XdsClient: remove now-unnecessary XdsCertificateProviderPluginMapInterface (#30854)

* remove now-unnecessary XdsCertificateProviderPluginMapInterface

* code review comments

* Automated change: Fix sanity tests

Co-authored-by: markdroth <markdroth@users.noreply.github.com>

src/core/ext/xds/xds_bootstrap_grpc.cc

@@ -33,11 +33,14 @@
 #include "absl/strings/str_format.h"
 #include "absl/strings/str_join.h"
 #include "absl/strings/string_view.h"
+#include "absl/types/optional.h"
 
+#include "src/core/ext/xds/certificate_provider_factory.h"
+#include "src/core/ext/xds/certificate_provider_registry.h"
 #include "src/core/lib/config/core_configuration.h"
+#include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/json/json_util.h"
 #include "src/core/lib/security/credentials/channel_creds_registry.h"
-#include "src/core/lib/transport/error_utils.h"
 
 namespace grpc_core {
 
@@ -97,27 +100,17 @@ grpc_error_handle ParseChannelCredsArray(const Json::Array& json,
 //
 
 std::unique_ptr<GrpcXdsBootstrap> GrpcXdsBootstrap::Create(
-    absl::string_view json_string,
-    std::unique_ptr<XdsCertificateProviderPluginMapInterface>
-        certificate_provider_plugin_map,
-    grpc_error_handle* error) {
+    absl::string_view json_string, grpc_error_handle* error) {
   auto json = Json::Parse(json_string);
   if (!json.ok()) {
     *error = GRPC_ERROR_CREATE_FROM_CPP_STRING(absl::StrCat(
         "Failed to parse bootstrap JSON string: ", json.status().ToString()));
     return nullptr;
   }
-  return absl::make_unique<GrpcXdsBootstrap>(
-      std::move(*json), std::move(certificate_provider_plugin_map), error);
+  return absl::make_unique<GrpcXdsBootstrap>(std::move(*json), error);
 }
 
-GrpcXdsBootstrap::GrpcXdsBootstrap(
-    Json json,
-    std::unique_ptr<XdsCertificateProviderPluginMapInterface>
-        certificate_provider_plugin_map,
-    grpc_error_handle* error)
-    : certificate_provider_plugin_map_(
-          std::move(certificate_provider_plugin_map)) {
+GrpcXdsBootstrap::GrpcXdsBootstrap(Json json, grpc_error_handle* error) {
   if (json.type() != Json::Type::OBJECT) {
     *error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
         "malformed JSON in bootstrap file");
@@ -376,24 +369,36 @@ grpc_error_handle GrpcXdsBootstrap::ParseCertificateProvider(
         "\"plugin_name\" field is not a string"));
   } else {
     std::string plugin_name = std::move(*(it->second.mutable_string_value()));
+    // Find config JSON.
+    absl::optional<Json> config_json;
     it = certificate_provider_json->mutable_object()->find("config");
     if (it != certificate_provider_json->mutable_object()->end()) {
       if (it->second.type() != Json::Type::OBJECT) {
         error_list.push_back(GRPC_ERROR_CREATE_FROM_STATIC_STRING(
             "\"config\" field is not an object"));
       } else {
-        absl::Status status = certificate_provider_plugin_map_->AddPlugin(
-            instance_name, plugin_name, it->second);
-        if (!status.ok()) {
-          error_list.push_back(absl_status_to_grpc_error(status));
-        }
+        config_json = it->second;
       }
     } else {
-      // "config" is an optional field, so create an empty JSON object.
-      absl::Status status = certificate_provider_plugin_map_->AddPlugin(
-          instance_name, plugin_name, Json::Object());
-      if (!status.ok()) {
-        error_list.push_back(absl_status_to_grpc_error(status));
+      // "config" is an optional field, so default to an empty JSON object.
+      config_json = Json::Object();
+    }
+    // Try to instantiate the provider.
+    CertificateProviderFactory* factory =
+        CertificateProviderRegistry::LookupCertificateProviderFactory(
+            plugin_name);
+    if (factory == nullptr) {
+      error_list.push_back(GRPC_ERROR_CREATE_FROM_CPP_STRING(
+          absl::StrCat("Unrecognized plugin name: ", plugin_name)));
+    } else if (config_json.has_value()) {
+      grpc_error_handle parse_error = GRPC_ERROR_NONE;
+      RefCountedPtr<CertificateProviderFactory::Config> config =
+          factory->CreateCertificateProviderConfig(*config_json, &parse_error);
+      if (!GRPC_ERROR_IS_NONE(parse_error)) {
+        error_list.push_back(parse_error);
+      } else {
+        certificate_providers_.insert(
+            {instance_name, {std::move(plugin_name), std::move(config)}});
       }
     }
   }
@@ -460,9 +465,18 @@ std::string GrpcXdsBootstrap::ToString() const {
                         entry.second.xds_servers[0].channel_creds_type));
     parts.push_back("      },\n");
   }
+  parts.push_back("}\n");
+  parts.push_back("certificate_providers={\n");
+  for (const auto& entry : certificate_providers_) {
+    parts.push_back(
+        absl::StrFormat("  %s={\n"
+                        "    plugin_name=%s\n"
+                        "    config=%s\n"
+                        "  },\n",
+                        entry.first, entry.second.plugin_name,
+                        entry.second.config->ToString()));
+  }
   parts.push_back("}");
-  parts.push_back("certificate_providers=");
-  parts.push_back(certificate_provider_plugin_map_->ToString());
   return absl::StrJoin(parts, "");
 }
 

src/core/ext/xds/xds_bootstrap_grpc.h

@@ -24,44 +24,25 @@
 #include <string>
 #include <vector>
 
-#include "absl/status/status.h"
 #include "absl/strings/string_view.h"
 
+#include "src/core/ext/xds/certificate_provider_store.h"
 #include "src/core/ext/xds/xds_bootstrap.h"
 #include "src/core/lib/iomgr/error.h"
 #include "src/core/lib/json/json.h"
 
 namespace grpc_core {
 
-class XdsCertificateProviderPluginMapInterface {
- public:
-  virtual ~XdsCertificateProviderPluginMapInterface() = default;
-
-  virtual absl::Status AddPlugin(const std::string& instance_name,
-                                 const std::string& plugin_name,
-                                 const Json& config) = 0;
-
-  virtual bool HasPlugin(const std::string& instance_name) const = 0;
-
-  virtual std::string ToString() const = 0;
-};
-
 class GrpcXdsBootstrap : public XdsBootstrap {
  public:
   // Creates bootstrap object from json_string.
   // If *error is not GRPC_ERROR_NONE after returning, then there was an
   // error parsing the contents.
-  static std::unique_ptr<GrpcXdsBootstrap> Create(
-      absl::string_view json_string,
-      std::unique_ptr<XdsCertificateProviderPluginMapInterface>
-          certificate_provider_plugin_map,
-      grpc_error_handle* error);
+  static std::unique_ptr<GrpcXdsBootstrap> Create(absl::string_view json_string,
+                                                  grpc_error_handle* error);
 
   // Do not instantiate directly -- use Create() above instead.
-  GrpcXdsBootstrap(Json json,
-                   std::unique_ptr<XdsCertificateProviderPluginMapInterface>
-                       certificate_provider_plugin_map,
-                   grpc_error_handle* error);
+  GrpcXdsBootstrap(Json json, grpc_error_handle* error);
 
   std::string ToString() const override;
 
@@ -77,9 +58,9 @@ class GrpcXdsBootstrap : public XdsBootstrap {
   const std::string& server_listener_resource_name_template() const {
     return server_listener_resource_name_template_;
   }
-  const XdsCertificateProviderPluginMapInterface*
-  certificate_provider_plugin_map() const {
-    return certificate_provider_plugin_map_.get();
+  const CertificateProviderStore::PluginDefinitionMap& certificate_providers()
+      const {
+    return certificate_providers_;
   }
 
   static XdsServer XdsServerParse(const Json& json, grpc_error_handle* error);
@@ -101,8 +82,7 @@ class GrpcXdsBootstrap : public XdsBootstrap {
   std::string client_default_listener_resource_name_template_;
   std::string server_listener_resource_name_template_;
   std::map<std::string, Authority> authorities_;
-  std::unique_ptr<XdsCertificateProviderPluginMapInterface>
-      certificate_provider_plugin_map_;
+  CertificateProviderStore::PluginDefinitionMap certificate_providers_;
 };
 
 }  // namespace grpc_core

src/core/ext/xds/xds_client_grpc.cc

@@ -19,18 +19,12 @@
 #include "src/core/ext/xds/xds_client_grpc.h"
 
 #include <algorithm>
-#include <map>
 #include <memory>
 #include <string>
 #include <utility>
-#include <vector>
 
 #include "absl/base/thread_annotations.h"
-#include "absl/memory/memory.h"
 #include "absl/status/status.h"
-#include "absl/strings/str_cat.h"
-#include "absl/strings/str_format.h"
-#include "absl/strings/str_join.h"
 #include "absl/strings/string_view.h"
 #include "absl/types/optional.h"
 
@@ -40,9 +34,8 @@
 #include <grpc/support/log.h>
 #include <grpc/support/string_util.h>
 
-#include "src/core/ext/xds/certificate_provider_factory.h"
-#include "src/core/ext/xds/certificate_provider_registry.h"
 #include "src/core/ext/xds/xds_bootstrap.h"
+#include "src/core/ext/xds/xds_bootstrap_grpc.h"
 #include "src/core/ext/xds/xds_channel_args.h"
 #include "src/core/ext/xds/xds_cluster_specifier_plugin.h"
 #include "src/core/ext/xds/xds_http_filters.h"
@@ -60,7 +53,6 @@
 #include "src/core/lib/iomgr/error.h"
 #include "src/core/lib/iomgr/exec_ctx.h"
 #include "src/core/lib/iomgr/load_file.h"
-#include "src/core/lib/json/json.h"
 #include "src/core/lib/slice/slice_internal.h"
 #include "src/core/lib/slice/slice_refcount.h"
 #include "src/core/lib/transport/error_utils.h"
@@ -144,17 +136,14 @@ absl::StatusOr<std::string> GetBootstrapContents(const char* fallback_config) {
 
 absl::StatusOr<RefCountedPtr<GrpcXdsClient>> GrpcXdsClient::GetOrCreate(
     const ChannelArgs& args, const char* reason) {
-  // Construct certificate provider plugin map.
-  auto certificate_provider_plugin_map =
-      absl::make_unique<GrpcXdsCertificateProviderPluginMap>();
   // If getting bootstrap from channel args, create a local XdsClient
   // instance for the channel or server instead of using the global instance.
   absl::optional<absl::string_view> bootstrap_config = args.GetString(
       GRPC_ARG_TEST_ONLY_DO_NOT_USE_IN_PROD_XDS_BOOTSTRAP_CONFIG);
   if (bootstrap_config.has_value()) {
     grpc_error_handle error = GRPC_ERROR_NONE;
-    std::unique_ptr<GrpcXdsBootstrap> bootstrap = GrpcXdsBootstrap::Create(
-        *bootstrap_config, std::move(certificate_provider_plugin_map), &error);
+    std::unique_ptr<GrpcXdsBootstrap> bootstrap =
+        GrpcXdsBootstrap::Create(*bootstrap_config, &error);
     if (!GRPC_ERROR_IS_NONE(error)) return grpc_error_to_absl_status(error);
     grpc_channel_args* xds_channel_args = args.GetPointer<grpc_channel_args>(
         GRPC_ARG_TEST_ONLY_DO_NOT_USE_IN_PROD_XDS_CLIENT_CHANNEL_ARGS);
@@ -176,8 +165,8 @@ absl::StatusOr<RefCountedPtr<GrpcXdsClient>> GrpcXdsClient::GetOrCreate(
   }
   // Parse bootstrap.
   grpc_error_handle error = GRPC_ERROR_NONE;
-  std::unique_ptr<GrpcXdsBootstrap> bootstrap = GrpcXdsBootstrap::Create(
-      *bootstrap_contents, std::move(certificate_provider_plugin_map), &error);
+  std::unique_ptr<GrpcXdsBootstrap> bootstrap =
+      GrpcXdsBootstrap::Create(*bootstrap_contents, &error);
   if (!GRPC_ERROR_IS_NONE(error)) return grpc_error_to_absl_status(error);
   // Instantiate XdsClient.
   auto xds_client = MakeRefCounted<GrpcXdsClient>(
@@ -195,10 +184,8 @@ GrpcXdsClient::GrpcXdsClient(std::unique_ptr<XdsBootstrap> bootstrap,
                            GRPC_ARG_XDS_RESOURCE_DOES_NOT_EXIST_TIMEOUT_MS)
                        .value_or(Duration::Seconds(15)))),
       certificate_provider_store_(MakeOrphanable<CertificateProviderStore>(
-          static_cast<const GrpcXdsCertificateProviderPluginMap*>(
-              static_cast<const GrpcXdsBootstrap&>(this->bootstrap())
-                  .certificate_provider_plugin_map())
-              ->plugin_map())) {}
+          static_cast<const GrpcXdsBootstrap&>(this->bootstrap())
+              .certificate_providers())) {}
 
 GrpcXdsClient::~GrpcXdsClient() {
   MutexLock lock(g_mu);
@@ -230,51 +217,6 @@ void SetXdsFallbackBootstrapConfig(const char* config) {
 
 }  // namespace internal
 
-//
-// GrpcXdsCertificateProviderPluginMap
-//
-
-absl::Status GrpcXdsCertificateProviderPluginMap::AddPlugin(
-    const std::string& instance_name, const std::string& plugin_name,
-    const Json& config) {
-  CertificateProviderFactory* factory =
-      CertificateProviderRegistry::LookupCertificateProviderFactory(
-          plugin_name);
-  if (factory == nullptr) {
-    return absl::InvalidArgumentError(
-        absl::StrCat("Unrecognized plugin name: ", plugin_name));
-  }
-  grpc_error_handle error = GRPC_ERROR_NONE;
-  auto parsed_config = factory->CreateCertificateProviderConfig(config, &error);
-  if (!GRPC_ERROR_IS_NONE(error)) {
-    absl::Status status = grpc_error_to_absl_status(error);
-    GRPC_ERROR_UNREF(error);
-    return status;
-  }
-  plugin_map_.insert({instance_name, {plugin_name, std::move(parsed_config)}});
-  return absl::OkStatus();
-}
-
-bool GrpcXdsCertificateProviderPluginMap::HasPlugin(
-    const std::string& instance_name) const {
-  return plugin_map_.find(instance_name) != plugin_map_.end();
-}
-
-std::string GrpcXdsCertificateProviderPluginMap::ToString() const {
-  std::vector<std::string> parts = {"{\n"};
-  for (const auto& entry : plugin_map_) {
-    parts.push_back(
-        absl::StrFormat("  %s={\n"
-                        "    plugin_name=%s\n"
-                        "    config=%s\n"
-                        "  },\n",
-                        entry.first, entry.second.plugin_name,
-                        entry.second.config->ToString()));
-  }
-  parts.push_back("}");
-  return absl::StrJoin(parts, "");
-}
-
 }  // namespace grpc_core
 
 // The returned bytes may contain NULL(0), so we can't use c-string.

src/core/ext/xds/xds_client_grpc.h

@@ -20,9 +20,7 @@
 #include <grpc/support/port_platform.h>
 
 #include <memory>
-#include <string>
 
-#include "absl/status/status.h"
 #include "absl/status/statusor.h"
 #include "absl/strings/string_view.h"
 
@@ -30,14 +28,12 @@
 
 #include "src/core/ext/xds/certificate_provider_store.h"
 #include "src/core/ext/xds/xds_bootstrap.h"
-#include "src/core/ext/xds/xds_bootstrap_grpc.h"
 #include "src/core/ext/xds/xds_client.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/gpr/useful.h"
 #include "src/core/lib/gprpp/orphanable.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/iomgr/iomgr_fwd.h"
-#include "src/core/lib/json/json.h"
 
 namespace grpc_core {
 
@@ -78,26 +74,6 @@ void UnsetGlobalXdsClientForTest();
 void SetXdsFallbackBootstrapConfig(const char* config);
 }  // namespace internal
 
-// Exposed for testing purposes only.
-class GrpcXdsCertificateProviderPluginMap
-    : public XdsCertificateProviderPluginMapInterface {
- public:
-  const CertificateProviderStore::PluginDefinitionMap& plugin_map() const {
-    return plugin_map_;
-  }
-
-  absl::Status AddPlugin(const std::string& instance_name,
-                         const std::string& plugin_name,
-                         const Json& config) override;
-
-  bool HasPlugin(const std::string& instance_name) const override;
-
-  std::string ToString() const override;
-
- private:
-  CertificateProviderStore::PluginDefinitionMap plugin_map_;
-};
-
 }  // namespace grpc_core
 
 #endif  // GRPC_CORE_EXT_XDS_XDS_CLIENT_GRPC_H

src/core/ext/xds/xds_common_types.cc

@@ -21,6 +21,7 @@
 #include <stddef.h>
 
 #include <algorithm>
+#include <map>
 #include <utility>
 
 #include "absl/status/status.h"
@@ -37,6 +38,7 @@
 #include "upb/upb.h"
 #include "xds/type/v3/typed_struct.upb.h"
 
+#include "src/core/ext/xds/certificate_provider_store.h"
 #include "src/core/ext/xds/upb_utils.h"
 #include "src/core/ext/xds/xds_bootstrap_grpc.h"
 #include "src/core/ext/xds/xds_client.h"
@@ -127,8 +129,9 @@ CertificateProviderInstanceParse(
                   certificate_provider_instance_proto))};
   const auto& bootstrap =
       static_cast<const GrpcXdsBootstrap&>(context.client->bootstrap());
-  if (!bootstrap.certificate_provider_plugin_map()->HasPlugin(
-          certificate_provider_plugin_instance.instance_name)) {
+  if (bootstrap.certificate_providers().find(
+          certificate_provider_plugin_instance.instance_name) ==
+      bootstrap.certificate_providers().end()) {
     return absl::InvalidArgumentError(
         absl::StrCat("Unrecognized certificate provider instance name: ",
                      certificate_provider_plugin_instance.instance_name));
@@ -151,8 +154,9 @@ CertificateProviderPluginInstanceParse(
                   certificate_provider_plugin_instance_proto))};
   const auto& bootstrap =
       static_cast<const GrpcXdsBootstrap&>(context.client->bootstrap());
-  if (!bootstrap.certificate_provider_plugin_map()->HasPlugin(
-          certificate_provider_plugin_instance.instance_name)) {
+  if (bootstrap.certificate_providers().find(
+          certificate_provider_plugin_instance.instance_name) ==
+      bootstrap.certificate_providers().end()) {
     return absl::InvalidArgumentError(
         absl::StrCat("Unrecognized certificate provider instance name: ",
                      certificate_provider_plugin_instance.instance_name));

test/core/xds/xds_bootstrap_test.cc

@@ -115,9 +115,7 @@ TEST(XdsBootstrapTest, Basic) {
   auto json = Json::Parse(json_str);
   ASSERT_TRUE(json.ok()) << json.status();
   grpc_error_handle error = GRPC_ERROR_NONE;
-  GrpcXdsBootstrap bootstrap(
-      std::move(*json),
-      absl::make_unique<GrpcXdsCertificateProviderPluginMap>(), &error);
+  GrpcXdsBootstrap bootstrap(std::move(*json), &error);
   EXPECT_EQ(error, GRPC_ERROR_NONE) << grpc_error_std_string(error);
   EXPECT_EQ(bootstrap.server().server_uri, "fake:///lb");
   EXPECT_EQ(bootstrap.server().channel_creds_type, "fake");
@@ -183,9 +181,7 @@ TEST(XdsBootstrapTest, ValidWithoutNode) {
   auto json = Json::Parse(json_str);
   ASSERT_TRUE(json.ok()) << json.status();
   grpc_error_handle error = GRPC_ERROR_NONE;
-  GrpcXdsBootstrap bootstrap(
-      std::move(*json),
-      absl::make_unique<GrpcXdsCertificateProviderPluginMap>(), &error);
+  GrpcXdsBootstrap bootstrap(std::move(*json), &error);
   EXPECT_EQ(error, GRPC_ERROR_NONE) << grpc_error_std_string(error);
   EXPECT_EQ(bootstrap.server().server_uri, "fake:///lb");
   EXPECT_EQ(bootstrap.server().channel_creds_type, "fake");
@@ -205,9 +201,7 @@ TEST(XdsBootstrapTest, InsecureCreds) {
   auto json = Json::Parse(json_str);
   ASSERT_TRUE(json.ok()) << json.status();
   grpc_error_handle error = GRPC_ERROR_NONE;
-  GrpcXdsBootstrap bootstrap(
-      std::move(*json),
-      absl::make_unique<GrpcXdsCertificateProviderPluginMap>(), &error);
+  GrpcXdsBootstrap bootstrap(std::move(*json), &error);
   EXPECT_EQ(error, GRPC_ERROR_NONE) << grpc_error_std_string(error);
   EXPECT_EQ(bootstrap.server().server_uri, "fake:///lb");
   EXPECT_EQ(bootstrap.server().channel_creds_type, "insecure");
@@ -243,9 +237,7 @@ TEST(XdsBootstrapTest, GoogleDefaultCreds) {
   auto json = Json::Parse(json_str);
   ASSERT_TRUE(json.ok()) << json.status();
   grpc_error_handle error = GRPC_ERROR_NONE;
-  GrpcXdsBootstrap bootstrap(
-      std::move(*json),
-      absl::make_unique<GrpcXdsCertificateProviderPluginMap>(), &error);
+  GrpcXdsBootstrap bootstrap(std::move(*json), &error);
   EXPECT_EQ(error, GRPC_ERROR_NONE) << grpc_error_std_string(error);
   EXPECT_EQ(bootstrap.server().server_uri, "fake:///lb");
   EXPECT_EQ(bootstrap.server().channel_creds_type, "google_default");
@@ -264,9 +256,7 @@ TEST(XdsBootstrapTest, MissingChannelCreds) {
   auto json = Json::Parse(json_str);
   ASSERT_TRUE(json.ok()) << json.status();
   grpc_error_handle error = GRPC_ERROR_NONE;
-  GrpcXdsBootstrap bootstrap(
-      std::move(*json),
-      absl::make_unique<GrpcXdsCertificateProviderPluginMap>(), &error);
+  GrpcXdsBootstrap bootstrap(std::move(*json), &error);
   EXPECT_THAT(
       grpc_error_std_string(error),
       ::testing::ContainsRegex("field:channel_creds error:does not exist."));
@@ -286,9 +276,7 @@ TEST(XdsBootstrapTest, NoKnownChannelCreds) {
   auto json = Json::Parse(json_str);
   ASSERT_TRUE(json.ok()) << json.status();
   grpc_error_handle error = GRPC_ERROR_NONE;
-  GrpcXdsBootstrap bootstrap(
-      std::move(*json),
-      absl::make_unique<GrpcXdsCertificateProviderPluginMap>(), &error);
+  GrpcXdsBootstrap bootstrap(std::move(*json), &error);
   EXPECT_THAT(grpc_error_std_string(error),
               ::testing::ContainsRegex(
                   "no known creds type found in \"channel_creds\""));
@@ -299,9 +287,7 @@ TEST(XdsBootstrapTest, MissingXdsServers) {
   auto json = Json::Parse("{}");
   ASSERT_TRUE(json.ok()) << json.status();
   grpc_error_handle error = GRPC_ERROR_NONE;
-  GrpcXdsBootstrap bootstrap(
-      std::move(*json),
-      absl::make_unique<GrpcXdsCertificateProviderPluginMap>(), &error);
+  GrpcXdsBootstrap bootstrap(std::move(*json), &error);
   EXPECT_THAT(grpc_error_std_string(error),
               ::testing::ContainsRegex("\"xds_servers\" field not present"));
   GRPC_ERROR_UNREF(error);
@@ -318,9 +304,7 @@ TEST(XdsBootstrapTest, TopFieldsWrongTypes) {
   auto json = Json::Parse(json_str);
   ASSERT_TRUE(json.ok()) << json.status();
   grpc_error_handle error = GRPC_ERROR_NONE;
-  GrpcXdsBootstrap bootstrap(
-      std::move(*json),
-      absl::make_unique<GrpcXdsCertificateProviderPluginMap>(), &error);
+  GrpcXdsBootstrap bootstrap(std::move(*json), &error);
   EXPECT_THAT(grpc_error_std_string(error),
               ::testing::ContainsRegex("\"xds_servers\" field is not an array.*"
                                        "\"node\" field is not an object.*"
@@ -340,9 +324,7 @@ TEST(XdsBootstrapTest, XdsServerMissingServerUri) {
   auto json = Json::Parse(json_str);
   ASSERT_TRUE(json.ok()) << json.status();
   grpc_error_handle error = GRPC_ERROR_NONE;
-  GrpcXdsBootstrap bootstrap(
-      std::move(*json),
-      absl::make_unique<GrpcXdsCertificateProviderPluginMap>(), &error);
+  GrpcXdsBootstrap bootstrap(std::move(*json), &error);
   EXPECT_THAT(
       grpc_error_std_string(error),
       ::testing::ContainsRegex("errors parsing \"xds_servers\" array.*"
@@ -365,9 +347,7 @@ TEST(XdsBootstrapTest, XdsServerUriAndCredsWrongTypes) {
   auto json = Json::Parse(json_str);
   ASSERT_TRUE(json.ok()) << json.status();
   grpc_error_handle error = GRPC_ERROR_NONE;
-  GrpcXdsBootstrap bootstrap(
-      std::move(*json),
-      absl::make_unique<GrpcXdsCertificateProviderPluginMap>(), &error);
+  GrpcXdsBootstrap bootstrap(std::move(*json), &error);
   EXPECT_THAT(grpc_error_std_string(error),
               ::testing::ContainsRegex(
                   "errors parsing \"xds_servers\" array.*"
@@ -396,9 +376,7 @@ TEST(XdsBootstrapTest, ChannelCredsFieldsWrongTypes) {
   auto json = Json::Parse(json_str);
   ASSERT_TRUE(json.ok()) << json.status();
   grpc_error_handle error = GRPC_ERROR_NONE;
-  GrpcXdsBootstrap bootstrap(
-      std::move(*json),
-      absl::make_unique<GrpcXdsCertificateProviderPluginMap>(), &error);
+  GrpcXdsBootstrap bootstrap(std::move(*json), &error);
   EXPECT_THAT(
       grpc_error_std_string(error),
       ::testing::ContainsRegex("errors parsing \"xds_servers\" array.*"
@@ -424,9 +402,7 @@ TEST(XdsBootstrapTest, NodeFieldsWrongTypes) {
   auto json = Json::Parse(json_str);
   ASSERT_TRUE(json.ok()) << json.status();
   grpc_error_handle error = GRPC_ERROR_NONE;
-  GrpcXdsBootstrap bootstrap(
-      std::move(*json),
-      absl::make_unique<GrpcXdsCertificateProviderPluginMap>(), &error);
+  GrpcXdsBootstrap bootstrap(std::move(*json), &error);
   EXPECT_THAT(grpc_error_std_string(error),
               ::testing::ContainsRegex("errors parsing \"node\" object.*"
                                        "\"id\" field is not a string.*"
@@ -450,9 +426,7 @@ TEST(XdsBootstrapTest, LocalityFieldsWrongType) {
   auto json = Json::Parse(json_str);
   ASSERT_TRUE(json.ok()) << json.status();
   grpc_error_handle error = GRPC_ERROR_NONE;
-  GrpcXdsBootstrap bootstrap(
-      std::move(*json),
-      absl::make_unique<GrpcXdsCertificateProviderPluginMap>(), &error);
+  GrpcXdsBootstrap bootstrap(std::move(*json), &error);
   EXPECT_THAT(grpc_error_std_string(error),
               ::testing::ContainsRegex("errors parsing \"node\" object.*"
                                        "errors parsing \"locality\" object.*"
@@ -478,9 +452,7 @@ TEST(XdsBootstrapTest, CertificateProvidersElementWrongType) {
   auto json = Json::Parse(json_str);
   ASSERT_TRUE(json.ok()) << json.status();
   grpc_error_handle error = GRPC_ERROR_NONE;
-  GrpcXdsBootstrap bootstrap(
-      std::move(*json),
-      absl::make_unique<GrpcXdsCertificateProviderPluginMap>(), &error);
+  GrpcXdsBootstrap bootstrap(std::move(*json), &error);
   EXPECT_THAT(grpc_error_std_string(error),
               ::testing::ContainsRegex(
                   "errors parsing \"certificate_providers\" object.*"
@@ -506,9 +478,7 @@ TEST(XdsBootstrapTest, CertificateProvidersPluginNameWrongType) {
   auto json = Json::Parse(json_str);
   ASSERT_TRUE(json.ok()) << json.status();
   grpc_error_handle error = GRPC_ERROR_NONE;
-  GrpcXdsBootstrap bootstrap(
-      std::move(*json),
-      absl::make_unique<GrpcXdsCertificateProviderPluginMap>(), &error);
+  GrpcXdsBootstrap bootstrap(std::move(*json), &error);
   EXPECT_THAT(grpc_error_std_string(error),
               ::testing::ContainsRegex(
                   "errors parsing \"certificate_providers\" object.*"
@@ -535,9 +505,7 @@ TEST(XdsBootstrapTest, CertificateProvidersUnrecognizedPluginName) {
   auto json = Json::Parse(json_str);
   ASSERT_TRUE(json.ok()) << json.status();
   grpc_error_handle error = GRPC_ERROR_NONE;
-  GrpcXdsBootstrap bootstrap(
-      std::move(*json),
-      absl::make_unique<GrpcXdsCertificateProviderPluginMap>(), &error);
+  GrpcXdsBootstrap bootstrap(std::move(*json), &error);
   EXPECT_THAT(grpc_error_std_string(error),
               ::testing::ContainsRegex(
                   "errors parsing \"certificate_providers\" object.*"
@@ -578,9 +546,7 @@ TEST(XdsBootstrapTest, AuthorityXdsServerInvalidResourceTemplate) {
   auto json = Json::Parse(json_str);
   ASSERT_TRUE(json.ok()) << json.status();
   grpc_error_handle error = GRPC_ERROR_NONE;
-  GrpcXdsBootstrap bootstrap(
-      std::move(*json),
-      absl::make_unique<GrpcXdsCertificateProviderPluginMap>(), &error);
+  GrpcXdsBootstrap bootstrap(std::move(*json), &error);
   EXPECT_THAT(grpc_error_std_string(error),
               ::testing::ContainsRegex(
                   "errors parsing \"authorities\".*"
@@ -612,9 +578,7 @@ TEST(XdsBootstrapTest, AuthorityXdsServerMissingServerUri) {
   auto json = Json::Parse(json_str);
   ASSERT_TRUE(json.ok()) << json.status();
   grpc_error_handle error = GRPC_ERROR_NONE;
-  GrpcXdsBootstrap bootstrap(
-      std::move(*json),
-      absl::make_unique<GrpcXdsCertificateProviderPluginMap>(), &error);
+  GrpcXdsBootstrap bootstrap(std::move(*json), &error);
   EXPECT_THAT(
       grpc_error_std_string(error),
       ::testing::ContainsRegex("errors parsing \"authorities\".*"
@@ -697,9 +661,7 @@ TEST(XdsBootstrapTest, CertificateProvidersFakePluginParsingError) {
   auto json = Json::Parse(json_str);
   ASSERT_TRUE(json.ok()) << json.status();
   grpc_error_handle error = GRPC_ERROR_NONE;
-  GrpcXdsBootstrap bootstrap(
-      std::move(*json),
-      absl::make_unique<GrpcXdsCertificateProviderPluginMap>(), &error);
+  GrpcXdsBootstrap bootstrap(std::move(*json), &error);
   EXPECT_THAT(grpc_error_std_string(error),
               ::testing::ContainsRegex(
                   "errors parsing \"certificate_providers\" object.*"
@@ -729,15 +691,10 @@ TEST(XdsBootstrapTest, CertificateProvidersFakePluginParsingSuccess) {
   auto json = Json::Parse(json_str);
   ASSERT_TRUE(json.ok()) << json.status();
   grpc_error_handle error = GRPC_ERROR_NONE;
-  GrpcXdsBootstrap bootstrap(
-      std::move(*json),
-      absl::make_unique<GrpcXdsCertificateProviderPluginMap>(), &error);
+  GrpcXdsBootstrap bootstrap(std::move(*json), &error);
   ASSERT_TRUE(GRPC_ERROR_IS_NONE(error)) << grpc_error_std_string(error);
   const CertificateProviderStore::PluginDefinition& fake_plugin =
-      static_cast<const GrpcXdsCertificateProviderPluginMap*>(
-          bootstrap.certificate_provider_plugin_map())
-          ->plugin_map()
-          .at("fake_plugin");
+      bootstrap.certificate_providers().at("fake_plugin");
   ASSERT_EQ(fake_plugin.plugin_name, "fake");
   ASSERT_STREQ(fake_plugin.config->name(), "fake");
   ASSERT_EQ(static_cast<RefCountedPtr<FakeCertificateProviderFactory::Config>>(
@@ -764,15 +721,10 @@ TEST(XdsBootstrapTest, CertificateProvidersFakePluginEmptyConfig) {
   auto json = Json::Parse(json_str);
   ASSERT_TRUE(json.ok()) << json.status();
   grpc_error_handle error = GRPC_ERROR_NONE;
-  GrpcXdsBootstrap bootstrap(
-      std::move(*json),
-      absl::make_unique<GrpcXdsCertificateProviderPluginMap>(), &error);
+  GrpcXdsBootstrap bootstrap(std::move(*json), &error);
   ASSERT_TRUE(GRPC_ERROR_IS_NONE(error)) << grpc_error_std_string(error);
   const CertificateProviderStore::PluginDefinition& fake_plugin =
-      static_cast<const GrpcXdsCertificateProviderPluginMap*>(
-          bootstrap.certificate_provider_plugin_map())
-          ->plugin_map()
-          .at("fake_plugin");
+      bootstrap.certificate_providers().at("fake_plugin");
   ASSERT_EQ(fake_plugin.plugin_name, "fake");
   ASSERT_STREQ(fake_plugin.config->name(), "fake");
   ASSERT_EQ(static_cast<RefCountedPtr<FakeCertificateProviderFactory::Config>>(