What causes "update does not contain the %s group" in hyperledger/fabric?

Change the WriteSet so its sole group entry is the Orderer group with the ConsensusType value change.

update does not contain the %s group

Error message

update does not contain the %s group

What it means

During consensus-type migration the config update must include the Orderer group itself. If WriteSet.Groups has exactly one entry but it is not the Orderer group (channelconfig.OrdererGroupKey), the update cannot be validated as a ConsensusType change and is rejected.

Source

Thrown at orderer/common/msgprocessor/maintenancefilter.go:206

		return errors.New("config update contains changes to more than one group")
	}

	if ordGroup, ok1 := configUpdate.WriteSet.Groups[channelconfig.OrdererGroupKey]; ok1 {
		if len(ordGroup.Groups) > 0 {
			return errors.Errorf("config update contains changes to groups within the %s group",
				channelconfig.OrdererGroupKey)
		}

		if _, ok2 := ordGroup.Values[channelconfig.ConsensusTypeKey]; !ok2 {
			return errors.Errorf("config update does not contain the %s value", channelconfig.ConsensusTypeKey)
		}

		if len(ordGroup.Values) > 1 {
			return errors.Errorf("config update contain more then just the %s value in the %s group",
				channelconfig.ConsensusTypeKey, channelconfig.OrdererGroupKey)
		}
	} else {
		return errors.Errorf("update does not contain the %s group", channelconfig.OrdererGroupKey)
	}

	return nil
}

func validateBFTConsenterMapping(currentOrdererConfig channelconfig.Orderer, nextOrdererConfig channelconfig.Orderer) error {
	// extract raft consenters from consensusTypeValue.metadata
	raftMetadata := &etcdraft.ConfigMetadata{}
	proto.Unmarshal(currentOrdererConfig.ConsensusMetadata(), raftMetadata)
	raftConsenters := raftMetadata.GetConsenters()

	// extract bft consenters
	bftConsenters := nextOrdererConfig.Consenters()

	if len(bftConsenters) == 0 {
		return errors.Errorf("Invalid new config: bft consenters are missing")
	}

View on GitHub (pinned to 2736b63f8f)

Solutions

Change the WriteSet so its sole group entry is the Orderer group with the ConsensusType value change.
If the intent was to edit another group, exit maintenance mode first — only Orderer/ConsensusType updates are permitted during migration.
Re-generate the delta from the current config ensuring the Orderer group is the edited group.

Example fix

// before
WriteSet.Groups["Application"] = appGroupDelta
// after
WriteSet.Groups["Orderer"] = &cb.ConfigGroup{Values: map[string]*cb.ConfigValue{"ConsensusType": ctValue}}

Defensive patterns

Strategy: validation

Validate before calling

groups := update.GetWriteSet().Groups
if len(groups) != 1 {
    return errors.New("expected exactly one group in migration update")
}
if _, ok := groups["Orderer"]; !ok {
    return errors.New("migration update must target the Orderer group")
}

Prevention

Confirm the edited group key is literally "Orderer" in the WriteSet.
Do not attempt Application/Consortiums edits while in maintenance mode.
Build updates from the current config snapshot, not an old one.

When it happens

Trigger: ensureConsensusTypeChangeOnly is called with a configUpdate where the single group in WriteSet.Groups is something other than "Orderer" — the ordGroup lookup fails and the else branch fires.

Common situations: Attempting a maintenance-mode update that modifies the Application group or a consortium instead of the Orderer group; a mis-scoped WriteSet produced by editing the wrong group in configtxlator output.

Related errors

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/5f0ae049b4bd7f59. Report an issue: GitHub.