{"record":{"id":"12f5a31b9152871e","repo":"apache/hadoop","slug":"key-name-not-found","errorCode":null,"errorMessage":"Key ${name} not found","messagePattern":"Key (.+?) not found","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java","lineNumber":515,"sourceCode":"    try {\n      keyStore.setKeyEntry(versionName, new SecretKeySpec(material, cipher),\n          password, null);\n    } catch (KeyStoreException e) {\n      throw new IOException(\"Can't store key \" + versionName + \" in \" + this,\n          e);\n    }\n    changed = true;\n    return new KeyVersion(name, versionName, material);\n  }\n\n  @Override\n  public KeyVersion rollNewVersion(String name,\n                                    byte[] material) throws IOException {\n    writeLock.lock();\n    try {\n      Metadata meta = getMetadata(name);\n      if (meta == null) {\n        throw new IOException(\"Key \" + name + \" not found\");\n      }\n      if (meta.getBitLength() != 8 * material.length) {\n        throw new IOException(\"Wrong key length. Required \" +\n            meta.getBitLength() + \", but got \" + (8 * material.length));\n      }\n      int nextVersion = meta.addVersion();\n      String versionName = buildVersionName(name, nextVersion);\n      return innerSetKeyVersion(name, versionName, material, meta.getCipher());\n    } finally {\n      writeLock.unlock();\n    }\n  }\n\n  @Override\n  public void flush() throws IOException {\n    Path newPath = constructNewPath(path);\n    Path oldPath = constructOldPath(path);\n    Path resetPath = path;","sourceCodeStart":497,"sourceCodeEnd":533,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java#L497-L533","documentation":"JavaKeyStoreProvider.rollNewVersion(name, material) requires an existing key: getMetadata(name) returned null, so there is no Metadata (cipher, bit length, version counter) to attach a new version to, and the call aborts with 'Key <name> not found' before any length check or version increment.","triggerScenarios":"Rolling a version before the key was created; a typo in the key name; the key was deleted by another process; the provider URI points at a different keystore than the one holding the key.","commonSituations":"Automation assuming a key exists on a fresh cluster; key name case mismatch; per-tenant keystores where the wrong tenant store is addressed.","solutions":["Create the key first with createKey (or `hadoop key create`)","Guard with getMetadata(name) != null before rolling","Use the provider instance bound to the keystore that actually stores the key"],"exampleFix":"// before\nprovider.rollNewVersion(name, material);\n\n// after\nif (provider.getMetadata(name) == null) {\n  provider.createKey(name, material, options);\n} else {\n  provider.rollNewVersion(name, material);\n}","handlingStrategy":"validation","validationCode":"if (provider.getMetadata(name) == null) {\n  provider.createKey(name, material, options);\n} else {\n  provider.rollNewVersion(name, material);\n}","typeGuard":null,"tryCatchPattern":"try { provider.rollNewVersion(name, material); } catch (IOException e) { if (String.valueOf(e.getMessage()).endsWith(\"not found\")) { provider.createKey(name, material, options); } else { throw e; } }","preventionTips":["Check getMetadata before rollNewVersion","Create keys as part of environment provisioning","Log the provider URI alongside key operations"],"tags":["java","hadoop","key-provider","not-found","key-management"],"backgroundTag":"key-not-found","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}