[xDS] A97 - JWT token file call creds

[Zgoda91]

implementing gRFC A97 grpc/proposal#492

[Zgoda91]

@ejona86 Could you please review this PR when you get a chance? Thanks!

[ejona86]

The shape of what I saw looked good. I didn't pay attention to any of the tests yet. I need to look through the provider plumbing more. But wanted to send the comments I have.

[Zgoda91]

@ejona86 PR ready for second round

[Zgoda91]

@ejona86 kindly reminder about this forgotten piece :)

[ejona86]

Just sending what I have.

We're going to want to make a clone of XdsCredentialsRegistry for CallCreds, because they are two different config namespaces, the gRFC says we'd create a new registry, and there's really no reason to provide both call creds and channel creds. However, I see that XdsCredentialsRegistry.getHardCodedClasses() should be deleted; we should just hard-code an empty list to InternalServiceProviders.loadAll(); none of this will be used on Android.

[ejona86]

When I mentioned removing the TemporaryFolder usage I was thinking you'd pass in a File (so the caller would be responsible for temporaryFolder.newFile()). deleteOnExit() isn't the worst, but generally a code smell.

[ejona86]

I'd expect this to be in the same package as JwtTokenFileXdsCredentialsProvider. I'm less concerned with which package, and just that they are co-located.

Things like this directly in io.grpc.xds are ideally package-private. Sometimes we have to make it public, but then we'd take some steps to hide it from the javadoc and mark it as @Internal. There's a few different options. I'm not seeing a need for anything public here (once the package is sorted out).

(I'm not claiming the xds package structure makes sense. io.grpc.xds.client and orca are pretty well separated, but the others are a bit haphazard.)

[ejona86]

Very few implementations implement this. Give this a default implementation that returns null?

[ejona86]

You don't need a new method.

protected Object getImplSpecificConfig(Map<String, ?> serverConfig, String serverUri)
      throws XdsInitializationException {
  ChannelCredentials channelCreds = getChannelCredentials(serverConfig, serverUri);
  CallCredentials callCreds = getCallCredentials(serverConfig, serverUri);
  if (callCreds != null) {
    channelCreds = CompositeChannelCredentials.create(channelCreds, callCreds);
  }
  return channelCreds;
}

[ejona86]

You don't need to pull the CallCreds back out. The gRPC Channel is already using them, as they were passed to newChannelBuilder(). Any CallCredentials added later, like in XdsStreamingCall's constructor, will be combined together with the call creds passed to newChannelBuilder().

The callCredentials passed into this method are a bit weird. They could be passed to newChannelBuilder(), but let's just leave them alone.