config update contain more then just the %s value in the %s

Error message

config update contain more then just the %s value in the %s group

What it means

Even when the update contains the ConsensusType value, migration mode requires that it contains ONLY that value in the Orderer group. Any additional Orderer value change (BatchSize, BatchTimeout, capabilities, etc.) makes the update ambiguous/unsafe and is rejected.

Source

Thrown at orderer/common/msgprocessor/maintenancefilter.go:202

		return errors.Errorf("config update contains changes to values in group %s", channelconfig.ChannelGroupKey)
	}

	if len(configUpdate.WriteSet.Groups) > 1 {
		return errors.New("config update contains changes to more than one group")
	}

	if ordGroup, ok1 := configUpdate.WriteSet.Groups[channelconfig.OrdererGroupKey]; ok1 {
		if len(ordGroup.Groups) > 0 {
			return errors.Errorf("config update contains changes to groups within the %s group",
				channelconfig.OrdererGroupKey)
		}

		if _, ok2 := ordGroup.Values[channelconfig.ConsensusTypeKey]; !ok2 {
			return errors.Errorf("config update does not contain the %s value", channelconfig.ConsensusTypeKey)
		}

		if len(ordGroup.Values) > 1 {
			return errors.Errorf("config update contain more then just the %s value in the %s group",
				channelconfig.ConsensusTypeKey, channelconfig.OrdererGroupKey)
		}
	} else {
		return errors.Errorf("update does not contain the %s group", channelconfig.OrdererGroupKey)
	}

	return nil
}

func validateBFTConsenterMapping(currentOrdererConfig channelconfig.Orderer, nextOrdererConfig channelconfig.Orderer) error {
	// extract raft consenters from consensusTypeValue.metadata
	raftMetadata := &etcdraft.ConfigMetadata{}
	proto.Unmarshal(currentOrdererConfig.ConsensusMetadata(), raftMetadata)
	raftConsenters := raftMetadata.GetConsenters()

	// extract bft consenters
	bftConsenters := nextOrdererConfig.Consenters()

View on GitHub (pinned to 2736b63f8f)

Solutions

Rebuild the WriteSet so the Orderer group's Values contains exactly one entry: ConsensusType.
Commit unrelated value changes (BatchSize, BatchTimeout, etc.) in a separate update after the channel returns to NORMAL state.
Re-diff with configtxlator against the current maintenance-mode config to isolate the ConsensusType change.

Example fix

// before
ordGroup.Values["ConsensusType"] = ct
ordGroup.Values["BatchTimeout"] = bt // extra value
// after
ordGroup.Values = map[string]*cb.ConfigValue{"ConsensusType": ct}

Defensive patterns

Strategy: validation

Validate before calling

if ord, ok := update.GetWriteSet().Groups["Orderer"]; ok {
    if _, hasCT := ord.Values["ConsensusType"]; hasCT && len(ord.Values) > 1 {
        return errors.New("Orderer group may contain only ConsensusType during migration")
    }
}

Prevention

Postpone BatchSize/BatchTimeout/capabilities edits until after NORMAL state is restored.
Re-diff against the live config so stale values do not sneak into the delta.
Keep the WriteSet minimal: one group, one value.

When it happens

Trigger: ensureConsensusTypeChangeOnly sees ordGroup.Values containing ConsensusTypeKey plus one or more other keys (len(ordGroup.Values) > 1).

Common situations: A config delta produced by diffing two configs where the administrator changed both ConsensusType and BatchTimeout before entering maintenance mode; tooling that re-applies a full config instead of a minimal delta.

Related errors

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/b6c67a145b05c61b. Report an issue: GitHub.