grpc 1.81.1 → 1.82.0.pre1

data/src/core/credentials/call/regional_access_boundary_fetcher.h

@@ -0,0 +1,158 @@
+//
+// Copyright 2026 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#ifndef GRPC_SRC_CORE_CREDENTIALS_CALL_REGIONAL_ACCESS_BOUNDARY_FETCHER_H
+#define GRPC_SRC_CORE_CREDENTIALS_CALL_REGIONAL_ACCESS_BOUNDARY_FETCHER_H
+
+#include <grpc/event_engine/event_engine.h>
+#include <grpc/support/port_platform.h>
+#include <grpc/support/sync.h>
+#include <grpc/support/time.h>
+
+#include <optional>
+#include <string>
+#include <variant>
+#include <vector>
+
+#include "src/core/call/metadata.h"
+#include "src/core/lib/iomgr/error.h"
+#include "src/core/util/backoff.h"
+#include "src/core/util/dual_ref_counted.h"
+#include "src/core/util/http_client/httpcli.h"
+#include "src/core/util/ref_counted_ptr.h"
+#include "absl/status/statusor.h"
+
+namespace grpc_core {
+
+class RegionalAccessBoundaryFetcher final
+    : public DualRefCounted<RegionalAccessBoundaryFetcher> {
+ public:
+  static RefCountedPtr<RegionalAccessBoundaryFetcher> Create(
+      absl::string_view lookup_url,
+      std::shared_ptr<grpc_event_engine::experimental::EventEngine>
+          event_engine = nullptr,
+      std::optional<BackOff::Options> backoff_options = std::nullopt);
+
+  explicit RegionalAccessBoundaryFetcher(
+      URI lookup_uri,
+      std::shared_ptr<grpc_event_engine::experimental::EventEngine>
+          event_engine = nullptr,
+      std::optional<BackOff::Options> backoff_options = std::nullopt);
+
+  // Attaches regional access boundary header (x-allowed-locations) to the
+  // initial metadata if available, otherwise initiates non-blocking,
+  // asynchronous fetch of regional access boundary if not already cached or in
+  // flight.
+  void Fetch(absl::string_view access_token, ClientMetadata& initial_metadata);
+
+  // Cancels any pending fetch of regional access boundary which must be called
+  // during destruction of any CallCredential which supports regional access
+  // boundary to avoid memory leaks from pending http requests.
+  void Orphaned() override;
+
+ private:
+  friend class RegionalAccessBoundaryFetcherTest;
+
+  struct RegionalAccessBoundary {
+    Slice encoded_locations;
+    Timestamp expiration;
+  };
+
+  class Request;
+
+  void OnFetchSuccess(Slice encoded_locations);
+  void OnFetchFailure(grpc_error_handle error, int http_status,
+                      absl::string_view response_body);
+
+  std::shared_ptr<grpc_event_engine::experimental::EventEngine> event_engine_;
+  const URI lookup_uri_;
+  Mutex cache_mu_;
+  std::optional<RegionalAccessBoundary> cache_ ABSL_GUARDED_BY(&cache_mu_);
+  Timestamp next_fetch_time_ ABSL_GUARDED_BY(&cache_mu_) = Timestamp::InfPast();
+  BackOff backoff_ ABSL_GUARDED_BY(&cache_mu_);
+  OrphanablePtr<Request> pending_request_ ABSL_GUARDED_BY(&cache_mu_);
+  bool shutdown_ ABSL_GUARDED_BY(&cache_mu_) = false;
+};
+
+class RegionalAccessBoundaryFetcher::Request final
+    : public InternallyRefCounted<Request> {
+ public:
+  Request(WeakRefCountedPtr<RegionalAccessBoundaryFetcher> fetcher,
+          absl::string_view access_token);
+
+  ~Request() override;
+
+  void Start();
+
+  // Cancels any pending http request which must be called during
+  // destruction to avoid memory leaks from pending http requests.
+  void Orphan() override;
+
+ private:
+  static void OnResponseWrapper(void* arg, grpc_error_handle error);
+  void OnResponse(grpc_error_handle error);
+
+  grpc_http_response response_;
+  OrphanablePtr<HttpRequest> http_request_;
+  std::string access_token_;
+  grpc_polling_entity pollent_;
+  WeakRefCountedPtr<RegionalAccessBoundaryFetcher> fetcher_;
+  grpc_closure closure_;
+};
+
+class EmailFetcher final : public DualRefCounted<EmailFetcher> {
+ public:
+  explicit EmailFetcher(
+      std::shared_ptr<grpc_event_engine::experimental::EventEngine>
+          event_engine = nullptr);
+
+  ~EmailFetcher() override;
+
+  static bool IsValidEmail(absl::string_view email);
+
+  void StartEmailFetch();
+
+  // Wrapper for RAB fetcher.
+  void Fetch(absl::string_view token, ClientMetadata& metadata);
+
+  void Orphaned() override;
+
+ private:
+  class EmailRequest;
+
+  void OnEmailFetchComplete(absl::string_view email);
+  void OnEmailFetchError(grpc_error_handle error);
+
+  std::shared_ptr<grpc_event_engine::experimental::EventEngine> event_engine_;
+  Mutex mu_;
+
+  // Either a pending email request or an RAB fetcher.
+  std::variant<OrphanablePtr<EmailRequest>,
+               RefCountedPtr<RegionalAccessBoundaryFetcher>>
+      state_ ABSL_GUARDED_BY(&mu_);
+  BackOff backoff_ ABSL_GUARDED_BY(&mu_) =
+      BackOff(BackOff::Options()
+                  .set_initial_backoff(Duration::Seconds(15))
+                  .set_multiplier(1.75)
+                  .set_jitter(0.1)
+                  .set_max_backoff(Duration::Minutes(2)));
+  Timestamp next_fetch_earliest_time_ ABSL_GUARDED_BY(&mu_) =
+      Timestamp::InfPast();
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_CREDENTIALS_CALL_REGIONAL_ACCESS_BOUNDARY_FETCHER_H

data/src/core/credentials/call/token_fetcher/token_fetcher_credentials.cc

@@ -49,7 +49,7 @@ TokenFetcherCredentials::Token::Token(Slice token, Timestamp expiration)
       expiration_(expiration - kTokenExpirationAdjustmentDuration) {}
 
 void TokenFetcherCredentials::Token::AddTokenToClientInitialMetadata(
-    ClientMetadata& metadata) const {
+    ClientMetadata& metadata) {
   metadata.Append(GRPC_AUTHORIZATION_METADATA_KEY, token_.Ref(),
                   [](absl::string_view, const Slice&) { abort(); });
 }

data/src/core/credentials/call/token_fetcher/token_fetcher_credentials.h

@@ -55,7 +55,11 @@ class TokenFetcherCredentials : public grpc_call_credentials {
     Timestamp ExpirationTime() const { return expiration_; }
 
     // Adds the token to the call's client initial metadata.
-    void AddTokenToClientInitialMetadata(ClientMetadata& metadata) const;
+    virtual void AddTokenToClientInitialMetadata(ClientMetadata& metadata);
+
+   protected:
+    // Returns the token's value.
+    const Slice& token() const { return token_; }
 
    private:
     Slice token_;
@@ -66,6 +70,8 @@ class TokenFetcherCredentials : public grpc_call_credentials {
 
   void Orphaned() override;
 
+  // TODO(roth): Change internal code to not override this method and then
+  // change it to 'final'.
   ArenaPromise<absl::StatusOr<ClientMetadataHandle>> GetRequestMetadata(
       ClientMetadataHandle initial_metadata,
       const GetRequestMetadataArgs* args) override;

data/src/core/credentials/transport/insecure/insecure_security_connector.h

@@ -45,7 +45,7 @@ namespace grpc_core {
 extern const char kInsecureTransportSecurityType[];
 
 // Exposed for testing purposes only.
-// Create an auth context which is necessary to pass the santiy check in
+// Create an auth context which is necessary to pass the sanity check in
 // client_auth_filter that verifies if the peer's auth context is obtained
 // during handshakes.
 RefCountedPtr<grpc_auth_context> TestOnlyMakeInsecureAuthContext();

data/src/core/credentials/transport/local/local_security_connector.cc

@@ -155,7 +155,7 @@ void local_check_peer(tsi_peer peer, grpc_endpoint* ep,
       &peer.properties[peer.property_count]);
   if (result != TSI_OK) return;
   peer.property_count++;
-  // Create an auth context which is necessary to pass the santiy check in
+  // Create an auth context which is necessary to pass the sanity check in
   // {client, server}_auth_filter that verifies if the peer's auth context is
   // obtained during handshakes. The auth context is only checked for its
   // existence and not actually used.

data/src/core/ext/filters/backend_metrics/backend_metric_filter.cc

@@ -45,6 +45,7 @@
 namespace grpc_core {
 
 namespace {
+
 std::optional<std::string> MaybeSerializeBackendMetrics(
     BackendMetricProvider* provider) {
   if (provider == nullptr) return std::nullopt;
@@ -103,8 +104,13 @@ std::optional<std::string> MaybeSerializeBackendMetrics(
   size_t len;
   char* buf =
       xds_data_orca_v3_OrcaLoadReport_serialize(response, arena.ptr(), &len);
+  if (buf == nullptr) {
+    LOG_EVERY_N_SEC(ERROR, 10) << "Failed to serialize ORCA load report";
+    return std::nullopt;
+  }
   return std::string(buf, len);
 }
+
 }  // namespace
 
 const grpc_channel_filter BackendMetricFilter::kFilter =

data/src/core/ext/filters/fault_injection/fault_injection_filter.cc

@@ -17,7 +17,6 @@
 #include "src/core/ext/filters/fault_injection/fault_injection_filter.h"
 
 #include <grpc/status.h>
-#include <grpc/support/port_platform.h>
 #include <stdint.h>
 
 #include <algorithm>
@@ -31,15 +30,12 @@
 #include "src/core/call/metadata_batch.h"
 #include "src/core/call/status_util.h"
 #include "src/core/config/core_configuration.h"
-#include "src/core/ext/filters/fault_injection/fault_injection_service_config_parser.h"
 #include "src/core/lib/channel/channel_stack.h"
 #include "src/core/lib/debug/trace.h"
-#include "src/core/lib/experiments/experiments.h"
 #include "src/core/lib/promise/context.h"
 #include "src/core/lib/promise/sleep.h"
 #include "src/core/lib/promise/try_seq.h"
 #include "src/core/lib/transport/transport.h"
-#include "src/core/service_config/service_config_call_data.h"
 #include "src/core/util/time.h"
 #include "absl/log/log.h"
 #include "absl/meta/type_traits.h"
@@ -186,24 +182,19 @@ class FaultInjectionFilter::InjectionDecision {
 absl::StatusOr<std::unique_ptr<FaultInjectionFilter>>
 FaultInjectionFilter::Create(const ChannelArgs&,
                              ChannelFilter::Args filter_args) {
-  if (IsXdsChannelFilterChainPerRouteEnabled()) {
-    if (filter_args.config() == nullptr) {
-      return absl::InternalError("no config passed to fault injection filter");
-    }
-    if (filter_args.config()->type() != Config::Type()) {
-      return absl::InternalError(
-          absl::StrCat("wrong config type passed to fault injection filter: ",
-                       filter_args.config()->type().name()));
-    }
+  if (filter_args.config() == nullptr) {
+    return absl::InternalError("no config passed to fault injection filter");
+  }
+  if (filter_args.config()->type() != Config::Type()) {
+    return absl::InternalError(
+        absl::StrCat("wrong config type passed to fault injection filter: ",
+                     filter_args.config()->type().name()));
   }
   return std::make_unique<FaultInjectionFilter>(filter_args);
 }
 
 FaultInjectionFilter::FaultInjectionFilter(ChannelFilter::Args filter_args)
-    : index_(filter_args.instance_id()),
-      service_config_parser_index_(
-          FaultInjectionServiceConfigParser::ParserIndex()),
-      config_(filter_args.config().TakeAsSubclass<const Config>()) {}
+    : config_(filter_args.config().TakeAsSubclass<const Config>()) {}
 
 // Construct a promise for one call.
 ArenaPromise<absl::Status> FaultInjectionFilter::Call::OnClientInitialMetadata(
@@ -221,75 +212,50 @@ ArenaPromise<absl::Status> FaultInjectionFilter::Call::OnClientInitialMetadata(
 FaultInjectionFilter::InjectionDecision
 FaultInjectionFilter::MakeInjectionDecision(
     const ClientMetadata& initial_metadata) {
-  if (!IsXdsChannelFilterChainPerRouteEnabled()) {
-    // Fetch the fault injection policy from the service config, based on the
-    // relative index for which policy should this CallData use.
-    auto* service_config_call_data = GetContext<ServiceConfigCallData>();
-    auto* method_params = static_cast<FaultInjectionMethodParsedConfig*>(
-        service_config_call_data->GetMethodParsedConfig(
-            service_config_parser_index_));
-    const FaultInjectionMethodParsedConfig::FaultInjectionPolicy* fi_policy =
-        nullptr;
-    if (method_params != nullptr) {
-      fi_policy = method_params->fault_injection_policy(index_);
-    }
-    // Shouldn't ever be null, but just in case, return a no-op decision.
-    if (fi_policy == nullptr) {
-      return InjectionDecision(/*max_faults=*/0,
-                               /*delay_time=*/Duration::Zero(),
-                               /*abort_request=*/std::nullopt);
-    }
-    return MakeInjectionDecision(initial_metadata, *fi_policy);
-  }
   // Shouldn't ever be null, but just in case, return a no-op decision.
   if (config_ == nullptr) {
     return InjectionDecision(/*max_faults=*/0, /*delay_time=*/Duration::Zero(),
                              /*abort_request=*/std::nullopt);
   }
-  return MakeInjectionDecision(initial_metadata, *config_);
-}
 
-template <typename T>
-FaultInjectionFilter::InjectionDecision
-FaultInjectionFilter::MakeInjectionDecision(
-    const ClientMetadata& initial_metadata, const T& config) {
-  grpc_status_code abort_code = config.abort_code;
-  uint32_t abort_percentage_numerator = config.abort_percentage_numerator;
-  uint32_t delay_percentage_numerator = config.delay_percentage_numerator;
-  Duration delay = config.delay;
+  grpc_status_code abort_code = config_->abort_code;
+  uint32_t abort_percentage_numerator = config_->abort_percentage_numerator;
+  uint32_t delay_percentage_numerator = config_->delay_percentage_numerator;
+  Duration delay = config_->delay;
 
   // Update the policy with values in initial metadata.
-  if (!config.abort_code_header.empty() ||
-      !config.abort_percentage_header.empty() || !config.delay_header.empty() ||
-      !config.delay_percentage_header.empty()) {
+  if (!config_->abort_code_header.empty() ||
+      !config_->abort_percentage_header.empty() ||
+      !config_->delay_header.empty() ||
+      !config_->delay_percentage_header.empty()) {
     std::string buffer;
-    if (!config.abort_code_header.empty() && abort_code == GRPC_STATUS_OK) {
+    if (!config_->abort_code_header.empty() && abort_code == GRPC_STATUS_OK) {
       auto value =
-          initial_metadata.GetStringValue(config.abort_code_header, &buffer);
+          initial_metadata.GetStringValue(config_->abort_code_header, &buffer);
       if (value.has_value()) {
         grpc_status_code_from_int(
             AsInt<int>(*value).value_or(GRPC_STATUS_UNKNOWN), &abort_code);
       }
     }
-    if (!config.abort_percentage_header.empty()) {
+    if (!config_->abort_percentage_header.empty()) {
       auto value = initial_metadata.GetStringValue(
-          config.abort_percentage_header, &buffer);
+          config_->abort_percentage_header, &buffer);
       if (value.has_value()) {
         abort_percentage_numerator = std::min(
             AsInt<uint32_t>(*value).value_or(-1), abort_percentage_numerator);
       }
     }
-    if (!config.delay_header.empty() && delay == Duration::Zero()) {
+    if (!config_->delay_header.empty() && delay == Duration::Zero()) {
       auto value =
-          initial_metadata.GetStringValue(config.delay_header, &buffer);
+          initial_metadata.GetStringValue(config_->delay_header, &buffer);
       if (value.has_value()) {
         delay = Duration::Milliseconds(
             std::max(AsInt<int64_t>(*value).value_or(0), int64_t{0}));
       }
     }
-    if (!config.delay_percentage_header.empty()) {
+    if (!config_->delay_percentage_header.empty()) {
       auto value = initial_metadata.GetStringValue(
-          config.delay_percentage_header, &buffer);
+          config_->delay_percentage_header, &buffer);
       if (value.has_value()) {
         delay_percentage_numerator = std::min(
             AsInt<uint32_t>(*value).value_or(-1), delay_percentage_numerator);
@@ -304,20 +270,20 @@ FaultInjectionFilter::MakeInjectionDecision(
     if (delay_request) {
       delay_request =
           UnderFraction(&delay_rand_generator_, delay_percentage_numerator,
-                        config.delay_percentage_denominator);
+                        config_->delay_percentage_denominator);
     }
     if (abort_request) {
       abort_request =
           UnderFraction(&abort_rand_generator_, abort_percentage_numerator,
-                        config.abort_percentage_denominator);
+                        config_->abort_percentage_denominator);
     }
   }
 
   return InjectionDecision(
-      config.max_faults, delay_request ? delay : Duration::Zero(),
+      config_->max_faults, delay_request ? delay : Duration::Zero(),
       abort_request ? std::optional<absl::Status>(absl::Status(
                           static_cast<absl::StatusCode>(abort_code),
-                          config.abort_message))
+                          config_->abort_message))
                     : std::nullopt);
 }
 
@@ -349,8 +315,4 @@ std::string FaultInjectionFilter::InjectionDecision::ToString() const {
 const grpc_channel_filter FaultInjectionFilter::kFilterVtable =
     MakePromiseBasedFilter<FaultInjectionFilter, FilterEndpoint::kClient>();
 
-void FaultInjectionFilterRegister(CoreConfiguration::Builder* builder) {
-  FaultInjectionServiceConfigParser::Register(builder);
-}
-
 }  // namespace grpc_core

data/src/core/ext/filters/fault_injection/fault_injection_filter.h

@@ -102,14 +102,6 @@ class FaultInjectionFilter
   InjectionDecision MakeInjectionDecision(
       const ClientMetadata& initial_metadata);
 
-  // TODO(roth): Remove this method and these data members as part of
-  // removing the xds_channel_filter_chain_per_route experiment.
-  template <typename T>
-  InjectionDecision MakeInjectionDecision(
-      const ClientMetadata& initial_metadata, const T& config);
-  size_t index_;  // The relative index of instances of the same filter.
-  const size_t service_config_parser_index_;
-
   const RefCountedPtr<const Config> config_;
 
   Mutex mu_;

data/src/core/ext/filters/gcp_authentication/gcp_authentication_filter.cc

@@ -23,16 +23,15 @@
 #include "src/core/call/security_context.h"
 #include "src/core/config/core_configuration.h"
 #include "src/core/credentials/call/gcp_service_account_identity/gcp_service_account_identity_credentials.h"
-#include "src/core/ext/filters/gcp_authentication/gcp_authentication_service_config_parser.h"
 #include "src/core/lib/channel/channel_stack.h"
 #include "src/core/lib/promise/context.h"
 #include "src/core/lib/resource_quota/arena.h"
 #include "src/core/lib/transport/transport.h"
 #include "src/core/resolver/xds/xds_resolver_attributes.h"
-#include "src/core/service_config/service_config.h"
 #include "src/core/service_config/service_config_call_data.h"
 #include "src/core/util/grpc_check.h"
 #include "absl/strings/str_cat.h"
+#include "absl/strings/str_format.h"
 
 namespace grpc_core {
 
@@ -42,12 +41,13 @@ namespace grpc_core {
 
 bool GcpAuthenticationFilter::Config::Equals(const FilterConfig& other) const {
   const auto& o = DownCast<const Config&>(other);
-  return instance_name == o.instance_name && cache_size == o.cache_size;
+  return instance_name == o.instance_name && cache_size == o.cache_size &&
+         cache == o.cache;
 }
 
 std::string GcpAuthenticationFilter::Config::ToString() const {
-  return absl::StrCat("{instance_name=\"", instance_name,
-                      "\", cache_size=", cache_size, "}");
+  return absl::StrFormat("{instance_name=\"%s\", cache_size=%u, cache=%p}",
+                         instance_name, cache_size, cache.get());
 }
 
 //
@@ -108,7 +108,7 @@ absl::Status GcpAuthenticationFilter::Call::OnClientInitialMetadata(
         cluster_name));
   }
   // Get the call creds instance.
-  auto creds = filter->cache_->Get(
+  auto creds = filter->filter_config_->cache->Get(
       DownCast<const XdsGcpAuthnAudienceMetadataValue*>(metadata_value)->url());
   // Add the call creds instance to the call.
   auto* arena = GetContext<Arena>();
@@ -158,40 +158,20 @@ const grpc_channel_filter GcpAuthenticationFilter::kFilterVtable =
 absl::StatusOr<std::unique_ptr<GcpAuthenticationFilter>>
 GcpAuthenticationFilter::Create(const ChannelArgs& args,
                                 ChannelFilter::Args filter_args) {
-  RefCountedPtr<const Config> config;
-  if (!IsXdsChannelFilterChainPerRouteEnabled()) {
-    // Construct new-style filter config from legacy service config.
-    auto service_config = args.GetObjectRef<ServiceConfig>();
-    if (service_config == nullptr) {
-      return absl::InvalidArgumentError(
-          "gcp_auth: no service config in channel args");
-    }
-    auto* global_config = static_cast<const GcpAuthenticationParsedConfig*>(
-        service_config->GetGlobalParsedConfig(
-            GcpAuthenticationServiceConfigParser::ParserIndex()));
-    if (global_config == nullptr) {
-      return absl::InvalidArgumentError("gcp_auth: parsed config not found");
-    }
-    auto* filter_config = global_config->GetConfig(filter_args.instance_id());
-    if (filter_config == nullptr) {
-      return absl::InvalidArgumentError(
-          "gcp_auth: filter instance ID not found in filter config");
-    }
-    auto new_config = MakeRefCounted<Config>();
-    new_config->instance_name = filter_config->filter_instance_name;
-    new_config->cache_size = filter_config->cache_size;
-    config = std::move(new_config);
-  } else {
-    // Get filter config.
-    if (filter_args.config() == nullptr) {
-      return absl::InternalError("gcp_auth: filter config not set");
-    }
-    if (filter_args.config()->type() != Config::Type()) {
-      return absl::InternalError(
-          absl::StrCat("wrong config type passed to GCP authn filter: ",
-                       filter_args.config()->type().name()));
-    }
-    config = filter_args.config().TakeAsSubclass<const Config>();
+  // Get filter config.
+  if (filter_args.config() == nullptr) {
+    return absl::InternalError("gcp_auth: filter config not set");
+  }
+  if (filter_args.config()->type() != Config::Type()) {
+    return absl::InternalError(
+        absl::StrCat("wrong config type passed to GCP authn filter: ",
+                     filter_args.config()->type().name()));
+  }
+  auto config = filter_args.config().TakeAsSubclass<const Config>();
+  // Make sure cache is present in config.
+  if (config->cache == nullptr) {
+    return absl::InternalError(
+        "gcp_auth: cache object not found in filter config");
   }
   // Get XdsConfig so that we can look up CDS resources.
   auto xds_config = args.GetObjectRef<XdsConfig>();
@@ -199,29 +179,15 @@ GcpAuthenticationFilter::Create(const ChannelArgs& args,
     return absl::InternalError(
         "gcp_auth: xds config not found in channel args");
   }
-  // Get cache from blackboard.  This must have been populated
-  // previously by the XdsConfigSelector.
-  auto cache =
-      filter_args.GetState<CallCredentialsCache>(config->instance_name);
-  if (cache == nullptr) {
-    return absl::InternalError(
-        "gcp_auth: cache object not found in filter state");
-  }
   // Instantiate filter.
-  return std::unique_ptr<GcpAuthenticationFilter>(new GcpAuthenticationFilter(
-      std::move(config), std::move(xds_config), std::move(cache)));
+  return std::unique_ptr<GcpAuthenticationFilter>(
+      new GcpAuthenticationFilter(std::move(config), std::move(xds_config)));
 }
 
 GcpAuthenticationFilter::GcpAuthenticationFilter(
     RefCountedPtr<const Config> filter_config,
-    RefCountedPtr<const XdsConfig> xds_config,
-    RefCountedPtr<CallCredentialsCache> cache)
+    RefCountedPtr<const XdsConfig> xds_config)
     : filter_config_(std::move(filter_config)),
-      xds_config_(std::move(xds_config)),
-      cache_(std::move(cache)) {}
-
-void GcpAuthenticationFilterRegister(CoreConfiguration::Builder* builder) {
-  GcpAuthenticationServiceConfigParser::Register(builder);
-}
+      xds_config_(std::move(xds_config)) {}
 
 }  // namespace grpc_core

data/src/core/ext/filters/gcp_authentication/gcp_authentication_filter.h

@@ -21,8 +21,6 @@
 #include <string>
 
 #include "src/core/credentials/call/call_credentials.h"
-#include "src/core/ext/filters/gcp_authentication/gcp_authentication_service_config_parser.h"
-#include "src/core/filter/blackboard.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/channel/channel_fwd.h"
 #include "src/core/lib/channel/promise_based_filter.h"
@@ -31,6 +29,7 @@
 #include "src/core/util/lru_cache.h"
 #include "src/core/util/ref_counted_ptr.h"
 #include "src/core/util/sync.h"
+#include "src/core/xds/grpc/blackboard.h"
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
 #include "absl/strings/string_view.h"
@@ -42,19 +41,6 @@ namespace grpc_core {
 class GcpAuthenticationFilter
     : public ImplementChannelFilter<GcpAuthenticationFilter> {
  public:
-  struct Config : public FilterConfig {
-    static UniqueTypeName Type() {
-      return GRPC_UNIQUE_TYPE_NAME_HERE("gcp_authentication_filter_config");
-    }
-    UniqueTypeName type() const override { return Type(); }
-
-    bool Equals(const FilterConfig& other) const override;
-    std::string ToString() const override;
-
-    std::string instance_name;
-    uint64_t cache_size = 10;
-  };
-
   class CallCredentialsCache : public Blackboard::Entry {
    public:
     explicit CallCredentialsCache(size_t max_size) : cache_(max_size) {}
@@ -63,14 +49,35 @@ class GcpAuthenticationFilter
 
     void SetMaxSize(size_t max_size);
 
+    size_t max_size() const {
+      MutexLock lock(&mu_);
+      return cache_.max_size();
+    }
+
     RefCountedPtr<grpc_call_credentials> Get(const std::string& audience);
 
    private:
-    Mutex mu_;
+    mutable Mutex mu_;
     LruCache<std::string /*audience*/, RefCountedPtr<grpc_call_credentials>>
         cache_ ABSL_GUARDED_BY(&mu_);
   };
 
+  struct Config : public FilterConfig {
+    static UniqueTypeName Type() {
+      return GRPC_UNIQUE_TYPE_NAME_HERE("gcp_authentication_filter_config");
+    }
+    UniqueTypeName type() const override { return Type(); }
+
+    bool Equals(const FilterConfig& other) const override;
+    std::string ToString() const override;
+
+    std::string instance_name;
+    uint64_t cache_size = 10;
+
+    // Populated from the blackboard.
+    RefCountedPtr<CallCredentialsCache> cache;
+  };
+
   static const grpc_channel_filter kFilterVtable;
 
   static absl::string_view TypeName() { return "gcp_authentication_filter"; }
@@ -95,12 +102,10 @@ class GcpAuthenticationFilter
 
  private:
   GcpAuthenticationFilter(RefCountedPtr<const Config> filter_config,
-                          RefCountedPtr<const XdsConfig> xds_config,
-                          RefCountedPtr<CallCredentialsCache> cache);
+                          RefCountedPtr<const XdsConfig> xds_config);
 
   const RefCountedPtr<const Config> filter_config_;
   const RefCountedPtr<const XdsConfig> xds_config_;
-  const RefCountedPtr<CallCredentialsCache> cache_;
 };
 
 }  // namespace grpc_core