{"record":{"id":"dc3c7fc7eb5d0fa5","repo":"grpc/grpc-java","slug":"invalid-allowed-grpc-services-config-for-targetu","errorCode":null,"errorMessage":"Invalid allowed_grpc_services config for ${targetUri}","messagePattern":"Invalid allowed_grpc_services config for (.+?)","errorType":"exception","errorClass":"XdsInitializationException","httpStatus":null,"severity":"critical","filePath":"xds/src/main/java/io/grpc/xds/GrpcBootstrapperImpl.java","lineNumber":188,"sourceCode":"      }\n    }\n    return null;\n  }\n\n  @Override\n  protected Optional<Object> parseImplSpecificObject(\n      @Nullable Map<String, ?> rawAllowedGrpcServices)\n      throws XdsInitializationException {\n    if (rawAllowedGrpcServices == null || rawAllowedGrpcServices.isEmpty()) {\n      return Optional.of(GrpcBootstrapImplConfig.create(AllowedGrpcServices.empty()));\n    }\n\n    ImmutableMap.Builder<String, AllowedGrpcService> builder =\n        ImmutableMap.builder();\n    for (String targetUri : rawAllowedGrpcServices.keySet()) {\n      Map<String, ?> serviceConfig = JsonUtil.getObject(rawAllowedGrpcServices, targetUri);\n      if (serviceConfig == null) {\n        throw new XdsInitializationException(\n            \"Invalid allowed_grpc_services config for \" + targetUri);\n      }\n      ConfiguredChannelCredentials configuredChannel =\n          getChannelCredentials(serviceConfig, targetUri);\n\n      Optional<CallCredentials> callCredentials = Optional.empty();\n      List<?> rawCallCredsList = JsonUtil.getList(serviceConfig, \"call_creds\");\n      if (rawCallCredsList != null && !rawCallCredsList.isEmpty()) {\n        callCredentials =\n            parseCallCredentials(JsonUtil.checkObjectList(rawCallCredsList), targetUri);\n      }\n\n      AllowedGrpcService.Builder b = AllowedGrpcService.builder()\n          .configuredChannelCredentials(configuredChannel);\n      callCredentials.ifPresent(b::callCredentials);\n      builder.put(targetUri, b.build());\n    }\n    GrpcBootstrapImplConfig customConfig =","sourceCodeStart":170,"sourceCodeEnd":206,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/xds/src/main/java/io/grpc/xds/GrpcBootstrapperImpl.java#L170-L206","documentation":"Thrown by GrpcBootstrapperImpl.parseImplSpecificObject when an entry in the bootstrap's allowed_grpc_services map does not resolve to a JSON object. Each key (target URI) must map to a server-config object containing at least channel_creds; if the value is missing, null, or of the wrong JSON type (e.g. a string or array), parsing fails with this error.","triggerScenarios":"Bootstrap contains allowed_grpc_services where a target URI maps to a non-object value (string, list, or null) instead of an object with channel_creds, so JsonUtil.getObject returns null.","commonSituations":"Hand-written bootstrap with shorthand values for allowed_grpc_services; copy-paste errors merging JSON blocks; tooling that serializes the map values as strings.","solutions":["Ensure every value in allowed_grpc_services is a JSON object containing channel_creds for that target URI.","Re-check the bootstrap schema: allowed_grpc_services is a map of URI -> server config object, not a list of URIs.","Run the bootstrap JSON through a schema validator or a working example before deploying."],"exampleFix":"// before (bootstrap.json)\n\"allowed_grpc_services\": {\"trafficdirector.googleapis.com\": \"default\"}\n// after\n\"allowed_grpc_services\": {\"trafficdirector.googleapis.com\": {\"channel_creds\": [{\"type\": \"google_default\"}]}}","handlingStrategy":"validation","validationCode":"// Pre-check allowed_grpc_services shape\nMap<String, ?> services = JsonUtil.getObject(bootstrap, \"allowed_grpc_services\");\nfor (String uri : services.keySet()) {\n  if (JsonUtil.getObject(services, uri) == null) {\n    throw new IllegalArgumentException(\"allowed_grpc_services[\" + uri + \"] must be an object\");\n  }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always map each allowed service URI to a full config object, not a string","Validate the whole bootstrap file in CI before rollout","Copy structure from a working bootstrap example"],"tags":["xds","bootstrap","config","schema"],"backgroundTag":"schema-validation-failed","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}