What causes "error deleting old acl predicates: %w" in dgraph-io/dgraph?

Run the upgrade as a guardian user so DropAttr is authorized, then retry only the delete step

error deleting old acl predicates: %w

Error message

error deleting old acl predicates: %w

What it means

When the deleteOld flag is set, upgradeACLRules drops the legacy dgraph.group.acl predicate with an ATTR drop alter. If the alter call fails, the new rules are already written but the old ones remain, and the operation aborts with this wrapped error.

Source

Thrown at upgrade/change_v20.03.0.go:113

	// Nothing to do.
	if len(nquads) == 0 {
		fmt.Println("nothing to do: no old rules found in the cluster")
		return nil
	}

	if err := mutateWithClient(dg, &api.Mutation{Set: nquads}); err != nil {
		return fmt.Errorf("error upgrading ACL rules: %w", err)
	}
	fmt.Println("Successfully upgraded ACL rules.")

	deleteOld := Upgrade.Conf.GetBool("deleteOld")
	if deleteOld {
		err := alterWithClient(dg, &api.Operation{
			DropOp:    api.Operation_ATTR,
			DropValue: "dgraph.group.acl",
		})
		if err != nil {
			return fmt.Errorf("error deleting old acl predicates: %w", err)
		}
		fmt.Println("Successfully deleted old rules.")
	}

	return nil
}

View on GitHub (pinned to 759e242be6)

Solutions

Run the upgrade as a guardian user so DropAttr is authorized, then retry only the delete step
Drop the predicate manually: curl the /alter endpoint with DropAttr dgraph.group.acl using root credentials
If keeping old rules is harmless, re-run the upgrade without --deleteOld and clean up later
Check alpha logs/health and network before retrying

Example fix

// manual fallback
// before (tool)
dgraph upgrade --deleteOld --creds user:password   // drop fails: not guardian
// after (manual alter with guardian creds)
curl -X POST localhost:8080/alter -H 'X-Dgraph-AccessToken: <jwt>' -d '{"drop_attr":"dgraph.group.acl"}'

Defensive patterns

Strategy: fallback

Validate before calling

// verify drop permission first
if err := alterWithClient(dg, &api.Operation{DropOp: api.Operation_ALL, DropValue: "_x_"}); err != nil {
    return errors.New("client lacks alter/drop privileges; run as guardian")
}

Try / catch

if err := upgradeACLRules(); err != nil {
    if strings.Contains(err.Error(), "error deleting old acl predicates") {
        // new rules are already written; drop dgraph.group.acl manually later via /alter
    }
    return err
}

Prevention

Drop requires elevated rights: always run the delete step as guardian/root
Separate migration and cleanup: migrate first, drop the old predicate in a controlled window
If the drop fails, remember the cluster still works — old rules are merely redundant

When it happens

Trigger: alterWithClient(dg, &api.Operation{DropOp: api.Operation_ATTR, DropValue: "dgraph.group.acl"}) fails because the client lacks drop permission, the alpha is unreachable, or a schema/guardian constraint blocks dropping the predicate.

Common situations: Running the upgrade without guardian-of-root privileges (drop requires elevated rights); cluster in restricted/health mode; drop rejected while queries/mutations are in flight; deleting old rules on an ACL-protected cluster with insufficient creds.

Related errors

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/8a4686b437c7c31e. Report an issue: GitHub.