apache/hadoop · error · IllegalStateException

currentKey hasn't been initialized.

Error message

currentKey hasn't been initialized.

What it means

BlockTokenSecretManager.createPassword throws IllegalStateException when a block token is requested but currentKey is null, i.e., the key-rolling machinery never produced an initial key. The secret manager generates keys on construction (generateKeys) or receives them via setKeys() when the NameNode loads fsimage; if neither happened, no password can be computed. It is a lifecycle bug: token generation was attempted before initialization, not a transient condition.

Source

Thrown at hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/security/token/block/BlockTokenSecretManager.java:488

  public BlockTokenIdentifier createIdentifier() {
    return new BlockTokenIdentifier();
  }

  /**
   * Create a new password/secret for the given block token identifier.
   *
   * @param identifier
   *          the block token identifier
   * @return token password/secret
   */
  @Override
  protected byte[] createPassword(BlockTokenIdentifier identifier) {
    BlockKey key = null;
    synchronized (this) {
      key = currentKey;
    }
    if (key == null) {
      throw new IllegalStateException("currentKey hasn't been initialized.");
    }
    identifier.setExpiryDate(timer.now() + tokenLifetime);
    identifier.setKeyId(key.getKeyId());
    if (LOG.isDebugEnabled()) {
      LOG.debug("Generating block token for " + identifier);
    }
    return createPassword(identifier.getBytes(), key.getKey());
  }

  /**
   * Look up the token password/secret for the given block token identifier.
   *
   * @param identifier
   *          the block token identifier to look up
   * @return token password/secret as byte[]
   * @throws InvalidToken
   */
  @Override

View on GitHub (pinned to 2add963021)

Solutions

1. Ensure the manager is initialized before any token minting: for a fresh cluster call generateKeys() (or setKeys(...) with keys from fsimage) prior to generateToken.
2. In NameNode context, confirm the active state (fsimage load) completed before serving RPCs that mint block tokens — check startup ordering in logs.
3. For read-only consumers, use a manager configured with keys loaded from the same source instead of an uninitialized one.
4. Add a startup assertion / health check getCurrentKey() != null to fail fast at boot rather than at first token request.

Example fix

// before
BlockTokenSecretManager sm = new BlockTokenSecretManager(keyUpdateInterval, tokenLifetime, 0, "BP-1", false);
Token<BlockTokenIdentifier> t = sm.generateToken(...); // IllegalStateException

// after
sm = new BlockTokenSecretManager(keyUpdateInterval, tokenLifetime, 0, "BP-1", true);
sm.setKeys(new BlockTokenSecretManager.Keys(...)); // or let ctor's generateKeys run
assert sm.getCurrentKey() != null;
Token<BlockTokenIdentifier> t = sm.generateToken(...);

if (blockTokenSecretManager.getCurrentKey() == null) {
  // keys not loaded yet: initialize (generateKeys/setKeys) before minting tokens
  blockTokenSecretManager.setKeys(loadKeysFromImageOrGenerate());
}

try {
  token = sm.generateToken(dn, block, modes);
} catch (IllegalStateException e) {
  if ("currentKey hasn't been initialized.".equals(e.getMessage())) {
    // lifecycle bug: initialize keys first, fail loudly rather than loop
    sm.setKeys(loadKeys());
  } else { throw e; }
}

When it happens

Trigger: generateToken/createPassword is called on a BlockTokenSecretManager whose currentKey was never set — e.g., before loadSecretManager state from fsimage was applied, before the first rollKeysTimer tick that calls generateKeys, or on a manager constructed for read-only verification (where setKeys was skipped) that is mistakenly used to mint tokens.

Common situations: Custom tooling/tests constructing BlockTokenSecretManager directly and calling generateToken without generateKeys()/setKeys(); NN code path issuing tokens (addBlock, DN handshake) racing ahead of image load; after an upgrade where setKeys ordering changed; using a secret manager intended only for password verification to also create tokens.

Related errors

• Block pool {bpid} is not found
• Can't re-compute encryption key for nonce, since the require
• Can't load state from image in a running SecretManager.
• Can't add persisted delegation token to a running SecretMana
• Cannot get access token since BlockKeyUpdater is not running

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/f8258f2e8a58bd5a. Report an issue: GitHub.