apache/hadoop · error · UnsupportedOperationException

removeDefaultAcl is only supported by storage accounts with

Error message

removeDefaultAcl is only supported by storage accounts with the hierarchical namespace enabled.

What it means

Thrown by AzureBlobFileSystem.removeDefaultAcl when the storage account does not have the hierarchical namespace enabled. Default (inheritable) ACLs only exist on HNS accounts; the driver rejects the operation client-side on flat accounts. It takes only a path, so on HNS accounts the call always proceeds to the service.

Source

Thrown at hadoop-tools/hadoop-azure/src/main/java/org/apache/hadoop/fs/azurebfs/AzureBlobFileSystem.java:1326

      checkException(path, ex);
    }
  }

  /**
   * Removes all default ACL entries from files and directories.
   *
   * @param path Path to modify
   * @throws IOException if an ACL could not be modified
   */
  @Override
  public void removeDefaultAcl(final Path path) throws IOException {
    LOG.debug("AzureBlobFileSystem.removeDefaultAcl path: {}", path);
    TracingContext tracingContext = new TracingContext(clientCorrelationId,
        fileSystemId, FSOperationType.REMOVE_DEFAULT_ACL, true,
        tracingHeaderFormat, listener);

    if (!getIsNamespaceEnabled(tracingContext)) {
      throw new UnsupportedOperationException(
          "removeDefaultAcl is only supported by storage accounts with the "
              + "hierarchical namespace enabled.");
    }

    Path qualifiedPath = makeQualified(path);

    try {
      getAbfsStore().removeDefaultAcl(qualifiedPath, tracingContext);
    } catch (AzureBlobFileSystemException ex) {
      checkException(path, ex);
    }
  }

  /**
   * Removes all but the base ACL entries of files and directories.  The entries
   * for user, group, and others are retained for compatibility with permission
   * bits.
   *

View on GitHub (pinned to 2add963021)

Solutions

Use an HNS-enabled account when default ACL management is required.
Guard the call with capability detection (try/catch UnsupportedOperationException).
Make the ACL-cleanup step conditional on filesystem type in job configuration.

Example fix

// before
fs.removeDefaultAcl(path);

// after
try {
  fs.removeDefaultAcl(path);
} catch (UnsupportedOperationException e) {
  LOG.debug("Default ACLs unsupported on this account: {}", path);
}

Defensive patterns

Strategy: try-catch

Validate before calling

static boolean isAclCapable(FileSystem fs) {
  try {
    fs.getAclStatus(new Path("/"));
    return true;
  } catch (UnsupportedOperationException e) {
    return false;
  } catch (IOException e) {
    return true;
  }
}

Try / catch

try {
  fs.removeDefaultAcl(path);
} catch (UnsupportedOperationException e) {
  LOG.debug("default ACLs unsupported without HNS: {}", path);
}

Prevention

Make default-ACL cleanup conditional on namespace capability.
Document the HNS requirement in tooling that walks directories.
Probe capability once and reuse the result for the whole job.

When it happens

Trigger: Calling fs.removeDefaultAcl(path) against a non-HNS storage account.

Common situations: Directory-permission normalization jobs that clear default ACLs on trees; tools ported from HDFS that assume default ACL support everywhere; misconfigured account scheme or endpoint.

Related errors

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/48486fc7bfc05b9c. Report an issue: GitHub.