{"record":{"id":"13634aae5a11d541","repo":"apache/hadoop","slug":"could-not-parse-file-encryption-info-for-inode","errorCode":null,"errorMessage":"\"Could not parse file encryption info for inode \" + iip.getPath()","messagePattern":"\"Could not parse file encryption info for inode \" \\+ iip\\.getPath\\(\\)","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"critical","filePath":"hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSDirEncryptionZoneOp.java","lineNumber":375,"sourceCode":"\n    final XAttr xattr = XAttrHelper\n        .buildXAttr(CRYPTO_XATTR_ENCRYPTION_ZONE, newZoneProto.toByteArray());\n    return xattr;\n  }\n\n  private static ZoneEncryptionInfoProto getZoneEncryptionInfoProto(\n      final INodesInPath iip) throws IOException {\n    final XAttr fileXAttr = FSDirXAttrOp.unprotectedGetXAttrByPrefixedName(\n        iip.getLastINode(), iip.getPathSnapshotId(),\n        CRYPTO_XATTR_ENCRYPTION_ZONE);\n    if (fileXAttr == null) {\n      throw new IOException(\n          \"Could not find reencryption XAttr for file \" + iip.getPath());\n    }\n    try {\n      return ZoneEncryptionInfoProto.parseFrom(fileXAttr.getValue());\n    } catch (InvalidProtocolBufferException e) {\n      throw new IOException(\n          \"Could not parse file encryption info for \" + \"inode \" + iip\n              .getPath(), e);\n    }\n  }\n\n  /**\n   * Save the batch's edeks to file xattrs.\n   */\n  static void saveFileXAttrsForBatch(FSDirectory fsd,\n      List<FileEdekInfo> batch) {\n    assert fsd.getFSNamesystem().hasWriteLock(RwLockMode.FS);\n    if (batch != null && !batch.isEmpty()) {\n      for (FileEdekInfo entry : batch) {\n        final INode inode = fsd.getInode(entry.getInodeId());\n        // no dir lock, so inode could be removed. no-op if so.\n        if (inode == null) {\n          NameNode.LOG.info(\"Cannot find inode {}, skip saving xattr for\"\n              + \" re-encryption\", entry.getInodeId());","sourceCodeStart":357,"sourceCodeEnd":393,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSDirEncryptionZoneOp.java#L357-L393","documentation":"While parsing the zone's encryption xattr, ZoneEncryptionInfoProto.parseFrom threw InvalidProtocolBufferException and it is rethrown as IOException 'Could not parse file encryption info for inode <path>'. The raw bytes stored in the CRYPTO_XATTR_ENCRYPTION_ZONE xattr are not a valid protobuf message — i.e. the zone's encryption metadata is corrupt. It affects reencryption/status updates, which read and rewrite this xattr.","triggerScenarios":"Issuing reencrypt/status operations on a zone whose xattr bytes are malformed: xattr written or truncated by incompatible software, manual xattr edits (setfattr), bit rot on the fsimage/edit containing the xattr, or a downgrade to a Hadoop version with an incompatible ZoneEncryptionInfoProto schema.","commonSituations":"Downgrading or mixing Hadoop versions across an HA pair after zones were created; experiments that wrote the raw xattr manually; rare fsimage corruption after a disk issue. This is abnormal — a healthy cluster never produces this error.","solutions":["Confirm all NameNodes (HA) and clients run one consistent Hadoop version; upgrade-path protobuf changes are a common cause.","Inspect the xattr bytes (hdfs getfattr -d xattr on the zone root, or an fsimage dump via oiv) to see whether the value is empty/truncated/text.","If the zone metadata is unrecoverable, plan a controlled repair: recreate the zone xattr via createEncryptionZone on the same path (after backing up image/edit logs) — accept that existing per-file EDEKs remain tied to the old key version.","Escalate to the Hadoop community (user@hadoop.apache.org) with the oiv output; hand-editing protobuf xattrs is a last resort."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// defensive pre-check before scheduling reencryption: confirm the zone xattr parses\nHdfsAdmin admin = new HdfsAdmin(fs.getUri(), conf);\nEncryptionZone ez = admin.getEncryptionZoneForPath(path); // null/IO failure here already indicates bad zone metadata","typeGuard":null,"tryCatchPattern":"catch (IOException e) {\n  if (e.getMessage() != null && e.getMessage().startsWith(\"Could not parse file encryption info\")) {\n    // do not retry; isolate the zone, capture oiv/fsimage evidence, escalate to admins\n    quarantineZoneAndEscalate(path, e);\n  } else { throw e; }\n}","preventionTips":["Never run mixed Hadoop versions across HA NameNodes; protobuf xattr schemas change between releases.","Never hand-edit raw.* xattrs with setfattr.","Back up fsimage/edits before encryption-zone maintenance so corrupt xattrs are recoverable."],"tags":["hdfs","encryption-zone","xattr","protobuf","corruption","reencryption"],"backgroundTag":"encryption-metadata-corrupt","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}