xds: add support for custom, per-target credentials on the transport.

xds/src/main/java/io/grpc/xds/GrpcXdsTransportFactory.java

@@ -19,6 +19,7 @@
 import static com.google.common.base.Preconditions.checkNotNull;
 
 import com.google.common.annotations.VisibleForTesting;
+import io.grpc.CallCredentials;
 import io.grpc.CallOptions;
 import io.grpc.ChannelCredentials;
 import io.grpc.ClientCall;
@@ -35,22 +36,33 @@
 final class GrpcXdsTransportFactory implements XdsTransportFactory {
 
   static final GrpcXdsTransportFactory DEFAULT_XDS_TRANSPORT_FACTORY =
-      new GrpcXdsTransportFactory();
+      new GrpcXdsTransportFactory(null);
+
+  private final CallCredentials callCredentials;
+
+  GrpcXdsTransportFactory(CallCredentials callCredentials) {
+    this.callCredentials = callCredentials;
+  }
 
   @Override
   public XdsTransport create(Bootstrapper.ServerInfo serverInfo) {
-    return new GrpcXdsTransport(serverInfo);
+    GrpcXdsTransport transport = new GrpcXdsTransport(serverInfo);
+    transport.setCallCredentials(callCredentials);
+    return transport;
   }
 
   @VisibleForTesting
   public XdsTransport createForTest(ManagedChannel channel) {
-    return new GrpcXdsTransport(channel);
+    GrpcXdsTransport transport = new GrpcXdsTransport(channel);
+    transport.setCallCredentials(callCredentials);
+    return transport;
   }
 
   @VisibleForTesting
   static class GrpcXdsTransport implements XdsTransport {
 
     private final ManagedChannel channel;
+    private CallCredentials callCredentials;
 
     public GrpcXdsTransport(Bootstrapper.ServerInfo serverInfo) {
       String target = serverInfo.target();
@@ -65,14 +77,19 @@ public GrpcXdsTransport(ManagedChannel channel) {
       this.channel = checkNotNull(channel, "channel");
     }
 
+    void setCallCredentials(CallCredentials callCredentials) {
+      this.callCredentials = callCredentials;
+    }
+
     @Override
     public <ReqT, RespT> StreamingCall<ReqT, RespT> createStreamingCall(
         String fullMethodName,
         MethodDescriptor.Marshaller<ReqT> reqMarshaller,
         MethodDescriptor.Marshaller<RespT> respMarshaller) {
       Context prevContext = Context.ROOT.attach();
       try {
-        return new XdsStreamingCall<>(fullMethodName, reqMarshaller, respMarshaller);
+        return new XdsStreamingCall<>(
+            fullMethodName, reqMarshaller, respMarshaller, callCredentials);
       } finally {
         Context.ROOT.detach(prevContext);
       }
@@ -89,16 +106,21 @@ private class XdsStreamingCall<ReqT, RespT> implements
 
       private final ClientCall<ReqT, RespT> call;
 
-      public XdsStreamingCall(String methodName, MethodDescriptor.Marshaller<ReqT> reqMarshaller,
-                              MethodDescriptor.Marshaller<RespT> respMarshaller) {
-        this.call = channel.newCall(
-            MethodDescriptor.<ReqT, RespT>newBuilder()
-                .setFullMethodName(methodName)
-                .setType(MethodDescriptor.MethodType.BIDI_STREAMING)
-                .setRequestMarshaller(reqMarshaller)
-                .setResponseMarshaller(respMarshaller)
-                .build(),
-            CallOptions.DEFAULT); // TODO(zivy): support waitForReady
+      public XdsStreamingCall(
+          String methodName,
+          MethodDescriptor.Marshaller<ReqT> reqMarshaller,
+          MethodDescriptor.Marshaller<RespT> respMarshaller,
+          CallCredentials callCredentials) {
+        this.call =
+            channel.newCall(
+                MethodDescriptor.<ReqT, RespT>newBuilder()
+                    .setFullMethodName(methodName)
+                    .setType(MethodDescriptor.MethodType.BIDI_STREAMING)
+                    .setRequestMarshaller(reqMarshaller)
+                    .setResponseMarshaller(respMarshaller)
+                    .build(),
+                CallOptions.DEFAULT.withCallCredentials(
+                    callCredentials)); // TODO(zivy): support waitForReady
       }
 
       @Override

xds/src/main/java/io/grpc/xds/SharedXdsClientPoolProvider.java

@@ -17,11 +17,11 @@
 package io.grpc.xds;
 
 import static com.google.common.base.Preconditions.checkNotNull;
-import static io.grpc.xds.GrpcXdsTransportFactory.DEFAULT_XDS_TRANSPORT_FACTORY;
 
 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.collect.ImmutableList;
 import com.google.errorprone.annotations.concurrent.GuardedBy;
+import io.grpc.CallCredentials;
 import io.grpc.MetricRecorder;
 import io.grpc.internal.ExponentialBackoffPolicy;
 import io.grpc.internal.GrpcUtil;
@@ -153,16 +153,21 @@ public XdsClient getObject() {
           }
           scheduler = SharedResourceHolder.get(GrpcUtil.TIMER_SERVICE);
           metricReporter = new XdsClientMetricReporterImpl(metricRecorder, target);
-          xdsClient = new XdsClientImpl(
-              DEFAULT_XDS_TRANSPORT_FACTORY,
-              bootstrapInfo,
-              scheduler,
-              BACKOFF_POLICY_PROVIDER,
-              GrpcUtil.STOPWATCH_SUPPLIER,
-              TimeProvider.SYSTEM_TIME_PROVIDER,
-              MessagePrinter.INSTANCE,
-              new TlsContextManagerImpl(bootstrapInfo),
-              metricReporter);
+          CallCredentials transportCallCreds =
+              XdsTransportCallCredentialsProvider.getTransportCallCredentials(target);
+          GrpcXdsTransportFactory xdsTransportFactory =
+              new GrpcXdsTransportFactory(transportCallCreds);
+          xdsClient =
+              new XdsClientImpl(
+                  xdsTransportFactory,
+                  bootstrapInfo,
+                  scheduler,
+                  BACKOFF_POLICY_PROVIDER,
+                  GrpcUtil.STOPWATCH_SUPPLIER,
+                  TimeProvider.SYSTEM_TIME_PROVIDER,
+                  MessagePrinter.INSTANCE,
+                  new TlsContextManagerImpl(bootstrapInfo),
+                  metricReporter);
           metricReporter.setXdsClient(xdsClient);
         }
         refCount++;

xds/src/main/java/io/grpc/xds/XdsTransportCallCredentialsProvider.java

@@ -0,0 +1,56 @@
+/*
+ * Copyright 2025 The gRPC Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.grpc.xds;
+
+import io.grpc.CallCredentials;
+import io.grpc.Internal;
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+
+/**
+ * Stores custom call credentials to use on the xDS transport for specific targets, and supplies
+ * them to the xDS client.
+ */
+@Internal
+public final class XdsTransportCallCredentialsProvider {
+  private static final Map<String, CallCredentials> xdsTransportCallCredentials =
+      new ConcurrentHashMap<>();
+
+  public static CallCredentials getTransportCallCredentials(String target) {
+    return xdsTransportCallCredentials.get(target);
+  }
+
+  /**
+   * Registers a custom {@link CallCredentials} that is to be used on the xDS transport when
+   * resolving the given target. Must be called before the xDS client for the target is created
+   * (i.e. before the application creates a channel to the target).
+   *
+   * <p>A custom {@code CallCredentials} can only be set once on the xDS transport; in other words,
+   * it is not possible to change the custom transport {@code CallCredentials} for an existing xDS
+   * client. If {@code setTransportCallCredentials} is called when there is already an existing xDS
+   * client for the target, then this does nothing and returns false.
+   */
+  public static boolean setTransportCallCredentials(String target, CallCredentials creds) {
+    if (SharedXdsClientPoolProvider.getDefaultProvider().get(target) != null) {
+      return false;
+    }
+    xdsTransportCallCredentials.put(target, creds);
+    return true;
+  }
+
+  private XdsTransportCallCredentialsProvider() {}
+}