{"record":{"id":"fd105930dcc31c07","repo":"apache/hadoop","slug":"can-t-create-an-encryption-zone-for-src-s","errorCode":null,"errorMessage":"\"Can't create an encryption zone for \" + src + \" since no key provider is available.\"","messagePattern":"\"Can't create an encryption zone for \" \\+ src \\+ \" since no key provider is available\\.\"","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSDirEncryptionZoneOp.java","lineNumber":118,"sourceCode":"          public EncryptedKeyVersion run() throws IOException {\n            try {\n              return fsd.getProvider().generateEncryptedKey(ezKeyName);\n            } catch (GeneralSecurityException e) {\n              throw new IOException(e);\n            }\n          }\n        });\n    long generateEDEKTime = monotonicNow() - generateEDEKStartTime;\n    NameNode.getNameNodeMetrics().addGenerateEDEKTime(generateEDEKTime);\n    Preconditions.checkNotNull(edek);\n    return edek;\n  }\n\n  static KeyProvider.Metadata ensureKeyIsInitialized(final FSDirectory fsd,\n      final String keyName, final String src) throws IOException {\n    KeyProviderCryptoExtension provider = fsd.getProvider();\n    if (provider == null) {\n      throw new IOException(\"Can't create an encryption zone for \" + src\n          + \" since no key provider is available.\");\n    }\n    if (keyName == null || keyName.isEmpty()) {\n      throw new IOException(\"Must specify a key name when creating an \"\n          + \"encryption zone\");\n    }\n    EncryptionFaultInjector.getInstance().ensureKeyIsInitialized();\n    KeyProvider.Metadata metadata = provider.getMetadata(keyName);\n    if (metadata == null) {\n      /*\n       * It would be nice if we threw something more specific than\n       * IOException when the key is not found, but the KeyProvider API\n       * doesn't provide for that. If that API is ever changed to throw\n       * something more specific (e.g. UnknownKeyException) then we can\n       * update this to match it, or better yet, just rethrow the\n       * KeyProvider's exception.\n       */\n      throw new IOException(\"Key \" + keyName + \" doesn't exist.\");","sourceCodeStart":100,"sourceCodeEnd":136,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSDirEncryptionZoneOp.java#L100-L136","documentation":"Creating an encryption zone requires a KeyProvider on the NameNode: FSDirEncryptionZoneOp.ensureKeyIsInitialized reads fsd.getProvider() and throws IOException when it is null. The provider is built from the key provider URI configuration (hadoop.security.key.provider.path, or dfs.encryption.key.provider.uri), so a null provider means the NameNode was never given (or could not build) a KMS address. Without a provider the NameNode cannot validate keys or generate EDEKs, so all zone creation stops here.","triggerScenarios":"Running 'hdfs crypto -createZone -key <k> -path <p>' or HdfsAdmin.createEncryptionZone before configuring the KMS provider URI in the NameNode's core-site.xml; pointing the URI at a KMS that failed to start (provider construction fails, FSDirectory ends up with null); adding the property to the client's config only.","commonSituations":"First-time HDFS TDE setup where KMS is installed but the URI property was added to hdfs-site.xml of the client or omitted entirely; config management (Ansible/Chef) rolling out the property to data nodes but not the NameNode; KMS HA URI typo so provider initialization fails silently at NN boot.","solutions":["Set hadoop.security.key.provider.path (core-site.xml) on the NameNode to the KMS URI, e.g. kms://https@kms-host:9600/kms, and restart the NameNode.","Verify the KMS is actually serving (curl the KMS endpoint / check kms.log) — a dead KMS makes provider construction fail the same way.","Confirm the property is in the NameNode's effective config, not just the client's (hdfs getconf -confKey hadoop.security.key.provider.path against the NN).","For HA KMS use kms://https@HOST1;HOST2:9600/kms and check hadoop.kms.authentication settings."],"exampleFix":"# before (no provider configured)\nhdfs crypto -createZone -key mykey -path /secure  # -> IOException: no key provider available\n\n# after (NameNode core-site.xml, then restart NameNode)\n<property>\n  <name>hadoop.security.key.provider.path</name>\n  <value>kms://https@kms1.example.com:9600/kms</value>\n</property>","handlingStrategy":"validation","validationCode":"String providerUri = conf.get(\"hadoop.security.key.provider.path\",\n    conf.get(\"dfs.encryption.key.provider.uri\"));\nif (providerUri == null) {\n  throw new IllegalStateException(\n      \"No KMS key provider configured for the NameNode; cannot create encryption zones\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  admin.createEncryptionZone(path, keyName);\n} catch (IOException e) {\n  if (e.getMessage() != null && e.getMessage().contains(\"no key provider\")) {\n    throw new IllegalStateException(\n        \"Configure hadoop.security.key.provider.path on the NameNode (KMS URI) and restart it\", e);\n  }\n  throw e;\n}","preventionTips":["Configure the KMS provider URI in the NameNode's core-site.xml (hadoop.security.key.provider.path) before enabling TDE.","Verify with 'hdfs getconf -confKey hadoop.security.key.provider.path' against the NameNode, not just locally.","Health-check the KMS service (port 9600 / kms.log) as part of cluster smoke tests after config changes."],"tags":["hdfs","encryption-zone","kms","key-provider","configuration"],"backgroundTag":"key-provider-not-configured","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}