{"record":{"id":"64b571f10aa05021","repo":"apache/hadoop","slug":"can-t-get-metadata-for-name-from-keystore-pat","errorCode":null,"errorMessage":"Can't get metadata for ${name} from keystore ${path}","messagePattern":"Can't get metadata for (.+?) from keystore (.+?)","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java","lineNumber":419,"sourceCode":"  public Metadata getMetadata(String name) throws IOException {\n    readLock.lock();\n    try {\n      if (cache.containsKey(name)) {\n        return cache.get(name);\n      }\n      try {\n        if (!keyStore.containsAlias(name)) {\n          return null;\n        }\n        Metadata meta = ((KeyMetadata) keyStore.getKey(name, password)).metadata;\n        cache.put(name, meta);\n        return meta;\n      } catch (ClassCastException e) {\n        throw new IOException(\"Can't cast key for \" + name + \" in keystore \" +\n            path + \" to a KeyMetadata. Key may have been added using \" +\n            \" keytool or some other non-Hadoop method.\", e);\n      } catch (KeyStoreException e) {\n        throw new IOException(\"Can't get metadata for \" + name +\n            \" from keystore \" + path, e);\n      } catch (NoSuchAlgorithmException e) {\n        throw new IOException(\"Can't get algorithm for \" + name +\n            \" from keystore \" + path, e);\n      } catch (UnrecoverableKeyException e) {\n        throw new IOException(\"Can't recover key for \" + name +\n            \" from keystore \" + path, e);\n      }\n    } finally {\n      readLock.unlock();\n    }\n  }\n\n  @Override\n  public KeyVersion createKey(String name, byte[] material,\n                               Options options) throws IOException {\n    Preconditions.checkArgument(name.equals(StringUtils.toLowerCase(name)),\n        \"Uppercase key names are unsupported: %s\", name);","sourceCodeStart":401,"sourceCodeEnd":437,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java#L401-L437","documentation":"In getMetadata(), the keystore threw KeyStoreException during containsAlias()/getKey() — the keystore object was never initialized or is in a failed internal state. Wrapped as IOException naming the key and keystore path.","triggerScenarios":"Any metadata-touching operation (getMetadata, createKey pre-checks, rollover, delete) against an uninitialized or broken KeyStore instance — typically after a load failure left the provider half-initialized, or in tests with mock keystores.","commonSituations":"KMS startup after a partially failed keystore load; unit tests mocking KeyStore without init/load; keystore file removed under a running process","solutions":["Restart KMS so the provider performs a full load; a clean load either succeeds or surfaces the real root error (password/format)","Check the keystore file exists and passes keytool -list","Fix or remove stale _NEW/_OLD artifacts per the load-inconsistency guidance"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// Health-check provider before metadata-dependent ops\ntry {\n  provider.getKeys();\n} catch (IOException e) {\n  throw new IllegalStateException(\"Keystore provider unhealthy: \" + e, e);\n}","typeGuard":null,"tryCatchPattern":"try {\n  meta = provider.getMetadata(name);\n} catch (IOException e) {\n  if (e.getCause() instanceof KeyStoreException) {\n    // reload provider (new instance) once; if it persists, restart KMS\n  }\n}","preventionTips":["Recreate provider instances after any keystore file change","Probe with getKeys() at startup to catch half-initialized state early","Avoid swallowing earlier load exceptions — they lead here later"],"tags":["keystore","kms","crypto","metadata","key-lookup"],"backgroundTag":"keystore-metadata-lookup-failed","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}