grpc/grpc-java · error · ResourceInvalidException

Invalid Resource in address proto

Error message

Invalid Resource in address proto

What it means

GcpAuthenticationFilter's AudienceWrapper.parse unpacks the filter metadata Any payload into an envoy.extensions.filters.http.gcp_authn.v3.Audience; if the bytes are not a valid Audience proto (InvalidProtocolBufferException), it throws ResourceInvalidException 'Invalid Resource in address proto'. The filter's typed per-route/filter metadata is not the expected message type.

Source

Thrown at xds/src/main/java/io/grpc/xds/GcpAuthenticationFilter.java:320

      final String audience;

      AudienceWrapper(String audience) {
        this.audience = checkNotNull(audience);
      }
    }

    @Override
    public String getTypeUrl() {
      return "type.googleapis.com/envoy.extensions.filters.http.gcp_authn.v3.Audience";
    }

    @Override
    public AudienceWrapper parse(Any any) throws ResourceInvalidException {
      Audience audience;
      try {
        audience = any.unpack(Audience.class);
      } catch (InvalidProtocolBufferException ex) {
        throw new ResourceInvalidException("Invalid Resource in address proto", ex);
      }
      String url = audience.getUrl();
      if (url.isEmpty()) {
        throw new ResourceInvalidException(
            "Audience URL is empty. Metadata value must contain a valid URL.");
      }
      return new AudienceWrapper(url);
    }
  }
}

View on GitHub (pinned to 64daddc1f3)

Solutions

1. Ensure the Any payload for the gcp_authn audience metadata is a properly serialized envoy.extensions.filters.http.gcp_authn.v3.Audience with a matching type_url.
2. Check the wrapped InvalidProtocolBufferException for byte-level clues (unexpected end-group, wrong wire type).
3. Align control-plane and grpc-java proto versions so the Audience schema matches.
4. Regenerate/republish the filter metadata from your management server.

Example fix

// before — wrong message packed under audience metadata
Any.pack(SomeOtherMessage.getDefaultInstance())
// after
Any.pack(Audience.newBuilder().setUrl("https://metadata.google.internal").build())

// verify the Any payload type before sending
if (!any.getTypeUrl().endsWith("/envoy.extensions.filters.http.gcp_authn.v3.Audience")) {
  throw new IllegalArgumentException("gcp_authn metadata must be Audience");
}
Audience.parseFrom(any.getValue()); // throws if bytes invalid

try { /* parse filter config */ } catch (ResourceInvalidException e) { log.error("gcp_authn audience invalid: {}", e.getMessage(), e.getCause()); }

When it happens

Trigger: xDS config (filter metadata / per-filter config for gcp_authn) containing an Any whose type_url matches but whose serialized bytes fail Audience.unpack — wrong message type, truncated bytes, or mismatched proto definition.

Common situations: Control plane packs the wrong message under the gcp_authn audience metadata type URL; hand-crafted bootstrap/LDS metadata; proto schema mismatch between server and client versions.

Understand the failure class

Background: "cannot parse invalid wire-format data", "cannot unmarshal", "failed unmarshalling": protobuf unmarshal errors explained — this error's family across 10 libraries.

Related errors

• Audience URL is empty. Metadata value must contain a valid U
• Failed to parse access token credentials: " + e.getMessage()
• Unable to unpack typedConfig for: " + typedConfig.getTypeUrl
• Failed to parse GrpcService config: ${e.getMessage()}
• ${e.getMessage()}

AI-assisted analysis of grpc/grpc-java@64daddc1f3 (2026-09-08). Data as JSON: /api/errors/7b5b0923df9233a2. Report an issue: GitHub.