extauthz: missing default_value in filter_enabled

Error message

extauthz: missing default_value in filter_enabled

What it means

The ExtAuthz config includes a filter_enabled RuntimeFractionalPercent but its default_value field is nil (ext_authz.go:66-68). The default_value (a FractionalPercent) is required to compute the sampling fraction that determines what percentage of requests the authorization filter applies to.

Solutions

Ensure the xDS server sets filter_enabled.default_value with a numerator and denominator (e.g. {numerator: 100, denominator: HUNDRED})
If filter_enabled is not needed, leave it unset entirely — parseFilterEnabled returns 100% when the field is nil (ext_authz.go:63-65)
Check the Envoy/xDS server filter configuration template for missing default_value

Defensive patterns

Strategy: validation

Validate before calling

// Validate filter_enabled has a default_value before processing.
if fe := msg.GetFilterEnabled(); fe != nil && fe.GetDefaultValue() == nil {
    return fmt.Errorf("extauthz: filter_enabled is set but missing required default_value")
}

Prevention

Validate ExtAuthz filter config completeness on the xDS server before deployment
Use xDS config validation tools that check for required nested fields
When setting filter_enabled, always include default_value with numerator and denominator
If sampling is not needed, omit filter_enabled entirely rather than sending a partial config

When it happens

Trigger: parseFilterEnabled is called with a non-nil RuntimeFractionalPercent whose GetDefaultValue() returns nil. This happens when the xDS server sets the filter_enabled wrapper but omits the nested default_value.

Common situations: xDS server configures filter_enabled but omits the nested default_value sub-message; partial or template-generated ExtAuthz config that leaves default_value unset; Envoy configuration translation bug that drops the default_value field.

Related errors

AI-assisted analysis of grpc/grpc-go@0c51461d27 (2026-08-11). Data as JSON: /api/errors/ed5a9e62663a7ed3. Report an issue: GitHub.

Appendix: source

Thrown at internal/xds/httpfilter/ext_authz/ext_authz.go:68

	}
)

type builder struct{}

func (builder) TypeURLs() []string {
	return []string{
		"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz",
		"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
	}
}

func parseFilterEnabled(fp *v3corepb.RuntimeFractionalPercent) (fraction, error) {
	if fp == nil {
		return fraction{numerator: 100, denominator: 100}, nil
	}
	fracPercent := fp.GetDefaultValue()
	if fracPercent == nil {
		return fraction{}, fmt.Errorf("extauthz: missing default_value in filter_enabled")
	}

	den := uint32(100)
	switch fracPercent.GetDenominator() {
	case v3typepb.FractionalPercent_TEN_THOUSAND:
		den = 10000
	case v3typepb.FractionalPercent_MILLION:
		den = 1000000
	}

	// If the numerator exceeds the denominator, cap the fractional value at 100%.
	num := min(fracPercent.GetNumerator(), den)
	return fraction{numerator: num, denominator: den}, nil
}

// grpcStatusCode converts an HTTP status code to a gRPC status code.
func grpcStatusCode(httpStatus int32) codes.Code {
	if code, ok := transport.HTTPStatusConvTab[int(httpStatus)]; ok {

View on GitHub (pinned to 0c51461d27)