{"record":{"id":"9da4911926edadf2","repo":"apache/hadoop","slug":"could-not-parse-encryption-zone-for-inode-iip","errorCode":null,"errorMessage":"\"Could not parse encryption zone for inode \" + iip.getPath()","messagePattern":"\"Could not parse encryption zone for inode \" \\+ iip\\.getPath\\(\\)","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/EncryptionZoneManager.java","lineNumber":427,"sourceCode":"      }\n      if (snapshotID == Snapshot.CURRENT_STATE_ID) {\n        final EncryptionZoneInt ezi = encryptionZones.get(inode.getId());\n        if (ezi != null) {\n          return ezi;\n        }\n      } else {\n        XAttr xAttr = FSDirXAttrOp.unprotectedGetXAttrByPrefixedName(\n            inode, snapshotID, CRYPTO_XATTR_ENCRYPTION_ZONE);\n        if (xAttr != null) {\n          try {\n            final HdfsProtos.ZoneEncryptionInfoProto ezProto =\n                HdfsProtos.ZoneEncryptionInfoProto.parseFrom(xAttr.getValue());\n            return new EncryptionZoneInt(\n                inode.getId(), PBHelperClient.convert(ezProto.getSuite()),\n                PBHelperClient.convert(ezProto.getCryptoProtocolVersion()),\n                ezProto.getKeyName());\n          } catch (InvalidProtocolBufferException e) {\n            throw new IOException(\"Could not parse encryption zone for inode \"\n                + iip.getPath(), e);\n          }\n        }\n      }\n    }\n    return null;\n  }\n\n  /**\n   * Looks up the nearest ancestor EncryptionZoneInt that contains the given\n   * path (excluding itself).\n   * Returns null if path is not within an EZ, or the path is the root dir '/'\n   * <p>\n   * Called while holding the FSDirectory lock.\n   */\n  private EncryptionZoneInt getParentEncryptionZoneForPath(INodesInPath iip)\n      throws  IOException {\n    assert dir.hasReadLock();","sourceCodeStart":409,"sourceCodeEnd":445,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/EncryptionZoneManager.java#L409-L445","documentation":"IOException('Could not parse encryption zone for inode <path>') from EncryptionZoneManager: while resolving an inode's encryption zone (cold path, when the zone is not already in the manager's cache), the raw.hdfs.crypto.encryption.zone xattr was found on the directory but ZoneEncryptionInfoProto.parseFrom() threw InvalidProtocolBufferException. The stored xattr payload is corrupt or was written in a format this NameNode version does not understand.","triggerScenarios":"Any operation under the affected directory that triggers getEncryptionZoneForPath/getPathEncryptionZone (create, rename, listZones rebuild): the xattr bytes are not a valid ZoneEncryptionInfoProto -- e.g., hand-written or legacy-format raw xattr, bit rot, or metadata restored from a mismatched-version backup.","commonSituations":"Upgrade/downgrade across Hadoop versions with encryption zones; someone set raw.* xattrs manually with setfattr; name-dir restored from an inconsistent snapshot; partially written xattr after an old crash.","solutions":["As the HDFS superuser, dump the xattr to confirm corruption: hdfs dfs -getfattr -e hex -n raw.hdfs.crypto.encryption.zone <path> (garbage or empty hex confirms it).","Remove the corrupt xattr and recreate the zone with the same key: hdfs dfs -setfattr -x raw.hdfs.crypto.encryption.zone <path>, then hdfs crypto -createZone -keyName <sameKey> <path>.","If caused by version skew, temporarily run the Hadoop release that wrote the xattr, verify the zone, then complete a supported upgrade path.","Data safety: after recreating the zone, re-encrypt existing files via re-encryption (hdfs crypto -reencryptZone -start -path <zone>) or copy-out/copy-in."],"exampleFix":"# before: every op under /secure fails: Could not parse encryption zone for inode /secure\nhdfs dfs -getfattr -e hex -n raw.hdfs.crypto.encryption.zone /secure   # unreadable hex\n# after: drop the corrupt marker, recreate the zone with the same key\nhdfs dfs -setfattr -x raw.hdfs.crypto.encryption.zone /secure\nhdfs crypto -createZone -keyName mykey /secure","handlingStrategy":"try-catch","validationCode":"# as HDFS superuser: dump the zone xattr and check it is sane hex\nhdfs dfs -getfattr -e hex -n raw.hdfs.crypto.encryption.zone /path\n# empty / non-hex / truncated output predicts the parse failure","typeGuard":null,"tryCatchPattern":"try {\n  fs.create(new Path(\"/secure/f\"));\n} catch (RemoteException re) {\n  IOException e = re.unwrapRemoteException(IOException.class);\n  if (e.getMessage().contains(\"Could not parse encryption zone\")) {\n    // quarantine the subtree: drop raw.hdfs.crypto.encryption.zone on that dir, recreate the zone, re-encrypt\n  } else { throw e; }\n}","preventionTips":["Never set raw.* xattrs by hand; only hdfs crypto tooling owns them.","Upgrade/downgrade through supported release paths; avoid skipping versions on clusters with encryption zones.","Back up the name dir (or run HA) so xattr corruption is restorable.","After any restore, run hdfs crypto -listZones across the tree to catch unparseable zones early."],"tags":["hdfs","encryption-zone","xattr","protobuf","metadata-corruption"],"backgroundTag":"corrupt-xattr-metadata","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}