grpc 1.48.0 → 1.49.1

data/src/core/ext/xds/xds_api.cc

@@ -28,7 +28,6 @@
 
 #include "absl/strings/str_cat.h"
 #include "absl/strings/strip.h"
-#include "envoy/admin/v3/config_dump.upb.h"
 #include "envoy/config/core/v3/base.upb.h"
 #include "envoy/config/endpoint/v3/load_report.upb.h"
 #include "envoy/service/discovery/v3/discovery.upb.h"
@@ -53,7 +52,6 @@
 
 #include "src/core/ext/xds/upb_utils.h"
 #include "src/core/ext/xds/xds_client.h"
-#include "src/core/lib/iomgr/error.h"
 #include "src/core/lib/json/json.h"
 
 // IWYU pragma: no_include "upb/msg_internal.h"
@@ -79,14 +77,10 @@ namespace grpc_core {
 #endif
 
 XdsApi::XdsApi(XdsClient* client, TraceFlag* tracer,
-               const XdsBootstrap::Node* node,
-               const CertificateProviderStore::PluginDefinitionMap*
-                   certificate_provider_definition_map,
-               upb::SymbolTable* symtab)
+               const XdsBootstrap::Node* node, upb::SymbolTable* symtab)
     : client_(client),
       tracer_(tracer),
       node_(node),
-      certificate_provider_definition_map_(certificate_provider_definition_map),
       symtab_(symtab),
       build_version_(absl::StrCat("gRPC C-core ", GPR_PLATFORM_STRING, " ",
                                   grpc_version_string(),
@@ -101,10 +95,18 @@ XdsApi::XdsApi(XdsClient* client, TraceFlag* tracer,
 
 namespace {
 
-void PopulateMetadataValue(const XdsEncodingContext& context,
+struct XdsApiContext {
+  XdsClient* client;
+  TraceFlag* tracer;
+  upb_DefPool* symtab;
+  upb_Arena* arena;
+  bool use_v3;
+};
+
+void PopulateMetadataValue(const XdsApiContext& context,
                            google_protobuf_Value* value_pb, const Json& value);
 
-void PopulateListValue(const XdsEncodingContext& context,
+void PopulateListValue(const XdsApiContext& context,
                        google_protobuf_ListValue* list_value,
                        const Json::Array& values) {
   for (const auto& value : values) {
@@ -114,7 +116,7 @@ void PopulateListValue(const XdsEncodingContext& context,
   }
 }
 
-void PopulateMetadata(const XdsEncodingContext& context,
+void PopulateMetadata(const XdsApiContext& context,
                       google_protobuf_Struct* metadata_pb,
                       const Json::Object& metadata) {
   for (const auto& p : metadata) {
@@ -125,7 +127,7 @@ void PopulateMetadata(const XdsEncodingContext& context,
   }
 }
 
-void PopulateMetadataValue(const XdsEncodingContext& context,
+void PopulateMetadataValue(const XdsApiContext& context,
                            google_protobuf_Value* value_pb, const Json& value) {
   switch (value.type()) {
     case Json::Type::JSON_NULL:
@@ -181,7 +183,7 @@ std::string EncodeStringField(uint32_t field_number, const std::string& str) {
          EncodeVarint(str.size()) + str;
 }
 
-void PopulateBuildVersion(const XdsEncodingContext& context,
+void PopulateBuildVersion(const XdsApiContext& context,
                           envoy_config_core_v3_Node* node_msg,
                           const std::string& build_version) {
   std::string encoded_build_version = EncodeStringField(5, build_version);
@@ -193,8 +195,7 @@ void PopulateBuildVersion(const XdsEncodingContext& context,
                           encoded_build_version.size(), context.arena);
 }
 
-void PopulateNode(const XdsEncodingContext& context,
-                  const XdsBootstrap::Node* node,
+void PopulateNode(const XdsApiContext& context, const XdsBootstrap::Node* node,
                   const std::string& build_version,
                   const std::string& user_agent_name,
                   const std::string& user_agent_version,
@@ -245,7 +246,7 @@ void PopulateNode(const XdsEncodingContext& context,
 }
 
 void MaybeLogDiscoveryRequest(
-    const XdsEncodingContext& context,
+    const XdsApiContext& context,
     const envoy_service_discovery_v3_DiscoveryRequest* request) {
   if (GRPC_TRACE_FLAG_ENABLED(*context.tracer) &&
       gpr_should_log(GPR_LOG_SEVERITY_DEBUG)) {
@@ -258,30 +259,25 @@ void MaybeLogDiscoveryRequest(
   }
 }
 
-grpc_slice SerializeDiscoveryRequest(
-    const XdsEncodingContext& context,
+std::string SerializeDiscoveryRequest(
+    const XdsApiContext& context,
     envoy_service_discovery_v3_DiscoveryRequest* request) {
   size_t output_length;
   char* output = envoy_service_discovery_v3_DiscoveryRequest_serialize(
       request, context.arena, &output_length);
-  return grpc_slice_from_copied_buffer(output, output_length);
+  return std::string(output, output_length);
 }
 
 }  // namespace
 
-grpc_slice XdsApi::CreateAdsRequest(
+std::string XdsApi::CreateAdsRequest(
     const XdsBootstrap::XdsServer& server, absl::string_view type_url,
     absl::string_view version, absl::string_view nonce,
-    const std::vector<std::string>& resource_names, grpc_error_handle error,
+    const std::vector<std::string>& resource_names, absl::Status status,
     bool populate_node) {
   upb::Arena arena;
-  const XdsEncodingContext context = {client_,
-                                      server,
-                                      tracer_,
-                                      symtab_->ptr(),
-                                      arena.ptr(),
-                                      server.ShouldUseV3(),
-                                      certificate_provider_definition_map_};
+  const XdsApiContext context = {client_, tracer_, symtab_->ptr(), arena.ptr(),
+                                 server.ShouldUseV3()};
   // Create a request.
   envoy_service_discovery_v3_DiscoveryRequest* request =
       envoy_service_discovery_v3_DiscoveryRequest_new(arena.ptr());
@@ -301,7 +297,7 @@ grpc_slice XdsApi::CreateAdsRequest(
   }
   // Set error_detail if it's a NACK.
   std::string error_string_storage;
-  if (!GRPC_ERROR_IS_NONE(error)) {
+  if (!status.ok()) {
     google_rpc_Status* error_detail =
         envoy_service_discovery_v3_DiscoveryRequest_mutable_error_detail(
             request, arena.ptr());
@@ -310,12 +306,11 @@ grpc_slice XdsApi::CreateAdsRequest(
     // we could attach a status code to the individual errors where we
     // generate them in the parsing code, and then use that here.
     google_rpc_Status_set_code(error_detail, GRPC_STATUS_INVALID_ARGUMENT);
-    // Error description comes from the error that was passed in.
-    error_string_storage = grpc_error_std_string(error);
+    // Error description comes from the status that was passed in.
+    error_string_storage = std::string(status.message());
     upb_StringView error_description =
         StdStringToUpbString(error_string_storage);
     google_rpc_Status_set_message(error_detail, error_description);
-    GRPC_ERROR_UNREF(error);
   }
   // Populate node.
   if (populate_node) {
@@ -340,7 +335,7 @@ grpc_slice XdsApi::CreateAdsRequest(
 namespace {
 
 void MaybeLogDiscoveryResponse(
-    const XdsEncodingContext& context,
+    const XdsApiContext& context,
     const envoy_service_discovery_v3_DiscoveryResponse* response) {
   if (GRPC_TRACE_FLAG_ENABLED(*context.tracer) &&
       gpr_should_log(GPR_LOG_SEVERITY_DEBUG)) {
@@ -356,21 +351,15 @@ void MaybeLogDiscoveryResponse(
 }  // namespace
 
 absl::Status XdsApi::ParseAdsResponse(const XdsBootstrap::XdsServer& server,
-                                      const grpc_slice& encoded_response,
+                                      absl::string_view encoded_response,
                                       AdsResponseParserInterface* parser) {
   upb::Arena arena;
-  const XdsEncodingContext context = {client_,
-                                      server,
-                                      tracer_,
-                                      symtab_->ptr(),
-                                      arena.ptr(),
-                                      server.ShouldUseV3(),
-                                      certificate_provider_definition_map_};
+  const XdsApiContext context = {client_, tracer_, symtab_->ptr(), arena.ptr(),
+                                 server.ShouldUseV3()};
   // Decode the response.
   const envoy_service_discovery_v3_DiscoveryResponse* response =
       envoy_service_discovery_v3_DiscoveryResponse_parse(
-          reinterpret_cast<const char*>(GRPC_SLICE_START_PTR(encoded_response)),
-          GRPC_SLICE_LENGTH(encoded_response), arena.ptr());
+          encoded_response.data(), encoded_response.size(), arena.ptr());
   // If decoding fails, report a fatal error and return.
   if (response == nullptr) {
     return absl::InvalidArgumentError("Can't decode DiscoveryResponse.");
@@ -417,7 +406,7 @@ absl::Status XdsApi::ParseAdsResponse(const XdsBootstrap::XdsServer& server,
       serialized_resource =
           UpbStringToAbsl(google_protobuf_Any_value(resource));
     }
-    parser->ParseResource(context, i, type_url, serialized_resource);
+    parser->ParseResource(context.arena, i, type_url, serialized_resource);
   }
   return absl::OkStatus();
 }
@@ -425,7 +414,7 @@ absl::Status XdsApi::ParseAdsResponse(const XdsBootstrap::XdsServer& server,
 namespace {
 
 void MaybeLogLrsRequest(
-    const XdsEncodingContext& context,
+    const XdsApiContext& context,
     const envoy_service_load_stats_v3_LoadStatsRequest* request) {
   if (GRPC_TRACE_FLAG_ENABLED(*context.tracer) &&
       gpr_should_log(GPR_LOG_SEVERITY_DEBUG)) {
@@ -438,27 +427,22 @@ void MaybeLogLrsRequest(
   }
 }
 
-grpc_slice SerializeLrsRequest(
-    const XdsEncodingContext& context,
+std::string SerializeLrsRequest(
+    const XdsApiContext& context,
     const envoy_service_load_stats_v3_LoadStatsRequest* request) {
   size_t output_length;
   char* output = envoy_service_load_stats_v3_LoadStatsRequest_serialize(
       request, context.arena, &output_length);
-  return grpc_slice_from_copied_buffer(output, output_length);
+  return std::string(output, output_length);
 }
 
 }  // namespace
 
-grpc_slice XdsApi::CreateLrsInitialRequest(
+std::string XdsApi::CreateLrsInitialRequest(
     const XdsBootstrap::XdsServer& server) {
   upb::Arena arena;
-  const XdsEncodingContext context = {client_,
-                                      server,
-                                      tracer_,
-                                      symtab_->ptr(),
-                                      arena.ptr(),
-                                      server.ShouldUseV3(),
-                                      certificate_provider_definition_map_};
+  const XdsApiContext context = {client_, tracer_, symtab_->ptr(), arena.ptr(),
+                                 server.ShouldUseV3()};
   // Create a request.
   envoy_service_load_stats_v3_LoadStatsRequest* request =
       envoy_service_load_stats_v3_LoadStatsRequest_new(arena.ptr());
@@ -479,7 +463,7 @@ grpc_slice XdsApi::CreateLrsInitialRequest(
 namespace {
 
 void LocalityStatsPopulate(
-    const XdsEncodingContext& context,
+    const XdsApiContext& context,
     envoy_config_endpoint_v3_UpstreamLocalityStats* output,
     const XdsLocalityName& locality_name,
     const XdsClusterLocalityStats::Snapshot& snapshot) {
@@ -526,19 +510,11 @@ void LocalityStatsPopulate(
 
 }  // namespace
 
-grpc_slice XdsApi::CreateLrsRequest(
+std::string XdsApi::CreateLrsRequest(
     ClusterLoadReportMap cluster_load_report_map) {
   upb::Arena arena;
-  // The xDS server info is not actually needed here, so we seed it with an
-  // empty value.
-  XdsBootstrap::XdsServer empty_server;
-  const XdsEncodingContext context = {client_,
-                                      empty_server,
-                                      tracer_,
-                                      symtab_->ptr(),
-                                      arena.ptr(),
-                                      false,
-                                      certificate_provider_definition_map_};
+  const XdsApiContext context = {client_, tracer_, symtab_->ptr(), arena.ptr(),
+                                 /*use_v3=*/false};
   // Create a request.
   envoy_service_load_stats_v3_LoadStatsRequest* request =
       envoy_service_load_stats_v3_LoadStatsRequest_new(arena.ptr());
@@ -597,19 +573,18 @@ grpc_slice XdsApi::CreateLrsRequest(
   return SerializeLrsRequest(context, request);
 }
 
-grpc_error_handle XdsApi::ParseLrsResponse(const grpc_slice& encoded_response,
-                                           bool* send_all_clusters,
-                                           std::set<std::string>* cluster_names,
-                                           Duration* load_reporting_interval) {
+absl::Status XdsApi::ParseLrsResponse(absl::string_view encoded_response,
+                                      bool* send_all_clusters,
+                                      std::set<std::string>* cluster_names,
+                                      Duration* load_reporting_interval) {
   upb::Arena arena;
   // Decode the response.
   const envoy_service_load_stats_v3_LoadStatsResponse* decoded_response =
       envoy_service_load_stats_v3_LoadStatsResponse_parse(
-          reinterpret_cast<const char*>(GRPC_SLICE_START_PTR(encoded_response)),
-          GRPC_SLICE_LENGTH(encoded_response), arena.ptr());
+          encoded_response.data(), encoded_response.size(), arena.ptr());
   // Parse the response.
   if (decoded_response == nullptr) {
-    return GRPC_ERROR_CREATE_FROM_STATIC_STRING("Can't decode response.");
+    return absl::UnavailableError("Can't decode response.");
   }
   // Check send_all_clusters.
   if (envoy_service_load_stats_v3_LoadStatsResponse_send_all_clusters(
@@ -632,12 +607,12 @@ grpc_error_handle XdsApi::ParseLrsResponse(const grpc_slice& encoded_response,
   *load_reporting_interval = Duration::FromSecondsAndNanoseconds(
       google_protobuf_Duration_seconds(load_reporting_interval_duration),
       google_protobuf_Duration_nanos(load_reporting_interval_duration));
-  return GRPC_ERROR_NONE;
+  return absl::OkStatus();
 }
 
 namespace {
 
-google_protobuf_Timestamp* EncodeTimestamp(const XdsEncodingContext& context,
+google_protobuf_Timestamp* EncodeTimestamp(const XdsApiContext& context,
                                            Timestamp value) {
   google_protobuf_Timestamp* timestamp =
       google_protobuf_Timestamp_new(context.arena);
@@ -657,16 +632,8 @@ std::string XdsApi::AssembleClientConfig(
   // Fill-in the node information
   auto* node = envoy_service_status_v3_ClientConfig_mutable_node(client_config,
                                                                  arena.ptr());
-  // The xDS server info is not actually needed here, so we seed it with an
-  // empty value.
-  XdsBootstrap::XdsServer empty_server;
-  const XdsEncodingContext context = {client_,
-                                      empty_server,
-                                      tracer_,
-                                      symtab_->ptr(),
-                                      arena.ptr(),
-                                      true,
-                                      certificate_provider_definition_map_};
+  const XdsApiContext context = {client_, tracer_, symtab_->ptr(), arena.ptr(),
+                                 /*use_v3=*/true};
   PopulateNode(context, node_, build_version_, user_agent_name_,
                user_agent_version_, node);
   // Dump each resource.

data/src/core/ext/xds/xds_api.h

@@ -29,26 +29,21 @@
 
 #include "absl/status/status.h"
 #include "absl/strings/string_view.h"
-#include "envoy/admin/v3/config_dump.upb.h"
+#include "envoy/admin/v3/config_dump_shared.upb.h"
+#include "upb/arena.h"
 #include "upb/def.hpp"
 
-#include <grpc/slice.h>
-
-#include "src/core/ext/xds/certificate_provider_store.h"
-#include "src/core/ext/xds/upb_utils.h"
 #include "src/core/ext/xds/xds_bootstrap.h"
 #include "src/core/ext/xds/xds_client_stats.h"
 #include "src/core/lib/debug/trace.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/gprpp/time.h"
-#include "src/core/lib/iomgr/error.h"
 
 namespace grpc_core {
 
 class XdsClient;
 
 // TODO(roth): When we have time, split this into multiple pieces:
-// - a common upb-based parsing framework (combine with XdsEncodingContext)
 // - ADS request/response handling
 // - LRS request/response handling
 // - CSDS response generation
@@ -72,7 +67,7 @@ class XdsApi {
     virtual absl::Status ProcessAdsResponseFields(AdsResponseFields fields) = 0;
 
     // Called to parse each individual resource in the ADS response.
-    virtual void ParseResource(const XdsEncodingContext& context, size_t idx,
+    virtual void ParseResource(upb_Arena* arena, size_t idx,
                                absl::string_view type_url,
                                absl::string_view serialized_resource) = 0;
   };
@@ -145,37 +140,35 @@ class XdsApi {
                 "");
 
   XdsApi(XdsClient* client, TraceFlag* tracer, const XdsBootstrap::Node* node,
-         const CertificateProviderStore::PluginDefinitionMap* map,
          upb::SymbolTable* symtab);
 
   // Creates an ADS request.
   // Takes ownership of \a error.
-  grpc_slice CreateAdsRequest(const XdsBootstrap::XdsServer& server,
-                              absl::string_view type_url,
-                              absl::string_view version,
-                              absl::string_view nonce,
-                              const std::vector<std::string>& resource_names,
-                              grpc_error_handle error, bool populate_node);
+  std::string CreateAdsRequest(const XdsBootstrap::XdsServer& server,
+                               absl::string_view type_url,
+                               absl::string_view version,
+                               absl::string_view nonce,
+                               const std::vector<std::string>& resource_names,
+                               absl::Status status, bool populate_node);
 
   // Returns non-OK when failing to deserialize response message.
   // Otherwise, all events are reported to the parser.
   absl::Status ParseAdsResponse(const XdsBootstrap::XdsServer& server,
-                                const grpc_slice& encoded_response,
+                                absl::string_view encoded_response,
                                 AdsResponseParserInterface* parser);
 
   // Creates an initial LRS request.
-  grpc_slice CreateLrsInitialRequest(const XdsBootstrap::XdsServer& server);
+  std::string CreateLrsInitialRequest(const XdsBootstrap::XdsServer& server);
 
   // Creates an LRS request sending a client-side load report.
-  grpc_slice CreateLrsRequest(ClusterLoadReportMap cluster_load_report_map);
+  std::string CreateLrsRequest(ClusterLoadReportMap cluster_load_report_map);
 
-  // Parses the LRS response and returns \a
-  // load_reporting_interval for client-side load reporting. If there is any
-  // error, the output config is invalid.
-  grpc_error_handle ParseLrsResponse(const grpc_slice& encoded_response,
-                                     bool* send_all_clusters,
-                                     std::set<std::string>* cluster_names,
-                                     Duration* load_reporting_interval);
+  // Parses the LRS response and populates send_all_clusters,
+  // cluster_names, and load_reporting_interval.
+  absl::Status ParseLrsResponse(absl::string_view encoded_response,
+                                bool* send_all_clusters,
+                                std::set<std::string>* cluster_names,
+                                Duration* load_reporting_interval);
 
   // Assemble the client config proto message and return the serialized result.
   std::string AssembleClientConfig(
@@ -185,9 +178,7 @@ class XdsApi {
   XdsClient* client_;
   TraceFlag* tracer_;
   const XdsBootstrap::Node* node_;  // Do not own.
-  const CertificateProviderStore::PluginDefinitionMap*
-      certificate_provider_definition_map_;  // Do not own.
-  upb::SymbolTable* symtab_;                 // Do not own.
+  upb::SymbolTable* symtab_;        // Do not own.
   const std::string build_version_;
   const std::string user_agent_name_;
   const std::string user_agent_version_;

data/src/core/ext/xds/xds_bootstrap.cc

@@ -24,6 +24,8 @@
 #include <vector>
 
 #include "absl/memory/memory.h"
+#include "absl/status/status.h"
+#include "absl/status/statusor.h"
 #include "absl/strings/match.h"
 #include "absl/strings/str_cat.h"
 #include "absl/strings/str_format.h"
@@ -32,14 +34,12 @@
 
 #include <grpc/support/alloc.h>
 
-#include "src/core/ext/xds/certificate_provider_factory.h"
-#include "src/core/ext/xds/certificate_provider_registry.h"
 #include "src/core/lib/config/core_configuration.h"
 #include "src/core/lib/gpr/env.h"
 #include "src/core/lib/gpr/string.h"
-#include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/json/json_util.h"
 #include "src/core/lib/security/credentials/channel_creds_registry.h"
+#include "src/core/lib/transport/error_utils.h"
 
 namespace grpc_core {
 
@@ -178,20 +178,27 @@ bool XdsBootstrap::XdsServer::IgnoreResourceDeletion() const {
 //
 
 std::unique_ptr<XdsBootstrap> XdsBootstrap::Create(
-    absl::string_view json_string, grpc_error_handle* error) {
-  Json json = Json::Parse(json_string, error);
-  if (!GRPC_ERROR_IS_NONE(*error)) {
-    grpc_error_handle error_out =
-        GRPC_ERROR_CREATE_REFERENCING_FROM_STATIC_STRING(
-            "Failed to parse bootstrap JSON string", error, 1);
-    GRPC_ERROR_UNREF(*error);
-    *error = error_out;
+    absl::string_view json_string,
+    std::unique_ptr<XdsCertificateProviderPluginMapInterface>
+        certificate_provider_plugin_map,
+    grpc_error_handle* error) {
+  auto json = Json::Parse(json_string);
+  if (!json.ok()) {
+    *error = GRPC_ERROR_CREATE_FROM_CPP_STRING(absl::StrCat(
+        "Failed to parse bootstrap JSON string: ", json.status().ToString()));
     return nullptr;
   }
-  return absl::make_unique<XdsBootstrap>(std::move(json), error);
+  return absl::make_unique<XdsBootstrap>(
+      std::move(*json), std::move(certificate_provider_plugin_map), error);
 }
 
-XdsBootstrap::XdsBootstrap(Json json, grpc_error_handle* error) {
+XdsBootstrap::XdsBootstrap(
+    Json json,
+    std::unique_ptr<XdsCertificateProviderPluginMapInterface>
+        certificate_provider_plugin_map,
+    grpc_error_handle* error)
+    : certificate_provider_plugin_map_(
+          std::move(certificate_provider_plugin_map)) {
   if (json.type() != Json::Type::OBJECT) {
     *error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
         "malformed JSON in bootstrap file");
@@ -470,36 +477,25 @@ grpc_error_handle XdsBootstrap::ParseCertificateProvider(
         "\"plugin_name\" field is not a string"));
   } else {
     std::string plugin_name = std::move(*(it->second.mutable_string_value()));
-    CertificateProviderFactory* factory =
-        CertificateProviderRegistry::LookupCertificateProviderFactory(
-            plugin_name);
-    if (factory == nullptr) {
-      error_list.push_back(GRPC_ERROR_CREATE_FROM_CPP_STRING(
-          absl::StrCat("Unrecognized plugin name: ", plugin_name)));
-    } else {
-      RefCountedPtr<CertificateProviderFactory::Config> config;
-      it = certificate_provider_json->mutable_object()->find("config");
-      if (it != certificate_provider_json->mutable_object()->end()) {
-        if (it->second.type() != Json::Type::OBJECT) {
-          error_list.push_back(GRPC_ERROR_CREATE_FROM_STATIC_STRING(
-              "\"config\" field is not an object"));
-        } else {
-          grpc_error_handle parse_error = GRPC_ERROR_NONE;
-          config = factory->CreateCertificateProviderConfig(it->second,
-                                                            &parse_error);
-          if (!GRPC_ERROR_IS_NONE(parse_error)) {
-            error_list.push_back(parse_error);
-          }
-        }
+    it = certificate_provider_json->mutable_object()->find("config");
+    if (it != certificate_provider_json->mutable_object()->end()) {
+      if (it->second.type() != Json::Type::OBJECT) {
+        error_list.push_back(GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+            "\"config\" field is not an object"));
       } else {
-        // "config" is an optional field, so create an empty JSON object.
-        grpc_error_handle parse_error = GRPC_ERROR_NONE;
-        config = factory->CreateCertificateProviderConfig(Json::Object(),
-                                                          &parse_error);
-        if (!GRPC_ERROR_IS_NONE(parse_error)) error_list.push_back(parse_error);
+        absl::Status status = certificate_provider_plugin_map_->AddPlugin(
+            instance_name, plugin_name, it->second);
+        if (!status.ok()) {
+          error_list.push_back(absl_status_to_grpc_error(status));
+        }
+      }
+    } else {
+      // "config" is an optional field, so create an empty JSON object.
+      absl::Status status = certificate_provider_plugin_map_->AddPlugin(
+          instance_name, plugin_name, Json::Object());
+      if (!status.ok()) {
+        error_list.push_back(absl_status_to_grpc_error(status));
       }
-      certificate_providers_.insert(
-          {instance_name, {std::move(plugin_name), std::move(config)}});
     }
   }
   return GRPC_ERROR_CREATE_FROM_VECTOR_AND_CPP_STRING(
@@ -566,17 +562,8 @@ std::string XdsBootstrap::ToString() const {
     parts.push_back("      },\n");
   }
   parts.push_back("}");
-  parts.push_back("certificate_providers={\n");
-  for (const auto& entry : certificate_providers_) {
-    parts.push_back(
-        absl::StrFormat("  %s={\n"
-                        "    plugin_name=%s\n"
-                        "    config=%s\n"
-                        "  },\n",
-                        entry.first, entry.second.plugin_name,
-                        entry.second.config->ToString()));
-  }
-  parts.push_back("}");
+  parts.push_back("certificate_providers=");
+  parts.push_back(certificate_provider_plugin_map_->ToString());
   return absl::StrJoin(parts, "");
 }
 

data/src/core/ext/xds/xds_bootstrap.h

@@ -26,9 +26,9 @@
 #include <string>
 #include <vector>
 
+#include "absl/status/status.h"
 #include "absl/strings/string_view.h"
 
-#include "src/core/ext/xds/certificate_provider_store.h"
 #include "src/core/lib/iomgr/error.h"
 #include "src/core/lib/json/json.h"
 
@@ -38,6 +38,19 @@ bool XdsFederationEnabled();
 
 class XdsClient;
 
+class XdsCertificateProviderPluginMapInterface {
+ public:
+  virtual ~XdsCertificateProviderPluginMapInterface() = default;
+
+  virtual absl::Status AddPlugin(const std::string& instance_name,
+                                 const std::string& plugin_name,
+                                 const Json& config) = 0;
+
+  virtual bool HasPlugin(const std::string& instance_name) const = 0;
+
+  virtual std::string ToString() const = 0;
+};
+
 class XdsBootstrap {
  public:
   struct Node {
@@ -88,11 +101,17 @@ class XdsBootstrap {
   // Creates bootstrap object from json_string.
   // If *error is not GRPC_ERROR_NONE after returning, then there was an
   // error parsing the contents.
-  static std::unique_ptr<XdsBootstrap> Create(absl::string_view json_string,
-                                              grpc_error_handle* error);
+  static std::unique_ptr<XdsBootstrap> Create(
+      absl::string_view json_string,
+      std::unique_ptr<XdsCertificateProviderPluginMapInterface>
+          certificate_provider_plugin_map,
+      grpc_error_handle* error);
 
   // Do not instantiate directly -- use Create() above instead.
-  XdsBootstrap(Json json, grpc_error_handle* error);
+  XdsBootstrap(Json json,
+               std::unique_ptr<XdsCertificateProviderPluginMapInterface>
+                   certificate_provider_plugin_map,
+               grpc_error_handle* error);
 
   std::string ToString() const;
 
@@ -110,9 +129,9 @@ class XdsBootstrap {
     return authorities_;
   }
   const Authority* LookupAuthority(const std::string& name) const;
-  const CertificateProviderStore::PluginDefinitionMap& certificate_providers()
-      const {
-    return certificate_providers_;
+  const XdsCertificateProviderPluginMapInterface*
+  certificate_provider_plugin_map() const {
+    return certificate_provider_plugin_map_.get();
   }
   // A util method to check that an xds server exists in this bootstrap file.
   bool XdsServerExists(const XdsServer& server) const;
@@ -133,7 +152,8 @@ class XdsBootstrap {
   std::string client_default_listener_resource_name_template_;
   std::string server_listener_resource_name_template_;
   std::map<std::string, Authority> authorities_;
-  CertificateProviderStore::PluginDefinitionMap certificate_providers_;
+  std::unique_ptr<XdsCertificateProviderPluginMapInterface>
+      certificate_provider_plugin_map_;
 };
 
 }  // namespace grpc_core

data/src/core/ext/xds/xds_certificate_provider.h

@@ -50,6 +50,15 @@ class XdsCertificateProvider : public grpc_tls_certificate_provider {
   XdsCertificateProvider();
   ~XdsCertificateProvider() override;
 
+  static absl::string_view ChannelArgName() {
+    return GRPC_ARG_XDS_CERTIFICATE_PROVIDER;
+  }
+
+  static int ChannelArgsCompare(const XdsCertificateProvider* a,
+                                const XdsCertificateProvider* b) {
+    return QsortCompare(a, b);
+  }
+
   RefCountedPtr<grpc_tls_certificate_distributor> distributor() const override {
     return distributor_;
   }