grpc/grpc-go · error

extauthz: failed to unmarshal override config %v: %v

Error message

extauthz: failed to unmarshal override config %v: %v

What it means

Raised by ParseFilterConfigOverride (ext_authz.go:176) when the override Any's bytes fail to deserialize into envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute. Like error 360 but for the per-route override: structurally invalid wire data for the declared type causes the RDS resource to be NACKed.

Source

Thrown at internal/xds/httpfilter/ext_authz/ext_authz.go:176

		decoderHeaderMutationRules: mutationRules,
		includePeerCertificate:     msg.GetIncludePeerCertificate(),
	}, nil
}

// ParseFilterConfigOverride parses the provided override configuration.
//
// Note that ExtAuthzPerRoute is unmarshaled to verify its syntax during xDS
// resource validation, no filter configuration object is returned. Per-route
// disabling is supported via the generic FilterConfig wrapper mechanism rather
// than the ExtAuthzPerRoute.disabled field directly.
func (builder) ParseFilterConfigOverride(overrideCfg proto.Message) (httpfilter.FilterConfig, error) {
	m, ok := overrideCfg.(*anypb.Any)
	if !ok {
		return nil, fmt.Errorf("extauthz: error parsing override config %v: unknown type %T, want *anypb.Any", overrideCfg, overrideCfg)
	}
	msg := new(v3extauthzpb.ExtAuthzPerRoute)
	if err := m.UnmarshalTo(msg); err != nil {
		return nil, fmt.Errorf("extauthz: failed to unmarshal override config %v: %v", overrideCfg, err)
	}
	return nil, nil
}

func (builder) IsTerminal() bool {
	return false
}

View on GitHub (pinned to 03255a9237)

Solutions

1. Inspect the wrapped %v for the protobuf-level cause (unexpected EOF = truncation; unknown field = version skew).
2. Verify the override type_url is 'type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute' and the body decodes as that exact message.
3. Re-emit the per-route override from a corrected control-plane template and confirm ACK.

Example fix

// before: per-route override payload is not a valid ExtAuthzPerRoute
//   typed_per_filter_config:
//     envoy.filters.http.ext_authz:
//       "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute
//       <bytes of a different message>
//
// after
import (
  "google.golang.org/protobuf/types/known/anypb"
  v3extauthzpb "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/ext_authz/v3"
)
perRoute := &v3extauthzpb.ExtAuthzPerRoute{ /* disabled or overrides */ }
anyOv, err := anypb.New(perRoute)

// Validate an ExtAuthzPerRoute override Any before publishing (ext_authz.go:174-177).
func validateExtAuthzPerRouteAny(a *anypb.Any) error {
    if a == nil || a.TypeUrl != "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute" {
        return fmt.Errorf("wrong/nil type_url for ExtAuthzPerRoute")
    }
    msg := new(v3extauthzpb.ExtAuthzPerRoute)
    if err := a.UnmarshalTo(msg); err != nil {
        return fmt.Errorf("ExtAuthzPerRoute payload invalid: %w", err)
    }
    return nil
}

When it happens

Trigger: The override is a valid *anypb.Any but m.UnmarshalTo(new(v3extauthzpb.ExtAuthzPerRoute)) at ext_authz.go:175 returns a non-nil error — corrupt/truncated bytes, or payload serialized from a different message than the ExtAuthzPerRoute type_url claims.

Common situations: typed_per_filter_config entry whose @type says ExtAuthzPerRoute but whose body is a different proto; v2/v3 version mismatch; a malformed per-route override generated by a templating tool.

Related errors

• extauthz: failed to unmarshal config: %v
• rls_csp: error parsing config %v: %v
• extauthz: missing default_value in filter_enabled
• extauthz: empty grpc_service provided in config %v
• extauthz: failed to parse grpc_service: %v

AI-assisted analysis of grpc/grpc-go@03255a9237 (2026-08-07). Data as JSON: /api/errors/eec14aaff8ef0fe0. Report an issue: GitHub.