grpc 1.83.1 → 1.84.0

data/src/core/xds/grpc/xds_bootstrap_grpc_builder.cc

@@ -0,0 +1,488 @@
+//
+// Copyright 2021 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#include "src/core/xds/grpc/xds_bootstrap_grpc_builder.h"
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <map>
+#include <optional>
+#include <string>
+#include <utility>
+#include <variant>
+#include <vector>
+
+#include "envoy/config/core/v3/extension.upb.h"
+#include "envoy/extensions/filters/http/router/v3/router.upb.h"
+#include "envoy/extensions/filters/http/router/v3/router.upbdefs.h"
+#include "envoy/extensions/load_balancing_policies/client_side_weighted_round_robin/v3/client_side_weighted_round_robin.upb.h"
+#include "envoy/extensions/load_balancing_policies/pick_first/v3/pick_first.upb.h"
+#include "envoy/extensions/load_balancing_policies/ring_hash/v3/ring_hash.upb.h"
+#include "envoy/extensions/load_balancing_policies/wrr_locality/v3/wrr_locality.upb.h"
+#include "google/protobuf/wrappers.upb.h"
+#include "src/core/config/experiment_env_var.h"
+#include "src/core/load_balancing/weighted_round_robin/weighted_round_robin.h"
+#include "src/core/util/grpc_check.h"
+#include "src/core/util/json/json.h"
+#include "src/core/util/sync.h"
+#include "src/core/util/time.h"
+#include "src/core/util/validation_errors.h"
+#include "src/core/xds/grpc/xds_common_types.h"
+#include "src/core/xds/grpc/xds_common_types_parser.h"
+#include "src/core/xds/grpc/xds_http_composite_filter.h"
+#include "src/core/xds/grpc/xds_http_ext_proc_filter.h"
+#include "src/core/xds/grpc/xds_http_fault_filter.h"
+#include "src/core/xds/grpc/xds_http_gcp_authn_filter.h"
+#include "src/core/xds/grpc/xds_http_rbac_filter.h"
+#include "src/core/xds/grpc/xds_http_stateful_session_filter.h"
+#include "src/core/xds/grpc/xds_lb_policy_registry.h"
+#include "absl/strings/str_cat.h"
+
+namespace grpc_core {
+
+absl::StatusOr<std::unique_ptr<GrpcXdsBootstrap>>
+GrpcXdsBootstrapBuilder::Build(absl::string_view json_string) {
+  auto bootstrap = GrpcXdsBootstrap::Create(json_string);
+  if (bootstrap.ok()) {
+    (*bootstrap)->http_filter_registry_ = CreateXdsHttpFilterRegistry();
+    (*bootstrap)->lb_policy_registry_ = CreateXdsLbPolicyRegistry();
+    (*bootstrap)->audit_logger_registry_ = CreateXdsAuditLoggerRegistry();
+  }
+  return bootstrap;
+}
+
+//
+// HTTP filter registry
+//
+
+namespace {
+
+Mutex* g_mu = new Mutex;
+NoDestruct<absl::AnyInvocable<void(XdsHttpFilterRegistry&)>>
+    g_http_filter_factory_test_init ABSL_GUARDED_BY(*g_mu);
+
+}  // namespace
+
+void GrpcXdsBootstrapBuilder::SetXdsHttpFilterFactoryInitForTest(
+    absl::AnyInvocable<void(XdsHttpFilterRegistry&)> init) {
+  MutexLock lock(g_mu);
+  *g_http_filter_factory_test_init = std::move(init);
+}
+
+XdsHttpFilterRegistry GrpcXdsBootstrapBuilder::CreateXdsHttpFilterRegistry(
+    bool register_builtins) {
+  XdsHttpFilterRegistry registry;
+  if (register_builtins) {
+    registry.RegisterFilter(std::make_unique<XdsHttpRouterFilterFactory>());
+    registry.RegisterFilter(std::make_unique<XdsHttpFaultFilterFactory>());
+    registry.RegisterFilter(std::make_unique<XdsHttpRbacFilterFactory>());
+    registry.RegisterFilter(
+        std::make_unique<XdsHttpStatefulSessionFilterFactory>());
+    registry.RegisterFilter(std::make_unique<XdsHttpGcpAuthnFilterFactory>());
+    if (IsExperimentEnvVarEnabled("GRPC_EXPERIMENTAL_XDS_COMPOSITE_FILTER")) {
+      registry.RegisterFilter(
+          std::make_unique<XdsHttpCompositeFilterFactory>());
+    }
+    if (IsExperimentEnvVarEnabled("GRPC_EXPERIMENTAL_XDS_EXT_PROC_ON_CLIENT")) {
+      registry.RegisterFilter(std::make_unique<XdsHttpExtProcFilterFactory>());
+    }
+    MutexLock lock(g_mu);
+    if (*g_http_filter_factory_test_init != nullptr) {
+      (*g_http_filter_factory_test_init)(registry);
+    }
+  }
+  return registry;
+}
+
+//
+// LB policy registry
+//
+
+namespace {
+
+class RoundRobinLbPolicyConfigFactory final
+    : public XdsLbPolicyRegistry::ConfigFactory {
+ public:
+  Json::Object ConvertXdsLbPolicyConfig(
+      const XdsLbPolicyRegistry* /*registry*/,
+      const XdsResourceType::DecodeContext& /*context*/,
+      absl::string_view /*configuration*/, ValidationErrors* /*errors*/,
+      int /*recursion_depth*/) override {
+    return Json::Object{{"round_robin", Json::FromObject({})}};
+  }
+
+  absl::string_view type() override { return Type(); }
+
+  static absl::string_view Type() {
+    return "envoy.extensions.load_balancing_policies.round_robin.v3.RoundRobin";
+  }
+};
+
+class ClientSideWeightedRoundRobinLbPolicyConfigFactory final
+    : public XdsLbPolicyRegistry::ConfigFactory {
+ public:
+  Json::Object ConvertXdsLbPolicyConfig(
+      const XdsLbPolicyRegistry* /*registry*/,
+      const XdsResourceType::DecodeContext& context,
+      absl::string_view configuration, ValidationErrors* errors,
+      int /*recursion_depth*/) override {
+    const auto* resource =
+        envoy_extensions_load_balancing_policies_client_side_weighted_round_robin_v3_ClientSideWeightedRoundRobin_parse(
+            configuration.data(), configuration.size(), context.arena);
+    if (resource == nullptr) {
+      errors->AddError(
+          "can't decode ClientSideWeightedRoundRobin LB policy config");
+      return {};
+    }
+    Json::Object config;
+    // enable_oob_load_report
+    if (ParseBoolValue(
+            envoy_extensions_load_balancing_policies_client_side_weighted_round_robin_v3_ClientSideWeightedRoundRobin_enable_oob_load_report(
+                resource))) {
+      config["enableOobLoadReport"] = Json::FromBool(true);
+    }
+    // oob_reporting_period
+    auto* duration_proto =
+        envoy_extensions_load_balancing_policies_client_side_weighted_round_robin_v3_ClientSideWeightedRoundRobin_oob_reporting_period(
+            resource);
+    if (duration_proto != nullptr) {
+      ValidationErrors::ScopedField field(errors, ".oob_reporting_period");
+      Duration duration = ParseDuration(duration_proto, errors);
+      config["oobReportingPeriod"] = Json::FromString(duration.ToJsonString());
+    }
+    // blackout_period
+    duration_proto =
+        envoy_extensions_load_balancing_policies_client_side_weighted_round_robin_v3_ClientSideWeightedRoundRobin_blackout_period(
+            resource);
+    if (duration_proto != nullptr) {
+      ValidationErrors::ScopedField field(errors, ".blackout_period");
+      Duration duration = ParseDuration(duration_proto, errors);
+      config["blackoutPeriod"] = Json::FromString(duration.ToJsonString());
+    }
+    // weight_update_period
+    duration_proto =
+        envoy_extensions_load_balancing_policies_client_side_weighted_round_robin_v3_ClientSideWeightedRoundRobin_weight_update_period(
+            resource);
+    if (duration_proto != nullptr) {
+      ValidationErrors::ScopedField field(errors, ".weight_update_period");
+      Duration duration = ParseDuration(duration_proto, errors);
+      config["weightUpdatePeriod"] = Json::FromString(duration.ToJsonString());
+    }
+    // weight_expiration_period
+    duration_proto =
+        envoy_extensions_load_balancing_policies_client_side_weighted_round_robin_v3_ClientSideWeightedRoundRobin_weight_expiration_period(
+            resource);
+    if (duration_proto != nullptr) {
+      ValidationErrors::ScopedField field(errors, ".weight_expiration_period");
+      Duration duration = ParseDuration(duration_proto, errors);
+      config["weightExpirationPeriod"] =
+          Json::FromString(duration.ToJsonString());
+    }
+    // error_utilization_penalty
+    auto* error_utilization_penalty =
+        envoy_extensions_load_balancing_policies_client_side_weighted_round_robin_v3_ClientSideWeightedRoundRobin_error_utilization_penalty(
+            resource);
+    if (error_utilization_penalty != nullptr) {
+      ValidationErrors::ScopedField field(errors, ".error_utilization_penalty");
+      const float value =
+          google_protobuf_FloatValue_value(error_utilization_penalty);
+      if (value < 0.0) {
+        errors->AddError("value must be non-negative");
+      }
+      config["errorUtilizationPenalty"] = Json::FromNumber(value);
+    }
+    // metric_names_for_computing_utilization
+    size_t size;
+    auto metric_names_for_computing_utilization =
+        envoy_extensions_load_balancing_policies_client_side_weighted_round_robin_v3_ClientSideWeightedRoundRobin_metric_names_for_computing_utilization(
+            resource, &size);
+    if (metric_names_for_computing_utilization != nullptr && size != 0) {
+      Json::Array metric_names;
+      for (size_t i = 0; i < size; ++i) {
+        metric_names.emplace_back(Json::FromString(
+            UpbStringToStdString(metric_names_for_computing_utilization[i])));
+      }
+      config["metricNamesForComputingUtilization"] =
+          Json::FromArray(std::move(metric_names));
+    }
+    return Json::Object{
+        {"weighted_round_robin", Json::FromObject(std::move(config))}};
+  }
+
+  absl::string_view type() override { return Type(); }
+
+  static absl::string_view Type() {
+    return "envoy.extensions.load_balancing_policies.client_side_weighted_"
+           "round_robin.v3.ClientSideWeightedRoundRobin";
+  }
+};
+
+class RingHashLbPolicyConfigFactory final
+    : public XdsLbPolicyRegistry::ConfigFactory {
+ public:
+  Json::Object ConvertXdsLbPolicyConfig(
+      const XdsLbPolicyRegistry* /*registry*/,
+      const XdsResourceType::DecodeContext& context,
+      absl::string_view configuration, ValidationErrors* errors,
+      int /*recursion_depth*/) override {
+    const auto* resource =
+        envoy_extensions_load_balancing_policies_ring_hash_v3_RingHash_parse(
+            configuration.data(), configuration.size(), context.arena);
+    if (resource == nullptr) {
+      errors->AddError("can't decode RingHash LB policy config");
+      return {};
+    }
+    if (envoy_extensions_load_balancing_policies_ring_hash_v3_RingHash_hash_function(
+            resource) !=
+            envoy_extensions_load_balancing_policies_ring_hash_v3_RingHash_XX_HASH &&
+        envoy_extensions_load_balancing_policies_ring_hash_v3_RingHash_hash_function(
+            resource) !=
+            envoy_extensions_load_balancing_policies_ring_hash_v3_RingHash_DEFAULT_HASH) {
+      ValidationErrors::ScopedField field(errors, ".hash_function");
+      errors->AddError("unsupported value (must be XX_HASH)");
+    }
+    uint64_t max_ring_size =
+        ParseUInt64Value(
+            envoy_extensions_load_balancing_policies_ring_hash_v3_RingHash_maximum_ring_size(
+                resource))
+            .value_or(8388608);
+    if (max_ring_size == 0 || max_ring_size > 8388608) {
+      ValidationErrors::ScopedField field(errors, ".maximum_ring_size");
+      errors->AddError("value must be in the range [1, 8388608]");
+    }
+    uint64_t min_ring_size =
+        ParseUInt64Value(
+            envoy_extensions_load_balancing_policies_ring_hash_v3_RingHash_minimum_ring_size(
+                resource))
+            .value_or(1024);
+    {
+      ValidationErrors::ScopedField field(errors, ".minimum_ring_size");
+      if (min_ring_size == 0 || min_ring_size > 8388608) {
+        errors->AddError("value must be in the range [1, 8388608]");
+      }
+      if (min_ring_size > max_ring_size) {
+        errors->AddError("cannot be greater than maximum_ring_size");
+      }
+    }
+    return Json::Object{
+        {"ring_hash_experimental",
+         Json::FromObject({
+             {"minRingSize", Json::FromNumber(min_ring_size)},
+             {"maxRingSize", Json::FromNumber(max_ring_size)},
+         })},
+    };
+  }
+
+  absl::string_view type() override { return Type(); }
+
+  static absl::string_view Type() {
+    return "envoy.extensions.load_balancing_policies.ring_hash.v3.RingHash";
+  }
+};
+
+class WrrLocalityLbPolicyConfigFactory final
+    : public XdsLbPolicyRegistry::ConfigFactory {
+ public:
+  Json::Object ConvertXdsLbPolicyConfig(
+      const XdsLbPolicyRegistry* registry,
+      const XdsResourceType::DecodeContext& context,
+      absl::string_view configuration, ValidationErrors* errors,
+      int recursion_depth) override {
+    const auto* resource =
+        envoy_extensions_load_balancing_policies_wrr_locality_v3_WrrLocality_parse(
+            configuration.data(), configuration.size(), context.arena);
+    if (resource == nullptr) {
+      errors->AddError("can't decode WrrLocality LB policy config");
+      return {};
+    }
+    ValidationErrors::ScopedField field(errors, ".endpoint_picking_policy");
+    const auto* endpoint_picking_policy =
+        envoy_extensions_load_balancing_policies_wrr_locality_v3_WrrLocality_endpoint_picking_policy(
+            resource);
+    if (endpoint_picking_policy == nullptr) {
+      errors->AddError("field not present");
+      return {};
+    }
+    auto child_policy = registry->ConvertXdsLbPolicyConfig(
+        context, endpoint_picking_policy, errors, recursion_depth + 1);
+    return Json::Object{
+        {"xds_wrr_locality_experimental",
+         Json::FromObject(
+             {{"childPolicy", Json::FromArray(std::move(child_policy))}})}};
+  }
+
+  absl::string_view type() override { return Type(); }
+
+  static absl::string_view Type() {
+    return "envoy.extensions.load_balancing_policies.wrr_locality.v3."
+           "WrrLocality";
+  }
+};
+
+class PickFirstLbPolicyConfigFactory final
+    : public XdsLbPolicyRegistry::ConfigFactory {
+ public:
+  Json::Object ConvertXdsLbPolicyConfig(
+      const XdsLbPolicyRegistry* /*registry*/,
+      const XdsResourceType::DecodeContext& context,
+      absl::string_view configuration, ValidationErrors* errors,
+      int /*recursion_depth*/) override {
+    const auto* resource =
+        envoy_extensions_load_balancing_policies_pick_first_v3_PickFirst_parse(
+            configuration.data(), configuration.size(), context.arena);
+    if (resource == nullptr) {
+      errors->AddError("can't decode PickFirst LB policy config");
+      return {};
+    }
+    bool shuffle_address_list =
+        envoy_extensions_load_balancing_policies_pick_first_v3_PickFirst_shuffle_address_list(
+            resource);
+    return Json::Object{
+        {"pick_first",
+         Json::FromObject({
+             {"shuffleAddressList", Json::FromBool(shuffle_address_list)},
+         })}};
+  }
+
+  absl::string_view type() override { return Type(); }
+
+  static absl::string_view Type() {
+    return "envoy.extensions.load_balancing_policies.pick_first.v3.PickFirst";
+  }
+};
+
+}  // namespace
+
+XdsLbPolicyRegistry GrpcXdsBootstrapBuilder::CreateXdsLbPolicyRegistry() {
+  XdsLbPolicyRegistry registry;
+  registry.RegisterFactory(std::make_unique<RingHashLbPolicyConfigFactory>());
+  registry.RegisterFactory(std::make_unique<RoundRobinLbPolicyConfigFactory>());
+  registry.RegisterFactory(
+      std::make_unique<ClientSideWeightedRoundRobinLbPolicyConfigFactory>());
+  registry.RegisterFactory(
+      std::make_unique<WrrLocalityLbPolicyConfigFactory>());
+  registry.RegisterFactory(std::make_unique<PickFirstLbPolicyConfigFactory>());
+  return registry;
+}
+
+//
+// Audit logger registry
+//
+
+namespace {
+
+class StdoutLoggerConfigFactory final
+    : public XdsAuditLoggerRegistry::ConfigFactory {
+ public:
+  Json::Object ConvertXdsAuditLoggerConfig(
+      const XdsResourceType::DecodeContext& /*context*/,
+      absl::string_view /*configuration*/,
+      ValidationErrors* /*errors*/) override {
+    // Stdout logger has no configuration right now. So we don't process the
+    // config protobuf.
+    return {};
+  }
+
+  absl::string_view type() override { return Type(); }
+  absl::string_view name() override { return "stdout_logger"; }
+
+  static absl::string_view Type() {
+    return "envoy.extensions.rbac.audit_loggers.stream.v3.StdoutAuditLog";
+  }
+};
+
+}  // namespace
+
+XdsAuditLoggerRegistry GrpcXdsBootstrapBuilder::CreateXdsAuditLoggerRegistry() {
+  XdsAuditLoggerRegistry registry;
+  registry.RegisterFactory(std::make_unique<StdoutLoggerConfigFactory>());
+  return registry;
+}
+
+//
+// XdsHttpRouterFilterFactory
+//
+
+absl::string_view XdsHttpRouterFilterFactory::ConfigProtoName() const {
+  return "envoy.extensions.filters.http.router.v3.Router";
+}
+
+absl::string_view XdsHttpRouterFilterFactory::OverrideConfigProtoName() const {
+  return "";
+}
+
+void XdsHttpRouterFilterFactory::PopulateSymtab(upb_DefPool* symtab) const {
+  envoy_extensions_filters_http_router_v3_Router_getmsgdef(symtab);
+}
+
+std::optional<Json> XdsHttpRouterFilterFactory::GenerateFilterConfig(
+    absl::string_view /*instance_name*/,
+    const XdsResourceType::DecodeContext& context,
+    const XdsExtension& extension, ValidationErrors* errors) const {
+  const absl::string_view* serialized_filter_config =
+      std::get_if<absl::string_view>(&extension.value);
+  if (serialized_filter_config == nullptr) {
+    errors->AddError("could not parse router filter config");
+    return std::nullopt;
+  }
+  if (envoy_extensions_filters_http_router_v3_Router_parse(
+          serialized_filter_config->data(), serialized_filter_config->size(),
+          context.arena) == nullptr) {
+    errors->AddError("could not parse router filter config");
+    return std::nullopt;
+  }
+  return Json();
+}
+
+std::optional<Json> XdsHttpRouterFilterFactory::GenerateFilterConfigOverride(
+    absl::string_view /*instance_name*/,
+    const XdsResourceType::DecodeContext& /*context*/,
+    const XdsExtension& /*extension*/, ValidationErrors* errors) const {
+  errors->AddError("router filter does not support config override");
+  return std::nullopt;
+}
+
+RefCountedPtr<const FilterConfig>
+XdsHttpRouterFilterFactory::ParseTopLevelConfig(
+    absl::string_view /*instance_name*/,
+    const XdsResourceType::DecodeContext& context,
+    const XdsExtension& extension, ValidationErrors* errors) const {
+  const absl::string_view* serialized_filter_config =
+      std::get_if<absl::string_view>(&extension.value);
+  if (serialized_filter_config == nullptr) {
+    errors->AddError("could not parse router filter config");
+    return nullptr;
+  }
+  if (envoy_extensions_filters_http_router_v3_Router_parse(
+          serialized_filter_config->data(), serialized_filter_config->size(),
+          context.arena) == nullptr) {
+    errors->AddError("could not parse router filter config");
+    return nullptr;
+  }
+  return nullptr;
+}
+
+RefCountedPtr<const FilterConfig>
+XdsHttpRouterFilterFactory::ParseOverrideConfig(
+    absl::string_view /*instance_name*/,
+    const XdsResourceType::DecodeContext& /*context*/,
+    const XdsExtension& /*extension*/, ValidationErrors* errors) const {
+  errors->AddError("router filter does not support config override");
+  return nullptr;
+}
+
+}  // namespace grpc_core

data/src/core/xds/grpc/xds_bootstrap_grpc_builder.h

@@ -0,0 +1,97 @@
+//
+// Copyright 2021 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#ifndef GRPC_SRC_CORE_XDS_GRPC_XDS_BOOTSTRAP_GRPC_BUILDER_H
+#define GRPC_SRC_CORE_XDS_GRPC_XDS_BOOTSTRAP_GRPC_BUILDER_H
+
+#include <memory>
+#include <optional>
+
+#include "src/core/util/validation_errors.h"
+#include "src/core/xds/grpc/xds_audit_logger_registry.h"
+#include "src/core/xds/grpc/xds_bootstrap_grpc.h"
+#include "src/core/xds/grpc/xds_common_types.h"
+#include "src/core/xds/grpc/xds_http_filter.h"
+#include "src/core/xds/grpc/xds_http_filter_registry.h"
+#include "src/core/xds/grpc/xds_lb_policy_registry.h"
+#include "src/core/xds/xds_client/xds_resource_type.h"
+#include "upb/reflection/def.h"
+#include "absl/functional/any_invocable.h"
+#include "absl/status/statusor.h"
+#include "absl/strings/string_view.h"
+
+namespace grpc_core {
+
+class GrpcXdsBootstrapBuilder final {
+ public:
+  static absl::StatusOr<std::unique_ptr<GrpcXdsBootstrap>> Build(
+      absl::string_view json_string);
+
+  static void SetXdsHttpFilterFactoryInitForTest(
+      absl::AnyInvocable<void(XdsHttpFilterRegistry&)> init);
+
+  static XdsHttpFilterRegistry CreateXdsHttpFilterRegistry(
+      bool register_builtins = true);
+
+  static XdsLbPolicyRegistry CreateXdsLbPolicyRegistry();
+
+  static XdsAuditLoggerRegistry CreateXdsAuditLoggerRegistry();
+};
+
+// Exposed for testing purposes only.
+class XdsHttpRouterFilterFactory final : public XdsHttpFilterFactory {
+ public:
+  absl::string_view ConfigProtoName() const override;
+  absl::string_view OverrideConfigProtoName() const override;
+  void PopulateSymtab(upb_DefPool* symtab) const override;
+  std::optional<Json> GenerateFilterConfig(
+      absl::string_view /*instance_name*/,
+      const XdsResourceType::DecodeContext& context,
+      const XdsExtension& extension, ValidationErrors* errors) const override;
+  std::optional<Json> GenerateFilterConfigOverride(
+      absl::string_view /*instance_name*/,
+      const XdsResourceType::DecodeContext& context,
+      const XdsExtension& extension, ValidationErrors* errors) const override;
+  const grpc_channel_filter* channel_filter() const override { return nullptr; }
+  absl::StatusOr<ServiceConfigJsonEntry> GenerateMethodConfig(
+      const Json& /*hcm_filter_config*/,
+      const Json* /*filter_config_override*/) const override {
+    // This will never be called, since channel_filter() returns null.
+    return absl::UnimplementedError("router filter should never be called");
+  }
+  absl::StatusOr<ServiceConfigJsonEntry> GenerateServiceConfig(
+      const Json& /*hcm_filter_config*/) const override {
+    // This will never be called, since channel_filter() returns null.
+    return absl::UnimplementedError("router filter should never be called");
+  }
+  void AddFilter(FilterChainBuilder& /*builder*/,
+                 RefCountedPtr<const FilterConfig> /*config*/) const override {}
+  RefCountedPtr<const FilterConfig> ParseTopLevelConfig(
+      absl::string_view instance_name,
+      const XdsResourceType::DecodeContext& context,
+      const XdsExtension& extension, ValidationErrors* errors) const override;
+  RefCountedPtr<const FilterConfig> ParseOverrideConfig(
+      absl::string_view instance_name,
+      const XdsResourceType::DecodeContext& context,
+      const XdsExtension& extension, ValidationErrors* errors) const override;
+  bool IsSupportedOnClients() const override { return true; }
+  bool IsSupportedOnServers() const override { return true; }
+  bool IsTerminalFilter() const override { return true; }
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_XDS_GRPC_XDS_BOOTSTRAP_GRPC_BUILDER_H

data/src/core/xds/grpc/xds_certificate_provider.cc

@@ -48,8 +48,8 @@ class RootCertificatesWatcher final
       : parent_(std::move(parent)) {}
 
   void OnCertificatesChanged(std::shared_ptr<RootCertInfo> roots,
-                             std::optional<PemKeyCertPairList>
-                             /* key_cert_pairs */) override {
+                             std::optional<KeyCertPairsOrSelector>
+                             /* key_cert_pairs_or_selector */) override {
     if (roots != nullptr) {
       parent_->SetKeyMaterials("", roots, std::nullopt);
     }
@@ -79,11 +79,11 @@ class IdentityCertificatesWatcher final
       RefCountedPtr<grpc_tls_certificate_distributor> parent)
       : parent_(std::move(parent)) {}
 
-  void OnCertificatesChanged(
-      std::shared_ptr<RootCertInfo> /* root_certs */,
-      std::optional<PemKeyCertPairList> key_cert_pairs) override {
-    if (key_cert_pairs.has_value()) {
-      parent_->SetKeyMaterials("", nullptr, key_cert_pairs);
+  void OnCertificatesChanged(std::shared_ptr<RootCertInfo> /* root_certs */,
+                             std::optional<KeyCertPairsOrSelector>
+                                 key_cert_pairs_or_selector) override {
+    if (key_cert_pairs_or_selector.has_value()) {
+      parent_->SetKeyMaterials("", nullptr, key_cert_pairs_or_selector);
     }
   }
 

data/src/core/xds/grpc/xds_client_grpc.cc

@@ -16,7 +16,6 @@
 
 #include "src/core/xds/grpc/xds_client_grpc.h"
 
-#include <grpc/grpc.h>
 #include <grpc/impl/channel_arg_names.h>
 #include <grpc/slice.h>
 #include <grpc/support/alloc.h>
@@ -35,22 +34,19 @@
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/debug/trace.h"
 #include "src/core/lib/event_engine/channel_args_endpoint_config.h"
-#include "src/core/lib/iomgr/error.h"
 #include "src/core/lib/iomgr/exec_ctx.h"
 #include "src/core/lib/slice/slice.h"
 #include "src/core/lib/slice/slice_internal.h"
-#include "src/core/lib/transport/error_utils.h"
 #include "src/core/telemetry/metrics.h"
 #include "src/core/util/debug_location.h"
-#include "src/core/util/down_cast.h"
 #include "src/core/util/env.h"
 #include "src/core/util/load_file.h"
-#include "src/core/util/orphanable.h"
 #include "src/core/util/ref_counted_ptr.h"
 #include "src/core/util/sync.h"
 #include "src/core/util/time.h"
 #include "src/core/util/upb_utils.h"
 #include "src/core/xds/grpc/xds_bootstrap_grpc.h"
+#include "src/core/xds/grpc/xds_bootstrap_grpc_builder.h"
 #include "src/core/xds/grpc/xds_transport_grpc.h"
 #include "src/core/xds/xds_client/xds_api.h"
 #include "src/core/xds/xds_client/xds_bootstrap.h"
@@ -205,7 +201,7 @@ absl::StatusOr<std::string> FindBootstrapContents()
         << "Got bootstrap file location from GRPC_XDS_BOOTSTRAP "
            "environment variable: "
         << *path;
-    auto contents = LoadFile(*path, /*add_null_terminator=*/false);
+    auto contents = LoadFile(*path);
     if (!contents.ok()) return contents.status();
     return std::string(contents->as_string_view());
   }
@@ -238,7 +234,7 @@ absl::StatusOr<std::shared_ptr<GrpcXdsBootstrap>> GetOrCreateGlobalBootstrap()
     GRPC_TRACE_LOG(xds_client, INFO)
         << "xDS bootstrap contents: " << *bootstrap_contents;
     // Parse bootstrap.
-    auto bootstrap = GrpcXdsBootstrap::Create(*bootstrap_contents);
+    auto bootstrap = GrpcXdsBootstrapBuilder::Build(*bootstrap_contents);
     if (!bootstrap.ok()) return bootstrap.status();
     *g_parsed_bootstrap = std::move(*bootstrap);
   }
@@ -274,7 +270,7 @@ absl::StatusOr<RefCountedPtr<GrpcXdsClient>> GrpcXdsClient::GetOrCreate(
   if (bootstrap_config.has_value()) {
     GRPC_TRACE_LOG(xds_client, INFO)
         << "xDS bootstrap contents: " << *bootstrap_config;
-    auto bootstrap = GrpcXdsBootstrap::Create(*bootstrap_config);
+    auto bootstrap = GrpcXdsBootstrapBuilder::Build(*bootstrap_config);
     if (!bootstrap.ok()) return bootstrap.status();
     grpc_channel_args* xds_channel_args = args.GetPointer<grpc_channel_args>(
         GRPC_ARG_TEST_ONLY_DO_NOT_USE_IN_PROD_XDS_CLIENT_CHANNEL_ARGS);