{"record":{"id":"51eb67bae2ad6a48","repo":"grpc/grpc-go","slug":"rbac-policy-condition-is-present","errorCode":null,"errorMessage":"rbac: Policy.condition is present","messagePattern":"rbac: Policy\\.condition is present","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/xds/httpfilter/rbac/rbac.go","lineNumber":64,"sourceCode":"\thttpfilter.FilterConfig\n\tchainEngine *rbac.ChainEngine\n}\n\nfunc (builder) TypeURLs() []string {\n\treturn []string{\n\t\t\"type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC\",\n\t\t\"type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBACPerRoute\",\n\t}\n}\n\n// Parsing is the same for the base config and the override config.\nfunc parseConfig(rbacCfg *rpb.RBAC) (httpfilter.FilterConfig, error) {\n\t// All the validation logic described in A41.\n\tfor _, policy := range rbacCfg.GetRules().GetPolicies() {\n\t\t// \"Policy.condition and Policy.checked_condition must cause a\n\t\t// validation failure if present.\" - A41\n\t\tif policy.Condition != nil {\n\t\t\treturn nil, errors.New(\"rbac: Policy.condition is present\")\n\t\t}\n\t\tif policy.CheckedCondition != nil {\n\t\t\treturn nil, errors.New(\"rbac: policy.CheckedCondition is present\")\n\t\t}\n\n\t\t// \"It is also a validation failure if Permission or Principal has a\n\t\t// header matcher for a grpc- prefixed header name or :scheme.\" - A41\n\t\tfor _, principal := range policy.Principals {\n\t\t\tname := principal.GetHeader().GetName()\n\t\t\tif name == \":scheme\" || strings.HasPrefix(name, \"grpc-\") {\n\t\t\t\treturn nil, fmt.Errorf(\"rbac: principal header matcher for %v is :scheme or starts with grpc\", name)\n\t\t\t}\n\t\t}\n\t\tfor _, permission := range policy.Permissions {\n\t\t\tname := permission.GetHeader().GetName()\n\t\t\tif name == \":scheme\" || strings.HasPrefix(name, \"grpc-\") {\n\t\t\t\treturn nil, fmt.Errorf(\"rbac: permission header matcher for %v is :scheme or starts with grpc\", name)\n\t\t\t}","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/grpc/grpc-go/blob/03255a9237b6eb32710f6bc4f2de9a675b99fe36/internal/xds/httpfilter/rbac/rbac.go#L46-L82","documentation":"Returned by the RBAC HTTP filter's parseConfig (rbac.go:63-64) when any policy in the RBAC rules has its condition field set. Per gRFC A41, gRPC's RBAC engine does not implement CEL condition expressions on policies, so their presence is a hard validation failure that NACKs the xDS config. The loop iterates every policy and rejects on the first non-nil Condition.","triggerScenarios":"An xDS RBAC HTTP filter config (type URL envoy.extensions.filters.http.rbac.v3.RBAC) whose rules.policies[*].condition is populated. parseConfig walks each policy and returns this error immediately.","commonSituations":"Porting an Envoy RBAC config that uses CEL conditions into an xDS-served gRPC deployment; a control plane that copies full Envoy RBAC features without filtering gRPC-incompatible ones.","solutions":["Remove the condition field from all RBAC policies in the xDS config; express the same logic via permissions/principals (header, source IP, path matchers) instead.","If CEL logic is mandatory, enforce it outside gRPC RBAC (e.g. an Envoy sidecar or an application-level interceptor).","Validate the RBAC proto before publishing: any policy with condition != nil should be rejected/folded into matchers."],"exampleFix":"// before\n//   policies: { p1: { condition: { ...CEL... }, permissions: [...] } }\n// after\n//   policies: { p1: { permissions: [...], principals: [...] } }  // no condition","handlingStrategy":"validation","validationCode":"func rbacPoliciesHaveNoCondition(cfg *rpb.RBAC) error {\n    for _, p := range cfg.GetRules().GetPolicies() {\n        if p.GetCondition() != nil {\n            return fmt.Errorf(\"policy %q uses unsupported condition\", p)\n        }\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Do not use CEL conditions in RBAC policies destined for gRPC.","Add an xDS/RBAC pre-publish lint rejecting condition fields.","Document that gRPC RBAC only supports permission/principal matchers (gRFC A41)."],"tags":["xds","rbac","http-filter","config","cel"],"analyzedSha":"03255a9237b6eb32710f6bc4f2de9a675b99fe36","analyzedAt":"2026-08-07T00:29:34.215Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}