grpc/grpc-java · error · GrpcServiceParseException

Untrusted xDS server & URI not found in allowed_grpc_service

Error message

Untrusted xDS server & URI not found in allowed_grpc_services: " + targetUri

What it means

Thrown by GrpcServiceConfigParser.parseGoogleGrpcConfig when the xDS server is not marked trusted in the bootstrap (isTrustedControlPlane is false) and the target URI has no override entry in allowed_grpc_services. As a security measure, untrusted control planes may only reference target URIs explicitly allow-listed with their own channel credentials in the bootstrap file.

Source

Thrown at xds/src/main/java/io/grpc/xds/GrpcServiceConfigParser.java:173

      String scheme = uri.getScheme();
      if (scheme == null) {
        scheme = NameResolverRegistry.getDefaultRegistry().getDefaultScheme();
      }
      if (scheme != null) {
        isTargetUriSchemeSupported =
            NameResolverRegistry.getDefaultRegistry().getProviderForScheme(scheme) != null;
      }
    } catch (URISyntaxException e) {
      // Fallback or ignore if not a valid URI
    }

    if (!isTargetUriSchemeSupported) {
      throw new GrpcServiceParseException("Target URI scheme is not resolvable: " + targetUri);
    }

    if (!isTrustedControlPlane) {
      if (!override.isPresent()) {
        throw new GrpcServiceParseException(
            "Untrusted xDS server & URI not found in allowed_grpc_services: " + targetUri);
      }

      GrpcServiceConfig.GoogleGrpcConfig.Builder builder =
          GrpcServiceConfig.GoogleGrpcConfig.builder().target(targetUri)
              .configuredChannelCredentials(override.get().configuredChannelCredentials());
      if (override.get().callCredentials().isPresent()) {
        builder.callCredentials(override.get().callCredentials().get());
      }
      return builder.build();
    }

    ConfiguredChannelCredentials channelCreds =
        extractChannelCredentials(googleGrpcProto.getChannelCredentialsPluginList());

    Optional<CallCredentials> callCreds =
        extractCallCredentials(googleGrpcProto.getCallCredentialsPluginList());

View on GitHub (pinned to 64daddc1f3)

Solutions

  1. Add the target URI to allowed_grpc_services in the bootstrap file with proper channel_creds for it.
  2. If the control plane is genuinely trusted (e.g. Google's), mark the server as trusted in the bootstrap so the allow-list check is bypassed.
  3. Compare the target_uri in the failing xDS resource against the bootstrap's allowed_grpc_services keys for typos.

Example fix

// before (bootstrap.json)
"allowed_grpc_services": {}
// after
"allowed_grpc_services": {"trafficdirector.googleapis.com": {"channel_creds": [{"type": "google_default"}]}}
Defensive patterns

Strategy: validation

Validate before calling

// Pre-check: every URI pushed by an untrusted control plane must be allow-listed
if (!bootstrapInfo.servers().get(0).isTrusted()) {
  for (String uri : pushedTargetUris) {
    if (!allowedGrpcServices.containsKey(uri)) {
      throw new IllegalArgumentException("URI not in allowed_grpc_services: " + uri);
    }
  }
}

Try / catch

try {
  config = GrpcServiceConfigParser.parse(proto, bootstrapInfo, serverInfo);
} catch (GrpcServiceParseException e) {
  if (e.getMessage().contains("allowed_grpc_services")) {
    // reject resource; update bootstrap allow-list before retrying
  }
}

Prevention

When it happens

Trigger: Bootstrap server_info lacks the trusted marker while an LDS/CDS resource references a google_grpc target_uri that is absent from bootstrap.allowed_grpc_services, so no override credentials are found and parsing aborts.

Common situations: Multi-tenant setups where the control plane pushes URIs the operator never allow-listed; forgetting to add a new target URI to allowed_grpc_services after a control-plane change; misconfigured 'server_info' trust settings in the bootstrap.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of grpc/grpc-java@64daddc1f3 (2026-09-08). Data as JSON: /api/errors/83388e834c45d2dc. Report an issue: GitHub.