From 1a9960ce1b39d6dd4d8fa27580253e1fb3621a28 Mon Sep 17 00:00:00 2001 From: Erik Engberg Date: Tue, 9 Jun 2026 00:27:37 +0200 Subject: [PATCH 1/2] fix xds credentials being silently ignored Fixes #565 --- grpcurl.go | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/grpcurl.go b/grpcurl.go index 777e3c10..fa96c1a2 100644 --- a/grpcurl.go +++ b/grpcurl.go @@ -617,7 +617,7 @@ func BlockingDial(ctx context.Context, network, address string, creds credential } var err error - if strings.HasPrefix(address, "xds:///") { + if strings.HasPrefix(address, "xds://") { // The xds:/// prefix is used to signal to the gRPC client to use an xDS server to resolve the // target. The relevant credentials will be automatically pulled from the GRPC_XDS_BOOTSTRAP or // GRPC_XDS_BOOTSTRAP_CONFIG env vars. @@ -737,3 +737,18 @@ func (c *errSignalingCreds) ClientHandshake(ctx context.Context, addr string, ra } return conn, auth, err } + +// UsesXDS forwards the optional UsesXDS marker of the wrapped credentials. The +// xDS credentials returned for "xds://" targets implement this method, and +// grpc-go's cds balancer relies on a type assertion for it to decide whether to +// apply the security configuration (e.g. UpstreamTlsContext) delivered by the +// management server. Because errSignalingCreds embeds the TransportCredentials +// interface, that extra method is not promoted automatically, so we forward it +// explicitly. Without this, xDS-supplied mTLS is silently ignored and the +// connection falls back to the plain credentials. +func (c *errSignalingCreds) UsesXDS() bool { + if x, ok := c.TransportCredentials.(interface{ UsesXDS() bool }); ok { + return x.UsesXDS() + } + return false +} From 4da27e7fc2973c424a9e97ab1b29f071254c13f0 Mon Sep 17 00:00:00 2001 From: Erik Engberg Date: Mon, 15 Jun 2026 14:10:36 +0200 Subject: [PATCH 2/2] Apply suggestion from @dragonsinth Co-authored-by: Scott Blum --- grpcurl.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/grpcurl.go b/grpcurl.go index fa96c1a2..6a1c51cc 100644 --- a/grpcurl.go +++ b/grpcurl.go @@ -618,7 +618,7 @@ func BlockingDial(ctx context.Context, network, address string, creds credential var err error if strings.HasPrefix(address, "xds://") { - // The xds:/// prefix is used to signal to the gRPC client to use an xDS server to resolve the + // The xds:// prefix is used to signal to the gRPC client to use an xDS server to resolve the // target. The relevant credentials will be automatically pulled from the GRPC_XDS_BOOTSTRAP or // GRPC_XDS_BOOTSTRAP_CONFIG env vars. creds, err = xdsCredentials.NewClientCredentials(xdsCredentials.ClientOptions{FallbackCreds: creds})