What causes "unable to get encryption keys" in dgraph-io/dgraph?

Check the wrapped cause for the specific key retrieval failure.

unable to get encryption keys

Error message

unable to get encryption keys

What it means

RunMapper wraps failures from x.GetEncAclKeys with 'unable to get encryption keys'. This step derives the ACL encryption key(s) from the encryption config (required when the cluster uses ACLs with encrypted passwords); failure here aborts the restore before mapping begins.

Source

Thrown at worker/restore_map.go:765

	creds := getCredentialsFromRestoreRequest(req)
	h, err := NewUriHandler(uri, creds)
	if err != nil {
		return nil, err
	}

	manifests, err := getManifestsToRestore(h, uri, req)
	if err != nil {
		return nil, errors.Wrapf(err, "cannot retrieve manifests")
	}
	glog.Infof("Got %d backups to restore ", len(manifests))

	cfg, err := getEncConfig(req)
	if err != nil {
		return nil, errors.Wrapf(err, "unable to get encryption config")
	}
	keys, err := x.GetEncAclKeys(cfg)
	if err != nil {
		return nil, errors.Wrapf(err, "unable to get encryption keys")
	}

	mapper := &mapper{
		buf:       z.NewBuffer(mapFileSz, "Restore.Buffer"),
		thr:       y.NewThrottle(3),
		bufLock:   &sync.Mutex{},
		closer:    z.NewCloser(1),
		reqCh:     make(chan listReq, 3),
		restoreTs: req.RestoreTs,
		mapDir:    mapDir,
		szHist:    z.NewHistogramData(z.HistogramBounds(10, 32)),
	}

	numGo := 8
	g, ctx := errgroup.WithContext(mapper.closer.Ctx())
	for range numGo {
		g.Go(func() error {
			return mapper.processReqCh(ctx)

View on GitHub (pinned to 759e242be6)

Solutions

Check the wrapped cause for the specific key retrieval failure.
Provide the same ACL encryption key (enc_key) used by the source cluster in the restore request/config.
Ensure the key provider (vault/kms) is reachable and credentials are valid.
Keep key IDs stable across backup and restore; if keys were rotated, use the key version active at backup time.

Example fix

// before
req := &pb.RestoreRequest{Location: loc} // ACL cluster, ACL key absent
// after
req := &pb.RestoreRequest{Location: loc, EncKey: aclEncKey} // supply the same ACL key as source cluster

Defensive patterns

Strategy: validation

Validate before calling

if usingAcl && aclEncKey == nil {
    return errors.New("ACL-enabled cluster: the ACL encryption key must be supplied")
}

Prevention

Back up and version the ACL enc_key with cluster config
Use the key version active when the backup was taken
Test key retrieval before the restore window

When it happens

Trigger: x.GetEncAclKeys(cfg) returns an error — typically the ACL key was not found in the encryption config, the key material is malformed, or the KMS provider call inside fails.

Common situations: Restoring into an ACL-enabled cluster without the same enc_key/acl key used at backup time; key mismatch after key rotation; passing a config missing the ACL key field.

Related errors

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/ad35e8b5b38ef8c7. Report an issue: GitHub.