alts: Make GoogleDefaultChannelCredentials take a CallCredentials

alts/src/main/java/io/grpc/alts/ComputeEngineChannelCredentials.java

@@ -44,29 +44,54 @@ private ComputeEngineChannelCredentials() {}
    * if applicable and using TLS as fallback.
    */
   public static ChannelCredentials create() {
-    ChannelCredentials nettyCredentials =
-        InternalNettyChannelCredentials.create(createClientFactory());
-    CallCredentials callCredentials;
-    if (InternalCheckGcpEnvironment.isOnGcp()) {
-      callCredentials = MoreCallCredentials.from(ComputeEngineCredentials.create());
-    } else {
-      callCredentials = new FailingCallCredentials(
-          Status.INTERNAL.withDescription(
-              "Compute Engine Credentials can only be used on Google Cloud Platform"));
-    }
-    return CompositeChannelCredentials.create(nettyCredentials, callCredentials);
+    return newBuilder().build();
+  }
+
+  public static Builder newBuilder() {
+    return new Builder();
   }
 
-  private static InternalProtocolNegotiator.ClientFactory createClientFactory() {
-    SslContext sslContext;
-    try {
-      sslContext = GrpcSslContexts.forClient().build();
-    } catch (SSLException e) {
-      throw new RuntimeException(e);
+  /** Builder for {@link ComputeEngineChannelCredentials} instances. */
+  public static final class Builder {
+    private CallCredentials callCredentials;
+
+    /**
+     * Receives a call credential so that ComputeEngineChannelCredentials can support non-default
+     * service account.
+     */
+    public Builder setCallCredentials(CallCredentials callCreds) {
+      callCredentials = callCreds;
+      return this;
+    }
+
+    /** Build a ComputeEngineChannelCredentials instance. */
+    public ChannelCredentials build() {
+      ChannelCredentials nettyCredentials =
+          InternalNettyChannelCredentials.create(createClientFactory());
+      if (!InternalCheckGcpEnvironment.isOnGcp()) {
+        callCredentials =
+            new FailingCallCredentials(
+                Status.INTERNAL.withDescription(
+                    "Compute Engine Credentials can only be used on Google Cloud Platform"));
+      }
+      if (callCredentials == null) {
+        return CompositeChannelCredentials.create(
+            nettyCredentials, MoreCallCredentials.from(ComputeEngineCredentials.create()));
+      }
+      return CompositeChannelCredentials.create(nettyCredentials, callCredentials);
+    }
+
+    private static InternalProtocolNegotiator.ClientFactory createClientFactory() {
+      SslContext sslContext;
+      try {
+        sslContext = GrpcSslContexts.forClient().build();
+      } catch (SSLException e) {
+        throw new RuntimeException(e);
+      }
+      return new GoogleDefaultProtocolNegotiatorFactory(
+          /* targetServiceAccounts= */ ImmutableList.<String>of(),
+          SharedResourcePool.forResource(HandshakerServiceChannel.SHARED_HANDSHAKER_CHANNEL),
+          sslContext);
     }
-    return new GoogleDefaultProtocolNegotiatorFactory(
-        /* targetServiceAccounts= */ ImmutableList.<String>of(),
-        SharedResourcePool.forResource(HandshakerServiceChannel.SHARED_HANDSHAKER_CHANNEL),
-        sslContext);
   }
 }