{"record":{"id":"5c33e290ae66ec2b","repo":"apache/hadoop","slug":"datanode-denied-communication-with-namenode-becaus-5c33e2","errorCode":null,"errorMessage":"Datanode denied communication with namenode because the host is not in the include-list: {nodeReg}","messagePattern":"Datanode denied communication with namenode because the host is not in the include-list: (.+?)","errorType":"exception","errorClass":"DisallowedDatanodeException","httpStatus":null,"severity":"error","filePath":"hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/blockmanagement/DatanodeManager.java","lineNumber":1214,"sourceCode":"        // Reject registration of unresolved datanode to prevent performance\n        // impact of repetitive DNS lookups later.\n        final String message = \"hostname cannot be resolved (ip=\"\n            + ip + \", hostname=\" + hostname + \")\";\n        LOG.warn(\"Unresolved datanode registration: \" + message);\n        throw new DisallowedDatanodeException(nodeReg, message);\n      }\n      // update node registration with the ip and hostname from rpc request\n      nodeReg.setIpAddr(ip);\n      nodeReg.setPeerHostName(hostname);\n    }\n    \n    try {\n      nodeReg.setExportedKeys(blockManager.getBlockKeys());\n  \n      // Checks if the node is not on the hosts list.  If it is not, then\n      // it will be disallowed from registering. \n      if (!hostConfigManager.isIncluded(nodeReg)) {\n        throw new DisallowedDatanodeException(nodeReg);\n      }\n        \n      NameNode.stateChangeLog.info(\"BLOCK* registerDatanode: from \"\n          + nodeReg + \" storage \" + nodeReg.getDatanodeUuid());\n  \n      DatanodeDescriptor nodeS = getDatanode(nodeReg.getDatanodeUuid());\n      DatanodeDescriptor nodeN = host2DatanodeMap.getDatanodeByXferAddr(\n          nodeReg.getIpAddr(), nodeReg.getXferPort());\n        \n      if (nodeN != null && nodeN != nodeS) {\n        NameNode.LOG.info(\"BLOCK* registerDatanode: \" + nodeN);\n        // nodeN previously served a different data storage, \n        // which is not served by anybody anymore.\n        removeDatanode(nodeN);\n        // physically remove node from datanodeMap\n        wipeDatanode(nodeN);\n        nodeN = null;\n      }","sourceCodeStart":1196,"sourceCodeEnd":1232,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/blockmanagement/DatanodeManager.java#L1196-L1232","documentation":"Thrown as DisallowedDatanodeException from DatanodeManager.registerDatanode when hostConfigManager.isIncluded(nodeReg) returns false: the datanode's address is not in the include list, so the NameNode refuses registration entirely. This is the hosts-exclusion enforcement point for the classic include/exclude files (dfs.hosts / dfs.hosts.exclude) or the JsonServiceFile-based host configuration.","triggerScenarios":"Datanode starts and registers while its host is absent from dfs.hosts include file (when include-list enforcement is enabled), or it is present only in dfs.hosts.exclude; after editing host files without `hdfs dfsadmin -refreshNodes`, or when DNS/hostname normalization makes the node not match an entry.","commonSituations":"First-time cluster bring-up without dfs.hosts configured correctly; adding a new DN without updating the include file; hostname vs IP mismatch in the files; decommission config left over excluding the node.","solutions":["Add the datanode (as it reports itself, typically host:transferPort or IP) to the dfs.hosts include file","Run `hdfs dfsadmin -refreshNodes` on the NameNode and then restart/re-register the datanode (`hdfs --daemon restart datanode`)","If the node should be decommissioned, this denial is intended — retire the DN","Check exact matching: use the same hostname form the DN registers with (verify in DN log 'banner' / nodeReg toString)"],"exampleFix":"# before: DN not in include list\n# NN log: Datanode denied communication with namenode: not in include-list\n\n# after: allow the node\necho 'dn5.example.com:9866' >> /etc/hadoop/dfs.hosts\nhdfs dfsadmin -refreshNodes\nhdfs --daemon restart datanode","handlingStrategy":"validation","validationCode":"// Ops pre-check: is the DN in the include list before starting it?\nString inc = conf.get(\"dfs.hosts\");\nString entry = \"dn5.example.com:9866\";\nboolean included = Files.readAllLines(Paths.get(inc)).stream()\n    .map(String::trim).filter(s -> !s.isEmpty() && !s.startsWith(\"#\"))\n    .anyMatch(l -> l.equals(entry) || l.split(\":\")[0].equals(entry.split(\":\")[0]));\nif (!included) { /* add entry + refreshNodes before starting the DN */ }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Update dfs.hosts before adding nodes; run `hdfs dfsadmin -refreshNodes` immediately after","Use the exact hostname:port form the DN registers with","Automate include-list updates in node provisioning","Read the denied nodeReg string in the NN log to see the exact unmatched identity"],"tags":["hdfs","datanode-registration","include-list","access-control","configuration","decommission"],"backgroundTag":"node-not-in-allowlist","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}