{"record":{"id":"f798770266a01669","repo":"apache/hadoop","slug":"can-t-set-metadata-key-entry-getkey","errorCode":null,"errorMessage":"Can't set metadata key ${entry.getKey()}","messagePattern":"Can't set metadata key (.+?)","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java","lineNumber":556,"sourceCode":"      }\n      // Might exist if a backup has been restored etc.\n      try {\n        renameOrFail(newPath, new Path(newPath.toString()\n            + \"_ORPHANED_\" + System.currentTimeMillis()));\n      } catch (FileNotFoundException ignored) {\n      }\n      try {\n        renameOrFail(oldPath, new Path(oldPath.toString()\n            + \"_ORPHANED_\" + System.currentTimeMillis()));\n      } catch (FileNotFoundException ignored) {\n      }\n      // put all of the updates into the keystore\n      for(Map.Entry<String, Metadata> entry: cache.entrySet()) {\n        try {\n          keyStore.setKeyEntry(entry.getKey(), new KeyMetadata(entry.getValue()),\n              password, null);\n        } catch (KeyStoreException e) {\n          throw new IOException(\"Can't set metadata key \" + entry.getKey(),e );\n        }\n      }\n\n      // Save old File first\n      boolean fileExisted = backupToOld(oldPath);\n      if (fileExisted) {\n        resetPath = oldPath;\n      }\n      // write out the keystore\n      // Write to _NEW path first :\n      try {\n        writeToNew(newPath);\n      } catch (IOException ioe) {\n        // rename _OLD back to curent and throw Exception\n        revertFromOld(oldPath, fileExisted);\n        resetPath = path;\n        throw ioe;\n      }","sourceCodeStart":538,"sourceCodeEnd":574,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java#L538-L574","documentation":"During flush(), every entry in the metadata cache is written back into the keystore as a KeyMetadata password entry via setKeyEntry; if any of those writes throws KeyStoreException, flush aborts with 'Can't set metadata key <name>'. At this stage nothing has been committed to disk yet (the file write happens later), so the on-disk store is unchanged but in-memory updates go unsaved.","triggerScenarios":"Keystore loaded in a degraded or corrupt state; a security-provider configuration that rejects the entry; the keystore file replaced underneath by a concurrent writer since load.","commonSituations":"Two daemons flushing the same jceks file; disk corruption; JVM security configuration changed under a long-lived process.","solutions":["Verify the keystore loads and lists cleanly (`hadoop key list -provider <uri>`)","Clear stale *_NEW/_OLD artifacts from an interrupted flush, then retry flush","Enforce single-writer access per keystore file","Restore the keystore from backup if the store itself is damaged"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { provider.flush(); } catch (IOException e) { if (String.valueOf(e.getMessage()).startsWith(\"Can't set metadata key\")) { // store-level fault: alert, verify store health; on-disk state unchanged, safe to retry after repair } else { throw e; } }","preventionTips":["Treat flush failures as unsaved state: retry after fixing the store","Keep keystore backups","Serialize flush across processes sharing a keystore","Alert on any keystore-wrapped IOException, not just fatals"],"tags":["java","hadoop","keystore","key-provider","flush"],"backgroundTag":"keystore-operation-failed","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}