grpc/grpc-java · error · IllegalArgumentException

Failed to parse Rbac policy

Error message

Failed to parse Rbac policy: %s

What it means

IllegalArgumentException thrown by InternalRbacFilter.createInterceptor when RbacFilter.Provider.parseRbacConfig fails to convert an envoy RBAC proto into a RbacConfig, returning a ConfigOrError with a non-null errorDetail. It means the RBAC policy configuration supplied to the interceptor is invalid.

Solutions

1. Read filterConfig.errorDetail (included in the exception message) to see the exact parse failure
2. Simplify/fix the RBAC policy: ensure action is ALLOW/DENY, rules is present, and only supported permission/principal matchers are used
3. Align the envoy protos version in your control plane with the version supported by your grpc-xds release
4. Remove unsupported RBAC fields (e.g. unknown condition expressions) from the policy

Example fix

// before: RBAC with unsupported/empty rules
RBAC.newBuilder().setAction(RBAC.Action.LOG).build()
// after
RBAC.newBuilder().setAction(RBAC.Action.ALLOW)
    .setRules(RBAC.Rules.newBuilder().putPolicies("p", Policy.newBuilder()...))
    .build()

// sanity-check the RBAC proto before calling createInterceptor
if (rbac.getAction() != RBAC.Action.ALLOW && rbac.getAction() != RBAC.Action.DENY) {
  throw new IllegalArgumentException("Unsupported RBAC action: " + rbac.getAction());
}
if (!rbac.hasRules()) {
  throw new IllegalArgumentException("RBAC policy missing rules");
}

When it happens

Trigger: Calling InternalRbacFilter.createInterceptor(rbac) with an RBAC proto whose rules/permissions/principals are unsupported or malformed (e.g. unknown action, missing rules, unsupported permission matcher).

Common situations: Embedding gRPC servers behind an RBAC policy authored for Envoy with unsupported fields; typo'd RBAC rule fields; RBAC proto from a newer Envoy API than the grpc-xds library supports.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• Unknown permission rule case: " + permission.getRuleCase()
• Unknown principal identifier case: " +…
• Audience URL is empty. Metadata value must contain a valid…
• ${e.getMessage()}
• Failed to parse access token credentials: " + e.getMessage()

AI-assisted analysis of grpc/grpc-java@64daddc1f3 (2026-09-08). Data as JSON: /api/errors/70edb777fbd55e4f. Report an issue: GitHub.

Appendix: source

Thrown at xds/src/main/java/io/grpc/xds/InternalRbacFilter.java:34

package io.grpc.xds;

import io.envoyproxy.envoy.extensions.filters.http.rbac.v3.RBAC;
import io.grpc.Internal;
import io.grpc.ServerInterceptor;
import io.grpc.xds.Filter.FilterContext;

/** This class exposes some functionality in RbacFilter to other packages. */
@Internal
public final class InternalRbacFilter {

  private InternalRbacFilter() {}

  /** Parses RBAC filter config and creates AuthorizationServerInterceptor. */
  public static ServerInterceptor createInterceptor(RBAC rbac) {
    ConfigOrError<RbacConfig> filterConfig = RbacFilter.Provider.parseRbacConfig(rbac);
    if (filterConfig.errorDetail != null) {
      throw new IllegalArgumentException(
        String.format("Failed to parse Rbac policy: %s", filterConfig.errorDetail));
    }
    return new RbacFilter.Provider().newInstance(
        FilterContext.create("internalRbacFilter", new io.grpc.MetricRecorder() {}))
        .buildServerInterceptor(filterConfig.config, null);
  }
}

View on GitHub (pinned to 64daddc1f3)