latest manifest indicates the last backup was encrypted but

Error message

latest manifest indicates the last backup was encrypted but this instance has encryption turned off. Try "forceFull" flag.

What it means

The mirror case of encryption-on mismatch: when no encryption key is configured (WorkerConfig.EncryptionKey == nil) but the latest backup manifest at the destination shows the last backup WAS encrypted, the backup is rejected. Incremental backups cannot mix encrypted and unencrypted data, so a forceFull backup is required.

Source

Thrown at worker/backup.go:305

	// To force a full backup we'll set the sinceTs to zero.
	if req.ForceFull {
		req.SinceTs = 0
	} else {
		if err := checkBackupReadTsAdvanced(latestManifest, req.ReadTs); err != nil {
			return err
		}

		if x.WorkerConfig.EncryptionKey != nil {
			// If encryption key given, latest backup should be encrypted.
			if latestManifest.Type != "" && !latestManifest.Encrypted {
				err = errors.Errorf("latest manifest indicates the last backup was not encrypted " +
					"but this instance has encryption turned on. Try \"forceFull\" flag.")
				return err
			}
		} else {
			// If encryption turned off, latest backup should be unencrypted.
			if latestManifest.Type != "" && latestManifest.Encrypted {
				err = errors.Errorf("latest manifest indicates the last backup was encrypted " +
					"but this instance has encryption turned off. Try \"forceFull\" flag.")
				return err
			}
		}
	}

	// Update the membership state to get the latest mapping of groups to predicates.
	if err := UpdateMembershipState(ctx); err != nil {
		return err
	}

	// Get the current membership state and parse it for easier processing.
	state := GetMembershipState()
	var groups []uint32
	predMap := make(map[uint32][]string)
	for gid, group := range state.Groups {
		groups = append(groups, gid)
		predMap[gid] = make([]string, 0)

View on GitHub (pinned to 759e242be6)

Solutions

Rerun with the forceFull flag to start a fresh unencrypted full backup
Use a new backup location for the unencrypted cluster
Re-add the encryption key to the instance config if encryption should stay on
Check the manifest at the URI to confirm which encryption state the existing backups use

Example fix

// before
req := &pb.BackupRequest{Location: uri}
// after
req := &pb.BackupRequest{Location: uri, ForceFull: true} // fresh unencrypted full backup

Defensive patterns

Strategy: validation

Validate before calling

latest, err := GetLatestManifest(handler, uri)
if err == nil && x.WorkerConfig.EncryptionKey == nil &&
    latest.Type != "" && latest.Encrypted {
    // plan a forceFull backup to a new location, or re-enable the key
}

Try / catch

err := ProcessBackupRequest(ctx, req)
if err != nil && strings.Contains(err.Error(), "was encrypted") {
    req.ForceFull = true // fresh unencrypted full backup
    err = ProcessBackupRequest(ctx, req)
}

Prevention

Never disable encryption while reusing the old backup URI; pick a new location
Verify the encryption key is present in the instance config before backups
Keep encryption settings and backup destinations in sync across environments
Check the latest manifest's Encrypted flag before incremental backups

When it happens

Trigger: Running a backup from an instance without an encryption key to a location whose latest manifest has Type set and Encrypted=true — e.g. encryption was removed from the cluster config but the old encrypted backups still live at the URI.

Common situations: Disabling encryption-at-rest in configuration while reusing the previous backup location; migrating backups from an encrypted deployment to an unencrypted one sharing the same URI; key accidentally omitted from the new instance's config.

Related errors

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/001f46c5e4e90912. Report an issue: GitHub.