grpc/grpc-java · error · ResourceInvalidException

transport-socket with name

Error message

transport-socket with name ${proto.getTransportSocket().getName()} not supported.

What it means

gRPC xDS only supports a transport_socket named 'tls' on server-side filter chains; any other name (e.g. 'envoy.transport_sockets.tls' or a custom name) is rejected with ResourceInvalidException. Names are used as a discriminator for which transport socket implementation to instantiate.

Solutions

1. Rename the filter chain's transport_socket to exactly 'tls' in the LDS resource
2. If no TLS is intended, remove the transport_socket field entirely (downstreamTlsContext stays null and plaintext is used)
3. Update the control plane template so emitted transport sockets always carry name: tls

Example fix

# before
transport_socket:
  name: envoy.transport_sockets.tls
  typed_config: {...}
# after
transport_socket:
  name: tls
  typed_config: {...}

if (fc.hasTransportSocket()
    && !"tls".equals(fc.getTransportSocket().getName())) {
  throw new IllegalArgumentException(
      "transport_socket name must be 'tls', got " + fc.getTransportSocket().getName());
}

try {
  listener = XdsListenerResource.parseServerSideListener(proto, ...);
} catch (ResourceInvalidException e) {
  if (e.getMessage().contains("transport-socket") && e.getMessage().contains("not supported")) {
    logger.warn("Rename transport_socket to 'tls'", e);
  }
}

When it happens

Trigger: A FilterChain proto sets transport_socket whose name field differs from the expected TRANSPORT_SOCKET_NAME_TLS constant ('tls') when parsed by parseFilterChain.

Common situations: Envoy configs using default/raw-buffer transport sockets or custom names; control planes auto-annotating transport sockets with implementation names like 'envoy.transport_sockets.tls'; hand-written configs using descriptive names.

Related errors

• ca_certificate_provider_instance name
• ca_certificate_provider_instance or system_root_certs is…
• CertificateProvider instance name
• common-tls-context is required in downstream-tls-context
• common-tls-context is required in upstream-tls-context

AI-assisted analysis of grpc/grpc-java@64daddc1f3 (2026-09-08). Data as JSON: /api/errors/7c926dfeb6762e8e. Report an issue: GitHub.

Appendix: source

Thrown at xds/src/main/java/io/grpc/xds/XdsListenerResource.java:271

      throw new ResourceInvalidException("FilterChain " + filterChainName + " with filter "
          + l4Filter.getName() + " failed to unpack message", e);
    }
    io.grpc.xds.HttpConnectionManager httpConnectionManager = parseHttpConnectionManager(
        hcmProto, filterRegistry, false /* isForClient */, args);

    // Parse Transport Socket.
    EnvoyServerProtoData.DownstreamTlsContext downstreamTlsContext = null;
    if (proto.hasTransportSocket()) {
      if (!TRANSPORT_SOCKET_NAME_TLS.equals(proto.getTransportSocket().getName())) {
        throw new ResourceInvalidException("transport-socket with name "
            + proto.getTransportSocket().getName() + " not supported.");
      }
      DownstreamTlsContext downstreamTlsContextProto;
      try {
        downstreamTlsContextProto =
            proto.getTransportSocket().getTypedConfig().unpack(DownstreamTlsContext.class);
      } catch (InvalidProtocolBufferException e) {
        throw new ResourceInvalidException("FilterChain " + filterChainName
            + " failed to unpack message", e);
      }
      downstreamTlsContext =
          EnvoyServerProtoData.DownstreamTlsContext.fromEnvoyProtoDownstreamTlsContext(
              validateDownstreamTlsContext(downstreamTlsContextProto, certProviderInstances));
    }

    // Parse FilterChainMatch.
    FilterChainMatch filterChainMatch = parseFilterChainMatch(proto.getFilterChainMatch());
    // null used to skip this check for defaultFilterChain.
    if (filterChainMatchSet != null) {
      validateFilterChainMatchForUniqueness(filterChainMatchSet, filterChainMatch);
    }

    return FilterChain.create(
        filterChainName,
        filterChainMatch,
        httpConnectionManager,

View on GitHub (pinned to 64daddc1f3)