{"record":{"id":"7b5b0923df9233a2","repo":"grpc/grpc-java","slug":"invalid-resource-in-address-proto","errorCode":null,"errorMessage":"Invalid Resource in address proto","messagePattern":"Invalid Resource in address proto","errorType":"validation","errorClass":"ResourceInvalidException","httpStatus":null,"severity":"error","filePath":"xds/src/main/java/io/grpc/xds/GcpAuthenticationFilter.java","lineNumber":320,"sourceCode":"      final String audience;\n\n      AudienceWrapper(String audience) {\n        this.audience = checkNotNull(audience);\n      }\n    }\n\n    @Override\n    public String getTypeUrl() {\n      return \"type.googleapis.com/envoy.extensions.filters.http.gcp_authn.v3.Audience\";\n    }\n\n    @Override\n    public AudienceWrapper parse(Any any) throws ResourceInvalidException {\n      Audience audience;\n      try {\n        audience = any.unpack(Audience.class);\n      } catch (InvalidProtocolBufferException ex) {\n        throw new ResourceInvalidException(\"Invalid Resource in address proto\", ex);\n      }\n      String url = audience.getUrl();\n      if (url.isEmpty()) {\n        throw new ResourceInvalidException(\n            \"Audience URL is empty. Metadata value must contain a valid URL.\");\n      }\n      return new AudienceWrapper(url);\n    }\n  }\n}\n","sourceCodeStart":302,"sourceCodeEnd":331,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/xds/src/main/java/io/grpc/xds/GcpAuthenticationFilter.java#L302-L331","documentation":"GcpAuthenticationFilter's AudienceWrapper.parse unpacks the filter metadata Any payload into an envoy.extensions.filters.http.gcp_authn.v3.Audience; if the bytes are not a valid Audience proto (InvalidProtocolBufferException), it throws ResourceInvalidException 'Invalid Resource in address proto'. The filter's typed per-route/filter metadata is not the expected message type.","triggerScenarios":"xDS config (filter metadata / per-filter config for gcp_authn) containing an Any whose type_url matches but whose serialized bytes fail Audience.unpack — wrong message type, truncated bytes, or mismatched proto definition.","commonSituations":"Control plane packs the wrong message under the gcp_authn audience metadata type URL; hand-crafted bootstrap/LDS metadata; proto schema mismatch between server and client versions.","solutions":["Ensure the Any payload for the gcp_authn audience metadata is a properly serialized envoy.extensions.filters.http.gcp_authn.v3.Audience with a matching type_url.","Check the wrapped InvalidProtocolBufferException for byte-level clues (unexpected end-group, wrong wire type).","Align control-plane and grpc-java proto versions so the Audience schema matches.","Regenerate/republish the filter metadata from your management server."],"exampleFix":"// before — wrong message packed under audience metadata\nAny.pack(SomeOtherMessage.getDefaultInstance())\n// after\nAny.pack(Audience.newBuilder().setUrl(\"https://metadata.google.internal\").build())","handlingStrategy":"validation","validationCode":"// verify the Any payload type before sending\nif (!any.getTypeUrl().endsWith(\"/envoy.extensions.filters.http.gcp_authn.v3.Audience\")) {\n  throw new IllegalArgumentException(\"gcp_authn metadata must be Audience\");\n}\nAudience.parseFrom(any.getValue()); // throws if bytes invalid","typeGuard":null,"tryCatchPattern":"try { /* parse filter config */ } catch (ResourceInvalidException e) { log.error(\"gcp_authn audience invalid: {}\", e.getMessage(), e.getCause()); }","preventionTips":["Always pack filter metadata with Any.pack(Audience) from the matching proto version","Keep proto definitions in sync between control plane and grpc-java","Test metadata serialization round-trip before deploying"],"tags":["xds","gcp-authn","protobuf","config-parsing"],"backgroundTag":"protobuf-unmarshal-failed","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}