diff --git a/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt b/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt
index 95da136e525..e68aec2f79d 100644
--- a/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt
+++ b/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt
@@ -474,6 +474,8 @@ Release 2.7.0 - UNRELEASED
     HDFS-7543. Avoid path resolution when getting FileStatus for audit logs.
     (wheat9)
 
+    HDFS-7530. Allow renaming of encryption zone roots. (Charles Lamb via wang)
+
   OPTIMIZATIONS
 
     HDFS-7454. Reduce memory footprint for AclEntries in NameNode.
diff --git a/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/EncryptionZoneManager.java b/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/EncryptionZoneManager.java
index 5c4f39d1233..3fe748d0eb9 100644
--- a/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/EncryptionZoneManager.java
+++ b/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/EncryptionZoneManager.java
@@ -249,6 +249,10 @@ void checkMoveValidity(INodesInPath srcIIP, INodesInPath dstIIP, String src)
     final boolean dstInEZ = (dstEZI != null);
     if (srcInEZ) {
       if (!dstInEZ) {
+        if (srcEZI.getINodeId() == srcIIP.getLastINode().getId()) {
+          // src is ez root and dest is not in an ez. Allow the rename.
+          return;
+        }
         throw new IOException(
             src + " can't be moved from an encryption zone.");
       }
diff --git a/hadoop-hdfs-project/hadoop-hdfs/src/test/java/org/apache/hadoop/hdfs/TestEncryptionZones.java b/hadoop-hdfs-project/hadoop-hdfs/src/test/java/org/apache/hadoop/hdfs/TestEncryptionZones.java
index cc00055c34a..13eb4cf97e0 100644
--- a/hadoop-hdfs-project/hadoop-hdfs/src/test/java/org/apache/hadoop/hdfs/TestEncryptionZones.java
+++ b/hadoop-hdfs-project/hadoop-hdfs/src/test/java/org/apache/hadoop/hdfs/TestEncryptionZones.java
@@ -538,6 +538,19 @@ private void doRenameEncryptionZone(FSTestWrapper wrapper) throws Exception {
         !wrapper.exists(pathFooBaz) && wrapper.exists(pathFooBar));
     assertEquals("Renamed file contents not the same",
         contents, DFSTestUtil.readFile(fs, pathFooBarFile));
+
+    // Verify that we can rename an EZ root
+    final Path newFoo = new Path(testRoot, "newfoo");
+    assertTrue("Rename of EZ root", fs.rename(pathFoo, newFoo));
+    assertTrue("Rename of EZ root failed",
+        !wrapper.exists(pathFoo) && wrapper.exists(newFoo));
+
+    // Verify that we can't rename an EZ root onto itself
+    try {
+      wrapper.rename(newFoo, newFoo);
+    } catch (IOException e) {
+      assertExceptionContains("are the same", e);
+    }
   }
 
   @Test(timeout = 60000)
diff --git a/hadoop-hdfs-project/hadoop-hdfs/src/test/resources/testCryptoConf.xml b/hadoop-hdfs-project/hadoop-hdfs/src/test/resources/testCryptoConf.xml
index ebbf773b133..89c93e26b1c 100644
--- a/hadoop-hdfs-project/hadoop-hdfs/src/test/resources/testCryptoConf.xml
+++ b/hadoop-hdfs-project/hadoop-hdfs/src/test/resources/testCryptoConf.xml
@@ -238,13 +238,35 @@
     </test>
 
     <test>
-      <description>Test failure of renaming a non-EZ file from an EZ</description>
+        <description>Test failure of renaming an EZ file into a non-EZ</description>
+        <test-commands>
+            <command>-fs NAMENODE -mkdir /src</command>
+            <command>-fs NAMENODE -mkdir /dst</command>
+            <command>-fs NAMENODE -ls /</command>-
+            <crypto-admin-command>-createZone -path /src -keyName myKey</crypto-admin-command>
+            <command>-fs NAMENODE -touchz /src/foo</command>
+            <command>-fs NAMENODE -mv /src/foo /dst</command>-
+        </test-commands>
+        <cleanup-commands>
+            <command>-fs NAMENODE -rm /src/foo</command>
+            <command>-fs NAMENODE -rmdir /src</command>
+            <command>-fs NAMENODE -rmdir /dst</command>
+        </cleanup-commands>
+        <comparators>
+            <comparator>
+                <type>SubstringComparator</type>
+                <expected-output>/src/foo can't be moved from an encryption zone.</expected-output>
+            </comparator>
+        </comparators>
+    </test>
+
+    <test>
+      <description>Test success of renaming an EZ root</description>
       <test-commands>
         <command>-fs NAMENODE -mkdir /src</command>
-        <command>-fs NAMENODE -mkdir /dst</command>
-        <command>-fs NAMENODE -ls /</command>-
         <crypto-admin-command>-createZone -path /src -keyName myKey</crypto-admin-command>
         <command>-fs NAMENODE -mv /src /dst</command>-
+        <command>-fs NAMENODE -ls /</command>-
       </test-commands>
       <cleanup-commands>
         <command>-fs NAMENODE -rmdir /src</command>
@@ -253,7 +275,7 @@
       <comparators>
         <comparator>
           <type>SubstringComparator</type>
-          <expected-output>/src can't be moved from an encryption zone</expected-output>
+          <expected-output>/dst</expected-output>
         </comparator>
       </comparators>
     </test>