apache/hadoop · error · HadoopIllegalArgumentException

can not have both PROVISION_TRASH and NO_TRASH flags

Error message

can not have both PROVISION_TRASH and NO_TRASH flags

What it means

HdfsAdmin.createEncryptionZone(path, keyName, flags) treats PROVISION_TRASH (create the zone's .Trash immediately) and NO_TRASH (explicitly skip trash provisioning) as mutually exclusive and throws HadoopIllegalArgumentException when both are set. Important side effect: dfs.createEncryptionZone(path, keyName) has already executed before the flag check, so on this throw the zone exists but its trash was neither provisioned nor explicitly suppressed.

Solutions

Pass exactly one of PROVISION_TRASH or NO_TRASH (or an empty set for default behavior).
Validate the flag set before the call so the zone is not left half-configured.
If you already hit this: the encryption zone was created — either provision trash manually (provisionEZTrash) or delete and recreate the zone with correct flags.

Example fix

// before
EnumSet<CreateEncryptionZoneFlag> flags =
    EnumSet.of(CreateEncryptionZoneFlag.PROVISION_TRASH,
               CreateEncryptionZoneFlag.NO_TRASH);
admin.createEncryptionZone(zonePath, keyName, flags);

// after
admin.createEncryptionZone(zonePath, keyName,
    EnumSet.of(CreateEncryptionZoneFlag.PROVISION_TRASH));

Defensive patterns

Strategy: validation

Validate before calling

if (flags.contains(CreateEncryptionZoneFlag.PROVISION_TRASH)
    && flags.contains(CreateEncryptionZoneFlag.NO_TRASH)) {
  // validate BEFORE the call: the zone is created before the server checks flags
  throw new IllegalArgumentException(
      "PROVISION_TRASH and NO_TRASH are mutually exclusive");
}

Prevention

Validate the flag set before calling — the zone is already created when this throws, leaving trash unprovisioned.
Model the choice as a single enum (NONE/PROVISION/SKIP) in your tooling instead of two booleans.
After catching this error, decide explicitly: provision trash manually or drop and recreate the zone.

When it happens

Trigger: Calling createEncryptionZone(path, key, EnumSet.of(CreateEncryptionZoneFlag.PROVISION_TRASH, CreateEncryptionZoneFlag.NO_TRASH)).

Common situations: Admin UIs or scripts that copy user checkboxes straight into the EnumSet; refactors that accumulate flags from several sources into one set; misunderstanding NO_TRASH as 'do not auto-create but still allowed'.

Understand the failure class

Background: "mutually exclusive" flag errors: what "can't supply both nx and xx", "--raw is not compatible with -i" and "cannot be used with" mean, and how to fix them — this error's family across 29 libraries.

Related errors

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/bf1c86a0c720d8be. Report an issue: GitHub.

Appendix: source

Thrown at hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/client/HdfsAdmin.java:346

   * specified using {@link CreateEncryptionZoneFlag} flags.
   *
   * @param path    The path of the root of the encryption zone. Must refer to
   *                an empty, existing directory.
   * @param keyName Name of key available at the KeyProvider.
   * @param flags   flags for this operation.
   * @throws IOException            if there was a general IO exception
   * @throws AccessControlException if the caller does not have access to path
   * @throws FileNotFoundException  if the path does not exist
   * @throws HadoopIllegalArgumentException if the flags are invalid
   */
  public void createEncryptionZone(Path path, String keyName,
      EnumSet<CreateEncryptionZoneFlag> flags)
      throws IOException, AccessControlException, FileNotFoundException,
      HadoopIllegalArgumentException{
    dfs.createEncryptionZone(path, keyName);
    if (flags.contains(CreateEncryptionZoneFlag.PROVISION_TRASH)) {
      if (flags.contains(CreateEncryptionZoneFlag.NO_TRASH)) {
        throw new HadoopIllegalArgumentException(
            "can not have both PROVISION_TRASH and NO_TRASH flags");
      }
      dfs.provisionEZTrash(path, TRASH_PERMISSION);
    }
  }

  /**
   * Provision a trash directory for a given encryption zone.

   * @param path the root of the encryption zone
   * @throws IOException if the trash directory can not be created.
   */
  public void provisionEncryptionZoneTrash(Path path) throws IOException {
    dfs.provisionEZTrash(path, TRASH_PERMISSION);
  }

  /**
   * Get the path of the encryption zone for a given file or directory.

View on GitHub (pinned to 2add963021)