grpc/grpc-go · error

rbac: error parsing config %v: %v

Error message

rbac: error parsing config %v: %v

What it means

The provided *anypb.Any failed to unmarshal into the RBAC proto. The wrapped error comes from proto.Unmarshal, indicating the Any's type URL or payload does not correspond to envoy.extensions.filters.http.rbac.v3.RBAC.

Source

Thrown at internal/xds/httpfilter/rbac/rbac.go:139

		if rbacCfg.GetRules().GetAction() != v3rbacpb.RBAC_LOG {
			return nil, fmt.Errorf("rbac: error constructing matching engine: %v", err)
		}
	}

	return config{chainEngine: ce}, nil
}

func (builder) ParseFilterConfig(cfg proto.Message) (httpfilter.FilterConfig, error) {
	if cfg == nil {
		return nil, fmt.Errorf("rbac: nil configuration message provided")
	}
	m, ok := cfg.(*anypb.Any)
	if !ok {
		return nil, fmt.Errorf("rbac: error parsing config %v: unknown type %T", cfg, cfg)
	}
	msg := new(rpb.RBAC)
	if err := m.UnmarshalTo(msg); err != nil {
		return nil, fmt.Errorf("rbac: error parsing config %v: %v", cfg, err)
	}
	return parseConfig(msg)
}

func (builder) ParseFilterConfigOverride(override proto.Message) (httpfilter.FilterConfig, error) {
	if override == nil {
		return nil, fmt.Errorf("rbac: nil configuration message provided")
	}
	m, ok := override.(*anypb.Any)
	if !ok {
		return nil, fmt.Errorf("rbac: error parsing override config %v: unknown type %T", override, override)
	}
	msg := new(rpb.RBACPerRoute)
	if err := m.UnmarshalTo(msg); err != nil {
		return nil, fmt.Errorf("rbac: error parsing override config %v: %v", override, err)
	}
	return parseConfig(msg.Rbac)
}

View on GitHub (pinned to 03255a9237)

Solutions

1. Confirm the Any TypeUrl is exactly type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC.
2. Ensure proto-version compatibility between the control plane and grpc-go (use v3, not v4alpha, for this filter).
3. Re-fetch the LDS resource and inspect the raw Any payload bytes.

func checkRBACTypeURL(a *anypb.Any) error {
	want := "type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC"
	if a.GetTypeUrl() != want {
		return fmt.Errorf("rbac type_url=%q want %q", a.GetTypeUrl(), want)
	}
	return nil
}

When it happens

Trigger: The Any's TypeUrl is for a different message (e.g. RBACPerRoute, a v4alpha type, or a router config) or the serialized bytes are corrupt/truncated.

Common situations: Control plane serving a different proto version than grpc-go expects; a TypeURL typo in the control plane; corrupted resource from a buggy xDS server; filter entry mislabeled with the RBAC type URL but carrying another message.

Related errors

• rbac: error parsing override config %v: %v
• router: error parsing config %v: %v
• lrs: unexpected message type %T
• unexpected message type %T
• rls_csp: error parsing config %v: %v

AI-assisted analysis of grpc/grpc-go@03255a9237 (2026-08-07). Data as JSON: /api/errors/8f3ea633cff22290. Report an issue: GitHub.