weaviate/weaviate · error

GetGroupingPolicy: %w

Error message

GetGroupingPolicy: %w

What it means

This error wraps casbin GetGroupingPolicy() failing inside Manager.ListGroupingSubjects, which returns the subject key of every role-assignment g row. The read of all grouping policies from storage failed, so callers like NamespaceLocalRBAC (and CountNamespaceLocalRBAC) cannot enumerate role assignments.

Source

Thrown at usecases/auth/authorization/rbac/manager.go:221

			casbinStoragePolicies = collectStaleRoles(polices, casbinStoragePoliciesMap, casbinStoragePolicies)
		}
	}
	policies, err := conv.CasbinPolicies(m.namespacesEnabled, casbinStoragePolicies...)
	if err != nil {
		return nil, fmt.Errorf("CasbinPolicies: %w", err)
	}
	return policies, nil
}

// ListGroupingSubjects returns the subject key of every role-assignment row
// (each a `<prefix>:<user>` or `<prefix>:<group>` string).
func (m *Manager) ListGroupingSubjects() ([]string, error) {
	m.restoreLock.RLock()
	defer m.restoreLock.RUnlock()

	rows, err := m.casbin.GetGroupingPolicy()
	if err != nil {
		return nil, fmt.Errorf("GetGroupingPolicy: %w", err)
	}
	subjects := make([]string, 0, len(rows))
	for _, r := range rows {
		if len(r) > 0 {
			subjects = append(subjects, r[0])
		}
	}
	return subjects, nil
}

// NamespaceSubject is a direct (db/oidc) principal holding at least one role
// assignment bound to a namespace. ID is the user id without the auth-type
// prefix, e.g. "customer1:bob".
type NamespaceSubject struct {
	ID       string
	AuthType authentication.AuthType
}

View on GitHub (pinned to 75aa4b6d11)

Solutions

1. Check the wrapped error to identify the storage failure.
2. Verify the RBAC storage file is readable and its g rows are intact.
3. Restore the file from backup if the grouping section is corrupted.
4. Fix mount/permission issues on the data directory.
5. Retry the namespace operation once reads succeed — the block gate will re-count correctly.

Example fix

// before: read fails on unresponsive NFS mount
//   RBAC file at /mnt/nfs/weaviate/rbac.csv (NFS hang)
// after: keep RBAC storage on local persistent disk
//   RBAC_STORAGE_PATH=/var/lib/weaviate/rbac.csv

// Go: confirm RBAC storage is readable before namespace teardown that calls ListGroupingSubjects
func rbacReadyForNamespaceOp(path string) error {
	f, err := os.Open(path)
	if err != nil {
		return fmt.Errorf("rbac storage unreadable, aborting namespace op: %w", err)
	}
	return f.Close()
}

if err := client.Namespaces().Deleter().WithName(ns).Do(ctx); err != nil {
	if strings.Contains(err.Error(), "ListGroupingSubjects") {
		// transient storage read failure: wait and retry the namespace operation
	}
	return err
}

When it happens

Trigger: Namespace deletion checks (NamespaceLocalRBAC) or any internal call to ListGroupingSubjects when the RBAC storage read fails — unreadable file, corrupted g rows, mount/permission problems on the storage path.

Common situations: RBAC file unreadable after permission churn; truncated g section; storage on an unresponsive network volume during namespace-removal gating.

Related errors

• GetNamedGroupingPolicy: %w
• GetFilteredNamedGroupingPolicy: %w
• SavePolicy: %w
• GetNamedPolicy: %w
• GetFilteredNamedPolicy: %w

AI-assisted analysis of weaviate/weaviate@75aa4b6d11 (2026-09-04). Data as JSON: /api/errors/098b23fdf4ca81fd. Report an issue: GitHub.