{"record":{"id":"ba6b3fb28b7c85c7","repo":"grpc/grpc-go","slug":"extauthz-empty-grpc-service-provided-in-config-v","errorCode":null,"errorMessage":"extauthz: empty grpc_service provided in config %v","messagePattern":"extauthz: empty grpc_service provided in config (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/xds/httpfilter/ext_authz/ext_authz.go","lineNumber":103,"sourceCode":"func grpcStatusCode(httpStatus int32) codes.Code {\n\tif code, ok := transport.HTTPStatusConvTab[int(httpStatus)]; ok {\n\t\treturn code\n\t}\n\treturn codes.Unknown\n}\n\nfunc (builder) ParseFilterConfig(cfg proto.Message) (httpfilter.FilterConfig, error) {\n\tm, ok := cfg.(*anypb.Any)\n\tif !ok {\n\t\treturn nil, fmt.Errorf(\"extauthz: error parsing config %v: unknown type %T, want *anypb.Any\", cfg, cfg)\n\t}\n\tmsg := new(v3extauthzpb.ExtAuthz)\n\tif err := m.UnmarshalTo(msg); err != nil {\n\t\treturn nil, fmt.Errorf(\"extauthz: failed to unmarshal config: %v\", err)\n\t}\n\n\tif msg.GetGrpcService() == nil {\n\t\treturn nil, fmt.Errorf(\"extauthz: empty grpc_service provided in config %v\", cfg)\n\t}\n\tserver, err := parseGRPCServiceConfig(msg.GetGrpcService())\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"extauthz: failed to parse grpc_service: %v\", err)\n\t}\n\n\tfilterEnabled, err := parseFilterEnabled(msg.GetFilterEnabled())\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tvar denyAtDisable bool\n\tif denyAtDisableFlag := msg.GetDenyAtDisable(); denyAtDisableFlag != nil {\n\t\tif denyAtDisableFlag.GetDefaultValue() == nil {\n\t\t\treturn nil, fmt.Errorf(\"extauthz: missing default_value in deny_at_disable\")\n\t\t}\n\t\tdenyAtDisable = denyAtDisableFlag.GetDefaultValue().GetValue()\n\t}","sourceCodeStart":85,"sourceCodeEnd":121,"githubUrl":"https://github.com/grpc/grpc-go/blob/03255a9237b6eb32710f6bc4f2de9a675b99fe36/internal/xds/httpfilter/ext_authz/ext_authz.go#L85-L121","documentation":"Raised by ParseFilterConfig (ext_authz.go:103) after the ExtAuthz proto is successfully unmarshaled but its grpc_service field is unset (nil). External authorization requires a backend gRPC service to send Check requests to, so a config with no grpc_service is unusable and the resource is rejected.","triggerScenarios":"An LDS HTTP filter typed_config that unmarshals to a valid ExtAuthz whose oneof Services is left unset, i.e. msg.GetGrpcService() == nil at ext_authz.go:102.","commonSituations":"An Envoy filter config that only sets http_service (not yet supported by gRPC's ext_authz) and omits grpc_service; a control-plane template with a typo or a conditional that drops the grpc_service block; a partially-rendered config during a rollout.","solutions":["Add a grpc_service block to the ext_authz filter config in your control-plane/LDS resource (gRPC's implementation requires the gRPC variant, not http_service).","Verify the grpc_service uses the google_grpc target specifier with a non-empty target_uri, since parseGRPCServiceConfig may reject envoy_grpc.","Re-apply the listener and confirm the xDS resource is ACKed (no NACK) by the gRPC client."],"exampleFix":"// before\n//   ext_authz: { }   // grpc_service omitted -> error 361\n//\n// after\n//   ext_authz: {\n//     grpc_service: {\n//       google_grpc: { target_uri: \"authz-server:9091\" }\n//     }\n//   }","handlingStrategy":"validation","validationCode":"// Ensure the ExtAuthz config carries a grpc_service (ext_authz.go:102-104).\nfunc ensureGrpcService(cfg *v3extauthzpb.ExtAuthz) error {\n    if cfg.GetGrpcService() == nil {\n        return fmt.Errorf(\"ext_authz: grpc_service must be set\")\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat grpc_service as required in any ext_authz control-plane template/schema.","Remember gRPC's ext_authz only supports grpc_service (google_grpc); http_service alone is not accepted.","Add a policy-as-code check (OPA/kyverno) that rejects ext_authz filters without a grpc_service."],"tags":["grpc","xds","config","ext-authz","grpc-service"],"analyzedSha":"03255a9237b6eb32710f6bc4f2de9a675b99fe36","analyzedAt":"2026-08-07T00:29:34.215Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}