dgraph-io/dgraph · error

unable to get encryption config

Error message

unable to get encryption config

What it means

RunMapper wraps failures from getEncConfig with 'unable to get encryption config'. getEncConfig resolves the encryption settings (key provider, key object path, key ID) from the RestoreRequest, typically by fetching an encryption key from a KMS-style provider; any error there is surfaced under this message.

Source

Thrown at worker/restore_map.go:761

	if req.RestoreTs == 0 {
		return nil, errors.New("RestoreRequest must have a valid restoreTs")
	}

	creds := getCredentialsFromRestoreRequest(req)
	h, err := NewUriHandler(uri, creds)
	if err != nil {
		return nil, err
	}

	manifests, err := getManifestsToRestore(h, uri, req)
	if err != nil {
		return nil, errors.Wrapf(err, "cannot retrieve manifests")
	}
	glog.Infof("Got %d backups to restore ", len(manifests))

	cfg, err := getEncConfig(req)
	if err != nil {
		return nil, errors.Wrapf(err, "unable to get encryption config")
	}
	keys, err := x.GetEncAclKeys(cfg)
	if err != nil {
		return nil, errors.Wrapf(err, "unable to get encryption keys")
	}

	mapper := &mapper{
		buf:       z.NewBuffer(mapFileSz, "Restore.Buffer"),
		thr:       y.NewThrottle(3),
		bufLock:   &sync.Mutex{},
		closer:    z.NewCloser(1),
		reqCh:     make(chan listReq, 3),
		restoreTs: req.RestoreTs,
		mapDir:    mapDir,
		szHist:    z.NewHistogramData(z.HistogramBounds(10, 32)),
	}

	numGo := 8

View on GitHub (pinned to 759e242be6)

Solutions

1. Inspect the wrapped cause for the provider-specific error (auth, not found, etc.).
2. Set req.EncryptionCfg (KeyId and the key object path/credentials) to match how the backup was created.
3. Confirm the encryption key object still exists and is readable from the configured location.
4. If the backup was not encrypted, remove/omit EncryptionCfg from the request.

Example fix

// before
req := &pb.RestoreRequest{Location: loc} // encrypted backup, no enc config
// after
req := &pb.RestoreRequest{Location: loc, EncryptionCfg: &pb.EncryptionCfg{KeyId: keyID, Path: keyPath}}

if backupWasEncrypted && req.EncryptionCfg == nil {
    return errors.New("backup is encrypted: EncryptionCfg (KeyId, Path) is required")
}

When it happens

Trigger: req.EncryptionCfg is set (or required) but the configured key provider cannot be reached, the key object/credentials are invalid, or the request lacks required encryption fields while the backup was encrypted.

Common situations: Restoring an encrypted backup without supplying EncryptionKey/EncryptionKeyId; wrong vault/kms endpoint or credentials; key object deleted or renamed in storage; mixing encrypted backups with non-encrypted restore config.

Related errors

• unable to get encryption keys
• RestoreRequest must have a valid restoreTs
• newBackupReader
• another restore operation is already running
• Pending transactions found. Please retry operation

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/fd8e4299f176ec39. Report an issue: GitHub.