gcpauthn: cache_config.cache_size must be greater than zero

Error message

gcpauthn: cache_config.cache_size must be greater than zero

What it means

If cache_config.cache_size is explicitly set, it must be strictly greater than zero (gcp_authn_filter.go:74). A value of zero would create a useless credentials cache, so it is rejected; an unset cache_size falls back to the default of 10.

Source

Thrown at internal/xds/httpfilter/gcp_authn/gcp_authn_filter.go:75

func (builder) TypeURLs() []string {
	return []string{"type.googleapis.com/envoy.extensions.filters.http.gcp_authn.v3.GcpAuthnFilterConfig"}
}

func (builder) ParseFilterConfig(cfg proto.Message) (httpfilter.FilterConfig, error) {
	m, ok := cfg.(*anypb.Any)
	if !ok {
		return nil, fmt.Errorf("gcpauthn: invalid filter config type %T", cfg)
	}
	msg := &v3gcpauthnpb.GcpAuthnFilterConfig{}
	if err := m.UnmarshalTo(msg); err != nil {
		return nil, fmt.Errorf("gcpauthn: failed to unmarshal filter config: %v", err)
	}

	cacheSize := uint64(defaultCacheSize)
	if cacheSizeConfig := msg.GetCacheConfig().GetCacheSize(); cacheSizeConfig != nil {
		if cacheSize = cacheSizeConfig.GetValue(); cacheSize == 0 {
			return nil, fmt.Errorf("gcpauthn: cache_config.cache_size must be greater than zero")
		}
	}

	return config{cacheSize: cacheSize}, nil
}

// ParseFilterConfigOverride parses the provided override configuration.
//
// Note that we don't support overrides for this filter configuration,
// but still validate it as part of the normal resource validation.
func (b builder) ParseFilterConfigOverride(cfg proto.Message) (httpfilter.FilterConfig, error) {
	return b.ParseFilterConfig(cfg)
}

func (builder) IsTerminal() bool {
	return false
}

View on GitHub (pinned to 03255a9237)

Solutions

Set cache_config.cache_size to a positive integer (or omit it to get the default of 10).
If the field is genuinely optional in your config schema, do not emit a wrapper at all.
Validate generated xDS resources reject wrapped-zero cache sizes in CI.

Example fix

// before
cfg := &v3gcpauthnpb.GcpAuthnFilterConfig{CacheConfig: &v3gcpauthnpb.CacheConfig{CacheSize: wrapperspb.UInt64(0)}}

// after: positive size (or omit to use default 10)
cfg := &v3gcpauthnpb.GcpAuthnFilterConfig{CacheConfig: &v3gcpauthnpb.CacheConfig{CacheSize: wrapperspb.UInt64(100)}}

Defensive patterns

Strategy: validation

Validate before calling

if cs := msg.GetCacheConfig().GetCacheSize(); cs != nil && cs.GetValue() == 0 {
    return errors.New("cache_size must be > 0; omit for default")
}

Prevention

Set cache_size to a positive integer or omit it (default 10).
Never wrap a zero value; an absent field is the way to say 'default'.
Add a CI rule rejecting wrapped-zero cache sizes.

When it happens

Trigger: The GcpAuthnFilterConfig.cache_config.cache_size is a non-nil wrapper whose value is 0.

Common situations: Operator explicitly sets cache_size: 0 thinking it means 'default' or 'unlimited'; templating that leaves cache_size at its protobuf zero default inside a wrapper; config generation bug emitting a wrapped zero.

Related errors

AI-assisted analysis of grpc/grpc-go@03255a9237 (2026-08-07). Data as JSON: /api/errors/0609eba5d13cbeed. Report an issue: GitHub.