apache/hadoop · error · AccessControlException

The operation is not allowed because there are mount points:

Error message

The operation is not allowed because there are mount points: {} under the path: {}

What it means

Thrown by RouterRpcServer.getLocationsForPath(path, failIfLocked=true) in HDFS Router-Based Federation (RBF) when the target path is itself a mount point (empty mount-point list) or has other mount points nested underneath it. The Router forwards operations to a single subcluster, so an operation that would partially apply to a subtree spanning multiple mount points is rejected with an AccessControlException that names the conflicting mount points. This guard is used by operations that must act atomically on one namespace, e.g. rename, setQuota/unsetQuota, and the snapshot commands.

Source

Thrown at hadoop-hdfs-project/hadoop-hdfs-rbf/src/main/java/org/apache/hadoop/hdfs/server/federation/router/RouterRpcServer.java:2177

    try {
      if (failIfLocked) {
        // check if there is any mount point under the path
        final List<String> mountPoints =
            this.subclusterResolver.getMountPoints(path);
        if (mountPoints != null) {
          StringBuilder sb = new StringBuilder();
          sb.append("The operation is not allowed because ");
          if (mountPoints.isEmpty()) {
            sb.append("the path: ")
                .append(path)
                .append(" is a mount point");
          } else {
            sb.append("there are mount points: ")
                .append(String.join(",", mountPoints))
                .append(" under the path: ")
                .append(path);
          }
          throw new AccessControlException(sb.toString());
        }
      }

      // Check the location for this path
      final PathLocation location =
          this.subclusterResolver.getDestinationForPath(path);
      if (location == null) {
        throw new NoLocationException(path, this.subclusterResolver.getClass());
      }

      // We may block some write operations
      if (opCategory.get() == OperationCategory.WRITE) {
        // Check if the path is in a read only mount point
        if (isPathReadOnly(path)) {
          if (this.rpcMonitor != null) {
            this.rpcMonitor.routerFailureReadOnly();
          }
          throw new IOException(path + " is in a read only mount point");

View on GitHub (pinned to 2add963021)

Solutions

Restructure the mount table so the operation target no longer contains nested mount points (move or remove the child entry with hdfs dfsrouteradmin -rm, then hdfs dfsrouteradmin -refresh)
Run the operation on each affected subcluster directly against the underlying NameNode instead of through the Router
For quotas use Router-based quotas (hdfs dfsrouteradmin quota commands) rather than per-NameNode setQuota on paths spanning mounts
Verify the actual layout with hdfs dfsrouteradmin -ls <path> and retry against a narrower path that stays inside one mount

Defensive patterns

Strategy: try-catch

Validate before calling

// Before rename/quota/snapshot via Router, check for nested mounts:
// (admin side) hdfs dfsrouteradmin -ls /parent
// shows child mount entries under the path -> operation will fail.

Try / catch

try {
  dfs.rename(src, dst);
} catch (AccessControlException e) {
  if (e.getMessage().contains("mount points")) {
    // path crosses mount boundaries: split the operation per subcluster
    // or restructure the mount table
  } else { throw e; }
}

Prevention

Keep mount-table subtrees free of nested mounts for directories that receive tree-wide admin operations
Document which paths are mount roots so operators avoid rename/setQuota across them
In automation, probe hdfs dfsrouteradmin -ls <path> before issuing quota or snapshot commands through the Router

When it happens

Trigger: Calling rename where src or dst subtree contains a nested mount point; hdfs dfsadmin -setQuota/-clrQuota through the Router on a directory that is or contains a mount point; allowSnapshot/createSnapshot/renameSnapshot/deleteSnapshot on a snapshot root whose tree contains mount points; any Router RPC path that invokes getLocationsForPath(src, true).

Common situations: Mount table defines /data plus a more specific /data/cold entry and an admin tries to rename or set quota on /data; a default '/' mount coexists with child mounts and tree-wide operations hit the children; users treat the Router as if it were a single NameNode supporting cross-mount operations.

Related errors

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/f20a7f5f51e86a45. Report an issue: GitHub.