xDS: extension points for GoogleGrpc credentials

api/envoy/config/core/v3/grpc_service.proto

@@ -64,7 +64,7 @@ message GrpcService {
     bool skip_envoy_headers = 5;
   }
 
-  // [#next-free-field: 9]
+  // [#next-free-field: 11]
   message GoogleGrpc {
     option (udpa.annotations.versioning).previous_message_type =
         "envoy.api.v2.core.GrpcService.GoogleGrpc";
@@ -249,16 +249,35 @@ message GrpcService {
     }
 
     // The target URI when using the `Google C++ gRPC client
-    // <https://github.com/grpc/grpc>`_. SSL credentials will be supplied in
-    // :ref:`channel_credentials <envoy_v3_api_field_config.core.v3.GrpcService.GoogleGrpc.channel_credentials>`.
+    // <https://github.com/grpc/grpc>`_.
     string target_uri = 1 [(validate.rules).string = {min_len: 1}];
 
+    // The channel credentials to use. See `channel credentials
+    // <https://grpc.io/docs/guides/auth.html#credential-types>`_.
+    // Ignored if :ref:`channel_credentials_plugin
+    // <envoy_api_field_config.core.v3.GrpcService.GoogleGrpc.channel_credentials_plugin>`
+    // is set.
     ChannelCredentials channel_credentials = 2;
 
-    // A set of call credentials that can be composed with `channel credentials
+    // A list of channel credentials plugins.
+    // The data plane will iterate over the list in order and stop at the first credential type
+    // that it supports. This provides a mechanism for starting to use new credential types that
+    // are not yet supported by all data planes.
+    // [#not-implemented-hide:]
+    repeated google.protobuf.Any channel_credentials_plugin = 9;
+
+    // The call credentials to use. See `channel credentials
     // <https://grpc.io/docs/guides/auth.html#credential-types>`_.
+    // Ignored if :ref:`call_credentials_plugin
+    // <envoy_api_field_config.core.v3.GrpcService.GoogleGrpc.call_credentials_plugin>`
+    // is set.
     repeated CallCredentials call_credentials = 3;
 
+    // A list of call credentials plugins. All supported plugins will be used.
+    // Unsupported plugin types will be ignored.
+    // [#not-implemented-hide:]
+    repeated google.protobuf.Any call_credentials_plugin = 10;
+
     // The human readable prefix to use when emitting statistics for the gRPC
     // service.
     //

api/envoy/extensions/grpc_service/call_credentials/google_compute_engine/v3/BUILD

@@ -0,0 +1,7 @@
+# DO NOT EDIT. This file is generated by tools/proto_format/proto_sync.py.
+
+load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
+
+licenses(["notice"])  # Apache 2
+
+api_proto_package()

api/envoy/extensions/grpc_service/call_credentials/google_compute_engine/v3/google_compute_engine_credentials.proto

@@ -0,0 +1,14 @@
+syntax = "proto3";
+
+package envoy.extensions.grpc_service.call_credentials.google_compute_engine.v3;
+
+option java_package = "io.envoyproxy.envoy.extensions.grpc_service.call_credentials.google_compute_engine.v3";
+option java_outer_classname = "GoogleComputeEngineCredentialsProto";
+option java_multiple_files = true;
+option (udpa.annotations.file_status).package_version_status = ACTIVE;
+
+// [#protodoc-title: gRPC Google Compute Engine Credentials]
+
+// [#not-implemented-hide:]
+message GoogleComputeEngineCredentials {
+}

api/envoy/extensions/grpc_service/channel_credentials/google_default/v3/BUILD

@@ -0,0 +1,7 @@
+# DO NOT EDIT. This file is generated by tools/proto_format/proto_sync.py.
+
+load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
+
+licenses(["notice"])  # Apache 2
+
+api_proto_package()

api/envoy/extensions/grpc_service/channel_credentials/google_default/v3/google_default_credentials.proto

@@ -0,0 +1,14 @@
+syntax = "proto3";
+
+package envoy.extensions.grpc_service.channel_credentials.google_default.v3;
+
+option java_package = "io.envoyproxy.envoy.extensions.grpc_service.channel_credentials.google_default.v3";
+option java_outer_classname = "GoogleDefaultCredentialsProto";
+option java_multiple_files = true;
+option (udpa.annotations.file_status).package_version_status = ACTIVE;
+
+// [#protodoc-title: gRPC Google Default Credentials]
+
+// [#not-implemented-hide:]
+message GoogleDefaultCredentials {
+}

api/envoy/extensions/grpc_service/channel_credentials/insecure/v3/BUILD

@@ -0,0 +1,7 @@
+# DO NOT EDIT. This file is generated by tools/proto_format/proto_sync.py.
+
+load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
+
+licenses(["notice"])  # Apache 2
+
+api_proto_package()

api/envoy/extensions/grpc_service/channel_credentials/insecure/v3/insecure_credentials.proto

@@ -0,0 +1,14 @@
+syntax = "proto3";
+
+package envoy.extensions.grpc_service.channel_credentials.insecure.v3;
+
+option java_package = "io.envoyproxy.envoy.extensions.grpc_service.channel_credentials.insecure.v3";
+option java_outer_classname = "InsecureCredentialsProto";
+option java_multiple_files = true;
+option (udpa.annotations.file_status).package_version_status = ACTIVE;
+
+// [#protodoc-title: gRPC Insecure Credentials]
+
+// [#not-implemented-hide:]
+message InsecureCredentials {
+}

api/envoy/extensions/grpc_service/channel_credentials/local/v3/BUILD

@@ -0,0 +1,7 @@
+# DO NOT EDIT. This file is generated by tools/proto_format/proto_sync.py.
+
+load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
+
+licenses(["notice"])  # Apache 2
+
+api_proto_package()

api/envoy/extensions/grpc_service/channel_credentials/local/v3/local_credentials.proto

@@ -0,0 +1,14 @@
+syntax = "proto3";
+
+package envoy.extensions.grpc_service.channel_credentials.local.v3;
+
+option java_package = "io.envoyproxy.envoy.extensions.grpc_service.channel_credentials.local.v3";
+option java_outer_classname = "LocalCredentialsProto";
+option java_multiple_files = true;
+option (udpa.annotations.file_status).package_version_status = ACTIVE;
+
+// [#protodoc-title: gRPC Local Credentials]
+
+// [#not-implemented-hide:]
+message LocalCredentials {
+}

api/envoy/extensions/grpc_service/channel_credentials/tls/v3/BUILD

@@ -0,0 +1,11 @@
+# DO NOT EDIT. This file is generated by tools/proto_format/proto_sync.py.
+
+load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
+
+licenses(["notice"])  # Apache 2
+
+api_proto_package(
+    deps = [
+        "//envoy/extensions/transport_sockets/tls/v3:pkg",
+    ],
+)

api/envoy/extensions/grpc_service/channel_credentials/tls/v3/tls_credentials.proto

@@ -0,0 +1,22 @@
+syntax = "proto3";
+
+package envoy.extensions.grpc_service.channel_credentials.tls.v3;
+
+import "envoy/extensions/transport_sockets/tls/v3/tls.proto";
+
+option java_package = "io.envoyproxy.envoy.extensions.grpc_service.channel_credentials.tls.v3";
+option java_outer_classname = "TlsCredentialsProto";
+option java_multiple_files = true;
+option (udpa.annotations.file_status).package_version_status = ACTIVE;
+
+// [#protodoc-title: gRPC TLS Credentials]
+
+// [#not-implemented-hide:]
+message TlsCredentials {
+  // The certificate provider instance for the root cert. Must be set.
+  transport_sockets.tls.v3.CommonTlsContext.CertificateProviderInstance root_certificate_provider = 1;
+
+  // The certificate provider instance for the identity cert. Optional;
+  // if unset, no identity certificate will be sent to the server.
+  transport_sockets.tls.v3.CommonTlsContext.CertificateProviderInstance identity_certificate_provider = 2;
+}

api/envoy/extensions/grpc_service/channel_credentials/xds/v3/BUILD

@@ -0,0 +1,11 @@
+# DO NOT EDIT. This file is generated by tools/proto_format/proto_sync.py.
+
+load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
+
+licenses(["notice"])  # Apache 2
+
+api_proto_package(
+    deps = [
+        "//envoy/core/core/v3:pkg",
+    ],
+)

api/envoy/extensions/grpc_service/channel_credentials/xds/v3/xds_credentials.proto

@@ -0,0 +1,18 @@
+syntax = "proto3";
+
+package envoy.extensions.grpc_service.channel_credentials.xds.v3;
+
+import "google/protobuf/any.proto";
+
+option java_package = "io.envoyproxy.envoy.extensions.grpc_service.channel_credentials.xds.v3";
+option java_outer_classname = "XdsCredentialsProto";
+option java_multiple_files = true;
+option (udpa.annotations.file_status).package_version_status = ACTIVE;
+
+// [#protodoc-title: gRPC xDS Credentials]
+
+// [#not-implemented-hide:]
+message XdsCredentials {
+  // Fallback credentials. Required.
+  google.protobuf.Any fallback_credentials = 1;
+}