What causes "gcpauthn: failed to unmarshal filter config: %v" in grpc/grpc-go?

gcpauthn: failed to unmarshal filter config: %v

Error message

gcpauthn: failed to unmarshal filter config: %v

What it means

After confirming the config is an *anypb.Any, ParseFilterConfig unmarshals it into GcpAuthnFilterConfig (gcp_authn_filter.go:68). A failure here means the Any payload is malformed, has the wrong type URL, or is schema-incompatible.

Source

Thrown at internal/xds/httpfilter/gcp_authn/gcp_authn_filter.go:69

type builder struct{}

type config struct {
	httpfilter.FilterConfig
	cacheSize uint64
}

func (builder) TypeURLs() []string {
	return []string{"type.googleapis.com/envoy.extensions.filters.http.gcp_authn.v3.GcpAuthnFilterConfig"}
}

func (builder) ParseFilterConfig(cfg proto.Message) (httpfilter.FilterConfig, error) {
	m, ok := cfg.(*anypb.Any)
	if !ok {
		return nil, fmt.Errorf("gcpauthn: invalid filter config type %T", cfg)
	}
	msg := &v3gcpauthnpb.GcpAuthnFilterConfig{}
	if err := m.UnmarshalTo(msg); err != nil {
		return nil, fmt.Errorf("gcpauthn: failed to unmarshal filter config: %v", err)
	}

	cacheSize := uint64(defaultCacheSize)
	if cacheSizeConfig := msg.GetCacheConfig().GetCacheSize(); cacheSizeConfig != nil {
		if cacheSize = cacheSizeConfig.GetValue(); cacheSize == 0 {
			return nil, fmt.Errorf("gcpauthn: cache_config.cache_size must be greater than zero")
		}
	}

	return config{cacheSize: cacheSize}, nil
}

// ParseFilterConfigOverride parses the provided override configuration.
//
// Note that we don't support overrides for this filter configuration,
// but still validate it as part of the normal resource validation.
func (b builder) ParseFilterConfigOverride(cfg proto.Message) (httpfilter.FilterConfig, error) {
	return b.ParseFilterConfig(cfg)

View on GitHub (pinned to 03255a9237)

Solutions

Verify Any.TypeURL equals type.googleapis.com/envoy.extensions.filters.http.gcp_authn.v3.GcpAuthnFilterConfig.
Regenerate the config from a control plane whose protobuf definitions match the client's go-control-plane.
Inspect the failing payload size/bytes for truncation.

Example fix

// before: wrong type URL or corrupt bytes
anyMsg := &anypb.Any{TypeUrl: "type.googleapis.com/wrong", Value: bad}

// after
anyMsg, _ := anypb.New(&v3gcpauthnpb.GcpAuthnFilterConfig{HttpUri: &corev3.HttpUri{Uri: "https://metadata.google.internal/...", Cluster: "metadata"}})

Defensive patterns

Strategy: validation

Validate before calling

if cfg.(*anypb.Any).TypeUrl != "type.googleapis.com/envoy.extensions.filters.http.gcp_authn.v3.GcpAuthnFilterConfig" {
    return nil, errors.New("wrong type URL for gcp_authn config")
}

Try / catch

fc, err := b.ParseFilterConfig(cfg)
if err != nil {
    return err
}

Prevention

Pin control-plane and go-control-plane protobuf versions together.
Validate TypeURL before decoding.
Log payload size on failure to detect corruption.

When it happens

Trigger: The Any does not deserialize as GcpAuthnFilterConfig: wrong type URL, corrupt/truncated bytes, or incompatible schema version.

Common situations: Control plane emits a gcp_authn config from a mismatched protobuf version; misconfigured type URL; corruption during xDS transport.

Related errors

AI-assisted analysis of grpc/grpc-go@03255a9237 (2026-08-07). Data as JSON: /api/errors/07d3a91c38f95e43. Report an issue: GitHub.