dgraph-io/dgraph · error

error querying old ACL rules: %w

Error message

error querying old ACL rules: %w

What it means

During the v20.03.0 ACL upgrade, upgradeACLRules runs a query against the cluster to fetch the old dgraph.group.acl rules via getQueryResult. If that Dgraph query fails (network, auth, malformed response), the underlying error is wrapped with this message so the operator knows the ACL migration could not read the old state.

Source

Thrown at upgrade/change_v20.03.0.go:45

type group struct {
	UID string `json:"uid"`
	ACL string `json:"dgraph.group.acl,omitempty"`
}

type rule struct {
	Predicate  string `json:"predicate,omitempty"`
	Permission int    `json:"perm,omitempty"`
}

type rules []rule

func upgradeACLRules() error {
	dg, cb := x.GetDgraphClient(Upgrade.Conf, true)
	defer cb()

	data := make(map[string][]group)
	if err := getQueryResult(dg, queryACLGroupsBefore_v20_03_0, &data); err != nil {
		return fmt.Errorf("error querying old ACL rules: %w", err)
	}

	groups, ok := data["rules"]
	if !ok {
		return fmt.Errorf("unable to parse ACLs: %v", data)
	}

	counter := 1
	var nquads []*api.NQuad
	for _, group := range groups {
		if group.ACL == "" {
			continue
		}

		var rs rules
		if err := json.Unmarshal([]byte(group.ACL), &rs); err != nil {
			return fmt.Errorf("unable to unmarshal ACL: %v :: %w", group.ACL, err)
		}

View on GitHub (pinned to 759e242be6)

Solutions

1. Verify the Dgraph alpha HTTP/gRPC addresses passed to the upgrade tool are correct and reachable
2. Ensure you authenticate with valid admin credentials (access JWT) before running the upgrade
3. Check Dgraph server logs for the underlying query error (permission denied, connection refused, etc.)
4. Confirm the old ACL predicates (dgraph.group.acl) still exist — if already migrated, skip this step

Example fix

// before
dgraph upgrade --alpha localhost:9080   // wrong port, query fails
// after
dgraph upgrade --alpha localhost:9082 --creds user:password   // correct address + creds

resp, err := http.Get("http://alpha:8080/health")
if err != nil || resp.StatusCode != http.StatusOK {
    return errors.New("dgraph alpha not reachable; aborting ACL upgrade")
}

if err := upgradeACLRules(); err != nil {
    if strings.Contains(err.Error(), "error querying old ACL rules") {
        // check connectivity/auth, back off, retry upgrade
        return fmt.Errorf("ACL upgrade aborted: %w", err)
    }
    return err
}

When it happens

Trigger: Running the dgraph upgrade tool against a cluster where the query queryACLGroupsBefore_v20_03_0 fails: Dgraph unreachable, wrong --alpha address, missing/invalid access JWT, or the group predicates already dropped.

Common situations: Upgrading a cluster where ACL data was already migrated or deleted; pointing the upgrade tool at the wrong port/host; running without admin credentials; TLS mismatch between tool and server.

Related errors

• unable to parse ACLs: %v
• unable to unmarshal ACL: %v :: %w
• error upgrading ACL rules: %w
• error deleting old acl predicates: %w
• error deleting old predicate %s

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/a770413c07133d83. Report an issue: GitHub.