grpc/grpc-go · error

rbac: error parsing config %v: unknown type %T

Error message

rbac: error parsing config %v: unknown type %T

What it means

ParseFilterConfig expects the incoming proto.Message to be an *anypb.Any. Any other concrete Go type indicates the xDS marshaling layer delivered the wrong type to the RBAC builder - typically an internal wiring bug rather than user config.

Source

Thrown at internal/xds/httpfilter/rbac/rbac.go:135

	ce, err := rbac.NewChainEngine([]*v3rbacpb.RBAC{rbacCfg.GetRules()}, "")
	if err != nil {
		// "At this time, if the RBAC.action is Action.LOG then the policy will be
		// completely ignored, as if RBAC was not configured." - A41
		if rbacCfg.GetRules().GetAction() != v3rbacpb.RBAC_LOG {
			return nil, fmt.Errorf("rbac: error constructing matching engine: %v", err)
		}
	}

	return config{chainEngine: ce}, nil
}

func (builder) ParseFilterConfig(cfg proto.Message) (httpfilter.FilterConfig, error) {
	if cfg == nil {
		return nil, fmt.Errorf("rbac: nil configuration message provided")
	}
	m, ok := cfg.(*anypb.Any)
	if !ok {
		return nil, fmt.Errorf("rbac: error parsing config %v: unknown type %T", cfg, cfg)
	}
	msg := new(rpb.RBAC)
	if err := m.UnmarshalTo(msg); err != nil {
		return nil, fmt.Errorf("rbac: error parsing config %v: %v", cfg, err)
	}
	return parseConfig(msg)
}

func (builder) ParseFilterConfigOverride(override proto.Message) (httpfilter.FilterConfig, error) {
	if override == nil {
		return nil, fmt.Errorf("rbac: nil configuration message provided")
	}
	m, ok := override.(*anypb.Any)
	if !ok {
		return nil, fmt.Errorf("rbac: error parsing override config %v: unknown type %T", override, override)
	}
	msg := new(rpb.RBACPerRoute)
	if err := m.UnmarshalTo(msg); err != nil {

View on GitHub (pinned to 03255a9237)

Solutions

1. Verify the RBAC builder's TypeURLs() match the resource's @type.
2. Ensure the xDS unmarshal path wraps filter configs in *anypb.Any before invoking the builder.

Example fix

// before: passing a concrete proto instead of Any
//   cfg := &rpb.RBAC{Rules: rules}
//   fc, err := b.ParseFilterConfig(cfg)
//
// after: wrap in Any
//   anyCfg, _ := anypb.New(cfg)
//   fc, err := b.ParseFilterConfig(anyCfg)

// Ensure the value handed to ParseFilterConfig is an *anypb.Any.
func isAny(m proto.Message) bool {
	_, ok := m.(*anypb.Any)
	return ok
}

When it happens

Trigger: The xdsclient/unmarshal path passes a non-Any proto.Message (e.g. the concrete *rpb.RBAC directly, or a *wrapperspb.StringValue) into ParseFilterConfig.

Common situations: Version skew between the httpfilter registry and the marshaling layer; a custom xDS client implementation bypassing the Any-wrapping convention; a fork that changed the marshaling pipeline.

Related errors

• rbac: error parsing override config %v: unknown type %T
• rbac: incorrect config type provided (%T): %v
• rbac: incorrect override config type provided (%T): %v
• grpctransport: Extensions field is %T, but must be %T in Ser
• fault: error parsing config %v: unknown type %T

AI-assisted analysis of grpc/grpc-go@03255a9237 (2026-08-07). Data as JSON: /api/errors/4f43409f0d6236e4. Report an issue: GitHub.