grpc 1.41.0 → 1.43.1

data/src/core/ext/xds/xds_api.cc

@@ -1,20 +1,18 @@
-/*
- *
- * Copyright 2018 gRPC authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- */
+//
+// Copyright 2018 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
 
 #include <grpc/support/port_platform.h>
 
@@ -82,24 +80,25 @@
 #include "google/protobuf/timestamp.upb.h"
 #include "google/protobuf/wrappers.upb.h"
 #include "google/rpc/status.upb.h"
-#include "udpa/type/v1/typed_struct.upb.h"
 #include "upb/text_encode.h"
 #include "upb/upb.h"
 #include "upb/upb.hpp"
+#include "xds/type/v3/typed_struct.upb.h"
 
 #include <grpc/impl/codegen/log.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/string_util.h>
 
+#include "src/core/ext/xds/xds_routing.h"
 #include "src/core/lib/address_utils/sockaddr_utils.h"
 #include "src/core/lib/gpr/env.h"
 #include "src/core/lib/gpr/string.h"
-#include "src/core/lib/gpr/useful.h"
 #include "src/core/lib/gprpp/host_port.h"
 #include "src/core/lib/iomgr/error.h"
 #include "src/core/lib/iomgr/sockaddr.h"
 #include "src/core/lib/iomgr/socket_utils.h"
 #include "src/core/lib/slice/slice_utils.h"
+#include "src/core/lib/uri/uri_parser.h"
 
 namespace grpc_core {
 
@@ -116,11 +115,58 @@ bool XdsAggregateAndLogicalDnsClusterEnabled() {
   return parse_succeeded && parsed_value;
 }
 
+// TODO(yashykt): Remove once RBAC is no longer experimental
+bool XdsRbacEnabled() {
+  char* value = gpr_getenv("GRPC_XDS_EXPERIMENTAL_RBAC");
+  bool parsed_value;
+  bool parse_succeeded = gpr_parse_bool_value(value, &parsed_value);
+  gpr_free(value);
+  return parse_succeeded && parsed_value;
+}
+
+//
+// XdsApi::RetryPolicy
+//
+
+std::string XdsApi::RetryPolicy::RetryBackOff::ToString() const {
+  std::vector<std::string> contents;
+  contents.push_back(
+      absl::StrCat("RetryBackOff Base: ", base_interval.ToString()));
+  contents.push_back(
+      absl::StrCat("RetryBackOff max: ", max_interval.ToString()));
+  return absl::StrJoin(contents, ",");
+}
+
+std::string XdsApi::RetryPolicy::ToString() const {
+  std::vector<std::string> contents;
+  contents.push_back(absl::StrFormat("num_retries=%d", num_retries));
+  contents.push_back(retry_back_off.ToString());
+  return absl::StrCat("{", absl::StrJoin(contents, ","), "}");
+}
+
+//
+// XdsApi::Route::Matchers
+//
+
+std::string XdsApi::Route::Matchers::ToString() const {
+  std::vector<std::string> contents;
+  contents.push_back(
+      absl::StrFormat("PathMatcher{%s}", path_matcher.ToString()));
+  for (const HeaderMatcher& header_matcher : header_matchers) {
+    contents.push_back(header_matcher.ToString());
+  }
+  if (fraction_per_million.has_value()) {
+    contents.push_back(absl::StrFormat("Fraction Per Million %d",
+                                       fraction_per_million.value()));
+  }
+  return absl::StrJoin(contents, "\n");
+}
+
 //
-// XdsApi::Route::HashPolicy
+// XdsApi::Route::RouteAction::HashPolicy
 //
 
-XdsApi::Route::HashPolicy::HashPolicy(const HashPolicy& other)
+XdsApi::Route::RouteAction::HashPolicy::HashPolicy(const HashPolicy& other)
     : type(other.type),
       header_name(other.header_name),
       regex_substitution(other.regex_substitution) {
@@ -130,8 +176,8 @@ XdsApi::Route::HashPolicy::HashPolicy(const HashPolicy& other)
   }
 }
 
-XdsApi::Route::HashPolicy& XdsApi::Route::HashPolicy::operator=(
-    const HashPolicy& other) {
+XdsApi::Route::RouteAction::HashPolicy&
+XdsApi::Route::RouteAction::HashPolicy::operator=(const HashPolicy& other) {
   type = other.type;
   header_name = other.header_name;
   if (other.regex != nullptr) {
@@ -142,14 +188,14 @@ XdsApi::Route::HashPolicy& XdsApi::Route::HashPolicy::operator=(
   return *this;
 }
 
-XdsApi::Route::HashPolicy::HashPolicy(HashPolicy&& other) noexcept
+XdsApi::Route::RouteAction::HashPolicy::HashPolicy(HashPolicy&& other) noexcept
     : type(other.type),
       header_name(std::move(other.header_name)),
       regex(std::move(other.regex)),
       regex_substitution(std::move(other.regex_substitution)) {}
 
-XdsApi::Route::HashPolicy& XdsApi::Route::HashPolicy::operator=(
-    HashPolicy&& other) noexcept {
+XdsApi::Route::RouteAction::HashPolicy&
+XdsApi::Route::RouteAction::HashPolicy::operator=(HashPolicy&& other) noexcept {
   type = other.type;
   header_name = std::move(other.header_name);
   regex = std::move(other.regex);
@@ -157,7 +203,7 @@ XdsApi::Route::HashPolicy& XdsApi::Route::HashPolicy::operator=(
   return *this;
 }
 
-bool XdsApi::Route::HashPolicy::HashPolicy::operator==(
+bool XdsApi::Route::RouteAction::HashPolicy::HashPolicy::operator==(
     const HashPolicy& other) const {
   if (type != other.type) return false;
   if (type == Type::HEADER) {
@@ -173,7 +219,7 @@ bool XdsApi::Route::HashPolicy::HashPolicy::operator==(
   return true;
 }
 
-std::string XdsApi::Route::HashPolicy::ToString() const {
+std::string XdsApi::Route::RouteAction::HashPolicy::ToString() const {
   std::vector<std::string> contents;
   switch (type) {
     case Type::HEADER:
@@ -194,43 +240,10 @@ std::string XdsApi::Route::HashPolicy::ToString() const {
 }
 
 //
-// XdsApi::Route::RetryPolicy
-//
-std::string XdsApi::Route::RetryPolicy::RetryBackOff::ToString() const {
-  std::vector<std::string> contents;
-  contents.push_back(
-      absl::StrCat("RetryBackOff Base: ", base_interval.ToString()));
-  contents.push_back(
-      absl::StrCat("RetryBackOff max: ", max_interval.ToString()));
-  return absl::StrJoin(contents, ",");
-}
-
-std::string XdsApi::Route::RetryPolicy::ToString() const {
-  std::vector<std::string> contents;
-  contents.push_back(absl::StrFormat("num_retries=%d", num_retries));
-  contents.push_back(retry_back_off.ToString());
-  return absl::StrJoin(contents, ",");
-}
-
-//
-// XdsApi::Route
+// XdsApi::Route::RouteAction::ClusterWeight
 //
 
-std::string XdsApi::Route::Matchers::ToString() const {
-  std::vector<std::string> contents;
-  contents.push_back(
-      absl::StrFormat("PathMatcher{%s}", path_matcher.ToString()));
-  for (const HeaderMatcher& header_matcher : header_matchers) {
-    contents.push_back(header_matcher.ToString());
-  }
-  if (fraction_per_million.has_value()) {
-    contents.push_back(absl::StrFormat("Fraction Per Million %d",
-                                       fraction_per_million.value()));
-  }
-  return absl::StrJoin(contents, "\n");
-}
-
-std::string XdsApi::Route::ClusterWeight::ToString() const {
+std::string XdsApi::Route::RouteAction::ClusterWeight::ToString() const {
   std::vector<std::string> contents;
   contents.push_back(absl::StrCat("cluster=", name));
   contents.push_back(absl::StrCat("weight=", weight));
@@ -247,15 +260,17 @@ std::string XdsApi::Route::ClusterWeight::ToString() const {
   return absl::StrCat("{", absl::StrJoin(contents, ", "), "}");
 }
 
-std::string XdsApi::Route::ToString() const {
+//
+// XdsApi::Route::RouteAction
+//
+
+std::string XdsApi::Route::RouteAction::ToString() const {
   std::vector<std::string> contents;
-  contents.push_back(matchers.ToString());
   for (const HashPolicy& hash_policy : hash_policies) {
     contents.push_back(absl::StrCat("hash_policy=", hash_policy.ToString()));
   }
   if (retry_policy.has_value()) {
-    contents.push_back(
-        absl::StrCat("retry_policy={", retry_policy->ToString(), "}"));
+    contents.push_back(absl::StrCat("retry_policy=", retry_policy->ToString()));
   }
   if (!cluster_name.empty()) {
     contents.push_back(absl::StrFormat("Cluster name: %s", cluster_name));
@@ -266,6 +281,25 @@ std::string XdsApi::Route::ToString() const {
   if (max_stream_duration.has_value()) {
     contents.push_back(max_stream_duration->ToString());
   }
+  return absl::StrCat("{", absl::StrJoin(contents, ", "), "}");
+}
+
+//
+// XdsApi::Route
+//
+
+std::string XdsApi::Route::ToString() const {
+  std::vector<std::string> contents;
+  contents.push_back(matchers.ToString());
+  auto* route_action = absl::get_if<XdsApi::Route::RouteAction>(&action);
+  if (route_action != nullptr) {
+    contents.push_back(absl::StrCat("route=", route_action->ToString()));
+  } else if (absl::holds_alternative<XdsApi::Route::NonForwardingAction>(
+                 action)) {
+    contents.push_back("non_forwarding_action={}");
+  } else {
+    contents.push_back("unknown_action={}");
+  }
   if (!typed_per_filter_config.empty()) {
     contents.push_back("typed_per_filter_config={");
     for (const auto& p : typed_per_filter_config) {
@@ -310,104 +344,6 @@ std::string XdsApi::RdsUpdate::ToString() const {
   return absl::StrJoin(vhosts, "");
 }
 
-namespace {
-
-// Better match type has smaller value.
-enum MatchType {
-  EXACT_MATCH,
-  SUFFIX_MATCH,
-  PREFIX_MATCH,
-  UNIVERSE_MATCH,
-  INVALID_MATCH,
-};
-
-// Returns true if match succeeds.
-bool DomainMatch(MatchType match_type, const std::string& domain_pattern_in,
-                 const std::string& expected_host_name_in) {
-  // Normalize the args to lower-case. Domain matching is case-insensitive.
-  std::string domain_pattern = domain_pattern_in;
-  std::string expected_host_name = expected_host_name_in;
-  std::transform(domain_pattern.begin(), domain_pattern.end(),
-                 domain_pattern.begin(),
-                 [](unsigned char c) { return std::tolower(c); });
-  std::transform(expected_host_name.begin(), expected_host_name.end(),
-                 expected_host_name.begin(),
-                 [](unsigned char c) { return std::tolower(c); });
-  if (match_type == EXACT_MATCH) {
-    return domain_pattern == expected_host_name;
-  } else if (match_type == SUFFIX_MATCH) {
-    // Asterisk must match at least one char.
-    if (expected_host_name.size() < domain_pattern.size()) return false;
-    absl::string_view pattern_suffix(domain_pattern.c_str() + 1);
-    absl::string_view host_suffix(expected_host_name.c_str() +
-                                  expected_host_name.size() -
-                                  pattern_suffix.size());
-    return pattern_suffix == host_suffix;
-  } else if (match_type == PREFIX_MATCH) {
-    // Asterisk must match at least one char.
-    if (expected_host_name.size() < domain_pattern.size()) return false;
-    absl::string_view pattern_prefix(domain_pattern.c_str(),
-                                     domain_pattern.size() - 1);
-    absl::string_view host_prefix(expected_host_name.c_str(),
-                                  pattern_prefix.size());
-    return pattern_prefix == host_prefix;
-  } else {
-    return match_type == UNIVERSE_MATCH;
-  }
-}
-
-MatchType DomainPatternMatchType(const std::string& domain_pattern) {
-  if (domain_pattern.empty()) return INVALID_MATCH;
-  if (domain_pattern.find('*') == std::string::npos) return EXACT_MATCH;
-  if (domain_pattern == "*") return UNIVERSE_MATCH;
-  if (domain_pattern[0] == '*') return SUFFIX_MATCH;
-  if (domain_pattern[domain_pattern.size() - 1] == '*') return PREFIX_MATCH;
-  return INVALID_MATCH;
-}
-
-}  // namespace
-
-XdsApi::RdsUpdate::VirtualHost* XdsApi::RdsUpdate::FindVirtualHostForDomain(
-    const std::string& domain) {
-  // Find the best matched virtual host.
-  // The search order for 4 groups of domain patterns:
-  //   1. Exact match.
-  //   2. Suffix match (e.g., "*ABC").
-  //   3. Prefix match (e.g., "ABC*").
-  //   4. Universe match (i.e., "*").
-  // Within each group, longest match wins.
-  // If the same best matched domain pattern appears in multiple virtual hosts,
-  // the first matched virtual host wins.
-  VirtualHost* target_vhost = nullptr;
-  MatchType best_match_type = INVALID_MATCH;
-  size_t longest_match = 0;
-  // Check each domain pattern in each virtual host to determine the best
-  // matched virtual host.
-  for (VirtualHost& vhost : virtual_hosts) {
-    for (const std::string& domain_pattern : vhost.domains) {
-      // Check the match type first. Skip the pattern if it's not better than
-      // current match.
-      const MatchType match_type = DomainPatternMatchType(domain_pattern);
-      // This should be caught by RouteConfigParse().
-      GPR_ASSERT(match_type != INVALID_MATCH);
-      if (match_type > best_match_type) continue;
-      if (match_type == best_match_type &&
-          domain_pattern.size() <= longest_match) {
-        continue;
-      }
-      // Skip if match fails.
-      if (!DomainMatch(match_type, domain_pattern, domain)) continue;
-      // Choose this match.
-      target_vhost = &vhost;
-      best_match_type = match_type;
-      longest_match = domain_pattern.size();
-      if (best_match_type == EXACT_MATCH) break;
-    }
-    if (best_match_type == EXACT_MATCH) break;
-  }
-  return target_vhost;
-}
-
 //
 // XdsApi::CommonTlsContext::CertificateValidationContext
 //
@@ -786,25 +722,22 @@ std::string XdsApi::EdsUpdate::ToString() const {
 // XdsApi
 //
 
-const char* XdsApi::kLdsTypeUrl =
-    "type.googleapis.com/envoy.config.listener.v3.Listener";
-const char* XdsApi::kRdsTypeUrl =
-    "type.googleapis.com/envoy.config.route.v3.RouteConfiguration";
-const char* XdsApi::kCdsTypeUrl =
-    "type.googleapis.com/envoy.config.cluster.v3.Cluster";
+// TODO(roth): All constants and functions for individual resource types
+// should be merged into the XdsResourceType abstraction.
+const char* XdsApi::kLdsTypeUrl = "envoy.config.listener.v3.Listener";
+const char* XdsApi::kRdsTypeUrl = "envoy.config.route.v3.RouteConfiguration";
+const char* XdsApi::kCdsTypeUrl = "envoy.config.cluster.v3.Cluster";
 const char* XdsApi::kEdsTypeUrl =
-    "type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment";
+    "envoy.config.endpoint.v3.ClusterLoadAssignment";
 
 namespace {
 
-const char* kLdsV2TypeUrl = "type.googleapis.com/envoy.api.v2.Listener";
-const char* kRdsV2TypeUrl =
-    "type.googleapis.com/envoy.api.v2.RouteConfiguration";
-const char* kCdsV2TypeUrl = "type.googleapis.com/envoy.api.v2.Cluster";
-const char* kEdsV2TypeUrl =
-    "type.googleapis.com/envoy.api.v2.ClusterLoadAssignment";
+const char* kLdsV2TypeUrl = "envoy.api.v2.Listener";
+const char* kRdsV2TypeUrl = "envoy.api.v2.RouteConfiguration";
+const char* kCdsV2TypeUrl = "envoy.api.v2.Cluster";
+const char* kEdsV2TypeUrl = "envoy.api.v2.ClusterLoadAssignment";
 
-bool IsLds(absl::string_view type_url, bool* is_v2 = nullptr) {
+bool IsLdsInternal(absl::string_view type_url, bool* is_v2 = nullptr) {
   if (type_url == XdsApi::kLdsTypeUrl) return true;
   if (type_url == kLdsV2TypeUrl) {
     if (is_v2 != nullptr) *is_v2 = true;
@@ -813,18 +746,118 @@ bool IsLds(absl::string_view type_url, bool* is_v2 = nullptr) {
   return false;
 }
 
-bool IsRds(absl::string_view type_url, bool* /*is_v2*/ = nullptr) {
+bool IsRdsInternal(absl::string_view type_url, bool* /*is_v2*/ = nullptr) {
   return type_url == XdsApi::kRdsTypeUrl || type_url == kRdsV2TypeUrl;
 }
 
-bool IsCds(absl::string_view type_url, bool* /*is_v2*/ = nullptr) {
+bool IsCdsInternal(absl::string_view type_url, bool* /*is_v2*/ = nullptr) {
   return type_url == XdsApi::kCdsTypeUrl || type_url == kCdsV2TypeUrl;
 }
 
-bool IsEds(absl::string_view type_url, bool* /*is_v2*/ = nullptr) {
+bool IsEdsInternal(absl::string_view type_url, bool* /*is_v2*/ = nullptr) {
   return type_url == XdsApi::kEdsTypeUrl || type_url == kEdsV2TypeUrl;
 }
 
+absl::string_view TypeUrlExternalToInternal(bool use_v3,
+                                            const std::string& type_url) {
+  if (!use_v3) {
+    if (type_url == XdsApi::kLdsTypeUrl) {
+      return kLdsV2TypeUrl;
+    }
+    if (type_url == XdsApi::kRdsTypeUrl) {
+      return kRdsV2TypeUrl;
+    }
+    if (type_url == XdsApi::kCdsTypeUrl) {
+      return kCdsV2TypeUrl;
+    }
+    if (type_url == XdsApi::kEdsTypeUrl) {
+      return kEdsV2TypeUrl;
+    }
+  }
+  return type_url;
+}
+
+std::string TypeUrlInternalToExternal(absl::string_view type_url) {
+  if (type_url == kLdsV2TypeUrl) {
+    return XdsApi::kLdsTypeUrl;
+  } else if (type_url == kRdsV2TypeUrl) {
+    return XdsApi::kRdsTypeUrl;
+  } else if (type_url == kCdsV2TypeUrl) {
+    return XdsApi::kCdsTypeUrl;
+  } else if (type_url == kEdsV2TypeUrl) {
+    return XdsApi::kEdsTypeUrl;
+  }
+  return std::string(type_url);
+}
+
+struct EncodingContext {
+  XdsClient* client;  // Used only for logging. Unsafe for dereferencing.
+  TraceFlag* tracer;
+  upb_symtab* symtab;
+  upb_arena* arena;
+  bool use_v3;
+  const CertificateProviderStore::PluginDefinitionMap*
+      certificate_provider_definition_map;
+};
+
+class XdsResourceType {
+ public:
+  // A base type for resource data.
+  struct ResourceData {};
+
+  struct DecodeResult {
+    std::string name;
+    absl::StatusOr<std::unique_ptr<ResourceData>> resource;
+  };
+
+  virtual ~XdsResourceType() = default;
+
+  virtual absl::string_view type_url() const = 0;
+
+  virtual absl::string_view v2_type_url() const = 0;
+
+  virtual absl::StatusOr<DecodeResult> Decode(
+      const EncodingContext& context, absl::string_view serialized_resource,
+      bool is_v2) const = 0;
+
+  bool IsType(absl::string_view resource_type, bool* is_v2) const {
+    if (resource_type == type_url()) return true;
+    if (resource_type == v2_type_url()) {
+      if (is_v2 != nullptr) *is_v2 = true;
+      return true;
+    }
+    return false;
+  }
+};
+
+absl::StatusOr<XdsApi::ResourceName> ParseResourceNameInternal(
+    absl::string_view name,
+    std::function<bool(absl::string_view, bool*)> is_expected_type) {
+  // Old-style names use the empty string for authority.
+  // authority is prefixed with "old:" to indicate that it's an old-style name.
+  if (!absl::StartsWith(name, "xdstp:")) {
+    return XdsApi::ResourceName{"old:", std::string(name)};
+  }
+  // New style name.  Parse URI.
+  auto uri = URI::Parse(name);
+  if (!uri.ok()) return uri.status();
+  // Split the resource type off of the path to get the id.
+  std::pair<absl::string_view, absl::string_view> path_parts =
+      absl::StrSplit(uri->path(), absl::MaxSplits('/', 1));
+  if (!is_expected_type(path_parts.first, nullptr)) {
+    return absl::InvalidArgumentError(
+        "xdstp URI path must indicate valid xDS resource type");
+  }
+  std::vector<std::pair<absl::string_view, absl::string_view>> query_parameters(
+      uri->query_parameter_map().begin(), uri->query_parameter_map().end());
+  std::sort(query_parameters.begin(), query_parameters.end());
+  return XdsApi::ResourceName{
+      absl::StrCat("xdstp:", uri->authority()),
+      absl::StrCat(
+          path_parts.second, (query_parameters.empty() ? "?" : ""),
+          absl::StrJoin(query_parameters, "&", absl::PairFormatter("=")))};
+}
+
 }  // namespace
 
 // If gRPC is built with -DGRPC_XDS_USER_AGENT_NAME_SUFFIX="...", that string
@@ -881,17 +914,41 @@ XdsApi::XdsApi(XdsClient* client, TraceFlag* tracer,
   XdsHttpFilterRegistry::PopulateSymtab(symtab_.ptr());
 }
 
-namespace {
+bool XdsApi::IsLds(absl::string_view type_url) {
+  return IsLdsInternal(type_url);
+}
 
-struct EncodingContext {
-  XdsClient* client;  // Used only for logging. Unsafe for dereferencing.
-  TraceFlag* tracer;
-  upb_symtab* symtab;
-  upb_arena* arena;
-  bool use_v3;
-  const CertificateProviderStore::PluginDefinitionMap*
-      certificate_provider_definition_map;
-};
+bool XdsApi::IsRds(absl::string_view type_url) {
+  return IsRdsInternal(type_url);
+}
+
+bool XdsApi::IsCds(absl::string_view type_url) {
+  return IsCdsInternal(type_url);
+}
+
+bool XdsApi::IsEds(absl::string_view type_url) {
+  return IsEdsInternal(type_url);
+}
+
+absl::StatusOr<XdsApi::ResourceName> XdsApi::ParseResourceName(
+    absl::string_view name, bool (*is_expected_type)(absl::string_view)) {
+  return ParseResourceNameInternal(
+      name, [is_expected_type](absl::string_view type, bool*) {
+        return is_expected_type(type);
+      });
+}
+
+std::string XdsApi::ConstructFullResourceName(absl::string_view authority,
+                                              absl::string_view resource_type,
+                                              absl::string_view name) {
+  if (absl::ConsumePrefix(&authority, "xdstp:")) {
+    return absl::StrCat("xdstp://", authority, "/", resource_type, "/", name);
+  } else {
+    return std::string(absl::StripPrefix(name, "old:"));
+  }
+}
+
+namespace {
 
 // Works for both std::string and absl::string_view.
 template <typename T>
@@ -1072,30 +1129,12 @@ grpc_slice SerializeDiscoveryRequest(
   return grpc_slice_from_copied_buffer(output, output_length);
 }
 
-absl::string_view TypeUrlExternalToInternal(bool use_v3,
-                                            const std::string& type_url) {
-  if (!use_v3) {
-    if (type_url == XdsApi::kLdsTypeUrl) {
-      return kLdsV2TypeUrl;
-    }
-    if (type_url == XdsApi::kRdsTypeUrl) {
-      return kRdsV2TypeUrl;
-    }
-    if (type_url == XdsApi::kCdsTypeUrl) {
-      return kCdsV2TypeUrl;
-    }
-    if (type_url == XdsApi::kEdsTypeUrl) {
-      return kEdsV2TypeUrl;
-    }
-  }
-  return type_url;
-}
-
 }  // namespace
 
 grpc_slice XdsApi::CreateAdsRequest(
     const XdsBootstrap::XdsServer& server, const std::string& type_url,
-    const std::set<absl::string_view>& resource_names,
+    const std::map<absl::string_view /*authority*/,
+                   std::set<absl::string_view /*name*/>>& resource_names,
     const std::string& version, const std::string& nonce,
     grpc_error_handle error, bool populate_node) {
   upb::Arena arena;
@@ -1111,8 +1150,10 @@ grpc_slice XdsApi::CreateAdsRequest(
   // Set type_url.
   absl::string_view real_type_url =
       TypeUrlExternalToInternal(server.ShouldUseV3(), type_url);
+  std::string real_type_url_str =
+      absl::StrCat("type.googleapis.com/", real_type_url);
   envoy_service_discovery_v3_DiscoveryRequest_set_type_url(
-      request, StdStringToUpbString(real_type_url));
+      request, StdStringToUpbString(real_type_url_str));
   // Set version_info.
   if (!version.empty()) {
     envoy_service_discovery_v3_DiscoveryRequest_set_version_info(
@@ -1148,10 +1189,27 @@ grpc_slice XdsApi::CreateAdsRequest(
     PopulateNode(context, node_, build_version_, user_agent_name_,
                  user_agent_version_, node_msg);
   }
+  // A vector for temporary local storage of resource name strings.
+  std::vector<std::string> resource_name_storage;
+  // Make sure the vector is sized right up-front, so that reallocations
+  // don't move the strings out from under the upb proto object that
+  // points to them.
+  size_t size = 0;
+  for (const auto& p : resource_names) {
+    size += p.second.size();
+  }
+  resource_name_storage.reserve(size);
   // Add resource_names.
-  for (const auto& resource_name : resource_names) {
-    envoy_service_discovery_v3_DiscoveryRequest_add_resource_names(
-        request, StdStringToUpbString(resource_name), arena.ptr());
+  for (const auto& a : resource_names) {
+    absl::string_view authority = a.first;
+    for (const auto& p : a.second) {
+      absl::string_view resource_id = p;
+      resource_name_storage.push_back(
+          ConstructFullResourceName(authority, real_type_url, resource_id));
+      envoy_service_discovery_v3_DiscoveryRequest_add_resource_names(
+          request, StdStringToUpbString(resource_name_storage.back()),
+          arena.ptr());
+    }
   }
   MaybeLogDiscoveryRequest(context, request);
   return SerializeDiscoveryRequest(context, request);
@@ -1438,16 +1496,17 @@ grpc_error_handle ExtractHttpFilterTypeName(const EncodingContext& context,
                                             const google_protobuf_Any* any,
                                             absl::string_view* filter_type) {
   *filter_type = UpbStringToAbsl(google_protobuf_Any_type_url(any));
-  if (*filter_type == "type.googleapis.com/udpa.type.v1.TypedStruct") {
+  if (*filter_type == "type.googleapis.com/xds.type.v3.TypedStruct" ||
+      *filter_type == "type.googleapis.com/udpa.type.v1.TypedStruct") {
     upb_strview any_value = google_protobuf_Any_value(any);
-    const auto* typed_struct = udpa_type_v1_TypedStruct_parse(
+    const auto* typed_struct = xds_type_v3_TypedStruct_parse(
         any_value.data, any_value.size, context.arena);
     if (typed_struct == nullptr) {
       return GRPC_ERROR_CREATE_FROM_STATIC_STRING(
           "could not parse TypedStruct from filter config");
     }
     *filter_type =
-        UpbStringToAbsl(udpa_type_v1_TypedStruct_type_url(typed_struct));
+        UpbStringToAbsl(xds_type_v3_TypedStruct_type_url(typed_struct));
   }
   *filter_type = absl::StripPrefix(*filter_type, "type.googleapis.com/");
   return GRPC_ERROR_NONE;
@@ -1528,9 +1587,9 @@ XdsApi::Duration DurationParse(const google_protobuf_Duration* proto_duration) {
 grpc_error_handle RetryPolicyParse(
     const EncodingContext& context,
     const envoy_config_route_v3_RetryPolicy* retry_policy,
-    absl::optional<XdsApi::Route::RetryPolicy>* retry) {
+    absl::optional<XdsApi::RetryPolicy>* retry) {
   std::vector<grpc_error_handle> errors;
-  XdsApi::Route::RetryPolicy retry_to_return;
+  XdsApi::RetryPolicy retry_to_return;
   auto retry_on = UpbStringToStdString(
       envoy_config_route_v3_RetryPolicy_retry_on(retry_policy));
   std::vector<absl::string_view> codes = absl::StrSplit(retry_on, ',');
@@ -1552,10 +1611,6 @@ grpc_error_handle RetryPolicyParse(
       }
     }
   }
-  // TODO(donnadionne): when we add support for per_try_timeout, we will need to
-  // return a policy if per_try_timeout is set even if retry_on specified no
-  // supported policies.
-  if (retry_to_return.retry_on.Empty()) return GRPC_ERROR_NONE;
   const google_protobuf_UInt32Value* num_retries =
       envoy_config_route_v3_RetryPolicy_num_retries(retry_policy);
   if (num_retries != nullptr) {
@@ -1614,11 +1669,8 @@ grpc_error_handle RetryPolicyParse(
 
 grpc_error_handle RouteActionParse(const EncodingContext& context,
                                    const envoy_config_route_v3_Route* route_msg,
-                                   XdsApi::Route* route, bool* ignore_route) {
-  if (!envoy_config_route_v3_Route_has_route(route_msg)) {
-    return GRPC_ERROR_CREATE_FROM_STATIC_STRING(
-        "No RouteAction found in route.");
-  }
+                                   XdsApi::Route::RouteAction* route,
+                                   bool* ignore_route) {
   const envoy_config_route_v3_RouteAction* route_action =
       envoy_config_route_v3_Route_route(route_msg);
   // Get the cluster or weighted_clusters in the RouteAction.
@@ -1647,7 +1699,7 @@ grpc_error_handle RouteActionParse(const EncodingContext& context,
     for (size_t j = 0; j < clusters_size; ++j) {
       const envoy_config_route_v3_WeightedCluster_ClusterWeight*
           cluster_weight = clusters[j];
-      XdsApi::Route::ClusterWeight cluster;
+      XdsApi::Route::RouteAction::ClusterWeight cluster;
       cluster.name = UpbStringToStdString(
           envoy_config_route_v3_WeightedCluster_ClusterWeight_name(
               cluster_weight));
@@ -1716,7 +1768,7 @@ grpc_error_handle RouteActionParse(const EncodingContext& context,
   for (size_t i = 0; i < size; ++i) {
     const envoy_config_route_v3_RouteAction_HashPolicy* hash_policy =
         hash_policies[i];
-    XdsApi::Route::HashPolicy policy;
+    XdsApi::Route::RouteAction::HashPolicy policy;
     policy.terminal =
         envoy_config_route_v3_RouteAction_HashPolicy_terminal(hash_policy);
     const envoy_config_route_v3_RouteAction_HashPolicy_Header* header;
@@ -1724,7 +1776,7 @@ grpc_error_handle RouteActionParse(const EncodingContext& context,
         filter_state;
     if ((header = envoy_config_route_v3_RouteAction_HashPolicy_header(
              hash_policy)) != nullptr) {
-      policy.type = XdsApi::Route::HashPolicy::Type::HEADER;
+      policy.type = XdsApi::Route::RouteAction::HashPolicy::Type::HEADER;
       policy.header_name = UpbStringToStdString(
           envoy_config_route_v3_RouteAction_HashPolicy_Header_header_name(
               header));
@@ -1768,7 +1820,7 @@ grpc_error_handle RouteActionParse(const EncodingContext& context,
           envoy_config_route_v3_RouteAction_HashPolicy_FilterState_key(
               filter_state));
       if (key == "io.grpc.channel_id") {
-        policy.type = XdsApi::Route::HashPolicy::Type::CHANNEL_ID;
+        policy.type = XdsApi::Route::RouteAction::HashPolicy::Type::CHANNEL_ID;
       } else {
         gpr_log(GPR_DEBUG,
                 "RouteAction HashPolicy contains policy specifier "
@@ -1787,7 +1839,7 @@ grpc_error_handle RouteActionParse(const EncodingContext& context,
   const envoy_config_route_v3_RetryPolicy* retry_policy =
       envoy_config_route_v3_RouteAction_retry_policy(route_action);
   if (retry_policy != nullptr) {
-    absl::optional<XdsApi::Route::RetryPolicy> retry;
+    absl::optional<XdsApi::RetryPolicy> retry;
     grpc_error_handle error = RetryPolicyParse(context, retry_policy, &retry);
     if (error != GRPC_ERROR_NONE) return error;
     route->retry_policy = retry;
@@ -1799,7 +1851,6 @@ grpc_error_handle RouteConfigParse(
     const EncodingContext& context,
     const envoy_config_route_v3_RouteConfiguration* route_config,
     bool /*is_v2*/, XdsApi::RdsUpdate* rds_update) {
-  MaybeLogRouteConfiguration(context, route_config);
   // Get the virtual hosts.
   size_t num_virtual_hosts;
   const envoy_config_route_v3_VirtualHost* const* virtual_hosts =
@@ -1814,8 +1865,7 @@ grpc_error_handle RouteConfigParse(
         virtual_hosts[i], &domain_size);
     for (size_t j = 0; j < domain_size; ++j) {
       std::string domain_pattern = UpbStringToStdString(domains[j]);
-      const MatchType match_type = DomainPatternMatchType(domain_pattern);
-      if (match_type == INVALID_MATCH) {
+      if (!XdsRouting::IsValidDomainPattern(domain_pattern)) {
         return GRPC_ERROR_CREATE_FROM_CPP_STRING(
             absl::StrCat("Invalid domain pattern \"", domain_pattern, "\"."));
       }
@@ -1837,7 +1887,7 @@ grpc_error_handle RouteConfigParse(
       if (error != GRPC_ERROR_NONE) return error;
     }
     // Parse retry policy.
-    absl::optional<XdsApi::Route::RetryPolicy> virtual_host_retry_policy;
+    absl::optional<XdsApi::RetryPolicy> virtual_host_retry_policy;
     const envoy_config_route_v3_RetryPolicy* retry_policy =
         envoy_config_route_v3_VirtualHost_retry_policy(virtual_hosts[i]);
     if (retry_policy != nullptr) {
@@ -1876,11 +1926,21 @@ grpc_error_handle RouteConfigParse(
       if (error != GRPC_ERROR_NONE) return error;
       error = RouteRuntimeFractionParse(match, &route);
       if (error != GRPC_ERROR_NONE) return error;
-      error = RouteActionParse(context, routes[j], &route, &ignore_route);
-      if (error != GRPC_ERROR_NONE) return error;
-      if (ignore_route) continue;
-      if (route.retry_policy == absl::nullopt && retry_policy != nullptr) {
-        route.retry_policy = virtual_host_retry_policy;
+      if (envoy_config_route_v3_Route_has_route(routes[j])) {
+        route.action.emplace<XdsApi::Route::RouteAction>();
+        auto& route_action =
+            absl::get<XdsApi::Route::RouteAction>(route.action);
+        error =
+            RouteActionParse(context, routes[j], &route_action, &ignore_route);
+        if (error != GRPC_ERROR_NONE) return error;
+        if (ignore_route) continue;
+        if (route_action.retry_policy == absl::nullopt &&
+            retry_policy != nullptr) {
+          route_action.retry_policy = virtual_host_retry_policy;
+        }
+      } else if (envoy_config_route_v3_Route_has_non_forwarding_action(
+                     routes[j])) {
+        route.action.emplace<XdsApi::Route::NonForwardingAction>();
       }
       if (context.use_v3) {
         grpc_error_handle error = ParseTypedPerFilterConfig<
@@ -2237,32 +2297,47 @@ grpc_error_handle HttpConnectionManagerParse(
             absl::StrFormat("Filter %s is not supported on %s", filter_type,
                             is_client ? "clients" : "servers"));
       }
-      if (i < num_filters - 1) {
+      absl::StatusOr<XdsHttpFilterImpl::FilterConfig> filter_config =
+          filter_impl->GenerateFilterConfig(google_protobuf_Any_value(any),
+                                            context.arena);
+      if (!filter_config.ok()) {
+        return GRPC_ERROR_CREATE_FROM_CPP_STRING(absl::StrCat(
+            "filter config for type ", filter_type,
+            " failed to parse: ", filter_config.status().ToString()));
+      }
+      http_connection_manager->http_filters.emplace_back(
+          XdsApi::LdsUpdate::HttpConnectionManager::HttpFilter{
+              std::string(name), std::move(*filter_config)});
+    }
+    if (http_connection_manager->http_filters.empty()) {
+      return GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+          "Expected at least one HTTP filter");
+    }
+    // Make sure that the last filter is terminal and non-last filters are
+    // non-terminal. Note that this check is being performed in a separate loop
+    // to take care of the case where there are two terminal filters in the list
+    // out of which only one gets added in the final list.
+    for (const auto& http_filter : http_connection_manager->http_filters) {
+      const XdsHttpFilterImpl* filter_impl =
+          XdsHttpFilterRegistry::GetFilterForType(
+              http_filter.config.config_proto_type_name);
+      if (&http_filter != &http_connection_manager->http_filters.back()) {
         // Filters before the last filter must not be terminal.
         if (filter_impl->IsTerminalFilter()) {
           return GRPC_ERROR_CREATE_FROM_CPP_STRING(
-              absl::StrCat("terminal filter for config type ", filter_type,
+              absl::StrCat("terminal filter for config type ",
+                           http_filter.config.config_proto_type_name,
                            " must be the last filter in the chain"));
         }
       } else {
         // The last filter must be terminal.
         if (!filter_impl->IsTerminalFilter()) {
           return GRPC_ERROR_CREATE_FROM_CPP_STRING(
-              absl::StrCat("non-terminal filter for config type ", filter_type,
+              absl::StrCat("non-terminal filter for config type ",
+                           http_filter.config.config_proto_type_name,
                            " is the last filter in the chain"));
         }
       }
-      absl::StatusOr<XdsHttpFilterImpl::FilterConfig> filter_config =
-          filter_impl->GenerateFilterConfig(google_protobuf_Any_value(any),
-                                            context.arena);
-      if (!filter_config.ok()) {
-        return GRPC_ERROR_CREATE_FROM_CPP_STRING(absl::StrCat(
-            "filter config for type ", filter_type,
-            " failed to parse: ", filter_config.status().ToString()));
-      }
-      http_connection_manager->http_filters.emplace_back(
-          XdsApi::LdsUpdate::HttpConnectionManager::HttpFilter{
-              std::string(name), std::move(*filter_config)});
     }
   } else {
     // If using a v2 config, we just hard-code a list containing only the
@@ -2273,7 +2348,10 @@ grpc_error_handle HttpConnectionManagerParse(
         XdsApi::LdsUpdate::HttpConnectionManager::HttpFilter{
             "router", {kXdsHttpRouterFilterConfigName, Json()}});
   }
-  if (is_client) {
+  // Guarding parsing of RouteConfig on the server side with the environmental
+  // variable since that's the first feature on the server side that will be
+  // using this.
+  if (is_client || XdsRbacEnabled()) {
     // Found inlined route_config. Parse it to find the cluster_name.
     if (envoy_extensions_filters_network_http_connection_manager_v3_HttpConnectionManager_has_route_config(
             http_connection_manager_proto)) {
@@ -2508,6 +2586,8 @@ grpc_error_handle FilterChainParse(
         filter_chain_match, &filter_chain->filter_chain_match);
     if (error != GRPC_ERROR_NONE) errors.push_back(error);
   }
+  filter_chain->filter_chain_data =
+      std::make_shared<XdsApi::LdsUpdate::FilterChainData>();
   // Parse the filters list. Currently we only support HttpConnectionManager.
   size_t size = 0;
   auto* filters =
@@ -2543,8 +2623,6 @@ grpc_error_handle FilterChainParse(
               "Could not parse HttpConnectionManager config from filter "
               "typed_config"));
         } else {
-          filter_chain->filter_chain_data =
-              std::make_shared<XdsApi::LdsUpdate::FilterChainData>();
           grpc_error_handle error = HttpConnectionManagerParse(
               false /* is_client */, context, http_connection_manager, is_v2,
               &filter_chain->filter_chain_data->http_connection_manager);
@@ -3277,7 +3355,7 @@ grpc_error_handle DropParseAndAppend(
       return GRPC_ERROR_CREATE_FROM_STATIC_STRING("Unknown denominator type");
   }
   // Cap numerator to 1000000.
-  numerator = GPR_MIN(numerator, 1000000);
+  numerator = std::min(numerator, 1000000u);
   drop_config->AddCategory(std::move(category), numerator);
   return GRPC_ERROR_NONE;
 }
@@ -3342,123 +3420,257 @@ grpc_error_handle EdsResourceParse(
   return GRPC_ERROR_CREATE_FROM_VECTOR("errors parsing EDS resource", &errors);
 }
 
-template <typename ProtoParseFunction, typename ProtoResourceNameFunction,
-          typename ResourceTypeSelectorFunction, typename ProtoLogFunction,
-          typename ResourceParseFunction, typename UpdateMap>
-grpc_error_handle AdsResponseParse(
-    const EncodingContext& context, ProtoParseFunction proto_parse_function,
-    ProtoResourceNameFunction proto_resource_name_function,
-    ResourceTypeSelectorFunction resource_type_selector_function,
-    ProtoLogFunction proto_log_function,
-    ResourceParseFunction resource_parse_function,
-    const envoy_service_discovery_v3_DiscoveryResponse* response,
-    const char* resource_type_string,
-    const std::set<absl::string_view>& expected_resource_names,
-    UpdateMap* update_map, std::set<std::string>* resource_names_failed) {
-  std::vector<grpc_error_handle> errors;
-  // Get the resources from the response.
-  size_t size;
-  const google_protobuf_Any* const* resources =
-      envoy_service_discovery_v3_DiscoveryResponse_resources(response, &size);
-  for (size_t i = 0; i < size; ++i) {
-    // Check the type_url of the resource.
-    absl::string_view type_url =
-        UpbStringToAbsl(google_protobuf_Any_type_url(resources[i]));
-    bool is_v2 = false;
-    if (!resource_type_selector_function(type_url, &is_v2)) {
-      errors.push_back(GRPC_ERROR_CREATE_FROM_CPP_STRING(
-          absl::StrCat("resource index ", i, ": Resource is not ",
-                       resource_type_string, ".")));
-      continue;
+class ListenerResourceType : public XdsResourceType {
+ public:
+  struct ListenerData : public ResourceData {
+    XdsApi::LdsUpdate resource;
+  };
+
+  absl::string_view type_url() const override { return XdsApi::kLdsTypeUrl; }
+  absl::string_view v2_type_url() const override { return kLdsV2TypeUrl; }
+
+  absl::StatusOr<DecodeResult> Decode(const EncodingContext& context,
+                                      absl::string_view serialized_resource,
+                                      bool is_v2) const override {
+    // Parse serialized proto.
+    auto* resource = envoy_config_listener_v3_Listener_parse(
+        serialized_resource.data(), serialized_resource.size(), context.arena);
+    if (resource == nullptr) {
+      return absl::InvalidArgumentError("Can't parse Listener resource.");
+    }
+    MaybeLogListener(context, resource);
+    // Validate resource.
+    DecodeResult result;
+    result.name =
+        UpbStringToStdString(envoy_config_listener_v3_Listener_name(resource));
+    auto listener_data = absl::make_unique<ListenerData>();
+    grpc_error_handle error =
+        LdsResourceParse(context, resource, is_v2, &listener_data->resource);
+    if (error != GRPC_ERROR_NONE) {
+      result.resource =
+          absl::InvalidArgumentError(grpc_error_std_string(error));
+      GRPC_ERROR_UNREF(error);
+    } else {
+      result.resource = std::move(listener_data);
     }
-    // Parse the resource.
-    upb_strview serialized_resource = google_protobuf_Any_value(resources[i]);
-    auto* resource = proto_parse_function(
-        serialized_resource.data, serialized_resource.size, context.arena);
+    return std::move(result);
+  }
+};
+
+class RouteConfigResourceType : public XdsResourceType {
+ public:
+  struct RouteConfigData : public ResourceData {
+    XdsApi::RdsUpdate resource;
+  };
+
+  absl::string_view type_url() const override { return XdsApi::kRdsTypeUrl; }
+  absl::string_view v2_type_url() const override { return kRdsV2TypeUrl; }
+
+  absl::StatusOr<DecodeResult> Decode(const EncodingContext& context,
+                                      absl::string_view serialized_resource,
+                                      bool is_v2) const override {
+    // Parse serialized proto.
+    auto* resource = envoy_config_route_v3_RouteConfiguration_parse(
+        serialized_resource.data(), serialized_resource.size(), context.arena);
     if (resource == nullptr) {
-      errors.push_back(GRPC_ERROR_CREATE_FROM_CPP_STRING(
-          absl::StrCat("resource index ", i, ": Can't parse ",
-                       resource_type_string, " resource.")));
-      continue;
+      return absl::InvalidArgumentError("Can't parse Listener resource.");
     }
-    proto_log_function(context, resource);
-    // Check the resource name.  Ignore unexpected names.
-    std::string resource_name =
-        UpbStringToStdString(proto_resource_name_function(resource));
-    if (expected_resource_names.find(resource_name) ==
-        expected_resource_names.end()) {
-      continue;
+    MaybeLogRouteConfiguration(context, resource);
+    // Validate resource.
+    DecodeResult result;
+    result.name = UpbStringToStdString(
+        envoy_config_route_v3_RouteConfiguration_name(resource));
+    auto route_config_data = absl::make_unique<RouteConfigData>();
+    grpc_error_handle error = RouteConfigParse(context, resource, is_v2,
+                                               &route_config_data->resource);
+    if (error != GRPC_ERROR_NONE) {
+      result.resource =
+          absl::InvalidArgumentError(grpc_error_std_string(error));
+      GRPC_ERROR_UNREF(error);
+    } else {
+      result.resource = std::move(route_config_data);
     }
-    // Fail on duplicate resources.
-    if (update_map->find(resource_name) != update_map->end()) {
-      errors.push_back(GRPC_ERROR_CREATE_FROM_CPP_STRING(
-          absl::StrCat("duplicate resource name \"", resource_name, "\"")));
-      resource_names_failed->insert(resource_name);
-      continue;
+    return std::move(result);
+  }
+};
+
+class ClusterResourceType : public XdsResourceType {
+ public:
+  struct ClusterData : public ResourceData {
+    XdsApi::CdsUpdate resource;
+  };
+
+  absl::string_view type_url() const override { return XdsApi::kCdsTypeUrl; }
+  absl::string_view v2_type_url() const override { return kCdsV2TypeUrl; }
+
+  absl::StatusOr<DecodeResult> Decode(const EncodingContext& context,
+                                      absl::string_view serialized_resource,
+                                      bool is_v2) const override {
+    // Parse serialized proto.
+    auto* resource = envoy_config_cluster_v3_Cluster_parse(
+        serialized_resource.data(), serialized_resource.size(), context.arena);
+    if (resource == nullptr) {
+      return absl::InvalidArgumentError("Can't parse Listener resource.");
     }
+    MaybeLogCluster(context, resource);
     // Validate resource.
-    decltype(UpdateMap::mapped_type::resource) update;
+    DecodeResult result;
+    result.name =
+        UpbStringToStdString(envoy_config_cluster_v3_Cluster_name(resource));
+    auto cluster_data = absl::make_unique<ClusterData>();
     grpc_error_handle error =
-        resource_parse_function(context, resource, is_v2, &update);
+        CdsResourceParse(context, resource, is_v2, &cluster_data->resource);
     if (error != GRPC_ERROR_NONE) {
-      errors.push_back(
-          grpc_error_add_child(GRPC_ERROR_CREATE_FROM_CPP_STRING(absl::StrCat(
-                                   resource_name, ": validation error")),
-                               error));
-      resource_names_failed->insert(resource_name);
+      result.resource =
+          absl::InvalidArgumentError(grpc_error_std_string(error));
+      GRPC_ERROR_UNREF(error);
     } else {
-      // Store result in update map, in both validated and serialized form.
-      auto& resource_data = (*update_map)[resource_name];
-      resource_data.resource = std::move(update);
-      resource_data.serialized_proto =
-          UpbStringToStdString(serialized_resource);
+      result.resource = std::move(cluster_data);
     }
+    return std::move(result);
   }
-  return GRPC_ERROR_CREATE_FROM_VECTOR("errors parsing ADS response", &errors);
-}
+};
 
-std::string TypeUrlInternalToExternal(absl::string_view type_url) {
-  if (type_url == kLdsV2TypeUrl) {
-    return XdsApi::kLdsTypeUrl;
-  } else if (type_url == kRdsV2TypeUrl) {
-    return XdsApi::kRdsTypeUrl;
-  } else if (type_url == kCdsV2TypeUrl) {
-    return XdsApi::kCdsTypeUrl;
-  } else if (type_url == kEdsV2TypeUrl) {
-    return XdsApi::kEdsTypeUrl;
-  }
-  return std::string(type_url);
-}
+class EndpointResourceType : public XdsResourceType {
+ public:
+  struct EndpointData : public ResourceData {
+    XdsApi::EdsUpdate resource;
+  };
 
-upb_strview LdsResourceName(
-    const envoy_config_listener_v3_Listener* lds_resource) {
-  return envoy_config_listener_v3_Listener_name(lds_resource);
-}
+  absl::string_view type_url() const override { return XdsApi::kEdsTypeUrl; }
+  absl::string_view v2_type_url() const override { return kEdsV2TypeUrl; }
 
-upb_strview RdsResourceName(
-    const envoy_config_route_v3_RouteConfiguration* rds_resource) {
-  return envoy_config_route_v3_RouteConfiguration_name(rds_resource);
-}
+  absl::StatusOr<DecodeResult> Decode(const EncodingContext& context,
+                                      absl::string_view serialized_resource,
+                                      bool is_v2) const override {
+    // Parse serialized proto.
+    auto* resource = envoy_config_endpoint_v3_ClusterLoadAssignment_parse(
+        serialized_resource.data(), serialized_resource.size(), context.arena);
+    if (resource == nullptr) {
+      return absl::InvalidArgumentError("Can't parse Listener resource.");
+    }
+    MaybeLogClusterLoadAssignment(context, resource);
+    // Validate resource.
+    DecodeResult result;
+    result.name = UpbStringToStdString(
+        envoy_config_endpoint_v3_ClusterLoadAssignment_cluster_name(resource));
+    auto endpoint_data = absl::make_unique<EndpointData>();
+    grpc_error_handle error =
+        EdsResourceParse(context, resource, is_v2, &endpoint_data->resource);
+    if (error != GRPC_ERROR_NONE) {
+      result.resource =
+          absl::InvalidArgumentError(grpc_error_std_string(error));
+      GRPC_ERROR_UNREF(error);
+    } else {
+      result.resource = std::move(endpoint_data);
+    }
+    return std::move(result);
+  }
+};
 
-upb_strview CdsResourceName(
-    const envoy_config_cluster_v3_Cluster* cds_resource) {
-  return envoy_config_cluster_v3_Cluster_name(cds_resource);
+grpc_error_handle AdsResourceParse(
+    const EncodingContext& context, XdsResourceType* type, size_t idx,
+    const google_protobuf_Any* resource_any,
+    const std::map<absl::string_view /*authority*/,
+                   std::set<absl::string_view /*name*/>>&
+        subscribed_resource_names,
+    std::function<grpc_error_handle(
+        absl::string_view, XdsApi::ResourceName,
+        std::unique_ptr<XdsResourceType::ResourceData>, std::string)>
+        add_result_func,
+    std::set<XdsApi::ResourceName>* resource_names_failed) {
+  // Check the type_url of the resource.
+  absl::string_view type_url = absl::StripPrefix(
+      UpbStringToAbsl(google_protobuf_Any_type_url(resource_any)),
+      "type.googleapis.com/");
+  bool is_v2 = false;
+  if (!type->IsType(type_url, &is_v2)) {
+    return GRPC_ERROR_CREATE_FROM_CPP_STRING(
+        absl::StrCat("resource index ", idx, ": found resource type ", type_url,
+                     " in response for type ", type->type_url()));
+  }
+  // Parse the resource.
+  absl::string_view serialized_resource =
+      UpbStringToAbsl(google_protobuf_Any_value(resource_any));
+  absl::StatusOr<XdsResourceType::DecodeResult> result =
+      type->Decode(context, serialized_resource, is_v2);
+  if (!result.ok()) {
+    return GRPC_ERROR_CREATE_FROM_CPP_STRING(
+        absl::StrCat("resource index ", idx, ": ", result.status().ToString()));
+  }
+  // Check the resource name.
+  auto resource_name = ParseResourceNameInternal(
+      result->name, [type](absl::string_view type_url, bool* is_v2) {
+        return type->IsType(type_url, is_v2);
+      });
+  if (!resource_name.ok()) {
+    return GRPC_ERROR_CREATE_FROM_CPP_STRING(absl::StrCat(
+        "resource index ", idx, ": Cannot parse xDS resource name \"",
+        result->name, "\""));
+  }
+  // Ignore unexpected names.
+  auto iter = subscribed_resource_names.find(resource_name->authority);
+  if (iter == subscribed_resource_names.end() ||
+      iter->second.find(resource_name->id) == iter->second.end()) {
+    return GRPC_ERROR_NONE;
+  }
+  // Check that resource was valid.
+  if (!result->resource.ok()) {
+    resource_names_failed->insert(*resource_name);
+    return GRPC_ERROR_CREATE_FROM_CPP_STRING(absl::StrCat(
+        "resource index ", idx, ": ", result->name,
+        ": validation error: ", result->resource.status().ToString()));
+  }
+  // Add result.
+  grpc_error_handle error = add_result_func(result->name, *resource_name,
+                                            std::move(*result->resource),
+                                            std::string(serialized_resource));
+  if (error != GRPC_ERROR_NONE) {
+    resource_names_failed->insert(*resource_name);
+    return grpc_error_add_child(
+        GRPC_ERROR_CREATE_FROM_CPP_STRING(absl::StrCat(
+            "resource index ", idx, ": ", result->name, ": validation error")),
+        error);
+  }
+  return GRPC_ERROR_NONE;
 }
 
-upb_strview EdsResourceName(
-    const envoy_config_endpoint_v3_ClusterLoadAssignment* eds_resource) {
-  return envoy_config_endpoint_v3_ClusterLoadAssignment_cluster_name(
-      eds_resource);
+template <typename UpdateMap, typename ResourceTypeData>
+grpc_error_handle AddResult(
+    UpdateMap* update_map, absl::string_view resource_name_string,
+    XdsApi::ResourceName resource_name,
+    std::unique_ptr<XdsResourceType::ResourceData> resource,
+    std::string serialized_resource) {
+  // Reject duplicate names.
+  if (update_map->find(resource_name) != update_map->end()) {
+    return GRPC_ERROR_CREATE_FROM_CPP_STRING(
+        absl::StrCat("duplicate resource name \"", resource_name_string, "\""));
+  }
+  // Save result.
+  auto& resource_data = (*update_map)[resource_name];
+  ResourceTypeData* typed_resource =
+      static_cast<ResourceTypeData*>(resource.get());
+  resource_data.resource = std::move(typed_resource->resource);
+  resource_data.serialized_proto = std::move(serialized_resource);
+  return GRPC_ERROR_NONE;
 }
 
 }  // namespace
 
 XdsApi::AdsParseResult XdsApi::ParseAdsResponse(
     const XdsBootstrap::XdsServer& server, const grpc_slice& encoded_response,
-    const std::set<absl::string_view>& expected_listener_names,
-    const std::set<absl::string_view>& expected_route_configuration_names,
-    const std::set<absl::string_view>& expected_cluster_names,
-    const std::set<absl::string_view>& expected_eds_service_names) {
+    const std::map<absl::string_view /*authority*/,
+                   std::set<absl::string_view /*name*/>>&
+        subscribed_listener_names,
+    const std::map<absl::string_view /*authority*/,
+                   std::set<absl::string_view /*name*/>>&
+        subscribed_route_config_names,
+    const std::map<absl::string_view /*authority*/,
+                   std::set<absl::string_view /*name*/>>&
+        subscribed_cluster_names,
+    const std::map<absl::string_view /*authority*/,
+                   std::set<absl::string_view /*name*/>>&
+        subscribed_eds_service_names) {
   AdsParseResult result;
   upb::Arena arena;
   const EncodingContext context = {client_,
@@ -3480,41 +3692,88 @@ XdsApi::AdsParseResult XdsApi::ParseAdsResponse(
   }
   MaybeLogDiscoveryResponse(context, response);
   // Record the type_url, the version_info, and the nonce of the response.
-  result.type_url = TypeUrlInternalToExternal(UpbStringToAbsl(
-      envoy_service_discovery_v3_DiscoveryResponse_type_url(response)));
+  result.type_url = TypeUrlInternalToExternal(absl::StripPrefix(
+      UpbStringToAbsl(
+          envoy_service_discovery_v3_DiscoveryResponse_type_url(response)),
+      "type.googleapis.com/"));
   result.version = UpbStringToStdString(
       envoy_service_discovery_v3_DiscoveryResponse_version_info(response));
   result.nonce = UpbStringToStdString(
       envoy_service_discovery_v3_DiscoveryResponse_nonce(response));
-  // Parse the response according to the resource type.
-  // TODO(roth): When we have time, consider defining an interface for the
-  // methods of each resource type, so that we don't have to pass
-  // individual functions into each call to AdsResponseParse().
-  if (IsLds(result.type_url)) {
-    result.parse_error = AdsResponseParse(
-        context, envoy_config_listener_v3_Listener_parse, LdsResourceName,
-        IsLds, MaybeLogListener, LdsResourceParse, response, "LDS",
-        expected_listener_names, &result.lds_update_map,
-        &result.resource_names_failed);
-  } else if (IsRds(result.type_url)) {
-    result.parse_error = AdsResponseParse(
-        context, envoy_config_route_v3_RouteConfiguration_parse,
-        RdsResourceName, IsRds, MaybeLogRouteConfiguration, RouteConfigParse,
-        response, "RDS", expected_route_configuration_names,
-        &result.rds_update_map, &result.resource_names_failed);
-  } else if (IsCds(result.type_url)) {
-    result.parse_error = AdsResponseParse(
-        context, envoy_config_cluster_v3_Cluster_parse, CdsResourceName, IsCds,
-        MaybeLogCluster, CdsResourceParse, response, "CDS",
-        expected_cluster_names, &result.cds_update_map,
-        &result.resource_names_failed);
-  } else if (IsEds(result.type_url)) {
-    result.parse_error = AdsResponseParse(
-        context, envoy_config_endpoint_v3_ClusterLoadAssignment_parse,
-        EdsResourceName, IsEds, MaybeLogClusterLoadAssignment, EdsResourceParse,
-        response, "EDS", expected_eds_service_names, &result.eds_update_map,
-        &result.resource_names_failed);
-  }
+  // Get the resources from the response.
+  std::vector<grpc_error_handle> errors;
+  size_t size;
+  const google_protobuf_Any* const* resources =
+      envoy_service_discovery_v3_DiscoveryResponse_resources(response, &size);
+  for (size_t i = 0; i < size; ++i) {
+    // Parse the response according to the resource type.
+    // TODO(roth): When we have time, change the API here to avoid the need
+    // for templating and conditionals.
+    grpc_error_handle parse_error = GRPC_ERROR_NONE;
+    if (IsLds(result.type_url)) {
+      ListenerResourceType resource_type;
+      auto& update_map = result.lds_update_map;
+      parse_error = AdsResourceParse(
+          context, &resource_type, i, resources[i], subscribed_listener_names,
+          [&update_map](absl::string_view resource_name_string,
+                        XdsApi::ResourceName resource_name,
+                        std::unique_ptr<XdsResourceType::ResourceData> resource,
+                        std::string serialized_resource) {
+            return AddResult<LdsUpdateMap, ListenerResourceType::ListenerData>(
+                &update_map, resource_name_string, std::move(resource_name),
+                std::move(resource), std::move(serialized_resource));
+          },
+          &result.resource_names_failed);
+    } else if (IsRds(result.type_url)) {
+      RouteConfigResourceType resource_type;
+      auto& update_map = result.rds_update_map;
+      parse_error = AdsResourceParse(
+          context, &resource_type, i, resources[i],
+          subscribed_route_config_names,
+          [&update_map](absl::string_view resource_name_string,
+                        XdsApi::ResourceName resource_name,
+                        std::unique_ptr<XdsResourceType::ResourceData> resource,
+                        std::string serialized_resource) {
+            return AddResult<RdsUpdateMap,
+                             RouteConfigResourceType::RouteConfigData>(
+                &update_map, resource_name_string, std::move(resource_name),
+                std::move(resource), std::move(serialized_resource));
+          },
+          &result.resource_names_failed);
+    } else if (IsCds(result.type_url)) {
+      ClusterResourceType resource_type;
+      auto& update_map = result.cds_update_map;
+      parse_error = AdsResourceParse(
+          context, &resource_type, i, resources[i], subscribed_cluster_names,
+          [&update_map](absl::string_view resource_name_string,
+                        XdsApi::ResourceName resource_name,
+                        std::unique_ptr<XdsResourceType::ResourceData> resource,
+                        std::string serialized_resource) {
+            return AddResult<CdsUpdateMap, ClusterResourceType::ClusterData>(
+                &update_map, resource_name_string, std::move(resource_name),
+                std::move(resource), std::move(serialized_resource));
+          },
+          &result.resource_names_failed);
+    } else if (IsEds(result.type_url)) {
+      EndpointResourceType resource_type;
+      auto& update_map = result.eds_update_map;
+      parse_error = AdsResourceParse(
+          context, &resource_type, i, resources[i],
+          subscribed_eds_service_names,
+          [&update_map](absl::string_view resource_name_string,
+                        XdsApi::ResourceName resource_name,
+                        std::unique_ptr<XdsResourceType::ResourceData> resource,
+                        std::string serialized_resource) {
+            return AddResult<EdsUpdateMap, EndpointResourceType::EndpointData>(
+                &update_map, resource_name_string, std::move(resource_name),
+                std::move(resource), std::move(serialized_resource));
+          },
+          &result.resource_names_failed);
+    }
+    if (parse_error != GRPC_ERROR_NONE) errors.push_back(parse_error);
+  }
+  result.parse_error =
+      GRPC_ERROR_CREATE_FROM_VECTOR("errors parsing ADS response", &errors);
   return result;
 }
 
@@ -3726,6 +3985,7 @@ grpc_error_handle XdsApi::ParseLrsResponse(
 }
 
 namespace {
+
 google_protobuf_Timestamp* GrpcMillisToTimestamp(const EncodingContext& context,
                                                  grpc_millis value) {
   google_protobuf_Timestamp* timestamp =
@@ -3736,218 +3996,6 @@ google_protobuf_Timestamp* GrpcMillisToTimestamp(const EncodingContext& context,
   return timestamp;
 }
 
-envoy_admin_v3_UpdateFailureState* CreateUpdateFailureStateUpb(
-    const EncodingContext& context,
-    const XdsApi::ResourceMetadata* resource_metadata) {
-  auto* update_failure_state =
-      envoy_admin_v3_UpdateFailureState_new(context.arena);
-  envoy_admin_v3_UpdateFailureState_set_details(
-      update_failure_state,
-      StdStringToUpbString(resource_metadata->failed_details));
-  envoy_admin_v3_UpdateFailureState_set_version_info(
-      update_failure_state,
-      StdStringToUpbString(resource_metadata->failed_version));
-  envoy_admin_v3_UpdateFailureState_set_last_update_attempt(
-      update_failure_state,
-      GrpcMillisToTimestamp(context, resource_metadata->failed_update_time));
-  return update_failure_state;
-}
-
-void DumpLdsConfig(const EncodingContext& context,
-                   const XdsApi::ResourceTypeMetadata& resource_type_metadata,
-                   envoy_service_status_v3_PerXdsConfig* per_xds_config) {
-  upb_strview kLdsTypeUrlUpb = upb_strview_makez(XdsApi::kLdsTypeUrl);
-  auto* listener_config_dump =
-      envoy_service_status_v3_PerXdsConfig_mutable_listener_config(
-          per_xds_config, context.arena);
-  envoy_admin_v3_ListenersConfigDump_set_version_info(
-      listener_config_dump,
-      StdStringToUpbString(resource_type_metadata.version));
-  for (auto& p : resource_type_metadata.resource_metadata_map) {
-    absl::string_view name = p.first;
-    const XdsApi::ResourceMetadata* meta = p.second;
-    const upb_strview name_upb = StdStringToUpbString(name);
-    auto* dynamic_listener =
-        envoy_admin_v3_ListenersConfigDump_add_dynamic_listeners(
-            listener_config_dump, context.arena);
-    envoy_admin_v3_ListenersConfigDump_DynamicListener_set_name(
-        dynamic_listener, name_upb);
-    envoy_admin_v3_ListenersConfigDump_DynamicListener_set_client_status(
-        dynamic_listener, meta->client_status);
-    if (!meta->serialized_proto.empty()) {
-      // Set in-effective listeners
-      auto* dynamic_listener_state =
-          envoy_admin_v3_ListenersConfigDump_DynamicListener_mutable_active_state(
-              dynamic_listener, context.arena);
-      envoy_admin_v3_ListenersConfigDump_DynamicListenerState_set_version_info(
-          dynamic_listener_state, StdStringToUpbString(meta->version));
-      envoy_admin_v3_ListenersConfigDump_DynamicListenerState_set_last_updated(
-          dynamic_listener_state,
-          GrpcMillisToTimestamp(context, meta->update_time));
-      auto* listener_any =
-          envoy_admin_v3_ListenersConfigDump_DynamicListenerState_mutable_listener(
-              dynamic_listener_state, context.arena);
-      google_protobuf_Any_set_type_url(listener_any, kLdsTypeUrlUpb);
-      google_protobuf_Any_set_value(
-          listener_any, StdStringToUpbString(meta->serialized_proto));
-    }
-    if (meta->client_status == XdsApi::ResourceMetadata::NACKED) {
-      // Set error_state if NACKED
-      envoy_admin_v3_ListenersConfigDump_DynamicListener_set_error_state(
-          dynamic_listener, CreateUpdateFailureStateUpb(context, meta));
-    }
-  }
-}
-
-void DumpRdsConfig(const EncodingContext& context,
-                   const XdsApi::ResourceTypeMetadata& resource_type_metadata,
-                   envoy_service_status_v3_PerXdsConfig* per_xds_config) {
-  upb_strview kRdsTypeUrlUpb = upb_strview_makez(XdsApi::kRdsTypeUrl);
-  auto* route_config_dump =
-      envoy_service_status_v3_PerXdsConfig_mutable_route_config(per_xds_config,
-                                                                context.arena);
-  for (auto& p : resource_type_metadata.resource_metadata_map) {
-    absl::string_view name = p.first;
-    const XdsApi::ResourceMetadata* meta = p.second;
-    const upb_strview name_upb = StdStringToUpbString(name);
-    auto* dynamic_route_config =
-        envoy_admin_v3_RoutesConfigDump_add_dynamic_route_configs(
-            route_config_dump, context.arena);
-    envoy_admin_v3_RoutesConfigDump_DynamicRouteConfig_set_client_status(
-        dynamic_route_config, meta->client_status);
-    auto* route_config_any =
-        envoy_admin_v3_RoutesConfigDump_DynamicRouteConfig_mutable_route_config(
-            dynamic_route_config, context.arena);
-    if (!meta->serialized_proto.empty()) {
-      // Set in-effective route configs
-      envoy_admin_v3_RoutesConfigDump_DynamicRouteConfig_set_version_info(
-          dynamic_route_config, StdStringToUpbString(meta->version));
-      envoy_admin_v3_RoutesConfigDump_DynamicRouteConfig_set_last_updated(
-          dynamic_route_config,
-          GrpcMillisToTimestamp(context, meta->update_time));
-      google_protobuf_Any_set_type_url(route_config_any, kRdsTypeUrlUpb);
-      google_protobuf_Any_set_value(
-          route_config_any, StdStringToUpbString(meta->serialized_proto));
-    } else {
-      // If there isn't a working route config, we still need to print the
-      // name.
-      auto* route_config =
-          envoy_config_route_v3_RouteConfiguration_new(context.arena);
-      envoy_config_route_v3_RouteConfiguration_set_name(route_config, name_upb);
-      size_t length;
-      char* bytes = envoy_config_route_v3_RouteConfiguration_serialize(
-          route_config, context.arena, &length);
-      google_protobuf_Any_set_type_url(route_config_any, kRdsTypeUrlUpb);
-      google_protobuf_Any_set_value(route_config_any,
-                                    upb_strview_make(bytes, length));
-    }
-    if (meta->client_status == XdsApi::ResourceMetadata::NACKED) {
-      // Set error_state if NACKED
-      envoy_admin_v3_RoutesConfigDump_DynamicRouteConfig_set_error_state(
-          dynamic_route_config, CreateUpdateFailureStateUpb(context, meta));
-    }
-  }
-}
-
-void DumpCdsConfig(const EncodingContext& context,
-                   const XdsApi::ResourceTypeMetadata& resource_type_metadata,
-                   envoy_service_status_v3_PerXdsConfig* per_xds_config) {
-  upb_strview kCdsTypeUrlUpb = upb_strview_makez(XdsApi::kCdsTypeUrl);
-  auto* cluster_config_dump =
-      envoy_service_status_v3_PerXdsConfig_mutable_cluster_config(
-          per_xds_config, context.arena);
-  envoy_admin_v3_ClustersConfigDump_set_version_info(
-      cluster_config_dump,
-      StdStringToUpbString(resource_type_metadata.version));
-  for (auto& p : resource_type_metadata.resource_metadata_map) {
-    absl::string_view name = p.first;
-    const XdsApi::ResourceMetadata* meta = p.second;
-    const upb_strview name_upb = StdStringToUpbString(name);
-    auto* dynamic_cluster =
-        envoy_admin_v3_ClustersConfigDump_add_dynamic_active_clusters(
-            cluster_config_dump, context.arena);
-    envoy_admin_v3_ClustersConfigDump_DynamicCluster_set_client_status(
-        dynamic_cluster, meta->client_status);
-    auto* cluster_any =
-        envoy_admin_v3_ClustersConfigDump_DynamicCluster_mutable_cluster(
-            dynamic_cluster, context.arena);
-    if (!meta->serialized_proto.empty()) {
-      // Set in-effective clusters
-      envoy_admin_v3_ClustersConfigDump_DynamicCluster_set_version_info(
-          dynamic_cluster, StdStringToUpbString(meta->version));
-      envoy_admin_v3_ClustersConfigDump_DynamicCluster_set_last_updated(
-          dynamic_cluster, GrpcMillisToTimestamp(context, meta->update_time));
-      google_protobuf_Any_set_type_url(cluster_any, kCdsTypeUrlUpb);
-      google_protobuf_Any_set_value(
-          cluster_any, StdStringToUpbString(meta->serialized_proto));
-    } else {
-      // If there isn't a working cluster, we still need to print the name.
-      auto* cluster = envoy_config_cluster_v3_Cluster_new(context.arena);
-      envoy_config_cluster_v3_Cluster_set_name(cluster, name_upb);
-      size_t length;
-      char* bytes = envoy_config_cluster_v3_Cluster_serialize(
-          cluster, context.arena, &length);
-      google_protobuf_Any_set_type_url(cluster_any, kCdsTypeUrlUpb);
-      google_protobuf_Any_set_value(cluster_any,
-                                    upb_strview_make(bytes, length));
-    }
-    if (meta->client_status == XdsApi::ResourceMetadata::NACKED) {
-      // Set error_state if NACKED
-      envoy_admin_v3_ClustersConfigDump_DynamicCluster_set_error_state(
-          dynamic_cluster, CreateUpdateFailureStateUpb(context, meta));
-    }
-  }
-}
-
-void DumpEdsConfig(const EncodingContext& context,
-                   const XdsApi::ResourceTypeMetadata& resource_type_metadata,
-                   envoy_service_status_v3_PerXdsConfig* per_xds_config) {
-  upb_strview kEdsTypeUrlUpb = upb_strview_makez(XdsApi::kEdsTypeUrl);
-  auto* endpoint_config_dump =
-      envoy_service_status_v3_PerXdsConfig_mutable_endpoint_config(
-          per_xds_config, context.arena);
-  for (auto& p : resource_type_metadata.resource_metadata_map) {
-    absl::string_view name = p.first;
-    const XdsApi::ResourceMetadata* meta = p.second;
-    const upb_strview name_upb = StdStringToUpbString(name);
-    auto* dynamic_endpoint =
-        envoy_admin_v3_EndpointsConfigDump_add_dynamic_endpoint_configs(
-            endpoint_config_dump, context.arena);
-    envoy_admin_v3_EndpointsConfigDump_DynamicEndpointConfig_set_client_status(
-        dynamic_endpoint, meta->client_status);
-    auto* endpoint_any =
-        envoy_admin_v3_EndpointsConfigDump_DynamicEndpointConfig_mutable_endpoint_config(
-            dynamic_endpoint, context.arena);
-    if (!meta->serialized_proto.empty()) {
-      // Set in-effective endpoints
-      envoy_admin_v3_EndpointsConfigDump_DynamicEndpointConfig_set_version_info(
-          dynamic_endpoint, StdStringToUpbString(meta->version));
-      envoy_admin_v3_EndpointsConfigDump_DynamicEndpointConfig_set_last_updated(
-          dynamic_endpoint, GrpcMillisToTimestamp(context, meta->update_time));
-      google_protobuf_Any_set_type_url(endpoint_any, kEdsTypeUrlUpb);
-      google_protobuf_Any_set_value(
-          endpoint_any, StdStringToUpbString(meta->serialized_proto));
-    } else {
-      // If there isn't a working endpoint, we still need to print the name.
-      auto* cluster_load_assignment =
-          envoy_config_endpoint_v3_ClusterLoadAssignment_new(context.arena);
-      envoy_config_endpoint_v3_ClusterLoadAssignment_set_cluster_name(
-          cluster_load_assignment, name_upb);
-      size_t length;
-      char* bytes = envoy_config_endpoint_v3_ClusterLoadAssignment_serialize(
-          cluster_load_assignment, context.arena, &length);
-      google_protobuf_Any_set_type_url(endpoint_any, kEdsTypeUrlUpb);
-      google_protobuf_Any_set_value(endpoint_any,
-                                    upb_strview_make(bytes, length));
-    }
-    if (meta->client_status == XdsApi::ResourceMetadata::NACKED) {
-      // Set error_state if NACKED
-      envoy_admin_v3_EndpointsConfigDump_DynamicEndpointConfig_set_error_state(
-          dynamic_endpoint, CreateUpdateFailureStateUpb(context, meta));
-    }
-  }
-}
-
 }  // namespace
 
 std::string XdsApi::AssembleClientConfig(
@@ -3963,33 +4011,53 @@ std::string XdsApi::AssembleClientConfig(
       arena.ptr(), true,    certificate_provider_definition_map_};
   PopulateNode(context, node_, build_version_, user_agent_name_,
                user_agent_version_, node);
-  // Dump each xDS-type config into PerXdsConfig
-  for (auto& p : resource_type_metadata_map) {
+  // Dump each resource.
+  std::vector<std::string> type_url_storage;
+  for (const auto& p : resource_type_metadata_map) {
     absl::string_view type_url = p.first;
-    const ResourceTypeMetadata& resource_type_metadata = p.second;
-    if (type_url == kLdsTypeUrl) {
-      auto* per_xds_config =
-          envoy_service_status_v3_ClientConfig_add_xds_config(client_config,
-                                                              context.arena);
-      DumpLdsConfig(context, resource_type_metadata, per_xds_config);
-    } else if (type_url == kRdsTypeUrl) {
-      auto* per_xds_config =
-          envoy_service_status_v3_ClientConfig_add_xds_config(client_config,
-                                                              context.arena);
-      DumpRdsConfig(context, resource_type_metadata, per_xds_config);
-    } else if (type_url == kCdsTypeUrl) {
-      auto* per_xds_config =
-          envoy_service_status_v3_ClientConfig_add_xds_config(client_config,
-                                                              context.arena);
-      DumpCdsConfig(context, resource_type_metadata, per_xds_config);
-    } else if (type_url == kEdsTypeUrl) {
-      auto* per_xds_config =
-          envoy_service_status_v3_ClientConfig_add_xds_config(client_config,
-                                                              context.arena);
-      DumpEdsConfig(context, resource_type_metadata, per_xds_config);
-    } else {
-      gpr_log(GPR_ERROR, "invalid type_url %s", std::string(type_url).c_str());
-      return "";
+    const ResourceMetadataMap& resource_metadata_map = p.second;
+    type_url_storage.emplace_back(
+        absl::StrCat("type.googleapis.com/", type_url));
+    for (const auto& q : resource_metadata_map) {
+      absl::string_view resource_name = q.first;
+      const ResourceMetadata& metadata = *q.second;
+      auto* entry =
+          envoy_service_status_v3_ClientConfig_add_generic_xds_configs(
+              client_config, context.arena);
+      envoy_service_status_v3_ClientConfig_GenericXdsConfig_set_type_url(
+          entry, StdStringToUpbString(type_url_storage.back()));
+      envoy_service_status_v3_ClientConfig_GenericXdsConfig_set_name(
+          entry, StdStringToUpbString(resource_name));
+      envoy_service_status_v3_ClientConfig_GenericXdsConfig_set_client_status(
+          entry, metadata.client_status);
+      if (!metadata.serialized_proto.empty()) {
+        envoy_service_status_v3_ClientConfig_GenericXdsConfig_set_version_info(
+            entry, StdStringToUpbString(metadata.version));
+        envoy_service_status_v3_ClientConfig_GenericXdsConfig_set_last_updated(
+            entry, GrpcMillisToTimestamp(context, metadata.update_time));
+        auto* any_field =
+            envoy_service_status_v3_ClientConfig_GenericXdsConfig_mutable_xds_config(
+                entry, context.arena);
+        google_protobuf_Any_set_type_url(
+            any_field, StdStringToUpbString(type_url_storage.back()));
+        google_protobuf_Any_set_value(
+            any_field, StdStringToUpbString(metadata.serialized_proto));
+      }
+      if (metadata.client_status == XdsApi::ResourceMetadata::NACKED) {
+        auto* update_failure_state =
+            envoy_admin_v3_UpdateFailureState_new(context.arena);
+        envoy_admin_v3_UpdateFailureState_set_details(
+            update_failure_state,
+            StdStringToUpbString(metadata.failed_details));
+        envoy_admin_v3_UpdateFailureState_set_version_info(
+            update_failure_state,
+            StdStringToUpbString(metadata.failed_version));
+        envoy_admin_v3_UpdateFailureState_set_last_update_attempt(
+            update_failure_state,
+            GrpcMillisToTimestamp(context, metadata.failed_update_time));
+        envoy_service_status_v3_ClientConfig_GenericXdsConfig_set_error_state(
+            entry, update_failure_state);
+      }
     }
   }
   // Serialize the upb message to bytes