apache/hadoop · error · IllegalArgumentException

IllegalArgumentException Wrong eek_op value, it must be gene

Error message

IllegalArgumentException Wrong eek_op value, it must be generate or decrypt

What it means

Thrown by the KMS REST resource generateEncryptedKeys (KMS.java:548), which serves GET /v1/key/{name}/_eek with the query parameter eek_op. In this code path only the literal value 'generate' is handled; every other value falls into the else branch, logs 'Wrong eek_op value, it must be generate or decrypt', and throws IllegalArgumentException, which the KMS exception mapper turns into an HTTP 400 response.

Source

Thrown at hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMS.java:548

        } catch (Exception e) {
          LOG.error("Exception in generateEncryptedKeys:", e);
          throw new IOException(e);
        }
        kmsAudit.ok(user, KMSOp.GENERATE_EEK, name, "");
        retJSON = new ArrayList();
        for (EncryptedKeyVersion edek : retEdeks) {
          ((ArrayList) retJSON).add(KMSUtil.toJSON(edek));
        }
      } else {
        StringBuilder error;
        error = new StringBuilder("IllegalArgumentException Wrong ");
        error.append(KMSRESTConstants.EEK_OP);
        error.append(" value, it must be ");
        error.append(KMSRESTConstants.EEK_GENERATE);
        error.append(" or ");
        error.append(KMSRESTConstants.EEK_DECRYPT);
        LOG.error(error.toString());
        throw new IllegalArgumentException(error.toString());
      }
      KMSWebApp.getGenerateEEKCallsMeter().mark();
      LOG.trace("Exiting generateEncryptedKeys method.");
      return Response.ok().type(MediaType.APPLICATION_JSON).entity(retJSON)
              .build();
    } catch (Exception e) {
      LOG.debug("Exception in generateEncryptedKeys.", e);
      throw e;
    }
  }

  @SuppressWarnings("rawtypes")
  @POST
  @Path(KMSRESTConstants.KEY_RESOURCE + "/{name:.*}/" +
      KMSRESTConstants.REENCRYPT_BATCH_SUB_RESOURCE)
  @Consumes(MediaType.APPLICATION_JSON)
  @Produces(MediaType.APPLICATION_JSON + "; " + JettyUtils.UTF_8)
  public Response reencryptEncryptedKeys(

View on GitHub (pinned to 2add963021)

Solutions

Send exactly eek_op=generate on GET /v1/key/{name}/_eek (add &num_keys=N if you need multiple EEKs)
For decryption use POST /v1/keyversion/{versionName}/_eek with eek_op=decrypt, and for re-encryption the same POST with eek_op=reencrypt
Prefer the Java API (KeyProviderCryptoExtension.generateEncryptedKey / KMSClientProvider) over hand-built URLs so the correct endpoint and parameter are chosen for you
Check for whitespace/case errors in the query string if the value looks correct

Example fix

# before
GET /v1/key/mykey/_eek?eek_op=Generate
# after
GET /v1/key/mykey/_eek?eek_op=generate&num_keys=1

Defensive patterns

Strategy: validation

Validate before calling

String op = "generate"; // must be exactly 'generate' for GET /key/{name}/_eek
if (!"generate".equals(op))
  throw new IllegalArgumentException("Use eek_op=generate on the key resource; decrypt/reencrypt belong to POST /keyversion/{v}/_eek");
// GET http://kms:9600/kms/v1/key/mykey/_eek?eek_op=generate

Try / catch

try { kmsClient.generateEncryptedKeys(...); } catch (IllegalArgumentException e) { /* KMS maps to HTTP 400 */ if (e.getMessage().contains("eek_op")) fixQueryParamAndRetry(); else throw e; }

Prevention

Prefer KeyProviderCryptoExtension.generateEncryptedKey over hand-built REST URLs
Centralize eek_op constants (generate/decrypt/reencrypt) in one enum in client code
Assert the endpoint/value pairing in one helper: generate->GET /key/{name}/_eek, decrypt|reencrypt->POST /keyversion/{v}/_eek

When it happens

Trigger: Calling GET /v1/key/{keyName}/_eek?eek_op=<value> where <value> is anything but exactly 'generate': typos such as 'Generate' or 'gen', or values that belong to the other endpoint, e.g. eek_op=decrypt or eek_op=reencrypt (decrypt/reencrypt must be POSTed to /v1/keyversion/{versionName}/_eek, not to the key resource). A missing eek_op instead fails earlier with checkNotNull (KMS.java:503), so this error specifically means a present-but-unrecognized value.

Common situations: Client code copied from the decrypt flow and reused on the generate URL; Hadoop KeyProvider via KMSClientProvider hitting a version skew where eek_op semantics changed; hand-rolled curl calls with a typo in the query parameter; trailing whitespace or URL-encoding mistakes (e.g. eek_op=generate%0A).

Related errors

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/9e189999547c7cd5. Report an issue: GitHub.