xds: Add configuration objects for ExtAuthz, GrpcService and Bootstrap changes for GrpcService

[sauravzg]

This commit introduces configuration objects for the external authorization (ExtAuthz) filter and the gRPC service and corresponding translations from XDS proto and Bootstrap. These classes provide a structured, immutable representation of the subset of the configuration defined in the xDS protobuf messages.

This PR should mostly now (hopefully ) be compliant with grpc/proposal#510 but without

• CallCredentials (since I don't see A97) being implemented yet and would prefer to do it in a followup , we return empty optional)
• TlsCredentials( since it's non trivial to construct a TLS credentials object, we throw an exception)
• LocalCredentials(Java does't support these, we throw an exception)

The main new classes are:

• ExtAuthzConfig: Represents the configuration for the ExtAuthz filter, including settings for the gRPC service, header mutation rules, and other filter behaviors.
• GrpcServiceConfig: Represents the configuration for a gRPC service, including the target URI, credentials, and other settings.
• HeaderMutationRulesConfig: Represents the configuration for header mutation rules.
• ChannelCredsConfig and friends: To allow comparison between credential configuration , to allow caching based on creds which'll be needed in followup PRs for authz and proc.

The relevant sections of the spec are

• GrpcService: A102: xDS GrpcService Support proposal#510
• ExtAuthz: https://github.com/grpc/proposal/pull/481/files#diff-6bb76a24aa142cc33db9218509688f01b30c8885d2fd8849f164244e68cd54eaR106-R190

This commit also includes parsers to create these configuration objects from the corresponding protobuf messages, as well as unit tests for the new classes.

[sauravzg]

@ejona86 PTAL. I've addressed most of the comments and have updated the PR description. Apart from addresing the comments, this PR now also contains the remaining implementation of GrpcService which wasn't in scope last quarter (essentially bootstrap changes and some bootstrap abstractions).

[kannanjgithub]

/gcbrun

Will wait for the security level check to be implemented before applying token call cred.

[AgraVator]

TlsCredentials( since it's non trivial to construct a TLS credentials object, we throw an exception)

Is there a tracked issue for the follow-up PR to implement this?

[sauravzg]

TlsCredentials( since it's non trivial to construct a TLS credentials object, we throw an exception)

Is there a tracked issue for the follow-up PR to implement this?

I am not sure what's the process here when creating an issue. What sort of issue do I need to create?

[sauravzg]

@AgraVator @kannanjgithub I made a minor refactor + bugfix in the latest commit around bootstrap. PTAL

[Copilot]

Pull request overview

Adds new internal, immutable config objects and parsers for xDS GrpcService and ExtAuthz (including header mutation rules), plus bootstrap support for allowed_grpc_services, with accompanying unit tests.

Changes:

• Introduces config models + parsers for GrpcService, ExtAuthz, and HeaderMutationRules.
• Adds gRPC-service-specific validation/utilities (header validation) and xDS parsing context abstractions.
• Extends bootstrap parsing to read allowed_grpc_services and exposes it via BootstrapInfo.

Reviewed changes

Copilot reviewed 30 out of 30 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
xds/src/test/java/io/grpc/xds/internal/headermutations/HeaderMutationRulesParserTest.java	Tests for HeaderMutationRules proto parsing (success + invalid regex).
xds/src/test/java/io/grpc/xds/internal/headermutations/HeaderMutationRulesConfigTest.java	Tests defaulting and builder behavior for HeaderMutationRulesConfig.
xds/src/test/java/io/grpc/xds/internal/grpcservice/HeaderValueValidationUtilsTest.java	Tests header key/value validation rules and limits.
xds/src/test/java/io/grpc/xds/internal/grpcservice/HeaderValueTest.java	Tests HeaderValue creation for ASCII vs binary values.
xds/src/test/java/io/grpc/xds/internal/grpcservice/GrpcServiceXdsContextTestUtil.java	Test helper for creating a dummy GrpcServiceXdsContextProvider.
xds/src/test/java/io/grpc/xds/internal/grpcservice/GrpcServiceConfigParserTest.java	Extensive tests for GrpcService parsing, creds handling, metadata, timeouts, and security-aware call creds.
xds/src/test/java/io/grpc/xds/internal/extauthz/ExtAuthzConfigParserTest.java	Tests ExtAuthz parsing + integration with GrpcService parsing and header mutation rules.
xds/src/test/java/io/grpc/xds/internal/MatcherParserTest.java	Tests for MatcherParser StringMatcher and new FractionMatcher parsing.
xds/src/test/java/io/grpc/xds/GrpcBootstrapperImplTest.java	Adds tests for bootstrap allowed_grpc_services parsing and validation.
xds/src/main/java/io/grpc/xds/internal/headermutations/HeaderMutationRulesParser.java	Parser from Envoy HeaderMutationRules proto to internal config.
xds/src/main/java/io/grpc/xds/internal/headermutations/HeaderMutationRulesParseException.java	Dedicated exception type for header mutation rules parsing failures.
xds/src/main/java/io/grpc/xds/internal/headermutations/HeaderMutationRulesConfig.java	Immutable internal representation of header mutation rules.
xds/src/main/java/io/grpc/xds/internal/grpcservice/HeaderValueValidationUtils.java	Header validation utility used by GrpcService parsing.
xds/src/main/java/io/grpc/xds/internal/grpcservice/HeaderValue.java	Immutable internal header representation (string vs raw bytes).
xds/src/main/java/io/grpc/xds/internal/grpcservice/GrpcServiceXdsContextProvider.java	Interface for retrieving target-specific parsing context.
xds/src/main/java/io/grpc/xds/internal/grpcservice/GrpcServiceXdsContext.java	Immutable context object for trusted/untrusted control plane logic.
xds/src/main/java/io/grpc/xds/internal/grpcservice/GrpcServiceParseException.java	Dedicated exception type for GrpcService parsing failures.
xds/src/main/java/io/grpc/xds/internal/grpcservice/GrpcServiceConfigParser.java	Core parser for Envoy GrpcService proto into internal config + creds extraction.
xds/src/main/java/io/grpc/xds/internal/grpcservice/GrpcServiceConfig.java	Immutable internal GrpcService config model.
xds/src/main/java/io/grpc/xds/internal/grpcservice/ConfiguredChannelCredentials.java	Value type combining ChannelCredentials with comparable config.
xds/src/main/java/io/grpc/xds/internal/grpcservice/ChannelCredsConfig.java	Interface describing channel credential configuration identity.
xds/src/main/java/io/grpc/xds/internal/grpcservice/AllowedGrpcServices.java	Wrapper for per-target allowed gRPC services from bootstrap.
xds/src/main/java/io/grpc/xds/internal/grpcservice/AllowedGrpcService.java	Per-target allowed service config (channel creds + optional call creds).
xds/src/main/java/io/grpc/xds/internal/extauthz/ExtAuthzParseException.java	Dedicated exception type for ExtAuthz parsing failures.
xds/src/main/java/io/grpc/xds/internal/extauthz/ExtAuthzConfigParser.java	Parser for Envoy ExtAuthz proto into internal config + matcher/header rules parsing.
xds/src/main/java/io/grpc/xds/internal/extauthz/ExtAuthzConfig.java	Immutable internal ExtAuthz config model.
xds/src/main/java/io/grpc/xds/internal/MatcherParser.java	Adds FractionalPercent → FractionMatcher parsing.
xds/src/main/java/io/grpc/xds/client/BootstrapperImpl.java	Wires in parsing hook for allowed_grpc_services.
xds/src/main/java/io/grpc/xds/client/Bootstrapper.java	Extends BootstrapInfo to expose parsed allowed_grpc_services.
xds/src/main/java/io/grpc/xds/GrpcBootstrapperImpl.java	Implements allowed_grpc_services parsing and wraps channel creds with config identity.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.