grpc/grpc-java · error · GrpcServiceParseException

Unsupported: GrpcService must have GoogleGrpc, got: ${grpcSe

Error message

Unsupported: GrpcService must have GoogleGrpc, got: ${grpcServiceProto}

What it means

Thrown by GrpcServiceConfigParser.parse when an xDS-received GrpcService proto carries no google_grpc field. grpc-java's xDS control plane only supports GoogleGrpc-style service configurations; an Envoy GrpcService specifying only grpc (Cc/EnvoyGrpc) or omitting both is unsupported and fails parsing.

Source

Thrown at xds/src/main/java/io/grpc/xds/GrpcServiceConfigParser.java:88

  static final String GOOGLE_DEFAULT_CREDENTIALS_TYPE_URL =
      "type.googleapis.com/envoy.extensions.grpc_service.channel_credentials."
          + "google_default.v3.GoogleDefaultCredentials";



  /**
   * Parses the {@link io.envoyproxy.envoy.config.core.v3.GrpcService} proto to create a
   * {@link GrpcServiceConfig} instance.
   *
   * @param grpcServiceProto The proto to parse.
   * @return A {@link GrpcServiceConfig} instance.
   * @throws GrpcServiceParseException if the proto is invalid or uses unsupported features.
   */
  public static GrpcServiceConfig parse(GrpcService grpcServiceProto,
      Bootstrapper.BootstrapInfo bootstrapInfo, Bootstrapper.ServerInfo serverInfo)
      throws GrpcServiceParseException {
    if (!grpcServiceProto.hasGoogleGrpc()) {
      throw new GrpcServiceParseException(
          "Unsupported: GrpcService must have GoogleGrpc, got: " + grpcServiceProto);
    }
    GrpcServiceConfig.GoogleGrpcConfig googleGrpcConfig =
        parseGoogleGrpcConfig(grpcServiceProto.getGoogleGrpc(), bootstrapInfo, serverInfo);

    GrpcServiceConfig.Builder builder = GrpcServiceConfig.builder().googleGrpc(googleGrpcConfig);

    ImmutableList.Builder<HeaderValue> initialMetadata = ImmutableList.builder();
    for (io.envoyproxy.envoy.config.core.v3.HeaderValue header : grpcServiceProto
        .getInitialMetadataList()) {
      String key = header.getKey();
      HeaderValue headerValue;
      try {
        if (key.endsWith(Metadata.BINARY_HEADER_SUFFIX)) {
          headerValue = HeaderValue.create(key, header.getRawValue());
        } else {
          headerValue = HeaderValue.create(key, header.getValue());
        }

View on GitHub (pinned to 64daddc1f3)

Solutions

1. Update the xDS management server / control-plane resource so GrpcService uses the google_grpc field with server_uri.
2. If using Istio/Envoy tooling, ensure the generated resources target google_grpc for Java workloads.
3. Check the received LDS/CDS resource (enable xDS client logging) to confirm which GrpcService variant is sent.

Example fix

// before (xDS resource proto)
grpc_service { envoy_grpc { cluster_name: "xds_cluster" } }
// after
grpc_service { google_grpc { target_uri: "xds.example.com:443" } }

// Verify the received resource uses google_grpc before relying on it
if (!grpcServiceProto.hasGoogleGrpc()) {
  throw new IllegalStateException("xDS resource lacks google_grpc; fix control-plane resource");
}

// Kotlin-style guard
fun GrpcService.hasGoogleGrpcConfig(): Boolean = hasGoogleGrpc()

try {
  GrpcServiceConfig cfg = GrpcServiceConfigParser.parse(grpcServiceProto, bootstrapInfo, serverInfo);
} catch (GrpcServiceParseException e) {
  logger.log(WARNING, "Unsupported GrpcService from control plane: " + e.getMessage());
  // skip resource / fall back to last-known-good config
}

When it happens

Trigger: xDS management server sends a ConfigSource/GrpcService message where hasGoogleGrpc() is false — e.g. the LDS/CDS resource uses envoy.extensions...grpc_service with only the 'envoy_grpc' field populated.

Common situations: Pointing grpc-java at an Envoy-oriented xDS control plane (e.g. Envoy xDS server, Istio configs written for Envoy) that emits envoy_grpc instead of google_grpc.

Related errors

• Unsupported fallback credentials type for XdsCredentials
• Invalid Resource in address proto
• LocalCredentials are not supported in grpc-java. See https:/
• Failed to parse channel credentials: " + e.getMessage()
• Failed to parse access token credentials: " + e.getMessage()

AI-assisted analysis of grpc/grpc-java@64daddc1f3 (2026-09-08). Data as JSON: /api/errors/2f890df573361f77. Report an issue: GitHub.