grpc/grpc-java · error · ResourceInvalidException

FilterChain ${filterChainName} contains filter ${l4Filter.ge

Error message

FilterChain ${filterChainName} contains filter ${l4Filter.getName()} without typed_config

What it means

When the FilterChain's single filter has a typed_config but its type_url is not the expected HttpConnectionManager URL, gRPC rejects it: only HCM is supported as the L4 filter on server-side listeners. The exception includes the filter name and the offending type_url for diagnosis.

Source

Thrown at xds/src/main/java/io/grpc/xds/XdsListenerResource.java:243

      // null disables FilterChainMatch uniqueness check, used for defaultFilterChain
      @Nullable Set<FilterChainMatch> filterChainMatchSet,
      Set<String> certProviderInstances,
      XdsResourceType.Args args)
      throws ResourceInvalidException {
    // FilterChain contains L4 filters, so we ensure it contains only HCM.
    if (proto.getFiltersCount() != 1) {
      throw new ResourceInvalidException("FilterChain " + filterChainName
          + " should contain exact one HttpConnectionManager filter");
    }
    io.envoyproxy.envoy.config.listener.v3.Filter l4Filter = proto.getFiltersList().get(0);
    if (!l4Filter.hasTypedConfig()) {
      throw new ResourceInvalidException(
          "FilterChain " + filterChainName + " contains filter " + l4Filter.getName()
              + " without typed_config");
    }
    Any any = l4Filter.getTypedConfig();
    if (!any.getTypeUrl().equals(TYPE_URL_HTTP_CONNECTION_MANAGER)) {
      throw new ResourceInvalidException(
          "FilterChain " + filterChainName + " contains filter " + l4Filter.getName()
              + " with unsupported typed_config type " + any.getTypeUrl());
    }

    // Parse HCM.
    HttpConnectionManager hcmProto;
    try {
      hcmProto = any.unpack(HttpConnectionManager.class);
    } catch (InvalidProtocolBufferException e) {
      throw new ResourceInvalidException("FilterChain " + filterChainName + " with filter "
          + l4Filter.getName() + " failed to unpack message", e);
    }
    io.grpc.xds.HttpConnectionManager httpConnectionManager = parseHttpConnectionManager(
        hcmProto, filterRegistry, false /* isForClient */, args);

    // Parse Transport Socket.
    EnvoyServerProtoData.DownstreamTlsContext downstreamTlsContext = null;
    if (proto.hasTransportSocket()) {

View on GitHub (pinned to 64daddc1f3)

Solutions

Change the filter's typed_config to an HttpConnectionManager v3 message with the correct type_url
If your control plane still emits v2 (envoy.config.filter.network.http_connection_manager.v2) URLs, upgrade it to emit v3 URLs
Remove unsupported network filters from the filter chain; gRPC xDS only accepts HCM

Example fix

// before
type_url: "type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager"
// after
type_url: "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager"

Defensive patterns

Strategy: validation

Validate before calling

String HCM_URL = "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager";
for (FilterChain fc : listener.getFilterChainsList()) {
  if (fc.getFiltersCount() == 1
      && fc.getFilters(0).hasTypedConfig()
      && !HCM_URL.equals(fc.getFilters(0).getTypedConfig().getTypeUrl())) {
    throw new IllegalArgumentException("Only HCM v3 filters are supported, got "
        + fc.getFilters(0).getTypedConfig().getTypeUrl());
  }
}

Try / catch

try {
  listener = XdsListenerResource.parseServerSideListener(proto, ...);
} catch (ResourceInvalidException e) {
  if (e.getMessage().contains("unsupported typed_config type")) {
    logger.warn("Replace non-HCM filter with HttpConnectionManager v3", e);
  }
}

Prevention

Pin control-plane output to v3 Envoy API type URLs
Strip non-HCM network filters when targeting gRPC xDS
Add a type_url allowlist check in control-plane CI

When it happens

Trigger: A filter's typed_config Any carries a type_url other than type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager - e.g. tcp_proxy, echo, or a custom filter - when parseFilterChain runs.

Common situations: Configs ported from Envoy that use tcp_proxy or other network filters; control planes emitting older/renamed HCM type URLs (v2 API vs v3); custom L4 filters not supported by gRPC xDS.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

AI-assisted analysis of grpc/grpc-java@64daddc1f3 (2026-09-08). Data as JSON: /api/errors/8e7988922f4fa704. Report an issue: GitHub.