{"record":{"id":"e6316106f6eeb0c4","repo":"apache/hadoop","slug":"no-key-provider-configured-re-encryption-operatio-e63161","errorCode":null,"errorMessage":"No key provider configured, re-encryption operation is rejected","messagePattern":"No key provider configured, re-encryption operation is rejected","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSNamesystem.java","lineNumber":8380,"sourceCode":"    checkSuperuserPrivilege(operationName, dir.rootDir.getFullPathName());\n    readLock(RwLockMode.FS);\n    try {\n      checkOperation(OperationCategory.READ);\n      final BatchedListEntries<ZoneReencryptionStatus> ret =\n          FSDirEncryptionZoneOp.listReencryptionStatus(dir, prevId);\n      success = true;\n      return ret;\n    } finally {\n      readUnlock(RwLockMode.FS, operationName, getLockReportInfoSupplier(null));\n      logAuditEvent(success, operationName, null);\n    }\n  }\n\n  private void reencryptEncryptionZoneInt(final FSPermissionChecker pc,\n      final String zone, final ReencryptAction action,\n      final boolean logRetryCache) throws IOException {\n    if (getProvider() == null) {\n      throw new IOException(\"No key provider configured, re-encryption \"\n          + \"operation is rejected\");\n    }\n    String keyVersionName = null;\n    if (action == ReencryptAction.START) {\n      // get zone's latest key version name out of the lock.\n      keyVersionName =\n          FSDirEncryptionZoneOp.getCurrentKeyVersion(dir, pc, zone);\n      if (keyVersionName == null) {\n        throw new IOException(\"Failed to get key version name for \" + zone);\n      }\n      LOG.info(\"Re-encryption using key version \" + keyVersionName\n          + \" for zone \" + zone);\n    }\n    writeLock(RwLockMode.FS);\n    try {\n      checkOperation(OperationCategory.WRITE);\n      checkNameNodeSafeMode(\"NameNode in safemode, cannot \" + action\n          + \" re-encryption on zone \" + zone);","sourceCodeStart":8362,"sourceCodeEnd":8398,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSNamesystem.java#L8362-L8398","documentation":"Error \"No key provider configured, re-encryption operation is rejected\" thrown in apache/hadoop.","triggerScenarios":"An admin submits an encryption zone re-encryption command but no KMS/key provider is configured.","commonSituations":"Running 'hdfs crypto -reencryptZone' on a cluster without hadoop.security.key.provider.path set.","solutions":["Configure a key provider via hadoop.security.key.provider.path (KMS) in core-site.xml before running re-encryption operations."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}