grpc/grpc-go · error

"deny_rules" %v

Error message

"deny_rules" %v

What it means

Raised by translatePolicy when parseRules fails on the deny_rules array; the wrapped %v is the underlying parseRules error (typically error 82 or 83, i.e. a missing rule name or a bad request block inside a deny rule). It is prefixed with "deny_rules" so you know which array is at fault.

Source

Thrown at authz/rbac_translator.go:383

	d.DisallowUnknownFields()
	if err := d.Decode(policy); err != nil {
		return nil, "", fmt.Errorf("failed to unmarshal policy: %v", err)
	}
	if policy.Name == "" {
		return nil, "", fmt.Errorf(`"name" is not present`)
	}
	if len(policy.AllowRules) == 0 {
		return nil, "", fmt.Errorf(`"allow_rules" is not present`)
	}
	allowLogger, denyLogger, err := policy.AuditLoggingOptions.toProtos()
	if err != nil {
		return nil, "", err
	}
	rbacs := make([]*v3rbacpb.RBAC, 0, 2)
	if len(policy.DenyRules) > 0 {
		denyPolicies, err := parseRules(policy.DenyRules, policy.Name)
		if err != nil {
			return nil, "", fmt.Errorf(`"deny_rules" %v`, err)
		}
		denyRBAC := &v3rbacpb.RBAC{
			Action:              v3rbacpb.RBAC_DENY,
			Policies:            denyPolicies,
			AuditLoggingOptions: denyLogger,
		}
		rbacs = append(rbacs, denyRBAC)
	}
	allowPolicies, err := parseRules(policy.AllowRules, policy.Name)
	if err != nil {
		return nil, "", fmt.Errorf(`"allow_rules" %v`, err)
	}
	allowRBAC := &v3rbacpb.RBAC{Action: v3rbacpb.RBAC_ALLOW, Policies: allowPolicies, AuditLoggingOptions: allowLogger}
	return append(rbacs, allowRBAC), policy.Name, nil
}

View on GitHub (pinned to 03255a9237)

Solutions

1. Read the wrapped %v — it contains the rule index and the specific sub-error (name missing vs request invalid).
2. Fix the flagged deny_rules entry (add name, fix request block).
3. Mirror the same validation you apply to allow_rules onto deny_rules in a unit test.
4. If the deny rule is no longer needed, remove it rather than leaving a half-edited entry.

Example fix

// before:
"deny_rules": [ { "source": { "principals": ["bad"] } } ]   // missing "name" -> parseRules error

// after:
"deny_rules": [ { "name": "deny-bad", "source": { "principals": ["bad"] } } ]

// Reuse validateRuleNames/validateRuleRequests scoped to deny_rules.
func validateDenyRules(policyStr string) error {
    var p struct {
        DenyRules []struct {
            Name    string          `json:"name"`
            Request json.RawMessage `json:"request"`
        } `json:"deny_rules"`
    }
    if err := json.Unmarshal([]byte(policyStr), &p); err != nil { return err }
    for i, r := range p.DenyRules {
        if r.Name == "" {
            return fmt.Errorf(`"deny_rules"[%d]: "name" is not present`, i)
        }
    }
    return nil
}

When it happens

Trigger: The policy has deny_rules and one of its entries fails parseRules (no name, or a malformed request). translatePolicy wraps and re-throws the parseRules error.

Common situations: Adding deny rules by copying allow rules and forgetting to set the name; introducing a header/path matcher typo specifically in a deny rule; refactoring rules and leaving a deny entry incomplete.

Related errors

• %d: %v
• "name" is not present
• "allow_rules" is not present
• "allow_rules" %v
• %d: "name" is not present

AI-assisted analysis of grpc/grpc-go@03255a9237 (2026-08-07). Data as JSON: /api/errors/2629d040aadf4688. Report an issue: GitHub.