grpc 1.34.0 → 1.37.0

data/src/core/ext/xds/xds_bootstrap.cc

@@ -48,8 +48,8 @@ bool XdsChannelCredsRegistry::IsSupported(const std::string& creds_type) {
          creds_type == "fake";
 }
 
-bool XdsChannelCredsRegistry::IsValidConfig(const std::string& creds_type,
-                                            const Json& config) {
+bool XdsChannelCredsRegistry::IsValidConfig(const std::string& /*creds_type*/,
+                                            const Json& /*config*/) {
   // Currently, none of the creds types actually take a config, but we
   // ignore whatever might be specified in the bootstrap file for
   // forward compatibility reasons.
@@ -58,7 +58,7 @@ bool XdsChannelCredsRegistry::IsValidConfig(const std::string& creds_type,
 
 RefCountedPtr<grpc_channel_credentials>
 XdsChannelCredsRegistry::MakeChannelCreds(const std::string& creds_type,
-                                          const Json& config) {
+                                          const Json& /*config*/) {
   if (creds_type == "google_default") {
     return grpc_google_default_credentials_create(nullptr);
   } else if (creds_type == "insecure") {
@@ -93,13 +93,14 @@ std::string BootstrapString(const XdsBootstrap& bootstrap) {
         "  locality={\n"
         "    region=\"%s\",\n"
         "    zone=\"%s\",\n"
-        "    subzone=\"%s\"\n"
+        "    sub_zone=\"%s\"\n"
         "  },\n"
         "  metadata=%s,\n"
         "},\n",
         bootstrap.node()->id, bootstrap.node()->cluster,
         bootstrap.node()->locality_region, bootstrap.node()->locality_zone,
-        bootstrap.node()->locality_subzone, bootstrap.node()->metadata.Dump()));
+        bootstrap.node()->locality_sub_zone,
+        bootstrap.node()->metadata.Dump()));
   }
   parts.push_back(absl::StrFormat(
       "servers=[\n"
@@ -118,6 +119,11 @@ std::string BootstrapString(const XdsBootstrap& bootstrap) {
         absl::StrJoin(bootstrap.server().server_features, ", "), "],\n"));
   }
   parts.push_back("  }\n],\n");
+  if (!bootstrap.server_listener_resource_name_template().empty()) {
+    parts.push_back(
+        absl::StrFormat("server_listener_resource_name_template=\"%s\",\n",
+                        bootstrap.server_listener_resource_name_template()));
+  }
   parts.push_back("certificate_providers={\n");
   for (const auto& entry : bootstrap.certificate_providers()) {
     parts.push_back(
@@ -132,36 +138,14 @@ std::string BootstrapString(const XdsBootstrap& bootstrap) {
   return absl::StrJoin(parts, "");
 }
 
-}  // namespace
-
-std::unique_ptr<XdsBootstrap> XdsBootstrap::ReadFromFile(XdsClient* client,
-                                                         TraceFlag* tracer,
-                                                         grpc_error** error) {
-  grpc_core::UniquePtr<char> path(gpr_getenv("GRPC_XDS_BOOTSTRAP"));
-  if (path == nullptr) {
-    *error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
-        "Environment variable GRPC_XDS_BOOTSTRAP not defined");
-    return nullptr;
-  }
-  if (GRPC_TRACE_FLAG_ENABLED(*tracer)) {
-    gpr_log(GPR_INFO,
-            "[xds_client %p] Got bootstrap file location from "
-            "GRPC_XDS_BOOTSTRAP environment variable: %s",
-            client, path.get());
-  }
-  grpc_slice contents;
-  *error = grpc_load_file(path.get(), /*add_null_terminator=*/true, &contents);
-  if (*error != GRPC_ERROR_NONE) return nullptr;
-  absl::string_view contents_str_view = StringViewFromSlice(contents);
-  if (GRPC_TRACE_FLAG_ENABLED(*tracer)) {
-    gpr_log(GPR_DEBUG, "[xds_client %p] Bootstrap file contents: %s", client,
-            std::string(contents_str_view).c_str());
-  }
-  Json json = Json::Parse(contents_str_view, error);
-  grpc_slice_unref_internal(contents);
+std::unique_ptr<XdsBootstrap> ParseJsonAndCreate(
+    XdsClient* client, TraceFlag* tracer, absl::string_view json_string,
+    absl::string_view bootstrap_source, grpc_error** error) {
+  Json json = Json::Parse(json_string, error);
   if (*error != GRPC_ERROR_NONE) {
     grpc_error* error_out = GRPC_ERROR_CREATE_REFERENCING_FROM_COPIED_STRING(
-        absl::StrCat("Failed to parse bootstrap file ", path.get()).c_str(),
+        absl::StrCat("Failed to parse bootstrap from ", bootstrap_source)
+            .c_str(),
         error, 1);
     GRPC_ERROR_UNREF(*error);
     *error = error_out;
@@ -177,6 +161,55 @@ std::unique_ptr<XdsBootstrap> XdsBootstrap::ReadFromFile(XdsClient* client,
   return result;
 }
 
+}  // namespace
+
+std::unique_ptr<XdsBootstrap> XdsBootstrap::Create(XdsClient* client,
+                                                   TraceFlag* tracer,
+                                                   const char* fallback_config,
+                                                   grpc_error** error) {
+  // First, try GRPC_XDS_BOOTSTRAP env var.
+  grpc_core::UniquePtr<char> path(gpr_getenv("GRPC_XDS_BOOTSTRAP"));
+  if (path != nullptr) {
+    if (GRPC_TRACE_FLAG_ENABLED(*tracer)) {
+      gpr_log(GPR_INFO,
+              "[xds_client %p] Got bootstrap file location from "
+              "GRPC_XDS_BOOTSTRAP environment variable: %s",
+              client, path.get());
+    }
+    grpc_slice contents;
+    *error =
+        grpc_load_file(path.get(), /*add_null_terminator=*/true, &contents);
+    if (*error != GRPC_ERROR_NONE) return nullptr;
+    absl::string_view contents_str_view = StringViewFromSlice(contents);
+    if (GRPC_TRACE_FLAG_ENABLED(*tracer)) {
+      gpr_log(GPR_DEBUG, "[xds_client %p] Bootstrap file contents: %s", client,
+              std::string(contents_str_view).c_str());
+    }
+    std::string bootstrap_source = absl::StrCat("file ", path.get());
+    auto result = ParseJsonAndCreate(client, tracer, contents_str_view,
+                                     bootstrap_source, error);
+    grpc_slice_unref_internal(contents);
+    return result;
+  }
+  // Next, try GRPC_XDS_BOOTSTRAP_CONFIG env var.
+  grpc_core::UniquePtr<char> env_config(
+      gpr_getenv("GRPC_XDS_BOOTSTRAP_CONFIG"));
+  if (env_config != nullptr) {
+    return ParseJsonAndCreate(client, tracer, env_config.get(),
+                              "GRPC_XDS_BOOTSTRAP_CONFIG env var", error);
+  }
+  // Finally, try fallback config.
+  if (fallback_config != nullptr) {
+    return ParseJsonAndCreate(client, tracer, fallback_config,
+                              "fallback config", error);
+  }
+  // No bootstrap config found.
+  *error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+      "Environment variables GRPC_XDS_BOOTSTRAP or GRPC_XDS_BOOTSTRAP_CONFIG "
+      "not defined");
+  return nullptr;
+}
+
 XdsBootstrap::XdsBootstrap(Json json, grpc_error** error) {
   if (json.type() != Json::Type::OBJECT) {
     *error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
@@ -205,6 +238,16 @@ XdsBootstrap::XdsBootstrap(Json json, grpc_error** error) {
       if (parse_error != GRPC_ERROR_NONE) error_list.push_back(parse_error);
     }
   }
+  it = json.mutable_object()->find("server_listener_resource_name_template");
+  if (it != json.mutable_object()->end()) {
+    if (it->second.type() != Json::Type::STRING) {
+      error_list.push_back(GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+          "\"server_listener_resource_name_template\" field is not a string"));
+    } else {
+      server_listener_resource_name_template_ =
+          std::move(*it->second.mutable_string_value());
+    }
+  }
   if (XdsSecurityEnabled()) {
     it = json.mutable_object()->find("certificate_providers");
     if (it != json.mutable_object()->end()) {
@@ -357,15 +400,7 @@ grpc_error* XdsBootstrap::ParseServerFeaturesArray(Json* json,
     Json& child = json->mutable_array()->at(i);
     if (child.type() == Json::Type::STRING &&
         child.string_value() == "xds_v3") {
-      // TODO(roth): Remove env var check once we do interop testing and
-      // are sure that the v3 code actually works.
-      grpc_core::UniquePtr<char> enable_str(
-          gpr_getenv("GRPC_XDS_EXPERIMENTAL_V3_SUPPORT"));
-      bool enabled = false;
-      if (gpr_parse_bool_value(enable_str.get(), &enabled) && enabled) {
-        server->server_features.insert(
-            std::move(*child.mutable_string_value()));
-      }
+      server->server_features.insert(std::move(*child.mutable_string_value()));
     }
   }
   return GRPC_ERROR_CREATE_FROM_VECTOR(
@@ -436,13 +471,13 @@ grpc_error* XdsBootstrap::ParseLocality(Json* json) {
       node_->locality_zone = std::move(*it->second.mutable_string_value());
     }
   }
-  it = json->mutable_object()->find("subzone");
+  it = json->mutable_object()->find("sub_zone");
   if (it != json->mutable_object()->end()) {
     if (it->second.type() != Json::Type::STRING) {
       error_list.push_back(GRPC_ERROR_CREATE_FROM_STATIC_STRING(
-          "\"subzone\" field is not a string"));
+          "\"sub_zone\" field is not a string"));
     } else {
-      node_->locality_subzone = std::move(*it->second.mutable_string_value());
+      node_->locality_sub_zone = std::move(*it->second.mutable_string_value());
     }
   }
   return GRPC_ERROR_CREATE_FROM_VECTOR("errors parsing \"locality\" object",

data/src/core/ext/xds/xds_bootstrap.h

@@ -29,7 +29,6 @@
 #include <grpc/slice.h>
 
 #include "src/core/ext/xds/certificate_provider_store.h"
-#include "src/core/lib/gprpp/map.h"
 #include "src/core/lib/gprpp/memory.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/iomgr/error.h"
@@ -55,7 +54,7 @@ class XdsBootstrap {
     std::string cluster;
     std::string locality_region;
     std::string locality_zone;
-    std::string locality_subzone;
+    std::string locality_sub_zone;
     Json metadata;
   };
 
@@ -68,11 +67,19 @@ class XdsBootstrap {
     bool ShouldUseV3() const;
   };
 
+  // Creates bootstrap object, obtaining the bootstrap JSON as appropriate
+  // for the environment:
+  // - If the GRPC_XDS_BOOTSTRAP env var is set, reads the file it specifies
+  //   to obtain the bootstrap JSON.
+  // - Otherwise, if the GRPC_XDS_BOOTSTRAP_CONFIG env var is set, reads the
+  //   content of that env var to obtain the bootstrap JSON.
+  // - Otherwise, the JSON will be read from fallback_config (if non-null).
   // If *error is not GRPC_ERROR_NONE after returning, then there was an
-  // error reading the file.
-  static std::unique_ptr<XdsBootstrap> ReadFromFile(XdsClient* client,
-                                                    TraceFlag* tracer,
-                                                    grpc_error** error);
+  // error (e.g., no config found or error reading the file).
+  static std::unique_ptr<XdsBootstrap> Create(XdsClient* client,
+                                              TraceFlag* tracer,
+                                              const char* fallback_config,
+                                              grpc_error** error);
 
   // Do not instantiate directly -- use ReadFromFile() above instead.
   XdsBootstrap(Json json, grpc_error** error);
@@ -81,6 +88,9 @@ class XdsBootstrap {
   // add support for fallback for the xds channel.
   const XdsServer& server() const { return servers_[0]; }
   const Node* node() const { return node_.get(); }
+  const std::string& server_listener_resource_name_template() const {
+    return server_listener_resource_name_template_;
+  }
 
   const CertificateProviderStore::PluginDefinitionMap& certificate_providers()
       const {
@@ -101,6 +111,7 @@ class XdsBootstrap {
 
   absl::InlinedVector<XdsServer, 1> servers_;
   std::unique_ptr<Node> node_;
+  std::string server_listener_resource_name_template_;
   CertificateProviderStore::PluginDefinitionMap certificate_providers_;
 };
 

data/src/core/ext/xds/xds_certificate_provider.cc

@@ -18,10 +18,12 @@
 
 #include <grpc/support/port_platform.h>
 
+#include "src/core/ext/xds/xds_certificate_provider.h"
+
 #include "absl/functional/bind_front.h"
 #include "absl/strings/str_cat.h"
 
-#include "src/core/ext/xds/xds_certificate_provider.h"
+#include "src/core/lib/gpr/useful.h"
 
 namespace grpc_core {
 
@@ -35,15 +37,16 @@ class RootCertificatesWatcher
   // presently, the watcher is immediately deleted when
   // CancelTlsCertificatesWatch() is called, but that can potentially change in
   // the future.
-  explicit RootCertificatesWatcher(
-      RefCountedPtr<grpc_tls_certificate_distributor> parent)
-      : parent_(std::move(parent)) {}
+  RootCertificatesWatcher(
+      RefCountedPtr<grpc_tls_certificate_distributor> parent,
+      std::string cert_name)
+      : parent_(std::move(parent)), cert_name_(std::move(cert_name)) {}
 
   void OnCertificatesChanged(absl::optional<absl::string_view> root_certs,
                              absl::optional<PemKeyCertPairList>
                              /* key_cert_pairs */) override {
     if (root_certs.has_value()) {
-      parent_->SetKeyMaterials("", std::string(root_certs.value()),
+      parent_->SetKeyMaterials(cert_name_, std::string(root_certs.value()),
                                absl::nullopt);
     }
   }
@@ -51,7 +54,7 @@ class RootCertificatesWatcher
   void OnError(grpc_error* root_cert_error,
                grpc_error* identity_cert_error) override {
     if (root_cert_error != GRPC_ERROR_NONE) {
-      parent_->SetErrorForCert("", root_cert_error /* pass the ref */,
+      parent_->SetErrorForCert(cert_name_, root_cert_error /* pass the ref */,
                                absl::nullopt);
     }
     GRPC_ERROR_UNREF(identity_cert_error);
@@ -59,6 +62,7 @@ class RootCertificatesWatcher
 
  private:
   RefCountedPtr<grpc_tls_certificate_distributor> parent_;
+  std::string cert_name_;
 };
 
 class IdentityCertificatesWatcher
@@ -69,22 +73,23 @@ class IdentityCertificatesWatcher
   // presently, the watcher is immediately deleted when
   // CancelTlsCertificatesWatch() is called, but that can potentially change in
   // the future.
-  explicit IdentityCertificatesWatcher(
-      RefCountedPtr<grpc_tls_certificate_distributor> parent)
-      : parent_(std::move(parent)) {}
+  IdentityCertificatesWatcher(
+      RefCountedPtr<grpc_tls_certificate_distributor> parent,
+      std::string cert_name)
+      : parent_(std::move(parent)), cert_name_(std::move(cert_name)) {}
 
   void OnCertificatesChanged(
       absl::optional<absl::string_view> /* root_certs */,
       absl::optional<PemKeyCertPairList> key_cert_pairs) override {
     if (key_cert_pairs.has_value()) {
-      parent_->SetKeyMaterials("", absl::nullopt, key_cert_pairs);
+      parent_->SetKeyMaterials(cert_name_, absl::nullopt, key_cert_pairs);
     }
   }
 
   void OnError(grpc_error* root_cert_error,
                grpc_error* identity_cert_error) override {
     if (identity_cert_error != GRPC_ERROR_NONE) {
-      parent_->SetErrorForCert("", absl::nullopt,
+      parent_->SetErrorForCert(cert_name_, absl::nullopt,
                                identity_cert_error /* pass the ref */);
     }
     GRPC_ERROR_UNREF(root_cert_error);
@@ -92,28 +97,39 @@ class IdentityCertificatesWatcher
 
  private:
   RefCountedPtr<grpc_tls_certificate_distributor> parent_;
+  std::string cert_name_;
 };
 
 }  // namespace
 
-XdsCertificateProvider::XdsCertificateProvider(
-    absl::string_view root_cert_name,
-    RefCountedPtr<grpc_tls_certificate_distributor> root_cert_distributor,
-    absl::string_view identity_cert_name,
-    RefCountedPtr<grpc_tls_certificate_distributor> identity_cert_distributor)
-    : root_cert_name_(root_cert_name),
-      identity_cert_name_(identity_cert_name),
-      root_cert_distributor_(std::move(root_cert_distributor)),
-      identity_cert_distributor_(std::move(identity_cert_distributor)),
-      distributor_(MakeRefCounted<grpc_tls_certificate_distributor>()) {
-  distributor_->SetWatchStatusCallback(
-      absl::bind_front(&XdsCertificateProvider::WatchStatusCallback, this));
+//
+// XdsCertificateProvider::ClusterCertificateState
+//
+
+XdsCertificateProvider::ClusterCertificateState::~ClusterCertificateState() {
+  if (root_cert_watcher_ != nullptr) {
+    root_cert_distributor_->CancelTlsCertificatesWatch(root_cert_watcher_);
+  }
+  if (identity_cert_watcher_ != nullptr) {
+    identity_cert_distributor_->CancelTlsCertificatesWatch(
+        identity_cert_watcher_);
+  }
 }
 
-void XdsCertificateProvider::UpdateRootCertNameAndDistributor(
-    absl::string_view root_cert_name,
-    RefCountedPtr<grpc_tls_certificate_distributor> root_cert_distributor) {
-  MutexLock lock(&mu_);
+bool XdsCertificateProvider::ClusterCertificateState::IsSafeToRemove() const {
+  return !watching_root_certs_ && !watching_identity_certs_ &&
+         root_cert_distributor_ == nullptr &&
+         identity_cert_distributor_ == nullptr;
+}
+
+void XdsCertificateProvider::ClusterCertificateState::
+    UpdateRootCertNameAndDistributor(
+        const std::string& cert_name, absl::string_view root_cert_name,
+        RefCountedPtr<grpc_tls_certificate_distributor> root_cert_distributor) {
+  if (root_cert_name_ == root_cert_name &&
+      root_cert_distributor_ == root_cert_distributor) {
+    return;
+  }
   root_cert_name_ = std::string(root_cert_name);
   if (watching_root_certs_) {
     // The root certificates are being watched. Swap out the watcher.
@@ -121,10 +137,10 @@ void XdsCertificateProvider::UpdateRootCertNameAndDistributor(
       root_cert_distributor_->CancelTlsCertificatesWatch(root_cert_watcher_);
     }
     if (root_cert_distributor != nullptr) {
-      UpdateRootCertWatcher(root_cert_distributor.get());
+      UpdateRootCertWatcher(cert_name, root_cert_distributor.get());
     } else {
       root_cert_watcher_ = nullptr;
-      distributor_->SetErrorForCert(
+      xds_certificate_provider_->distributor_->SetErrorForCert(
           "",
           GRPC_ERROR_CREATE_FROM_STATIC_STRING(
               "No certificate provider available for root certificates"),
@@ -135,10 +151,15 @@ void XdsCertificateProvider::UpdateRootCertNameAndDistributor(
   root_cert_distributor_ = std::move(root_cert_distributor);
 }
 
-void XdsCertificateProvider::UpdateIdentityCertNameAndDistributor(
-    absl::string_view identity_cert_name,
-    RefCountedPtr<grpc_tls_certificate_distributor> identity_cert_distributor) {
-  MutexLock lock(&mu_);
+void XdsCertificateProvider::ClusterCertificateState::
+    UpdateIdentityCertNameAndDistributor(
+        const std::string& cert_name, absl::string_view identity_cert_name,
+        RefCountedPtr<grpc_tls_certificate_distributor>
+            identity_cert_distributor) {
+  if (identity_cert_name_ == identity_cert_name &&
+      identity_cert_distributor_ == identity_cert_distributor) {
+    return;
+  }
   identity_cert_name_ = std::string(identity_cert_name);
   if (watching_identity_certs_) {
     // The identity certificates are being watched. Swap out the watcher.
@@ -147,10 +168,10 @@ void XdsCertificateProvider::UpdateIdentityCertNameAndDistributor(
           identity_cert_watcher_);
     }
     if (identity_cert_distributor != nullptr) {
-      UpdateIdentityCertWatcher(identity_cert_distributor.get());
+      UpdateIdentityCertWatcher(cert_name, identity_cert_distributor.get());
     } else {
       identity_cert_watcher_ = nullptr;
-      distributor_->SetErrorForCert(
+      xds_certificate_provider_->distributor_->SetErrorForCert(
           "", absl::nullopt,
           GRPC_ERROR_CREATE_FROM_STATIC_STRING(
               "No certificate provider available for identity certificates"));
@@ -160,36 +181,45 @@ void XdsCertificateProvider::UpdateIdentityCertNameAndDistributor(
   identity_cert_distributor_ = std::move(identity_cert_distributor);
 }
 
-void XdsCertificateProvider::WatchStatusCallback(std::string cert_name,
-                                                 bool root_being_watched,
-                                                 bool identity_being_watched) {
+void XdsCertificateProvider::ClusterCertificateState::UpdateRootCertWatcher(
+    const std::string& cert_name,
+    grpc_tls_certificate_distributor* root_cert_distributor) {
+  auto watcher = absl::make_unique<RootCertificatesWatcher>(
+      xds_certificate_provider_->distributor_, cert_name);
+  root_cert_watcher_ = watcher.get();
+  root_cert_distributor->WatchTlsCertificates(std::move(watcher),
+                                              root_cert_name_, absl::nullopt);
+}
+
+void XdsCertificateProvider::ClusterCertificateState::UpdateIdentityCertWatcher(
+    const std::string& cert_name,
+    grpc_tls_certificate_distributor* identity_cert_distributor) {
+  auto watcher = absl::make_unique<IdentityCertificatesWatcher>(
+      xds_certificate_provider_->distributor_, cert_name);
+  identity_cert_watcher_ = watcher.get();
+  identity_cert_distributor->WatchTlsCertificates(
+      std::move(watcher), absl::nullopt, identity_cert_name_);
+}
+
+void XdsCertificateProvider::ClusterCertificateState::WatchStatusCallback(
+    const std::string& cert_name, bool root_being_watched,
+    bool identity_being_watched) {
   // We aren't specially handling the case where root_cert_distributor is same
   // as identity_cert_distributor. Always using two separate watchers
   // irrespective of the fact results in a straightforward design, and using a
   // single watcher does not seem to provide any benefit other than cutting down
   // on the number of callbacks.
-  MutexLock lock(&mu_);
-  if (!cert_name.empty()) {
-    grpc_error* error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(
-        absl::StrCat("Illegal certificate name: \'", cert_name,
-                     "\'. Should be empty.")
-            .c_str());
-    distributor_->SetErrorForCert(cert_name, GRPC_ERROR_REF(error),
-                                  GRPC_ERROR_REF(error));
-    GRPC_ERROR_UNREF(error);
-    return;
-  }
   if (root_being_watched && !watching_root_certs_) {
     // We need to start watching root certs.
     watching_root_certs_ = true;
     if (root_cert_distributor_ == nullptr) {
-      distributor_->SetErrorForCert(
-          "",
+      xds_certificate_provider_->distributor_->SetErrorForCert(
+          cert_name,
           GRPC_ERROR_CREATE_FROM_STATIC_STRING(
               "No certificate provider available for root certificates"),
           absl::nullopt);
     } else {
-      UpdateRootCertWatcher(root_cert_distributor_.get());
+      UpdateRootCertWatcher(cert_name, root_cert_distributor_.get());
     }
   } else if (!root_being_watched && watching_root_certs_) {
     // We need to cancel root certs watch.
@@ -203,12 +233,12 @@ void XdsCertificateProvider::WatchStatusCallback(std::string cert_name,
   if (identity_being_watched && !watching_identity_certs_) {
     watching_identity_certs_ = true;
     if (identity_cert_distributor_ == nullptr) {
-      distributor_->SetErrorForCert(
-          "", absl::nullopt,
+      xds_certificate_provider_->distributor_->SetErrorForCert(
+          cert_name, absl::nullopt,
           GRPC_ERROR_CREATE_FROM_STATIC_STRING(
               "No certificate provider available for identity certificates"));
     } else {
-      UpdateIdentityCertWatcher(identity_cert_distributor_.get());
+      UpdateIdentityCertWatcher(cert_name, identity_cert_distributor_.get());
     }
   } else if (!identity_being_watched && watching_identity_certs_) {
     watching_identity_certs_ = false;
@@ -221,20 +251,155 @@ void XdsCertificateProvider::WatchStatusCallback(std::string cert_name,
   }
 }
 
-void XdsCertificateProvider::UpdateRootCertWatcher(
-    grpc_tls_certificate_distributor* root_cert_distributor) {
-  auto watcher = absl::make_unique<RootCertificatesWatcher>(distributor());
-  root_cert_watcher_ = watcher.get();
-  root_cert_distributor->WatchTlsCertificates(std::move(watcher),
-                                              root_cert_name_, absl::nullopt);
+//
+// XdsCertificateProvider
+//
+
+XdsCertificateProvider::XdsCertificateProvider()
+    : distributor_(MakeRefCounted<grpc_tls_certificate_distributor>()) {
+  distributor_->SetWatchStatusCallback(
+      absl::bind_front(&XdsCertificateProvider::WatchStatusCallback, this));
 }
 
-void XdsCertificateProvider::UpdateIdentityCertWatcher(
-    grpc_tls_certificate_distributor* identity_cert_distributor) {
-  auto watcher = absl::make_unique<IdentityCertificatesWatcher>(distributor());
-  identity_cert_watcher_ = watcher.get();
-  identity_cert_distributor->WatchTlsCertificates(
-      std::move(watcher), absl::nullopt, identity_cert_name_);
+XdsCertificateProvider::~XdsCertificateProvider() {
+  distributor_->SetWatchStatusCallback(nullptr);
+}
+
+bool XdsCertificateProvider::ProvidesRootCerts(const std::string& cert_name) {
+  MutexLock lock(&mu_);
+  auto it = certificate_state_map_.find(cert_name);
+  if (it == certificate_state_map_.end()) return false;
+  return it->second->ProvidesRootCerts();
+}
+
+void XdsCertificateProvider::UpdateRootCertNameAndDistributor(
+    const std::string& cert_name, absl::string_view root_cert_name,
+    RefCountedPtr<grpc_tls_certificate_distributor> root_cert_distributor) {
+  MutexLock lock(&mu_);
+  auto it = certificate_state_map_.find(cert_name);
+  if (it == certificate_state_map_.end()) {
+    it = certificate_state_map_
+             .emplace(cert_name,
+                      absl::make_unique<ClusterCertificateState>(this))
+             .first;
+  }
+  it->second->UpdateRootCertNameAndDistributor(cert_name, root_cert_name,
+                                               root_cert_distributor);
+  // Delete unused entries.
+  if (it->second->IsSafeToRemove()) certificate_state_map_.erase(it);
+}
+
+bool XdsCertificateProvider::ProvidesIdentityCerts(
+    const std::string& cert_name) {
+  MutexLock lock(&mu_);
+  auto it = certificate_state_map_.find(cert_name);
+  if (it == certificate_state_map_.end()) return false;
+  return it->second->ProvidesIdentityCerts();
+}
+
+void XdsCertificateProvider::UpdateIdentityCertNameAndDistributor(
+    const std::string& cert_name, absl::string_view identity_cert_name,
+    RefCountedPtr<grpc_tls_certificate_distributor> identity_cert_distributor) {
+  MutexLock lock(&mu_);
+  auto it = certificate_state_map_.find(cert_name);
+  if (it == certificate_state_map_.end()) {
+    it = certificate_state_map_
+             .emplace(cert_name,
+                      absl::make_unique<ClusterCertificateState>(this))
+             .first;
+  }
+  it->second->UpdateIdentityCertNameAndDistributor(
+      cert_name, identity_cert_name, identity_cert_distributor);
+  // Delete unused entries.
+  if (it->second->IsSafeToRemove()) certificate_state_map_.erase(it);
+}
+
+bool XdsCertificateProvider::GetRequireClientCertificate(
+    const std::string& cert_name) {
+  MutexLock lock(&mu_);
+  auto it = certificate_state_map_.find(cert_name);
+  if (it == certificate_state_map_.end()) return false;
+  return it->second->require_client_certificate();
+}
+
+void XdsCertificateProvider::UpdateRequireClientCertificate(
+    const std::string& cert_name, bool require_client_certificate) {
+  MutexLock lock(&mu_);
+  auto it = certificate_state_map_.find(cert_name);
+  if (it == certificate_state_map_.end()) return;
+  it->second->set_require_client_certificate(require_client_certificate);
+}
+
+std::vector<StringMatcher> XdsCertificateProvider::GetSanMatchers(
+    const std::string& cluster) {
+  MutexLock lock(&san_matchers_mu_);
+  auto it = san_matcher_map_.find(cluster);
+  if (it == san_matcher_map_.end()) return {};
+  return it->second;
+}
+
+void XdsCertificateProvider::UpdateSubjectAlternativeNameMatchers(
+    const std::string& cluster, std::vector<StringMatcher> matchers) {
+  MutexLock lock(&san_matchers_mu_);
+  if (matchers.empty()) {
+    san_matcher_map_.erase(cluster);
+  } else {
+    san_matcher_map_[cluster] = std::move(matchers);
+  }
+}
+
+void XdsCertificateProvider::WatchStatusCallback(std::string cert_name,
+                                                 bool root_being_watched,
+                                                 bool identity_being_watched) {
+  MutexLock lock(&mu_);
+  auto it = certificate_state_map_.find(cert_name);
+  if (it == certificate_state_map_.end()) {
+    it = certificate_state_map_
+             .emplace(cert_name,
+                      absl::make_unique<ClusterCertificateState>(this))
+             .first;
+  }
+  it->second->WatchStatusCallback(cert_name, root_being_watched,
+                                  identity_being_watched);
+  // Delete unused entries.
+  if (it->second->IsSafeToRemove()) certificate_state_map_.erase(it);
+}
+
+namespace {
+
+void* XdsCertificateProviderArgCopy(void* p) {
+  XdsCertificateProvider* xds_certificate_provider =
+      static_cast<XdsCertificateProvider*>(p);
+  return xds_certificate_provider->Ref().release();
+}
+
+void XdsCertificateProviderArgDestroy(void* p) {
+  XdsCertificateProvider* xds_certificate_provider =
+      static_cast<XdsCertificateProvider*>(p);
+  xds_certificate_provider->Unref();
+}
+
+int XdsCertificateProviderArgCmp(void* p, void* q) { return GPR_ICMP(p, q); }
+
+const grpc_arg_pointer_vtable kChannelArgVtable = {
+    XdsCertificateProviderArgCopy, XdsCertificateProviderArgDestroy,
+    XdsCertificateProviderArgCmp};
+
+}  // namespace
+
+grpc_arg XdsCertificateProvider::MakeChannelArg() const {
+  return grpc_channel_arg_pointer_create(
+      const_cast<char*>(GRPC_ARG_XDS_CERTIFICATE_PROVIDER),
+      const_cast<XdsCertificateProvider*>(this), &kChannelArgVtable);
+}
+
+RefCountedPtr<XdsCertificateProvider>
+XdsCertificateProvider::GetFromChannelArgs(const grpc_channel_args* args) {
+  XdsCertificateProvider* xds_certificate_provider =
+      grpc_channel_args_find_pointer<XdsCertificateProvider>(
+          args, GRPC_ARG_XDS_CERTIFICATE_PROVIDER);
+  return xds_certificate_provider != nullptr ? xds_certificate_provider->Ref()
+                                             : nullptr;
 }
 
 }  // namespace grpc_core