grpc/grpc-go · error

rbac: nil configuration message provided

Error message

rbac: nil configuration message provided

What it means

ParseFilterConfig rejects a nil protobuf config message. The RBAC filter requires a non-nil listener-level config; a nil config means the xDS resource referenced an RBAC filter but supplied no typed_config.

Source

Thrown at internal/xds/httpfilter/rbac/rbac.go:131

	// TODO(gregorycooke) - change the call chain to here so we have the filter
	// name to input here instead of an empty string. It will come from here:
	// https://github.com/grpc/grpc-go/blob/eff0942e95d93112921414aee758e619ec86f26f/xds/internal/xdsclient/xdsresource/unmarshal_lds.go#L199
	ce, err := rbac.NewChainEngine([]*v3rbacpb.RBAC{rbacCfg.GetRules()}, "")
	if err != nil {
		// "At this time, if the RBAC.action is Action.LOG then the policy will be
		// completely ignored, as if RBAC was not configured." - A41
		if rbacCfg.GetRules().GetAction() != v3rbacpb.RBAC_LOG {
			return nil, fmt.Errorf("rbac: error constructing matching engine: %v", err)
		}
	}

	return config{chainEngine: ce}, nil
}

func (builder) ParseFilterConfig(cfg proto.Message) (httpfilter.FilterConfig, error) {
	if cfg == nil {
		return nil, fmt.Errorf("rbac: nil configuration message provided")
	}
	m, ok := cfg.(*anypb.Any)
	if !ok {
		return nil, fmt.Errorf("rbac: error parsing config %v: unknown type %T", cfg, cfg)
	}
	msg := new(rpb.RBAC)
	if err := m.UnmarshalTo(msg); err != nil {
		return nil, fmt.Errorf("rbac: error parsing config %v: %v", cfg, err)
	}
	return parseConfig(msg)
}

func (builder) ParseFilterConfigOverride(override proto.Message) (httpfilter.FilterConfig, error) {
	if override == nil {
		return nil, fmt.Errorf("rbac: nil configuration message provided")
	}
	m, ok := override.(*anypb.Any)
	if !ok {

View on GitHub (pinned to 03255a9237)

Solutions

1. Ensure the RBAC filter entry in the LDS resource carries a typed_config Any wrapping envoy.extensions.filters.http.rbac.v3.RBAC.
2. Validate the LDS resource on the control plane before serving it (reject filter entries with no typed_config).

func ensureRBACFilterConfigPresent(filters []*hcmpb.HttpFilter) error {
	for _, f := range filters {
		if isRBACFilter(f) && f.GetTypedConfig() == nil {
			return fmt.Errorf("rbac filter %q has nil typed_config", f.GetName())
		}
	}
	return nil
}

When it happens

Trigger: The LDS HTTP filter chain contains an RBAC filter entry whose typed_config is absent/nil when the builder's ParseFilterConfig is invoked.

Common situations: Control-plane misconfiguration emitting a filter entry without a body; a custom xDS server omitting the config field; partial resource during a rolling update.

Related errors

• rbac: permission header matcher for %v is :scheme or starts
• missing fallback credentials
• rbac: principal header matcher for %v is :scheme or starts w
• rbac: error constructing matching engine: %v
• rbac: error parsing config %v: unknown type %T

AI-assisted analysis of grpc/grpc-go@03255a9237 (2026-08-07). Data as JSON: /api/errors/3cd421993a0c55fc. Report an issue: GitHub.