grpc/grpc-go · error

rbac: error parsing override config %v: %v

Error message

rbac: error parsing override config %v: %v

What it means

The override *anypb.Any failed to unmarshal into rpb.RBACPerRoute. The wrapped proto.Unmarshal error indicates a type-URL or payload mismatch for the per-route override.

Source

Thrown at internal/xds/httpfilter/rbac/rbac.go:154

	}
	msg := new(rpb.RBAC)
	if err := m.UnmarshalTo(msg); err != nil {
		return nil, fmt.Errorf("rbac: error parsing config %v: %v", cfg, err)
	}
	return parseConfig(msg)
}

func (builder) ParseFilterConfigOverride(override proto.Message) (httpfilter.FilterConfig, error) {
	if override == nil {
		return nil, fmt.Errorf("rbac: nil configuration message provided")
	}
	m, ok := override.(*anypb.Any)
	if !ok {
		return nil, fmt.Errorf("rbac: error parsing override config %v: unknown type %T", override, override)
	}
	msg := new(rpb.RBACPerRoute)
	if err := m.UnmarshalTo(msg); err != nil {
		return nil, fmt.Errorf("rbac: error parsing override config %v: %v", override, err)
	}
	return parseConfig(msg.Rbac)
}

func (builder) IsTerminal() bool {
	return false
}

func (builder) BuildServerFilter() httpfilter.ServerFilter {
	return serverFilter{}
}

var _ httpfilter.ServerFilterBuilder = builder{}

type serverFilter struct{}

func (serverFilter) Close() {}

View on GitHub (pinned to 03255a9237)

Solutions

1. Confirm the override TypeUrl is type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBACPerRoute.
2. Ensure the override payload is a serialized RBACPerRoute, not a base RBAC.
3. Re-fetch and inspect the RDS resource carrying the per-route config.

func checkRBACPerRouteTypeURL(a *anypb.Any) error {
	want := "type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBACPerRoute"
	if a.GetTypeUrl() != want {
		return fmt.Errorf("override type_url=%q want %q", a.GetTypeUrl(), want)
	}
	return nil
}

When it happens

Trigger: The override Any's TypeUrl is not envoy.extensions.filters.http.rbac.v3.RBACPerRoute, or its bytes are corrupt.

Common situations: Control plane serving the base RBAC proto where a RBACPerRoute is expected (or vice versa); version mismatch; corrupted resource.

Related errors

• rbac: error parsing config %v: %v
• rbac: error parsing override config %v: unknown type %T
• rbac: incorrect override config type provided (%T): %v
• router: error parsing config %v: %v
• lrs: unexpected message type %T

AI-assisted analysis of grpc/grpc-go@03255a9237 (2026-08-07). Data as JSON: /api/errors/1b132c9cef8d256c. Report an issue: GitHub.