latest manifest indicates the last backup was not encrypted

Error message

latest manifest indicates the last backup was not encrypted but this instance has encryption turned on. Try "forceFull" flag.

What it means

Backups enforce encryption continuity: if an encryption key is configured on this instance (x.WorkerConfig.EncryptionKey != nil), the latest existing backup at the destination must also have been encrypted. If the latest manifest shows an unencrypted backup, the request is rejected and the user is told to use forceFull to start a fresh full backup.

Source

Thrown at worker/backup.go:298

	}
	latestManifest, err := GetLatestManifest(handler, uri)
	if err != nil {
		return err
	}

	req.SinceTs = latestManifest.ValidReadTs()
	// To force a full backup we'll set the sinceTs to zero.
	if req.ForceFull {
		req.SinceTs = 0
	} else {
		if err := checkBackupReadTsAdvanced(latestManifest, req.ReadTs); err != nil {
			return err
		}

		if x.WorkerConfig.EncryptionKey != nil {
			// If encryption key given, latest backup should be encrypted.
			if latestManifest.Type != "" && !latestManifest.Encrypted {
				err = errors.Errorf("latest manifest indicates the last backup was not encrypted " +
					"but this instance has encryption turned on. Try \"forceFull\" flag.")
				return err
			}
		} else {
			// If encryption turned off, latest backup should be unencrypted.
			if latestManifest.Type != "" && latestManifest.Encrypted {
				err = errors.Errorf("latest manifest indicates the last backup was encrypted " +
					"but this instance has encryption turned off. Try \"forceFull\" flag.")
				return err
			}
		}
	}

	// Update the membership state to get the latest mapping of groups to predicates.
	if err := UpdateMembershipState(ctx); err != nil {
		return err
	}

View on GitHub (pinned to 759e242be6)

Solutions

Rerun the backup with the forceFull flag set to create a new full encrypted backup
Use a different backup location for the encrypted cluster
Disable the encryption key if unencrypted backups must continue (not recommended)
Verify the latest manifest at the URI matches the expected encryption state

Example fix

// before
req := &pb.BackupRequest{Location: uri}
// after
req := &pb.BackupRequest{Location: uri, ForceFull: true} // new full encrypted backup

Defensive patterns

Strategy: validation

Validate before calling

latest, err := GetLatestManifest(handler, uri)
if err == nil && x.WorkerConfig.EncryptionKey != nil &&
    latest.Type != "" && !latest.Encrypted {
    // plan a forceFull backup instead of incremental
}

Try / catch

err := ProcessBackupRequest(ctx, req)
if err != nil && strings.Contains(err.Error(), "was not encrypted") {
    req.ForceFull = true // retry as a fresh full encrypted backup
    err = ProcessBackupRequest(ctx, req)
}

Prevention

When toggling encryption on, switch to a new backup location or run forceFull
Record the encryption state of each backup location in runbooks
Compare the latest manifest's Encrypted flag against instance config before scheduling
Avoid sharing one backup URI across differently-configured clusters

When it happens

Trigger: Running an incremental or full backup to a location whose latest manifest has Type set and Encrypted=false, while the current instance was started with an encryption key — e.g. encryption was enabled after previous unencrypted backups to the same location.

Common situations: Enabling encryption-at-rest on an existing cluster pointing at an old backup location; restoring backups from a non-encrypted deployment into an encrypted one; rotating configuration without changing the backup URI.

Related errors

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/2e962a54c160be83. Report an issue: GitHub.