apache/hadoop · error · IOException

Failed to instantiate a custom keyring provider: " + e

Error message

Failed to instantiate a custom keyring provider: " + e

What it means

Error "Failed to instantiate a custom keyring provider: " + e" thrown in apache/hadoop.

Source

Thrown at hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/impl/EncryptionS3ClientFactory.java:206

            // this is required for backward compatibility with older encryption clients
            .enableLegacyWrappingAlgorithms(true);

    switch (cseMaterials.getCseKeyType()) {
    case KMS:
      Keyring kmsKeyring = createKmsKeyring(parameters, cseMaterials);
      CryptographicMaterialsManager kmsCryptoMaterialsManager =
          DefaultCryptoMaterialsManager.builder()
              .keyring(kmsKeyring)
              .build();
      s3EncryptionClientBuilder.cryptoMaterialsManager(kmsCryptoMaterialsManager);
      break;
    case CUSTOM:
      Keyring keyring;
      try {
        keyring =
            getKeyringProvider(cseMaterials.getCustomKeyringClassName(), cseMaterials.getConf());
      } catch (RuntimeException e) {
        throw new IOException("Failed to instantiate a custom keyring provider: " + e, e);
      }
      CryptographicMaterialsManager customCryptoMaterialsManager =
          DefaultCryptoMaterialsManager.builder()
              .keyring(keyring)
              .build();
      s3EncryptionClientBuilder.cryptoMaterialsManager(customCryptoMaterialsManager);
      break;
    default:
      break;
    }
    return s3EncryptionClientBuilder.build();
  }

  /**
   * Creates KmsKeyring instance based on the provided S3ClientCreationParameters and CSEMaterials.
   *
   * @param parameters The S3ClientCreationParameters containing the necessary configuration.
   * @param cseMaterials The CSEMaterials containing the KMS key ID and other encryption materials.

View on GitHub (pinned to 2add963021)

Solutions

1. Ensure the custom keyring provider class is on the classpath, public, and instantiable; check fs.s3a.encryption.cse.keyring.class.name.

When it happens

Trigger: Thrown at hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/impl/EncryptionS3ClientFactory.java:206 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/5b1e26fa310d404e. Report an issue: GitHub.