apache/hadoop · error · IOException

Key ${name} already exists in ${this}

Error message

Key ${name} already exists in ${this}

What it means

createKey() refuses to overwrite: if the alias already exists in the keystore (keyStore.containsAlias) or in the metadata cache, it throws IOException('Key <name> already exists'). Hadoop key versions are append-only; new versions must go through rolloverKey, not createKey.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java:442

      } catch (UnrecoverableKeyException e) {
        throw new IOException("Can't recover key for " + name +
            " from keystore " + path, e);
      }
    } finally {
      readLock.unlock();
    }
  }

  @Override
  public KeyVersion createKey(String name, byte[] material,
                               Options options) throws IOException {
    Preconditions.checkArgument(name.equals(StringUtils.toLowerCase(name)),
        "Uppercase key names are unsupported: %s", name);
    writeLock.lock();
    try {
      try {
        if (keyStore.containsAlias(name) || cache.containsKey(name)) {
          throw new IOException("Key " + name + " already exists in " + this);
        }
      } catch (KeyStoreException e) {
        throw new IOException("Problem looking up key " + name + " in " + this,
            e);
      }
      Metadata meta = new Metadata(options.getCipher(), options.getBitLength(),
          options.getDescription(), options.getAttributes(), new Date(), 1);
      if (options.getBitLength() != 8 * material.length) {
        throw new IOException("Wrong key length. Required " +
            options.getBitLength() + ", but got " + (8 * material.length));
      }
      cache.put(name, meta);
      String versionName = buildVersionName(name, 0);
      return innerSetKeyVersion(name, versionName, material, meta.getCipher());
    } finally {
      writeLock.unlock();
    }
  }

View on GitHub (pinned to 2add963021)

Solutions

1. List keys first (hadoop key list -provider ... or provider.getKeys()) and pick a different name if the key should stay
2. If you intend a new version of the same key, use rolloverKey / `hadoop key roll <name>` instead of create
3. Delete the old key first (`hadoop key delete <name>`, wait for cache invalidation) and then create — note deletion is irreversible for EZ use
4. Guard scripts with an existence check before create to make them idempotent

Example fix

// before
provider.createKey("mykey", bytes, options); // Key mykey already exists

// after
if (provider.getKeys().contains("mykey")) {
  provider.rollNewVersion("mykey", bytes); // new version of existing key
} else {
  provider.createKey("mykey", bytes, options);
}
provider.flush();

// Idempotent key provisioning
if (provider.getKeys().contains(name)) {
  if (wantNewVersion) {
    provider.rollNewVersion(name, material);
  }
  // else: key already exists as desired
} else {
  provider.createKey(name, material, options);
}
provider.flush();

try {
  provider.createKey(name, material, options);
} catch (IOException e) {
  if (String.valueOf(e.getMessage()).contains("already exists")) {
    provider.rollNewVersion(name, material); // intended semantics: new version
  } else {
    throw e;
  }
}

When it happens

Trigger: Calling KeyProvider.createKey(name, ...) / `hadoop key create name` when a key with that name (or an alias matching it) already exists in the JCEKS keystore — including keys created earlier on another KMS host sharing the file, or leftovers from a deleted-then-recreated test flow.

Common situations: Re-running a provisioning script after a partial failure; retrying create after a network timeout where the first create actually succeeded; key name collisions across environments sharing one keystore; pre-existing keytool alias with the same name

Related errors

• Problem looking up key ${name} in ${this}
• Keystore not loaded due to some inconsistency ('%s' and '%s'
• Can't create keystore: ${e}
• Can't load keystore ${path} : ${e}
• Can't get key ${versionName} from ${path}

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/73aa9ce9dcfd5e66. Report an issue: GitHub.