grpc/grpc-go · error

%d: %v

Error message

%d: %v

What it means

Raised by parseRules when parseRequest(rule.Request) fails for rule at index %d; the wrapped %v is the underlying request-parsing error (e.g. malformed path/header matcher). The gRPC authz translator converts each rule's "request" block into an RBAC Permission, so any invalid field in that block surfaces here with its index.

Source

Thrown at authz/rbac_translator.go:278

	if len(and) > 0 {
		return permissionAnd(and), nil
	}
	return &v3rbacpb.Permission{
		Rule: &v3rbacpb.Permission_Any{
			Any: true,
		},
	}, nil
}

func parseRules(rules []rule, prefixName string) (map[string]*v3rbacpb.Policy, error) {
	policies := make(map[string]*v3rbacpb.Policy)
	for i, rule := range rules {
		if rule.Name == "" {
			return policies, fmt.Errorf(`%d: "name" is not present`, i)
		}
		permission, err := parseRequest(rule.Request)
		if err != nil {
			return nil, fmt.Errorf("%d: %v", i, err)
		}
		policyName := prefixName + "_" + rule.Name
		policies[policyName] = &v3rbacpb.Policy{
			Principals:  []*v3rbacpb.Principal{parsePeer(rule.Source)},
			Permissions: []*v3rbacpb.Permission{permission},
		}
	}
	return policies, nil
}

// Parse auditLoggingOptions to the associated RBAC protos. The single
// auditLoggingOptions results in two different parsed protos, one for the allow
// policy and one for the deny policy
func (options *auditLoggingOptions) toProtos() (allow *v3rbacpb.RBAC_AuditLoggingOptions, deny *v3rbacpb.RBAC_AuditLoggingOptions, err error) {
	allow = &v3rbacpb.RBAC_AuditLoggingOptions{}
	deny = &v3rbacpb.RBAC_AuditLoggingOptions{}

	if options.AuditCondition != "" {

View on GitHub (pinned to 03255a9237)

Solutions

1. Read the wrapped %v in the error message — it names the exact request sub-field that failed (path/header).
2. Go to the rule at the reported index and fix the flagged field (e.g. supply a valid header name, a non-empty path).
3. Add a unit test that parses the policy JSON through the same translator path to fail fast on invalid request blocks.
4. Diff the policy against the SDK's documented request schema for your gRPC version.

Example fix

// before:
{ "name": "r0", "request": { "headers": [ { "key": "", "values": ["x"] } ] } }  // empty header key -> parseHeaders fails

// after:
{ "name": "r0", "request": { "headers": [ { "key": "x-custom", "values": ["allowed"] } ] } }

// Pre-flight: round-trip each rule's request through the SDK structs to
// surface request-block errors before serving the policy.
func validateRuleRequests(policyStr string) error {
    var p struct {
        AllowRules []struct {
            Name    string          `json:"name"`
            Request json.RawMessage `json:"request"`
        } `json:"allow_rules"`
        DenyRules []struct {
            Name    string          `json:"name"`
            Request json.RawMessage `json:"request"`
        } `json:"deny_rules"`
    }
    if err := json.Unmarshal([]byte(policyStr), &p); err != nil { return err }
    for i, r := range p.AllowRules {
        var req interface{} // replace with the SDK request struct
        if err := json.Unmarshal(r.Request, &req); err != nil {
            return fmt.Errorf("allow_rules[%d]: %v", i, err)
        }
    }
    for i, r := range p.DenyRules {
        var req interface{}
        if err := json.Unmarshal(r.Request, &req); err != nil {
            return fmt.Errorf("deny_rules[%d]: %v", i, err)
        }
    }
    return nil
}

When it happens

Trigger: An allow_rules/deny_rules entry has a "request" object whose Paths or Headers fail validation inside parseRequest/parsePaths/parseHeaders. The error bubbles up wrapped as `index: underlying-error`.

Common situations: A header matcher with an invalid key or an unsupported matcher type; a path entry that is empty or fails the path-syntax check; a schema change in the SDK where a previously-tolerated field is now rejected; YAML-to-JSON conversion mangling nested header objects.

Related errors

• "name" is not present
• "allow_rules" is not present
• "deny_rules" %v
• "allow_rules" %v
• %d: "name" is not present

AI-assisted analysis of grpc/grpc-go@03255a9237 (2026-08-07). Data as JSON: /api/errors/421b952590e49e7e. Report an issue: GitHub.