feedback from easwar:

- close credentials provider for each authority
- Fatal tests where possible.

xds/internal/xdsclient/authority.go

@@ -448,6 +448,10 @@ func (a *authority) close() {
 	a.resourcesMu.Lock()
 	a.closed = true
 	a.resourcesMu.Unlock()
+
+	for _, cleanup := range a.serverCfg.Cleanups {
+		cleanup()
+	}
 }
 
 func (a *authority) watchResource(rType xdsresource.Type, resourceName string, watcher xdsresource.ResourceWatcher) func() {

xds/internal/xdsclient/bootstrap/bootstrap_test.go

@@ -1056,11 +1056,11 @@ func TestCredsBuilders(t *testing.T) {
 
 func TestTlsCredsBuilder(t *testing.T) {
 	tls := &tlsCredsBuilder{}
-	if _, stop, err := tls.Build(json.RawMessage(`{}`)); err != nil {
-		t.Errorf("tls.Build() failed with error %s when expected to succeed", err)
-	} else {
-		stop()
+	_, stop, err := tls.Build(json.RawMessage(`{}`))
+	if err != nil {
+		t.Fatalf("tls.Build() failed with error %s when expected to succeed", err)
 	}
+	stop()
 	if _, stop, err := tls.Build(json.RawMessage(`{"ca_certificate_file":"/ca_certificates.pem","refresh_interval": "asdf"}`)); err == nil {
 		t.Errorf("tls.Build() succeeded with an invalid refresh interval, when expected to fail")
 		stop()

xds/internal/xdsclient/clientimpl.go

@@ -85,8 +85,5 @@ func (c *clientImpl) close() {
 	c.authorityMu.Unlock()
 	c.serializerClose()
 
-	for _, f := range c.config.XDSServer.Cleanups {
-		f()
-	}
 	c.logger.Infof("Shutdown")
 }

xds/internal/xdsclient/tlscreds/bundle_ext_test.go

@@ -135,7 +135,9 @@ func (s) TestInvalidTlsBuilder(t *testing.T) {
 			msg := json.RawMessage(test.jd)
 			if _, stop, err := tlscreds.NewBundle(msg); err == nil || !strings.HasPrefix(err.Error(), test.wantErrPrefix) {
 				t.Errorf("NewBundle(%s): got error %s, want an error with prefix %s", msg, err, test.wantErrPrefix)
-				stop()
+				if err == nil {
+					stop()
+				}
 			}
 		})
 	}