{"record":{"id":"001f46c5e4e90912","repo":"dgraph-io/dgraph","slug":"latest-manifest-indicates-the-last-backup-was-encr","errorCode":null,"errorMessage":"latest manifest indicates the last backup was encrypted but this instance has encryption turned off. Try \"forceFull\" flag.","messagePattern":"latest manifest indicates the last backup was encrypted but this instance has encryption turned off\\. Try \"forceFull\" flag\\.","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"worker/backup.go","lineNumber":305,"sourceCode":"\t// To force a full backup we'll set the sinceTs to zero.\n\tif req.ForceFull {\n\t\treq.SinceTs = 0\n\t} else {\n\t\tif err := checkBackupReadTsAdvanced(latestManifest, req.ReadTs); err != nil {\n\t\t\treturn err\n\t\t}\n\n\t\tif x.WorkerConfig.EncryptionKey != nil {\n\t\t\t// If encryption key given, latest backup should be encrypted.\n\t\t\tif latestManifest.Type != \"\" && !latestManifest.Encrypted {\n\t\t\t\terr = errors.Errorf(\"latest manifest indicates the last backup was not encrypted \" +\n\t\t\t\t\t\"but this instance has encryption turned on. Try \\\"forceFull\\\" flag.\")\n\t\t\t\treturn err\n\t\t\t}\n\t\t} else {\n\t\t\t// If encryption turned off, latest backup should be unencrypted.\n\t\t\tif latestManifest.Type != \"\" && latestManifest.Encrypted {\n\t\t\t\terr = errors.Errorf(\"latest manifest indicates the last backup was encrypted \" +\n\t\t\t\t\t\"but this instance has encryption turned off. Try \\\"forceFull\\\" flag.\")\n\t\t\t\treturn err\n\t\t\t}\n\t\t}\n\t}\n\n\t// Update the membership state to get the latest mapping of groups to predicates.\n\tif err := UpdateMembershipState(ctx); err != nil {\n\t\treturn err\n\t}\n\n\t// Get the current membership state and parse it for easier processing.\n\tstate := GetMembershipState()\n\tvar groups []uint32\n\tpredMap := make(map[uint32][]string)\n\tfor gid, group := range state.Groups {\n\t\tgroups = append(groups, gid)\n\t\tpredMap[gid] = make([]string, 0)","sourceCodeStart":287,"sourceCodeEnd":323,"githubUrl":"https://github.com/dgraph-io/dgraph/blob/759e242be62c91f8d084da06ad0c8d21256d9c07/worker/backup.go#L287-L323","documentation":"The mirror case of encryption-on mismatch: when no encryption key is configured (WorkerConfig.EncryptionKey == nil) but the latest backup manifest at the destination shows the last backup WAS encrypted, the backup is rejected. Incremental backups cannot mix encrypted and unencrypted data, so a forceFull backup is required.","triggerScenarios":"Running a backup from an instance without an encryption key to a location whose latest manifest has Type set and Encrypted=true — e.g. encryption was removed from the cluster config but the old encrypted backups still live at the URI.","commonSituations":"Disabling encryption-at-rest in configuration while reusing the previous backup location; migrating backups from an encrypted deployment to an unencrypted one sharing the same URI; key accidentally omitted from the new instance's config.","solutions":["Rerun with the forceFull flag to start a fresh unencrypted full backup","Use a new backup location for the unencrypted cluster","Re-add the encryption key to the instance config if encryption should stay on","Check the manifest at the URI to confirm which encryption state the existing backups use"],"exampleFix":"// before\nreq := &pb.BackupRequest{Location: uri}\n// after\nreq := &pb.BackupRequest{Location: uri, ForceFull: true} // fresh unencrypted full backup","handlingStrategy":"validation","validationCode":"latest, err := GetLatestManifest(handler, uri)\nif err == nil && x.WorkerConfig.EncryptionKey == nil &&\n    latest.Type != \"\" && latest.Encrypted {\n    // plan a forceFull backup to a new location, or re-enable the key\n}","typeGuard":null,"tryCatchPattern":"err := ProcessBackupRequest(ctx, req)\nif err != nil && strings.Contains(err.Error(), \"was encrypted\") {\n    req.ForceFull = true // fresh unencrypted full backup\n    err = ProcessBackupRequest(ctx, req)\n}","preventionTips":["Never disable encryption while reusing the old backup URI; pick a new location","Verify the encryption key is present in the instance config before backups","Keep encryption settings and backup destinations in sync across environments","Check the latest manifest's Encrypted flag before incremental backups"],"tags":["backup","encryption","manifest","configuration"],"backgroundTag":"backup-encryption-state-mismatch","analyzedSha":"759e242be62c91f8d084da06ad0c8d21256d9c07","analyzedAt":"2026-09-01T14:42:12.034Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}