What causes ""cannot find " + srcIIP.getPath()" in apache/hadoop?

Create the directory first: hdfs dfs -mkdir -p , then hdfs crypto -createZone -keyName .

apache/hadoop · error · FileNotFoundException

"cannot find " + srcIIP.getPath()

Error message

"cannot find " + srcIIP.getPath()

What it means

FileNotFoundException('cannot find <path>') from EncryptionZoneManager.createEncryptionZone: the INodesInPath resolved for the createZone request has no last inode, i.e., the path does not exist in the namespace. The zone target must be an existing directory before it can be marked as an encryption zone.

Source

Thrown at hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/EncryptionZoneManager.java:542

      sb.append(getFullPathName(zoneId));
      sb.append(" is currently under re-encryption");
      throw new IOException(sb.toString());
    }
  }

  /**
   * Create a new encryption zone.
   * <p>
   * Called while holding the FSDirectory lock.
   */
  XAttr createEncryptionZone(INodesInPath srcIIP, CipherSuite suite,
      CryptoProtocolVersion version, String keyName)
      throws IOException {
    assert dir.hasWriteLock();

    // Check if src is a valid path for new EZ creation
    if (srcIIP.getLastINode() == null) {
      throw new FileNotFoundException("cannot find " + srcIIP.getPath());
    }

    INode srcINode = srcIIP.getLastINode();
    if (!srcINode.isDirectory()) {
      throw new IOException("Attempt to create an encryption zone for a file.");
    }

    if (hasCreatedEncryptionZone() && encryptionZones.
        get(srcINode.getId()) != null) {
      throw new IOException(
          "Directory " + srcIIP.getPath() + " is already an encryption zone.");
    }

    if (dir.isNonEmptyDirectory(srcIIP)) {
      throw new IOException(
          "Attempt to create an encryption zone for a non-empty directory.");
    }
    final HdfsProtos.ZoneEncryptionInfoProto proto =

View on GitHub (pinned to 2add963021)

Solutions

Create the directory first: hdfs dfs -mkdir -p <path>, then hdfs crypto -createZone -keyName <key> <path>.
Fix the typo/verify existence with hdfs dfs -test -d <path> before creating the zone.
In provisioning code, make zone creation idempotent: check existence and zone status first.

Example fix

# before
hdfs crypto -createZone -keyName mykey /projets/secure   # typo, path missing
# after
hdfs dfs -mkdir -p /projects/secure
hdfs crypto -createZone -keyName mykey /projects/secure

Defensive patterns

Strategy: validation

Validate before calling

if (!fs.exists(zonePath)) {
  fs.mkdirs(zonePath);              // zone target must exist first
}
hdfs crypto -createZone -keyName key zonePath

Try / catch

try {
  dfs.createEncryptionZone(dir, key);
} catch (RemoteException re) {
  IOException e = re.unwrapRemoteException(FileNotFoundException.class);
  // create the directory (mkdirs) and retry once
}

Prevention

Always mkdir -p before hdfs crypto -createZone in scripts.
Verify paths with hdfs dfs -test -d during provisioning.
Make zone provisioning idempotent: exists() check + zone-membership check + create.

When it happens

Trigger: hdfs crypto -createZone -keyName <key> <path> (or the equivalent createEncryptionZone API) where <path> was never created, has a typo, or a parent component is missing.

Common situations: Automation/provisioning scripts that call createZone before mkdir; typos in long paths; races where the mkdir step failed earlier in the script.

Related errors

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/700141d14644db3e. Report an issue: GitHub.