apache/iceberg · error · IllegalArgumentException

Cannot initialize KeyManagementClient, missing no-arg constr

Error message

Cannot initialize KeyManagementClient, missing no-arg constructor for class ${kmsImpl}

What it means

EncryptionUtil.createKmsClient loads the configured encryption.kms.impl class reflectively via DynConstructors, requiring a public no-arg constructor implementing KeyManagementClient. If no such constructor exists (NoSuchMethodException), it throws IllegalArgumentException naming the class.

Source

Thrown at core/src/main/java/org/apache/iceberg/encryption/EncryptionUtil.java:79

                CatalogProperties.ENCRYPTION_KMS_IMPL_AWS;
            case CatalogProperties.ENCRYPTION_KMS_TYPE_AZURE ->
                CatalogProperties.ENCRYPTION_KMS_IMPL_AZURE;
            case CatalogProperties.ENCRYPTION_KMS_TYPE_GCP ->
                CatalogProperties.ENCRYPTION_KMS_IMPL_GCP;
            default -> throw new IllegalStateException("Unsupported KMS type: " + kmsType);
          };
    }

    KeyManagementClient kmsClient;
    DynConstructors.Ctor<KeyManagementClient> ctor;
    try {
      ctor =
          DynConstructors.builder(KeyManagementClient.class)
              .loader(EncryptionUtil.class.getClassLoader())
              .impl(kmsImpl)
              .buildChecked();
    } catch (NoSuchMethodException e) {
      throw new IllegalArgumentException(
          String.format(
              "Cannot initialize KeyManagementClient, missing no-arg constructor for class %s",
              kmsImpl),
          e);
    }

    try {
      kmsClient = ctor.newInstance();
    } catch (ClassCastException e) {
      throw new IllegalArgumentException(
          String.format(
              "Cannot initialize kms client, %s does not implement KeyManagementClient interface",
              kmsImpl),
          e);
    }

    kmsClient.initialize(catalogProperties);

View on GitHub (pinned to 86d9c8fc54)

Solutions

Add a public no-arg constructor to the configured KeyManagementClient class
Configure the class so it reads its settings from catalog/table properties at construction time instead of constructor args
Point encryption.kms.impl at the concrete client class, not a factory or abstract class
Verify the class implements org.apache.iceberg.encryption.KeyManagementClient and is on the classpath

Example fix

// before
class MyKmsClient implements KeyManagementClient {
  MyKmsClient(String keyId) { ... }
}
// after
class MyKmsClient implements KeyManagementClient {
  public MyKmsClient() { this.keyId = System.getenv("KMS_KEY_ID"); }
  MyKmsClient(String keyId) { ... }
}

Defensive patterns

Strategy: validation

Validate before calling

Class<?> c = Class.forName(kmsImpl);
if (!KeyManagementClient.class.isAssignableFrom(c)) {
  throw new IllegalArgumentException(kmsImpl + " does not implement KeyManagementClient");
}
if (java.lang.reflect.Modifier.isAbstract(c.getModifiers()) ||
    c.getConstructors().length == 0 ||
    java.util.Arrays.stream(c.getConstructors()).noneMatch(ctor -> ctor.getParameterCount() == 0)) {
  throw new IllegalArgumentException(kmsImpl + " lacks a public no-arg constructor");
}

Try / catch

try {
  kms = EncryptionUtil.createKmsClient(config);
} catch (IllegalArgumentException e) {
  if (e.getMessage() != null && e.getMessage().contains("missing no-arg constructor")) {
    throw new ConfigException("encryption.kms.impl class must be public, concrete, and have a no-arg ctor", e);
  }
  throw e;
}

Prevention

Implement custom KMS clients with a public no-arg constructor reading config from properties
Point kms.impl at the concrete client class, never a factory or abstract base
Add a startup smoke test that instantiates the configured class reflectively
Ensure the class is compiled against the same Iceberg KeyManagementClient interface version

When it happens

Trigger: Setting encryption.kms.impl to a class that has only parameterized constructors, is abstract, or implements the wrong interface so no matching no-arg impl ctor resolves.

Common situations: Custom KMS client implementations that require config in the constructor; pointing kms.impl at a factory/wrapper class instead of the client itself; class compiled against a different KeyManagementClient interface version.

Related errors

AI-assisted analysis of apache/iceberg@86d9c8fc54 (2026-09-12). Data as JSON: /api/errors/c9e739b9507dfee1. Report an issue: GitHub.