grpc/grpc-java · error · ResourceInvalidException

outlier_detection failure_percentage_threshold is > 100

Error message

outlier_detection failure_percentage_threshold is > 100

What it means

This ResourceInvalidException is thrown when outlier_detection.failure_percentage_threshold exceeds 100. The threshold is a percentage of requests that must fail before failure-percentage outlier detection ejects a host, so values above 100 are meaningless and rejected during Cluster validation in parseNonAggregateCluster.

Solutions

1. Set failure_percentage_threshold to a value in [0, 100] (Envoy default is 50).
2. Scale fractional values by 100 (0.85 -> 85).
3. Clamp or validate the value in the control plane before publishing.
4. Keep it below 100 so the detector can actually trigger.

Example fix

# before
outlier_detection:
  failure_percentage_threshold: 850
# after
outlier_detection:
  failure_percentage_threshold: 85

boolean validFailurePercentageThreshold(io.envoyproxy.envoy.type.v3.UInt32Value v) {
  return v == null || v.getValue() <= 100;
}

boolean isPercent(long v) {
  return v >= 0 && v <= 100;
}

try {
  cluster = parseCluster(raw);
} catch (io.grpc.xds.ResourceInvalidException e) {
  if (e.getMessage().contains("failure_percentage_threshold")) {
    log.error("failure_percentage_threshold must be <= 100");
  }
  return null;
}

When it happens

Trigger: A Cluster resource carries outlier_detection.failure_percentage_threshold (UInt32Value) with a value > 100 while being validated by validateOutlierDetection.

Common situations: Fraction-to-percent conversion mistakes (0.75 -> 750); users entering probabilities; generators reusing a 0-1000 scale; typos like 1005.

Understand the failure class

Background: "value must be between 0 and 1" / "out of range" / "must not be negative" errors: fixing range-validation failures across open-source libraries — this error's family across 42 libraries.

Related errors

• outlier_detection enforcing_success_rate is > 100
• outlier_detection max_ejection_percent is > 100
• A terminal HttpFilter must be the last filter
• AndMatcher must have at least 2 predicates
• client_listener_resource_name_template

AI-assisted analysis of grpc/grpc-java@64daddc1f3 (2026-09-08). Data as JSON: /api/errors/2d9682813a3e9733. Report an issue: GitHub.

Appendix: source

Thrown at xds/src/main/java/io/grpc/xds/XdsClusterResource.java:421

    }
    if (outlierDetection.hasMaxEjectionPercent()
        && outlierDetection.getMaxEjectionPercent().getValue() > 100) {
      throw new ResourceInvalidException(
          "outlier_detection max_ejection_percent is > 100");
    }
    if (outlierDetection.hasEnforcingSuccessRate()
        && outlierDetection.getEnforcingSuccessRate().getValue() > 100) {
      throw new ResourceInvalidException(
          "outlier_detection enforcing_success_rate is > 100");
    }
    if (outlierDetection.hasFailurePercentageThreshold()
        && outlierDetection.getFailurePercentageThreshold().getValue() > 100) {
      throw new ResourceInvalidException(
          "outlier_detection failure_percentage_threshold is > 100");
    }
    if (outlierDetection.hasEnforcingFailurePercentage()
        && outlierDetection.getEnforcingFailurePercentage().getValue() > 100) {
      throw new ResourceInvalidException(
          "outlier_detection enforcing_failure_percentage is > 100");
    }

    return outlierDetection;
  }

  static boolean hasNegativeValues(Duration duration) {
    return duration.getSeconds() < 0 || duration.getNanos() < 0;
  }

  @VisibleForTesting
  static io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
      validateUpstreamTlsContext(
      io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext upstreamTlsContext,
      Set<String> certProviderInstances)
      throws ResourceInvalidException {
    if (upstreamTlsContext.hasCommonTlsContext()) {
      validateCommonTlsContext(upstreamTlsContext.getCommonTlsContext(), certProviderInstances,

View on GitHub (pinned to 64daddc1f3)