[xDS] A65 mTLS credentials in bootstrap (part 2) #12255
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ejona86
added
the
kokoro:run
grpc-kokoro
removed
the
kokoro:run
|
@ejona86 Could you please review this PR when you get a chance? Thanks! |
kannanjgithub
previously approved these changes
Aug 28, 2025
ejona86
added
the
kokoro:run
grpc-kokoro
removed
the
kokoro:run
ejona86
reviewed
Aug 28, 2025
Zgoda91
force-pushed
the
A65_mtls_creds_in_bootstrap
branch
from
8248816 to
faaa15c
Compare
ejona86
reviewed
Sep 4, 2025
xds/src/main/java/io/grpc/xds/internal/TlsXdsCredentialsProvider.java
Outdated
Show resolved
Hide resolved
xds/src/main/java/io/grpc/xds/internal/TlsXdsCredentialsProvider.java
Outdated
Show resolved
Hide resolved
Zgoda91
changed the title
Zgoda91
force-pushed
the
A65_mtls_creds_in_bootstrap
branch
2 times, most recently
from
5a59b20 to
46f7ddc
Compare
Lifetime of `ChannelCredentials` is now bounded to `GrpcXdsTransport`
Zgoda91
force-pushed
the
A65_mtls_creds_in_bootstrap
branch
from
46f7ddc to
434579a
Compare
| private static final String CREDS_NAME = "tls"; | ||
| private static final String CERT_FILE_KEY = "certificate_file"; |
There was a problem hiding this comment.
The grfc says implementations should be able to reuse the FileWatcherCertificateProvider. It is a bit more work though - we could do similar to CertProvidersslContextProvider's usage here. (You can see it getting used during XdsClientServerSecurityTest)
- passing the plugin name as file_watcher and
- Make this class (
TlsXdsCredentialsProvider) implementWatcherinterface for the Watcher parameter that receives certificate updates - Add the returned
Handleto the list ofCloseables inResourceAllocationChannelProvider. - This will require making CertificateProviderStore.Handle public.
@ejona86 WDYT?
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
implementing gRFC A65 grpc/proposal/pull/372
This change contains:
TlsChannelCredentialsinstantiation process, which involves reading trust certificates from paths provided in the bootstrap configuration file.TlsChannelCredentialsare no longer used (as per [xDS] A65 mTLS credentials in bootstrap (part1) #12350)