{"record":{"id":"bf1c86a0c720d8be","repo":"apache/hadoop","slug":"can-not-have-both-provision-trash-and-no-trash-fla","errorCode":null,"errorMessage":"can not have both PROVISION_TRASH and NO_TRASH flags","messagePattern":"can not have both PROVISION_TRASH and NO_TRASH flags","errorType":"validation","errorClass":"HadoopIllegalArgumentException","httpStatus":null,"severity":"error","filePath":"hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/client/HdfsAdmin.java","lineNumber":346,"sourceCode":"   * specified using {@link CreateEncryptionZoneFlag} flags.\n   *\n   * @param path    The path of the root of the encryption zone. Must refer to\n   *                an empty, existing directory.\n   * @param keyName Name of key available at the KeyProvider.\n   * @param flags   flags for this operation.\n   * @throws IOException            if there was a general IO exception\n   * @throws AccessControlException if the caller does not have access to path\n   * @throws FileNotFoundException  if the path does not exist\n   * @throws HadoopIllegalArgumentException if the flags are invalid\n   */\n  public void createEncryptionZone(Path path, String keyName,\n      EnumSet<CreateEncryptionZoneFlag> flags)\n      throws IOException, AccessControlException, FileNotFoundException,\n      HadoopIllegalArgumentException{\n    dfs.createEncryptionZone(path, keyName);\n    if (flags.contains(CreateEncryptionZoneFlag.PROVISION_TRASH)) {\n      if (flags.contains(CreateEncryptionZoneFlag.NO_TRASH)) {\n        throw new HadoopIllegalArgumentException(\n            \"can not have both PROVISION_TRASH and NO_TRASH flags\");\n      }\n      dfs.provisionEZTrash(path, TRASH_PERMISSION);\n    }\n  }\n\n  /**\n   * Provision a trash directory for a given encryption zone.\n\n   * @param path the root of the encryption zone\n   * @throws IOException if the trash directory can not be created.\n   */\n  public void provisionEncryptionZoneTrash(Path path) throws IOException {\n    dfs.provisionEZTrash(path, TRASH_PERMISSION);\n  }\n\n  /**\n   * Get the path of the encryption zone for a given file or directory.","sourceCodeStart":328,"sourceCodeEnd":364,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/client/HdfsAdmin.java#L328-L364","documentation":"HdfsAdmin.createEncryptionZone(path, keyName, flags) treats PROVISION_TRASH (create the zone's .Trash immediately) and NO_TRASH (explicitly skip trash provisioning) as mutually exclusive and throws HadoopIllegalArgumentException when both are set. Important side effect: dfs.createEncryptionZone(path, keyName) has already executed before the flag check, so on this throw the zone exists but its trash was neither provisioned nor explicitly suppressed.","triggerScenarios":"Calling createEncryptionZone(path, key, EnumSet.of(CreateEncryptionZoneFlag.PROVISION_TRASH, CreateEncryptionZoneFlag.NO_TRASH)).","commonSituations":"Admin UIs or scripts that copy user checkboxes straight into the EnumSet; refactors that accumulate flags from several sources into one set; misunderstanding NO_TRASH as 'do not auto-create but still allowed'.","solutions":["Pass exactly one of PROVISION_TRASH or NO_TRASH (or an empty set for default behavior).","Validate the flag set before the call so the zone is not left half-configured.","If you already hit this: the encryption zone was created — either provision trash manually (provisionEZTrash) or delete and recreate the zone with correct flags."],"exampleFix":"// before\nEnumSet<CreateEncryptionZoneFlag> flags =\n    EnumSet.of(CreateEncryptionZoneFlag.PROVISION_TRASH,\n               CreateEncryptionZoneFlag.NO_TRASH);\nadmin.createEncryptionZone(zonePath, keyName, flags);\n\n// after\nadmin.createEncryptionZone(zonePath, keyName,\n    EnumSet.of(CreateEncryptionZoneFlag.PROVISION_TRASH));","handlingStrategy":"validation","validationCode":"if (flags.contains(CreateEncryptionZoneFlag.PROVISION_TRASH)\n    && flags.contains(CreateEncryptionZoneFlag.NO_TRASH)) {\n  // validate BEFORE the call: the zone is created before the server checks flags\n  throw new IllegalArgumentException(\n      \"PROVISION_TRASH and NO_TRASH are mutually exclusive\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate the flag set before calling — the zone is already created when this throws, leaving trash unprovisioned.","Model the choice as a single enum (NONE/PROVISION/SKIP) in your tooling instead of two booleans.","After catching this error, decide explicitly: provision trash manually or drop and recreate the zone."],"tags":["hdfs","encryption-zone","validation","flags"],"backgroundTag":"mutually-exclusive-flags","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}