{"record":{"id":"1f20f992d25a5e68","repo":"grpc/grpc-java","slug":"failed-to-parse-grpcservice-config-e-getmessage","errorCode":null,"errorMessage":"Failed to parse GrpcService config: ${e.getMessage()}","messagePattern":"Failed to parse GrpcService config: (.+?)","errorType":"validation","errorClass":"ExtAuthzParseException","httpStatus":null,"severity":"error","filePath":"xds/src/main/java/io/grpc/xds/ExtAuthzConfigParser.java","lineNumber":60,"sourceCode":"   * create an {@link ExtAuthzConfig} instance.\n   *\n   * @param extAuthzProto The ext_authz proto to parse.\n   * @return An {@link ExtAuthzConfig} instance.\n   * @throws ExtAuthzParseException if the proto is invalid or contains unsupported features.\n   */\n  public static ExtAuthzConfig parse(\n      ExtAuthz extAuthzProto, BootstrapInfo bootstrapInfo, ServerInfo serverInfo)\n      throws ExtAuthzParseException {\n    if (!extAuthzProto.hasGrpcService()) {\n      throw new ExtAuthzParseException(\n          \"unsupported ExtAuthz service type: only grpc_service is supported\");\n    }\n    GrpcServiceConfig grpcServiceConfig;\n    try {\n      grpcServiceConfig =\n          GrpcServiceConfigParser.parse(extAuthzProto.getGrpcService(), bootstrapInfo, serverInfo);\n    } catch (GrpcServiceParseException e) {\n      throw new ExtAuthzParseException(\"Failed to parse GrpcService config: \" + e.getMessage(), e);\n    }\n    ExtAuthzConfig.Builder builder = ExtAuthzConfig.builder().grpcService(grpcServiceConfig)\n        .failureModeAllow(extAuthzProto.getFailureModeAllow())\n        .failureModeAllowHeaderAdd(extAuthzProto.getFailureModeAllowHeaderAdd())\n        .includePeerCertificate(extAuthzProto.getIncludePeerCertificate())\n        .denyAtDisable(extAuthzProto.getDenyAtDisable().getDefaultValue().getValue());\n\n    if (extAuthzProto.hasFilterEnabled()) {\n      try {\n        builder.filterEnabled(\n            MatcherParser.parseFractionMatcher(extAuthzProto.getFilterEnabled().getDefaultValue()));\n      } catch (IllegalArgumentException e) {\n        throw new ExtAuthzParseException(e.getMessage());\n      }\n    }\n\n    if (extAuthzProto.hasStatusOnError()) {\n      builder.statusOnError(","sourceCodeStart":42,"sourceCodeEnd":78,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/xds/src/main/java/io/grpc/xds/ExtAuthzConfigParser.java#L42-L78","documentation":"ExtAuthzConfigParser.parse wraps any GrpcServiceParseException from GrpcServiceConfigParser.parse in an ExtAuthzParseException, prefixing with 'Failed to parse GrpcService config:'. It means the grpc_service section of the io.envoy.extensions.filters.http.ext_authz.v3.ExtAuthz proto in the xDS filter config is malformed or references unknown resources. The library throws it to abort building the ext_authz filter config early with a clear cause chain.","triggerScenarios":"ClientXdsClient parsing an HTTP filter config whose ext_authz proto has a grpc_service that GrpcServiceConfigParser rejects — e.g. missing target Uri, invalid channel creds, unknown fields, or a server_info reference that doesn't resolve in the bootstrap.","commonSituations":"Misconfigured Envoy/ext_authz filter metadata in a control-plane LDS response; typo'd grpc_service target URI; referencing a GoogleGrpc settings block the Java parser doesn't support; bootstrap server_info names not matching the filter's authority.","solutions":["Read the wrapped GrpcServiceParseException cause to see the specific grpc_service field that failed and fix it in the LDS filter config.","Ensure ext_authz.grpc_service has a valid transport (google_grpc or grpc) with a resolvable target_uri present in the bootstrap server_info.","Check ClientXdsClient logs and the proto received from the management server for unexpected or unsupported fields.","Verify your control plane (Istio/Envoy admin) emits a grpc_service schema this grpc-java xDS version supports."],"exampleFix":"// before (LDS ext_authz filter config)\n\"grpcService\": { \"targetUri\": \"ext-authz.default.svc:9000\" }\n// after — use the fully-qualified, bootstrap-matching target\n\"grpcService\": { \"googleGrpc\": { \"targetUri\": \"ext-authz.default.svc.cluster.local:9000\", \"statPrefix\": \"ext_authz\" } }","handlingStrategy":"validation","validationCode":"// before submitting config, verify grpc_service basics in the ext_authz filter JSON\nJSONObject cfg = /* filter config */;\nJSONObject grpcService = cfg.optJSONObject(\"grpcService\");\nif (grpcService == null || (!grpcService.has(\"targetUri\") && !grpcService.has(\"googleGrpc\"))) {\n    throw new IllegalArgumentException(\"ext_authz grpc_service missing target\");\n}","typeGuard":null,"tryCatchPattern":"try { /* configure xDS channel */ } catch (ExtAuthzParseException e) { log.error(\"ext_authz grpc_service invalid: {}\", e.getMessage(), e.getCause()); }","preventionTips":["Validate LDS filter protos against the Envoy ext_authz schema before pushing them","Keep grpc_service target URIs consistent with bootstrap server_info names","Log the full cause chain (GrpcServiceParseException) when debugging"],"tags":["xds","config-parsing","ext-authz","grpc-service"],"backgroundTag":"schema-validation-failed","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}