{"record":{"id":"73aa9ce9dcfd5e66","repo":"apache/hadoop","slug":"key-name-already-exists-in-this","errorCode":null,"errorMessage":"Key ${name} already exists in ${this}","messagePattern":"Key (.+?) already exists in (.+?)","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java","lineNumber":442,"sourceCode":"      } catch (UnrecoverableKeyException e) {\n        throw new IOException(\"Can't recover key for \" + name +\n            \" from keystore \" + path, e);\n      }\n    } finally {\n      readLock.unlock();\n    }\n  }\n\n  @Override\n  public KeyVersion createKey(String name, byte[] material,\n                               Options options) throws IOException {\n    Preconditions.checkArgument(name.equals(StringUtils.toLowerCase(name)),\n        \"Uppercase key names are unsupported: %s\", name);\n    writeLock.lock();\n    try {\n      try {\n        if (keyStore.containsAlias(name) || cache.containsKey(name)) {\n          throw new IOException(\"Key \" + name + \" already exists in \" + this);\n        }\n      } catch (KeyStoreException e) {\n        throw new IOException(\"Problem looking up key \" + name + \" in \" + this,\n            e);\n      }\n      Metadata meta = new Metadata(options.getCipher(), options.getBitLength(),\n          options.getDescription(), options.getAttributes(), new Date(), 1);\n      if (options.getBitLength() != 8 * material.length) {\n        throw new IOException(\"Wrong key length. Required \" +\n            options.getBitLength() + \", but got \" + (8 * material.length));\n      }\n      cache.put(name, meta);\n      String versionName = buildVersionName(name, 0);\n      return innerSetKeyVersion(name, versionName, material, meta.getCipher());\n    } finally {\n      writeLock.unlock();\n    }\n  }","sourceCodeStart":424,"sourceCodeEnd":460,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java#L424-L460","documentation":"createKey() refuses to overwrite: if the alias already exists in the keystore (keyStore.containsAlias) or in the metadata cache, it throws IOException('Key <name> already exists'). Hadoop key versions are append-only; new versions must go through rolloverKey, not createKey.","triggerScenarios":"Calling KeyProvider.createKey(name, ...) / `hadoop key create name` when a key with that name (or an alias matching it) already exists in the JCEKS keystore — including keys created earlier on another KMS host sharing the file, or leftovers from a deleted-then-recreated test flow.","commonSituations":"Re-running a provisioning script after a partial failure; retrying create after a network timeout where the first create actually succeeded; key name collisions across environments sharing one keystore; pre-existing keytool alias with the same name","solutions":["List keys first (hadoop key list -provider ... or provider.getKeys()) and pick a different name if the key should stay","If you intend a new version of the same key, use rolloverKey / `hadoop key roll <name>` instead of create","Delete the old key first (`hadoop key delete <name>`, wait for cache invalidation) and then create — note deletion is irreversible for EZ use","Guard scripts with an existence check before create to make them idempotent"],"exampleFix":"// before\nprovider.createKey(\"mykey\", bytes, options); // Key mykey already exists\n\n// after\nif (provider.getKeys().contains(\"mykey\")) {\n  provider.rollNewVersion(\"mykey\", bytes); // new version of existing key\n} else {\n  provider.createKey(\"mykey\", bytes, options);\n}\nprovider.flush();","handlingStrategy":"validation","validationCode":"// Idempotent key provisioning\nif (provider.getKeys().contains(name)) {\n  if (wantNewVersion) {\n    provider.rollNewVersion(name, material);\n  }\n  // else: key already exists as desired\n} else {\n  provider.createKey(name, material, options);\n}\nprovider.flush();","typeGuard":null,"tryCatchPattern":"try {\n  provider.createKey(name, material, options);\n} catch (IOException e) {\n  if (String.valueOf(e.getMessage()).contains(\"already exists\")) {\n    provider.rollNewVersion(name, material); // intended semantics: new version\n  } else {\n    throw e;\n  }\n}","preventionTips":["Check existence (getKeys) before create in every provisioning script","Use rollNewVersion for new versions; create only for genuinely new names","Make create paths idempotent because timeouts + retries commonly double-create"],"tags":["keystore","kms","crypto","duplicate-key","create-key"],"backgroundTag":"duplicate-key-entry","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}