{"record":{"id":"d3d3682d66b1b985","repo":"grpc/grpc-go","slug":"rbac-policy-checkedcondition-is-present","errorCode":null,"errorMessage":"rbac: policy.CheckedCondition is present","messagePattern":"rbac: policy\\.CheckedCondition is present","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/xds/httpfilter/rbac/rbac.go","lineNumber":67,"sourceCode":"\nfunc (builder) TypeURLs() []string {\n\treturn []string{\n\t\t\"type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC\",\n\t\t\"type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBACPerRoute\",\n\t}\n}\n\n// Parsing is the same for the base config and the override config.\nfunc parseConfig(rbacCfg *rpb.RBAC) (httpfilter.FilterConfig, error) {\n\t// All the validation logic described in A41.\n\tfor _, policy := range rbacCfg.GetRules().GetPolicies() {\n\t\t// \"Policy.condition and Policy.checked_condition must cause a\n\t\t// validation failure if present.\" - A41\n\t\tif policy.Condition != nil {\n\t\t\treturn nil, errors.New(\"rbac: Policy.condition is present\")\n\t\t}\n\t\tif policy.CheckedCondition != nil {\n\t\t\treturn nil, errors.New(\"rbac: policy.CheckedCondition is present\")\n\t\t}\n\n\t\t// \"It is also a validation failure if Permission or Principal has a\n\t\t// header matcher for a grpc- prefixed header name or :scheme.\" - A41\n\t\tfor _, principal := range policy.Principals {\n\t\t\tname := principal.GetHeader().GetName()\n\t\t\tif name == \":scheme\" || strings.HasPrefix(name, \"grpc-\") {\n\t\t\t\treturn nil, fmt.Errorf(\"rbac: principal header matcher for %v is :scheme or starts with grpc\", name)\n\t\t\t}\n\t\t}\n\t\tfor _, permission := range policy.Permissions {\n\t\t\tname := permission.GetHeader().GetName()\n\t\t\tif name == \":scheme\" || strings.HasPrefix(name, \"grpc-\") {\n\t\t\t\treturn nil, fmt.Errorf(\"rbac: permission header matcher for %v is :scheme or starts with grpc\", name)\n\t\t\t}\n\t\t}\n\t}\n","sourceCodeStart":49,"sourceCodeEnd":85,"githubUrl":"https://github.com/grpc/grpc-go/blob/03255a9237b6eb32710f6bc4f2de9a675b99fe36/internal/xds/httpfilter/rbac/rbac.go#L49-L85","documentation":"Returned by the RBAC HTTP filter's parseConfig (rbac.go:66-67) when any policy has its checked_condition field set. checked_condition is the 'safe-to-log' CEL variant, but gRPC RBAC (per gRFC A41) implements neither condition nor checked_condition, so its presence is a validation failure. The check runs right after the condition check in the same policy loop.","triggerScenarios":"An xDS RBAC HTTP filter config whose rules.policies[*].checked_condition is populated. parseConfig detects policy.CheckedCondition != nil and returns this error, NACKing the resource.","commonSituations":"Envoy RBAC configs that opted for checked_condition (logging-safe CEL) being served to gRPC; migrating an Envoy policy verbatim; control planes not stripping gRPC-incompatible fields.","solutions":["Strip the checked_condition field from every RBAC policy before serving to gRPC.","Re-express the intended rule using supported permission/principal matchers.","Run an xDS/RBAC pre-publish lint that rejects policies with condition or checked_condition set."],"exampleFix":"// before\n//   policies: { p1: { checked_condition: { ...CEL... }, permissions: [...] } }\n// after\n//   policies: { p1: { permissions: [...], principals: [...] } }  // no checked_condition","handlingStrategy":"validation","validationCode":"func rbacPoliciesHaveNoCheckedCondition(cfg *rpb.RBAC) error {\n    for _, p := range cfg.GetRules().GetPolicies() {\n        if p.GetCheckedCondition() != nil {\n            return fmt.Errorf(\"policy %q uses unsupported checked_condition\", p)\n        }\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Strip both condition and checked_condition from RBAC policies for gRPC.","Prefer matcher-based rules over CEL expressions.","Run a config lint that rejects either CEL field before serving."],"tags":["xds","rbac","http-filter","config","cel"],"analyzedSha":"03255a9237b6eb32710f6bc4f2de9a675b99fe36","analyzedAt":"2026-08-07T00:29:34.215Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}