{"record":{"id":"ddfcc643abf91f8d","repo":"apache/hadoop","slug":"pathname-can-t-be-moved-because-encryption-zon","errorCode":null,"errorMessage":"pathName + \" can't be moved because encryption zone \" + getFullPathName(zoneId) + \" is currently under re-encryption\"","messagePattern":"pathName \\+ \" can't be moved because encryption zone \" \\+ getFullPathName\\(zoneId\\) \\+ \" is currently under re-encryption\"","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/EncryptionZoneManager.java","lineNumber":526,"sourceCode":"      }\n      checkMoveValidityForReencryption(srcIIP.getPath(),\n          srcParentEZI.getINodeId());\n    } else if (dstInEZ) {\n      checkMoveValidityForReencryption(dstIIP.getPath(),\n          dstParentEZI.getINodeId());\n    }\n  }\n\n  private void checkMoveValidityForReencryption(final String pathName,\n      final long zoneId) throws IOException {\n    assert dir.hasReadLock();\n    final ZoneReencryptionStatus zs = reencryptionStatus.getZoneStatus(zoneId);\n    if (zs != null && zs.getState() != ZoneReencryptionStatus.State.Completed) {\n      final StringBuilder sb = new StringBuilder(pathName);\n      sb.append(\" can't be moved because encryption zone \");\n      sb.append(getFullPathName(zoneId));\n      sb.append(\" is currently under re-encryption\");\n      throw new IOException(sb.toString());\n    }\n  }\n\n  /**\n   * Create a new encryption zone.\n   * <p>\n   * Called while holding the FSDirectory lock.\n   */\n  XAttr createEncryptionZone(INodesInPath srcIIP, CipherSuite suite,\n      CryptoProtocolVersion version, String keyName)\n      throws IOException {\n    assert dir.hasWriteLock();\n\n    // Check if src is a valid path for new EZ creation\n    if (srcIIP.getLastINode() == null) {\n      throw new FileNotFoundException(\"cannot find \" + srcIIP.getPath());\n    }\n","sourceCodeStart":508,"sourceCodeEnd":544,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/EncryptionZoneManager.java#L508-L544","documentation":"IOException from EncryptionZoneManager.checkMoveValidityForReencryption: a rename whose parent chains into a zone is blocked while that zone's re-encryption status exists and is not Completed (Submitted or Running). During re-encryption the NameNode tracks files by inode id inside the zone, and renames would desync that bookkeeping, so moves are rejected until the re-encryption finishes.","triggerScenarios":"An admin runs hdfs crypto -reencryptZone -start -path <zone> (key rotation); while the ZoneReencryptionStatus is Submitted/Running, any rename() with src or dst under that zone throws this.","commonSituations":"Key rotation overlapping normal user jobs on a large zone (re-encryption can run for hours/days); a re-encryption submitted and forgotten; scheduled mass-maintenance renames colliding with the security calendar.","solutions":["Check state: hdfs crypto -listReencryptionStatus -- wait until the zone shows Completed, then retry the rename.","If the move is urgent: hdfs crypto -reencryptZone -cancel -path <zone>, wait for the cancellation to settle (status cleared), do the rename, then re-submit -start later.","For big zones, schedule re-encryption during windows when rename-heavy jobs are paused."],"exampleFix":"# before: rename fails -- zone still under re-encryption\nhdfs crypto -listReencryptionStatus          # zone: RUNNING\n# after: wait for completion, or cancel then retry\nhdfs crypto -reencryptZone -cancel -path /secure\nhdfs dfs -mv /secure/a /secure/b             # succeeds once status is cleared","handlingStrategy":"validation","validationCode":"hdfs crypto -listReencryptionStatus\n# any zone whose Status is not Completed will reject renames under it;\n# wait or cancel (-reencryptZone -cancel -path <zone>) before scheduling moves","typeGuard":null,"tryCatchPattern":"try {\n  fs.rename(src, dst);\n} catch (RemoteException re) {\n  IOException e = re.unwrapRemoteException(IOException.class);\n  if (e.getMessage() != null && e.getMessage().contains(\"under re-encryption\")) {\n    // transient: poll hdfs crypto -listReencryptionStatus, retry the rename once Completed\n  } else { throw e; }\n}","preventionTips":["Check zone re-encryption status before scheduling rename-heavy maintenance.","Run re-encryption in windows that do not overlap data-reorganization jobs.","Alert on long-running (possibly stuck) re-encryption states so they do not block moves indefinitely."],"tags":["hdfs","encryption-zone","reencryption","rename","key-rotation"],"backgroundTag":"encryption-zone-reencryption-in-progress","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}