apache/hadoop · error · IOException

"Directory " + srcIIP.getPath() + " is already an encryption

Error message

"Directory " + srcIIP.getPath() + " is already an encryption zone."

What it means

IOException('Directory <path> is already an encryption zone.') from createEncryptionZone: the encryptionZones map already contains the target inode id, i.e., this exact directory already carries an encryption-zone marker. Re-creating (or re-keying by re-creating) a zone on the same directory is not supported; nested zones beneath it are fine, but the same dir cannot be zoned twice.

Source

Thrown at hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/EncryptionZoneManager.java:552

   */
  XAttr createEncryptionZone(INodesInPath srcIIP, CipherSuite suite,
      CryptoProtocolVersion version, String keyName)
      throws IOException {
    assert dir.hasWriteLock();

    // Check if src is a valid path for new EZ creation
    if (srcIIP.getLastINode() == null) {
      throw new FileNotFoundException("cannot find " + srcIIP.getPath());
    }

    INode srcINode = srcIIP.getLastINode();
    if (!srcINode.isDirectory()) {
      throw new IOException("Attempt to create an encryption zone for a file.");
    }

    if (hasCreatedEncryptionZone() && encryptionZones.
        get(srcINode.getId()) != null) {
      throw new IOException(
          "Directory " + srcIIP.getPath() + " is already an encryption zone.");
    }

    if (dir.isNonEmptyDirectory(srcIIP)) {
      throw new IOException(
          "Attempt to create an encryption zone for a non-empty directory.");
    }
    final HdfsProtos.ZoneEncryptionInfoProto proto =
        PBHelperClient.convert(suite, version, keyName);
    final XAttr ezXAttr = XAttrHelper
        .buildXAttr(CRYPTO_XATTR_ENCRYPTION_ZONE, proto.toByteArray());

    final List<XAttr> xattrs = Lists.newArrayListWithCapacity(1);
    xattrs.add(ezXAttr);
    // updating the xattr will call addEncryptionZone,
    // done this way to handle edit log loading
    FSDirXAttrOp.unprotectedSetXAttrs(dir, srcIIP, xattrs,
                                      EnumSet.of(XAttrSetFlag.CREATE));

View on GitHub (pinned to 2add963021)

Solutions

Confirm existing zone and key: hdfs crypto -listZones | grep <path>; keep using it if the key is right.
To change which key protects the data, create the new-key zone on a new empty directory and copy data into it (zones cannot be re-keyed in place); to rotate the key version, use KMS key rotation + hdfs crypto -reencryptZone -start -path <zone>.
Make provisioning idempotent: check getEncryptionZoneForPath(path) equals path before calling createZone.

Example fix

# before
hdfs crypto -createZone -keyName keyA /secure
hdfs crypto -createZone -keyName keyB /secure   # -> already an encryption zone
# after: rotate via re-encryption with the new key version, not by re-creating
hdfs crypto -listZones | grep /secure
hdfs crypto -reencryptZone -start -path /secure   # after KMS keyB rollover

Defensive patterns

Strategy: validation

Validate before calling

EncryptionZone ez = dfs.getEncryptionZoneForPath(zonePath);
if (ez != null && ez.getPath().equals(zonePath)) {
  // already a zone: skip creation, or rotate keys via -reencryptZone instead
}

Try / catch

try {
  dfs.createEncryptionZone(dir, key);
} catch (RemoteException re) {
  IOException e = re.unwrapRemoteException(IOException.class);
  if (e.getMessage().contains("already an encryption zone")) { /* keep existing zone */ }
  else { throw e; }
}

Prevention

Make zone provisioning idempotent: check hdfs crypto -listZones / getEncryptionZoneForPath first.
To change protection, use KMS key rotation + hdfs crypto -reencryptZone; never try to re-create the zone over data.
Document which key each zone uses so operators are not tempted to recreate zones.

When it happens

Trigger: hdfs crypto -createZone -keyName <otherKey> <path> run a second time on a directory that is already a zone -- typically while trying to change the zone's key; automation re-runs that do not check prior state.

Common situations: Attempts to rotate a zone's key by recreating the zone (the supported way is hdfs crypto -reencryptZone after the KMS key version changes); re-run of provisioning playbooks; copy-paste operations.

Related errors

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/7905b8044e9fb180. Report an issue: GitHub.