apache/hadoop · error · IOException

Zookeeper client is null

Error message

Zookeeper client is null

What it means

getZooKeeperClient() obtains the underlying org.apache.zookeeper.ZooKeeper handle from the Curator client (zkClient.getZookeeperClient().getZooKeeper()). If Curator is null/not started or the call throws, it logs INFO 'Cannot get zookeeper client' with the cause and then throws IOException('Zookeeper client is null') in the finally block. Callers include rebuildTokenCache, which needs the raw client for unsorted getChildren over the token tree.

Source

Thrown at hadoop-hdfs-project/hadoop-hdfs-rbf/src/main/java/org/apache/hadoop/hdfs/server/federation/router/security/token/ZKDelegationTokenSecretManagerImpl.java:224

  @Override
  protected void addOrUpdateToken(AbstractDelegationTokenIdentifier ident,
      DelegationTokenInformation info, boolean isUpdate) throws Exception {
    // Store the data in local memory first
    currentTokens.put(ident, info);
    super.addOrUpdateToken(ident, info, isUpdate);
  }

  private ZooKeeper getZooKeeperClient() throws IOException {
    // get zookeeper client
    ZooKeeper zookeeper = null;
    try {
      zookeeper = zkClient.getZookeeperClient().getZooKeeper();
    } catch (Exception e) {
      LOG.info("Cannot get zookeeper client ", e);
    } finally {
      if (zookeeper == null) {
        throw new IOException("Zookeeper client is null");
      }
    }
    return zookeeper;
  }
}

View on GitHub (pinned to 2add963021)

Solutions

1. Look at the preceding INFO log 'Cannot get zookeeper client' — it carries the underlying exception (connection refused, auth failure, illegal state).
2. Verify ZooKeeper connectivity and connection string from the router host.
3. Ensure the manager is fully started (its startThreads runs during router initialization) before token operations trigger cache rebuilds.
4. Restart the router after ZooKeeper recovers; the handle cannot be re-obtained from a dead Curator client.

try {
  zkClient.getChildren(TOKEN_PATH, false); // path using getZooKeeperClient()
} catch (IOException e) {
  if ("Zookeeper client is null".equals(e.getMessage())) {
    // curator handle unavailable: check preceding 'Cannot get zookeeper client' log,
    // restore ZK / restart the secret manager rather than retrying in-process
    throw new IllegalStateException("ZK token store disconnected; restart after ZK recovery", e);
  }
  throw e;
}

When it happens

Trigger: The ZK token secret manager's Curator client was never started or lost its connection so getZookeeperClient() throws; the manager was constructed against an unreachable ZooKeeper ensemble; Curator is still connecting when a token cache rebuild runs.

Common situations: ZooKeeper ensemble down at router start or during a token cache refresh; wrong ZK connection string in the token manager configuration; ZK session expired and Curator has not re-established before the next rebuild.

Related errors

• Tokens cannot be fetched from path {TOKEN_PATH}
• Failed to create SecretManager
• Delegation Token can be issued only with kerberos or web aut
• Delegation Token can be renewed only with kerberos or web au
• Counter table not initialized: {table}

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/a94549414d474203. Report an issue: GitHub.