hyperledger/fabric · error

missing policy at path: %s

Error message

missing policy at path: %s

What it means

recurseConfigMap is converting a config tree back into a ConfigGroup and expects every policy listed in a group to have a corresponding entry in the flattened configMap keyed by its path. This error fires when group.Policies contains a key whose path (policyPrefix + path + key) is absent from the map. It indicates the configMap was built inconsistently with the group tree.

Source

Thrown at common/configtx/configmap.go:150

	}

	for key := range group.Values {
		valuePath := valuePrefix + path + pathSeparator + key
		value, ok := configMap[valuePath]
		if !ok {
			return nil, errors.Errorf("missing value at path: %s", valuePath)
		}
		if value.ConfigValue == nil {
			return nil, errors.Errorf("ConfigValue not found at value path: %s", valuePath)
		}
		newConfigGroup.Values[key] = proto.Clone(value.ConfigValue).(*cb.ConfigValue)
	}

	for key := range group.Policies {
		policyPath := policyPrefix + path + pathSeparator + key
		policy, ok := configMap[policyPath]
		if !ok {
			return nil, errors.Errorf("missing policy at path: %s", policyPath)
		}
		if policy.ConfigPolicy == nil {
			return nil, errors.Errorf("ConfigPolicy not found at policy path: %s", policyPath)
		}
		newConfigGroup.Policies[key] = proto.Clone(policy.ConfigPolicy).(*cb.ConfigPolicy)
		logger.Debugf("Setting policy for key %s to %+v", key, group.Policies[key])
	}

	// This is a really very hacky fix to facilitate upgrading channels which were constructed
	// using the channel generation from v1.0 with bugs FAB-5309, and FAB-6080.
	// In summary, these channels were constructed with a bug which left mod_policy unset in some cases.
	// If mod_policy is unset, it's impossible to modify the element, and current code disallows
	// unset mod_policy values.  This hack 'fixes' existing config with empty mod_policy values.
	// If the capabilities framework is on, it sets any unset mod_policy to 'Admins'.
	// This code needs to sit here until validation of v1.0 channels is deprecated from the codebase.
	if _, ok := configMap[hackyFixOrdererCapabilities]; ok {
		// Hacky fix constants, used in recurseConfigMap
		if newConfigGroup.ModPolicy == "" {

View on GitHub (pinned to 2736b63f8f)

Solutions

  1. Ensure every policy key in the group has a corresponding entry added as ConfigPolicy in the config map at path '<policyPrefix><groupPath>/<key>'.
  2. Rebuild the config map from the original ConfigGroup via channel.Config instead of hand-assembling it.
  3. Check the policyPrefix/path separator usage matches the internal pathSeparator convention.

Example fix

// before
configMap["/Channel/policies/Admins"] = nil // policy entry missing
// after
configMap["/Channel/policies/Admins"] = &Config{ConfigPolicy: &cb.ConfigPolicy{Policy: &cb.Policy{Type: int32(cb.Policy_SIGNATURE), Value: policyBytes}}}
Defensive patterns

Strategy: validation

Validate before calling

for key := range group.Policies {
  if _, ok := configMap[policyPrefix+path+pathSeparator+key]; !ok {
    return fmt.Errorf("config map missing policy %s at %s", key, path)
  }
}

Type guard

if p, ok := configMap[policyPath]; !ok || p == nil || p.ConfigPolicy == nil { return false }; return true

Try / catch

if err := recurseConfigMap(configMap, group, path, newGroup); err != nil {
  if strings.Contains(err.Error(), "missing policy at path") {
    // repair or rebuild config map and retry
  }
  return err
}

Prevention

When it happens

Trigger: Calling configMapToConfig on a config map that is missing a '<policyPrefix><groupPath>/<policyKey>' entry while the corresponding group still declares that policy in Policies.

Common situations: Hand-built or programmatically mutated config maps where a policy entry was removed or renamed but the group still references it; loading a truncated or corrupted channel configuration.

Related errors

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/b50bee05286c395e. Report an issue: GitHub.