grpc/grpc-go · error

rbac: incorrect override config type provided (%T): %v

Error message

rbac: incorrect override config type provided (%T): %v

What it means

When a per-route override is present, BuildServerInterceptor reassigns the config from the override and asserts it is the RBAC config type. A different type means an override produced by another filter builder was applied to the RBAC builder.

Source

Thrown at internal/xds/httpfilter/rbac/rbac.go:188

func (serverFilter) Close() {}

func (serverFilter) BuildServerInterceptor(cfg httpfilter.FilterConfig, override httpfilter.FilterConfig) (resolver.ServerInterceptor, error) {
	if cfg == nil {
		return nil, fmt.Errorf("rbac: nil config provided")
	}

	c, ok := cfg.(config)
	if !ok {
		return nil, fmt.Errorf("rbac: incorrect config type provided (%T): %v", cfg, cfg)
	}

	if override != nil {
		// override completely replaces the listener configuration; but we
		// still validate the listener config type.
		c, ok = override.(config)
		if !ok {
			return nil, fmt.Errorf("rbac: incorrect override config type provided (%T): %v", override, override)
		}
	}

	// RBAC HTTP Filter is a no op from one of these two cases:
	// "If absent, no enforcing RBAC policy will be applied" - RBAC
	// Documentation for Rules field.
	// "At this time, if the RBAC.action is Action.LOG then the policy will be
	// completely ignored, as if RBAC was not configured." - A41
	if c.chainEngine == nil {
		return nil, nil
	}
	return &interceptor{chainEngine: c.chainEngine}, nil
}

type interceptor struct {
	chainEngine *rbac.ChainEngine
}

View on GitHub (pinned to 03255a9237)

Solutions

1. Ensure the typed_per_filter_config entry is keyed by the RBAC filter name and parsed by the RBAC builder.
2. Verify no filter builders collide on the RBACPerRoute TypeURL.

// Ensure the override was produced by the same (RBAC) builder before build.
// At the resolver, track which builder parsed each FilterConfig and only pass
// matching pairs to BuildServerInterceptor.

When it happens

Trigger: A per-route typed_per_filter_config entry routes a non-RBAC override to the RBAC builder, or the override parsing produced the wrong concrete type.

Common situations: Per-route override keyed by the wrong filter name; override marshaling bug; TypeURL collision on overrides.

Related errors

• rbac: error parsing override config %v: unknown type %T
• rbac: incorrect config type provided (%T): %v
• rbac: error parsing config %v: unknown type %T
• rbac: error parsing override config %v: %v
• rbac: nil config provided

AI-assisted analysis of grpc/grpc-go@03255a9237 (2026-08-07). Data as JSON: /api/errors/2d908b0ed53851ab. Report an issue: GitHub.