secure DataNode to startup if:
      // 1. Http is secure.
      // 2. Rpc is secure
      if (rpcSecured && httpSecured) {
        return;
      }
    } else {
      // Handle cases when SecureDataNodeStarter#getSecureResources is not
      // invoked
      SaslPropertiesResolver saslPropsResolver = dnConf.getSaslPropsResolver();
      if (saslPropsResolver != null &&
          DFSUtil.getHttpPolicy(conf) == HttpConfig.Policy.HTTPS_ONLY) {
        return;
      }
    }

    throw new RuntimeException("Cannot start secure DataNode due to incorrect "
        + "config. See https://cwiki.apache.org/confluence/display/HADOOP/"
        + "Secure+DataNode for details.");
  }
  
  public static String generateUuid() {
    return UUID.randomUUID().toString();
  }

  public SaslDataTransferClient getSaslClient() {
    return saslClient;
  }

  /**
   * Verify that the DatanodeUuid has been initialized. If this is a new
   * datanode then we generate a new Datanode Uuid and persist it to disk.
   *
   * @throws IOException
   */

View on GitHub (pinned to 2add963021)

Solutions

1. Follow the Secure DataNode guide: configure Kerberos principal/keytab (dfs.datanode.kerberos.principal, dfs.datanode.keytab.file) and either SASL (dfs.data.transfer.protection) or privileged ports via jsvc/SecureDataNodeStarter.
2. If using ports <1024, start the DataNode with jsvc or enable dfs.datanode.use.secure.ports.with.sasl so binding works without root.

When it happens

Trigger: Starting a DataNode in a Kerberos-secured cluster without the required principal/keytab, SASL data transfer protection, or a mechanism to bind privileged ports.

Common situations: The secure DataNode cannot bind privileged ports or load its keytab. Follow the SecureDataNode guide: configure jsvc or SASL and correct Kerberos settings before startup.

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/12edf09f86ce3192. Report an issue: GitHub.