grpc/grpc-java · error · IllegalArgumentException

Failed to parse Rbac policy: %s

Error message

Failed to parse Rbac policy: %s

What it means

IllegalArgumentException thrown by InternalRbacFilter.createInterceptor when RbacFilter.Provider.parseRbacConfig fails to convert an envoy RBAC proto into a RbacConfig, returning a ConfigOrError with a non-null errorDetail. It means the RBAC policy configuration supplied to the interceptor is invalid.

Source

Thrown at xds/src/main/java/io/grpc/xds/InternalRbacFilter.java:34

package io.grpc.xds;

import io.envoyproxy.envoy.extensions.filters.http.rbac.v3.RBAC;
import io.grpc.Internal;
import io.grpc.ServerInterceptor;
import io.grpc.xds.Filter.FilterContext;

/** This class exposes some functionality in RbacFilter to other packages. */
@Internal
public final class InternalRbacFilter {

  private InternalRbacFilter() {}

  /** Parses RBAC filter config and creates AuthorizationServerInterceptor. */
  public static ServerInterceptor createInterceptor(RBAC rbac) {
    ConfigOrError<RbacConfig> filterConfig = RbacFilter.Provider.parseRbacConfig(rbac);
    if (filterConfig.errorDetail != null) {
      throw new IllegalArgumentException(
        String.format("Failed to parse Rbac policy: %s", filterConfig.errorDetail));
    }
    return new RbacFilter.Provider().newInstance(
        FilterContext.create("internalRbacFilter", new io.grpc.MetricRecorder() {}))
        .buildServerInterceptor(filterConfig.config, null);
  }
}

View on GitHub (pinned to 64daddc1f3)

Solutions

1. Read filterConfig.errorDetail (included in the exception message) to see the exact parse failure
2. Simplify/fix the RBAC policy: ensure action is ALLOW/DENY, rules is present, and only supported permission/principal matchers are used
3. Align the envoy protos version in your control plane with the version supported by your grpc-xds release
4. Remove unsupported RBAC fields (e.g. unknown condition expressions) from the policy

Example fix

// before: RBAC with unsupported/empty rules
RBAC.newBuilder().setAction(RBAC.Action.LOG).build()
// after
RBAC.newBuilder().setAction(RBAC.Action.ALLOW)
    .setRules(RBAC.Rules.newBuilder().putPolicies("p", Policy.newBuilder()...))
    .build()

// sanity-check the RBAC proto before calling createInterceptor
if (rbac.getAction() != RBAC.Action.ALLOW && rbac.getAction() != RBAC.Action.DENY) {
  throw new IllegalArgumentException("Unsupported RBAC action: " + rbac.getAction());
}
if (!rbac.hasRules()) {
  throw new IllegalArgumentException("RBAC policy missing rules");
}

When it happens

Trigger: Calling InternalRbacFilter.createInterceptor(rbac) with an RBAC proto whose rules/permissions/principals are unsupported or malformed (e.g. unknown action, missing rules, unsupported permission matcher).

Common situations: Embedding gRPC servers behind an RBAC policy authored for Envoy with unsupported fields; typo'd RBAC rule fields; RBAC proto from a newer Envoy API than the grpc-xds library supports.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• Unknown permission rule case: " + permission.getRuleCase()
• Unknown principal identifier case: " + principal.getIdentifi
• Failed to parse GrpcService config: ${e.getMessage()}
• ${e.getMessage()}
• Unknown denominator type: ${proto.getDenominator()}

AI-assisted analysis of grpc/grpc-java@64daddc1f3 (2026-09-08). Data as JSON: /api/errors/70edb777fbd55e4f. Report an issue: GitHub.