{"record":{"id":"eec14aaff8ef0fe0","repo":"grpc/grpc-go","slug":"extauthz-failed-to-unmarshal-override-config-v","errorCode":null,"errorMessage":"extauthz: failed to unmarshal override config %v: %v","messagePattern":"extauthz: failed to unmarshal override config (.+?): (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/xds/httpfilter/ext_authz/ext_authz.go","lineNumber":176,"sourceCode":"\t\tdecoderHeaderMutationRules: mutationRules,\n\t\tincludePeerCertificate:     msg.GetIncludePeerCertificate(),\n\t}, nil\n}\n\n// ParseFilterConfigOverride parses the provided override configuration.\n//\n// Note that ExtAuthzPerRoute is unmarshaled to verify its syntax during xDS\n// resource validation, no filter configuration object is returned. Per-route\n// disabling is supported via the generic FilterConfig wrapper mechanism rather\n// than the ExtAuthzPerRoute.disabled field directly.\nfunc (builder) ParseFilterConfigOverride(overrideCfg proto.Message) (httpfilter.FilterConfig, error) {\n\tm, ok := overrideCfg.(*anypb.Any)\n\tif !ok {\n\t\treturn nil, fmt.Errorf(\"extauthz: error parsing override config %v: unknown type %T, want *anypb.Any\", overrideCfg, overrideCfg)\n\t}\n\tmsg := new(v3extauthzpb.ExtAuthzPerRoute)\n\tif err := m.UnmarshalTo(msg); err != nil {\n\t\treturn nil, fmt.Errorf(\"extauthz: failed to unmarshal override config %v: %v\", overrideCfg, err)\n\t}\n\treturn nil, nil\n}\n\nfunc (builder) IsTerminal() bool {\n\treturn false\n}\n","sourceCodeStart":158,"sourceCodeEnd":184,"githubUrl":"https://github.com/grpc/grpc-go/blob/03255a9237b6eb32710f6bc4f2de9a675b99fe36/internal/xds/httpfilter/ext_authz/ext_authz.go#L158-L184","documentation":"Raised by ParseFilterConfigOverride (ext_authz.go:176) when the override Any's bytes fail to deserialize into envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute. Like error 360 but for the per-route override: structurally invalid wire data for the declared type causes the RDS resource to be NACKed.","triggerScenarios":"The override is a valid *anypb.Any but m.UnmarshalTo(new(v3extauthzpb.ExtAuthzPerRoute)) at ext_authz.go:175 returns a non-nil error — corrupt/truncated bytes, or payload serialized from a different message than the ExtAuthzPerRoute type_url claims.","commonSituations":"typed_per_filter_config entry whose @type says ExtAuthzPerRoute but whose body is a different proto; v2/v3 version mismatch; a malformed per-route override generated by a templating tool.","solutions":["Inspect the wrapped %v for the protobuf-level cause (unexpected EOF = truncation; unknown field = version skew).","Verify the override type_url is 'type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute' and the body decodes as that exact message.","Re-emit the per-route override from a corrected control-plane template and confirm ACK."],"exampleFix":"// before: per-route override payload is not a valid ExtAuthzPerRoute\n//   typed_per_filter_config:\n//     envoy.filters.http.ext_authz:\n//       \"@type\": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute\n//       <bytes of a different message>\n//\n// after\nimport (\n  \"google.golang.org/protobuf/types/known/anypb\"\n  v3extauthzpb \"github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/ext_authz/v3\"\n)\nperRoute := &v3extauthzpb.ExtAuthzPerRoute{ /* disabled or overrides */ }\nanyOv, err := anypb.New(perRoute)","handlingStrategy":"validation","validationCode":"// Validate an ExtAuthzPerRoute override Any before publishing (ext_authz.go:174-177).\nfunc validateExtAuthzPerRouteAny(a *anypb.Any) error {\n    if a == nil || a.TypeUrl != \"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute\" {\n        return fmt.Errorf(\"wrong/nil type_url for ExtAuthzPerRoute\")\n    }\n    msg := new(v3extauthzpb.ExtAuthzPerRoute)\n    if err := a.UnmarshalTo(msg); err != nil {\n        return fmt.Errorf(\"ExtAuthzPerRoute payload invalid: %w\", err)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use anypb.New to build per-route overrides so type_url and payload stay consistent.","Ensure per-route override type URLs use the v3 ExtAuthzPerRoute name.","Decode override Any.value in CI before publishing to the control plane."],"tags":["grpc","xds","protobuf","config","ext-authz"],"analyzedSha":"03255a9237b6eb32710f6bc4f2de9a675b99fe36","analyzedAt":"2026-08-07T00:29:34.215Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}