{"record":{"id":"2e962a54c160be83","repo":"dgraph-io/dgraph","slug":"latest-manifest-indicates-the-last-backup-was-not","errorCode":null,"errorMessage":"latest manifest indicates the last backup was not encrypted but this instance has encryption turned on. Try \"forceFull\" flag.","messagePattern":"latest manifest indicates the last backup was not encrypted but this instance has encryption turned on\\. Try \"forceFull\" flag\\.","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"worker/backup.go","lineNumber":298,"sourceCode":"\t}\n\tlatestManifest, err := GetLatestManifest(handler, uri)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\treq.SinceTs = latestManifest.ValidReadTs()\n\t// To force a full backup we'll set the sinceTs to zero.\n\tif req.ForceFull {\n\t\treq.SinceTs = 0\n\t} else {\n\t\tif err := checkBackupReadTsAdvanced(latestManifest, req.ReadTs); err != nil {\n\t\t\treturn err\n\t\t}\n\n\t\tif x.WorkerConfig.EncryptionKey != nil {\n\t\t\t// If encryption key given, latest backup should be encrypted.\n\t\t\tif latestManifest.Type != \"\" && !latestManifest.Encrypted {\n\t\t\t\terr = errors.Errorf(\"latest manifest indicates the last backup was not encrypted \" +\n\t\t\t\t\t\"but this instance has encryption turned on. Try \\\"forceFull\\\" flag.\")\n\t\t\t\treturn err\n\t\t\t}\n\t\t} else {\n\t\t\t// If encryption turned off, latest backup should be unencrypted.\n\t\t\tif latestManifest.Type != \"\" && latestManifest.Encrypted {\n\t\t\t\terr = errors.Errorf(\"latest manifest indicates the last backup was encrypted \" +\n\t\t\t\t\t\"but this instance has encryption turned off. Try \\\"forceFull\\\" flag.\")\n\t\t\t\treturn err\n\t\t\t}\n\t\t}\n\t}\n\n\t// Update the membership state to get the latest mapping of groups to predicates.\n\tif err := UpdateMembershipState(ctx); err != nil {\n\t\treturn err\n\t}\n","sourceCodeStart":280,"sourceCodeEnd":316,"githubUrl":"https://github.com/dgraph-io/dgraph/blob/759e242be62c91f8d084da06ad0c8d21256d9c07/worker/backup.go#L280-L316","documentation":"Backups enforce encryption continuity: if an encryption key is configured on this instance (x.WorkerConfig.EncryptionKey != nil), the latest existing backup at the destination must also have been encrypted. If the latest manifest shows an unencrypted backup, the request is rejected and the user is told to use forceFull to start a fresh full backup.","triggerScenarios":"Running an incremental or full backup to a location whose latest manifest has Type set and Encrypted=false, while the current instance was started with an encryption key — e.g. encryption was enabled after previous unencrypted backups to the same location.","commonSituations":"Enabling encryption-at-rest on an existing cluster pointing at an old backup location; restoring backups from a non-encrypted deployment into an encrypted one; rotating configuration without changing the backup URI.","solutions":["Rerun the backup with the forceFull flag set to create a new full encrypted backup","Use a different backup location for the encrypted cluster","Disable the encryption key if unencrypted backups must continue (not recommended)","Verify the latest manifest at the URI matches the expected encryption state"],"exampleFix":"// before\nreq := &pb.BackupRequest{Location: uri}\n// after\nreq := &pb.BackupRequest{Location: uri, ForceFull: true} // new full encrypted backup","handlingStrategy":"validation","validationCode":"latest, err := GetLatestManifest(handler, uri)\nif err == nil && x.WorkerConfig.EncryptionKey != nil &&\n    latest.Type != \"\" && !latest.Encrypted {\n    // plan a forceFull backup instead of incremental\n}","typeGuard":null,"tryCatchPattern":"err := ProcessBackupRequest(ctx, req)\nif err != nil && strings.Contains(err.Error(), \"was not encrypted\") {\n    req.ForceFull = true // retry as a fresh full encrypted backup\n    err = ProcessBackupRequest(ctx, req)\n}","preventionTips":["When toggling encryption on, switch to a new backup location or run forceFull","Record the encryption state of each backup location in runbooks","Compare the latest manifest's Encrypted flag against instance config before scheduling","Avoid sharing one backup URI across differently-configured clusters"],"tags":["backup","encryption","manifest","configuration"],"backgroundTag":"backup-encryption-state-mismatch","analyzedSha":"759e242be62c91f8d084da06ad0c8d21256d9c07","analyzedAt":"2026-09-01T14:42:12.034Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}