xds bootstrap: enable using JWT Call Credentials (part 2 for A97) - #8535
Closed
dimpavloff wants to merge 81 commits into
Closed
dimpavloff wants to merge 81 commits into
dimpavloff wants to merge 81 commits into
Conversation
This PR simplifies IP address handling in `lbBalancer.processServerList`. From [net.JoinHostPort](https://pkg.go.dev/net#JoinHostPort): > JoinHostPort combines host and port into a network address of the form "host:port". If host contains a colon, as found in literal IPv6 addresses, then JoinHostPort returns "[host]:port". RELEASE NOTES: none
This PR updates Prometheus-related dependencies in grpc-go to fix compatibility issues caused by recent API changes in github.com/prometheus/otlptranslator. Complementing the broader dependency updates made in PR grpc#8497. RELEASE NOTES: N/A
…d in CallbackSerializer (grpc#8489) [The current minimum supported Go version is now 1.23](https://github.com/grpc/grpc-go/blob/62ec29fd9b3f9ea3cea6dc08a31e837aa92678b7/go.mod#L3). `context.AfterFunc` is available for all of grpc-go's latest version users. Thus we can do this pending TODO. `context.AfterFunc` would invoke the given function for both _immediate_ context cancelation and timer-based context cancelation (`WithTimeout`, `WithDeadline`). So I think this change is safe. RELEASE NOTES: N/A
… from the xdsChannel (grpc#8498) This is a small code change that simplifies how a callback is scheduled. The `xdsChannel` will no longer directly access the serializer inside the `authority` type. Instead, the authority type will now handle the scheduling itself. This makes the code cleaner and moves the scheduling logic to where it belongs. RELEASE NOTES: none
…n test (grpc#8467) RELEASE NOTES: N/A Fixes: grpc#8462 The main issue was that the requests were getting dropped since we use a [non-blocking send](https://github.com/grpc/grpc-go/blob/a5e7cd6d4c2c31b1e6649789c2ddc9a82ad6b5fa/xds/internal/balancer/cdsbalancer/cdsbalancer_test.go#L222C5-L227C6) for resources in test along with buffer size of just [one](https://github.com/grpc/grpc-go/blob/a5e7cd6d4c2c31b1e6649789c2ddc9a82ad6b5fa/xds/internal/balancer/cdsbalancer/cdsbalancer_test.go#L210) which was resulting in resource request updates being dropped if the receiver is not executing at the exact moment. Fix: Changed the `setupManagementServer` to take `listener` and `OnStreamReq` function as a parameter and in the `TestWatcher` added a blocking send whenever a cluster resource is requested.
…pc#8515) Fixes grpc#7290, ensuring that only user-facing functionality remains in the top-level xds package. Updates all import paths and aliases to reference the new internal/xds package, using aliases (e.g., `internal` → `xds` or `xdsinternal`) where needed to minimize changes to call sites. No functional changes intended; this is purely a package path reorganization. RELEASE NOTES: none
…ler_server (grpc#8519) Fixes: grpc#8514 The mutex that guards the trailers should be held while copying the trailers. We do lock the mutex in [the regular gRPC server transport](https://github.com/grpc/grpc-go/blob/9ac0ec87ca2ecc66b3c0c084708aef768637aef6/internal/transport/http2_server.go#L1140-L1142), but have missed it in the std lib http/2 transport. The only place where a write happens is `writeStatus()` is when the status contains a proto. https://github.com/grpc/grpc-go/blob/4375c784450aa7e43ff15b8b2879c896d0917130/internal/transport/handler_server.go#L251-L252 RELEASE NOTES: * transport: Fix a data race while copying headers for stats handlers in the std lib http2 server transport.
dimpavloff
marked this pull request as draft
August 22, 2025 11:33
Contributor
Author
|
Apologies, I messed up the PR stacking, will open a new one |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part two for grpc/proposal#492 (A97). It's stacked on top of #8431
What this PR does is:
internal/xds/bootstrapwith support for loading multiple PerRPCCallCredentials specifed in a newcall_credsfield in the boostrap file as per A97xds/internal/xdsclient/clientimpl.goto use the call credentials when constructing the clientxds/bootstrapto register thejwtcredscall credentials and make them available ifGRPC_EXPERIMENTAL_XDS_BOOTSTRAP_CALL_CREDSis enabledI have added
DialOptionsWithCallCredsForTransportbecause, even though current and future call credentials are likely to all expect secure transport, I thought it would be safer to check of insecure transport just in case. If you prefer, I can just updateDialOptionsto use all call credentials regardless of the transport.Relates to istio/istio#53532
RELEASE NOTES: