{"record":{"id":"7905b8044e9fb180","repo":"apache/hadoop","slug":"directory-srciip-getpath-is-already-an","errorCode":null,"errorMessage":"\"Directory \" + srcIIP.getPath() + \" is already an encryption zone.\"","messagePattern":"\"Directory \" \\+ srcIIP\\.getPath\\(\\) \\+ \" is already an encryption zone\\.\"","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/EncryptionZoneManager.java","lineNumber":552,"sourceCode":"   */\n  XAttr createEncryptionZone(INodesInPath srcIIP, CipherSuite suite,\n      CryptoProtocolVersion version, String keyName)\n      throws IOException {\n    assert dir.hasWriteLock();\n\n    // Check if src is a valid path for new EZ creation\n    if (srcIIP.getLastINode() == null) {\n      throw new FileNotFoundException(\"cannot find \" + srcIIP.getPath());\n    }\n\n    INode srcINode = srcIIP.getLastINode();\n    if (!srcINode.isDirectory()) {\n      throw new IOException(\"Attempt to create an encryption zone for a file.\");\n    }\n\n    if (hasCreatedEncryptionZone() && encryptionZones.\n        get(srcINode.getId()) != null) {\n      throw new IOException(\n          \"Directory \" + srcIIP.getPath() + \" is already an encryption zone.\");\n    }\n\n    if (dir.isNonEmptyDirectory(srcIIP)) {\n      throw new IOException(\n          \"Attempt to create an encryption zone for a non-empty directory.\");\n    }\n    final HdfsProtos.ZoneEncryptionInfoProto proto =\n        PBHelperClient.convert(suite, version, keyName);\n    final XAttr ezXAttr = XAttrHelper\n        .buildXAttr(CRYPTO_XATTR_ENCRYPTION_ZONE, proto.toByteArray());\n\n    final List<XAttr> xattrs = Lists.newArrayListWithCapacity(1);\n    xattrs.add(ezXAttr);\n    // updating the xattr will call addEncryptionZone,\n    // done this way to handle edit log loading\n    FSDirXAttrOp.unprotectedSetXAttrs(dir, srcIIP, xattrs,\n                                      EnumSet.of(XAttrSetFlag.CREATE));","sourceCodeStart":534,"sourceCodeEnd":570,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/EncryptionZoneManager.java#L534-L570","documentation":"IOException('Directory <path> is already an encryption zone.') from createEncryptionZone: the encryptionZones map already contains the target inode id, i.e., this exact directory already carries an encryption-zone marker. Re-creating (or re-keying by re-creating) a zone on the same directory is not supported; nested zones beneath it are fine, but the same dir cannot be zoned twice.","triggerScenarios":"hdfs crypto -createZone -keyName <otherKey> <path> run a second time on a directory that is already a zone -- typically while trying to change the zone's key; automation re-runs that do not check prior state.","commonSituations":"Attempts to rotate a zone's key by recreating the zone (the supported way is hdfs crypto -reencryptZone after the KMS key version changes); re-run of provisioning playbooks; copy-paste operations.","solutions":["Confirm existing zone and key: hdfs crypto -listZones | grep <path>; keep using it if the key is right.","To change which key protects the data, create the new-key zone on a new empty directory and copy data into it (zones cannot be re-keyed in place); to rotate the key version, use KMS key rotation + hdfs crypto -reencryptZone -start -path <zone>.","Make provisioning idempotent: check getEncryptionZoneForPath(path) equals path before calling createZone."],"exampleFix":"# before\nhdfs crypto -createZone -keyName keyA /secure\nhdfs crypto -createZone -keyName keyB /secure   # -> already an encryption zone\n# after: rotate via re-encryption with the new key version, not by re-creating\nhdfs crypto -listZones | grep /secure\nhdfs crypto -reencryptZone -start -path /secure   # after KMS keyB rollover","handlingStrategy":"validation","validationCode":"EncryptionZone ez = dfs.getEncryptionZoneForPath(zonePath);\nif (ez != null && ez.getPath().equals(zonePath)) {\n  // already a zone: skip creation, or rotate keys via -reencryptZone instead\n}","typeGuard":null,"tryCatchPattern":"try {\n  dfs.createEncryptionZone(dir, key);\n} catch (RemoteException re) {\n  IOException e = re.unwrapRemoteException(IOException.class);\n  if (e.getMessage().contains(\"already an encryption zone\")) { /* keep existing zone */ }\n  else { throw e; }\n}","preventionTips":["Make zone provisioning idempotent: check hdfs crypto -listZones / getEncryptionZoneForPath first.","To change protection, use KMS key rotation + hdfs crypto -reencryptZone; never try to re-create the zone over data.","Document which key each zone uses so operators are not tempted to recreate zones."],"tags":["hdfs","encryption-zone","already-exists","key-management"],"backgroundTag":"already-exists","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}