{"record":{"id":"0609eba5d13cbeed","repo":"grpc/grpc-go","slug":"gcpauthn-cache-config-cache-size-must-be-greater","errorCode":null,"errorMessage":"gcpauthn: cache_config.cache_size must be greater than zero","messagePattern":"gcpauthn: cache_config\\.cache_size must be greater than zero","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/xds/httpfilter/gcp_authn/gcp_authn_filter.go","lineNumber":75,"sourceCode":"\nfunc (builder) TypeURLs() []string {\n\treturn []string{\"type.googleapis.com/envoy.extensions.filters.http.gcp_authn.v3.GcpAuthnFilterConfig\"}\n}\n\nfunc (builder) ParseFilterConfig(cfg proto.Message) (httpfilter.FilterConfig, error) {\n\tm, ok := cfg.(*anypb.Any)\n\tif !ok {\n\t\treturn nil, fmt.Errorf(\"gcpauthn: invalid filter config type %T\", cfg)\n\t}\n\tmsg := &v3gcpauthnpb.GcpAuthnFilterConfig{}\n\tif err := m.UnmarshalTo(msg); err != nil {\n\t\treturn nil, fmt.Errorf(\"gcpauthn: failed to unmarshal filter config: %v\", err)\n\t}\n\n\tcacheSize := uint64(defaultCacheSize)\n\tif cacheSizeConfig := msg.GetCacheConfig().GetCacheSize(); cacheSizeConfig != nil {\n\t\tif cacheSize = cacheSizeConfig.GetValue(); cacheSize == 0 {\n\t\t\treturn nil, fmt.Errorf(\"gcpauthn: cache_config.cache_size must be greater than zero\")\n\t\t}\n\t}\n\n\treturn config{cacheSize: cacheSize}, nil\n}\n\n// ParseFilterConfigOverride parses the provided override configuration.\n//\n// Note that we don't support overrides for this filter configuration,\n// but still validate it as part of the normal resource validation.\nfunc (b builder) ParseFilterConfigOverride(cfg proto.Message) (httpfilter.FilterConfig, error) {\n\treturn b.ParseFilterConfig(cfg)\n}\n\nfunc (builder) IsTerminal() bool {\n\treturn false\n}\n","sourceCodeStart":57,"sourceCodeEnd":93,"githubUrl":"https://github.com/grpc/grpc-go/blob/03255a9237b6eb32710f6bc4f2de9a675b99fe36/internal/xds/httpfilter/gcp_authn/gcp_authn_filter.go#L57-L93","documentation":"If cache_config.cache_size is explicitly set, it must be strictly greater than zero (gcp_authn_filter.go:74). A value of zero would create a useless credentials cache, so it is rejected; an unset cache_size falls back to the default of 10.","triggerScenarios":"The GcpAuthnFilterConfig.cache_config.cache_size is a non-nil wrapper whose value is 0.","commonSituations":"Operator explicitly sets cache_size: 0 thinking it means 'default' or 'unlimited'; templating that leaves cache_size at its protobuf zero default inside a wrapper; config generation bug emitting a wrapped zero.","solutions":["Set cache_config.cache_size to a positive integer (or omit it to get the default of 10).","If the field is genuinely optional in your config schema, do not emit a wrapper at all.","Validate generated xDS resources reject wrapped-zero cache sizes in CI."],"exampleFix":"// before\ncfg := &v3gcpauthnpb.GcpAuthnFilterConfig{CacheConfig: &v3gcpauthnpb.CacheConfig{CacheSize: wrapperspb.UInt64(0)}}\n\n// after: positive size (or omit to use default 10)\ncfg := &v3gcpauthnpb.GcpAuthnFilterConfig{CacheConfig: &v3gcpauthnpb.CacheConfig{CacheSize: wrapperspb.UInt64(100)}}","handlingStrategy":"validation","validationCode":"if cs := msg.GetCacheConfig().GetCacheSize(); cs != nil && cs.GetValue() == 0 {\n    return errors.New(\"cache_size must be > 0; omit for default\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Set cache_size to a positive integer or omit it (default 10).","Never wrap a zero value; an absent field is the way to say 'default'.","Add a CI rule rejecting wrapped-zero cache sizes."],"tags":["gcp-authn","grpc","xds","config","validation","go"],"analyzedSha":"03255a9237b6eb32710f6bc4f2de9a675b99fe36","analyzedAt":"2026-08-07T00:29:34.215Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}