feat(xds): expose CertificateProvider for custom certificate sources#2743
Open
LYZJU2019 wants to merge 2 commits into
Open
feat(xds): expose CertificateProvider for custom certificate sources#2743LYZJU2019 wants to merge 2 commits into
LYZJU2019 wants to merge 2 commits into
Conversation
LYZJU2019
force-pushed
the
lyzju2019/xds-custom-cert-provider
branch
from
July 19, 2026 21:44
1a4c1e0 to
6072b5a
Compare
Make the gRFC A29 data-plane TLS certificate provider API public so applications can supply their own certificate source instead of the built-in `file_watcher` plugin. - Promote `CertificateProvider`, `CertificateData`, and `Identity` to public API and re-export them from the crate root (TLS features only). - Add `XdsChannelBuilder::with_certificate_provider(instance_name, provider)` to register custom provider instances. They resolve by the instance name referenced in CDS `UpstreamTlsContext` resources and fully shadow a bootstrap `file_watcher` instance of the same name. - Add a general `CertProviderError::Other` variant so out-of-crate providers can report their own failures. - Allow `rustls::*` in the public API: CA roots surface as a parsed `RootCertStore`. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
LYZJU2019
force-pushed
the
lyzju2019/xds-custom-cert-provider
branch
from
July 19, 2026 21:58
6072b5a to
c5f1072
Compare
YutaoMa
reviewed
Jul 20, 2026
YutaoMa
reviewed
Jul 20, 2026
YutaoMa
reviewed
Jul 20, 2026
| pub(crate) key: Vec<u8>, | ||
| pub struct Identity { | ||
| /// PEM-encoded certificate chain. | ||
| pub cert_chain: Vec<u8>, |
Contributor
There was a problem hiding this comment.
Let's use getters/setters for this type
YutaoMa
reviewed
Jul 20, 2026
YutaoMa
reviewed
Jul 20, 2026
| &bootstrap.certificate_providers, | ||
| )?); | ||
| let cert_provider_registry = Arc::new(if self.cert_providers.is_empty() { | ||
| CertProviderRegistry::from_bootstrap(&bootstrap.certificate_providers)? |
Contributor
There was a problem hiding this comment.
since this delegates to HashMap::new() anyway, can collapse to just the 2nd branch
- Redact the private key in `Identity`'s `Debug` (manual impl). - Mark `CertProviderError` `#[non_exhaustive]` for future extensibility. - Encapsulate `Identity` behind `new()` + `cert_chain()`/`key()` accessors. - Carry CA roots as PEM bytes instead of `rustls::RootCertStore`, for symmetry with the identity bytes and to drop rustls from the public API. The verifier parses the bundle into a `RootCertStore` at handshake time. - Collapse the registry build into a single `from_bootstrap` call that takes the injected providers directly. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
tonic-xdscurrently sources data-plane (upstream) TLS certificates only from the built-infile_watcherplugin, configured through the bootstrapcertificate_providersmap (gRFC A29). Applications that obtain certificates from a different system have no way to plug in.This mirrors the pluggable certificate-provider registries in grpc-go / grpc-java: applications can register their own provider implementation and have CDS-referenced instances resolve to it.
Changes
CertificateProvider,CertificateData, andIdentityto public API and re-export them from the crate root (gated on a TLS feature).XdsChannelBuilder::with_certificate_provider(instance_name, provider)to register custom provider instances.CertProviderError::Othervariant so out-of-crate providers can surface their own failures.rustls::*in thecargo-check-external-typesallowlist:CertificateDatasurfaces CA roots as a parsedrustls::RootCertStore.Testing
cargo test -p tonic-xds --features tls-ring— allcargo clippy -p tonic-xds --features tls-ringand default (no-TLS feature).cargo docwith-D rustdoc::broken_intra_doc_links.