{"record":{"id":"dd27bac96f3542fd","repo":"apache/hadoop","slug":"can-t-get-key-versionname-from-path","errorCode":null,"errorMessage":"Can't get key ${versionName} from ${path}","messagePattern":"Can't get key (.+?) from (.+?)","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java","lineNumber":338,"sourceCode":"\n  @Override\n  public String noPasswordError() {\n    return ProviderUtils.noPasswordError(KEYSTORE_PASSWORD_ENV_VAR,\n        KEYSTORE_PASSWORD_FILE_KEY);\n  }\n\n  @Override\n  public KeyVersion getKeyVersion(String versionName) throws IOException {\n    readLock.lock();\n    try {\n      SecretKeySpec key = null;\n      try {\n        if (!keyStore.containsAlias(versionName)) {\n          return null;\n        }\n        key = (SecretKeySpec) keyStore.getKey(versionName, password);\n      } catch (KeyStoreException e) {\n        throw new IOException(\"Can't get key \" + versionName + \" from \" +\n                              path, e);\n      } catch (NoSuchAlgorithmException e) {\n        throw new IOException(\"Can't get algorithm for key \" + key + \" from \" +\n                              path, e);\n      } catch (UnrecoverableKeyException e) {\n        throw new IOException(\"Can't recover key \" + key + \" from \" + path, e);\n      }\n      return new KeyVersion(getBaseName(versionName), versionName, key.getEncoded());\n    } finally {\n      readLock.unlock();\n    }\n  }\n\n  @Override\n  public List<String> getKeys() throws IOException {\n    readLock.lock();\n    try {\n      ArrayList<String> list = new ArrayList<String>();","sourceCodeStart":320,"sourceCodeEnd":356,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java#L320-L356","documentation":"getKeyVersion() looks up a key version by alias in the JCEKS keystore. The keystore threw KeyStoreException during containsAlias()/getKey() — typically meaning the keystore object was never initialized or is in a bad internal state. Wrapped as IOException with the version name and keystore path.","triggerScenarios":"Calling KeyProvider.getKeyVersion(versionName) when the underlying KeyStore is uninitialized or internally inconsistent — rare after a successful load, more common in tests using mock/uninitialized providers, or when the keystore file was swapped underneath a live provider instance.","commonSituations":"Unit tests with partially mocked keystores; the keystore file replaced on disk while KMS held an old handle; provider state corruption after a failed flush","solutions":["Restart KMS so the provider reloads the keystore cleanly","Check keystore health with keytool -list; repair from _OLD backup if damaged","In tests, fully initialize the keystore (load a real jceks file) instead of mocking the KeyStore object"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Check alias presence before fetching a version\nif (!kp.getKeys().contains(baseName(versionName))) {\n  return null; // key absent, avoid lookup failure\n}","typeGuard":null,"tryCatchPattern":"try {\n  KeyVersion kv = provider.getKeyVersion(versionName);\n} catch (IOException e) {\n  Throwable c = e.getCause();\n  if (c instanceof KeyStoreException) {\n    // keystore state broken: restart/reload provider rather than retry\n  }\n}","preventionTips":["Restart KMS after keystore repairs instead of reusing live provider handles","Back tests with real keystore files","Treat KeyStoreException-rooted failures as state errors, not transient ones — do not blind-retry"],"tags":["keystore","kms","crypto","key-lookup"],"backgroundTag":"keystore-key-lookup-failed","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}