{"record":{"id":"4f43409f0d6236e4","repo":"grpc/grpc-go","slug":"rbac-error-parsing-config-v-unknown-type-t","errorCode":null,"errorMessage":"rbac: error parsing config %v: unknown type %T","messagePattern":"rbac: error parsing config (.+?): unknown type %T","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/xds/httpfilter/rbac/rbac.go","lineNumber":135,"sourceCode":"\tce, err := rbac.NewChainEngine([]*v3rbacpb.RBAC{rbacCfg.GetRules()}, \"\")\n\tif err != nil {\n\t\t// \"At this time, if the RBAC.action is Action.LOG then the policy will be\n\t\t// completely ignored, as if RBAC was not configured.\" - A41\n\t\tif rbacCfg.GetRules().GetAction() != v3rbacpb.RBAC_LOG {\n\t\t\treturn nil, fmt.Errorf(\"rbac: error constructing matching engine: %v\", err)\n\t\t}\n\t}\n\n\treturn config{chainEngine: ce}, nil\n}\n\nfunc (builder) ParseFilterConfig(cfg proto.Message) (httpfilter.FilterConfig, error) {\n\tif cfg == nil {\n\t\treturn nil, fmt.Errorf(\"rbac: nil configuration message provided\")\n\t}\n\tm, ok := cfg.(*anypb.Any)\n\tif !ok {\n\t\treturn nil, fmt.Errorf(\"rbac: error parsing config %v: unknown type %T\", cfg, cfg)\n\t}\n\tmsg := new(rpb.RBAC)\n\tif err := m.UnmarshalTo(msg); err != nil {\n\t\treturn nil, fmt.Errorf(\"rbac: error parsing config %v: %v\", cfg, err)\n\t}\n\treturn parseConfig(msg)\n}\n\nfunc (builder) ParseFilterConfigOverride(override proto.Message) (httpfilter.FilterConfig, error) {\n\tif override == nil {\n\t\treturn nil, fmt.Errorf(\"rbac: nil configuration message provided\")\n\t}\n\tm, ok := override.(*anypb.Any)\n\tif !ok {\n\t\treturn nil, fmt.Errorf(\"rbac: error parsing override config %v: unknown type %T\", override, override)\n\t}\n\tmsg := new(rpb.RBACPerRoute)\n\tif err := m.UnmarshalTo(msg); err != nil {","sourceCodeStart":117,"sourceCodeEnd":153,"githubUrl":"https://github.com/grpc/grpc-go/blob/03255a9237b6eb32710f6bc4f2de9a675b99fe36/internal/xds/httpfilter/rbac/rbac.go#L117-L153","documentation":"ParseFilterConfig expects the incoming proto.Message to be an *anypb.Any. Any other concrete Go type indicates the xDS marshaling layer delivered the wrong type to the RBAC builder - typically an internal wiring bug rather than user config.","triggerScenarios":"The xdsclient/unmarshal path passes a non-Any proto.Message (e.g. the concrete *rpb.RBAC directly, or a *wrapperspb.StringValue) into ParseFilterConfig.","commonSituations":"Version skew between the httpfilter registry and the marshaling layer; a custom xDS client implementation bypassing the Any-wrapping convention; a fork that changed the marshaling pipeline.","solutions":["Verify the RBAC builder's TypeURLs() match the resource's @type.","Ensure the xDS unmarshal path wraps filter configs in *anypb.Any before invoking the builder."],"exampleFix":"// before: passing a concrete proto instead of Any\n//   cfg := &rpb.RBAC{Rules: rules}\n//   fc, err := b.ParseFilterConfig(cfg)\n//\n// after: wrap in Any\n//   anyCfg, _ := anypb.New(cfg)\n//   fc, err := b.ParseFilterConfig(anyCfg)","handlingStrategy":"type-guard","validationCode":null,"typeGuard":"// Ensure the value handed to ParseFilterConfig is an *anypb.Any.\nfunc isAny(m proto.Message) bool {\n\t_, ok := m.(*anypb.Any)\n\treturn ok\n}","tryCatchPattern":null,"preventionTips":["Always wrap filter configs in *anypb.Any in xDS marshaling code.","Run the standard grpc-go xdsclient rather than a custom marshaling pipeline to stay consistent with builder expectations."],"tags":["rbac","xds","grpc","type-mismatch"],"analyzedSha":"03255a9237b6eb32710f6bc4f2de9a675b99fe36","analyzedAt":"2026-08-07T00:29:34.215Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}