Index: hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/src/main/java/org/apache/hadoop/yarn/server/resourcemanager/rmapp/attempt/RMAppAttemptImpl.java =================================================================== --- hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/src/main/java/org/apache/hadoop/yarn/server/resourcemanager/rmapp/attempt/RMAppAttemptImpl.java (revision 1591866) +++ hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/src/main/java/org/apache/hadoop/yarn/server/resourcemanager/rmapp/attempt/RMAppAttemptImpl.java (working copy) @@ -713,10 +713,14 @@ } if (UserGroupInformation.isSecurityEnabled()) { - byte[] clientTokenMasterKeyBytes = appAttemptTokens.getSecretKey( - RMStateStore.AM_CLIENT_TOKEN_MASTER_KEY_NAME); - clientTokenMasterKey = rmContext.getClientToAMTokenSecretManager() - .registerMasterKey(applicationAttemptId, clientTokenMasterKeyBytes); + byte[] clientTokenMasterKeyBytes = + appAttemptTokens + .getSecretKey(RMStateStore.AM_CLIENT_TOKEN_MASTER_KEY_NAME); + if (clientTokenMasterKeyBytes != null) { + clientTokenMasterKey = + rmContext.getClientToAMTokenSecretManager().registerMasterKey( + applicationAttemptId, clientTokenMasterKeyBytes); + } } // Only one AMRMToken is stored per-attempt, so this should be fine. Can't