grpc/grpc-go · error

extauthz: missing default_value in filter_enabled

Error message

extauthz: missing default_value in filter_enabled

What it means

Returned by parseFilterEnabled when the ExtAuthz config provides a filter_enabled RuntimeFractionalPercent whose default_value (the FractionalPercent) is nil. A present-but-empty filter_enabled is treated as a config error; an absent (nil) filter_enabled defaults to 100%.

Source

Thrown at internal/xds/httpfilter/ext_authz/ext_authz.go:68

	}
)

type builder struct{}

func (builder) TypeURLs() []string {
	return []string{
		"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz",
		"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
	}
}

func parseFilterEnabled(fp *v3corepb.RuntimeFractionalPercent) (fraction, error) {
	if fp == nil {
		return fraction{numerator: 100, denominator: 100}, nil
	}
	fracPercent := fp.GetDefaultValue()
	if fracPercent == nil {
		return fraction{}, fmt.Errorf("extauthz: missing default_value in filter_enabled")
	}

	den := uint32(100)
	switch fracPercent.GetDenominator() {
	case v3typepb.FractionalPercent_TEN_THOUSAND:
		den = 10000
	case v3typepb.FractionalPercent_MILLION:
		den = 1000000
	}

	// If the numerator exceeds the denominator, cap the fractional value at 100%.
	num := min(fracPercent.GetNumerator(), den)
	return fraction{numerator: num, denominator: den}, nil
}

// grpcStatusCode converts an HTTP status code to a gRPC status code.
func grpcStatusCode(httpStatus int32) codes.Code {
	if code, ok := transport.HTTPStatusConvTab[int(httpStatus)]; ok {

View on GitHub (pinned to 03255a9237)

Solutions

1. On the management server, either omit filter_enabled (defaults to 100%) or fully populate filter_enabled.default_value with numerator and denominator.
2. Validate the ExtAuthz config before publishing to ensure default_value is set whenever filter_enabled is present.

// Ensure filter_enabled.default_value is set when filter_enabled is present.
func validateFilterEnabled(fp *v3corepb.RuntimeFractionalPercent) error {
    if fp != nil && fp.GetDefaultValue() == nil {
        return errors.New("filter_enabled present but default_value missing")
    }
    return nil
}

When it happens

Trigger: An xDS ExtAuthz config where filter_enabled is set as a non-nil RuntimeFractionalPercent but its default_value field is omitted, producing a nil FractionalPercent.

Common situations: Control plane partially populating filter_enabled (setting the wrapper but not the inner default_value), or a tool/UI that emits an empty filter_enabled object. Envoy and Traffic Director normally omit the field entirely or fully populate it.

Related errors

• extauthz: failed to unmarshal config: %v
• extauthz: empty grpc_service provided in config %v
• extauthz: failed to parse grpc_service: %v
• extauthz: missing default_value in deny_at_disable
• extauthz: error parsing override config %v: unknown type %T,

AI-assisted analysis of grpc/grpc-go@03255a9237 (2026-08-07). Data as JSON: /api/errors/ed5a9e62663a7ed3. Report an issue: GitHub.