{"record":{"id":"7e353b58ad2204af","repo":"weaviate/weaviate","slug":"upgrade-groupings-w","errorCode":null,"errorMessage":"upgrade groupings: %w","messagePattern":"upgrade groupings: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"usecases/auth/authorization/rbac/manager.go","lineNumber":724,"sourceCode":"\tm.casbin.ClearPolicy()\n\n\t_, err := m.casbin.AddPolicies(snapshot.Policy)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"add policies: %w\", err)\n\t}\n\n\t_, err = m.casbin.AddGroupingPolicies(snapshot.GroupingPolicy)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"add grouping policies: %w\", err)\n\t}\n\n\tif snapshot.Version == SnapshotVersionV0 {\n\t\tif err := upgradePoliciesFrom129(m.casbin, true); err != nil {\n\t\t\treturn fmt.Errorf(\"upgrade policies: %w\", err)\n\t\t}\n\n\t\tif err := upgradeGroupingsFrom129(m.casbin, m.authNconf); err != nil {\n\t\t\treturn fmt.Errorf(\"upgrade groupings: %w\", err)\n\t\t}\n\t}\n\n\t// environment config needs to be applied again in case there were changes since the last snapshot\n\tif err := applyPredefinedRoles(m.casbin, m.rbacConf, m.authNconf, m.namespacesEnabled); err != nil {\n\t\treturn fmt.Errorf(\"apply env config: %w\", err)\n\t}\n\n\t// Load the policies to ensure they are in memory\n\tif err := m.casbin.LoadPolicy(); err != nil {\n\t\treturn fmt.Errorf(\"load policies: %w\", err)\n\t}\n\n\t// Invalidate the cache so the first Enforce() after the lock is released\n\t// evaluates against the freshly loaded policies. ClearPolicy() is not\n\t// overridden by SyncedCachedEnforcer and does not invalidate on its own.\n\tif err := m.casbin.InvalidateCache(); err != nil {\n\t\treturn fmt.Errorf(\"restore snapshot: InvalidateCache: %w\", err)","sourceCodeStart":706,"sourceCodeEnd":742,"githubUrl":"https://github.com/weaviate/weaviate/blob/75aa4b6d11f8818305aafd4440b4e32794f7ca04/usecases/auth/authorization/rbac/manager.go#L706-L742","documentation":"Restore detected a V0 snapshot and ran upgradeGroupingsFrom129 to migrate legacy grouping rows (using the authN config to resolve subjects); its error is wrapped as 'upgrade groupings'. This follows a successful policy upgrade, so the target is mid-migration when the failure occurs — retries of Restore are required to reach a consistent state.","triggerScenarios":"Restoring a V0 snapshot whose legacy g-rows cannot be rewritten against the current authN configuration: subject formats the 1.29->current migration does not recognize, missing/changed AUTHENTICATION config (e.g. OIDC settings) needed to re-derive subjects, or casbin write failures during the rewrite.","commonSituations":"Upgrading old clusters whose OIDC/static-key configuration differs between source and target; restoring old backups onto a cluster with different AUTHENTICATION env vars; snapshots containing subjects from auth providers no longer configured.","solutions":["Align the target's authentication configuration (AUTHENTICATION_* env) with the source cluster so legacy subjects can be resolved, then retry Restore.","Re-export the snapshot from a newer source version that writes SnapshotVersionLatest, avoiding the legacy groupings migration.","Inspect the wrapped error to find the un-upgradable g-row and clean up or recreate that assignment on the source.","Re-run Restore — the clear-then-add flow makes a full retry rebuild consistent state."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"var probe struct{ Version int `json:\"version\"` }\nif json.Unmarshal(b, &probe) == nil && probe.Version == 0 {\n    // confirm target AUTHENTICATION config matches the snapshot's source cluster\n}","typeGuard":null,"tryCatchPattern":"if err := mgr.Restore(b, strip); err != nil {\n    if strings.Contains(err.Error(), \"upgrade groupings\") {\n        // align AUTHENTICATION_* env with source, then retry; or re-export from newer source\n        alignAuthConfig();\n        return mgr.Restore(b, strip)\n    }\n    return err\n}","preventionTips":["Match OIDC/static-key authentication configuration between source and target clusters before restoring legacy snapshots.","Prefer re-exporting from a current version over relying on the 1.29 groupings migration.","Document and pin the AUTHENTICATION env expected by old backups.","Re-run Restore after any mid-migration failure to rebuild consistent state."],"tags":["rbac","restore","migration","grouping-policy","authentication"],"backgroundTag":"snapshot-version-migration-failed","analyzedSha":"75aa4b6d11f8818305aafd4440b4e32794f7ca04","analyzedAt":"2026-09-04T14:58:20.392Z","contentChangedAt":"2026-09-04T14:58:20.392Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}