grpc/grpc-java · error · GrpcServiceParseException

TlsCredentials input stream construction pending.

Error message

TlsCredentials input stream construction pending.

What it means

The parser matched a TLS_CREDENTIALS_TYPE_URL plugin, but in this revision of GrpcServiceConfigParser the TLS credential support is only a structural skeleton: the stream-level conversions for TlsCredentials were not yet merged, so any TlsCredentials config throws GrpcServiceParseException "TlsCredentials input stream construction pending."

Source

Thrown at xds/src/main/java/io/grpc/xds/GrpcServiceConfigParser.java:232

          XdsCredentials xdsConfig = cred.unpack(XdsCredentials.class);
          Optional<ConfiguredChannelCredentials> fallbackCreds =
              channelCredsFromProto(xdsConfig.getFallbackCredentials());
          if (!fallbackCreds.isPresent()) {
            throw new GrpcServiceParseException(
                "Unsupported fallback credentials type for XdsCredentials");
          }
          return Optional.of(ConfiguredChannelCredentials.create(
              XdsChannelCredentials.create(fallbackCreds.get().channelCredentials()),
              new ProtoChannelCredsConfig(typeUrl, cred)));
        case LOCAL_CREDENTIALS_TYPE_URL:
          throw new GrpcServiceParseException(
              "LocalCredentials are not supported in grpc-java. "
                  + "See https://github.com/grpc/grpc-java/issues/8928");
        case TLS_CREDENTIALS_TYPE_URL:
          // For this PR, we establish this structural skeleton,
          // but throw an GrpcServiceParseException until the exact stream conversions are
          // merged.
          throw new GrpcServiceParseException(
              "TlsCredentials input stream construction pending.");
        default:
          return Optional.empty();
      }
    } catch (InvalidProtocolBufferException e) {
      throw new GrpcServiceParseException("Failed to parse channel credentials: " + e.getMessage());
    }
  }

  private static ConfiguredChannelCredentials extractChannelCredentials(
      List<Any> channelCredentialPlugins) throws GrpcServiceParseException {
    for (Any cred : channelCredentialPlugins) {
      Optional<ConfiguredChannelCredentials> parsed = channelCredsFromProto(cred);
      if (parsed.isPresent()) {
        return parsed.get();
      }
    }
    throw new GrpcServiceParseException("No valid supported channel_credentials found");

View on GitHub (pinned to 64daddc1f3)

Solutions

Upgrade grpc-java to a version where TlsCredentials stream conversion is merged (post-skeleton release)
Switch the channel credentials plugin to a supported type (e.g. google_default) until the TLS path lands
Pin the previous working version/config that did not require TlsCredentials parsing

Example fix

// before: dependency using skeleton build
implementation 'io.grpc:grpc-xds:1.35.0-SNAPSHOT'
// after: version with TLS creds support
implementation 'io.grpc:grpc-xds:1.36.0'

Defensive patterns

Strategy: try-catch

Validate before calling

// Pre-check: detect skeleton TLS path
if (plugin.getTypeUrl().contains("TlsCredentials")) {
  checkState(supportsTlsCreds(), "grpc-java build lacks TlsCredentials support");
}

Type guard

boolean tlsSupported(String grpcXdsVersion) {
  return compareVersions(grpcXdsVersion, "1.36.0") >= 0;
}

Try / catch

try {
  parsed = parser.parse(serviceConfig);
} catch (GrpcServiceParseException e) {
  if (e.getMessage().startsWith("TlsCredentials input stream construction pending")) {
    // upgrade grpc-java or fall back to google_default
  } else throw e;
}

Prevention

Avoid SNAPSHOT/intermediate grpc-xds builds in production configs
Prefer google_default credentials when TLS conversion is not yet merged
Track the release notes for the TLS stream-conversion merge before enabling TLS in xDS configs

When it happens

Trigger: channelCredsFromProto (via fallbackCreds or parsed) receives a channel_credentials_plugins Any whose type_url equals TLS_CREDENTIALS_TYPE_URL; the case is reached every time a TLS credentials plugin is configured in this PR-state build.

Common situations: Using a dev/intermediate build of grpc-java xDS that predates the TLS stream-conversion merge while the bootstrap config declares tls credentials; upgrading configs to TLS on a library version that still has the skeleton.

Related errors

AI-assisted analysis of grpc/grpc-java@64daddc1f3 (2026-09-08). Data as JSON: /api/errors/06e3a6e46b671fed. Report an issue: GitHub.