{"record":{"id":"06e3a6e46b671fed","repo":"grpc/grpc-java","slug":"tlscredentials-input-stream-construction-pending","errorCode":null,"errorMessage":"TlsCredentials input stream construction pending.","messagePattern":"TlsCredentials input stream construction pending\\.","errorType":"validation","errorClass":"GrpcServiceParseException","httpStatus":null,"severity":"error","filePath":"xds/src/main/java/io/grpc/xds/GrpcServiceConfigParser.java","lineNumber":232,"sourceCode":"          XdsCredentials xdsConfig = cred.unpack(XdsCredentials.class);\n          Optional<ConfiguredChannelCredentials> fallbackCreds =\n              channelCredsFromProto(xdsConfig.getFallbackCredentials());\n          if (!fallbackCreds.isPresent()) {\n            throw new GrpcServiceParseException(\n                \"Unsupported fallback credentials type for XdsCredentials\");\n          }\n          return Optional.of(ConfiguredChannelCredentials.create(\n              XdsChannelCredentials.create(fallbackCreds.get().channelCredentials()),\n              new ProtoChannelCredsConfig(typeUrl, cred)));\n        case LOCAL_CREDENTIALS_TYPE_URL:\n          throw new GrpcServiceParseException(\n              \"LocalCredentials are not supported in grpc-java. \"\n                  + \"See https://github.com/grpc/grpc-java/issues/8928\");\n        case TLS_CREDENTIALS_TYPE_URL:\n          // For this PR, we establish this structural skeleton,\n          // but throw an GrpcServiceParseException until the exact stream conversions are\n          // merged.\n          throw new GrpcServiceParseException(\n              \"TlsCredentials input stream construction pending.\");\n        default:\n          return Optional.empty();\n      }\n    } catch (InvalidProtocolBufferException e) {\n      throw new GrpcServiceParseException(\"Failed to parse channel credentials: \" + e.getMessage());\n    }\n  }\n\n  private static ConfiguredChannelCredentials extractChannelCredentials(\n      List<Any> channelCredentialPlugins) throws GrpcServiceParseException {\n    for (Any cred : channelCredentialPlugins) {\n      Optional<ConfiguredChannelCredentials> parsed = channelCredsFromProto(cred);\n      if (parsed.isPresent()) {\n        return parsed.get();\n      }\n    }\n    throw new GrpcServiceParseException(\"No valid supported channel_credentials found\");","sourceCodeStart":214,"sourceCodeEnd":250,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/xds/src/main/java/io/grpc/xds/GrpcServiceConfigParser.java#L214-L250","documentation":"The parser matched a TLS_CREDENTIALS_TYPE_URL plugin, but in this revision of GrpcServiceConfigParser the TLS credential support is only a structural skeleton: the stream-level conversions for TlsCredentials were not yet merged, so any TlsCredentials config throws GrpcServiceParseException \"TlsCredentials input stream construction pending.\"","triggerScenarios":"channelCredsFromProto (via fallbackCreds or parsed) receives a channel_credentials_plugins Any whose type_url equals TLS_CREDENTIALS_TYPE_URL; the case is reached every time a TLS credentials plugin is configured in this PR-state build.","commonSituations":"Using a dev/intermediate build of grpc-java xDS that predates the TLS stream-conversion merge while the bootstrap config declares tls credentials; upgrading configs to TLS on a library version that still has the skeleton.","solutions":["Upgrade grpc-java to a version where TlsCredentials stream conversion is merged (post-skeleton release)","Switch the channel credentials plugin to a supported type (e.g. google_default) until the TLS path lands","Pin the previous working version/config that did not require TlsCredentials parsing"],"exampleFix":"// before: dependency using skeleton build\nimplementation 'io.grpc:grpc-xds:1.35.0-SNAPSHOT'\n// after: version with TLS creds support\nimplementation 'io.grpc:grpc-xds:1.36.0'\n","handlingStrategy":"try-catch","validationCode":"// Pre-check: detect skeleton TLS path\nif (plugin.getTypeUrl().contains(\"TlsCredentials\")) {\n  checkState(supportsTlsCreds(), \"grpc-java build lacks TlsCredentials support\");\n}","typeGuard":"boolean tlsSupported(String grpcXdsVersion) {\n  return compareVersions(grpcXdsVersion, \"1.36.0\") >= 0;\n}","tryCatchPattern":"try {\n  parsed = parser.parse(serviceConfig);\n} catch (GrpcServiceParseException e) {\n  if (e.getMessage().startsWith(\"TlsCredentials input stream construction pending\")) {\n    // upgrade grpc-java or fall back to google_default\n  } else throw e;\n}","preventionTips":["Avoid SNAPSHOT/intermediate grpc-xds builds in production configs","Prefer google_default credentials when TLS conversion is not yet merged","Track the release notes for the TLS stream-conversion merge before enabling TLS in xDS configs"],"tags":["xds","grpc-java","tls","credentials","unimplemented"],"backgroundTag":"method-not-implemented","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}