grpc/grpc-go · error

failed to parse AuditCondition %v. Allowed values {NONE, ON_

Error message

failed to parse AuditCondition %v. Allowed values {NONE, ON_DENY, ON_ALLOW, ON_DENY_AND_ALLOW}

What it means

Raised by auditLoggingOptions.toProtos when the policy's audit_logging_options.audit_condition string is not a key in the RBAC_AuditLoggingOptions_AuditCondition enum map. The gRPC authz SDK accepts exactly NONE, ON_DENY, ON_ALLOW, ON_DENY_AND_ALLOW (case-sensitive, as defined in the envoy.config.rbac.v3 RBAC proto). Any other value — including lowercase variants or typos — is rejected.

Source

Thrown at authz/rbac_translator.go:299

		policies[policyName] = &v3rbacpb.Policy{
			Principals:  []*v3rbacpb.Principal{parsePeer(rule.Source)},
			Permissions: []*v3rbacpb.Permission{permission},
		}
	}
	return policies, nil
}

// Parse auditLoggingOptions to the associated RBAC protos. The single
// auditLoggingOptions results in two different parsed protos, one for the allow
// policy and one for the deny policy
func (options *auditLoggingOptions) toProtos() (allow *v3rbacpb.RBAC_AuditLoggingOptions, deny *v3rbacpb.RBAC_AuditLoggingOptions, err error) {
	allow = &v3rbacpb.RBAC_AuditLoggingOptions{}
	deny = &v3rbacpb.RBAC_AuditLoggingOptions{}

	if options.AuditCondition != "" {
		rbacCondition, ok := v3rbacpb.RBAC_AuditLoggingOptions_AuditCondition_value[options.AuditCondition]
		if !ok {
			return nil, nil, fmt.Errorf("failed to parse AuditCondition %v. Allowed values {NONE, ON_DENY, ON_ALLOW, ON_DENY_AND_ALLOW}", options.AuditCondition)
		}
		allow.AuditCondition = v3rbacpb.RBAC_AuditLoggingOptions_AuditCondition(rbacCondition)
		deny.AuditCondition = toDenyCondition(v3rbacpb.RBAC_AuditLoggingOptions_AuditCondition(rbacCondition))
	}

	for i, config := range options.AuditLoggers {
		if config.Name == "" {
			return nil, nil, fmt.Errorf("missing required field: name in audit_logging_options.audit_loggers[%v]", i)
		}
		if config.Config == nil {
			config.Config = &structpb.Struct{}
		}
		typedStruct := &v1xdsudpatypepb.TypedStruct{
			TypeUrl: typeURLPrefix + config.Name,
			Value:   config.Config,
		}
		customConfig, err := anypb.New(typedStruct)
		if err != nil {

View on GitHub (pinned to 03255a9237)

Solutions

1. Set audit_condition to one of the four exact strings: NONE, ON_DENY, ON_ALLOW, ON_DENY_AND_ALLOW (uppercase).
2. Remove the audit_logging_options block entirely if you don't need auditing — it defaults cleanly.
3. Pin your policy template to the enum values documented for your exact grpc-go authz version.
4. Add a CI lint that checks audit_condition against the allowed set before deploy.

Example fix

// before:
"audit_logging_options": { "audit_condition": "on_deny" }   // lowercase -> rejected

// after:
"audit_logging_options": { "audit_condition": "ON_DENY" }

var allowedAuditConditions = map[string]bool{
    "NONE": true, "ON_DENY": true, "ON_ALLOW": true, "ON_DENY_AND_ALLOW": true,
}
func validateAuditCondition(policyStr string) error {
    var p struct {
        AuditLoggingOptions struct {
            AuditCondition string `json:"audit_condition"`
        } `json:"audit_logging_options"`
    }
    if err := json.Unmarshal([]byte(policyStr), &p); err != nil { return err }
    c := p.AuditLoggingOptions.AuditCondition
    if c != "" && !allowedAuditConditions[c] {
        return fmt.Errorf("invalid audit_condition %q; allowed: NONE, ON_DENY, ON_ALLOW, ON_DENY_AND_ALLOW", c)
    }
    return nil
}

When it happens

Trigger: The authorization-policy JSON contains an audit_logging_options block whose "audit_condition" is misspelled, lowercase, or from an older/newer schema. toProtos looks up the string in the enum-value map and the `!ok` branch fires.

Common situations: Using lowercase "on_deny" instead of "ON_DENY"; copying an Envoy-style enum value not in the SDK's allow-list; upgrading the authz SDK and an old audit_condition value was removed; a typo like "ON_DENY_AND_ALL".

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• missing required field: name in audit_logging_options.audit_
• error parsing custom audit logger config: %v
• %d: "name" is not present
• %d: %v
• failed to unmarshal policy: %v

AI-assisted analysis of grpc/grpc-go@03255a9237 (2026-08-07). Data as JSON: /api/errors/3d1a2113372f3b34. Report an issue: GitHub.