{"record":{"id":"79a73044db67cfe4","repo":"grpc/grpc-go","slug":"extproc-failed-to-create-channel-to-the-external","errorCode":null,"errorMessage":"extproc: failed to create channel to the external processor server %q: %v","messagePattern":"extproc: failed to create channel to the external processor server %q: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"internal/xds/httpfilter/extproc/ext_proc.go","lineNumber":254,"sourceCode":"\tb, ok := base.(baseConfig)\n\tif !ok {\n\t\treturn nil, fmt.Errorf(\"extproc: incorrect config type provided (%T): %v\", base, base)\n\t}\n\n\tvar ov overrideConfig\n\tif override != nil {\n\t\tov, ok = override.(overrideConfig)\n\t\tif !ok {\n\t\t\treturn nil, fmt.Errorf(\"extproc: incorrect override config type provided (%T): %v\", override, override)\n\t\t}\n\t}\n\n\tconfig := newInterceptorConfig(b, ov)\n\n\t// Create a channel to the external processor server.\n\tcc, cancel, err := iextproc.CreateExtProcChannel(config.server)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"extproc: failed to create channel to the external processor server %q: %v\", config.server.TargetURI, err)\n\t}\n\treturn &clientInterceptor{\n\t\tconfig:          config,\n\t\tprocClient:      v3procservicegrpc.NewExternalProcessorClient(cc),\n\t\tcloseClient:     cancel,\n\t\tmetricsRecorder: cf.metricsRecorder,\n\t\ttarget:          cf.target,\n\t}, nil\n}\n\ntype clientInterceptor struct {\n\tconfig          baseConfig\n\tprocClient      v3procservicegrpc.ExternalProcessorClient\n\tcloseClient     func() error\n\tmetricsRecorder estats.MetricsRecorder\n\ttarget          string\n}\n","sourceCodeStart":236,"sourceCodeEnd":272,"githubUrl":"https://github.com/grpc/grpc-go/blob/03255a9237b6eb32710f6bc4f2de9a675b99fe36/internal/xds/httpfilter/extproc/ext_proc.go#L236-L272","documentation":"Raised by BuildClientInterceptor when iextproc.CreateExtProcChannel(config.server) fails. The filter could not establish a gRPC client channel to the configured external processor server (the dial failed before any RPC), so the interceptor cannot be built and the filter is rejected for that target.","triggerScenarios":"Dialing config.server.TargetURI fails: DNS resolution error, no route to host, TLS handshake/cert verification failure, bad authority scheme, connection refused, or the channel factory rejecting the GRPCServiceConfig (e.g. invalid credentials).","commonSituations":"Ext-proc server pod is down or Service has no ready endpoints. TLS CA cert misconfigured or hostname mismatch. target_uri uses a scheme the resolver does not understand. Network policy/firewall blocking the port. Service mesh sidecar not injected so the authority is unreachable.","solutions":["Check the wrapped dial error (%v) — it distinguishes DNS failure, TLS failure, and connection refused.","Verify config.server.TargetURI resolves and the ext-proc server is reachable (grpcurl / kubectl port-forward / telnet to the port).","Fix TLS: ensure the CA bundle and SNI/override match the server certificate, or switch to plaintext for debugging.","If transient, ensure the channel factory has retry/backoff and the LDS update is reprocessed once endpoints come back."],"exampleFix":"// before: unreachable target\ngrpc_service:\n  envoy_grpc:\n    cluster_name: ext_proc_cluster   # cluster has 0 healthy endpoints\n\n// after: target resolves to a live ext-proc server\ngrpc_service:\n  envoy_grpc:\n    cluster_name: ext_proc_cluster   # cluster backs a healthy Service+Deployment","handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"// Channel/dial failures surface from BuildClientInterceptor as a wrapped error;\n// retry by reprocessing the LDS resource once endpoints/TLS are fixed.\nci, err := cf.BuildClientInterceptor(base, ov)\nif err != nil {\n    if strings.Contains(err.Error(), \"failed to create channel to the external processor server\") {\n        // transient: surface to xdsclient to retry on next update\n    }\n    return err\n}","preventionTips":["Keep the ext_proc cluster healthy (readiness probes, enough replicas).","Validate TLS CA/SNI against the server certificate before publishing LDS.","Use a resolvable target_uri scheme (dns:///, xds:///) supported by the client."],"tags":["extproc","network","dial","tls","connectivity"],"analyzedSha":"03255a9237b6eb32710f6bc4f2de9a675b99fe36","analyzedAt":"2026-08-07T00:29:34.215Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}