{"record":{"id":"fd8e4299f176ec39","repo":"dgraph-io/dgraph","slug":"unable-to-get-encryption-config","errorCode":null,"errorMessage":"unable to get encryption config","messagePattern":"unable to get encryption config","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"worker/restore_map.go","lineNumber":761,"sourceCode":"\tif req.RestoreTs == 0 {\n\t\treturn nil, errors.New(\"RestoreRequest must have a valid restoreTs\")\n\t}\n\n\tcreds := getCredentialsFromRestoreRequest(req)\n\th, err := NewUriHandler(uri, creds)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tmanifests, err := getManifestsToRestore(h, uri, req)\n\tif err != nil {\n\t\treturn nil, errors.Wrapf(err, \"cannot retrieve manifests\")\n\t}\n\tglog.Infof(\"Got %d backups to restore \", len(manifests))\n\n\tcfg, err := getEncConfig(req)\n\tif err != nil {\n\t\treturn nil, errors.Wrapf(err, \"unable to get encryption config\")\n\t}\n\tkeys, err := x.GetEncAclKeys(cfg)\n\tif err != nil {\n\t\treturn nil, errors.Wrapf(err, \"unable to get encryption keys\")\n\t}\n\n\tmapper := &mapper{\n\t\tbuf:       z.NewBuffer(mapFileSz, \"Restore.Buffer\"),\n\t\tthr:       y.NewThrottle(3),\n\t\tbufLock:   &sync.Mutex{},\n\t\tcloser:    z.NewCloser(1),\n\t\treqCh:     make(chan listReq, 3),\n\t\trestoreTs: req.RestoreTs,\n\t\tmapDir:    mapDir,\n\t\tszHist:    z.NewHistogramData(z.HistogramBounds(10, 32)),\n\t}\n\n\tnumGo := 8","sourceCodeStart":743,"sourceCodeEnd":779,"githubUrl":"https://github.com/dgraph-io/dgraph/blob/759e242be62c91f8d084da06ad0c8d21256d9c07/worker/restore_map.go#L743-L779","documentation":"RunMapper wraps failures from getEncConfig with 'unable to get encryption config'. getEncConfig resolves the encryption settings (key provider, key object path, key ID) from the RestoreRequest, typically by fetching an encryption key from a KMS-style provider; any error there is surfaced under this message.","triggerScenarios":"req.EncryptionCfg is set (or required) but the configured key provider cannot be reached, the key object/credentials are invalid, or the request lacks required encryption fields while the backup was encrypted.","commonSituations":"Restoring an encrypted backup without supplying EncryptionKey/EncryptionKeyId; wrong vault/kms endpoint or credentials; key object deleted or renamed in storage; mixing encrypted backups with non-encrypted restore config.","solutions":["Inspect the wrapped cause for the provider-specific error (auth, not found, etc.).","Set req.EncryptionCfg (KeyId and the key object path/credentials) to match how the backup was created.","Confirm the encryption key object still exists and is readable from the configured location.","If the backup was not encrypted, remove/omit EncryptionCfg from the request."],"exampleFix":"// before\nreq := &pb.RestoreRequest{Location: loc} // encrypted backup, no enc config\n// after\nreq := &pb.RestoreRequest{Location: loc, EncryptionCfg: &pb.EncryptionCfg{KeyId: keyID, Path: keyPath}}","handlingStrategy":"validation","validationCode":"if backupWasEncrypted && req.EncryptionCfg == nil {\n    return errors.New(\"backup is encrypted: EncryptionCfg (KeyId, Path) is required\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Record whether the backup was encrypted at backup time","Keep EncryptionCfg in the same secret store as the backup metadata","Verify key object readability before starting a long restore"],"tags":["dgraph","restore","encryption","config"],"backgroundTag":"encryption-config-missing","analyzedSha":"759e242be62c91f8d084da06ad0c8d21256d9c07","analyzedAt":"2026-09-01T14:42:12.034Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}