apache/hadoop · error · IOException

Problem looking up key ${name} in ${this}

Error message

Problem looking up key ${name} in ${this}

What it means

At the start of createKey(), the pre-existence check itself (keyStore.containsAlias) threw KeyStoreException — the keystore object is uninitialized or in a failed state, so the provider cannot even check whether the key exists. Wrapped as IOException('Problem looking up key ...') with the cause attached.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java:445

      }
    } finally {
      readLock.unlock();
    }
  }

  @Override
  public KeyVersion createKey(String name, byte[] material,
                               Options options) throws IOException {
    Preconditions.checkArgument(name.equals(StringUtils.toLowerCase(name)),
        "Uppercase key names are unsupported: %s", name);
    writeLock.lock();
    try {
      try {
        if (keyStore.containsAlias(name) || cache.containsKey(name)) {
          throw new IOException("Key " + name + " already exists in " + this);
        }
      } catch (KeyStoreException e) {
        throw new IOException("Problem looking up key " + name + " in " + this,
            e);
      }
      Metadata meta = new Metadata(options.getCipher(), options.getBitLength(),
          options.getDescription(), options.getAttributes(), new Date(), 1);
      if (options.getBitLength() != 8 * material.length) {
        throw new IOException("Wrong key length. Required " +
            options.getBitLength() + ", but got " + (8 * material.length));
      }
      cache.put(name, meta);
      String versionName = buildVersionName(name, 0);
      return innerSetKeyVersion(name, versionName, material, meta.getCipher());
    } finally {
      writeLock.unlock();
    }
  }

  @Override
  public void deleteKey(String name) throws IOException {

View on GitHub (pinned to 2add963021)

Solutions

1. Recreate/reload the provider so load() runs cleanly, then retry createKey
2. Confirm the keystore path exists and passes keytool -list before invoking the provider
3. In tests, back the provider with a real (temporary) JCEKS file instead of mocks

// Verify provider health before create paths
try {
  provider.getKeys(); // cheap structural probe
} catch (IOException e) {
  throw new IllegalStateException("Keystore not initialized/healthy", e);
}

try {
  provider.createKey(name, material, options);
} catch (IOException e) {
  if (e.getCause() instanceof KeyStoreException) {
    // provider state broken: build a fresh provider instance and retry once
  }
}

When it happens

Trigger: Calling createKey() against a provider whose KeyStore was never initialized or whose load failed earlier — common in tests with mock/partial keystores, or when the keystore file disappeared while a provider instance was live.

Common situations: Unit tests mocking KeyStore without calling load(); KMS process holding a handle to a deleted/moved keystore file; provider reuse after a swallowed load error

Related errors

• Can't get key ${versionName} from ${path}
• Can't get key ${alias} from ${path}
• Can't get metadata for ${name} from keystore ${path}
• Key ${name} already exists in ${this}
• Keystore not loaded due to some inconsistency ('%s' and '%s'

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/074b8cbada102c6f. Report an issue: GitHub.