or run

npx @tessl/cli init
Log in

Version

Tile

Overview

Evals

Files

docs

channel-builders.mdchannel-credentials.mdcontext-authorization.mdindex.mdserver-builders.mdserver-credentials.md
tile.json

tessl/maven-io-grpc--grpc-alts

gRPC ALTS (Application Layer Transport Security) implementation for secure and authenticated communication between Google Cloud VMs

Workspace
tessl
Visibility
Public
Created
Last updated
Describes
mavenpkg:maven/io.grpc/grpc-alts@1.73.x

To install, run

npx @tessl/cli install tessl/maven-io-grpc--grpc-alts@1.73.0

index.mddocs/

gRPC ALTS Java Library

The gRPC ALTS (Application Layer Transport Security) Java library provides secure, authenticated communication capabilities for gRPC applications running on Google Cloud Platform. ALTS enables mutual authentication and encryption between services without explicit credential management, leveraging Google's infrastructure for automatic service identity verification.

Package Information

  • Package Name: grpc-alts
  • Package Type: maven
  • Language: Java
  • Installation: Maven coordinates io.grpc:grpc-alts:1.73.0

Core Imports

import io.grpc.alts.AltsChannelBuilder;
import io.grpc.alts.AltsServerBuilder;
import io.grpc.alts.AltsChannelCredentials;
import io.grpc.alts.AltsServerCredentials;
import io.grpc.alts.AltsContext;
import io.grpc.alts.AltsContextUtil;
import io.grpc.alts.ComputeEngineChannelBuilder;
import io.grpc.alts.GoogleDefaultChannelBuilder;

Basic Usage

Client Channel with ALTS

import io.grpc.alts.AltsChannelBuilder;
import io.grpc.ManagedChannel;

// Create a secure ALTS channel to a target service
ManagedChannel channel = AltsChannelBuilder.forTarget("example-service:443")
    .addTargetServiceAccount("expected-service@gcp-project.iam.gserviceaccount.com")
    .build();

// Use the channel for gRPC calls
YourServiceGrpc.YourServiceBlockingStub stub = 
    YourServiceGrpc.newBlockingStub(channel);

Server with ALTS

import io.grpc.alts.AltsServerBuilder;
import io.grpc.Server;

// Create a secure ALTS server
Server server = AltsServerBuilder.forPort(8080)
    .addService(new YourServiceImpl())
    .build();

server.start();

Compute Engine Channel (ALTS with TLS Fallback)

import io.grpc.alts.ComputeEngineChannelBuilder;
import io.grpc.ManagedChannel;

// Automatically uses ALTS on GCP, TLS elsewhere
ManagedChannel channel = ComputeEngineChannelBuilder
    .forTarget("example-service:443")
    .build();

Architecture

The gRPC ALTS library is organized around several key components:

  • Channel and Server Builders: High-level builders (AltsChannelBuilder, AltsServerBuilder) that configure ALTS security automatically
  • Credential Classes: Lower-level credential objects (AltsChannelCredentials, AltsServerCredentials) for custom integration
  • Context and Authorization: Runtime context access (AltsContext, AltsContextUtil) for service identity verification
  • Fallback Mechanisms: Compute Engine and Google Default builders that provide automatic fallback to TLS
  • Testing Support: Special configurations for development and testing environments

Capabilities

Channel Builders

High-level builders for creating secure gRPC channels with ALTS authentication. These builders automatically configure the underlying security infrastructure.

// Pure ALTS channel builder
public final class AltsChannelBuilder {
    public static AltsChannelBuilder forTarget(String target);
    public static AltsChannelBuilder forAddress(String name, int port);
    public AltsChannelBuilder addTargetServiceAccount(String targetServiceAccount);
    public ManagedChannel build();
}

// Compute Engine channel builder (ALTS with TLS fallback)
public final class ComputeEngineChannelBuilder {
    public static ComputeEngineChannelBuilder forTarget(String target);
    public static ComputeEngineChannelBuilder forAddress(String name, int port);
}

// Google Default channel builder (full Google Cloud auth stack)
public final class GoogleDefaultChannelBuilder {
    public static GoogleDefaultChannelBuilder forTarget(String target);
    public static GoogleDefaultChannelBuilder forAddress(String name, int port);
}

Channel Builders

Server Builders

High-level builders for creating secure gRPC servers with ALTS authentication.

public final class AltsServerBuilder {
    public static AltsServerBuilder forPort(int port);
    public AltsServerBuilder enableUntrustedAltsForTesting();
    public AltsServerBuilder setHandshakerAddressForTesting(String handshakerAddress);
    public Server build();
}

Server Builders

Channel Credentials

Lower-level credential objects for custom channel security configuration.

public final class AltsChannelCredentials {
    public static ChannelCredentials create();
    public static Builder newBuilder();
}

public final class ComputeEngineChannelCredentials {
    public static ChannelCredentials create();
}

public final class GoogleDefaultChannelCredentials {
    public static ChannelCredentials create();
    public static Builder newBuilder(); // Since 1.43.0
}

Channel Credentials

Server Credentials

Lower-level credential objects for custom server security configuration.

public final class AltsServerCredentials {
    public static ServerCredentials create();
    public static Builder newBuilder();
}

Server Credentials

Context and Authorization

Runtime context access for service identity verification and authorization checks.

public final class AltsContext {
    public SecurityLevel getSecurityLevel();
    public String getPeerServiceAccount();
    public String getLocalServiceAccount();
    
    public enum SecurityLevel {
        UNKNOWN, SECURITY_NONE, INTEGRITY_ONLY, INTEGRITY_AND_PRIVACY
    }
}

public final class AltsContextUtil {
    public static AltsContext createFrom(ServerCall<?, ?> call);
    public static AltsContext createFrom(ClientCall<?, ?> call);
    public static boolean check(ServerCall<?, ?> call);
    public static boolean check(ClientCall<?, ?> call);
}

public final class AuthorizationUtil {
    public static Status clientAuthorizationCheck(
        ServerCall<?, ?> call, 
        Collection<String> expectedServiceAccounts
    );
}

Context and Authorization

Types

// Core gRPC interfaces used by ALTS
import io.grpc.ManagedChannel;
import io.grpc.Server;
import io.grpc.ChannelCredentials;
import io.grpc.ServerCredentials;
import io.grpc.ServerCall;
import io.grpc.ClientCall;
import io.grpc.Status;

// Java standard types
import java.util.Collection;
import java.util.concurrent.TimeUnit;

API Maturity

Most ALTS APIs are marked as @ExperimentalApi and subject to change:

  • Main builder and credential APIs are experimental (Issue #4151)
  • Context and utility APIs are experimental (Issue #7864)

Production usage should account for potential API changes in future versions.