grpc 1.81.0 → 1.82.0.pre1

data/src/core/client_channel/dynamic_filters.cc

@@ -137,10 +137,8 @@ void DynamicFilters::Call::IncrementRefCount(const DebugLocation& /*location*/,
 namespace {
 
 absl::StatusOr<RefCountedPtr<grpc_channel_stack>> CreateChannelStack(
-    const ChannelArgs& args, std::vector<FilterAndConfig> filters,
-    const Blackboard* blackboard) {
+    const ChannelArgs& args, std::vector<FilterAndConfig> filters) {
   ChannelStackBuilderImpl builder("DynamicFilters", GRPC_CLIENT_DYNAMIC, args);
-  builder.SetBlackboard(blackboard);
   for (auto& [filter, config] : filters) {
     builder.AppendFilter(filter, std::move(config));
   }
@@ -150,16 +148,15 @@ absl::StatusOr<RefCountedPtr<grpc_channel_stack>> CreateChannelStack(
 }  // namespace
 
 RefCountedPtr<DynamicFilters> DynamicFilters::Create(
-    const ChannelArgs& args, std::vector<FilterAndConfig> filters,
-    const Blackboard* blackboard) {
+    const ChannelArgs& args, std::vector<FilterAndConfig> filters) {
   // Attempt to create channel stack from requested filters.
-  auto p = CreateChannelStack(args, std::move(filters), blackboard);
+  auto p = CreateChannelStack(args, std::move(filters));
   if (!p.ok()) {
     // Channel stack creation failed with requested filters.
     // Create with lame filter instead.
     auto error = p.status();
     p = CreateChannelStack(args.Set(MakeLameClientErrorArg(&error)),
-                           {{&LameClientFilter::kFilter, nullptr}}, nullptr);
+                           {{&LameClientFilter::kFilter, nullptr}});
   }
   return MakeRefCounted<DynamicFilters>(std::move(p.value()));
 }

data/src/core/client_channel/dynamic_filters.h

@@ -23,7 +23,6 @@
 #include <utility>
 #include <vector>
 
-#include "src/core/filter/blackboard.h"
 #include "src/core/filter/filter_chain.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/channel/channel_fwd.h"
@@ -90,8 +89,7 @@ class DynamicFilters final : public FilterChain {
   };
 
   static RefCountedPtr<DynamicFilters> Create(
-      const ChannelArgs& args, std::vector<FilterAndConfig> filters,
-      const Blackboard* blackboard);
+      const ChannelArgs& args, std::vector<FilterAndConfig> filters);
 
   explicit DynamicFilters(RefCountedPtr<grpc_channel_stack> channel_stack)
       : channel_stack_(std::move(channel_stack)) {}

data/src/core/client_channel/retry_filter.cc

@@ -81,9 +81,6 @@
 // TODO(roth): In subsequent PRs:
 // - implement hedging
 
-using grpc_core::internal::RetryGlobalConfig;
-using grpc_core::internal::RetryMethodConfig;
-using grpc_core::internal::RetryServiceConfigParser;
 using grpc_event_engine::experimental::EventEngine;
 
 namespace grpc_core {
@@ -92,33 +89,13 @@ namespace grpc_core {
 // RetryFilter
 //
 
-void RetryFilter::UpdateBlackboard(const ServiceConfig& service_config,
-                                   const Blackboard* old_blackboard,
-                                   Blackboard* new_blackboard) {
-  // Get retry throttling parameters from service config.
-  const auto* config = static_cast<const RetryGlobalConfig*>(
-      service_config.GetGlobalParsedConfig(
-          RetryServiceConfigParser::ParserIndex()));
-  if (config == nullptr) return;
-  // Get throttler.
-  RefCountedPtr<internal::RetryThrottler> throttler;
-  if (old_blackboard != nullptr) {
-    throttler = old_blackboard->Get<internal::RetryThrottler>("");
-  }
-  throttler = internal::RetryThrottler::Create(config->max_milli_tokens(),
-                                               config->milli_token_ratio(),
-                                               std::move(throttler));
-  new_blackboard->Set("", std::move(throttler));
-}
-
 RetryFilter::RetryFilter(const grpc_channel_element_args& args)
     : client_channel_(args.channel_args.GetObject<ClientChannelFilter>()),
       event_engine_(args.channel_args.GetObject<EventEngine>()),
       per_rpc_retry_buffer_size_(
           GetMaxPerRpcRetryBufferSize(args.channel_args)),
-      retry_throttler_(args.blackboard->Get<internal::RetryThrottler>("")),
-      service_config_parser_index_(
-          internal::RetryServiceConfigParser::ParserIndex()) {}
+      retry_throttler_(args.channel_args.GetObjectRef<RetryThrottler>()),
+      service_config_parser_index_(RetryServiceConfigParser::ParserIndex()) {}
 
 const RetryMethodConfig* RetryFilter::GetRetryPolicy(Arena* arena) {
   auto* svc_cfg_call_data = arena->GetContext<ServiceConfigCallData>();

data/src/core/client_channel/retry_filter.h

@@ -45,10 +45,6 @@ class RetryFilter final {
  public:
   static const grpc_channel_filter kFilterVtable;
 
-  static void UpdateBlackboard(const ServiceConfig& service_config,
-                               const Blackboard* old_blackboard,
-                               Blackboard* blackboard);
-
  private:
   // Old filter-stack style call implementation, in
   // retry_filter_legacy_call_data.{h,cc}
@@ -62,9 +58,9 @@ class RetryFilter final {
   // any even moderately compelling reason to do so.
   static double BackoffJitter() { return 0.2; }
 
-  const internal::RetryMethodConfig* GetRetryPolicy(Arena* arena);
+  const RetryMethodConfig* GetRetryPolicy(Arena* arena);
 
-  RefCountedPtr<internal::RetryThrottler> retry_throttler() const {
+  RefCountedPtr<RetryThrottler> retry_throttler() const {
     return retry_throttler_;
   }
 
@@ -108,7 +104,7 @@ class RetryFilter final {
   ClientChannelFilter* client_channel_;
   grpc_event_engine::experimental::EventEngine* const event_engine_;
   size_t per_rpc_retry_buffer_size_;
-  RefCountedPtr<internal::RetryThrottler> retry_throttler_;
+  RefCountedPtr<RetryThrottler> retry_throttler_;
   const size_t service_config_parser_index_;
 };
 

data/src/core/client_channel/retry_filter_legacy_call_data.cc

@@ -966,7 +966,7 @@ void GetCallStatus(
       *is_lb_drop = true;
     }
   } else {
-    *status = *md_batch->get(GrpcStatusMetadata());
+    *status = md_batch->get(GrpcStatusMetadata()).value_or(GRPC_STATUS_UNKNOWN);
   }
   *server_pushback = md_batch->get(GrpcRetryPushbackMsMetadata());
   *stream_network_state = md_batch->get(GrpcStreamNetworkState());

data/src/core/client_channel/retry_filter_legacy_call_data.h

@@ -369,8 +369,8 @@ class RetryFilter::LegacyCallData final {
 
   RetryFilter* chand_;
   grpc_polling_entity* pollent_;
-  RefCountedPtr<internal::RetryThrottler> retry_throttler_;
-  const internal::RetryMethodConfig* retry_policy_ = nullptr;
+  RefCountedPtr<RetryThrottler> retry_throttler_;
+  const RetryMethodConfig* retry_policy_ = nullptr;
   BackOff retry_backoff_;
 
   Timestamp deadline_;

data/src/core/client_channel/retry_interceptor.cc

@@ -35,8 +35,8 @@ size_t GetMaxPerRpcRetryBufferSize(const ChannelArgs& args) {
 
 namespace retry_detail {
 
-RetryState::RetryState(const internal::RetryMethodConfig* retry_policy,
-                       RefCountedPtr<internal::RetryThrottler> retry_throttler)
+RetryState::RetryState(const RetryMethodConfig* retry_policy,
+                       RefCountedPtr<RetryThrottler> retry_throttler)
     : retry_policy_(retry_policy),
       retry_throttler_(std::move(retry_throttler)),
       retry_backoff_(
@@ -134,38 +134,10 @@ std::optional<Duration> RetryState::ShouldRetry(
 ////////////////////////////////////////////////////////////////////////////////
 // RetryInterceptor
 
-absl::StatusOr<RefCountedPtr<RetryInterceptor>> RetryInterceptor::Create(
-    const ChannelArgs& args, const FilterArgs& filter_args) {
-  auto retry_throttler = filter_args.GetState<internal::RetryThrottler>("");
-  return MakeRefCounted<RetryInterceptor>(args, std::move(retry_throttler));
-}
-
-void RetryInterceptor::UpdateBlackboard(const ServiceConfig& service_config,
-                                        const Blackboard* old_blackboard,
-                                        Blackboard* new_blackboard) {
-  const auto* config = static_cast<const internal::RetryGlobalConfig*>(
-      service_config.GetGlobalParsedConfig(
-          internal::RetryServiceConfigParser::ParserIndex()));
-  if (config == nullptr) return;
-  // Get existing throttle state.
-  RefCountedPtr<internal::RetryThrottler> throttler;
-  if (old_blackboard != nullptr) {
-    throttler = old_blackboard->Get<internal::RetryThrottler>("");
-  }
-  throttler = internal::RetryThrottler::Create(config->max_milli_tokens(),
-                                               config->milli_token_ratio(),
-                                               std::move(throttler));
-  CHECK_NE(new_blackboard, nullptr);
-  new_blackboard->Set("", std::move(throttler));
-}
-
-RetryInterceptor::RetryInterceptor(
-    const ChannelArgs& args,
-    RefCountedPtr<internal::RetryThrottler> retry_throttler)
+RetryInterceptor::RetryInterceptor(const ChannelArgs& args)
     : per_rpc_retry_buffer_size_(GetMaxPerRpcRetryBufferSize(args)),
-      service_config_parser_index_(
-          internal::RetryServiceConfigParser::ParserIndex()),
-      retry_throttler_(std::move(retry_throttler)) {}
+      service_config_parser_index_(RetryServiceConfigParser::ParserIndex()),
+      retry_throttler_(args.GetObjectRef<RetryThrottler>()) {}
 
 void RetryInterceptor::InterceptCall(
     UnstartedCallHandler unstarted_call_handler) {
@@ -177,10 +149,10 @@ void RetryInterceptor::InterceptCall(
   call->Start();
 }
 
-const internal::RetryMethodConfig* RetryInterceptor::GetRetryPolicy() {
+const RetryMethodConfig* RetryInterceptor::GetRetryPolicy() {
   auto* svc_cfg_call_data = MaybeGetContext<ServiceConfigCallData>();
   if (svc_cfg_call_data == nullptr) return nullptr;
-  return static_cast<const internal::RetryMethodConfig*>(
+  return static_cast<const RetryMethodConfig*>(
       svc_cfg_call_data->GetMethodParsedConfig(service_config_parser_index_));
 }
 

data/src/core/client_channel/retry_interceptor.h

@@ -29,8 +29,8 @@ namespace retry_detail {
 
 class RetryState {
  public:
-  RetryState(const internal::RetryMethodConfig* retry_policy,
-             RefCountedPtr<internal::RetryThrottler> retry_throttler);
+  RetryState(const RetryMethodConfig* retry_policy,
+             RefCountedPtr<RetryThrottler> retry_throttler);
 
   // if nullopt --> commit & don't retry
   // if duration --> retry after duration
@@ -50,8 +50,8 @@ class RetryState {
   }
 
  private:
-  const internal::RetryMethodConfig* const retry_policy_;
-  RefCountedPtr<internal::RetryThrottler> retry_throttler_;
+  const RetryMethodConfig* const retry_policy_;
+  RefCountedPtr<RetryThrottler> retry_throttler_;
   int num_attempts_completed_ = 0;
   BackOff retry_backoff_;
 };
@@ -60,17 +60,14 @@ class RetryState {
 
 class RetryInterceptor : public Interceptor {
  public:
-  RetryInterceptor(const ChannelArgs& args,
-                   RefCountedPtr<internal::RetryThrottler> retry_throttler);
-
   static absl::StatusOr<RefCountedPtr<RetryInterceptor>> Create(
-      const ChannelArgs& args, const FilterArgs& filter_args);
+      const ChannelArgs& args, const FilterArgs& /*filter_args*/) {
+    return MakeRefCounted<RetryInterceptor>(args);
+  }
 
-  void Orphaned() override {}
+  explicit RetryInterceptor(const ChannelArgs& args);
 
-  static void UpdateBlackboard(const ServiceConfig& service_config,
-                               const Blackboard* old_blackboard,
-                               Blackboard* new_blackboard);
+  void Orphaned() override {}
 
  protected:
   void InterceptCall(UnstartedCallHandler unstarted_call_handler) override;
@@ -146,11 +143,11 @@ class RetryInterceptor : public Interceptor {
     bool committed_ = false;
   };
 
-  const internal::RetryMethodConfig* GetRetryPolicy();
+  const RetryMethodConfig* GetRetryPolicy();
 
   const size_t per_rpc_retry_buffer_size_;
   const size_t service_config_parser_index_;
-  const RefCountedPtr<internal::RetryThrottler> retry_throttler_;
+  const RefCountedPtr<RetryThrottler> retry_throttler_;
 };
 
 }  // namespace grpc_core

data/src/core/client_channel/retry_service_config.cc

@@ -39,7 +39,6 @@
 #define MAX_MAX_RETRY_ATTEMPTS 5
 
 namespace grpc_core {
-namespace internal {
 
 //
 // RetryGlobalConfig
@@ -276,5 +275,4 @@ RetryServiceConfigParser::ParsePerMethodParams(const ChannelArgs& args,
   return std::move(method_params.retry_policy);
 }
 
-}  // namespace internal
 }  // namespace grpc_core

data/src/core/client_channel/retry_service_config.h

@@ -36,7 +36,6 @@
 #include "absl/strings/string_view.h"
 
 namespace grpc_core {
-namespace internal {
 
 class RetryGlobalConfig final : public ServiceConfigParser::ParsedConfig {
  public:
@@ -110,7 +109,6 @@ class RetryServiceConfigParser final : public ServiceConfigParser::Parser {
   static absl::string_view parser_name() { return "retry"; }
 };
 
-}  // namespace internal
 }  // namespace grpc_core
 
 #endif  // GRPC_SRC_CORE_CLIENT_CHANNEL_RETRY_SERVICE_CONFIG_H

data/src/core/client_channel/retry_throttle.cc

@@ -22,10 +22,10 @@
 #include <cstdint>
 #include <limits>
 
+#include "src/core/client_channel/retry_service_config.h"
 #include "src/core/util/useful.h"
 
 namespace grpc_core {
-namespace internal {
 
 namespace {
 
@@ -71,11 +71,6 @@ RefCountedPtr<RetryThrottler> RetryThrottler::Create(
   return throttle_data;
 }
 
-UniqueTypeName RetryThrottler::Type() {
-  static UniqueTypeName::Factory factory("retry_throttle");
-  return factory.Create();
-}
-
 RetryThrottler::RetryThrottler(uintptr_t max_milli_tokens,
                                uintptr_t milli_token_ratio,
                                uintptr_t milli_tokens)
@@ -130,5 +125,22 @@ void RetryThrottler::RecordSuccess() {
                                  std::numeric_limits<intptr_t>::max())));
 }
 
-}  // namespace internal
+void RetryThrottlerChannelArgsUpdater::Update(
+    const ServiceConfig& service_config, ChannelArgs& args) {
+  // Get retry throttling parameters from service config.
+  const auto* config = static_cast<const RetryGlobalConfig*>(
+      service_config.GetGlobalParsedConfig(
+          RetryServiceConfigParser::ParserIndex()));
+  if (config == nullptr) {
+    throttler_.reset();  // No throttling config.
+    return;
+  }
+  // Create a new throttler that replaces the current throttler and add
+  // it to channel args.
+  throttler_ = RetryThrottler::Create(config->max_milli_tokens(),
+                                      config->milli_token_ratio(),
+                                      std::move(throttler_));
+  args = args.SetObject(throttler_);
+}
+
 }  // namespace grpc_core

data/src/core/client_channel/retry_throttle.h

@@ -23,21 +23,19 @@
 
 #include <atomic>
 
-#include "src/core/filter/blackboard.h"
+#include "src/core/service_config/service_config.h"
+#include "src/core/util/ref_counted.h"
 #include "src/core/util/ref_counted_ptr.h"
 
 namespace grpc_core {
-namespace internal {
 
-/// Tracks retry throttling data for an individual server name.
-class RetryThrottler final : public Blackboard::Entry {
+/// Tracks retry throttling data for a channel.
+class RetryThrottler final : public RefCounted<RetryThrottler> {
  public:
   static RefCountedPtr<RetryThrottler> Create(
       uintptr_t max_milli_tokens, uintptr_t milli_token_ratio,
       RefCountedPtr<RetryThrottler> previous);
 
-  static UniqueTypeName Type();
-
   // Do not instantiate directly -- use Create() instead.
   RetryThrottler(uintptr_t max_milli_tokens, uintptr_t milli_token_ratio,
                  uintptr_t milli_tokens);
@@ -56,6 +54,14 @@ class RetryThrottler final : public Blackboard::Entry {
     return milli_tokens_.load(std::memory_order_relaxed);
   }
 
+  static absl::string_view ChannelArgName() {
+    return "grpc.internal.retry_throttler";
+  }
+  static int ChannelArgsCompare(const RetryThrottler* a,
+                                const RetryThrottler* b) {
+    return QsortCompare(a, b);
+  }
+
  private:
   void SetReplacement(RefCountedPtr<RetryThrottler> replacement);
 
@@ -70,7 +76,18 @@ class RetryThrottler final : public Blackboard::Entry {
   std::atomic<RetryThrottler*> replacement_{nullptr};
 };
 
-}  // namespace internal
+// Tracks retry throttler state across service config updates and
+// handles adding the current throttler to channel args.
+class RetryThrottlerChannelArgsUpdater final {
+ public:
+  // Applies the latest service config update and adds the current
+  // throttler to channel args if needed.
+  void Update(const ServiceConfig& service_config, ChannelArgs& args);
+
+ private:
+  RefCountedPtr<RetryThrottler> throttler_;
+};
+
 }  // namespace grpc_core
 
 #endif  // GRPC_SRC_CORE_CLIENT_CHANNEL_RETRY_THROTTLE_H

data/src/core/client_channel/subchannel.cc

@@ -1616,7 +1616,7 @@ void NewSubchannel::QueuedCall::ResumeOnConnectionLocked(
   // It's possible that the subchannel will get quota for the call
   // and try to resume it before buffered_call_ contains any batches.
   // In that case, we will not be holding the call combiner here, so we
-  // must not yeild it.  That's why we use
+  // must not yield it.  That's why we use
   // YieldCallCombinerIfPendingBatchesFound here.
   if (!error.ok()) {
     buffered_call_.Fail(error,

data/src/core/credentials/call/external/external_account_credentials.cc

@@ -33,7 +33,9 @@
 #include "src/core/credentials/call/external/file_external_account_credentials.h"
 #include "src/core/credentials/call/external/url_external_account_credentials.h"
 #include "src/core/credentials/call/json_util.h"
+#include "src/core/credentials/call/regional_access_boundary_fetcher.h"
 #include "src/core/credentials/transport/transport_credentials.h"
+#include "src/core/lib/promise/map.h"
 #include "src/core/lib/transport/status_conversion.h"
 #include "src/core/util/grpc_check.h"
 #include "src/core/util/http_client/httpcli_ssl_credentials.h"
@@ -72,6 +74,33 @@ namespace grpc_core {
 // ExternalAccountCredentials::NoOpFetchBody
 //
 
+namespace {
+
+class TokenWithRegionalAccessBoundary final
+    : public TokenFetcherCredentials::Token {
+ public:
+  TokenWithRegionalAccessBoundary(Slice token, Timestamp expiration,
+                                  RefCountedPtr<RegionalAccessBoundaryFetcher>
+                                      regional_access_boundary_fetcher)
+      : Token(std::move(token), expiration),
+        regional_access_boundary_fetcher_(
+            std::move(regional_access_boundary_fetcher)) {
+    CHECK(regional_access_boundary_fetcher_ != nullptr);
+  }
+
+  void AddTokenToClientInitialMetadata(ClientMetadata& metadata) override {
+    Token::AddTokenToClientInitialMetadata(metadata);
+    regional_access_boundary_fetcher_->Fetch(token().as_string_view(),
+                                             metadata);
+  }
+
+ private:
+  RefCountedPtr<RegionalAccessBoundaryFetcher>
+      regional_access_boundary_fetcher_;
+};
+
+}  // namespace
+
 ExternalAccountCredentials::NoOpFetchBody::NoOpFetchBody(
     grpc_event_engine::experimental::EventEngine& event_engine,
     absl::AnyInvocable<void(absl::StatusOr<std::string>)> on_done,
@@ -411,8 +440,14 @@ void ExternalAccountCredentials::ExternalFetchRequest::FinishTokenFetch(
         GRPC_CREDENTIALS_OK) {
       result = GRPC_ERROR_CREATE("Could not parse oauth token");
     } else {
-      result = MakeRefCounted<Token>(std::move(*token_value),
-                                     Timestamp::Now() + token_lifetime);
+      if (creds_->regional_access_boundary_fetcher_ != nullptr) {
+        result = MakeRefCounted<TokenWithRegionalAccessBoundary>(
+            std::move(*token_value), Timestamp::Now() + token_lifetime,
+            creds_->regional_access_boundary_fetcher_->Ref());
+      } else {
+        result = MakeRefCounted<TokenFetcherCredentials::Token>(
+            std::move(*token_value), Timestamp::Now() + token_lifetime);
+      }
     }
   }
   creds_->event_engine().Run([on_done = std::exchange(on_done_, nullptr),
@@ -442,21 +477,56 @@ bool ExternalAccountCredentials::ExternalFetchRequest::MaybeFailLocked(
 
 namespace {
 
+struct WorkloadIdentityPoolFields {
+  absl::string_view project;
+  absl::string_view pool_id;
+};
+
+// Expression to match:
+// //iam.googleapis.com/projects/<project>/locations/global/workloadIdentityPools/<pool-id>/providers/.+
+//
+// Returns the project and pool ID within the WorkloadIdentityPoolFields struct
+// if the audience matches the Workload Identity Pool format, otherwise returns
+// std::nullopt.
+std::optional<WorkloadIdentityPoolFields> MatchWorkloadIdentityPoolAudience(
+    absl::string_view audience) {
+  // Match "//iam.googleapis.com/projects/"
+  if (!absl::ConsumePrefix(&audience, "//iam.googleapis.com/projects/")) {
+    return std::nullopt;
+  }
+  // Match "<project>/locations/global/workloadIdentityPools/"
+  auto location_pos = audience.find("/locations/global/workloadIdentityPools/");
+  if (location_pos == absl::string_view::npos) return std::nullopt;
+  auto project = audience.substr(0, location_pos);
+  if (project.empty()) return std::nullopt;
+  audience.remove_prefix(
+      location_pos + sizeof("/locations/global/workloadIdentityPools/") - 1);
+  // Match "<pool-id>/providers/"
+  auto provider_pos = audience.find("/providers/");
+  if (provider_pos == absl::string_view::npos) return std::nullopt;
+  auto pool_id = audience.substr(0, provider_pos);
+  if (pool_id.empty()) return std::nullopt;
+  return WorkloadIdentityPoolFields{project, pool_id};
+}
+
 // Expression to match:
 // //iam.googleapis.com/locations/[^/]+/workforcePools/[^/]+/providers/.+
-bool MatchWorkforcePoolAudience(absl::string_view audience) {
+// Returns the workforce pool ID if the audience matches the Workforce Pool
+// format, otherwise returns an empty string view.
+absl::string_view MatchWorkforcePoolAudience(absl::string_view audience) {
   // Match "//iam.googleapis.com/locations/"
-  if (!absl::ConsumePrefix(&audience, "//iam.googleapis.com")) return false;
-  if (!absl::ConsumePrefix(&audience, "/locations/")) return false;
+  if (!absl::ConsumePrefix(&audience, "//iam.googleapis.com")) return "";
+  if (!absl::ConsumePrefix(&audience, "/locations/")) return "";
   // Match "[^/]+/workforcePools/"
   std::pair<absl::string_view, absl::string_view> workforce_pools_split_result =
       absl::StrSplit(audience, absl::MaxSplits("/workforcePools/", 1));
-  if (absl::StrContains(workforce_pools_split_result.first, '/')) return false;
+  if (absl::StrContains(workforce_pools_split_result.first, '/')) return "";
   // Match "[^/]+/providers/.+"
   std::pair<absl::string_view, absl::string_view> providers_split_result =
       absl::StrSplit(workforce_pools_split_result.second,
                      absl::MaxSplits("/providers/", 1));
-  return !absl::StrContains(providers_split_result.first, '/');
+  if (absl::StrContains(providers_split_result.first, '/')) return "";
+  return providers_split_result.first;
 }
 
 }  // namespace
@@ -533,7 +603,9 @@ ExternalAccountCredentials::Create(
   }
   it = json.object().find("workforce_pool_user_project");
   if (it != json.object().end()) {
-    if (MatchWorkforcePoolAudience(options.audience)) {
+    if (auto workforce_pool_id = MatchWorkforcePoolAudience(options.audience);
+        !workforce_pool_id.empty()) {
+      options.workforce_pool_id = std::string(workforce_pool_id);
       options.workforce_pool_user_project = it->second.string();
     } else {
       return GRPC_ERROR_CREATE(
@@ -541,6 +613,14 @@ ExternalAccountCredentials::Create(
           "pool credentials");
     }
   }
+  if (auto workload_identity_pool_fields =
+          MatchWorkloadIdentityPoolAudience(options.audience);
+      workload_identity_pool_fields.has_value()) {
+    options.workload_pool_project =
+        std::string(workload_identity_pool_fields->project);
+    options.workload_pool_id =
+        std::string(workload_identity_pool_fields->pool_id);
+  }
   it = json.object().find("service_account_impersonation");
   options.service_account_impersonation.token_lifetime_seconds =
       IMPERSONATED_CRED_DEFAULT_LIFETIME_IN_SECONDS;
@@ -590,20 +670,53 @@ ExternalAccountCredentials::Create(
   if (!error.ok()) return error;
   return creds;
 }
+namespace {
+
+std::string BuildRegionalAccessBoundaryUrl(
+    const ExternalAccountCredentials::Options& options) {
+  if (!options.service_account_impersonation_url.empty()) {
+    absl::string_view url = options.service_account_impersonation_url;
+    absl::string_view::size_type start = url.find("serviceAccounts/");
+    absl::string_view::size_type end = url.find(":generateAccessToken");
+    if (start != absl::string_view::npos && end != absl::string_view::npos &&
+        start + 16 < end) {
+      absl::string_view email = url.substr(start + 16, end - (start + 16));
+      return absl::StrFormat(
+          "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/"
+          "%s/allowedLocations",
+          email);
+    }
+  }
+  if (!options.workforce_pool_id.empty()) {
+    return absl::StrFormat(
+        "https://iamcredentials.googleapis.com/v1/locations/global/"
+        "workforcePools/%s/allowedLocations",
+        options.workforce_pool_id);
+  } else if (!options.workload_pool_project.empty() &&
+             !options.workload_pool_id.empty()) {
+    return absl::StrFormat(
+        "https://iamcredentials.googleapis.com/v1/projects/"
+        "%s/locations/global/workloadIdentityPools/%s/allowedLocations",
+        options.workload_pool_project, options.workload_pool_id);
+  }
+  return "";
+}
+
+}  // namespace
 
 ExternalAccountCredentials::ExternalAccountCredentials(
     Options options, std::vector<std::string> scopes,
     std::shared_ptr<grpc_event_engine::experimental::EventEngine> event_engine)
-    : TokenFetcherCredentials(std::move(event_engine)),
-      options_(std::move(options)) {
+    : TokenFetcherCredentials(event_engine),
+      options_(std::move(options)),
+      regional_access_boundary_fetcher_(RegionalAccessBoundaryFetcher::Create(
+          BuildRegionalAccessBoundaryUrl(options_), std::move(event_engine))) {
   if (scopes.empty()) {
     scopes.push_back(GOOGLE_CLOUD_PLATFORM_DEFAULT_SCOPE);
   }
   scopes_ = std::move(scopes);
 }
 
-ExternalAccountCredentials::~ExternalAccountCredentials() {}
-
 std::string ExternalAccountCredentials::MetricsHeaderValue() {
   return absl::StrFormat(
       "gl-cpp/unknown auth/%s google-byoid-sdk source/%s sa-impersonation/%v "

data/src/core/credentials/call/external/external_account_credentials.h

@@ -27,6 +27,7 @@
 #include <vector>
 
 #include "src/core/credentials/call/oauth2/oauth2_credentials.h"
+#include "src/core/credentials/call/regional_access_boundary_fetcher.h"
 #include "src/core/credentials/call/token_fetcher/token_fetcher_credentials.h"
 #include "src/core/lib/iomgr/closure.h"
 #include "src/core/lib/iomgr/error.h"
@@ -64,6 +65,9 @@ class ExternalAccountCredentials : public TokenFetcherCredentials {
     std::string client_id;
     std::string client_secret;
     std::string workforce_pool_user_project;
+    std::string workforce_pool_id;
+    std::string workload_pool_project;
+    std::string workload_pool_id;
   };
 
   static absl::StatusOr<RefCountedPtr<ExternalAccountCredentials>> Create(
@@ -75,7 +79,6 @@ class ExternalAccountCredentials : public TokenFetcherCredentials {
       Options options, std::vector<std::string> scopes,
       std::shared_ptr<grpc_event_engine::experimental::EventEngine>
           event_engine = nullptr);
-  ~ExternalAccountCredentials() override;
 
  protected:
   // A base class for a cancellable fetch operation.
@@ -200,6 +203,8 @@ class ExternalAccountCredentials : public TokenFetcherCredentials {
 
   Options options_;
   std::vector<std::string> scopes_;
+  RefCountedPtr<RegionalAccessBoundaryFetcher>
+      regional_access_boundary_fetcher_;
 };
 
 }  // namespace grpc_core