apache/hadoop · error · PathIOException

EncryptionContext not present in GetPathStatus response

Error message

EncryptionContext not present in GetPathStatus response

What it means

The ABFS driver is configured for client-side encryption via an encryption-context provider (fs.azure.encryption.context.provider.type, EncryptionType.ENCRYPTION_CONTEXT). In this mode every file must carry its per-file encryption context, returned by the service in the x-ms-encryption-context response header of GetPathStatus. createEncryptionAdapterFromServerStoreContext builds the decrypting adapter for a path; when that header is null it throws PathIOException, meaning the file at this path was not written with an encryption context.

Source

Thrown at hadoop-tools/hadoop-azure/src/main/java/org/apache/hadoop/fs/azurebfs/AzureBlobFileSystemStore.java:603

   *     {@link NoContextEncryptionAdapter}: if encryptionType is not of type
   *     {@link org.apache.hadoop.fs.azurebfs.utils.EncryptionType#ENCRYPTION_CONTEXT}.
   *   </li>
   *   <li>
   *     new object of {@link ContextProviderEncryptionAdapter} containing required encryptionKeys for the give file:
   *     if encryptionType is of type {@link org.apache.hadoop.fs.azurebfs.utils.EncryptionType#ENCRYPTION_CONTEXT}.
   *   </li>
   * </ul>
   */
  private ContextEncryptionAdapter createEncryptionAdapterFromServerStoreContext(final String path,
      final TracingContext tracingContext) throws IOException {
    if (getClient().getEncryptionType() != EncryptionType.ENCRYPTION_CONTEXT) {
      return NoContextEncryptionAdapter.getInstance();
    }
    final String responseHeaderEncryptionContext = getClient().getPathStatus(path,
            false, tracingContext, null).getResult()
        .getResponseHeader(X_MS_ENCRYPTION_CONTEXT);
    if (responseHeaderEncryptionContext == null) {
      throw new PathIOException(path,
          "EncryptionContext not present in GetPathStatus response");
    }
    byte[] encryptionContext = responseHeaderEncryptionContext.getBytes(
        StandardCharsets.UTF_8);

    try {
      return new ContextProviderEncryptionAdapter(getClient().getEncryptionContextProvider(),
          new Path(path).toUri().getPath(), encryptionContext);
    } catch (IOException e) {
      LOG.debug("Could not initialize EncryptionAdapter");
      throw e;
    }
  }

  public void setPathProperties(final Path path,
      final Hashtable<String, String> properties, TracingContext tracingContext)
      throws IOException {
    try (AbfsPerfInfo perfInfo = startTracking("setPathProperties", "setPathProperties")){

View on GitHub (pinned to 2add963021)

Solutions

Verify the file was created through the ABFS Hadoop client while the encryption-context provider was configured; externally uploaded files will not have the header.
Re-create or copy the file through the ABFS filesystem with the provider active so x-ms-encryption-context is written.
Confirm the header exists with a raw call: 'az storage fs file show -f <fs> -p <path> --query properties.metadata' or a REST GetPathStatus with header inspection.
For legacy unencrypted data, mount it through a separate filesystem config without the provider; mixing modes on one mount will keep failing.

Defensive patterns

Strategy: try-catch

Try / catch

try {
  fs.open(path);
} catch (PathIOException e) {
  if (e.getMessage().contains("EncryptionContext not present")) {
    // file predates encryption-context enablement: rewrite via ABFS or use an unencrypted mount
  }
}

Prevention

Enable fs.azure.encryption.context.provider.type before any data is written, not after.
Land external data through the encrypted ABFS mount, not AzCopy/SDK directly.
Keep legacy unencrypted data on a separate mount without the provider.

When it happens

Trigger: Any operation that resolves the server-side encryption context for a path (e.g. append/overwrite setup, reads that go through createEncryptionAdapterFromServerStoreContext) while the provider is configured, and the GetPathStatus response for that path lacks x-ms-encryption-context.

Common situations: Enabling fs.azure.encryption.context.provider.type on data written before the setting existed; files uploaded out-of-band through Azure Portal, az cli, or the Storage SDK (which never set x-ms-encryption-context); provider pointed at the wrong account/filesystem.

Related errors

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/52d1a5f7c3ea4db9. Report an issue: GitHub.