grpc/grpc-go · error

extauthz: missing default_value in deny_at_disable

Error message

extauthz: missing default_value in deny_at_disable

What it means

Raised by ParseFilterConfig (ext_authz.go:118) when the config sets the deny_at_disable field (the message is non-nil) but its default_value sub-message is nil. deny_at_disable.default_value carries the actual boolean controlling whether traffic is denied when the filter is disabled; without it the behavior is ambiguous, so the resource is rejected.

Source

Thrown at internal/xds/httpfilter/ext_authz/ext_authz.go:118

	}

	if msg.GetGrpcService() == nil {
		return nil, fmt.Errorf("extauthz: empty grpc_service provided in config %v", cfg)
	}
	server, err := parseGRPCServiceConfig(msg.GetGrpcService())
	if err != nil {
		return nil, fmt.Errorf("extauthz: failed to parse grpc_service: %v", err)
	}

	filterEnabled, err := parseFilterEnabled(msg.GetFilterEnabled())
	if err != nil {
		return nil, err
	}

	var denyAtDisable bool
	if denyAtDisableFlag := msg.GetDenyAtDisable(); denyAtDisableFlag != nil {
		if denyAtDisableFlag.GetDefaultValue() == nil {
			return nil, fmt.Errorf("extauthz: missing default_value in deny_at_disable")
		}
		denyAtDisable = denyAtDisableFlag.GetDefaultValue().GetValue()
	}

	httpStatus := int32(http.StatusForbidden)
	if st := msg.GetStatusOnError().GetCode(); st != 0 {
		httpStatus = int32(st)
	}
	statusOnError := grpcStatusCode(httpStatus)

	mutationRules, err := httpfilter.HeaderMutationRulesFromProto(msg.GetDecoderHeaderMutationRules())
	if err != nil {
		return nil, err
	}

	var allowedHeaders, disallowedHeaders []matcher.StringMatcher
	if allowed := msg.GetAllowedHeaders(); allowed != nil {
		allowedHeaders, err = httpfilter.ConvertStringMatchers(allowed.GetPatterns())

View on GitHub (pinned to 03255a9237)

Solutions

1. Either omit deny_at_disable entirely (the code at ext_authz.go:116 only validates when the field is present) or populate it fully.
2. When present, set deny_at_disable.default_value to a FractionalPercent/BoolValue carrying an explicit value, e.g. default_value: { value: true }.
3. Re-deploy the LDS resource and verify the client ACKs it.

Example fix

// before
//   ext_authz: { deny_at_disable: { } }   // default_value missing -> error 363
//
// after (option A: fully populate)
//   ext_authz: { deny_at_disable: { default_value: { value: true } } }
//
// after (option B: omit it entirely)

// Mirror ext_authz.go:115-121: deny_at_disable, if set, must carry default_value.
func validateDenyAtDisable(cfg *v3extauthzpb.ExtAuthz) error {
    d := cfg.GetDenyAtDisable()
    if d != nil && d.GetDefaultValue() == nil {
        return fmt.Errorf("deny_at_disable set without default_value")
    }
    return nil
}

When it happens

Trigger: msg.GetDenyAtDisable() is non-nil at ext_authz.go:116, but denyAtDisableFlag.GetDefaultValue() returns nil at ext_authz.go:117 — i.e. a RuntimeFractionalPercent-shaped field was provided empty.

Common situations: A control-plane template renders deny_at_disable as an empty object '{ }' (e.g. a Helm value left blank) instead of '{ default_value: { value: true } }'; an incomplete programmatic config that sets the container but forgets the inner value.

Related errors

• extauthz: missing default_value in filter_enabled
• extauthz: failed to unmarshal config: %v
• extauthz: empty grpc_service provided in config %v
• extauthz: failed to parse grpc_service: %v
• extauthz: error parsing override config %v: unknown type %T,

AI-assisted analysis of grpc/grpc-go@03255a9237 (2026-08-07). Data as JSON: /api/errors/f669488814955627. Report an issue: GitHub.