grpc 1.50.0 → 1.56.0

data/src/core/ext/xds/xds_route_config.cc

@@ -21,6 +21,8 @@
 #include <stddef.h>
 #include <stdint.h>
 
+#include <initializer_list>
+#include <limits>
 #include <map>
 #include <memory>
 #include <set>
@@ -28,7 +30,6 @@
 #include <utility>
 #include <vector>
 
-#include "absl/memory/memory.h"
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
 #include "absl/strings/str_cat.h"
@@ -44,51 +45,45 @@
 #include "envoy/config/route/v3/route.upbdefs.h"
 #include "envoy/config/route/v3/route_components.upb.h"
 #include "envoy/type/matcher/v3/regex.upb.h"
+#include "envoy/type/matcher/v3/string.upb.h"
 #include "envoy/type/v3/percent.upb.h"
 #include "envoy/type/v3/range.upb.h"
 #include "google/protobuf/any.upb.h"
 #include "google/protobuf/duration.upb.h"
 #include "google/protobuf/wrappers.upb.h"
 #include "re2/re2.h"
-#include "upb/def.h"
-#include "upb/text_encode.h"
-#include "upb/upb.h"
+#include "upb/base/string_view.h"
+#include "upb/collections/map.h"
+#include "upb/text/encode.h"
 
 #include <grpc/status.h>
 #include <grpc/support/log.h>
 
 #include "src/core/ext/xds/upb_utils.h"
-#include "src/core/ext/xds/xds_bootstrap.h"
 #include "src/core/ext/xds/xds_cluster_specifier_plugin.h"
 #include "src/core/ext/xds/xds_common_types.h"
 #include "src/core/ext/xds/xds_http_filters.h"
 #include "src/core/ext/xds/xds_resource_type.h"
-#include "src/core/ext/xds/xds_resource_type_impl.h"
 #include "src/core/ext/xds/xds_routing.h"
 #include "src/core/lib/channel/status_util.h"
+#include "src/core/lib/config/core_configuration.h"
 #include "src/core/lib/debug/trace.h"
 #include "src/core/lib/gpr/string.h"
 #include "src/core/lib/gprpp/env.h"
 #include "src/core/lib/gprpp/match.h"
+#include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/gprpp/time.h"
-#include "src/core/lib/iomgr/error.h"
+#include "src/core/lib/json/json.h"
+#include "src/core/lib/json/json_writer.h"
+#include "src/core/lib/load_balancing/lb_policy_registry.h"
 #include "src/core/lib/matchers/matchers.h"
 
 namespace grpc_core {
 
-// TODO(yashykt): Remove once RBAC is no longer experimental
-bool XdsRbacEnabled() {
-  auto value = GetEnv("GRPC_XDS_EXPERIMENTAL_RBAC");
-  if (!value.has_value()) return false;
-  bool parsed_value;
-  bool parse_succeeded = gpr_parse_bool_value(value->c_str(), &parsed_value);
-  return parse_succeeded && parsed_value;
-}
-
-// TODO(donnadionne): Remove once RLS is no longer experimental
+// TODO(apolcyn): remove this flag by the 1.58 release
 bool XdsRlsEnabled() {
   auto value = GetEnv("GRPC_EXPERIMENTAL_XDS_RLS_LB");
-  if (!value.has_value()) return false;
+  if (!value.has_value()) return true;
   bool parsed_value;
   bool parse_succeeded = gpr_parse_bool_value(value->c_str(), &parsed_value);
   return parse_succeeded && parsed_value;
@@ -134,85 +129,77 @@ std::string XdsRouteConfigResource::Route::Matchers::ToString() const {
 }
 
 //
-// XdsRouteConfigResource::Route::RouteAction::HashPolicy
+// XdsRouteConfigResource::Route::RouteAction::HashPolicy::Header
 //
 
-XdsRouteConfigResource::Route::RouteAction::HashPolicy::HashPolicy(
-    const HashPolicy& other)
-    : type(other.type),
-      header_name(other.header_name),
+XdsRouteConfigResource::Route::RouteAction::HashPolicy::Header::Header(
+    const Header& other)
+    : header_name(other.header_name),
       regex_substitution(other.regex_substitution) {
   if (other.regex != nullptr) {
     regex =
-        absl::make_unique<RE2>(other.regex->pattern(), other.regex->options());
+        std::make_unique<RE2>(other.regex->pattern(), other.regex->options());
   }
 }
 
-XdsRouteConfigResource::Route::RouteAction::HashPolicy&
-XdsRouteConfigResource::Route::RouteAction::HashPolicy::operator=(
-    const HashPolicy& other) {
-  type = other.type;
+XdsRouteConfigResource::Route::RouteAction::HashPolicy::Header&
+XdsRouteConfigResource::Route::RouteAction::HashPolicy::Header::operator=(
+    const Header& other) {
   header_name = other.header_name;
   if (other.regex != nullptr) {
     regex =
-        absl::make_unique<RE2>(other.regex->pattern(), other.regex->options());
+        std::make_unique<RE2>(other.regex->pattern(), other.regex->options());
   }
   regex_substitution = other.regex_substitution;
   return *this;
 }
 
-XdsRouteConfigResource::Route::RouteAction::HashPolicy::HashPolicy(
-    HashPolicy&& other) noexcept
-    : type(other.type),
-      header_name(std::move(other.header_name)),
+XdsRouteConfigResource::Route::RouteAction::HashPolicy::Header::Header(
+    Header&& other) noexcept
+    : header_name(std::move(other.header_name)),
       regex(std::move(other.regex)),
       regex_substitution(std::move(other.regex_substitution)) {}
 
-XdsRouteConfigResource::Route::RouteAction::HashPolicy&
-XdsRouteConfigResource::Route::RouteAction::HashPolicy::operator=(
-    HashPolicy&& other) noexcept {
-  type = other.type;
+XdsRouteConfigResource::Route::RouteAction::HashPolicy::Header&
+XdsRouteConfigResource::Route::RouteAction::HashPolicy::Header::operator=(
+    Header&& other) noexcept {
   header_name = std::move(other.header_name);
   regex = std::move(other.regex);
   regex_substitution = std::move(other.regex_substitution);
   return *this;
 }
 
-bool XdsRouteConfigResource::Route::RouteAction::HashPolicy::HashPolicy::
-operator==(const HashPolicy& other) const {
-  if (type != other.type) return false;
-  if (type == Type::HEADER) {
-    if (regex == nullptr) {
-      if (other.regex != nullptr) return false;
-    } else {
-      if (other.regex == nullptr) return false;
-      return header_name == other.header_name &&
-             regex->pattern() == other.regex->pattern() &&
-             regex_substitution == other.regex_substitution;
-    }
+bool XdsRouteConfigResource::Route::RouteAction::HashPolicy::Header::operator==(
+    const Header& other) const {
+  if (header_name != other.header_name) return false;
+  if (regex == nullptr) {
+    if (other.regex != nullptr) return false;
+  } else {
+    if (other.regex == nullptr) return false;
+    if (regex->pattern() != other.regex->pattern()) return false;
   }
-  return true;
+  return regex_substitution == other.regex_substitution;
+}
+
+std::string
+XdsRouteConfigResource::Route::RouteAction::HashPolicy::Header::ToString()
+    const {
+  return absl::StrCat("Header ", header_name, "/",
+                      (regex == nullptr) ? "" : regex->pattern(), "/",
+                      regex_substitution);
 }
 
+//
+// XdsRouteConfigResource::Route::RouteAction::HashPolicy
+//
+
 std::string XdsRouteConfigResource::Route::RouteAction::HashPolicy::ToString()
     const {
-  std::vector<std::string> contents;
-  switch (type) {
-    case Type::HEADER:
-      contents.push_back("type=HEADER");
-      break;
-    case Type::CHANNEL_ID:
-      contents.push_back("type=CHANNEL_ID");
-      break;
-  }
-  contents.push_back(
-      absl::StrFormat("terminal=%s", terminal ? "true" : "false"));
-  if (type == Type::HEADER) {
-    contents.push_back(absl::StrFormat(
-        "Header %s:/%s/%s", header_name,
-        (regex == nullptr) ? "" : regex->pattern(), regex_substitution));
-  }
-  return absl::StrCat("{", absl::StrJoin(contents, ", "), "}");
+  std::string type = Match(
+      policy, [](const Header& header) { return header.ToString(); },
+      [](const ChannelId&) -> std::string { return "ChannelId"; });
+  return absl::StrCat("{", type, ", terminal=", terminal ? "true" : "false",
+                      "}");
 }
 
 //
@@ -243,6 +230,7 @@ XdsRouteConfigResource::Route::RouteAction::ClusterWeight::ToString() const {
 
 std::string XdsRouteConfigResource::Route::RouteAction::ToString() const {
   std::vector<std::string> contents;
+  contents.reserve(hash_policies.size());
   for (const HashPolicy& hash_policy : hash_policies) {
     contents.push_back(absl::StrCat("hash_policy=", hash_policy.ToString()));
   }
@@ -339,65 +327,85 @@ std::string XdsRouteConfigResource::ToString() const {
 
 namespace {
 
-absl::StatusOr<XdsRouteConfigResource::ClusterSpecifierPluginMap>
-ClusterSpecifierPluginParse(
+XdsRouteConfigResource::ClusterSpecifierPluginMap ClusterSpecifierPluginParse(
     const XdsResourceType::DecodeContext& context,
-    const envoy_config_route_v3_RouteConfiguration* route_config) {
+    const envoy_config_route_v3_RouteConfiguration* route_config,
+    ValidationErrors* errors) {
   XdsRouteConfigResource::ClusterSpecifierPluginMap
       cluster_specifier_plugin_map;
+  const auto& cluster_specifier_plugin_registry =
+      static_cast<const GrpcXdsBootstrap&>(context.client->bootstrap())
+          .cluster_specifier_plugin_registry();
   size_t num_cluster_specifier_plugins;
   const envoy_config_route_v3_ClusterSpecifierPlugin* const*
       cluster_specifier_plugin =
           envoy_config_route_v3_RouteConfiguration_cluster_specifier_plugins(
               route_config, &num_cluster_specifier_plugins);
   for (size_t i = 0; i < num_cluster_specifier_plugins; ++i) {
-    const envoy_config_core_v3_TypedExtensionConfig* extension =
+    bool is_optional = envoy_config_route_v3_ClusterSpecifierPlugin_is_optional(
+        cluster_specifier_plugin[i]);
+    ValidationErrors::ScopedField field(
+        errors, absl::StrCat(".cluster_specifier_plugins[", i, "].extension"));
+    const envoy_config_core_v3_TypedExtensionConfig* typed_extension_config =
         envoy_config_route_v3_ClusterSpecifierPlugin_extension(
             cluster_specifier_plugin[i]);
     std::string name = UpbStringToStdString(
-        envoy_config_core_v3_TypedExtensionConfig_name(extension));
+        envoy_config_core_v3_TypedExtensionConfig_name(typed_extension_config));
     if (cluster_specifier_plugin_map.find(name) !=
         cluster_specifier_plugin_map.end()) {
-      return absl::InvalidArgumentError(absl::StrCat(
-          "Duplicated definition of cluster_specifier_plugin ", name));
+      ValidationErrors::ScopedField field(errors, ".name");
+      errors->AddError(absl::StrCat("duplicate name \"", name, "\""));
+    } else {
+      // Add a sentinel entry in case we encounter an error later, just so we
+      // don't generate duplicate errors for each route that uses this plugin.
+      cluster_specifier_plugin_map[name] = "<sentinel>";
     }
+    ValidationErrors::ScopedField field2(errors, ".typed_config");
     const google_protobuf_Any* any =
-        envoy_config_core_v3_TypedExtensionConfig_typed_config(extension);
-    if (any == nullptr) {
-      return absl::InvalidArgumentError(
-          "Could not obtrain TypedExtensionConfig for plugin config.");
-    }
-    auto plugin_type = ExtractExtensionTypeName(context, any);
-    if (!plugin_type.ok()) return plugin_type.status();
-    bool is_optional = envoy_config_route_v3_ClusterSpecifierPlugin_is_optional(
-        cluster_specifier_plugin[i]);
+        envoy_config_core_v3_TypedExtensionConfig_typed_config(
+            typed_extension_config);
+    auto extension = ExtractXdsExtension(context, any, errors);
+    if (!extension.has_value()) continue;
     const XdsClusterSpecifierPluginImpl* cluster_specifier_plugin_impl =
-        XdsClusterSpecifierPluginRegistry::GetPluginForType(plugin_type->type);
-    std::string lb_policy_config;
+        cluster_specifier_plugin_registry.GetPluginForType(extension->type);
     if (cluster_specifier_plugin_impl == nullptr) {
-      if (!is_optional) {
-        return absl::InvalidArgumentError(absl::StrCat(
-            "Unknown ClusterSpecifierPlugin type ", plugin_type->type));
+      if (is_optional) {
+        // Empty string indicates an optional plugin.
+        // This is used later when validating routes, and since we will skip
+        // any routes that refer to this plugin, we won't wind up including
+        // this plugin in the resource that we return to the watcher.
+        cluster_specifier_plugin_map[std::move(name)] = "";
+      } else {
+        // Not optional, report error.
+        errors->AddError("unsupported ClusterSpecifierPlugin type");
       }
-      // Optional plugin, leave lb_policy_config empty.
+      continue;
+    }
+    const size_t original_error_size = errors->size();
+    Json lb_policy_config =
+        cluster_specifier_plugin_impl->GenerateLoadBalancingPolicyConfig(
+            std::move(*extension), context.arena, context.symtab, errors);
+    if (errors->size() != original_error_size) continue;
+    auto config =
+        CoreConfiguration::Get().lb_policy_registry().ParseLoadBalancingConfig(
+            lb_policy_config);
+    if (!config.ok()) {
+      errors->AddError(absl::StrCat(
+          "ClusterSpecifierPlugin returned invalid LB policy config: ",
+          config.status().message()));
     } else {
-      auto config =
-          cluster_specifier_plugin_impl->GenerateLoadBalancingPolicyConfig(
-              google_protobuf_Any_value(any), context.arena, context.symtab);
-      if (!config.ok()) return config.status();
-      lb_policy_config = std::move(*config);
+      cluster_specifier_plugin_map[std::move(name)] =
+          JsonDump(lb_policy_config);
     }
-    cluster_specifier_plugin_map[std::move(name)] = std::move(lb_policy_config);
   }
   return cluster_specifier_plugin_map;
 }
 
-absl::Status RoutePathMatchParse(const envoy_config_route_v3_RouteMatch* match,
-                                 XdsRouteConfigResource::Route* route,
-                                 bool* ignore_route) {
+absl::optional<StringMatcher> RoutePathMatchParse(
+    const envoy_config_route_v3_RouteMatch* match, ValidationErrors* errors) {
+  bool case_sensitive = true;
   auto* case_sensitive_ptr =
       envoy_config_route_v3_RouteMatch_case_sensitive(match);
-  bool case_sensitive = true;
   if (case_sensitive_ptr != nullptr) {
     case_sensitive = google_protobuf_BoolValue_value(case_sensitive_ptr);
   }
@@ -406,25 +414,18 @@ absl::Status RoutePathMatchParse(const envoy_config_route_v3_RouteMatch* match,
   if (envoy_config_route_v3_RouteMatch_has_prefix(match)) {
     absl::string_view prefix =
         UpbStringToAbsl(envoy_config_route_v3_RouteMatch_prefix(match));
-    // Empty prefix "" is accepted.
+    // For any prefix that cannot match a path of the form "/service/method",
+    // ignore the route.
     if (!prefix.empty()) {
-      // Prefix "/" is accepted.
-      if (prefix[0] != '/') {
-        // Prefix which does not start with a / will never match anything, so
-        // ignore this route.
-        *ignore_route = true;
-        return absl::OkStatus();
-      }
+      // Does not start with a slash.
+      if (prefix[0] != '/') return absl::nullopt;
       std::vector<absl::string_view> prefix_elements =
           absl::StrSplit(prefix.substr(1), absl::MaxSplits('/', 2));
-      if (prefix_elements.size() > 2) {
-        // Prefix cannot have more than 2 slashes.
-        *ignore_route = true;
-        return absl::OkStatus();
-      } else if (prefix_elements.size() == 2 && prefix_elements[0].empty()) {
-        // Prefix contains empty string between the 2 slashes
-        *ignore_route = true;
-        return absl::OkStatus();
+      // More than 2 slashes.
+      if (prefix_elements.size() > 2) return absl::nullopt;
+      // Two consecutive slashes.
+      if (prefix_elements.size() == 2 && prefix_elements[0].empty()) {
+        return absl::nullopt;
       }
     }
     type = StringMatcher::Type::kPrefix;
@@ -432,35 +433,19 @@ absl::Status RoutePathMatchParse(const envoy_config_route_v3_RouteMatch* match,
   } else if (envoy_config_route_v3_RouteMatch_has_path(match)) {
     absl::string_view path =
         UpbStringToAbsl(envoy_config_route_v3_RouteMatch_path(match));
-    if (path.empty()) {
-      // Path that is empty will never match anything, so ignore this route.
-      *ignore_route = true;
-      return absl::OkStatus();
-    }
-    if (path[0] != '/') {
-      // Path which does not start with a / will never match anything, so
-      // ignore this route.
-      *ignore_route = true;
-      return absl::OkStatus();
-    }
+    // For any path not of the form "/service/method", ignore the route.
+    // Empty path.
+    if (path.empty()) return absl::nullopt;
+    // Does not start with a slash.
+    if (path[0] != '/') return absl::nullopt;
     std::vector<absl::string_view> path_elements =
         absl::StrSplit(path.substr(1), absl::MaxSplits('/', 2));
-    if (path_elements.size() != 2) {
-      // Path not in the required format of /service/method will never match
-      // anything, so ignore this route.
-      *ignore_route = true;
-      return absl::OkStatus();
-    } else if (path_elements[0].empty()) {
-      // Path contains empty service name will never match anything, so ignore
-      // this route.
-      *ignore_route = true;
-      return absl::OkStatus();
-    } else if (path_elements[1].empty()) {
-      // Path contains empty method name will never match anything, so ignore
-      // this route.
-      *ignore_route = true;
-      return absl::OkStatus();
-    }
+    // Number of slashes does not equal 2.
+    if (path_elements.size() != 2) return absl::nullopt;
+    // Empty service name.
+    if (path_elements[0].empty()) return absl::nullopt;
+    // Empty method name.
+    if (path_elements[1].empty()) return absl::nullopt;
     type = StringMatcher::Type::kExact;
     match_string = std::string(path);
   } else if (envoy_config_route_v3_RouteMatch_has_safe_regex(match)) {
@@ -471,27 +456,30 @@ absl::Status RoutePathMatchParse(const envoy_config_route_v3_RouteMatch* match,
     match_string = UpbStringToStdString(
         envoy_type_matcher_v3_RegexMatcher_regex(regex_matcher));
   } else {
-    return absl::InvalidArgumentError(
-        "Invalid route path specifier specified.");
+    errors->AddError("invalid path specifier");
+    return absl::nullopt;
   }
   absl::StatusOr<StringMatcher> string_matcher =
       StringMatcher::Create(type, match_string, case_sensitive);
   if (!string_matcher.ok()) {
-    return absl::InvalidArgumentError(
-        absl::StrCat("path matcher: ", string_matcher.status().message()));
+    errors->AddError(absl::StrCat("error creating path matcher: ",
+                                  string_matcher.status().message()));
+    return absl::nullopt;
   }
-  route->matchers.path_matcher = std::move(string_matcher.value());
-  return absl::OkStatus();
+  return std::move(*string_matcher);
 }
 
-absl::Status RouteHeaderMatchersParse(
-    const envoy_config_route_v3_RouteMatch* match,
-    XdsRouteConfigResource::Route* route) {
+void RouteHeaderMatchersParse(const envoy_config_route_v3_RouteMatch* match,
+                              XdsRouteConfigResource::Route* route,
+                              ValidationErrors* errors) {
   size_t size;
   const envoy_config_route_v3_HeaderMatcher* const* headers =
       envoy_config_route_v3_RouteMatch_headers(match, &size);
   for (size_t i = 0; i < size; ++i) {
+    ValidationErrors::ScopedField field(errors,
+                                        absl::StrCat(".headers[", i, "]"));
     const envoy_config_route_v3_HeaderMatcher* header = headers[i];
+    GPR_ASSERT(header != nullptr);
     const std::string name =
         UpbStringToStdString(envoy_config_route_v3_HeaderMatcher_name(header));
     HeaderMatcher::Type type;
@@ -499,10 +487,23 @@ absl::Status RouteHeaderMatchersParse(
     int64_t range_start = 0;
     int64_t range_end = 0;
     bool present_match = false;
+    bool case_sensitive = true;
     if (envoy_config_route_v3_HeaderMatcher_has_exact_match(header)) {
       type = HeaderMatcher::Type::kExact;
       match_string = UpbStringToStdString(
           envoy_config_route_v3_HeaderMatcher_exact_match(header));
+    } else if (envoy_config_route_v3_HeaderMatcher_has_prefix_match(header)) {
+      type = HeaderMatcher::Type::kPrefix;
+      match_string = UpbStringToStdString(
+          envoy_config_route_v3_HeaderMatcher_prefix_match(header));
+    } else if (envoy_config_route_v3_HeaderMatcher_has_suffix_match(header)) {
+      type = HeaderMatcher::Type::kSuffix;
+      match_string = UpbStringToStdString(
+          envoy_config_route_v3_HeaderMatcher_suffix_match(header));
+    } else if (envoy_config_route_v3_HeaderMatcher_has_contains_match(header)) {
+      type = HeaderMatcher::Type::kContains;
+      match_string = UpbStringToStdString(
+          envoy_config_route_v3_HeaderMatcher_contains_match(header));
     } else if (envoy_config_route_v3_HeaderMatcher_has_safe_regex_match(
                    header)) {
       const envoy_type_matcher_v3_RegexMatcher* regex_matcher =
@@ -515,45 +516,67 @@ absl::Status RouteHeaderMatchersParse(
       type = HeaderMatcher::Type::kRange;
       const envoy_type_v3_Int64Range* range_matcher =
           envoy_config_route_v3_HeaderMatcher_range_match(header);
+      GPR_ASSERT(range_matcher != nullptr);
       range_start = envoy_type_v3_Int64Range_start(range_matcher);
       range_end = envoy_type_v3_Int64Range_end(range_matcher);
     } else if (envoy_config_route_v3_HeaderMatcher_has_present_match(header)) {
       type = HeaderMatcher::Type::kPresent;
       present_match = envoy_config_route_v3_HeaderMatcher_present_match(header);
-    } else if (envoy_config_route_v3_HeaderMatcher_has_prefix_match(header)) {
-      type = HeaderMatcher::Type::kPrefix;
-      match_string = UpbStringToStdString(
-          envoy_config_route_v3_HeaderMatcher_prefix_match(header));
-    } else if (envoy_config_route_v3_HeaderMatcher_has_suffix_match(header)) {
-      type = HeaderMatcher::Type::kSuffix;
-      match_string = UpbStringToStdString(
-          envoy_config_route_v3_HeaderMatcher_suffix_match(header));
-    } else if (envoy_config_route_v3_HeaderMatcher_has_contains_match(header)) {
-      type = HeaderMatcher::Type::kContains;
-      match_string = UpbStringToStdString(
-          envoy_config_route_v3_HeaderMatcher_contains_match(header));
+    } else if (envoy_config_route_v3_HeaderMatcher_has_string_match(header)) {
+      ValidationErrors::ScopedField field(errors, ".string_match");
+      const auto* matcher =
+          envoy_config_route_v3_HeaderMatcher_string_match(header);
+      GPR_ASSERT(matcher != nullptr);
+      if (envoy_type_matcher_v3_StringMatcher_has_exact(matcher)) {
+        type = HeaderMatcher::Type::kExact;
+        match_string = UpbStringToStdString(
+            envoy_type_matcher_v3_StringMatcher_exact(matcher));
+      } else if (envoy_type_matcher_v3_StringMatcher_has_prefix(matcher)) {
+        type = HeaderMatcher::Type::kPrefix;
+        match_string = UpbStringToStdString(
+            envoy_type_matcher_v3_StringMatcher_prefix(matcher));
+      } else if (envoy_type_matcher_v3_StringMatcher_has_suffix(matcher)) {
+        type = HeaderMatcher::Type::kSuffix;
+        match_string = UpbStringToStdString(
+            envoy_type_matcher_v3_StringMatcher_suffix(matcher));
+      } else if (envoy_type_matcher_v3_StringMatcher_has_contains(matcher)) {
+        type = HeaderMatcher::Type::kContains;
+        match_string = UpbStringToStdString(
+            envoy_type_matcher_v3_StringMatcher_contains(matcher));
+      } else if (envoy_type_matcher_v3_StringMatcher_has_safe_regex(matcher)) {
+        type = HeaderMatcher::Type::kSafeRegex;
+        const auto* regex_matcher =
+            envoy_type_matcher_v3_StringMatcher_safe_regex(matcher);
+        GPR_ASSERT(regex_matcher != nullptr);
+        match_string = UpbStringToStdString(
+            envoy_type_matcher_v3_RegexMatcher_regex(regex_matcher));
+      } else {
+        errors->AddError("invalid string matcher");
+        continue;
+      }
+      case_sensitive =
+          !envoy_type_matcher_v3_StringMatcher_ignore_case(matcher);
     } else {
-      return absl::InvalidArgumentError(
-          "Invalid route header matcher specified.");
+      errors->AddError("invalid header matcher");
+      continue;
     }
     bool invert_match =
         envoy_config_route_v3_HeaderMatcher_invert_match(header);
     absl::StatusOr<HeaderMatcher> header_matcher =
         HeaderMatcher::Create(name, type, match_string, range_start, range_end,
-                              present_match, invert_match);
+                              present_match, invert_match, case_sensitive);
     if (!header_matcher.ok()) {
-      return absl::InvalidArgumentError(
-          absl::StrCat("header matcher: ", header_matcher.status().message()));
+      errors->AddError(absl::StrCat("cannot create header matcher: ",
+                                    header_matcher.status().message()));
+    } else {
+      route->matchers.header_matchers.emplace_back(std::move(*header_matcher));
     }
-    route->matchers.header_matchers.emplace_back(
-        std::move(header_matcher.value()));
   }
-  return absl::OkStatus();
 }
 
-absl::Status RouteRuntimeFractionParse(
-    const envoy_config_route_v3_RouteMatch* match,
-    XdsRouteConfigResource::Route* route) {
+void RouteRuntimeFractionParse(const envoy_config_route_v3_RouteMatch* match,
+                               XdsRouteConfigResource::Route* route,
+                               ValidationErrors* errors) {
   const envoy_config_core_v3_RuntimeFractionalPercent* runtime_fraction =
       envoy_config_route_v3_RouteMatch_runtime_fraction(match);
   if (runtime_fraction != nullptr) {
@@ -562,9 +585,8 @@ absl::Status RouteRuntimeFractionParse(
             runtime_fraction);
     if (fraction != nullptr) {
       uint32_t numerator = envoy_type_v3_FractionalPercent_numerator(fraction);
-      const auto denominator =
-          static_cast<envoy_type_v3_FractionalPercent_DenominatorType>(
-              envoy_type_v3_FractionalPercent_denominator(fraction));
+      const uint32_t denominator =
+          envoy_type_v3_FractionalPercent_denominator(fraction);
       // Normalize to million.
       switch (denominator) {
         case envoy_type_v3_FractionalPercent_HUNDRED:
@@ -575,100 +597,98 @@ absl::Status RouteRuntimeFractionParse(
           break;
         case envoy_type_v3_FractionalPercent_MILLION:
           break;
-        default:
-          return absl::InvalidArgumentError("Unknown denominator type");
+        default: {
+          ValidationErrors::ScopedField field(
+              errors, ".runtime_fraction.default_value.denominator");
+          errors->AddError("unknown denominator type");
+          return;
+        }
       }
       route->matchers.fraction_per_million = numerator;
     }
   }
-  return GRPC_ERROR_NONE;
 }
 
 template <typename ParentType, typename EntryType>
-absl::StatusOr<XdsRouteConfigResource::TypedPerFilterConfig>
-ParseTypedPerFilterConfig(
+XdsRouteConfigResource::TypedPerFilterConfig ParseTypedPerFilterConfig(
     const XdsResourceType::DecodeContext& context, const ParentType* parent,
     const EntryType* (*entry_func)(const ParentType*, size_t*),
     upb_StringView (*key_func)(const EntryType*),
-    const google_protobuf_Any* (*value_func)(const EntryType*)) {
+    const google_protobuf_Any* (*value_func)(const EntryType*),
+    ValidationErrors* errors) {
   XdsRouteConfigResource::TypedPerFilterConfig typed_per_filter_config;
   size_t filter_it = kUpb_Map_Begin;
   while (true) {
     const auto* filter_entry = entry_func(parent, &filter_it);
     if (filter_entry == nullptr) break;
     absl::string_view key = UpbStringToAbsl(key_func(filter_entry));
-    if (key.empty()) {
-      return absl::InvalidArgumentError("empty filter name in map");
-    }
+    ValidationErrors::ScopedField field(errors, absl::StrCat("[", key, "]"));
+    if (key.empty()) errors->AddError("filter name must be non-empty");
     const google_protobuf_Any* any = value_func(filter_entry);
-    GPR_ASSERT(any != nullptr);
-    absl::string_view filter_type =
-        UpbStringToAbsl(google_protobuf_Any_type_url(any));
-    if (filter_type.empty()) {
-      return absl::InvalidArgumentError(
-          absl::StrCat("no filter config specified for filter name ", key));
-    }
+    auto extension = ExtractXdsExtension(context, any, errors);
+    if (!extension.has_value()) continue;
+    auto* extension_to_use = &*extension;
+    absl::optional<XdsExtension> nested_extension;
     bool is_optional = false;
-    if (filter_type ==
-        "type.googleapis.com/envoy.config.route.v3.FilterConfig") {
-      upb_StringView any_value = google_protobuf_Any_value(any);
+    if (extension->type == "envoy.config.route.v3.FilterConfig") {
+      absl::string_view* serialized_config =
+          absl::get_if<absl::string_view>(&extension->value);
+      if (serialized_config == nullptr) {
+        errors->AddError("could not parse FilterConfig");
+        continue;
+      }
       const auto* filter_config = envoy_config_route_v3_FilterConfig_parse(
-          any_value.data, any_value.size, context.arena);
+          serialized_config->data(), serialized_config->size(), context.arena);
       if (filter_config == nullptr) {
-        return absl::InvalidArgumentError(
-            absl::StrCat("could not parse FilterConfig wrapper for ", key));
+        errors->AddError("could not parse FilterConfig");
+        continue;
       }
       is_optional =
           envoy_config_route_v3_FilterConfig_is_optional(filter_config);
       any = envoy_config_route_v3_FilterConfig_config(filter_config);
-      if (any == nullptr) {
-        if (is_optional) continue;
-        return absl::InvalidArgumentError(
-            absl::StrCat("no filter config specified for filter name ", key));
-      }
+      extension->validation_fields.emplace_back(errors, ".config");
+      nested_extension = ExtractXdsExtension(context, any, errors);
+      if (!nested_extension.has_value()) continue;
+      extension_to_use = &*nested_extension;
     }
-    auto type = ExtractExtensionTypeName(context, any);
-    if (!type.ok()) return type.status();
+    const auto& http_filter_registry =
+        static_cast<const GrpcXdsBootstrap&>(context.client->bootstrap())
+            .http_filter_registry();
     const XdsHttpFilterImpl* filter_impl =
-        XdsHttpFilterRegistry::GetFilterForType(type->type);
+        http_filter_registry.GetFilterForType(extension_to_use->type);
     if (filter_impl == nullptr) {
-      if (is_optional) continue;
-      return absl::InvalidArgumentError(
-          absl::StrCat("no filter registered for config type ", type->type));
+      if (!is_optional) errors->AddError("unsupported filter type");
+      continue;
     }
-    absl::StatusOr<XdsHttpFilterImpl::FilterConfig> filter_config =
+    absl::optional<XdsHttpFilterImpl::FilterConfig> filter_config =
         filter_impl->GenerateFilterConfigOverride(
-            google_protobuf_Any_value(any), context.arena);
-    if (!filter_config.ok()) {
-      return absl::InvalidArgumentError(
-          absl::StrCat("filter config for type ", type->type,
-                       " failed to parse: ", filter_config.status().message()));
+            context, std::move(*extension_to_use), errors);
+    if (filter_config.has_value()) {
+      typed_per_filter_config[std::string(key)] = std::move(*filter_config);
     }
-    typed_per_filter_config[std::string(key)] = std::move(*filter_config);
   }
   return typed_per_filter_config;
 }
 
-absl::Status RetryPolicyParse(
+XdsRouteConfigResource::RetryPolicy RetryPolicyParse(
     const XdsResourceType::DecodeContext& context,
-    const envoy_config_route_v3_RetryPolicy* retry_policy,
-    absl::optional<XdsRouteConfigResource::RetryPolicy>* retry) {
-  std::vector<std::string> errors;
-  XdsRouteConfigResource::RetryPolicy retry_to_return;
+    const envoy_config_route_v3_RetryPolicy* retry_policy_proto,
+    ValidationErrors* errors) {
+  XdsRouteConfigResource::RetryPolicy retry_policy;
   auto retry_on = UpbStringToStdString(
-      envoy_config_route_v3_RetryPolicy_retry_on(retry_policy));
+      envoy_config_route_v3_RetryPolicy_retry_on(retry_policy_proto));
   std::vector<absl::string_view> codes = absl::StrSplit(retry_on, ',');
   for (const auto& code : codes) {
     if (code == "cancelled") {
-      retry_to_return.retry_on.Add(GRPC_STATUS_CANCELLED);
+      retry_policy.retry_on.Add(GRPC_STATUS_CANCELLED);
     } else if (code == "deadline-exceeded") {
-      retry_to_return.retry_on.Add(GRPC_STATUS_DEADLINE_EXCEEDED);
+      retry_policy.retry_on.Add(GRPC_STATUS_DEADLINE_EXCEEDED);
     } else if (code == "internal") {
-      retry_to_return.retry_on.Add(GRPC_STATUS_INTERNAL);
+      retry_policy.retry_on.Add(GRPC_STATUS_INTERNAL);
     } else if (code == "resource-exhausted") {
-      retry_to_return.retry_on.Add(GRPC_STATUS_RESOURCE_EXHAUSTED);
+      retry_policy.retry_on.Add(GRPC_STATUS_RESOURCE_EXHAUSTED);
     } else if (code == "unavailable") {
-      retry_to_return.retry_on.Add(GRPC_STATUS_UNAVAILABLE);
+      retry_policy.retry_on.Add(GRPC_STATUS_UNAVAILABLE);
     } else {
       if (GRPC_TRACE_FLAG_ENABLED(*context.tracer)) {
         gpr_log(GPR_INFO, "Unsupported retry_on policy %s.",
@@ -677,187 +697,90 @@ absl::Status RetryPolicyParse(
     }
   }
   const google_protobuf_UInt32Value* num_retries =
-      envoy_config_route_v3_RetryPolicy_num_retries(retry_policy);
+      envoy_config_route_v3_RetryPolicy_num_retries(retry_policy_proto);
   if (num_retries != nullptr) {
     uint32_t num_retries_value = google_protobuf_UInt32Value_value(num_retries);
     if (num_retries_value == 0) {
-      errors.emplace_back(
-          "RouteAction RetryPolicy num_retries set to invalid value 0.");
+      ValidationErrors::ScopedField field(errors, ".num_retries");
+      errors->AddError("must be greater than 0");
     } else {
-      retry_to_return.num_retries = num_retries_value;
+      retry_policy.num_retries = num_retries_value;
     }
   } else {
-    retry_to_return.num_retries = 1;
+    retry_policy.num_retries = 1;
   }
   const envoy_config_route_v3_RetryPolicy_RetryBackOff* backoff =
-      envoy_config_route_v3_RetryPolicy_retry_back_off(retry_policy);
+      envoy_config_route_v3_RetryPolicy_retry_back_off(retry_policy_proto);
   if (backoff != nullptr) {
-    const google_protobuf_Duration* base_interval =
-        envoy_config_route_v3_RetryPolicy_RetryBackOff_base_interval(backoff);
-    if (base_interval == nullptr) {
-      errors.emplace_back(
-          "RouteAction RetryPolicy RetryBackoff missing base interval.");
-    } else {
-      retry_to_return.retry_back_off.base_interval =
-          ParseDuration(base_interval);
+    ValidationErrors::ScopedField field(errors, ".retry_back_off");
+    {
+      ValidationErrors::ScopedField field(errors, ".base_interval");
+      const google_protobuf_Duration* base_interval =
+          envoy_config_route_v3_RetryPolicy_RetryBackOff_base_interval(backoff);
+      if (base_interval == nullptr) {
+        errors->AddError("field not present");
+      } else {
+        retry_policy.retry_back_off.base_interval =
+            ParseDuration(base_interval, errors);
+      }
     }
-    const google_protobuf_Duration* max_interval =
-        envoy_config_route_v3_RetryPolicy_RetryBackOff_max_interval(backoff);
-    Duration max;
-    if (max_interval != nullptr) {
-      max = ParseDuration(max_interval);
-    } else {
-      // if max interval is not set, it is 10x the base.
-      max = 10 * retry_to_return.retry_back_off.base_interval;
+    {
+      ValidationErrors::ScopedField field(errors, ".max_interval");
+      const google_protobuf_Duration* max_interval =
+          envoy_config_route_v3_RetryPolicy_RetryBackOff_max_interval(backoff);
+      Duration max;
+      if (max_interval != nullptr) {
+        max = ParseDuration(max_interval, errors);
+      } else {
+        // if max interval is not set, it is 10x the base.
+        max = 10 * retry_policy.retry_back_off.base_interval;
+      }
+      retry_policy.retry_back_off.max_interval = max;
     }
-    retry_to_return.retry_back_off.max_interval = max;
   } else {
-    retry_to_return.retry_back_off.base_interval = Duration::Milliseconds(25);
-    retry_to_return.retry_back_off.max_interval = Duration::Milliseconds(250);
-  }
-  // Return result.
-  if (!errors.empty()) {
-    return absl::InvalidArgumentError(absl::StrCat(
-        "Errors parsing retry policy: [", absl::StrJoin(errors, "; "), "]"));
+    retry_policy.retry_back_off.base_interval = Duration::Milliseconds(25);
+    retry_policy.retry_back_off.max_interval = Duration::Milliseconds(250);
   }
-  *retry = retry_to_return;
-  return absl::OkStatus();
+  return retry_policy;
 }
 
-absl::StatusOr<XdsRouteConfigResource::Route::RouteAction> RouteActionParse(
+absl::optional<XdsRouteConfigResource::Route::RouteAction> RouteActionParse(
     const XdsResourceType::DecodeContext& context,
-    const envoy_config_route_v3_Route* route_msg,
+    const envoy_config_route_v3_RouteAction* route_action_proto,
     const std::map<std::string /*cluster_specifier_plugin_name*/,
                    std::string /*LB policy config*/>&
         cluster_specifier_plugin_map,
-    bool* ignore_route) {
-  XdsRouteConfigResource::Route::RouteAction route;
-  const envoy_config_route_v3_RouteAction* route_action =
-      envoy_config_route_v3_Route_route(route_msg);
-  // Get the cluster or weighted_clusters in the RouteAction.
-  if (envoy_config_route_v3_RouteAction_has_cluster(route_action)) {
-    std::string cluster_name = UpbStringToStdString(
-        envoy_config_route_v3_RouteAction_cluster(route_action));
-    if (cluster_name.empty()) {
-      return absl::InvalidArgumentError(
-          "RouteAction cluster contains empty cluster name.");
-    }
-    route.action = XdsRouteConfigResource::Route::RouteAction::ClusterName{
-        std::move(cluster_name)};
-  } else if (envoy_config_route_v3_RouteAction_has_weighted_clusters(
-                 route_action)) {
-    std::vector<XdsRouteConfigResource::Route::RouteAction::ClusterWeight>
-        action_weighted_clusters;
-    const envoy_config_route_v3_WeightedCluster* weighted_cluster =
-        envoy_config_route_v3_RouteAction_weighted_clusters(route_action);
-    uint32_t total_weight = 100;
-    const google_protobuf_UInt32Value* weight =
-        envoy_config_route_v3_WeightedCluster_total_weight(weighted_cluster);
-    if (weight != nullptr) {
-      total_weight = google_protobuf_UInt32Value_value(weight);
-    }
-    size_t clusters_size;
-    const envoy_config_route_v3_WeightedCluster_ClusterWeight* const* clusters =
-        envoy_config_route_v3_WeightedCluster_clusters(weighted_cluster,
-                                                       &clusters_size);
-    uint32_t sum_of_weights = 0;
-    for (size_t j = 0; j < clusters_size; ++j) {
-      const envoy_config_route_v3_WeightedCluster_ClusterWeight*
-          cluster_weight = clusters[j];
-      XdsRouteConfigResource::Route::RouteAction::ClusterWeight cluster;
-      cluster.name = UpbStringToStdString(
-          envoy_config_route_v3_WeightedCluster_ClusterWeight_name(
-              cluster_weight));
-      if (cluster.name.empty()) {
-        return absl::InvalidArgumentError(
-            "RouteAction weighted_cluster cluster contains empty cluster "
-            "name.");
-      }
-      const google_protobuf_UInt32Value* weight =
-          envoy_config_route_v3_WeightedCluster_ClusterWeight_weight(
-              cluster_weight);
-      if (weight == nullptr) {
-        return absl::InvalidArgumentError(
-            "RouteAction weighted_cluster cluster missing weight");
-      }
-      cluster.weight = google_protobuf_UInt32Value_value(weight);
-      if (cluster.weight == 0) continue;
-      sum_of_weights += cluster.weight;
-      if (context.server.ShouldUseV3()) {
-        auto typed_per_filter_config = ParseTypedPerFilterConfig<
-            envoy_config_route_v3_WeightedCluster_ClusterWeight,
-            envoy_config_route_v3_WeightedCluster_ClusterWeight_TypedPerFilterConfigEntry>(
-            context, cluster_weight,
-            envoy_config_route_v3_WeightedCluster_ClusterWeight_typed_per_filter_config_next,
-            envoy_config_route_v3_WeightedCluster_ClusterWeight_TypedPerFilterConfigEntry_key,
-            envoy_config_route_v3_WeightedCluster_ClusterWeight_TypedPerFilterConfigEntry_value);
-        if (!typed_per_filter_config.ok()) {
-          return typed_per_filter_config.status();
-        }
-        cluster.typed_per_filter_config = std::move(*typed_per_filter_config);
-      }
-      action_weighted_clusters.emplace_back(std::move(cluster));
-    }
-    if (total_weight != sum_of_weights) {
-      return absl::InvalidArgumentError(
-          "RouteAction weighted_cluster has incorrect total weight");
-    }
-    if (action_weighted_clusters.empty()) {
-      return absl::InvalidArgumentError(
-          "RouteAction weighted_cluster has no valid clusters specified.");
-    }
-    route.action = std::move(action_weighted_clusters);
-  } else if (XdsRlsEnabled() &&
-             envoy_config_route_v3_RouteAction_has_cluster_specifier_plugin(
-                 route_action)) {
-    std::string plugin_name = UpbStringToStdString(
-        envoy_config_route_v3_RouteAction_cluster_specifier_plugin(
-            route_action));
-    if (plugin_name.empty()) {
-      return absl::InvalidArgumentError(
-          "RouteAction cluster contains empty cluster specifier plugin name.");
-    }
-    auto it = cluster_specifier_plugin_map.find(plugin_name);
-    if (it == cluster_specifier_plugin_map.end()) {
-      return absl::InvalidArgumentError(
-          absl::StrCat("RouteAction cluster contains cluster specifier plugin "
-                       "name not configured: ",
-                       plugin_name));
-    }
-    if (it->second.empty()) *ignore_route = true;
-    route.action =
-        XdsRouteConfigResource::Route::RouteAction::ClusterSpecifierPluginName{
-            std::move(plugin_name)};
-  } else {
-    // No cluster or weighted_clusters or plugin found in RouteAction, ignore
-    // this route.
-    *ignore_route = true;
-  }
-  if (!*ignore_route) {
-    const envoy_config_route_v3_RouteAction_MaxStreamDuration*
-        max_stream_duration =
-            envoy_config_route_v3_RouteAction_max_stream_duration(route_action);
-    if (max_stream_duration != nullptr) {
-      const google_protobuf_Duration* duration =
-          envoy_config_route_v3_RouteAction_MaxStreamDuration_grpc_timeout_header_max(
+    ValidationErrors* errors) {
+  XdsRouteConfigResource::Route::RouteAction route_action;
+  // grpc_timeout_header_max or max_stream_duration
+  const auto* max_stream_duration =
+      envoy_config_route_v3_RouteAction_max_stream_duration(route_action_proto);
+  if (max_stream_duration != nullptr) {
+    ValidationErrors::ScopedField field(errors, ".max_stream_duration");
+    const google_protobuf_Duration* duration =
+        envoy_config_route_v3_RouteAction_MaxStreamDuration_grpc_timeout_header_max(
+            max_stream_duration);
+    if (duration != nullptr) {
+      ValidationErrors::ScopedField field(errors, ".grpc_timeout_header_max");
+      route_action.max_stream_duration = ParseDuration(duration, errors);
+    } else {
+      duration =
+          envoy_config_route_v3_RouteAction_MaxStreamDuration_max_stream_duration(
               max_stream_duration);
-      if (duration == nullptr) {
-        duration =
-            envoy_config_route_v3_RouteAction_MaxStreamDuration_max_stream_duration(
-                max_stream_duration);
-      }
       if (duration != nullptr) {
-        route.max_stream_duration = ParseDuration(duration);
+        ValidationErrors::ScopedField field(errors, ".max_stream_duration");
+        route_action.max_stream_duration = ParseDuration(duration, errors);
       }
     }
   }
-  // Get HashPolicy from RouteAction
+  // hash_policy
   size_t size = 0;
   const envoy_config_route_v3_RouteAction_HashPolicy* const* hash_policies =
-      envoy_config_route_v3_RouteAction_hash_policy(route_action, &size);
+      envoy_config_route_v3_RouteAction_hash_policy(route_action_proto, &size);
   for (size_t i = 0; i < size; ++i) {
-    const envoy_config_route_v3_RouteAction_HashPolicy* hash_policy =
-        hash_policies[i];
+    ValidationErrors::ScopedField field(errors,
+                                        absl::StrCat(".hash_policy[", i, "]"));
+    const auto* hash_policy = hash_policies[i];
     XdsRouteConfigResource::Route::RouteAction::HashPolicy policy;
     policy.terminal =
         envoy_config_route_v3_RouteAction_HashPolicy_terminal(hash_policy);
@@ -866,94 +789,264 @@ absl::StatusOr<XdsRouteConfigResource::Route::RouteAction> RouteActionParse(
         filter_state;
     if ((header = envoy_config_route_v3_RouteAction_HashPolicy_header(
              hash_policy)) != nullptr) {
-      policy.type =
-          XdsRouteConfigResource::Route::RouteAction::HashPolicy::Type::HEADER;
-      policy.header_name = UpbStringToStdString(
+      // header
+      ValidationErrors::ScopedField field(errors, ".header");
+      XdsRouteConfigResource::Route::RouteAction::HashPolicy::Header
+          header_policy;
+      header_policy.header_name = UpbStringToStdString(
           envoy_config_route_v3_RouteAction_HashPolicy_Header_header_name(
               header));
-      const struct envoy_type_matcher_v3_RegexMatchAndSubstitute*
-          regex_rewrite =
-              envoy_config_route_v3_RouteAction_HashPolicy_Header_regex_rewrite(
-                  header);
+      if (header_policy.header_name.empty()) {
+        ValidationErrors::ScopedField field(errors, ".header_name");
+        errors->AddError("must be non-empty");
+      }
+      // regex_rewrite
+      const auto* regex_rewrite =
+          envoy_config_route_v3_RouteAction_HashPolicy_Header_regex_rewrite(
+              header);
       if (regex_rewrite != nullptr) {
-        const envoy_type_matcher_v3_RegexMatcher* regex_matcher =
+        ValidationErrors::ScopedField field(errors, ".regex_rewrite.pattern");
+        const auto* pattern =
             envoy_type_matcher_v3_RegexMatchAndSubstitute_pattern(
                 regex_rewrite);
-        if (regex_matcher == nullptr) {
-          gpr_log(
-              GPR_DEBUG,
-              "RouteAction HashPolicy contains policy specifier Header with "
-              "RegexMatchAndSubstitution but RegexMatcher pattern is "
-              "missing");
+        if (pattern == nullptr) {
+          errors->AddError("field not present");
+          continue;
+        }
+        ValidationErrors::ScopedField field2(errors, ".regex");
+        std::string regex = UpbStringToStdString(
+            envoy_type_matcher_v3_RegexMatcher_regex(pattern));
+        if (regex.empty()) {
+          errors->AddError("field not present");
           continue;
         }
         RE2::Options options;
-        policy.regex = absl::make_unique<RE2>(
-            UpbStringToStdString(
-                envoy_type_matcher_v3_RegexMatcher_regex(regex_matcher)),
-            options);
-        if (!policy.regex->ok()) {
-          gpr_log(
-              GPR_DEBUG,
-              "RouteAction HashPolicy contains policy specifier Header with "
-              "RegexMatchAndSubstitution but RegexMatcher pattern does not "
-              "compile");
+        header_policy.regex = std::make_unique<RE2>(regex, options);
+        if (!header_policy.regex->ok()) {
+          errors->AddError(absl::StrCat("errors compiling regex: ",
+                                        header_policy.regex->error()));
           continue;
         }
-        policy.regex_substitution = UpbStringToStdString(
+        header_policy.regex_substitution = UpbStringToStdString(
             envoy_type_matcher_v3_RegexMatchAndSubstitute_substitution(
                 regex_rewrite));
       }
+      policy.policy = std::move(header_policy);
     } else if ((filter_state =
                     envoy_config_route_v3_RouteAction_HashPolicy_filter_state(
                         hash_policy)) != nullptr) {
+      // filter_state
       std::string key = UpbStringToStdString(
           envoy_config_route_v3_RouteAction_HashPolicy_FilterState_key(
               filter_state));
-      if (key == "io.grpc.channel_id") {
-        policy.type = XdsRouteConfigResource::Route::RouteAction::HashPolicy::
-            Type::CHANNEL_ID;
-      } else {
-        gpr_log(GPR_DEBUG,
-                "RouteAction HashPolicy contains policy specifier "
-                "FilterState but "
-                "key is not io.grpc.channel_id.");
-        continue;
-      }
+      if (key != "io.grpc.channel_id") continue;
+      policy.policy =
+          XdsRouteConfigResource::Route::RouteAction::HashPolicy::ChannelId();
     } else {
-      gpr_log(GPR_DEBUG,
-              "RouteAction HashPolicy contains unsupported policy specifier.");
+      // Unsupported hash policy type, ignore it.
       continue;
     }
-    route.hash_policies.emplace_back(std::move(policy));
+    route_action.hash_policies.emplace_back(std::move(policy));
   }
   // Get retry policy
   const envoy_config_route_v3_RetryPolicy* retry_policy =
-      envoy_config_route_v3_RouteAction_retry_policy(route_action);
+      envoy_config_route_v3_RouteAction_retry_policy(route_action_proto);
   if (retry_policy != nullptr) {
-    absl::optional<XdsRouteConfigResource::RetryPolicy> retry;
-    absl::Status status = RetryPolicyParse(context, retry_policy, &retry);
-    if (!status.ok()) return status;
-    route.retry_policy = retry;
+    ValidationErrors::ScopedField field(errors, ".retry_policy");
+    route_action.retry_policy = RetryPolicyParse(context, retry_policy, errors);
+  }
+  // Parse cluster specifier, which is one of several options.
+  if (envoy_config_route_v3_RouteAction_has_cluster(route_action_proto)) {
+    // Cluster name.
+    std::string cluster_name = UpbStringToStdString(
+        envoy_config_route_v3_RouteAction_cluster(route_action_proto));
+    if (cluster_name.empty()) {
+      ValidationErrors::ScopedField field(errors, ".cluster");
+      errors->AddError("must be non-empty");
+    }
+    route_action.action =
+        XdsRouteConfigResource::Route::RouteAction::ClusterName{
+            std::move(cluster_name)};
+  } else if (envoy_config_route_v3_RouteAction_has_weighted_clusters(
+                 route_action_proto)) {
+    // WeightedClusters.
+    ValidationErrors::ScopedField field(errors, ".weighted_clusters");
+    const envoy_config_route_v3_WeightedCluster* weighted_clusters_proto =
+        envoy_config_route_v3_RouteAction_weighted_clusters(route_action_proto);
+    GPR_ASSERT(weighted_clusters_proto != nullptr);
+    std::vector<XdsRouteConfigResource::Route::RouteAction::ClusterWeight>
+        action_weighted_clusters;
+    uint64_t total_weight = 0;
+    size_t clusters_size;
+    const envoy_config_route_v3_WeightedCluster_ClusterWeight* const* clusters =
+        envoy_config_route_v3_WeightedCluster_clusters(weighted_clusters_proto,
+                                                       &clusters_size);
+    for (size_t i = 0; i < clusters_size; ++i) {
+      ValidationErrors::ScopedField field(errors,
+                                          absl::StrCat(".clusters[", i, "]"));
+      const auto* cluster_proto = clusters[i];
+      XdsRouteConfigResource::Route::RouteAction::ClusterWeight cluster;
+      // typed_per_filter_config
+      {
+        ValidationErrors::ScopedField field(errors, ".typed_per_filter_config");
+        cluster.typed_per_filter_config = ParseTypedPerFilterConfig<
+            envoy_config_route_v3_WeightedCluster_ClusterWeight,
+            envoy_config_route_v3_WeightedCluster_ClusterWeight_TypedPerFilterConfigEntry>(
+            context, cluster_proto,
+            envoy_config_route_v3_WeightedCluster_ClusterWeight_typed_per_filter_config_next,
+            envoy_config_route_v3_WeightedCluster_ClusterWeight_TypedPerFilterConfigEntry_key,
+            envoy_config_route_v3_WeightedCluster_ClusterWeight_TypedPerFilterConfigEntry_value,
+            errors);
+      }
+      // name
+      cluster.name = UpbStringToStdString(
+          envoy_config_route_v3_WeightedCluster_ClusterWeight_name(
+              cluster_proto));
+      if (cluster.name.empty()) {
+        ValidationErrors::ScopedField field(errors, ".name");
+        errors->AddError("must be non-empty");
+      }
+      // weight
+      const google_protobuf_UInt32Value* weight_proto =
+          envoy_config_route_v3_WeightedCluster_ClusterWeight_weight(
+              cluster_proto);
+      if (weight_proto == nullptr) {
+        ValidationErrors::ScopedField field(errors, ".weight");
+        errors->AddError("field not present");
+      } else {
+        cluster.weight = google_protobuf_UInt32Value_value(weight_proto);
+        if (cluster.weight == 0) continue;
+        total_weight += cluster.weight;
+      }
+      // Add entry to WeightedClusters.
+      action_weighted_clusters.emplace_back(std::move(cluster));
+    }
+    if (action_weighted_clusters.empty()) {
+      errors->AddError("no valid clusters specified");
+    } else if (total_weight > std::numeric_limits<uint32_t>::max()) {
+      errors->AddError("sum of cluster weights exceeds uint32 max");
+    }
+    route_action.action = std::move(action_weighted_clusters);
+  } else if (XdsRlsEnabled() &&
+             envoy_config_route_v3_RouteAction_has_cluster_specifier_plugin(
+                 route_action_proto)) {
+    // ClusterSpecifierPlugin
+    ValidationErrors::ScopedField field(errors, ".cluster_specifier_plugin");
+    std::string plugin_name = UpbStringToStdString(
+        envoy_config_route_v3_RouteAction_cluster_specifier_plugin(
+            route_action_proto));
+    if (plugin_name.empty()) {
+      errors->AddError("must be non-empty");
+      return absl::nullopt;
+    }
+    auto it = cluster_specifier_plugin_map.find(plugin_name);
+    if (it == cluster_specifier_plugin_map.end()) {
+      errors->AddError(absl::StrCat("unknown cluster specifier plugin name \"",
+                                    plugin_name, "\""));
+    } else {
+      // If the cluster specifier config is empty, that means that the
+      // plugin was unsupported but optional.  In that case, skip this route.
+      if (it->second.empty()) return absl::nullopt;
+    }
+    route_action.action =
+        XdsRouteConfigResource::Route::RouteAction::ClusterSpecifierPluginName{
+            std::move(plugin_name)};
+  } else {
+    // Not a supported cluster specifier, so ignore this route.
+    return absl::nullopt;
+  }
+  return route_action;
+}
+
+absl::optional<XdsRouteConfigResource::Route> ParseRoute(
+    const XdsResourceType::DecodeContext& context,
+    const envoy_config_route_v3_Route* route_proto,
+    const absl::optional<XdsRouteConfigResource::RetryPolicy>&
+        virtual_host_retry_policy,
+    const XdsRouteConfigResource::ClusterSpecifierPluginMap&
+        cluster_specifier_plugin_map,
+    std::set<absl::string_view>* cluster_specifier_plugins_not_seen,
+    ValidationErrors* errors) {
+  XdsRouteConfigResource::Route route;
+  // Parse route match.
+  {
+    ValidationErrors::ScopedField field(errors, ".match");
+    const auto* match = envoy_config_route_v3_Route_match(route_proto);
+    if (match == nullptr) {
+      errors->AddError("field not present");
+      return absl::nullopt;
+    }
+    // Skip routes with query_parameters set.
+    size_t query_parameters_size;
+    static_cast<void>(envoy_config_route_v3_RouteMatch_query_parameters(
+        match, &query_parameters_size));
+    if (query_parameters_size > 0) return absl::nullopt;
+    // Parse matchers.
+    auto path_matcher = RoutePathMatchParse(match, errors);
+    if (!path_matcher.has_value()) return absl::nullopt;
+    route.matchers.path_matcher = std::move(*path_matcher);
+    RouteHeaderMatchersParse(match, &route, errors);
+    RouteRuntimeFractionParse(match, &route, errors);
+  }
+  // Parse route action.
+  const envoy_config_route_v3_RouteAction* route_action_proto =
+      envoy_config_route_v3_Route_route(route_proto);
+  if (route_action_proto != nullptr) {
+    ValidationErrors::ScopedField field(errors, ".route");
+    auto route_action = RouteActionParse(context, route_action_proto,
+                                         cluster_specifier_plugin_map, errors);
+    if (!route_action.has_value()) return absl::nullopt;
+    // If the route does not have a retry policy but the vhost does,
+    // use the vhost retry policy for this route.
+    if (!route_action->retry_policy.has_value()) {
+      route_action->retry_policy = virtual_host_retry_policy;
+    }
+    // Mark off plugins used in route action.
+    auto* cluster_specifier_action = absl::get_if<
+        XdsRouteConfigResource::Route::RouteAction::ClusterSpecifierPluginName>(
+        &route_action->action);
+    if (cluster_specifier_action != nullptr) {
+      cluster_specifier_plugins_not_seen->erase(
+          cluster_specifier_action->cluster_specifier_plugin_name);
+    }
+    route.action = std::move(*route_action);
+  } else if (envoy_config_route_v3_Route_has_non_forwarding_action(
+                 route_proto)) {
+    route.action = XdsRouteConfigResource::Route::NonForwardingAction();
+  } else {
+    // Leave route.action initialized to UnknownAction (its default).
+  }
+  // Parse typed_per_filter_config.
+  {
+    ValidationErrors::ScopedField field(errors, ".typed_per_filter_config");
+    route.typed_per_filter_config = ParseTypedPerFilterConfig<
+        envoy_config_route_v3_Route,
+        envoy_config_route_v3_Route_TypedPerFilterConfigEntry>(
+        context, route_proto,
+        envoy_config_route_v3_Route_typed_per_filter_config_next,
+        envoy_config_route_v3_Route_TypedPerFilterConfigEntry_key,
+        envoy_config_route_v3_Route_TypedPerFilterConfigEntry_value, errors);
   }
   return route;
 }
 
 }  // namespace
 
-absl::StatusOr<XdsRouteConfigResource> XdsRouteConfigResource::Parse(
+XdsRouteConfigResource XdsRouteConfigResource::Parse(
     const XdsResourceType::DecodeContext& context,
-    const envoy_config_route_v3_RouteConfiguration* route_config) {
+    const envoy_config_route_v3_RouteConfiguration* route_config,
+    ValidationErrors* errors) {
   XdsRouteConfigResource rds_update;
-  // Get the cluster spcifier plugins
+  // Get the cluster spcifier plugin map.
   if (XdsRlsEnabled()) {
-    auto cluster_specifier_plugin_map =
-        ClusterSpecifierPluginParse(context, route_config);
-    if (!cluster_specifier_plugin_map.ok()) {
-      return cluster_specifier_plugin_map.status();
-    }
     rds_update.cluster_specifier_plugin_map =
-        std::move(*cluster_specifier_plugin_map);
+        ClusterSpecifierPluginParse(context, route_config, errors);
+  }
+  // Build a set of configured cluster_specifier_plugin names to make sure
+  // each is actually referenced by a route action.
+  std::set<absl::string_view> cluster_specifier_plugins_not_seen;
+  for (auto& plugin : rds_update.cluster_specifier_plugin_map) {
+    cluster_specifier_plugins_not_seen.emplace(plugin.first);
   }
   // Get the virtual hosts.
   size_t num_virtual_hosts;
@@ -961,6 +1054,8 @@ absl::StatusOr<XdsRouteConfigResource> XdsRouteConfigResource::Parse(
       envoy_config_route_v3_RouteConfiguration_virtual_hosts(
           route_config, &num_virtual_hosts);
   for (size_t i = 0; i < num_virtual_hosts; ++i) {
+    ValidationErrors::ScopedField field(
+        errors, absl::StrCat(".virtual_hosts[", i, "]"));
     rds_update.virtual_hosts.emplace_back();
     XdsRouteConfigResource::VirtualHost& vhost =
         rds_update.virtual_hosts.back();
@@ -971,27 +1066,28 @@ absl::StatusOr<XdsRouteConfigResource> XdsRouteConfigResource::Parse(
     for (size_t j = 0; j < domain_size; ++j) {
       std::string domain_pattern = UpbStringToStdString(domains[j]);
       if (!XdsRouting::IsValidDomainPattern(domain_pattern)) {
-        return absl::InvalidArgumentError(
-            absl::StrCat("Invalid domain pattern \"", domain_pattern, "\"."));
+        ValidationErrors::ScopedField field(errors,
+                                            absl::StrCat(".domains[", j, "]"));
+        errors->AddError(
+            absl::StrCat("invalid domain pattern \"", domain_pattern, "\""));
       }
       vhost.domains.emplace_back(std::move(domain_pattern));
     }
     if (vhost.domains.empty()) {
-      return absl::InvalidArgumentError("VirtualHost has no domains");
+      ValidationErrors::ScopedField field(errors, ".domains");
+      errors->AddError("must be non-empty");
     }
     // Parse typed_per_filter_config.
-    if (context.server.ShouldUseV3()) {
-      auto typed_per_filter_config = ParseTypedPerFilterConfig<
+    {
+      ValidationErrors::ScopedField field(errors, ".typed_per_filter_config");
+      vhost.typed_per_filter_config = ParseTypedPerFilterConfig<
           envoy_config_route_v3_VirtualHost,
           envoy_config_route_v3_VirtualHost_TypedPerFilterConfigEntry>(
           context, virtual_hosts[i],
           envoy_config_route_v3_VirtualHost_typed_per_filter_config_next,
           envoy_config_route_v3_VirtualHost_TypedPerFilterConfigEntry_key,
-          envoy_config_route_v3_VirtualHost_TypedPerFilterConfigEntry_value);
-      if (!typed_per_filter_config.ok()) {
-        return typed_per_filter_config.status();
-      }
-      vhost.typed_per_filter_config = std::move(*typed_per_filter_config);
+          envoy_config_route_v3_VirtualHost_TypedPerFilterConfigEntry_value,
+          errors);
     }
     // Parse retry policy.
     absl::optional<XdsRouteConfigResource::RetryPolicy>
@@ -999,94 +1095,28 @@ absl::StatusOr<XdsRouteConfigResource> XdsRouteConfigResource::Parse(
     const envoy_config_route_v3_RetryPolicy* retry_policy =
         envoy_config_route_v3_VirtualHost_retry_policy(virtual_hosts[i]);
     if (retry_policy != nullptr) {
-      absl::Status status =
-          RetryPolicyParse(context, retry_policy, &virtual_host_retry_policy);
-      if (!status.ok()) return status;
+      ValidationErrors::ScopedField field(errors, ".retry_policy");
+      virtual_host_retry_policy =
+          RetryPolicyParse(context, retry_policy, errors);
     }
     // Parse routes.
+    ValidationErrors::ScopedField field2(errors, ".routes");
     size_t num_routes;
     const envoy_config_route_v3_Route* const* routes =
         envoy_config_route_v3_VirtualHost_routes(virtual_hosts[i], &num_routes);
-    if (num_routes < 1) {
-      return absl::InvalidArgumentError("No route found in the virtual host.");
-    }
-    // Build a set of cluster_specifier_plugin configured to make sure each is
-    // actually referenced by a route action.
-    std::set<absl::string_view> cluster_specifier_plugins;
-    for (auto& plugin : rds_update.cluster_specifier_plugin_map) {
-      cluster_specifier_plugins.emplace(plugin.first);
-    }
-    // Loop over the whole list of routes
     for (size_t j = 0; j < num_routes; ++j) {
-      const envoy_config_route_v3_RouteMatch* match =
-          envoy_config_route_v3_Route_match(routes[j]);
-      if (match == nullptr) {
-        return absl::InvalidArgumentError("Match can't be null.");
-      }
-      size_t query_parameters_size;
-      static_cast<void>(envoy_config_route_v3_RouteMatch_query_parameters(
-          match, &query_parameters_size));
-      if (query_parameters_size > 0) {
-        continue;
-      }
-      XdsRouteConfigResource::Route route;
-      bool ignore_route = false;
-      absl::Status status = RoutePathMatchParse(match, &route, &ignore_route);
-      if (!status.ok()) return status;
-      if (ignore_route) continue;
-      status = RouteHeaderMatchersParse(match, &route);
-      if (!status.ok()) return status;
-      status = RouteRuntimeFractionParse(match, &route);
-      if (!status.ok()) return status;
-      if (envoy_config_route_v3_Route_has_route(routes[j])) {
-        route.action.emplace<XdsRouteConfigResource::Route::RouteAction>();
-        auto route_action = RouteActionParse(
-            context, routes[j], rds_update.cluster_specifier_plugin_map,
-            &ignore_route);
-        if (!route_action.ok()) return route_action.status();
-        if (ignore_route) continue;
-        if (route_action->retry_policy == absl::nullopt &&
-            retry_policy != nullptr) {
-          route_action->retry_policy = virtual_host_retry_policy;
-        }
-        // Mark off plugins used in route action.
-        auto* cluster_specifier_action =
-            absl::get_if<XdsRouteConfigResource::Route::RouteAction::
-                             ClusterSpecifierPluginName>(&route_action->action);
-        if (cluster_specifier_action != nullptr) {
-          cluster_specifier_plugins.erase(
-              cluster_specifier_action->cluster_specifier_plugin_name);
-        }
-        route.action = std::move(*route_action);
-      } else if (envoy_config_route_v3_Route_has_non_forwarding_action(
-                     routes[j])) {
-        route.action
-            .emplace<XdsRouteConfigResource::Route::NonForwardingAction>();
-      }
-      if (context.server.ShouldUseV3()) {
-        auto typed_per_filter_config = ParseTypedPerFilterConfig<
-            envoy_config_route_v3_Route,
-            envoy_config_route_v3_Route_TypedPerFilterConfigEntry>(
-            context, routes[j],
-            envoy_config_route_v3_Route_typed_per_filter_config_next,
-            envoy_config_route_v3_Route_TypedPerFilterConfigEntry_key,
-            envoy_config_route_v3_Route_TypedPerFilterConfigEntry_value);
-        if (!typed_per_filter_config.ok()) {
-          return typed_per_filter_config.status();
-        }
-        route.typed_per_filter_config = std::move(*typed_per_filter_config);
-      }
-      vhost.routes.emplace_back(std::move(route));
-    }
-    if (vhost.routes.empty()) {
-      return absl::InvalidArgumentError("No valid routes specified.");
-    }
-    // For plugins not used in route action, delete from the update to prevent
-    // further use.
-    for (auto& unused_plugin : cluster_specifier_plugins) {
-      rds_update.cluster_specifier_plugin_map.erase(std::string(unused_plugin));
+      ValidationErrors::ScopedField field(errors, absl::StrCat("[", j, "]"));
+      auto route = ParseRoute(context, routes[j], virtual_host_retry_policy,
+                              rds_update.cluster_specifier_plugin_map,
+                              &cluster_specifier_plugins_not_seen, errors);
+      if (route.has_value()) vhost.routes.emplace_back(std::move(*route));
     }
   }
+  // For cluster specifier plugins that were not used in any route action,
+  // delete them from the update, since they will never be used.
+  for (auto& unused_plugin : cluster_specifier_plugins_not_seen) {
+    rds_update.cluster_specifier_plugin_map.erase(std::string(unused_plugin));
+  }
   return rds_update;
 }
 
@@ -1114,7 +1144,7 @@ void MaybeLogRouteConfiguration(
 
 XdsResourceType::DecodeResult XdsRouteConfigResourceType::Decode(
     const XdsResourceType::DecodeContext& context,
-    absl::string_view serialized_resource, bool /*is_v2*/) const {
+    absl::string_view serialized_resource) const {
   DecodeResult result;
   // Parse serialized proto.
   auto* resource = envoy_config_route_v3_RouteConfiguration_parse(
@@ -1128,23 +1158,25 @@ XdsResourceType::DecodeResult XdsRouteConfigResourceType::Decode(
   // Validate resource.
   result.name = UpbStringToStdString(
       envoy_config_route_v3_RouteConfiguration_name(resource));
-  auto rds_update = XdsRouteConfigResource::Parse(context, resource);
-  if (!rds_update.ok()) {
+  ValidationErrors errors;
+  auto rds_update = XdsRouteConfigResource::Parse(context, resource, &errors);
+  if (!errors.ok()) {
+    absl::Status status =
+        errors.status(absl::StatusCode::kInvalidArgument,
+                      "errors validating RouteConfiguration resource");
     if (GRPC_TRACE_FLAG_ENABLED(*context.tracer)) {
       gpr_log(GPR_ERROR, "[xds_client %p] invalid RouteConfiguration %s: %s",
-              context.client, result.name->c_str(),
-              rds_update.status().ToString().c_str());
+              context.client, result.name->c_str(), status.ToString().c_str());
     }
-    result.resource = rds_update.status();
+    result.resource = std::move(status);
   } else {
     if (GRPC_TRACE_FLAG_ENABLED(*context.tracer)) {
       gpr_log(GPR_INFO, "[xds_client %p] parsed RouteConfiguration %s: %s",
               context.client, result.name->c_str(),
-              rds_update->ToString().c_str());
+              rds_update.ToString().c_str());
     }
-    auto resource = absl::make_unique<ResourceDataSubclass>();
-    resource->resource = std::move(*rds_update);
-    result.resource = std::move(resource);
+    result.resource =
+        std::make_unique<XdsRouteConfigResource>(std::move(rds_update));
   }
   return result;
 }