rule %d: actions list cannot include wildcard and other acti

Error message

rule %d: actions list cannot include wildcard and other actions, have %v

What it means

When reifying the RBAC config, each rule's actions are validated: a rule may either use the wildcard "*" (meaning all actions) or a list of specific actions, but not both. Mixing "*" with concrete actions is ambiguous, so Reify records a validation error identifying the rule by index. This runs before any request matching, preventing ambiguous authorization semantics.

Source

Thrown at go/vt/vtadmin/rbac/config.go:95

// must be reified before first use. Calling Reify multiple times has no effect
// after the first call. Reify is called by LoadConfig, so a config loaded that
// way does not need to be manually reified.
func (c *Config) Reify() error {
	if c.reified {
		return nil
	}

	// reify the rules
	byResource := map[string][]*Rule{}
	rec := concurrency.AllErrorRecorder{}

	for i, rule := range c.Rules {
		resourceRules := byResource[rule.Resource]

		actions := sets.New[string](rule.Actions...)
		if actions.Has("*") && actions.Len() > 1 {
			// error to have wildcard and something else
			rec.RecordError(fmt.Errorf("rule %d: actions list cannot include wildcard and other actions, have %v", i, sets.List(actions)))
		}

		subjects := sets.New[string](rule.Subjects...)
		if subjects.Has("*") && subjects.Len() > 1 {
			// error to have wildcard and something else
			rec.RecordError(fmt.Errorf("rule %d: subjects list cannot include wildcard and other subjects, have %v", i, sets.List(subjects)))
		}

		clusters := sets.New[string](rule.Clusters...)
		if clusters.Has("*") && clusters.Len() > 1 {
			// error to have wildcard and something else
			rec.RecordError(fmt.Errorf("rule %d: clusters list cannot include wildcard and other clusters, have %v", i, sets.List(clusters)))
		}

		resourceRules = append(resourceRules, &Rule{
			actions:  actions,
			subjects: subjects,
			clusters: clusters,

View on GitHub (pinned to 01a25a7d17)

Solutions

Remove the wildcard and list only the needed actions.
Or keep "*" alone and drop the other actions if all actions are intended.
Validate the rule index reported in the error against your config file to locate the offending rule.

Example fix

// before
{"resource": "tablets", "actions": ["*", "GetTablet"]}
// after
{"resource": "tablets", "actions": ["*"]}
// or
{"resource": "tablets", "actions": ["GetTablet", "GetTablets"]}

Defensive patterns

Strategy: validation

Validate before calling

for i, rule := range cfg.Rules {
	hasWildcard := slices.Contains(rule.Actions, "*")
	if hasWildcard && len(rule.Actions) > 1 {
		return fmt.Errorf("rule %d: actions must be * alone or explicit list", i)
	}
}

Type guard

func actionsValid(actions []string) bool {
	return !(slices.Contains(actions, "*") && len(actions) > 1)
}

Try / catch

rules, err := cfg.Reify()
if err != nil {
	var verr *validationError
	if errors.As(err, &verr) {
		log.Fatalf("invalid RBAC config: %v", verr)
	}
}

Prevention

Lint RBAC configs in CI with the same wildcard checks Reify performs.
Treat "*" as exclusive in your config templates.
Schema-validate the RBAC config with a JSON schema disallowing wildcard-plus-list.

When it happens

Trigger: An RBAC config file rule with `actions: ["*", "GetSchema"]` or any wildcard plus other action names, then calling rbac config.Reify (done at vtadmin startup).

Common situations: Hand-edited RBAC JSON/YAML where a user added a specific action 'just to be safe' alongside *; template-generated configs appending actions to a wildcard default; copy-paste between rules.

Related errors

AI-assisted analysis of vitessio/vitess@01a25a7d17 (2026-09-01). Data as JSON: /api/errors/3df063964fa7e231. Report an issue: GitHub.