{"record":{"id":"3227f15b428cebcc","repo":"apache/hadoop","slug":"file-doesn-t-have-encryptioncontext","errorCode":null,"errorMessage":"File doesn't have encryptionContext.","messagePattern":"File doesn't have encryptionContext\\.","errorType":"exception","errorClass":"PathIOException","httpStatus":null,"severity":"error","filePath":"hadoop-tools/hadoop-azure/src/main/java/org/apache/hadoop/fs/azurebfs/AzureBlobFileSystemStore.java","lineNumber":1132,"sourceCode":"      final long contentLength = extractContentLength(op.getResult());\n      final long offset = overwrite ? 0 : contentLength;\n\n      perfInfo.registerSuccess(true);\n\n      boolean isAppendBlob = false;\n      if (isAppendBlobKey(path.toString())) {\n        isAppendBlob = true;\n      }\n\n      AbfsLease lease = maybeCreateLease(relativePath, tracingContext);\n      final String eTag = extractEtagHeader(op.getResult());\n      final ContextEncryptionAdapter contextEncryptionAdapter;\n      if (writeClient.getEncryptionType() == EncryptionType.ENCRYPTION_CONTEXT) {\n        final String encryptionContext = op.getResult()\n            .getResponseHeader(\n                HttpHeaderConfigurations.X_MS_ENCRYPTION_CONTEXT);\n        if (encryptionContext == null) {\n          throw new PathIOException(path.toString(),\n              \"File doesn't have encryptionContext.\");\n        }\n        contextEncryptionAdapter = new ContextProviderEncryptionAdapter(\n            writeClient.getEncryptionContextProvider(), getRelativePath(path),\n            encryptionContext.getBytes(StandardCharsets.UTF_8));\n      } else {\n        contextEncryptionAdapter = NoContextEncryptionAdapter.getInstance();\n      }\n\n      return new AbfsOutputStream(\n          populateAbfsOutputStreamContext(\n              isAppendBlob,\n              lease,\n              getClientHandler(),\n              statistics,\n              relativePath,\n              offset,\n              eTag,","sourceCodeStart":1114,"sourceCodeEnd":1150,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-tools/hadoop-azure/src/main/java/org/apache/hadoop/fs/azurebfs/AzureBlobFileSystemStore.java#L1114-L1150","documentation":"Write-path sibling of the GetPathStatus encryption-context checks. In openFileForWrite, when the client's EncryptionType is ENCRYPTION_CONTEXT, the existing file must return x-ms-encryption-context on its status call so a ContextProviderEncryptionAdapter can be built for append/in-place write. A null header throws PathIOException 'File doesn't have encryptionContext.'","triggerScenarios":"fs.append(path) or create(path, overwrite=false) in ENCRYPTION_CONTEXT mode on an existing file that lacks the encryption-context header (written pre-encryption or by external tools).","commonSituations":"Appending to logs/outputs written before the encryption-context provider was enabled; appending to files landed by AzCopy/SDK; provider rollout to existing data lakes.","solutions":["Create with overwrite=true instead of append - the fresh file is written with a new encryption context under the configured provider.","If append semantics are required, first copy the file through the encrypted ABFS mount (read+rewrite) so it gains the context, then append.","Verify with a raw GetPathStatus whether x-ms-encryption-context exists before assuming provider misconfiguration.","Keep unencrypted legacy files on a mount without fs.azure.encryption.context.provider.type."],"exampleFix":"// before - append fails on pre-encryption file\ntry (FSDataOutputStream out = fs.append(path)) { ... }\n\n// after - rewrite the file via the encrypted mount, then append\ntry (FSDataInputStream in = fs.open(path);\n     FSDataOutputStream out = fs.create(path, true)) {\n  IOUtils.copyBytes(in, out, 4 << 20, false);\n}\ntry (FSDataOutputStream out = fs.append(path)) { ... }","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  out = fs.append(path);\n} catch (PathIOException e) {\n  if (e.getMessage().contains(\"encryptionContext\")) {\n    // file lacks x-ms-encryption-context: create(path, true) to rewrite with a fresh context\n  }\n}","preventionTips":["Do not append to files that predate encryption-context enablement.","When both append and overwrite are acceptable on encrypted mounts, prefer create(overwrite=true).","Validate append targets came from the same encrypted pipeline."],"tags":["azure","abfs","encryption","append","client-side-encryption"],"backgroundTag":"encryption-context-missing","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}