rbac: error parsing override config %v: unknown type %T

Error message

rbac: error parsing override config %v: unknown type %T

What it means

ParseFilterConfigOverride expects an *anypb.Any. Receiving another concrete type means the marshaling layer delivered the wrong Go type as the override - an internal wiring issue.

Source

Thrown at internal/xds/httpfilter/rbac/rbac.go:150

	}
	m, ok := cfg.(*anypb.Any)
	if !ok {
		return nil, fmt.Errorf("rbac: error parsing config %v: unknown type %T", cfg, cfg)
	}
	msg := new(rpb.RBAC)
	if err := m.UnmarshalTo(msg); err != nil {
		return nil, fmt.Errorf("rbac: error parsing config %v: %v", cfg, err)
	}
	return parseConfig(msg)
}

func (builder) ParseFilterConfigOverride(override proto.Message) (httpfilter.FilterConfig, error) {
	if override == nil {
		return nil, fmt.Errorf("rbac: nil configuration message provided")
	}
	m, ok := override.(*anypb.Any)
	if !ok {
		return nil, fmt.Errorf("rbac: error parsing override config %v: unknown type %T", override, override)
	}
	msg := new(rpb.RBACPerRoute)
	if err := m.UnmarshalTo(msg); err != nil {
		return nil, fmt.Errorf("rbac: error parsing override config %v: %v", override, err)
	}
	return parseConfig(msg.Rbac)
}

func (builder) IsTerminal() bool {
	return false
}

func (builder) BuildServerFilter() httpfilter.ServerFilter {
	return serverFilter{}
}

var _ httpfilter.ServerFilterBuilder = builder{}

View on GitHub (pinned to 03255a9237)

Solutions

Ensure per-route overrides are wrapped in *anypb.Any before being passed to the builder.
Verify the override TypeURL corresponds to envoy.extensions.filters.http.rbac.v3.RBACPerRoute.

Defensive patterns

Strategy: type-guard

Type guard

func isOverrideAny(m proto.Message) bool { _, ok := m.(*anypb.Any); return ok }

Prevention

Always wrap per-route overrides in *anypb.Any.
Prefer the standard grpc-go xDS client over a custom marshaling path.

When it happens

Trigger: A non-Any proto.Message is passed as the RBAC override to ParseFilterConfigOverride.

Common situations: Custom xDS client bypassing the Any convention; version skew in the override marshaling path.

Related errors

AI-assisted analysis of grpc/grpc-go@03255a9237 (2026-08-07). Data as JSON: /api/errors/ada359a1bb59343f. Report an issue: GitHub.