{"record":{"id":"70edb777fbd55e4f","repo":"grpc/grpc-java","slug":"failed-to-parse-rbac-policy-s","errorCode":null,"errorMessage":"Failed to parse Rbac policy: %s","messagePattern":"Failed to parse Rbac policy: (.+?)","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"xds/src/main/java/io/grpc/xds/InternalRbacFilter.java","lineNumber":34,"sourceCode":"\npackage io.grpc.xds;\n\nimport io.envoyproxy.envoy.extensions.filters.http.rbac.v3.RBAC;\nimport io.grpc.Internal;\nimport io.grpc.ServerInterceptor;\nimport io.grpc.xds.Filter.FilterContext;\n\n/** This class exposes some functionality in RbacFilter to other packages. */\n@Internal\npublic final class InternalRbacFilter {\n\n  private InternalRbacFilter() {}\n\n  /** Parses RBAC filter config and creates AuthorizationServerInterceptor. */\n  public static ServerInterceptor createInterceptor(RBAC rbac) {\n    ConfigOrError<RbacConfig> filterConfig = RbacFilter.Provider.parseRbacConfig(rbac);\n    if (filterConfig.errorDetail != null) {\n      throw new IllegalArgumentException(\n        String.format(\"Failed to parse Rbac policy: %s\", filterConfig.errorDetail));\n    }\n    return new RbacFilter.Provider().newInstance(\n        FilterContext.create(\"internalRbacFilter\", new io.grpc.MetricRecorder() {}))\n        .buildServerInterceptor(filterConfig.config, null);\n  }\n}\n","sourceCodeStart":16,"sourceCodeEnd":42,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/xds/src/main/java/io/grpc/xds/InternalRbacFilter.java#L16-L42","documentation":"IllegalArgumentException thrown by InternalRbacFilter.createInterceptor when RbacFilter.Provider.parseRbacConfig fails to convert an envoy RBAC proto into a RbacConfig, returning a ConfigOrError with a non-null errorDetail. It means the RBAC policy configuration supplied to the interceptor is invalid.","triggerScenarios":"Calling InternalRbacFilter.createInterceptor(rbac) with an RBAC proto whose rules/permissions/principals are unsupported or malformed (e.g. unknown action, missing rules, unsupported permission matcher).","commonSituations":"Embedding gRPC servers behind an RBAC policy authored for Envoy with unsupported fields; typo'd RBAC rule fields; RBAC proto from a newer Envoy API than the grpc-xds library supports.","solutions":["Read filterConfig.errorDetail (included in the exception message) to see the exact parse failure","Simplify/fix the RBAC policy: ensure action is ALLOW/DENY, rules is present, and only supported permission/principal matchers are used","Align the envoy protos version in your control plane with the version supported by your grpc-xds release","Remove unsupported RBAC fields (e.g. unknown condition expressions) from the policy"],"exampleFix":"// before: RBAC with unsupported/empty rules\nRBAC.newBuilder().setAction(RBAC.Action.LOG).build()\n// after\nRBAC.newBuilder().setAction(RBAC.Action.ALLOW)\n    .setRules(RBAC.Rules.newBuilder().putPolicies(\"p\", Policy.newBuilder()...))\n    .build()","handlingStrategy":"validation","validationCode":"// sanity-check the RBAC proto before calling createInterceptor\nif (rbac.getAction() != RBAC.Action.ALLOW && rbac.getAction() != RBAC.Action.DENY) {\n  throw new IllegalArgumentException(\"Unsupported RBAC action: \" + rbac.getAction());\n}\nif (!rbac.hasRules()) {\n  throw new IllegalArgumentException(\"RBAC policy missing rules\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only use RBAC actions and matchers supported by grpc-xds","Validate Envoy RBAC configs against the proto schema before deployment","Catch IllegalArgumentException around createInterceptor and surface filterConfig.errorDetail","Keep the envoy protos dependency version aligned with the control plane"],"tags":["xds","rbac","config-parsing","authorization"],"backgroundTag":"schema-validation-failed","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}