vitessio/vitess · error

permissions diffs: %v

Error message

permissions diffs: %v

What it means

ValidatePermissionsKeyspace aggregates permission diffs across all tablets in a keyspace using an errgroup; when any tablet's permission comparison fails, the group returns the first error and the server wraps it as "permissions diffs: %v". It signals that tablet permission validation could not complete cleanly for at least one tablet.

Source

Thrown at go/vt/vtctl/grpcvtctldserver/server.go:4956

				})
				if err != nil {
					return err
				}

				log.Info(fmt.Sprintf("Diffing permissions between %s and %s", topoproto.TabletAliasString(referenceAlias),
					topoproto.TabletAliasString(alias)))
				er := &concurrency.AllErrorRecorder{}
				tmutils.DiffPermissions(topoproto.TabletAliasString(referenceAlias), referencePermissions,
					topoproto.TabletAliasString(alias), presp.Permissions, er)
				if er.HasErrors() {
					return er.Error()
				}
			}
			return nil
		})
	}
	if err := eg.Wait(); err != nil {
		return nil, fmt.Errorf("permissions diffs: %v", err)
	}

	return &vtctldatapb.ValidatePermissionsKeyspaceResponse{}, nil
}

// ValidateSchemaKeyspace is a part of the vtctlservicepb.VtctldServer interface.
// It will diff the schema between the tablets in all shards -- or a subset if
// any specific shards are specified -- within the keyspace.
func (s *VtctldServer) ValidateSchemaKeyspace(ctx context.Context, req *vtctldatapb.ValidateSchemaKeyspaceRequest) (resp *vtctldatapb.ValidateSchemaKeyspaceResponse, err error) {
	span, ctx := trace.NewSpan(ctx, "VtctldServer.ValidateSchemaKeyspace")
	defer span.Finish()

	defer panicHandler(&err)

	span.Annotate("keyspace", req.Keyspace)
	span.Annotate("shards", req.Shards)
	keyspace := req.Keyspace

View on GitHub (pinned to 01a25a7d17)

Solutions

1. Check all tablets in the keyspace are serving and reachable (vtctldclient GetTablets).
2. Inspect vttablet logs of the failing tablet for the underlying permission error.
3. Re-run after fixing the tablet; permissions diffs that are real must be reconciled manually on the tablet.

aliases, err := ts.FindAllTabletAliasesInKeyspace(ctx, ks); if err == nil { for _, a := range aliases { if _, err := ts.GetTablet(ctx, a); err != nil { /* tablet unreachable — fix before validating */ } } }

resp, err := client.ValidatePermissionsKeyspace(ctx, &vtctldatapb.ValidatePermissionsKeyspaceRequest{Keyspace: ks}); if err != nil { if strings.Contains(err.Error(), "permissions diffs:") { log.Warn("permission validation incomplete", slog.Any("error", err)); /* inspect failing tablet, fix, retry */ } return err }

When it happens

Trigger: Calling ValidatePermissionsKeyspace (vtctldclient ValidatePermissionsKeyspace) when a tablet RPC fails (tablet down, permission diff found recorded, topoSrv error) inside the errgroup.

Common situations: A replica tablet is unreachable during a validation run; tablet ACL/permission tables differ between primary and replicas after a config change or version upgrade.

Related errors

• invalid key:value pair
• BaseKeyspace is required for SNAPSHOT keyspaces
• SnapshotTime is required for SNAPSHOT keyspaces
• same keyrange is present in source and target: %v
• source and target keyranges don't match: %v vs %v

AI-assisted analysis of vitessio/vitess@01a25a7d17 (2026-09-01). Data as JSON: /api/errors/2a900b9dfb4997b4. Report an issue: GitHub.