dapr/dapr · error

failed to load workflow access policies: %w

Error message

failed to load workflow access policies: %w

What it means

Emitted from DaprRuntime.Run when loadWorkflowAccessPolicies fails during sidecar startup. WorkflowAccessPolicy resources are read from disk (standalone mode, resources path) or from the Dapr operator API (Kubernetes mode); individual policies that fail semantic validation are skipped with only a warning, so this error means the loader itself broke: unreadable/unparseable resource files or a failing operator client. The sidecar aborts startup.

Source

Thrown at pkg/runtime/runtime.go:804

	// Create and start internal and external gRPC servers
	a.daprGRPCAPI = grpc.NewAPI(grpc.APIOpts{
		Universal:              a.daprUniversal,
		Logger:                 logger.NewLogger("dapr.grpc.api"),
		Channels:               a.channels,
		PubSubAdapter:          a.pubsubAdapter,
		PubSubAdapterStreamer:  a.pubsubAdapterStreamer,
		Outbox:                 a.outbox,
		DirectMessaging:        a.directMessaging,
		SendToOutputBindingFn:  a.processor.Binding().SendToOutputBinding,
		TracingSpec:            a.globalConfig.GetTracingSpec(),
		AccessControlList:      a.accessControlList,
		Processor:              a.processor,
		WorkflowAccessPolicies: a.workflowAccessPolicies,
	})

	// Load and apply workflow access policies before starting servers.
	if err = a.loadWorkflowAccessPolicies(ctx); err != nil {
		return fmt.Errorf("failed to load workflow access policies: %w", err)
	}

	a.reloader.SetPolicyRecompiler(reconciler.WorkflowAccessPolicyOptions{
		AppID:      a.runtimeConfig.id,
		Loader:     a.reloader.Loader(),
		CompStore:  a.compStore,
		Recompiler: a.workflowAccessPolicies.Store,
		Healthz:    a.runtimeConfig.healthz,
	})

	if err = a.runnerCloser.AddCloser(a.daprGRPCAPI); err != nil {
		return err
	}

	err = a.startGRPCAPIServer(ctx, a.daprGRPCAPI, a.runtimeConfig.apiGRPCPort)
	if err != nil {
		return fmt.Errorf("failed to start API gRPC server: %w", err)
	}

View on GitHub (pinned to 74ad417027)

Solutions

1. Read the wrapped error (%w) to see whether it is a file/parse error (standalone) or a Kubernetes API error
2. In standalone: verify --resources-path exists and every file in it parses as valid YAML/JSON (kubectl apply --dry-run=client or yamllint)
3. In Kubernetes: verify the operator pod is healthy and the daprd service account can list workflowaccesspolicies (check CRD installed and RBAC)
4. Temporarily remove WorkflowAccessPolicy resources to confirm the rest of startup succeeds, then re-add them one by one

Example fix

# before: malformed resource file
apiVersion: dapr.io/v1alpha1
kind: WorkflowAccessPolicy
metadata: { name: wf-policy
  # missing closing brace / bad indent

# after: validate with
kubectl apply --dry-run=client -f resources.yaml

// Before starting daprd, ensure every resource file parses.
import (
  "os"
  "path/filepath"
  "gopkg.in/yaml.v3"
)
func lintResources(dir string) error {
  entries, err := os.ReadDir(dir)
  if err != nil { return err }
  for _, e := range entries {
    if e.IsDir() { continue }
    b, err := os.ReadFile(filepath.Join(dir, e.Name()))
    if err != nil { return err }
    var v any
    if err := yaml.Unmarshal(b, &v); err != nil {
      return fmt.Errorf("%s: %w", e.Name(), err)
    }
  }
  return nil
}

func isWorkflowAccessPolicyLoadErr(err error) bool {
    return err != nil && strings.HasPrefix(err.Error(), "failed to load workflow access policies:")
}

When it happens

Trigger: Running daprd with a resources directory containing a WorkflowAccessPolicy YAML file that is unreadable (permissions) or unparseable (invalid YAML/JSON at the file level); in Kubernetes, the operator client failing to list WorkflowAccessPolicy CRs (API error, RBAC, operator unreachable).

Common situations: A typo or bad indentation in a WorkflowAccessPolicy manifest dropped into the components/resources path; wrong --resources-path pointing at a non-directory; stale CRD version in the cluster so the operator list call fails; custom embedders setting an invalid mode producing a nil loader edge case.

Related errors

• kubeconfig flag is only valid in --mode=kubernetes
• invalid access control spec. missing trustdomain for apps: %
• failed to unmarshal activity HistoryEvent: %s
• failed to unmarshal CreateWorkflowInstanceRequest: %s
• failed to parse default actor idle timeout: %s

AI-assisted analysis of dapr/dapr@74ad417027 (2026-08-16). Data as JSON: /api/errors/cc44c76fb042203e. Report an issue: GitHub.