{"record":{"id":"12edf09f86ce3192","repo":"apache/hadoop","slug":"cannot-start-secure-datanode-due-to-incorrect-conf","errorCode":null,"errorMessage":"Cannot start secure DataNode due to incorrect config. See https://cwiki.apache.org/confluence/display/HADOOP/Secure+DataNode for details.","messagePattern":"Cannot start secure DataNode due to incorrect config\\. See https://cwiki\\.apache\\.org/confluence/display/HADOOP/Secure\\+DataNode for details\\.","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/datanode/DataNode.java","lineNumber":2041,"sourceCode":"          || resources.isSaslEnabled();\n\n      // Allow secure DataNode to startup if:\n      // 1. Http is secure.\n      // 2. Rpc is secure\n      if (rpcSecured && httpSecured) {\n        return;\n      }\n    } else {\n      // Handle cases when SecureDataNodeStarter#getSecureResources is not\n      // invoked\n      SaslPropertiesResolver saslPropsResolver = dnConf.getSaslPropsResolver();\n      if (saslPropsResolver != null &&\n          DFSUtil.getHttpPolicy(conf) == HttpConfig.Policy.HTTPS_ONLY) {\n        return;\n      }\n    }\n\n    throw new RuntimeException(\"Cannot start secure DataNode due to incorrect \"\n        + \"config. See https://cwiki.apache.org/confluence/display/HADOOP/\"\n        + \"Secure+DataNode for details.\");\n  }\n  \n  public static String generateUuid() {\n    return UUID.randomUUID().toString();\n  }\n\n  public SaslDataTransferClient getSaslClient() {\n    return saslClient;\n  }\n\n  /**\n   * Verify that the DatanodeUuid has been initialized. If this is a new\n   * datanode then we generate a new Datanode Uuid and persist it to disk.\n   *\n   * @throws IOException\n   */","sourceCodeStart":2023,"sourceCodeEnd":2059,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/datanode/DataNode.java#L2023-L2059","documentation":"Error \"Cannot start secure DataNode due to incorrect config. See https://cwiki.apache.org/confluence/display/HADOOP/Secure+DataNode for details.\" thrown in apache/hadoop.","triggerScenarios":"Starting a DataNode in a Kerberos-secured cluster without the required principal/keytab, SASL data transfer protection, or a mechanism to bind privileged ports.","commonSituations":"The secure DataNode cannot bind privileged ports or load its keytab. Follow the SecureDataNode guide: configure jsvc or SASL and correct Kerberos settings before startup.","solutions":["Follow the Secure DataNode guide: configure Kerberos principal/keytab (dfs.datanode.kerberos.principal, dfs.datanode.keytab.file) and either SASL (dfs.data.transfer.protection) or privileged ports via jsvc/SecureDataNodeStarter.","If using ports <1024, start the DataNode with jsvc or enable dfs.datanode.use.secure.ports.with.sasl so binding works without root."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}