[jira] [Created] (HADOOP-19665) [kms] Negative hadoop.security.kms.client.encrypted.key.cache.expiry causes KMSClientProvider init failure with generic IllegalArgumentException; improve validation message and docs

["AMC-team (Jira)" <ji...@apache.org>]

AMC-team created HADOOP-19665:
---------------------------------

             Summary: [kms] Negative hadoop.security.kms.client.encrypted.key.cache.expiry causes KMSClientProvider init failure with generic IllegalArgumentException; improve validation message and docs
                 Key: HADOOP-19665
                 URL: https://issues.apache.org/jira/browse/HADOOP-19665
             Project: Hadoop Common
          Issue Type: Improvement
          Components: kms
    Affects Versions: 2.8.5
            Reporter: AMC-team
         Attachments: kms_expiry_from_token_lifetime.patch

When the client-side config hadoop.security.kms.client.encrypted.key.cache.expiry is set to a negative value in core-site.xml, any tool that initializes KMSClientProvider (e.g., KeyShell) fails immediately with:

{code:java}
java.lang.IllegalArgumentException: expiry must be > 0
    at org.apache.hadoop.crypto.key.kms.ValueQueue.<init>(ValueQueue.java:xxx)
    at org.apache.hadoop.crypto.key.kms.KMSClientProvider.<init>(KMSClientProvider.java:xxx)
    ...

{code}

This is a controlled failure (JVM doesn’t crash), but the error message does not mention which property and what value triggered it. Users typically see a stack trace without a clear remediation hint.

*Expected behavior*

Fail fast with a clear configuration error that names the property and value, e.g.:
Invalid configuration: hadoop.security.kms.client.encrypted.key.cache.expiry = -1 (must be > 0 ms)

*Steps to Reproduce*
1. In the client core-site.xml, set:

{code:xml}
<property>
  <name>hadoop.security.kms.client.encrypted.key.cache.expiry</name>
  <value>-1</value>
</property>
{code}
2. Ensure the conf is active (echo $HADOOP_CONF_DIR points to this dir).
3. Run:

{code:java}
./bin/hadoop key list -provider kms://http@localhost:9600/kms -metadata
{code}




--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: common-dev-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-dev-help@hadoop.apache.org