[kalragauri]

With DirectPathXdsOverInterconnectOption (or GOOGLE_CLOUD_ENABLE_DIRECT_PATH_XDS_OVER_INTERCONNECT=true) and gRPC >= 1.85, DefaultOptionsGrpc() targets google-c2p:///storage-direct.googleapis.com?force-xds (default_options.cc#L178-L181), but the default credentials still map to grpc::GoogleDefaultCredentials() (unified_grpc_credentials.cc#L109-L112). Those credentials select ALTS for any xDS cluster not named google_cfe_* (google_default_credentials.cc#L136-L145), which is what Traffic Director returns for DirectPath backends. Interconnect clients run outside Google Cloud, where ALTS is unavailable, so the channel never connects.

This PR adds an internal GrpcGoogleDefaultTlsOnlyOption. When set, the GoogleDefaultCredentialsConfig branch of CreateAuthenticationStrategy() returns grpc::CompositeChannelCredentials(grpc::SslCredentials(), call_creds), with call_creds derived from Application Default Credentials the same way gRPC's own Google Default credentials derive them (google_default_credentials.cc#L263). Tokens stay channel-level, so RLS control channels inherit them; only the transport changes from ALTS to TLS. The ADC lookup mirrors the REST loader (oauth2_google_credentials.cc#L161-L180) rather than reusing it, because grpc_utils does not link rest_internal (libcurl). Differences from grpc::GoogleDefaultCredentials()'s own lookup, all matching the REST
credentials and pinned by tests: a GOOGLE_APPLICATION_CREDENTIALS file that cannot be opened or
parsed is an error rather than a fall-through to the gcloud file and the metadata server;
GOOGLE_GCLOUD_ADC_PATH_OVERRIDE is honored; with no file at all, Compute Engine call credentials
are used without probing the metadata server; and CARootsFilePathOption applies to the TLS roots.

DefaultOptionsGrpc() sets the option whenever gRPC supports force-xds and the effective endpoint is an Interconnect target: keyed on the endpoint like the AuthorityOption default from #16584, but for any force-xds host, since ALTS is unavailable regardless of host.

[gemini-code-assist]

Code Review

This pull request introduces the GrpcGoogleDefaultTlsOnlyOption option and implements a custom Application Default Credentials (ADC) lookup and classification mechanism in the gRPC unified credentials implementation. This allows the SDK to compose TLS channel credentials with call credentials derived from ADC when running in environments where ALTS is unavailable, such as DirectPath over Interconnect. The changes also include comprehensive unit tests and updates to the Cloud Storage gRPC plugin options and documentation to enable this option for Interconnect endpoints. I have no feedback to provide as there are no review comments.

[v-pratap]

Looks good overall, and the option wiring and error paths are well covered. Main ask: add one test that can tell the TLS strategy apart from grpc::GoogleDefaultCredentials(); right now swapping them keeps the suite green. A few nits inline.

[codecov]

Codecov Report

❌ Patch coverage is 99.81785% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 92.42%. Comparing base (608aeef) to head (3a945e8).

Files with missing lines	Patch %	Lines
...le/cloud/internal/unified_grpc_credentials_test.cc	99.74%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #16599      +/-   ##
==========================================
+ Coverage   92.40%   92.42%   +0.02%     
==========================================
  Files        2266     2266              
  Lines      220810   221345     +535     
==========================================
+ Hits       204036   204588     +552     
+ Misses      16774    16757      -17     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.