dgraph-io/dgraph · error

error querying old ACL rules

Error message

error querying old ACL rules: %w

What it means

During the v20.03.0 ACL upgrade, upgradeACLRules runs a query against the cluster to fetch the old dgraph.group.acl rules via getQueryResult. If that Dgraph query fails (network, auth, malformed response), the underlying error is wrapped with this message so the operator knows the ACL migration could not read the old state.

Solutions

1. Verify the Dgraph alpha HTTP/gRPC addresses passed to the upgrade tool are correct and reachable
2. Ensure you authenticate with valid admin credentials (access JWT) before running the upgrade
3. Check Dgraph server logs for the underlying query error (permission denied, connection refused, etc.)
4. Confirm the old ACL predicates (dgraph.group.acl) still exist — if already migrated, skip this step

Example fix

// before
dgraph upgrade --alpha localhost:9080   // wrong port, query fails
// after
dgraph upgrade --alpha localhost:9082 --creds user:password   // correct address + creds

resp, err := http.Get("http://alpha:8080/health")
if err != nil || resp.StatusCode != http.StatusOK {
    return errors.New("dgraph alpha not reachable; aborting ACL upgrade")
}

if err := upgradeACLRules(); err != nil {
    if strings.Contains(err.Error(), "error querying old ACL rules") {
        // check connectivity/auth, back off, retry upgrade
        return fmt.Errorf("ACL upgrade aborted: %w", err)
    }
    return err
}

When it happens

Trigger: Running the dgraph upgrade tool against a cluster where the query queryACLGroupsBefore_v20_03_0 fails: Dgraph unreachable, wrong --alpha address, missing/invalid access JWT, or the group predicates already dropped.

Common situations: Upgrading a cluster where ACL data was already migrated or deleted; pointing the upgrade tool at the wrong port/host; running without admin credentials; TLS mismatch between tool and server.

Related errors

• error deleting old acl predicates
• error deleting old predicate
• error deleting old type
• error querying cors
• error querying graphql schema

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/a770413c07133d83. Report an issue: GitHub.

Appendix: source

Thrown at upgrade/change_v20.03.0.go:45

type group struct {
	UID string `json:"uid"`
	ACL string `json:"dgraph.group.acl,omitempty"`
}

type rule struct {
	Predicate  string `json:"predicate,omitempty"`
	Permission int    `json:"perm,omitempty"`
}

type rules []rule

func upgradeACLRules() error {
	dg, cb := x.GetDgraphClient(Upgrade.Conf, true)
	defer cb()

	data := make(map[string][]group)
	if err := getQueryResult(dg, queryACLGroupsBefore_v20_03_0, &data); err != nil {
		return fmt.Errorf("error querying old ACL rules: %w", err)
	}

	groups, ok := data["rules"]
	if !ok {
		return fmt.Errorf("unable to parse ACLs: %v", data)
	}

	counter := 1
	var nquads []*api.NQuad
	for _, group := range groups {
		if group.ACL == "" {
			continue
		}

		var rs rules
		if err := json.Unmarshal([]byte(group.ACL), &rs); err != nil {
			return fmt.Errorf("unable to unmarshal ACL: %v :: %w", group.ACL, err)
		}

View on GitHub (pinned to 759e242be6)