apache/hadoop · error · IOException

Key ${name} does not exist in ${this}

Error message

Key ${name} does not exist in ${this}

What it means

JavaKeyStoreProvider.deleteKey resolves Metadata for the key name first; if getMetadata(name) returns null, the name exists neither in the metadata cache nor as an alias in the keystore, and deletion aborts with this IOException instead of silently succeeding. The provider treats a missing key as an error so callers notice wrong names or wrong keystores.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java:468

      if (options.getBitLength() != 8 * material.length) {
        throw new IOException("Wrong key length. Required " +
            options.getBitLength() + ", but got " + (8 * material.length));
      }
      cache.put(name, meta);
      String versionName = buildVersionName(name, 0);
      return innerSetKeyVersion(name, versionName, material, meta.getCipher());
    } finally {
      writeLock.unlock();
    }
  }

  @Override
  public void deleteKey(String name) throws IOException {
    writeLock.lock();
    try {
      Metadata meta = getMetadata(name);
      if (meta == null) {
        throw new IOException("Key " + name + " does not exist in " + this);
      }
      for(int v=0; v < meta.getVersions(); ++v) {
        String versionName = buildVersionName(name, v);
        try {
          if (keyStore.containsAlias(versionName)) {
            keyStore.deleteEntry(versionName);
          }
        } catch (KeyStoreException e) {
          throw new IOException("Problem removing " + versionName + " from " +
              this, e);
        }
      }
      try {
        if (keyStore.containsAlias(name)) {
          keyStore.deleteEntry(name);
        }
      } catch (KeyStoreException e) {
        throw new IOException("Problem removing " + name + " from " + this, e);

View on GitHub (pinned to 2add963021)

Solutions

1. Check provider.getMetadata(name) != null (or list provider.getKeys()) before deleting
2. Make deletion idempotent: catch the IOException and treat 'does not exist' as success
3. Verify the key actually lives in that provider with `hadoop key list -provider <uri>`

Example fix

// before
provider.deleteKey(name);

// after
if (provider.getMetadata(name) != null) {
  provider.deleteKey(name);
}

if (provider.getMetadata(name) != null) {
  provider.deleteKey(name);
} // else: nothing to delete, treat as success

try { provider.deleteKey(name); } catch (IOException e) { if (String.valueOf(e.getMessage()).contains("does not exist")) { return; } throw e; }

When it happens

Trigger: Calling deleteKey on a never-created name; deleting a key that was already deleted; a typo in the key name; calling on a provider instance built from a different jceks:// URI than the one that stores the key.

Common situations: Cleanup scripts run twice; concurrent admins deleting the same key; hadoop.security.key.provider.path pointing at the wrong keystore file so every lookup misses.

Related errors

• Key ${name} not found
• Can't find Metadata for key ${name}
• Wrong key length. Required ${options.getBitLength()}, but go
• Wrong key length. Required ${meta.getBitLength()}, but got $
• Can't find KeyProvider for key ${keyName}

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/043b45b5821fdb11. Report an issue: GitHub.