apache/hadoop · error · PathIOException

EncryptionContext not present in GetPathStatus response

Error message

EncryptionContext not present in GetPathStatus response

What it means

The ABFS driver is configured for client-side encryption via an encryption-context provider (fs.azure.encryption.context.provider.type, EncryptionType.ENCRYPTION_CONTEXT). In this mode every file must carry its per-file encryption context, returned by the service in the x-ms-encryption-context response header of GetPathStatus. createEncryptionAdapterFromServerStoreContext builds the decrypting adapter for a path; when that header is null it throws PathIOException, meaning the file at this path was not written with an encryption context.

Solutions

Verify the file was created through the ABFS Hadoop client while the encryption-context provider was configured; externally uploaded files will not have the header.
Re-create or copy the file through the ABFS filesystem with the provider active so x-ms-encryption-context is written.
Confirm the header exists with a raw call: 'az storage fs file show -f <fs> -p <path> --query properties.metadata' or a REST GetPathStatus with header inspection.
For legacy unencrypted data, mount it through a separate filesystem config without the provider; mixing modes on one mount will keep failing.

Defensive patterns

Strategy: try-catch

Try / catch

try {
  fs.open(path);
} catch (PathIOException e) {
  if (e.getMessage().contains("EncryptionContext not present")) {
    // file predates encryption-context enablement: rewrite via ABFS or use an unencrypted mount
  }
}

Prevention

Enable fs.azure.encryption.context.provider.type before any data is written, not after.
Land external data through the encrypted ABFS mount, not AzCopy/SDK directly.
Keep legacy unencrypted data on a separate mount without the provider.

When it happens

Trigger: Any operation that resolves the server-side encryption context for a path (e.g. append/overwrite setup, reads that go through createEncryptionAdapterFromServerStoreContext) while the provider is configured, and the GetPathStatus response for that path lacks x-ms-encryption-context.

Common situations: Enabling fs.azure.encryption.context.provider.type on data written before the setting existed; files uploaded out-of-band through Azure Portal, az cli, or the Storage SDK (which never set x-ms-encryption-context); provider pointed at the wrong account/filesystem.

Related errors

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/52d1a5f7c3ea4db9. Report an issue: GitHub.

Appendix: source

Thrown at hadoop-tools/hadoop-azure/src/main/java/org/apache/hadoop/fs/azurebfs/AzureBlobFileSystemStore.java:603

   *     {@link NoContextEncryptionAdapter}: if encryptionType is not of type
   *     {@link org.apache.hadoop.fs.azurebfs.utils.EncryptionType#ENCRYPTION_CONTEXT}.
   *   </li>
   *   <li>
   *     new object of {@link ContextProviderEncryptionAdapter} containing required encryptionKeys for the give file:
   *     if encryptionType is of type {@link org.apache.hadoop.fs.azurebfs.utils.EncryptionType#ENCRYPTION_CONTEXT}.
   *   </li>
   * </ul>
   */
  private ContextEncryptionAdapter createEncryptionAdapterFromServerStoreContext(final String path,
      final TracingContext tracingContext) throws IOException {
    if (getClient().getEncryptionType() != EncryptionType.ENCRYPTION_CONTEXT) {
      return NoContextEncryptionAdapter.getInstance();
    }
    final String responseHeaderEncryptionContext = getClient().getPathStatus(path,
            false, tracingContext, null).getResult()
        .getResponseHeader(X_MS_ENCRYPTION_CONTEXT);
    if (responseHeaderEncryptionContext == null) {
      throw new PathIOException(path,
          "EncryptionContext not present in GetPathStatus response");
    }
    byte[] encryptionContext = responseHeaderEncryptionContext.getBytes(
        StandardCharsets.UTF_8);

    try {
      return new ContextProviderEncryptionAdapter(getClient().getEncryptionContextProvider(),
          new Path(path).toUri().getPath(), encryptionContext);
    } catch (IOException e) {
      LOG.debug("Could not initialize EncryptionAdapter");
      throw e;
    }
  }

  public void setPathProperties(final Path path,
      final Hashtable<String, String> properties, TracingContext tracingContext)
      throws IOException {
    try (AbfsPerfInfo perfInfo = startTracking("setPathProperties", "setPathProperties")){

View on GitHub (pinned to 2add963021)