grpc/grpc-go · error

extauthz: error parsing config %v: unknown type %T, want *an

Error message

extauthz: error parsing config %v: unknown type %T, want *anypb.Any

What it means

Returned at the top of ext_authz builder.ParseFilterConfig when the proto.Message argument is not a *anypb.Any. The httpfilter framework always supplies *anypb.Any, so a non-Any type indicates a framework misuse or a direct call with the wrong type.

Source

Thrown at internal/xds/httpfilter/ext_authz/ext_authz.go:95

	}

	// If the numerator exceeds the denominator, cap the fractional value at 100%.
	num := min(fracPercent.GetNumerator(), den)
	return fraction{numerator: num, denominator: den}, nil
}

// grpcStatusCode converts an HTTP status code to a gRPC status code.
func grpcStatusCode(httpStatus int32) codes.Code {
	if code, ok := transport.HTTPStatusConvTab[int(httpStatus)]; ok {
		return code
	}
	return codes.Unknown
}

func (builder) ParseFilterConfig(cfg proto.Message) (httpfilter.FilterConfig, error) {
	m, ok := cfg.(*anypb.Any)
	if !ok {
		return nil, fmt.Errorf("extauthz: error parsing config %v: unknown type %T, want *anypb.Any", cfg, cfg)
	}
	msg := new(v3extauthzpb.ExtAuthz)
	if err := m.UnmarshalTo(msg); err != nil {
		return nil, fmt.Errorf("extauthz: failed to unmarshal config: %v", err)
	}

	if msg.GetGrpcService() == nil {
		return nil, fmt.Errorf("extauthz: empty grpc_service provided in config %v", cfg)
	}
	server, err := parseGRPCServiceConfig(msg.GetGrpcService())
	if err != nil {
		return nil, fmt.Errorf("extauthz: failed to parse grpc_service: %v", err)
	}

	filterEnabled, err := parseFilterEnabled(msg.GetFilterEnabled())
	if err != nil {
		return nil, err
	}

View on GitHub (pinned to 03255a9237)

Solutions

1. When calling ParseFilterConfig directly, wrap the proto with anypb.New first.
2. If reached through the standard xDS path, report it as a framework integration bug.

Example fix

// before
cfg, err := b.ParseFilterConfig(extAuthzProto) // *v3extauthzpb.ExtAuthz

// after
any, _ := anypb.New(extAuthzProto)
cfg, err := b.ParseFilterConfig(any)

func isExtAuthzAny(m proto.Message) (*anypb.Any, bool) {
    a, ok := m.(*anypb.Any)
    return a, ok
}

When it happens

Trigger: A direct invocation of ParseFilterConfig with a raw *v3extauthzpb.ExtAuthz instead of *anypb.Any, or an integration bug that fails to Any-wrap the config.

Common situations: Custom test code or a forked httpfilter dispatcher that passes concrete proto types; normal xDS-driven parsing always provides *anypb.Any.

Related errors

• parseGRPCServiceConfig not implemented
• rls_csp: error parsing config %v: unknown type %T
• extauthz: missing default_value in filter_enabled
• extauthz: failed to unmarshal config: %v
• extauthz: empty grpc_service provided in config %v

AI-assisted analysis of grpc/grpc-go@03255a9237 (2026-08-07). Data as JSON: /api/errors/f9add31e63a98989. Report an issue: GitHub.