{"record":{"id":"5acbd96939fca4c3","repo":"apache/hadoop","slug":"incompatible-encryptionsecrets-version-versionid","errorCode":null,"errorMessage":"Incompatible EncryptionSecrets version: {versionId}","messagePattern":"Incompatible EncryptionSecrets version: (.+?)","errorType":"exception","errorClass":"DelegationTokenIOException","httpStatus":null,"severity":"error","filePath":"hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/auth/delegation/EncryptionSecrets.java","lineNumber":188,"sourceCode":"   * After reading, call {@link #init()}.\n   * @param in {@code DataInput} to deserialize this object from.\n   * @throws IOException failure to read/validate data.\n   */\n  @Override\n  public void readFields(final DataInput in) throws IOException {\n    final LongWritable version = new LongWritable();\n    version.readFields(in);\n    boolean readContext;\n\n    final long versionId = version.get();\n    if (versionId == SERIAL_VERSION_UID_1) {\n      LOG.info(\"Unmarshalling Encryption Secrets from older client; \"\n          + \"setting encryption context to \\\"\\\"\");\n      readContext = false;\n    } else if (versionId == serialVersionUID) {\n      readContext = true;\n    } else {\n      throw new DelegationTokenIOException(\n          \"Incompatible EncryptionSecrets version: \" + versionId);\n    }\n    encryptionAlgorithm = Text.readString(in, MAX_SECRET_LENGTH);\n    encryptionKey = Text.readString(in, MAX_SECRET_LENGTH);\n    if (readContext) {\n      encryptionContext = Text.readString(in);\n    } else {\n      encryptionContext = DEFAULT_S3_ENCRYPTION_CONTEXT;\n    }\n    init();\n  }\n\n  /**\n   * For java serialization: read and then call {@link #init()}.\n   * @param in input\n   * @throws IOException IO problem\n   * @throws ClassNotFoundException problem loading inner class.\n   */","sourceCodeStart":170,"sourceCodeEnd":206,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/auth/delegation/EncryptionSecrets.java#L170-L206","documentation":"EncryptionSecrets embeds the SSE key material inside S3A delegation tokens and prefixes its serialized form with a version stamp. readFields accepts only SERIAL_VERSION_UID_1 (legacy, no encryption context) and the current serialVersionUID; any other leading long is treated as an incompatible format and throws DelegationTokenIOException 'Incompatible EncryptionSecrets version'. This is a wire-format guard, not a data error.","triggerScenarios":"A delegation token issued by a hadoop-aws build whose EncryptionSecrets serialVersionUID differs from the decoding build is decoded during token binding. The version long read from the token bytes matches neither known version.","commonSituations":"Rolling upgrades where executors run a different Hadoop patch line than the service that issued tokens; long-lived tokens surviving a cluster upgrade; mixed-version distros in one workflow.","solutions":["Re-issue delegation tokens after upgrading so all tokens use the current format","Run issuer and consumers on the same hadoop-aws version (at least for delegation-token compatibility)","During rolling upgrades, expire old tokens before switching traffic to the new version"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// no pre-check possible from token bytes alone; version is opaque until decode.\n// Mitigate by comparing hadoop-aws versions before accepting a token:\nString issuerVersion = tokenConf.get(\"hadoop.build.version\"); // recorded at issue time if available\nif (!VersionInfo.getVersion().equals(issuerVersion)) {\n  LOG.warn(\"Token from hadoop {} decoded by {}; re-fetch if decode fails\", issuerVersion, VersionInfo.getVersion());\n}","typeGuard":null,"tryCatchPattern":"try {\n  tokens.bindToAnyDelegationToken();\n} catch (DelegationTokenIOException e) {\n  if (e.getMessage().contains(\"Incompatible EncryptionSecrets version\")) {\n    // version skew: discard token and re-authenticate directly\n    credentials.removeAllTokens();\n    deployUnbondedAndProceed();\n  } else {\n    throw e;\n  }\n}","preventionTips":["Pin one hadoop-aws version across the workflow during token lifetimes","Expire delegation tokens before rolling upgrades complete","Treat 'Incompatible ... version' as a deployment problem, not a data problem"],"tags":["aws","s3a","delegation-token","serialization","version-skew","encryption"],"backgroundTag":"serialization-version-mismatch","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}