grpc/grpc-go · error

rbac: nil config provided

Error message

rbac: nil config provided

What it means

BuildServerInterceptor requires the listener-level config to be non-nil. A nil cfg means ParseFilterConfig either did not run or its result was dropped before interceptor construction - normally a defensive guard, not a user-facing config error.

Source

Thrown at internal/xds/httpfilter/rbac/rbac.go:175

}

func (builder) IsTerminal() bool {
	return false
}

func (builder) BuildServerFilter() httpfilter.ServerFilter {
	return serverFilter{}
}

var _ httpfilter.ServerFilterBuilder = builder{}

type serverFilter struct{}

func (serverFilter) Close() {}

func (serverFilter) BuildServerInterceptor(cfg httpfilter.FilterConfig, override httpfilter.FilterConfig) (resolver.ServerInterceptor, error) {
	if cfg == nil {
		return nil, fmt.Errorf("rbac: nil config provided")
	}

	c, ok := cfg.(config)
	if !ok {
		return nil, fmt.Errorf("rbac: incorrect config type provided (%T): %v", cfg, cfg)
	}

	if override != nil {
		// override completely replaces the listener configuration; but we
		// still validate the listener config type.
		c, ok = override.(config)
		if !ok {
			return nil, fmt.Errorf("rbac: incorrect override config type provided (%T): %v", override, override)
		}
	}

	// RBAC HTTP Filter is a no op from one of these two cases:
	// "If absent, no enforcing RBAC policy will be applied" - RBAC

View on GitHub (pinned to 03255a9237)

Solutions

1. Ensure ParseFilterConfig ran successfully and produced a non-nil FilterConfig before BuildServerInterceptor is called.
2. Verify the listener resource carries the RBAC filter config and that the httpfilter registry routes it to the RBAC builder.

// In a custom filter wiring path, guard the interceptor build.
func buildSafe(cfg httpfilter.FilterConfig, override httpfilter.FilterConfig) (resolver.ServerInterceptor, error) {
	if cfg == nil {
		return nil, errors.New("refusing to build rbac interceptor from nil config")
	}
	return serverFilter.BuildServerInterceptor(cfg, override)
}

When it happens

Trigger: The xDS server-filter construction path invokes BuildServerInterceptor with a nil cfg, e.g. when a listener references the RBAC filter but the config parse produced nothing and the wiring passed nil onward.

Common situations: Internal wiring bug; a listener resource that lists the RBAC filter without a corresponding successful ParseFilterConfig result.

Related errors

• rbac: incorrect config type provided (%T): %v
• rbac: incorrect override config type provided (%T): %v
• rbac: principal header matcher for %v is :scheme or starts w
• rbac: permission header matcher for %v is :scheme or starts
• rbac: error constructing matching engine: %v

AI-assisted analysis of grpc/grpc-go@03255a9237 (2026-08-07). Data as JSON: /api/errors/8bf0486d9ccd6132. Report an issue: GitHub.