apache/hadoop · error · IOException

No key provider configured, re-encryption operation is rejec

Error message

No key provider configured, re-encryption operation is rejected

What it means

Error "No key provider configured, re-encryption operation is rejected" thrown in apache/hadoop.

Source

Thrown at hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSNamesystem.java:8380

    checkSuperuserPrivilege(operationName, dir.rootDir.getFullPathName());
    readLock(RwLockMode.FS);
    try {
      checkOperation(OperationCategory.READ);
      final BatchedListEntries<ZoneReencryptionStatus> ret =
          FSDirEncryptionZoneOp.listReencryptionStatus(dir, prevId);
      success = true;
      return ret;
    } finally {
      readUnlock(RwLockMode.FS, operationName, getLockReportInfoSupplier(null));
      logAuditEvent(success, operationName, null);
    }
  }

  private void reencryptEncryptionZoneInt(final FSPermissionChecker pc,
      final String zone, final ReencryptAction action,
      final boolean logRetryCache) throws IOException {
    if (getProvider() == null) {
      throw new IOException("No key provider configured, re-encryption "
          + "operation is rejected");
    }
    String keyVersionName = null;
    if (action == ReencryptAction.START) {
      // get zone's latest key version name out of the lock.
      keyVersionName =
          FSDirEncryptionZoneOp.getCurrentKeyVersion(dir, pc, zone);
      if (keyVersionName == null) {
        throw new IOException("Failed to get key version name for " + zone);
      }
      LOG.info("Re-encryption using key version " + keyVersionName
          + " for zone " + zone);
    }
    writeLock(RwLockMode.FS);
    try {
      checkOperation(OperationCategory.WRITE);
      checkNameNodeSafeMode("NameNode in safemode, cannot " + action
          + " re-encryption on zone " + zone);

View on GitHub (pinned to 2add963021)

Solutions

1. Configure a key provider via hadoop.security.key.provider.path (KMS) in core-site.xml before running re-encryption operations.

When it happens

Trigger: An admin submits an encryption zone re-encryption command but no KMS/key provider is configured.

Common situations: Running 'hdfs crypto -reencryptZone' on a cluster without hadoop.security.key.provider.path set.

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/e6316106f6eeb0c4. Report an issue: GitHub.