grpc/grpc-go · error

extauthz: failed to parse grpc_service: %v

Error message

extauthz: failed to parse grpc_service: %v

What it means

Raised by ParseFilterConfig (ext_authz.go:107) when parseGRPCServiceConfig rejects the supplied GrpcService proto. In this build parseGRPCServiceConfig (ext_authz.go:48) is a placeholder that returns 'parseGRPCServiceConfig not implemented' until gRFC A102 lands; the test override additionally rejects anything that is not a google_grpc with a non-empty target_uri.

Source

Thrown at internal/xds/httpfilter/ext_authz/ext_authz.go:107

	return codes.Unknown
}

func (builder) ParseFilterConfig(cfg proto.Message) (httpfilter.FilterConfig, error) {
	m, ok := cfg.(*anypb.Any)
	if !ok {
		return nil, fmt.Errorf("extauthz: error parsing config %v: unknown type %T, want *anypb.Any", cfg, cfg)
	}
	msg := new(v3extauthzpb.ExtAuthz)
	if err := m.UnmarshalTo(msg); err != nil {
		return nil, fmt.Errorf("extauthz: failed to unmarshal config: %v", err)
	}

	if msg.GetGrpcService() == nil {
		return nil, fmt.Errorf("extauthz: empty grpc_service provided in config %v", cfg)
	}
	server, err := parseGRPCServiceConfig(msg.GetGrpcService())
	if err != nil {
		return nil, fmt.Errorf("extauthz: failed to parse grpc_service: %v", err)
	}

	filterEnabled, err := parseFilterEnabled(msg.GetFilterEnabled())
	if err != nil {
		return nil, err
	}

	var denyAtDisable bool
	if denyAtDisableFlag := msg.GetDenyAtDisable(); denyAtDisableFlag != nil {
		if denyAtDisableFlag.GetDefaultValue() == nil {
			return nil, fmt.Errorf("extauthz: missing default_value in deny_at_disable")
		}
		denyAtDisable = denyAtDisableFlag.GetDefaultValue().GetValue()
	}

	httpStatus := int32(http.StatusForbidden)
	if st := msg.GetStatusOnError().GetCode(); st != 0 {
		httpStatus = int32(st)

View on GitHub (pinned to 03255a9237)

Solutions

1. If you hit 'parseGRPCServiceConfig not implemented', this gRPC version has not wired in A102 grpc_service parsing for ext_authz; use a build/feature flag that enables it or a gRPC version where the parser is registered.
2. Ensure the grpc_service uses google_grpc (GrpcService_GoogleGrpc) rather than envoy_grpc.
3. Set a non-empty target_uri on google_grpc pointing at your authorization server.
4. Confirm there are no unsupported fields (call credentials / channel credentials JSON) the active parser cannot consume.

Example fix

// before: envoy_grpc is not parseable by the current parser
//   grpc_service: { envoy_grpc: { cluster_name: "authz" } }
//
// after: google_grpc with a concrete target
//   grpc_service: {
//     google_grpc: { target_uri: "dns:///authz-server.ns:9091" }
//   }

// Pre-validate the grpc_service the way the parser will (see ext_authz.go:105-108
// and the test parser testParseGRPCServiceConfig).
func validateAuthzGrpcService(gs *v3corepb.GrpcService) error {
    if gs == nil {
        return fmt.Errorf("grpc_service is nil")
    }
    if gs.GetGoogleGrpc() == nil {
        return fmt.Errorf("only google_grpc grpc_service is supported")
    }
    if gs.GetGoogleGrpc().GetTargetUri() == "" {
        return fmt.Errorf("target_uri must be a non-empty string")
    }
    return nil
}

When it happens

Trigger: msg.GetGrpcService() is non-nil, but parseGRPCServiceConfig returns an error: either the stub 'not implemented' error (the A102 parser isn't wired in yet), or a real parse error such as an envoy_grpc specifier or an empty target_uri.

Common situations: Running an ext_authz filter on a gRPC build where gRFC A102 grpc_service parsing is not yet enabled (stub returns not-implemented); the control plane emits envoy_grpc instead of google_grpc; target_uri is blank in the google_grpc block.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• extauthz: empty grpc_service provided in config %v
• extauthz: missing default_value in filter_enabled
• extauthz: failed to unmarshal config: %v
• extauthz: missing default_value in deny_at_disable
• extauthz: error parsing override config %v: unknown type %T,

AI-assisted analysis of grpc/grpc-go@03255a9237 (2026-08-07). Data as JSON: /api/errors/23fefd2d090672fa. Report an issue: GitHub.