{"record":{"id":"7b937385ab76d024","repo":"rustfs/rustfs","slug":"baseline-version-lost-for-key-key-id-master-key","errorCode":null,"errorMessage":"Baseline version lost for key {key_id}: master key version records exist (oldest {oldest_version}) but the key record carries no baseline version, so data keys written before versioned rotation can no longer be resolved to the master key version that wrapped them. A node older than versioned rotation rewrote the key record and dropped the field. Finish upgrading every node, restore baseline_version to {oldest_version} on the key record, then retry","messagePattern":"Baseline version lost for key (.+?): master key version records exist \\(oldest (.+?)\\) but the key record carries no baseline version, so data keys written before versioned rotation can no longer be resolved to the master key version that wrapped them\\. A node older than versioned rotation rewrote the key record and dropped the field\\. Finish upgrading every node, restore baseline_version to (.+?) on the key record, then retry","errorType":"http","errorClass":"KmsError","httpStatus":500,"severity":"critical","filePath":"crates/kms/src/error.rs","lineNumber":144,"sourceCode":"    KeyVersionNotFound { key_id: String, version: u32 },\n\n    /// Backup/restore bundle contract violation; see [`crate::backup::BackupError`]\n    #[error(transparent)]\n    Backup(#[from] crate::backup::BackupError),\n\n    /// Operation is not supported by the active KMS backend\n    #[error(\"Operation '{operation}' is not supported by KMS backend '{backend}'\")]\n    UnsupportedCapability { backend: String, operation: String },\n\n    /// Backend credentials expired or could not be refreshed in time; requests\n    /// fail closed instead of being sent with credentials that may lapse mid-flight\n    #[error(\"KMS credentials unavailable: {message}\")]\n    CredentialsUnavailable { message: String },\n\n    /// Key has master key version records but no baseline version, so envelopes\n    /// written before versioned rotation can no longer be resolved\n    #[error(\n        \"Baseline version lost for key {key_id}: master key version records exist (oldest {oldest_version}) but the key record carries no baseline version, so data keys written before versioned rotation can no longer be resolved to the master key version that wrapped them. A node older than versioned rotation rewrote the key record and dropped the field. Finish upgrading every node, restore baseline_version to {oldest_version} on the key record, then retry\"\n    )]\n    BaselineVersionLost { key_id: String, oldest_version: u32 },\n\n    /// Configuration still points at the key, so its material must not be\n    /// destroyed. Distinct from the generic invalid-operation errors so that\n    /// callers can tell \"this key is still wired into the deployment\" apart\n    /// from a malformed request and act on the listed references.\n    #[error(\n        \"Key {key_id} is still referenced by configuration and its material must not be destroyed: {}. Remove or repoint the listed configuration, then retry\",\n        .references.join(\", \")\n    )]\n    KeyStillReferenced { key_id: String, references: Vec<String> },\n\n    /// The only available way to rewrap this envelope would pull the plaintext\n    /// data key into the RustFS process. Refused rather than performed: the\n    /// point of a backend-side rewrap is that the data key stays inside the\n    /// backend, so silently falling back to unwrap-then-rewrap would hand back\n    /// a correct envelope while quietly dropping the property that justified","sourceCodeStart":126,"sourceCodeEnd":162,"githubUrl":"https://github.com/rustfs/rustfs/blob/35af688cd9d41b4346fbe27dcf7250ba72046c1f/crates/kms/src/error.rs#L126-L162","documentation":"The key record carries master-key version records but no `baseline_version`, so data-key envelopes written before versioned rotation can no longer be mapped to the master key version that wrapped them. The stated cause is a node running code older than versioned rotation that rewrote the key record and dropped the field. Key listing marks such keys `Unreadable` (backends/mod.rs:299). `oldest_version` is exactly the baseline that was dropped, because version records start at the baseline the first rotation froze (error.rs:329-334).","triggerScenarios":"A mixed-version cluster where an old binary edits the Vault KV2 key record after a newer node performed versioned rotation; downgrading a node below versioned-rotation support and letting it touch the key; hand-editing the key record without the `baseline_version` field.","commonSituations":"Rolling upgrade paused mid-way with KMS writes happening on both versions; a rollback of one node while others already rotated keys; restore of a key record from an old backup.","solutions":["Finish upgrading every node to a version that understands versioned rotation so no old writer remains","Restore `baseline_version` on the key record to the `oldest_version` value the error reports","Retry the failing operation; verify the key now lists as readable again"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":"fn is_baseline_version_lost(e: &rustfs_kms::error::KmsError) -> bool {\n    matches!(e, rustfs_kms::error::KmsError::BaselineVersionLost { .. })\n}","tryCatchPattern":"if let Err(rustfs_kms::error::KmsError::BaselineVersionLost { key_id, oldest_version }) = op.await {\n    page_operator(key_id, *oldest_version); // needs manual record repair\n}","preventionTips":["Never run mixed versions across nodes where one version predates versioned rotation","Back up the Vault KV key record before downgrades or experiments","Alert on keys listing as Unreadable — that classification includes this condition"],"tags":["kms","rust","vault","rotation","upgrade","data-loss-risk"],"backgroundTag":"mixed-version-metadata-loss","analyzedSha":"35af688cd9d41b4346fbe27dcf7250ba72046c1f","analyzedAt":"2026-08-20T21:57:04.799Z","contentChangedAt":"2026-08-20T21:57:04.799Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}