grpc 1.35.0 → 1.36.0

data/src/core/ext/xds/xds_api.h

@@ -36,6 +36,7 @@
 #include "src/core/ext/filters/client_channel/server_address.h"
 #include "src/core/ext/xds/xds_bootstrap.h"
 #include "src/core/ext/xds/xds_client_stats.h"
+#include "src/core/lib/security/authorization/matchers.h"
 
 namespace grpc_core {
 
@@ -69,52 +70,7 @@ class XdsApi {
   struct Route {
     // Matchers for this route.
     struct Matchers {
-      struct PathMatcher {
-        enum class PathMatcherType {
-          PATH,    // path stored in string_matcher field
-          PREFIX,  // prefix stored in string_matcher field
-          REGEX,   // regex stored in regex_matcher field
-        };
-        PathMatcherType type;
-        std::string string_matcher;
-        std::unique_ptr<RE2> regex_matcher;
-        bool case_sensitive = true;
-
-        PathMatcher() = default;
-        PathMatcher(const PathMatcher& other);
-        PathMatcher& operator=(const PathMatcher& other);
-        bool operator==(const PathMatcher& other) const;
-        std::string ToString() const;
-      };
-
-      struct HeaderMatcher {
-        enum class HeaderMatcherType {
-          EXACT,    // value stored in string_matcher field
-          REGEX,    // uses regex_match field
-          RANGE,    // uses range_start and range_end fields
-          PRESENT,  // uses present_match field
-          PREFIX,   // prefix stored in string_matcher field
-          SUFFIX,   // suffix stored in string_matcher field
-        };
-        std::string name;
-        HeaderMatcherType type;
-        int64_t range_start;
-        int64_t range_end;
-        std::string string_matcher;
-        std::unique_ptr<RE2> regex_match;
-        bool present_match;
-        // invert_match field may or may not exisit, so initialize it to
-        // false.
-        bool invert_match = false;
-
-        HeaderMatcher() = default;
-        HeaderMatcher(const HeaderMatcher& other);
-        HeaderMatcher& operator=(const HeaderMatcher& other);
-        bool operator==(const HeaderMatcher& other) const;
-        std::string ToString() const;
-      };
-
-      PathMatcher path_matcher;
+      StringMatcher path_matcher;
       std::vector<HeaderMatcher> header_matchers;
       absl::optional<uint32_t> fraction_per_million;
 
@@ -175,42 +131,6 @@ class XdsApi {
     VirtualHost* FindVirtualHostForDomain(const std::string& domain);
   };
 
-  class StringMatcher {
-   public:
-    enum class StringMatcherType {
-      EXACT,       // value stored in string_matcher_ field
-      PREFIX,      // value stored in string_matcher_ field
-      SUFFIX,      // value stored in string_matcher_ field
-      SAFE_REGEX,  // pattern stored in regex_matcher_ field
-      CONTAINS,    // value stored in string_matcher_ field
-    };
-
-    StringMatcher() = default;
-    StringMatcher(const StringMatcher& other);
-    StringMatcher(StringMatcherType type, const std::string& matcher,
-                  bool ignore_case = false);
-    StringMatcher& operator=(const StringMatcher& other);
-    bool operator==(const StringMatcher& other) const;
-
-    bool Match(absl::string_view value) const;
-
-    std::string ToString() const;
-
-    StringMatcherType type() const { return type_; }
-
-    // Valid for EXACT, PREFIX, SUFFIX and CONTAINS
-    const std::string& string_matcher() const { return string_matcher_; }
-
-    // Valid for SAFE_REGEX
-    RE2* regex_matcher() const { return regex_matcher_.get(); }
-
-   private:
-    StringMatcherType type_ = StringMatcherType::EXACT;
-    std::string string_matcher_;
-    std::unique_ptr<RE2> regex_matcher_;
-    bool ignore_case_ = false;
-  };
-
   struct CommonTlsContext {
     struct CertificateValidationContext {
       std::vector<StringMatcher> match_subject_alt_names;
@@ -264,9 +184,27 @@ class XdsApi {
     bool Empty() const;
   };
 
+  struct DownstreamTlsContext {
+    CommonTlsContext common_tls_context;
+    bool require_client_certificate = false;
+
+    bool operator==(const DownstreamTlsContext& other) const {
+      return common_tls_context == other.common_tls_context &&
+             require_client_certificate == other.require_client_certificate;
+    }
+
+    std::string ToString() const;
+    bool Empty() const;
+  };
+
   // TODO(roth): When we can use absl::variant<>, consider using that
   // here, to enforce the fact that only one of the two fields can be set.
   struct LdsUpdate {
+    enum class ListenerType {
+      kTcpListener = 0,
+      kHttpApiListener,
+    } type;
+    DownstreamTlsContext downstream_tls_context;
     // The name to use in the RDS request.
     std::string route_config_name;
     // Storing the Http Connection Manager Common Http Protocol Option
@@ -277,10 +215,13 @@ class XdsApi {
     absl::optional<RdsUpdate> rds_update;
 
     bool operator==(const LdsUpdate& other) const {
-      return route_config_name == other.route_config_name &&
+      return downstream_tls_context == other.downstream_tls_context &&
+             route_config_name == other.route_config_name &&
              rds_update == other.rds_update &&
              http_max_stream_duration == other.http_max_stream_duration;
     }
+
+    std::string ToString() const;
   };
 
   using LdsUpdateMap = std::map<std::string /*server_name*/, LdsUpdate>;
@@ -288,6 +229,9 @@ class XdsApi {
   using RdsUpdateMap = std::map<std::string /*route_config_name*/, RdsUpdate>;
 
   struct CdsUpdate {
+    enum ClusterType { EDS, LOGICAL_DNS, AGGREGATE };
+    ClusterType cluster_type;
+    // For cluster type EDS.
     // The name to use in the EDS request.
     // If empty, the cluster name will be used.
     std::string eds_service_name;
@@ -298,15 +242,27 @@ class XdsApi {
     // If set to the empty string, will use the same server we obtained the CDS
     // data from.
     absl::optional<std::string> lrs_load_reporting_server_name;
+    // The LB policy to use (e.g., "ROUND_ROBIN" or "RING_HASH").
+    std::string lb_policy;
+    // Used for RING_HASH LB policy only.
+    uint64_t min_ring_size = 1024;
+    uint64_t max_ring_size = 8388608;
+    enum HashFunction { XX_HASH, MURMUR_HASH_2 };
+    HashFunction hash_function;
     // Maximum number of outstanding requests can be made to the upstream
     // cluster.
     uint32_t max_concurrent_requests = 1024;
+    // For cluster type AGGREGATE.
+    // The prioritized list of cluster names.
+    std::vector<std::string> prioritized_cluster_names;
 
     bool operator==(const CdsUpdate& other) const {
-      return eds_service_name == other.eds_service_name &&
+      return cluster_type == other.cluster_type &&
+             eds_service_name == other.eds_service_name &&
              common_tls_context == other.common_tls_context &&
              lrs_load_reporting_server_name ==
                  other.lrs_load_reporting_server_name &&
+             prioritized_cluster_names == other.prioritized_cluster_names &&
              max_concurrent_requests == other.max_concurrent_requests;
     }
 
@@ -424,6 +380,11 @@ class XdsApi {
   // Parses an ADS response.
   // If the response can't be parsed at the top level, the resulting
   // type_url will be empty.
+  // If there is any other type of validation error, the parse_error
+  // field will be set to something other than GRPC_ERROR_NONE and the
+  // resource_names_failed field will be populated.
+  // Otherwise, one of the *_update_map fields will be populated, based
+  // on the type_url field.
   struct AdsParseResult {
     grpc_error* parse_error = GRPC_ERROR_NONE;
     std::string version;
@@ -433,6 +394,7 @@ class XdsApi {
     RdsUpdateMap rds_update_map;
     CdsUpdateMap cds_update_map;
     EdsUpdateMap eds_update_map;
+    std::set<std::string> resource_names_failed;
   };
   AdsParseResult ParseAdsResponse(
       const grpc_slice& encoded_response,

data/src/core/ext/xds/xds_bootstrap.cc

@@ -48,8 +48,8 @@ bool XdsChannelCredsRegistry::IsSupported(const std::string& creds_type) {
          creds_type == "fake";
 }
 
-bool XdsChannelCredsRegistry::IsValidConfig(const std::string& creds_type,
-                                            const Json& config) {
+bool XdsChannelCredsRegistry::IsValidConfig(const std::string& /*creds_type*/,
+                                            const Json& /*config*/) {
   // Currently, none of the creds types actually take a config, but we
   // ignore whatever might be specified in the bootstrap file for
   // forward compatibility reasons.
@@ -58,7 +58,7 @@ bool XdsChannelCredsRegistry::IsValidConfig(const std::string& creds_type,
 
 RefCountedPtr<grpc_channel_credentials>
 XdsChannelCredsRegistry::MakeChannelCreds(const std::string& creds_type,
-                                          const Json& config) {
+                                          const Json& /*config*/) {
   if (creds_type == "google_default") {
     return grpc_google_default_credentials_create(nullptr);
   } else if (creds_type == "insecure") {
@@ -132,36 +132,14 @@ std::string BootstrapString(const XdsBootstrap& bootstrap) {
   return absl::StrJoin(parts, "");
 }
 
-}  // namespace
-
-std::unique_ptr<XdsBootstrap> XdsBootstrap::ReadFromFile(XdsClient* client,
-                                                         TraceFlag* tracer,
-                                                         grpc_error** error) {
-  grpc_core::UniquePtr<char> path(gpr_getenv("GRPC_XDS_BOOTSTRAP"));
-  if (path == nullptr) {
-    *error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
-        "Environment variable GRPC_XDS_BOOTSTRAP not defined");
-    return nullptr;
-  }
-  if (GRPC_TRACE_FLAG_ENABLED(*tracer)) {
-    gpr_log(GPR_INFO,
-            "[xds_client %p] Got bootstrap file location from "
-            "GRPC_XDS_BOOTSTRAP environment variable: %s",
-            client, path.get());
-  }
-  grpc_slice contents;
-  *error = grpc_load_file(path.get(), /*add_null_terminator=*/true, &contents);
-  if (*error != GRPC_ERROR_NONE) return nullptr;
-  absl::string_view contents_str_view = StringViewFromSlice(contents);
-  if (GRPC_TRACE_FLAG_ENABLED(*tracer)) {
-    gpr_log(GPR_DEBUG, "[xds_client %p] Bootstrap file contents: %s", client,
-            std::string(contents_str_view).c_str());
-  }
-  Json json = Json::Parse(contents_str_view, error);
-  grpc_slice_unref_internal(contents);
+std::unique_ptr<XdsBootstrap> ParseJsonAndCreate(
+    XdsClient* client, TraceFlag* tracer, absl::string_view json_string,
+    absl::string_view bootstrap_source, grpc_error** error) {
+  Json json = Json::Parse(json_string, error);
   if (*error != GRPC_ERROR_NONE) {
     grpc_error* error_out = GRPC_ERROR_CREATE_REFERENCING_FROM_COPIED_STRING(
-        absl::StrCat("Failed to parse bootstrap file ", path.get()).c_str(),
+        absl::StrCat("Failed to parse bootstrap from ", bootstrap_source)
+            .c_str(),
         error, 1);
     GRPC_ERROR_UNREF(*error);
     *error = error_out;
@@ -177,6 +155,55 @@ std::unique_ptr<XdsBootstrap> XdsBootstrap::ReadFromFile(XdsClient* client,
   return result;
 }
 
+}  // namespace
+
+std::unique_ptr<XdsBootstrap> XdsBootstrap::Create(XdsClient* client,
+                                                   TraceFlag* tracer,
+                                                   const char* fallback_config,
+                                                   grpc_error** error) {
+  // First, try GRPC_XDS_BOOTSTRAP env var.
+  grpc_core::UniquePtr<char> path(gpr_getenv("GRPC_XDS_BOOTSTRAP"));
+  if (path != nullptr) {
+    if (GRPC_TRACE_FLAG_ENABLED(*tracer)) {
+      gpr_log(GPR_INFO,
+              "[xds_client %p] Got bootstrap file location from "
+              "GRPC_XDS_BOOTSTRAP environment variable: %s",
+              client, path.get());
+    }
+    grpc_slice contents;
+    *error =
+        grpc_load_file(path.get(), /*add_null_terminator=*/true, &contents);
+    if (*error != GRPC_ERROR_NONE) return nullptr;
+    absl::string_view contents_str_view = StringViewFromSlice(contents);
+    if (GRPC_TRACE_FLAG_ENABLED(*tracer)) {
+      gpr_log(GPR_DEBUG, "[xds_client %p] Bootstrap file contents: %s", client,
+              std::string(contents_str_view).c_str());
+    }
+    std::string bootstrap_source = absl::StrCat("file ", path.get());
+    auto result = ParseJsonAndCreate(client, tracer, contents_str_view,
+                                     bootstrap_source, error);
+    grpc_slice_unref_internal(contents);
+    return result;
+  }
+  // Next, try GRPC_XDS_BOOTSTRAP_CONFIG env var.
+  grpc_core::UniquePtr<char> env_config(
+      gpr_getenv("GRPC_XDS_BOOTSTRAP_CONFIG"));
+  if (env_config != nullptr) {
+    return ParseJsonAndCreate(client, tracer, env_config.get(),
+                              "GRPC_XDS_BOOTSTRAP_CONFIG env var", error);
+  }
+  // Finally, try fallback config.
+  if (fallback_config != nullptr) {
+    return ParseJsonAndCreate(client, tracer, fallback_config,
+                              "fallback config", error);
+  }
+  // No bootstrap config found.
+  *error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+      "Environment variables GRPC_XDS_BOOTSTRAP or GRPC_XDS_BOOTSTRAP_CONFIG "
+      "not defined");
+  return nullptr;
+}
+
 XdsBootstrap::XdsBootstrap(Json json, grpc_error** error) {
   if (json.type() != Json::Type::OBJECT) {
     *error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
@@ -357,15 +384,7 @@ grpc_error* XdsBootstrap::ParseServerFeaturesArray(Json* json,
     Json& child = json->mutable_array()->at(i);
     if (child.type() == Json::Type::STRING &&
         child.string_value() == "xds_v3") {
-      // TODO(roth): Remove env var check once we do interop testing and
-      // are sure that the v3 code actually works.
-      grpc_core::UniquePtr<char> enable_str(
-          gpr_getenv("GRPC_XDS_EXPERIMENTAL_V3_SUPPORT"));
-      bool enabled = false;
-      if (gpr_parse_bool_value(enable_str.get(), &enabled) && enabled) {
-        server->server_features.insert(
-            std::move(*child.mutable_string_value()));
-      }
+      server->server_features.insert(std::move(*child.mutable_string_value()));
     }
   }
   return GRPC_ERROR_CREATE_FROM_VECTOR(

data/src/core/ext/xds/xds_bootstrap.h

@@ -67,11 +67,19 @@ class XdsBootstrap {
     bool ShouldUseV3() const;
   };
 
+  // Creates bootstrap object, obtaining the bootstrap JSON as appropriate
+  // for the environment:
+  // - If the GRPC_XDS_BOOTSTRAP env var is set, reads the file it specifies
+  //   to obtain the bootstrap JSON.
+  // - Otherwise, if the GRPC_XDS_BOOTSTRAP_CONFIG env var is set, reads the
+  //   content of that env var to obtain the bootstrap JSON.
+  // - Otherwise, the JSON will be read from fallback_config (if non-null).
   // If *error is not GRPC_ERROR_NONE after returning, then there was an
-  // error reading the file.
-  static std::unique_ptr<XdsBootstrap> ReadFromFile(XdsClient* client,
-                                                    TraceFlag* tracer,
-                                                    grpc_error** error);
+  // error (e.g., no config found or error reading the file).
+  static std::unique_ptr<XdsBootstrap> Create(XdsClient* client,
+                                              TraceFlag* tracer,
+                                              const char* fallback_config,
+                                              grpc_error** error);
 
   // Do not instantiate directly -- use ReadFromFile() above instead.
   XdsBootstrap(Json json, grpc_error** error);

data/src/core/ext/xds/xds_certificate_provider.cc

@@ -37,15 +37,16 @@ class RootCertificatesWatcher
   // presently, the watcher is immediately deleted when
   // CancelTlsCertificatesWatch() is called, but that can potentially change in
   // the future.
-  explicit RootCertificatesWatcher(
-      RefCountedPtr<grpc_tls_certificate_distributor> parent)
-      : parent_(std::move(parent)) {}
+  RootCertificatesWatcher(
+      RefCountedPtr<grpc_tls_certificate_distributor> parent,
+      std::string cert_name)
+      : parent_(std::move(parent)), cert_name_(std::move(cert_name)) {}
 
   void OnCertificatesChanged(absl::optional<absl::string_view> root_certs,
                              absl::optional<PemKeyCertPairList>
                              /* key_cert_pairs */) override {
     if (root_certs.has_value()) {
-      parent_->SetKeyMaterials("", std::string(root_certs.value()),
+      parent_->SetKeyMaterials(cert_name_, std::string(root_certs.value()),
                                absl::nullopt);
     }
   }
@@ -53,7 +54,7 @@ class RootCertificatesWatcher
   void OnError(grpc_error* root_cert_error,
                grpc_error* identity_cert_error) override {
     if (root_cert_error != GRPC_ERROR_NONE) {
-      parent_->SetErrorForCert("", root_cert_error /* pass the ref */,
+      parent_->SetErrorForCert(cert_name_, root_cert_error /* pass the ref */,
                                absl::nullopt);
     }
     GRPC_ERROR_UNREF(identity_cert_error);
@@ -61,6 +62,7 @@ class RootCertificatesWatcher
 
  private:
   RefCountedPtr<grpc_tls_certificate_distributor> parent_;
+  std::string cert_name_;
 };
 
 class IdentityCertificatesWatcher
@@ -71,22 +73,23 @@ class IdentityCertificatesWatcher
   // presently, the watcher is immediately deleted when
   // CancelTlsCertificatesWatch() is called, but that can potentially change in
   // the future.
-  explicit IdentityCertificatesWatcher(
-      RefCountedPtr<grpc_tls_certificate_distributor> parent)
-      : parent_(std::move(parent)) {}
+  IdentityCertificatesWatcher(
+      RefCountedPtr<grpc_tls_certificate_distributor> parent,
+      std::string cert_name)
+      : parent_(std::move(parent)), cert_name_(std::move(cert_name)) {}
 
   void OnCertificatesChanged(
       absl::optional<absl::string_view> /* root_certs */,
       absl::optional<PemKeyCertPairList> key_cert_pairs) override {
     if (key_cert_pairs.has_value()) {
-      parent_->SetKeyMaterials("", absl::nullopt, key_cert_pairs);
+      parent_->SetKeyMaterials(cert_name_, absl::nullopt, key_cert_pairs);
     }
   }
 
   void OnError(grpc_error* root_cert_error,
                grpc_error* identity_cert_error) override {
     if (identity_cert_error != GRPC_ERROR_NONE) {
-      parent_->SetErrorForCert("", absl::nullopt,
+      parent_->SetErrorForCert(cert_name_, absl::nullopt,
                                identity_cert_error /* pass the ref */);
     }
     GRPC_ERROR_UNREF(root_cert_error);
@@ -94,34 +97,35 @@ class IdentityCertificatesWatcher
 
  private:
   RefCountedPtr<grpc_tls_certificate_distributor> parent_;
+  std::string cert_name_;
 };
 
 }  // namespace
 
-XdsCertificateProvider::XdsCertificateProvider(
-    absl::string_view root_cert_name,
-    RefCountedPtr<grpc_tls_certificate_distributor> root_cert_distributor,
-    absl::string_view identity_cert_name,
-    RefCountedPtr<grpc_tls_certificate_distributor> identity_cert_distributor,
-    std::vector<XdsApi::StringMatcher> san_matchers)
-    : root_cert_name_(root_cert_name),
-      identity_cert_name_(identity_cert_name),
-      root_cert_distributor_(std::move(root_cert_distributor)),
-      identity_cert_distributor_(std::move(identity_cert_distributor)),
-      san_matchers_(std::move(san_matchers)),
-      distributor_(MakeRefCounted<grpc_tls_certificate_distributor>()) {
-  distributor_->SetWatchStatusCallback(
-      absl::bind_front(&XdsCertificateProvider::WatchStatusCallback, this));
+//
+// XdsCertificateProvider::ClusterCertificateState
+//
+
+XdsCertificateProvider::ClusterCertificateState::~ClusterCertificateState() {
+  if (root_cert_watcher_ != nullptr) {
+    root_cert_distributor_->CancelTlsCertificatesWatch(root_cert_watcher_);
+  }
+  if (identity_cert_watcher_ != nullptr) {
+    identity_cert_distributor_->CancelTlsCertificatesWatch(
+        identity_cert_watcher_);
+  }
 }
 
-XdsCertificateProvider::~XdsCertificateProvider() {
-  distributor_->SetWatchStatusCallback(nullptr);
+bool XdsCertificateProvider::ClusterCertificateState::IsSafeToRemove() const {
+  return !watching_root_certs_ && !watching_identity_certs_ &&
+         root_cert_distributor_ == nullptr &&
+         identity_cert_distributor_ == nullptr;
 }
 
-void XdsCertificateProvider::UpdateRootCertNameAndDistributor(
-    absl::string_view root_cert_name,
-    RefCountedPtr<grpc_tls_certificate_distributor> root_cert_distributor) {
-  MutexLock lock(&mu_);
+void XdsCertificateProvider::ClusterCertificateState::
+    UpdateRootCertNameAndDistributor(
+        const std::string& cert_name, absl::string_view root_cert_name,
+        RefCountedPtr<grpc_tls_certificate_distributor> root_cert_distributor) {
   if (root_cert_name_ == root_cert_name &&
       root_cert_distributor_ == root_cert_distributor) {
     return;
@@ -133,10 +137,10 @@ void XdsCertificateProvider::UpdateRootCertNameAndDistributor(
       root_cert_distributor_->CancelTlsCertificatesWatch(root_cert_watcher_);
     }
     if (root_cert_distributor != nullptr) {
-      UpdateRootCertWatcher(root_cert_distributor.get());
+      UpdateRootCertWatcher(cert_name, root_cert_distributor.get());
     } else {
       root_cert_watcher_ = nullptr;
-      distributor_->SetErrorForCert(
+      xds_certificate_provider_->distributor_->SetErrorForCert(
           "",
           GRPC_ERROR_CREATE_FROM_STATIC_STRING(
               "No certificate provider available for root certificates"),
@@ -147,10 +151,11 @@ void XdsCertificateProvider::UpdateRootCertNameAndDistributor(
   root_cert_distributor_ = std::move(root_cert_distributor);
 }
 
-void XdsCertificateProvider::UpdateIdentityCertNameAndDistributor(
-    absl::string_view identity_cert_name,
-    RefCountedPtr<grpc_tls_certificate_distributor> identity_cert_distributor) {
-  MutexLock lock(&mu_);
+void XdsCertificateProvider::ClusterCertificateState::
+    UpdateIdentityCertNameAndDistributor(
+        const std::string& cert_name, absl::string_view identity_cert_name,
+        RefCountedPtr<grpc_tls_certificate_distributor>
+            identity_cert_distributor) {
   if (identity_cert_name_ == identity_cert_name &&
       identity_cert_distributor_ == identity_cert_distributor) {
     return;
@@ -163,10 +168,10 @@ void XdsCertificateProvider::UpdateIdentityCertNameAndDistributor(
           identity_cert_watcher_);
     }
     if (identity_cert_distributor != nullptr) {
-      UpdateIdentityCertWatcher(identity_cert_distributor.get());
+      UpdateIdentityCertWatcher(cert_name, identity_cert_distributor.get());
     } else {
       identity_cert_watcher_ = nullptr;
-      distributor_->SetErrorForCert(
+      xds_certificate_provider_->distributor_->SetErrorForCert(
           "", absl::nullopt,
           GRPC_ERROR_CREATE_FROM_STATIC_STRING(
               "No certificate provider available for identity certificates"));
@@ -176,42 +181,45 @@ void XdsCertificateProvider::UpdateIdentityCertNameAndDistributor(
   identity_cert_distributor_ = std::move(identity_cert_distributor);
 }
 
-void XdsCertificateProvider::UpdateSubjectAlternativeNameMatchers(
-    std::vector<XdsApi::StringMatcher> matchers) {
-  MutexLock lock(&san_matchers_mu_);
-  san_matchers_ = std::move(matchers);
+void XdsCertificateProvider::ClusterCertificateState::UpdateRootCertWatcher(
+    const std::string& cert_name,
+    grpc_tls_certificate_distributor* root_cert_distributor) {
+  auto watcher = absl::make_unique<RootCertificatesWatcher>(
+      xds_certificate_provider_->distributor_, cert_name);
+  root_cert_watcher_ = watcher.get();
+  root_cert_distributor->WatchTlsCertificates(std::move(watcher),
+                                              root_cert_name_, absl::nullopt);
 }
 
-void XdsCertificateProvider::WatchStatusCallback(std::string cert_name,
-                                                 bool root_being_watched,
-                                                 bool identity_being_watched) {
+void XdsCertificateProvider::ClusterCertificateState::UpdateIdentityCertWatcher(
+    const std::string& cert_name,
+    grpc_tls_certificate_distributor* identity_cert_distributor) {
+  auto watcher = absl::make_unique<IdentityCertificatesWatcher>(
+      xds_certificate_provider_->distributor_, cert_name);
+  identity_cert_watcher_ = watcher.get();
+  identity_cert_distributor->WatchTlsCertificates(
+      std::move(watcher), absl::nullopt, identity_cert_name_);
+}
+
+void XdsCertificateProvider::ClusterCertificateState::WatchStatusCallback(
+    const std::string& cert_name, bool root_being_watched,
+    bool identity_being_watched) {
   // We aren't specially handling the case where root_cert_distributor is same
   // as identity_cert_distributor. Always using two separate watchers
   // irrespective of the fact results in a straightforward design, and using a
   // single watcher does not seem to provide any benefit other than cutting down
   // on the number of callbacks.
-  MutexLock lock(&mu_);
-  if (!cert_name.empty()) {
-    grpc_error* error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(
-        absl::StrCat("Illegal certificate name: \'", cert_name,
-                     "\'. Should be empty.")
-            .c_str());
-    distributor_->SetErrorForCert(cert_name, GRPC_ERROR_REF(error),
-                                  GRPC_ERROR_REF(error));
-    GRPC_ERROR_UNREF(error);
-    return;
-  }
   if (root_being_watched && !watching_root_certs_) {
     // We need to start watching root certs.
     watching_root_certs_ = true;
     if (root_cert_distributor_ == nullptr) {
-      distributor_->SetErrorForCert(
-          "",
+      xds_certificate_provider_->distributor_->SetErrorForCert(
+          cert_name,
           GRPC_ERROR_CREATE_FROM_STATIC_STRING(
               "No certificate provider available for root certificates"),
           absl::nullopt);
     } else {
-      UpdateRootCertWatcher(root_cert_distributor_.get());
+      UpdateRootCertWatcher(cert_name, root_cert_distributor_.get());
     }
   } else if (!root_being_watched && watching_root_certs_) {
     // We need to cancel root certs watch.
@@ -225,12 +233,12 @@ void XdsCertificateProvider::WatchStatusCallback(std::string cert_name,
   if (identity_being_watched && !watching_identity_certs_) {
     watching_identity_certs_ = true;
     if (identity_cert_distributor_ == nullptr) {
-      distributor_->SetErrorForCert(
-          "", absl::nullopt,
+      xds_certificate_provider_->distributor_->SetErrorForCert(
+          cert_name, absl::nullopt,
           GRPC_ERROR_CREATE_FROM_STATIC_STRING(
               "No certificate provider available for identity certificates"));
     } else {
-      UpdateIdentityCertWatcher(identity_cert_distributor_.get());
+      UpdateIdentityCertWatcher(cert_name, identity_cert_distributor_.get());
     }
   } else if (!identity_being_watched && watching_identity_certs_) {
     watching_identity_certs_ = false;
@@ -243,20 +251,118 @@ void XdsCertificateProvider::WatchStatusCallback(std::string cert_name,
   }
 }
 
-void XdsCertificateProvider::UpdateRootCertWatcher(
-    grpc_tls_certificate_distributor* root_cert_distributor) {
-  auto watcher = absl::make_unique<RootCertificatesWatcher>(distributor());
-  root_cert_watcher_ = watcher.get();
-  root_cert_distributor->WatchTlsCertificates(std::move(watcher),
-                                              root_cert_name_, absl::nullopt);
+//
+// XdsCertificateProvider
+//
+
+XdsCertificateProvider::XdsCertificateProvider()
+    : distributor_(MakeRefCounted<grpc_tls_certificate_distributor>()) {
+  distributor_->SetWatchStatusCallback(
+      absl::bind_front(&XdsCertificateProvider::WatchStatusCallback, this));
 }
 
-void XdsCertificateProvider::UpdateIdentityCertWatcher(
-    grpc_tls_certificate_distributor* identity_cert_distributor) {
-  auto watcher = absl::make_unique<IdentityCertificatesWatcher>(distributor());
-  identity_cert_watcher_ = watcher.get();
-  identity_cert_distributor->WatchTlsCertificates(
-      std::move(watcher), absl::nullopt, identity_cert_name_);
+XdsCertificateProvider::~XdsCertificateProvider() {
+  distributor_->SetWatchStatusCallback(nullptr);
+}
+
+bool XdsCertificateProvider::ProvidesRootCerts(const std::string& cert_name) {
+  MutexLock lock(&mu_);
+  auto it = certificate_state_map_.find(cert_name);
+  if (it == certificate_state_map_.end()) return false;
+  return it->second->ProvidesRootCerts();
+}
+
+void XdsCertificateProvider::UpdateRootCertNameAndDistributor(
+    const std::string& cert_name, absl::string_view root_cert_name,
+    RefCountedPtr<grpc_tls_certificate_distributor> root_cert_distributor) {
+  MutexLock lock(&mu_);
+  auto it = certificate_state_map_.find(cert_name);
+  if (it == certificate_state_map_.end()) {
+    it = certificate_state_map_
+             .emplace(cert_name,
+                      absl::make_unique<ClusterCertificateState>(this))
+             .first;
+  }
+  it->second->UpdateRootCertNameAndDistributor(cert_name, root_cert_name,
+                                               root_cert_distributor);
+  // Delete unused entries.
+  if (it->second->IsSafeToRemove()) certificate_state_map_.erase(it);
+}
+
+bool XdsCertificateProvider::ProvidesIdentityCerts(
+    const std::string& cert_name) {
+  MutexLock lock(&mu_);
+  auto it = certificate_state_map_.find(cert_name);
+  if (it == certificate_state_map_.end()) return false;
+  return it->second->ProvidesIdentityCerts();
+}
+
+void XdsCertificateProvider::UpdateIdentityCertNameAndDistributor(
+    const std::string& cert_name, absl::string_view identity_cert_name,
+    RefCountedPtr<grpc_tls_certificate_distributor> identity_cert_distributor) {
+  MutexLock lock(&mu_);
+  auto it = certificate_state_map_.find(cert_name);
+  if (it == certificate_state_map_.end()) {
+    it = certificate_state_map_
+             .emplace(cert_name,
+                      absl::make_unique<ClusterCertificateState>(this))
+             .first;
+  }
+  it->second->UpdateIdentityCertNameAndDistributor(
+      cert_name, identity_cert_name, identity_cert_distributor);
+  // Delete unused entries.
+  if (it->second->IsSafeToRemove()) certificate_state_map_.erase(it);
+}
+
+bool XdsCertificateProvider::GetRequireClientCertificate(
+    const std::string& cert_name) {
+  MutexLock lock(&mu_);
+  auto it = certificate_state_map_.find(cert_name);
+  if (it == certificate_state_map_.end()) return false;
+  return it->second->require_client_certificate();
+}
+
+void XdsCertificateProvider::UpdateRequireClientCertificate(
+    const std::string& cert_name, bool require_client_certificate) {
+  MutexLock lock(&mu_);
+  auto it = certificate_state_map_.find(cert_name);
+  if (it == certificate_state_map_.end()) return;
+  it->second->set_require_client_certificate(require_client_certificate);
+}
+
+std::vector<StringMatcher> XdsCertificateProvider::GetSanMatchers(
+    const std::string& cluster) {
+  MutexLock lock(&san_matchers_mu_);
+  auto it = san_matcher_map_.find(cluster);
+  if (it == san_matcher_map_.end()) return {};
+  return it->second;
+}
+
+void XdsCertificateProvider::UpdateSubjectAlternativeNameMatchers(
+    const std::string& cluster, std::vector<StringMatcher> matchers) {
+  MutexLock lock(&san_matchers_mu_);
+  if (matchers.empty()) {
+    san_matcher_map_.erase(cluster);
+  } else {
+    san_matcher_map_[cluster] = std::move(matchers);
+  }
+}
+
+void XdsCertificateProvider::WatchStatusCallback(std::string cert_name,
+                                                 bool root_being_watched,
+                                                 bool identity_being_watched) {
+  MutexLock lock(&mu_);
+  auto it = certificate_state_map_.find(cert_name);
+  if (it == certificate_state_map_.end()) {
+    it = certificate_state_map_
+             .emplace(cert_name,
+                      absl::make_unique<ClusterCertificateState>(this))
+             .first;
+  }
+  it->second->WatchStatusCallback(cert_name, root_being_watched,
+                                  identity_being_watched);
+  // Delete unused entries.
+  if (it->second->IsSafeToRemove()) certificate_state_map_.erase(it);
 }
 
 namespace {