xds: Move channel creds creation into bootstrap parser.

CMakeLists.txt

@@ -15170,7 +15170,7 @@ endif()
 if(gRPC_BUILD_TESTS)
 
 add_executable(xds_bootstrap_test
-  test/core/client_channel/xds_bootstrap_test.cc
+  test/core/xds/xds_bootstrap_test.cc
   third_party/googletest/googletest/src/gtest-all.cc
   third_party/googletest/googlemock/src/gmock-all.cc
 )

build_autogenerated.yaml

@@ -7743,7 +7743,7 @@ targets:
   language: c++
   headers: []
   src:
-  - test/core/client_channel/xds_bootstrap_test.cc
+  - test/core/xds/xds_bootstrap_test.cc
   deps:
   - grpc_test_util
   - grpc

src/core/ext/xds/xds_bootstrap.cc

@@ -32,6 +32,8 @@
 #include "src/core/lib/gpr/env.h"
 #include "src/core/lib/gpr/string.h"
 #include "src/core/lib/iomgr/load_file.h"
+#include "src/core/lib/security/credentials/credentials.h"
+#include "src/core/lib/security/credentials/fake/fake_credentials.h"
 #include "src/core/lib/slice/slice_internal.h"
 
 namespace grpc_core {
@@ -60,17 +62,17 @@ std::string BootstrapString(const XdsBootstrap& bootstrap) {
         bootstrap.node()->locality_region, bootstrap.node()->locality_zone,
         bootstrap.node()->locality_subzone, bootstrap.node()->metadata.Dump()));
   }
-  parts.push_back(
-      absl::StrFormat("servers=[\n"
-                      "  {\n"
-                      "    uri=\"%s\",\n"
-                      "    creds=[\n",
-                      bootstrap.server().server_uri));
-  for (const auto& creds : bootstrap.server().channel_creds) {
-    parts.push_back(absl::StrFormat("      {type=\"%s\", config=%s},\n",
-                                    creds.type, creds.config.Dump()));
-  }
-  parts.push_back("    ],\n");
+  parts.push_back(absl::StrFormat(
+      "servers=[\n"
+      "  {\n"
+      "    uri=\"%s\",\n"
+      "    creds=<%s>,\n",
+      bootstrap.server().server_uri, bootstrap.server().channel_creds->type()));
+  if (bootstrap.server().channel_creds_config.type() != Json::Type::JSON_NULL) {
+    parts.push_back(
+        absl::StrFormat("    creds_config=%s,",
+                        bootstrap.server().channel_creds_config.Dump()));
+  }
   if (!bootstrap.server().server_features.empty()) {
     parts.push_back(absl::StrCat(
         "    server_features=[",
@@ -198,14 +200,15 @@ grpc_error* XdsBootstrap::ParseXdsServer(Json* json, size_t idx) {
     server.server_uri = std::move(*it->second.mutable_string_value());
   }
   it = json->mutable_object()->find("channel_creds");
-  if (it != json->mutable_object()->end()) {
-    if (it->second.type() != Json::Type::ARRAY) {
-      error_list.push_back(GRPC_ERROR_CREATE_FROM_STATIC_STRING(
-          "\"channel_creds\" field is not an array"));
-    } else {
-      grpc_error* parse_error = ParseChannelCredsArray(&it->second, &server);
-      if (parse_error != GRPC_ERROR_NONE) error_list.push_back(parse_error);
-    }
+  if (it == json->mutable_object()->end()) {
+    error_list.push_back(GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+        "\"channel_creds\" field not present"));
+  } else if (it->second.type() != Json::Type::ARRAY) {
+    error_list.push_back(GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+        "\"channel_creds\" field is not an array"));
+  } else {
+    grpc_error* parse_error = ParseChannelCredsArray(&it->second, &server);
+    if (parse_error != GRPC_ERROR_NONE) error_list.push_back(parse_error);
   }
   it = json->mutable_object()->find("server_features");
   if (it != json->mutable_object()->end()) {
@@ -241,6 +244,10 @@ grpc_error* XdsBootstrap::ParseChannelCredsArray(Json* json,
       if (parse_error != GRPC_ERROR_NONE) error_list.push_back(parse_error);
     }
   }
+  if (server->channel_creds == nullptr) {
+    error_list.push_back(GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+        "no known creds type found in \"channel_creds\""));
+  }
   return GRPC_ERROR_CREATE_FROM_VECTOR("errors parsing \"channel_creds\" array",
                                        &error_list);
 }
@@ -248,7 +255,7 @@ grpc_error* XdsBootstrap::ParseChannelCredsArray(Json* json,
 grpc_error* XdsBootstrap::ParseChannelCreds(Json* json, size_t idx,
                                             XdsServer* server) {
   std::vector<grpc_error*> error_list;
-  ChannelCreds channel_creds;
+  std::string type;
   auto it = json->mutable_object()->find("type");
   if (it == json->mutable_object()->end()) {
     error_list.push_back(
@@ -257,19 +264,33 @@ grpc_error* XdsBootstrap::ParseChannelCreds(Json* json, size_t idx,
     error_list.push_back(
         GRPC_ERROR_CREATE_FROM_STATIC_STRING("\"type\" field is not a string"));
   } else {
-    channel_creds.type = std::move(*it->second.mutable_string_value());
+    type = std::move(*it->second.mutable_string_value());
   }
+  Json config;
   it = json->mutable_object()->find("config");
   if (it != json->mutable_object()->end()) {
     if (it->second.type() != Json::Type::OBJECT) {
       error_list.push_back(GRPC_ERROR_CREATE_FROM_STATIC_STRING(
           "\"config\" field is not an object"));
     } else {
-      channel_creds.config = std::move(it->second);
+      config = std::move(it->second);
     }
   }
-  if (!channel_creds.type.empty()) {
-    server->channel_creds.emplace_back(std::move(channel_creds));
+  // Select the first channel creds type that we support.
+  if (server->channel_creds == nullptr) {
+    if (type == "google_default") {
+      server->channel_creds.reset(
+          grpc_google_default_credentials_create(nullptr));
+    } else if (type == "insecure") {
+      server->channel_creds.reset(grpc_insecure_credentials_create());
+    } else if (type == "fake") {
+      server->channel_creds.reset(
+          grpc_fake_transport_security_credentials_create());
+    }
+    if (server->channel_creds != nullptr) {
+      server->channel_creds_type = std::move(type);
+      server->channel_creds_config = std::move(config);
+    }
   }
   // Can't use GRPC_ERROR_CREATE_FROM_VECTOR() here, because the error
   // string is not static in this case.

src/core/ext/xds/xds_bootstrap.h

@@ -31,8 +31,10 @@
 #include "src/core/ext/xds/certificate_provider_store.h"
 #include "src/core/lib/gprpp/map.h"
 #include "src/core/lib/gprpp/memory.h"
+#include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/iomgr/error.h"
 #include "src/core/lib/json/json.h"
+#include "src/core/lib/security/credentials/credentials.h"
 
 namespace grpc_core {
 
@@ -49,14 +51,11 @@ class XdsBootstrap {
     Json metadata;
   };
 
-  struct ChannelCreds {
-    std::string type;
-    Json config;
-  };
-
   struct XdsServer {
     std::string server_uri;
-    absl::InlinedVector<ChannelCreds, 1> channel_creds;
+    std::string channel_creds_type;
+    Json channel_creds_config;
+    RefCountedPtr<grpc_channel_credentials> channel_creds;
     std::set<std::string> server_features;
 
     bool ShouldUseV3() const;

src/core/ext/xds/xds_client.cc

@@ -50,8 +50,6 @@
 #include "src/core/lib/iomgr/sockaddr.h"
 #include "src/core/lib/iomgr/sockaddr_utils.h"
 #include "src/core/lib/iomgr/timer.h"
-#include "src/core/lib/security/credentials/credentials.h"
-#include "src/core/lib/security/credentials/fake/fake_credentials.h"
 #include "src/core/lib/slice/slice_internal.h"
 #include "src/core/lib/slice/slice_string_helpers.h"
 #include "src/core/lib/surface/call.h"
@@ -1704,8 +1702,7 @@ grpc_millis GetRequestTimeout() {
       {15000, 0, INT_MAX});
 }
 
-grpc_channel* CreateXdsChannel(const XdsBootstrap& bootstrap,
-                               grpc_error** error) {
+grpc_channel* CreateXdsChannel(const XdsBootstrap& bootstrap) {
   // Build channel args.
   absl::InlinedVector<grpc_arg, 2> args_to_add = {
       grpc_channel_arg_integer_create(
@@ -1716,31 +1713,10 @@ grpc_channel* CreateXdsChannel(const XdsBootstrap& bootstrap,
   };
   grpc_channel_args* new_args = grpc_channel_args_copy_and_add(
       g_channel_args, args_to_add.data(), args_to_add.size());
-  // Find credentials and create channel.
-  RefCountedPtr<grpc_channel_credentials> creds;
-  for (const auto& channel_creds : bootstrap.server().channel_creds) {
-    if (channel_creds.type == "google_default") {
-      creds.reset(grpc_google_default_credentials_create(nullptr));
-      break;
-    }
-    if (channel_creds.type == "insecure") {
-      grpc_channel* channel = grpc_insecure_channel_create(
-          bootstrap.server().server_uri.c_str(), new_args, nullptr);
-      grpc_channel_args_destroy(new_args);
-      return channel;
-    }
-    if (channel_creds.type == "fake") {
-      creds.reset(grpc_fake_transport_security_credentials_create());
-      break;
-    }
-  }
-  if (creds == nullptr) {
-    *error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
-        "no supported credential types found");
-    return nullptr;
-  }
+  // Create channel.
   grpc_channel* channel = grpc_secure_channel_create(
-      creds.get(), bootstrap.server().server_uri.c_str(), new_args, nullptr);
+      bootstrap.server().channel_creds.get(),
+      bootstrap.server().server_uri.c_str(), new_args, nullptr);
   grpc_channel_args_destroy(new_args);
   return channel;
 }
@@ -1768,12 +1744,7 @@ XdsClient::XdsClient(grpc_error** error)
     gpr_log(GPR_INFO, "[xds_client %p] creating channel to %s", this,
             bootstrap_->server().server_uri.c_str());
   }
-  grpc_channel* channel = CreateXdsChannel(*bootstrap_, error);
-  if (*error != GRPC_ERROR_NONE) {
-    gpr_log(GPR_ERROR, "[xds_client %p] failed to create xds channel: %s", this,
-            grpc_error_string(*error));
-    return;
-  }
+  grpc_channel* channel = CreateXdsChannel(*bootstrap_);
   // Create ChannelState object.
   chand_ = MakeOrphanable<ChannelState>(
       WeakRef(DEBUG_LOCATION, "XdsClient+ChannelState"), channel);

test/core/client_channel/BUILD

@@ -58,17 +58,3 @@ grpc_cc_test(
         "//test/core/util:grpc_test_util",
     ],
 )
-
-grpc_cc_test(
-    name = "xds_bootstrap_test",
-    srcs = ["xds_bootstrap_test.cc"],
-    external_deps = [
-        "gtest",
-    ],
-    language = "C++",
-    deps = [
-        "//:gpr",
-        "//:grpc",
-        "//test/core/util:grpc_test_util",
-    ],
-)

test/core/xds/BUILD

@@ -18,6 +18,20 @@ grpc_package(name = "test/core/xds")
 
 licenses(["notice"])
 
+grpc_cc_test(
+    name = "xds_bootstrap_test",
+    srcs = ["xds_bootstrap_test.cc"],
+    external_deps = [
+        "gtest",
+    ],
+    language = "C++",
+    deps = [
+        "//:gpr",
+        "//:grpc",
+        "//test/core/util:grpc_test_util",
+    ],
+)
+
 grpc_cc_test(
     name = "certificate_provider_store_test",
     srcs = ["certificate_provider_store_test.cc"],

test/core/client_channel/xds_bootstrap_test.cc → test/core/xds/xds_bootstrap_test.cc

@@ -26,6 +26,8 @@
 
 #include "src/core/ext/xds/certificate_provider_registry.h"
 #include "src/core/ext/xds/xds_bootstrap.h"
+#include "src/core/lib/gpr/env.h"
+#include "src/core/lib/gpr/tmpfile.h"
 #include "test/core/util/test_config.h"
 
 namespace grpc_core {
@@ -58,6 +60,9 @@ TEST_F(XdsBootstrapTest, Basic) {
       "        {"
       "          \"type\": \"ignored\","
       "          \"ignore\": 0"
+      "        },"
+      "        {"
+      "          \"type\": \"fake\""
       "        }"
       "      ],"
       "      \"ignore\": 0"
@@ -83,13 +88,15 @@ TEST_F(XdsBootstrapTest, Basic) {
   grpc_error* error = GRPC_ERROR_NONE;
   Json json = Json::Parse(json_str, &error);
   ASSERT_EQ(error, GRPC_ERROR_NONE) << grpc_error_string(error);
-  grpc_core::XdsBootstrap bootstrap(std::move(json), &error);
+  XdsBootstrap bootstrap(std::move(json), &error);
   EXPECT_EQ(error, GRPC_ERROR_NONE) << grpc_error_string(error);
   EXPECT_EQ(bootstrap.server().server_uri, "fake:///lb");
-  ASSERT_EQ(bootstrap.server().channel_creds.size(), 1UL);
-  EXPECT_EQ(bootstrap.server().channel_creds[0].type, "fake");
-  EXPECT_EQ(bootstrap.server().channel_creds[0].config.type(),
+  EXPECT_EQ(bootstrap.server().channel_creds_type, "fake");
+  EXPECT_EQ(bootstrap.server().channel_creds_config.type(),
             Json::Type::JSON_NULL);
+  ASSERT_NE(bootstrap.server().channel_creds, nullptr);
+  EXPECT_STREQ(bootstrap.server().channel_creds->type(),
+               "FakeTransportSecurity");
   ASSERT_NE(bootstrap.node(), nullptr);
   EXPECT_EQ(bootstrap.node()->id, "foo");
   EXPECT_EQ(bootstrap.node()->cluster, "bar");
@@ -111,30 +118,129 @@ TEST_F(XdsBootstrapTest, Basic) {
                           ::testing::Property(&Json::string_value, "1")))));
 }
 
-TEST_F(XdsBootstrapTest, ValidWithoutChannelCredsAndNode) {
+TEST_F(XdsBootstrapTest, ValidWithoutNode) {
   const char* json_str =
       "{"
       "  \"xds_servers\": ["
       "    {"
-      "      \"server_uri\": \"fake:///lb\""
+      "      \"server_uri\": \"fake:///lb\","
+      "      \"channel_creds\": [{\"type\": \"fake\"}]"
+      "    }"
+      "  ]"
+      "}";
+  grpc_error* error = GRPC_ERROR_NONE;
+  Json json = Json::Parse(json_str, &error);
+  ASSERT_EQ(error, GRPC_ERROR_NONE) << grpc_error_string(error);
+  XdsBootstrap bootstrap(std::move(json), &error);
+  EXPECT_EQ(error, GRPC_ERROR_NONE) << grpc_error_string(error);
+  EXPECT_EQ(bootstrap.server().server_uri, "fake:///lb");
+  EXPECT_EQ(bootstrap.server().channel_creds_type, "fake");
+  EXPECT_EQ(bootstrap.node(), nullptr);
+}
+
+TEST_F(XdsBootstrapTest, InsecureCreds) {
+  const char* json_str =
+      "{"
+      "  \"xds_servers\": ["
+      "    {"
+      "      \"server_uri\": \"fake:///lb\","
+      "      \"channel_creds\": [{\"type\": \"insecure\"}]"
+      "    }"
+      "  ]"
+      "}";
+  grpc_error* error = GRPC_ERROR_NONE;
+  Json json = Json::Parse(json_str, &error);
+  ASSERT_EQ(error, GRPC_ERROR_NONE) << grpc_error_string(error);
+  XdsBootstrap bootstrap(std::move(json), &error);
+  EXPECT_EQ(error, GRPC_ERROR_NONE) << grpc_error_string(error);
+  EXPECT_EQ(bootstrap.server().server_uri, "fake:///lb");
+  EXPECT_EQ(bootstrap.server().channel_creds_type, "insecure");
+  ASSERT_NE(bootstrap.server().channel_creds, nullptr);
+  EXPECT_STREQ(bootstrap.server().channel_creds->type(), "insecure");
+  EXPECT_EQ(bootstrap.node(), nullptr);
+}
+
+TEST_F(XdsBootstrapTest, GoogleDefaultCreds) {
+  // Generate call creds file needed by GoogleDefaultCreds.
+  const char token_str[] =
+      "{ \"client_id\": \"32555999999.apps.googleusercontent.com\","
+      "  \"client_secret\": \"EmssLNjJy1332hD4KFsecret\","
+      "  \"refresh_token\": \"1/Blahblasj424jladJDSGNf-u4Sua3HDA2ngjd42\","
+      "  \"type\": \"authorized_user\"}";
+  char* creds_file_name;
+  FILE* creds_file = gpr_tmpfile("xds_bootstrap_test", &creds_file_name);
+  ASSERT_NE(creds_file_name, nullptr);
+  ASSERT_NE(creds_file, nullptr);
+  ASSERT_EQ(fwrite(token_str, 1, sizeof(token_str), creds_file),
+            sizeof(token_str));
+  fclose(creds_file);
+  gpr_setenv(GRPC_GOOGLE_CREDENTIALS_ENV_VAR, creds_file_name);
+  gpr_free(creds_file_name);
+  // Now run test.
+  const char* json_str =
+      "{"
+      "  \"xds_servers\": ["
+      "    {"
+      "      \"server_uri\": \"fake:///lb\","
+      "      \"channel_creds\": [{\"type\": \"google_default\"}]"
       "    }"
       "  ]"
       "}";
   grpc_error* error = GRPC_ERROR_NONE;
   Json json = Json::Parse(json_str, &error);
   ASSERT_EQ(error, GRPC_ERROR_NONE) << grpc_error_string(error);
-  grpc_core::XdsBootstrap bootstrap(std::move(json), &error);
+  XdsBootstrap bootstrap(std::move(json), &error);
   EXPECT_EQ(error, GRPC_ERROR_NONE) << grpc_error_string(error);
   EXPECT_EQ(bootstrap.server().server_uri, "fake:///lb");
-  EXPECT_EQ(bootstrap.server().channel_creds.size(), 0UL);
+  EXPECT_EQ(bootstrap.server().channel_creds_type, "google_default");
+  ASSERT_NE(bootstrap.server().channel_creds, nullptr);
+  EXPECT_STREQ(bootstrap.server().channel_creds->type(), "GoogleDefault");
   EXPECT_EQ(bootstrap.node(), nullptr);
 }
 
+TEST_F(XdsBootstrapTest, MissingChannelCreds) {
+  const char* json_str =
+      "{"
+      "  \"xds_servers\": ["
+      "    {"
+      "      \"server_uri\": \"fake:///lb\""
+      "    }"
+      "  ]"
+      "}";
+  grpc_error* error = GRPC_ERROR_NONE;
+  Json json = Json::Parse(json_str, &error);
+  ASSERT_EQ(error, GRPC_ERROR_NONE) << grpc_error_string(error);
+  XdsBootstrap bootstrap(std::move(json), &error);
+  EXPECT_THAT(grpc_error_string(error),
+              ::testing::ContainsRegex("\"channel_creds\" field not present"));
+  GRPC_ERROR_UNREF(error);
+}
+
+TEST_F(XdsBootstrapTest, NoKnownChannelCreds) {
+  const char* json_str =
+      "{"
+      "  \"xds_servers\": ["
+      "    {"
+      "      \"server_uri\": \"fake:///lb\","
+      "      \"channel_creds\": [{\"type\": \"unknown\"}]"
+      "    }"
+      "  ]"
+      "}";
+  grpc_error* error = GRPC_ERROR_NONE;
+  Json json = Json::Parse(json_str, &error);
+  ASSERT_EQ(error, GRPC_ERROR_NONE) << grpc_error_string(error);
+  XdsBootstrap bootstrap(std::move(json), &error);
+  EXPECT_THAT(grpc_error_string(error),
+              ::testing::ContainsRegex(
+                  "no known creds type found in \"channel_creds\""));
+  GRPC_ERROR_UNREF(error);
+}
+
 TEST_F(XdsBootstrapTest, MissingXdsServers) {
   grpc_error* error = GRPC_ERROR_NONE;
   Json json = Json::Parse("{}", &error);
   ASSERT_EQ(error, GRPC_ERROR_NONE) << grpc_error_string(error);
-  grpc_core::XdsBootstrap bootstrap(std::move(json), &error);
+  XdsBootstrap bootstrap(std::move(json), &error);
   EXPECT_THAT(grpc_error_string(error),
               ::testing::ContainsRegex("\"xds_servers\" field not present"));
   GRPC_ERROR_UNREF(error);
@@ -150,7 +256,7 @@ TEST_F(XdsBootstrapTest, TopFieldsWrongTypes) {
   grpc_error* error = GRPC_ERROR_NONE;
   Json json = Json::Parse(json_str, &error);
   ASSERT_EQ(error, GRPC_ERROR_NONE) << grpc_error_string(error);
-  grpc_core::XdsBootstrap bootstrap(std::move(json), &error);
+  XdsBootstrap bootstrap(std::move(json), &error);
   EXPECT_THAT(grpc_error_string(error),
               ::testing::ContainsRegex(
                   "\"xds_servers\" field is not an array.*"
@@ -167,7 +273,7 @@ TEST_F(XdsBootstrapTest, XdsServerMissingServerUri) {
   grpc_error* error = GRPC_ERROR_NONE;
   Json json = Json::Parse(json_str, &error);
   ASSERT_EQ(error, GRPC_ERROR_NONE) << grpc_error_string(error);
-  grpc_core::XdsBootstrap bootstrap(std::move(json), &error);
+  XdsBootstrap bootstrap(std::move(json), &error);
   EXPECT_THAT(grpc_error_string(error),
               ::testing::ContainsRegex("errors parsing \"xds_servers\" array.*"
                                        "errors parsing index 0.*"
@@ -188,7 +294,7 @@ TEST_F(XdsBootstrapTest, XdsServerUriAndCredsWrongTypes) {
   grpc_error* error = GRPC_ERROR_NONE;
   Json json = Json::Parse(json_str, &error);
   ASSERT_EQ(error, GRPC_ERROR_NONE) << grpc_error_string(error);
-  grpc_core::XdsBootstrap bootstrap(std::move(json), &error);
+  XdsBootstrap bootstrap(std::move(json), &error);
   EXPECT_THAT(
       grpc_error_string(error),
       ::testing::ContainsRegex("errors parsing \"xds_servers\" array.*"
@@ -216,7 +322,7 @@ TEST_F(XdsBootstrapTest, ChannelCredsFieldsWrongTypes) {
   grpc_error* error = GRPC_ERROR_NONE;
   Json json = Json::Parse(json_str, &error);
   ASSERT_EQ(error, GRPC_ERROR_NONE) << grpc_error_string(error);
-  grpc_core::XdsBootstrap bootstrap(std::move(json), &error);
+  XdsBootstrap bootstrap(std::move(json), &error);
   EXPECT_THAT(
       grpc_error_string(error),
       ::testing::ContainsRegex("errors parsing \"xds_servers\" array.*"
@@ -241,7 +347,7 @@ TEST_F(XdsBootstrapTest, NodeFieldsWrongTypes) {
   grpc_error* error = GRPC_ERROR_NONE;
   Json json = Json::Parse(json_str, &error);
   ASSERT_EQ(error, GRPC_ERROR_NONE) << grpc_error_string(error);
-  grpc_core::XdsBootstrap bootstrap(std::move(json), &error);
+  XdsBootstrap bootstrap(std::move(json), &error);
   EXPECT_THAT(grpc_error_string(error),
               ::testing::ContainsRegex("errors parsing \"node\" object.*"
                                        "\"id\" field is not a string.*"
@@ -265,7 +371,7 @@ TEST_F(XdsBootstrapTest, LocalityFieldsWrongType) {
   grpc_error* error = GRPC_ERROR_NONE;
   Json json = Json::Parse(json_str, &error);
   ASSERT_EQ(error, GRPC_ERROR_NONE) << grpc_error_string(error);
-  grpc_core::XdsBootstrap bootstrap(std::move(json), &error);
+  XdsBootstrap bootstrap(std::move(json), &error);
   EXPECT_THAT(grpc_error_string(error),
               ::testing::ContainsRegex("errors parsing \"node\" object.*"
                                        "errors parsing \"locality\" object.*"
@@ -290,7 +396,7 @@ TEST_F(XdsBootstrapTest, CertificateProvidersElementWrongType) {
   grpc_error* error = GRPC_ERROR_NONE;
   Json json = Json::Parse(json_str, &error);
   ASSERT_EQ(error, GRPC_ERROR_NONE) << grpc_error_string(error);
-  grpc_core::XdsBootstrap bootstrap(std::move(json), &error);
+  XdsBootstrap bootstrap(std::move(json), &error);
   EXPECT_THAT(grpc_error_string(error),
               ::testing::ContainsRegex(
                   "errors parsing \"certificate_providers\" object.*"
@@ -315,7 +421,7 @@ TEST_F(XdsBootstrapTest, CertificateProvidersPluginNameWrongType) {
   grpc_error* error = GRPC_ERROR_NONE;
   Json json = Json::Parse(json_str, &error);
   ASSERT_EQ(error, GRPC_ERROR_NONE) << grpc_error_string(error);
-  grpc_core::XdsBootstrap bootstrap(std::move(json), &error);
+  XdsBootstrap bootstrap(std::move(json), &error);
   EXPECT_THAT(grpc_error_string(error),
               ::testing::ContainsRegex(
                   "errors parsing \"certificate_providers\" object.*"
@@ -387,7 +493,7 @@ TEST_F(XdsBootstrapTest, CertificateProvidersFakePluginParsingError) {
   grpc_error* error = GRPC_ERROR_NONE;
   Json json = Json::Parse(json_str, &error);
   ASSERT_EQ(error, GRPC_ERROR_NONE) << grpc_error_string(error);
-  grpc_core::XdsBootstrap bootstrap(std::move(json), &error);
+  XdsBootstrap bootstrap(std::move(json), &error);
   EXPECT_THAT(grpc_error_string(error),
               ::testing::ContainsRegex(
                   "errors parsing \"certificate_providers\" object.*"
@@ -403,7 +509,8 @@ TEST_F(XdsBootstrapTest, CertificateProvidersFakePluginParsingSuccess) {
       "{"
       "  \"xds_servers\": ["
       "    {"
-      "      \"server_uri\": \"fake:///lb\""
+      "      \"server_uri\": \"fake:///lb\","
+      "      \"channel_creds\": [{\"type\": \"fake\"}]"
       "    }"
       "  ],"
       "  \"certificate_providers\": {"
@@ -418,8 +525,8 @@ TEST_F(XdsBootstrapTest, CertificateProvidersFakePluginParsingSuccess) {
   grpc_error* error = GRPC_ERROR_NONE;
   Json json = Json::Parse(json_str, &error);
   ASSERT_EQ(error, GRPC_ERROR_NONE) << grpc_error_string(error);
-  grpc_core::XdsBootstrap bootstrap(std::move(json), &error);
-  ASSERT_TRUE(error == GRPC_ERROR_NONE);
+  XdsBootstrap bootstrap(std::move(json), &error);
+  ASSERT_TRUE(error == GRPC_ERROR_NONE) << grpc_error_string(error);
   const CertificateProviderStore::PluginDefinition& fake_plugin =
       bootstrap.certificate_providers().at("fake_plugin");
   ASSERT_EQ(fake_plugin.plugin_name, "fake");
@@ -437,7 +544,8 @@ TEST_F(XdsBootstrapTest, CertificateProvidersFakePluginEmptyConfig) {
       "{"
       "  \"xds_servers\": ["
       "    {"
-      "      \"server_uri\": \"fake:///lb\""
+      "      \"server_uri\": \"fake:///lb\","
+      "      \"channel_creds\": [{\"type\": \"fake\"}]"
       "    }"
       "  ],"
       "  \"certificate_providers\": {"
@@ -449,8 +557,8 @@ TEST_F(XdsBootstrapTest, CertificateProvidersFakePluginEmptyConfig) {
   grpc_error* error = GRPC_ERROR_NONE;
   Json json = Json::Parse(json_str, &error);
   ASSERT_EQ(error, GRPC_ERROR_NONE) << grpc_error_string(error);
-  grpc_core::XdsBootstrap bootstrap(std::move(json), &error);
-  ASSERT_TRUE(error == GRPC_ERROR_NONE);
+  XdsBootstrap bootstrap(std::move(json), &error);
+  ASSERT_TRUE(error == GRPC_ERROR_NONE) << grpc_error_string(error);
   const CertificateProviderStore::PluginDefinition& fake_plugin =
       bootstrap.certificate_providers().at("fake_plugin");
   ASSERT_EQ(fake_plugin.plugin_name, "fake");