config update contains changes to groups within the %s group

Error message

config update contains changes to groups within the %s group

What it means

This error is thrown during consensus-type migration (maintenance mode) when a channel config update includes sub-groups nested inside the Orderer group. During migration, the config update written to the Orderer group must contain ONLY the ConsensusType value change — any nested group changes (e.g. changes to the Application or Consortiums groups inside Orderer) are rejected because they would alter more than the migration allows.

Source

Thrown at orderer/common/msgprocessor/maintenancefilter.go:193

	if err != nil {
		return errors.Wrap(err, "config update unmarshalling error")
	}

	if len(configUpdate.WriteSet.Groups) == 0 {
		return errors.New("config update contains no changes")
	}

	if len(configUpdate.WriteSet.Values) > 0 {
		return errors.Errorf("config update contains changes to values in group %s", channelconfig.ChannelGroupKey)
	}

	if len(configUpdate.WriteSet.Groups) > 1 {
		return errors.New("config update contains changes to more than one group")
	}

	if ordGroup, ok1 := configUpdate.WriteSet.Groups[channelconfig.OrdererGroupKey]; ok1 {
		if len(ordGroup.Groups) > 0 {
			return errors.Errorf("config update contains changes to groups within the %s group",
				channelconfig.OrdererGroupKey)
		}

		if _, ok2 := ordGroup.Values[channelconfig.ConsensusTypeKey]; !ok2 {
			return errors.Errorf("config update does not contain the %s value", channelconfig.ConsensusTypeKey)
		}

		if len(ordGroup.Values) > 1 {
			return errors.Errorf("config update contain more then just the %s value in the %s group",
				channelconfig.ConsensusTypeKey, channelconfig.OrdererGroupKey)
		}
	} else {
		return errors.Errorf("update does not contain the %s group", channelconfig.OrdererGroupKey)
	}

	return nil
}

View on GitHub (pinned to 2736b63f8f)

Solutions

Remove all nested group entries under the Orderer group from the WriteSet so only the Orderer group itself with the ConsensusType value change remains.
Recompute the config delta against the latest channel config so only the consensus_type value differs.
Split unrelated configuration changes into separate, post-migration config updates.

Example fix

// before
WriteSet.Groups["Orderer"].Groups["OrdererOrg"] = modifiedOrgGroup // nested group change
// after
WriteSet.Groups["Orderer"].Groups = nil
WriteSet.Groups["Orderer"].Values["ConsensusType"] = newConsensusTypeValue

Defensive patterns

Strategy: validation

Validate before calling

if len(update.GetWriteSet().Groups) == 1 {
    if ord, ok := update.GetWriteSet().Groups["Orderer"]; ok && len(ord.Groups) > 0 {
        return errors.New("nested groups under Orderer not allowed during migration")
    }
}

Prevention

Generate the delta with configtxlator rather than hand-editing the full config.
During migration, touch only the Orderer group and only its ConsensusType value.
Diff the proposed update against the current config before submitting.

When it happens

Trigger: Calling msgprocessor inspect during maintenance mode with a configUpdate whose WriteSet contains OrdererGroupKey in WriteSet.Groups, but where ordGroup.Groups is non-empty (sub-group entries inside the Orderer group).

Common situations: Admins preparing a Raft-to-BFT consensus-type migration who bundle other config edits (e.g. moving a consortium, adding orderer endpoints group changes) into the same update transaction; tooling that generates deltas from a full config rather than the single ConsensusType change.

Related errors

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/a9b75319e2826242. Report an issue: GitHub.