remove ALTS shared resources

22 files changed, 47 insertions, 155 deletions

diff --git a/BUILD b/BUILD
index e86e48c7e3..d572285233 100644
--- a/BUILD
+++ b/BUILD
@@ -1962,7 +1962,6 @@ grpc_cc_library(
         "src/core/tsi/alts/handshaker/alts_shared_resource.cc",
         "src/core/tsi/alts/handshaker/alts_tsi_handshaker.cc",
         "src/core/tsi/alts/handshaker/alts_tsi_utils.cc",
-        "src/core/tsi/alts_transport_security.cc",
         "src/core/tsi/fake_transport_security.cc",
         "src/core/tsi/local_transport_security.cc",
         "src/core/tsi/ssl/session_cache/ssl_session_boringssl.cc",
@@ -1977,7 +1976,6 @@ grpc_cc_library(
         "src/core/tsi/alts/handshaker/alts_tsi_handshaker.h",
         "src/core/tsi/alts/handshaker/alts_tsi_handshaker_private.h",
         "src/core/tsi/alts/handshaker/alts_tsi_utils.h",
-        "src/core/tsi/alts_transport_security.h",
         "src/core/tsi/fake_transport_security.h",
         "src/core/tsi/local_transport_security.h",
         "src/core/tsi/ssl/session_cache/ssl_session.h",
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 56c9c6a02f..4cf60b1b28 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1251,7 +1251,6 @@ add_library(grpc
   src/core/ext/filters/client_channel/subchannel_index.cc
   src/core/ext/filters/deadline/deadline_filter.cc
   src/core/ext/filters/client_channel/health/health.pb.c
-  src/core/tsi/alts_transport_security.cc
   src/core/tsi/fake_transport_security.cc
   src/core/tsi/local_transport_security.cc
   src/core/tsi/ssl/session_cache/ssl_session_boringssl.cc
@@ -1675,7 +1674,6 @@ add_library(grpc_cronet
   src/core/ext/transport/chttp2/client/insecure/channel_create_posix.cc
   src/core/ext/transport/chttp2/client/authority.cc
   src/core/ext/transport/chttp2/client/chttp2_connector.cc
-  src/core/tsi/alts_transport_security.cc
   src/core/tsi/fake_transport_security.cc
   src/core/tsi/local_transport_security.cc
   src/core/tsi/ssl/session_cache/ssl_session_boringssl.cc
diff --git a/Makefile b/Makefile
index ca881ab0e1..5ef7e83b11 100644
--- a/Makefile
+++ b/Makefile
@@ -3726,7 +3726,6 @@ LIBGRPC_SRC = \
     src/core/ext/filters/client_channel/subchannel_index.cc \
     src/core/ext/filters/deadline/deadline_filter.cc \
     src/core/ext/filters/client_channel/health/health.pb.c \
-    src/core/tsi/alts_transport_security.cc \
     src/core/tsi/fake_transport_security.cc \
     src/core/tsi/local_transport_security.cc \
     src/core/tsi/ssl/session_cache/ssl_session_boringssl.cc \
@@ -4144,7 +4143,6 @@ LIBGRPC_CRONET_SRC = \
     src/core/ext/transport/chttp2/client/insecure/channel_create_posix.cc \
     src/core/ext/transport/chttp2/client/authority.cc \
     src/core/ext/transport/chttp2/client/chttp2_connector.cc \
-    src/core/tsi/alts_transport_security.cc \
     src/core/tsi/fake_transport_security.cc \
     src/core/tsi/local_transport_security.cc \
     src/core/tsi/ssl/session_cache/ssl_session_boringssl.cc \
@@ -25037,7 +25035,6 @@ src/core/tsi/alts/zero_copy_frame_protector/alts_grpc_privacy_integrity_record_p
 src/core/tsi/alts/zero_copy_frame_protector/alts_grpc_record_protocol_common.cc: $(OPENSSL_DEP)
 src/core/tsi/alts/zero_copy_frame_protector/alts_iovec_record_protocol.cc: $(OPENSSL_DEP)
 src/core/tsi/alts/zero_copy_frame_protector/alts_zero_copy_grpc_protector.cc: $(OPENSSL_DEP)
-src/core/tsi/alts_transport_security.cc: $(OPENSSL_DEP)
 src/core/tsi/fake_transport_security.cc: $(OPENSSL_DEP)
 src/core/tsi/local_transport_security.cc: $(OPENSSL_DEP)
 src/core/tsi/ssl/session_cache/ssl_session_boringssl.cc: $(OPENSSL_DEP)
diff --git a/build.yaml b/build.yaml
index 6d09a13af4..831aef419e 100644
--- a/build.yaml
+++ b/build.yaml
@@ -1146,7 +1146,6 @@ filegroups:
   - grpc
 - name: tsi
   headers:
-  - src/core/tsi/alts_transport_security.h
   - src/core/tsi/fake_transport_security.h
   - src/core/tsi/local_transport_security.h
   - src/core/tsi/ssl/session_cache/ssl_session.h
@@ -1155,7 +1154,6 @@ filegroups:
   - src/core/tsi/ssl_types.h
   - src/core/tsi/transport_security_grpc.h
   src:
-  - src/core/tsi/alts_transport_security.cc
   - src/core/tsi/fake_transport_security.cc
   - src/core/tsi/local_transport_security.cc
   - src/core/tsi/ssl/session_cache/ssl_session_boringssl.cc
@@ -1165,7 +1163,6 @@ filegroups:
   - src/core/tsi/transport_security_grpc.cc
   deps:
   - gpr
-  plugin: grpc_tsi_alts
   secure: true
   uses:
   - tsi_interface
diff --git a/config.m4 b/config.m4
index 15f3a54321..d0e22a8e43 100644
--- a/config.m4
+++ b/config.m4
@@ -360,7 +360,6 @@ if test "$PHP_GRPC" != "no"; then
     src/core/ext/filters/client_channel/subchannel_index.cc \
     src/core/ext/filters/deadline/deadline_filter.cc \
     src/core/ext/filters/client_channel/health/health.pb.c \
-    src/core/tsi/alts_transport_security.cc \
     src/core/tsi/fake_transport_security.cc \
     src/core/tsi/local_transport_security.cc \
     src/core/tsi/ssl/session_cache/ssl_session_boringssl.cc \
diff --git a/config.w32 b/config.w32
index 8dff1229be..07473ff5a9 100644
--- a/config.w32
+++ b/config.w32
@@ -335,7 +335,6 @@ if (PHP_GRPC != "no") {
     "src\\core\\ext\\filters\\client_channel\\subchannel_index.cc " +
     "src\\core\\ext\\filters\\deadline\\deadline_filter.cc " +
     "src\\core\\ext\\filters\\client_channel\\health\\health.pb.c " +
-    "src\\core\\tsi\\alts_transport_security.cc " +
     "src\\core\\tsi\\fake_transport_security.cc " +
     "src\\core\\tsi\\local_transport_security.cc " +
     "src\\core\\tsi\\ssl\\session_cache\\ssl_session_boringssl.cc " +
diff --git a/gRPC-C++.podspec b/gRPC-C++.podspec
index d4b0548532..b9f5900751 100644
--- a/gRPC-C++.podspec
+++ b/gRPC-C++.podspec
@@ -359,7 +359,6 @@ Pod::Spec.new do |s|
                       'src/core/ext/filters/client_channel/subchannel_index.h',
                       'src/core/ext/filters/deadline/deadline_filter.h',
                       'src/core/ext/filters/client_channel/health/health.pb.h',
-                      'src/core/tsi/alts_transport_security.h',
                       'src/core/tsi/fake_transport_security.h',
                       'src/core/tsi/local_transport_security.h',
                       'src/core/tsi/ssl/session_cache/ssl_session.h',
diff --git a/gRPC-Core.podspec b/gRPC-Core.podspec
index 6a43420830..189decc18a 100644
--- a/gRPC-Core.podspec
+++ b/gRPC-Core.podspec
@@ -357,7 +357,6 @@ Pod::Spec.new do |s|
                       'src/core/ext/filters/client_channel/subchannel_index.h',
                       'src/core/ext/filters/deadline/deadline_filter.h',
                       'src/core/ext/filters/client_channel/health/health.pb.h',
-                      'src/core/tsi/alts_transport_security.h',
                       'src/core/tsi/fake_transport_security.h',
                       'src/core/tsi/local_transport_security.h',
                       'src/core/tsi/ssl/session_cache/ssl_session.h',
@@ -797,7 +796,6 @@ Pod::Spec.new do |s|
                       'src/core/ext/filters/client_channel/subchannel_index.cc',
                       'src/core/ext/filters/deadline/deadline_filter.cc',
                       'src/core/ext/filters/client_channel/health/health.pb.c',
-                      'src/core/tsi/alts_transport_security.cc',
                       'src/core/tsi/fake_transport_security.cc',
                       'src/core/tsi/local_transport_security.cc',
                       'src/core/tsi/ssl/session_cache/ssl_session_boringssl.cc',
@@ -976,7 +974,6 @@ Pod::Spec.new do |s|
                               'src/core/ext/filters/client_channel/subchannel_index.h',
                               'src/core/ext/filters/deadline/deadline_filter.h',
                               'src/core/ext/filters/client_channel/health/health.pb.h',
-                              'src/core/tsi/alts_transport_security.h',
                               'src/core/tsi/fake_transport_security.h',
                               'src/core/tsi/local_transport_security.h',
                               'src/core/tsi/ssl/session_cache/ssl_session.h',
diff --git a/grpc.gemspec b/grpc.gemspec
index a9d3a95f2c..d8e5aac13c 100644
--- a/grpc.gemspec
+++ b/grpc.gemspec
@@ -293,7 +293,6 @@ Gem::Specification.new do |s|
   s.files += %w( src/core/ext/filters/client_channel/subchannel_index.h )
   s.files += %w( src/core/ext/filters/deadline/deadline_filter.h )
   s.files += %w( src/core/ext/filters/client_channel/health/health.pb.h )
-  s.files += %w( src/core/tsi/alts_transport_security.h )
   s.files += %w( src/core/tsi/fake_transport_security.h )
   s.files += %w( src/core/tsi/local_transport_security.h )
   s.files += %w( src/core/tsi/ssl/session_cache/ssl_session.h )
@@ -736,7 +735,6 @@ Gem::Specification.new do |s|
   s.files += %w( src/core/ext/filters/client_channel/subchannel_index.cc )
   s.files += %w( src/core/ext/filters/deadline/deadline_filter.cc )
   s.files += %w( src/core/ext/filters/client_channel/health/health.pb.c )
-  s.files += %w( src/core/tsi/alts_transport_security.cc )
   s.files += %w( src/core/tsi/fake_transport_security.cc )
   s.files += %w( src/core/tsi/local_transport_security.cc )
   s.files += %w( src/core/tsi/ssl/session_cache/ssl_session_boringssl.cc )
diff --git a/grpc.gyp b/grpc.gyp
index c365b7e2ad..ae97b8b0ee 100644
--- a/grpc.gyp
+++ b/grpc.gyp
@@ -552,7 +552,6 @@
         'src/core/ext/filters/client_channel/subchannel_index.cc',
         'src/core/ext/filters/deadline/deadline_filter.cc',
         'src/core/ext/filters/client_channel/health/health.pb.c',
-        'src/core/tsi/alts_transport_security.cc',
         'src/core/tsi/fake_transport_security.cc',
         'src/core/tsi/local_transport_security.cc',
         'src/core/tsi/ssl/session_cache/ssl_session_boringssl.cc',
diff --git a/package.xml b/package.xml
index 69f952c466..fb41e5f34a 100644
--- a/package.xml
+++ b/package.xml
@@ -298,7 +298,6 @@
     <file baseinstalldir="/" name="src/core/ext/filters/client_channel/subchannel_index.h" role="src" />
     <file baseinstalldir="/" name="src/core/ext/filters/deadline/deadline_filter.h" role="src" />
     <file baseinstalldir="/" name="src/core/ext/filters/client_channel/health/health.pb.h" role="src" />
-    <file baseinstalldir="/" name="src/core/tsi/alts_transport_security.h" role="src" />
     <file baseinstalldir="/" name="src/core/tsi/fake_transport_security.h" role="src" />
     <file baseinstalldir="/" name="src/core/tsi/local_transport_security.h" role="src" />
     <file baseinstalldir="/" name="src/core/tsi/ssl/session_cache/ssl_session.h" role="src" />
@@ -741,7 +740,6 @@
     <file baseinstalldir="/" name="src/core/ext/filters/client_channel/subchannel_index.cc" role="src" />
     <file baseinstalldir="/" name="src/core/ext/filters/deadline/deadline_filter.cc" role="src" />
     <file baseinstalldir="/" name="src/core/ext/filters/client_channel/health/health.pb.c" role="src" />
-    <file baseinstalldir="/" name="src/core/tsi/alts_transport_security.cc" role="src" />
     <file baseinstalldir="/" name="src/core/tsi/fake_transport_security.cc" role="src" />
     <file baseinstalldir="/" name="src/core/tsi/local_transport_security.cc" role="src" />
     <file baseinstalldir="/" name="src/core/tsi/ssl/session_cache/ssl_session_boringssl.cc" role="src" />
diff --git a/src/core/plugin_registry/grpc_cronet_plugin_registry.cc b/src/core/plugin_registry/grpc_cronet_plugin_registry.cc
index c0c17b0a4b..92085d31d7 100644
--- a/src/core/plugin_registry/grpc_cronet_plugin_registry.cc
+++ b/src/core/plugin_registry/grpc_cronet_plugin_registry.cc
@@ -28,8 +28,6 @@ void grpc_deadline_filter_init(void);
 void grpc_deadline_filter_shutdown(void);
 void grpc_client_channel_init(void);
 void grpc_client_channel_shutdown(void);
-void grpc_tsi_alts_init(void);
-void grpc_tsi_alts_shutdown(void);
 
 void grpc_register_built_in_plugins(void) {
   grpc_register_plugin(grpc_http_filters_init,
@@ -40,6 +38,4 @@ void grpc_register_built_in_plugins(void) {
                        grpc_deadline_filter_shutdown);
   grpc_register_plugin(grpc_client_channel_init,
                        grpc_client_channel_shutdown);
-  grpc_register_plugin(grpc_tsi_alts_init,
-                       grpc_tsi_alts_shutdown);
 }
diff --git a/src/core/plugin_registry/grpc_plugin_registry.cc b/src/core/plugin_registry/grpc_plugin_registry.cc
index 94c2493d5e..cde40ef65c 100644
--- a/src/core/plugin_registry/grpc_plugin_registry.cc
+++ b/src/core/plugin_registry/grpc_plugin_registry.cc
@@ -28,8 +28,6 @@ void grpc_deadline_filter_init(void);
 void grpc_deadline_filter_shutdown(void);
 void grpc_client_channel_init(void);
 void grpc_client_channel_shutdown(void);
-void grpc_tsi_alts_init(void);
-void grpc_tsi_alts_shutdown(void);
 void grpc_inproc_plugin_init(void);
 void grpc_inproc_plugin_shutdown(void);
 void grpc_resolver_fake_init(void);
@@ -66,8 +64,6 @@ void grpc_register_built_in_plugins(void) {
                        grpc_deadline_filter_shutdown);
   grpc_register_plugin(grpc_client_channel_init,
                        grpc_client_channel_shutdown);
-  grpc_register_plugin(grpc_tsi_alts_init,
-                       grpc_tsi_alts_shutdown);
   grpc_register_plugin(grpc_inproc_plugin_init,
                        grpc_inproc_plugin_shutdown);
   grpc_register_plugin(grpc_resolver_fake_init,
diff --git a/src/core/tsi/alts/handshaker/alts_shared_resource.cc b/src/core/tsi/alts/handshaker/alts_shared_resource.cc
index ffb5e1c655..3501257f05 100644
--- a/src/core/tsi/alts/handshaker/alts_shared_resource.cc
+++ b/src/core/tsi/alts/handshaker/alts_shared_resource.cc
@@ -25,7 +25,6 @@
 #include "src/core/tsi/alts/handshaker/alts_handshaker_client.h"
 
 static alts_shared_resource_dedicated g_alts_resource_dedicated;
-static alts_shared_resource* g_shared_resources = alts_get_shared_resource();
 
 alts_shared_resource_dedicated* grpc_alts_get_shared_resource_dedicated(void) {
   return &g_alts_resource_dedicated;
@@ -49,16 +48,25 @@ static void thread_worker(void* arg) {
 
 void grpc_alts_shared_resource_dedicated_init() {
   g_alts_resource_dedicated.cq = nullptr;
+  gpr_mu_init(&g_alts_resource_dedicated.mu);
 }
 
-void grpc_alts_shared_resource_dedicated_start() {
-  g_alts_resource_dedicated.cq = grpc_completion_queue_create_for_next(nullptr);
-  g_alts_resource_dedicated.thread =
-      grpc_core::Thread("alts_tsi_handshaker", &thread_worker, nullptr);
-  g_alts_resource_dedicated.interested_parties = grpc_pollset_set_create();
-  grpc_pollset_set_add_pollset(g_alts_resource_dedicated.interested_parties,
-                               grpc_cq_pollset(g_alts_resource_dedicated.cq));
-  g_alts_resource_dedicated.thread.Start();
+void grpc_alts_shared_resource_dedicated_start(
+    const char* handshaker_service_url) {
+  gpr_mu_lock(&g_alts_resource_dedicated.mu);
+  if (g_alts_resource_dedicated.cq == nullptr) {
+    g_alts_resource_dedicated.channel =
+        grpc_insecure_channel_create(handshaker_service_url, nullptr, nullptr);
+    g_alts_resource_dedicated.cq =
+        grpc_completion_queue_create_for_next(nullptr);
+    g_alts_resource_dedicated.thread =
+        grpc_core::Thread("alts_tsi_handshaker", &thread_worker, nullptr);
+    g_alts_resource_dedicated.interested_parties = grpc_pollset_set_create();
+    grpc_pollset_set_add_pollset(g_alts_resource_dedicated.interested_parties,
+                                 grpc_cq_pollset(g_alts_resource_dedicated.cq));
+    g_alts_resource_dedicated.thread.Start();
+  }
+  gpr_mu_unlock(&g_alts_resource_dedicated.mu);
 }
 
 void grpc_alts_shared_resource_dedicated_shutdown() {
@@ -69,5 +77,7 @@ void grpc_alts_shared_resource_dedicated_shutdown() {
     g_alts_resource_dedicated.thread.Join();
     grpc_pollset_set_destroy(g_alts_resource_dedicated.interested_parties);
     grpc_completion_queue_destroy(g_alts_resource_dedicated.cq);
+    grpc_channel_destroy(g_alts_resource_dedicated.channel);
   }
+  gpr_mu_destroy(&g_alts_resource_dedicated.mu);
 }
diff --git a/src/core/tsi/alts/handshaker/alts_shared_resource.h b/src/core/tsi/alts/handshaker/alts_shared_resource.h
index a07da305a8..8ae0089a11 100644
--- a/src/core/tsi/alts/handshaker/alts_shared_resource.h
+++ b/src/core/tsi/alts/handshaker/alts_shared_resource.h
@@ -37,6 +37,8 @@ typedef struct alts_shared_resource_dedicated {
   grpc_completion_queue* cq;
   grpc_pollset_set* interested_parties;
   grpc_cq_completion storage;
+  gpr_mu mu;
+  grpc_channel* channel;
 } alts_shared_resource_dedicated;
 
 /* This method returns the address of alts_shared_resource_dedicated
@@ -64,7 +66,8 @@ void grpc_alts_shared_resource_dedicated_init();
  * The API will be invoked by the caller in a lazy manner. That is,
  * it will get invoked when ALTS TSI handshake occurs for the first time.
  */
-void grpc_alts_shared_resource_dedicated_start();
+void grpc_alts_shared_resource_dedicated_start(
+    const char* handshaker_service_url);
 
 #endif /* GRPC_CORE_TSI_ALTS_HANDSHAKER_ALTS_SHARED_RESOURCE_H \
         */
diff --git a/src/core/tsi/alts/handshaker/alts_tsi_handshaker.cc b/src/core/tsi/alts/handshaker/alts_tsi_handshaker.cc
index 1639252883..1b7e58d3ce 100644
--- a/src/core/tsi/alts/handshaker/alts_tsi_handshaker.cc
+++ b/src/core/tsi/alts/handshaker/alts_tsi_handshaker.cc
@@ -39,9 +39,6 @@
 #include "src/core/tsi/alts/handshaker/alts_shared_resource.h"
 #include "src/core/tsi/alts/handshaker/alts_tsi_utils.h"
 #include "src/core/tsi/alts/zero_copy_frame_protector/alts_zero_copy_grpc_protector.h"
-#include "src/core/tsi/alts_transport_security.h"
-
-static alts_shared_resource* g_shared_resources = alts_get_shared_resource();
 
 /* Main struct for ALTS TSI handshaker. */
 struct alts_tsi_handshaker {
@@ -51,11 +48,11 @@ struct alts_tsi_handshaker {
   bool is_client;
   bool has_sent_start_message;
   bool has_created_handshaker_client;
-  bool use_dedicated_cq;
   char* handshaker_service_url;
   grpc_pollset_set* interested_parties;
   grpc_alts_credentials_options* options;
   alts_handshaker_client_vtable* client_vtable_for_testing;
+  grpc_channel* channel;
 };
 
 /* Main struct for ALTS TSI handshaker result. */
@@ -237,20 +234,6 @@ tsi_result alts_tsi_handshaker_result_create(grpc_gcp_handshaker_resp* resp,
   return TSI_OK;
 }
 
-static void init_shared_resources(const char* handshaker_service_url,
-                                  bool use_dedicated_cq) {
-  GPR_ASSERT(handshaker_service_url != nullptr);
-  gpr_mu_lock(&g_shared_resources->mu);
-  if (g_shared_resources->channel == nullptr) {
-    g_shared_resources->channel =
-        grpc_insecure_channel_create(handshaker_service_url, nullptr, nullptr);
-    if (use_dedicated_cq) {
-      grpc_alts_shared_resource_dedicated_start();
-    }
-  }
-  gpr_mu_unlock(&g_shared_resources->mu);
-}
-
 /* gRPC provided callback used when gRPC thread model is applied. */
 static void on_handshaker_service_resp_recv(void* arg, grpc_error* error) {
   alts_handshaker_client* client = static_cast<alts_handshaker_client*>(arg);
@@ -289,20 +272,24 @@ static tsi_result handshaker_next(
       reinterpret_cast<alts_tsi_handshaker*>(self);
   tsi_result ok = TSI_OK;
   if (!handshaker->has_created_handshaker_client) {
-    init_shared_resources(handshaker->handshaker_service_url,
-                          handshaker->use_dedicated_cq);
-    if (handshaker->use_dedicated_cq) {
+    if (handshaker->channel == nullptr) {
+      grpc_alts_shared_resource_dedicated_start(
+          handshaker->handshaker_service_url);
       handshaker->interested_parties =
           grpc_alts_get_shared_resource_dedicated()->interested_parties;
       GPR_ASSERT(handshaker->interested_parties != nullptr);
     }
-    grpc_iomgr_cb_func grpc_cb = handshaker->use_dedicated_cq
+    grpc_iomgr_cb_func grpc_cb = handshaker->channel == nullptr
                                      ? on_handshaker_service_resp_recv_dedicated
                                      : on_handshaker_service_resp_recv;
+    grpc_channel* channel =
+        handshaker->channel == nullptr
+            ? grpc_alts_get_shared_resource_dedicated()->channel
+            : handshaker->channel;
     handshaker->client = alts_grpc_handshaker_client_create(
-        handshaker, g_shared_resources->channel,
-        handshaker->handshaker_service_url, handshaker->interested_parties,
-        handshaker->options, handshaker->target_name, grpc_cb, cb, user_data,
+        handshaker, channel, handshaker->handshaker_service_url,
+        handshaker->interested_parties, handshaker->options,
+        handshaker->target_name, grpc_cb, cb, user_data,
         handshaker->client_vtable_for_testing, handshaker->is_client);
     if (handshaker->client == nullptr) {
       gpr_log(GPR_ERROR, "Failed to create ALTS handshaker client");
@@ -310,7 +297,7 @@ static tsi_result handshaker_next(
     }
     handshaker->has_created_handshaker_client = true;
   }
-  if (handshaker->use_dedicated_cq &&
+  if (handshaker->channel == nullptr &&
       handshaker->client_vtable_for_testing == nullptr) {
     GPR_ASSERT(grpc_cq_begin_op(grpc_alts_get_shared_resource_dedicated()->cq,
                                 handshaker->client));
@@ -371,6 +358,9 @@ static void handshaker_destroy(tsi_handshaker* self) {
   alts_handshaker_client_destroy(handshaker->client);
   grpc_slice_unref_internal(handshaker->target_name);
   grpc_alts_credentials_options_destroy(handshaker->options);
+  if (handshaker->channel != nullptr) {
+    grpc_channel_destroy(handshaker->channel);
+  }
   gpr_free(handshaker->handshaker_service_url);
   gpr_free(handshaker);
 }
@@ -407,7 +397,7 @@ tsi_result alts_tsi_handshaker_create(
   }
   alts_tsi_handshaker* handshaker =
       static_cast<alts_tsi_handshaker*>(gpr_zalloc(sizeof(*handshaker)));
-  handshaker->use_dedicated_cq = interested_parties == nullptr;
+  bool use_dedicated_cq = interested_parties == nullptr;
   handshaker->client = nullptr;
   handshaker->is_client = is_client;
   handshaker->has_sent_start_message = false;
@@ -418,9 +408,13 @@ tsi_result alts_tsi_handshaker_create(
   handshaker->has_created_handshaker_client = false;
   handshaker->handshaker_service_url = gpr_strdup(handshaker_service_url);
   handshaker->options = grpc_alts_credentials_options_copy(options);
-  handshaker->base.vtable = handshaker->use_dedicated_cq
-                                ? &handshaker_vtable_dedicated
-                                : &handshaker_vtable;
+  handshaker->base.vtable =
+      use_dedicated_cq ? &handshaker_vtable_dedicated : &handshaker_vtable;
+  handshaker->channel =
+      use_dedicated_cq
+          ? nullptr
+          : grpc_insecure_channel_create(handshaker->handshaker_service_url,
+                                         nullptr, nullptr);
   *self = &handshaker->base;
   return TSI_OK;
 }
diff --git a/src/core/tsi/alts/handshaker/alts_tsi_handshaker.h b/src/core/tsi/alts/handshaker/alts_tsi_handshaker.h
index c961eae498..32f94bc9d3 100644
--- a/src/core/tsi/alts/handshaker/alts_tsi_handshaker.h
+++ b/src/core/tsi/alts/handshaker/alts_tsi_handshaker.h
@@ -27,7 +27,6 @@
 #include "src/core/lib/security/credentials/alts/grpc_alts_credentials_options.h"
 #include "src/core/tsi/alts/handshaker/alts_handshaker_client.h"
 #include "src/core/tsi/alts/handshaker/alts_handshaker_service_api_util.h"
-#include "src/core/tsi/alts_transport_security.h"
 #include "src/core/tsi/transport_security.h"
 #include "src/core/tsi/transport_security_interface.h"
 
diff --git a/src/core/tsi/alts_transport_security.cc b/src/core/tsi/alts_transport_security.cc
deleted file mode 100644
index 5a1494ae5c..0000000000
--- a/src/core/tsi/alts_transport_security.cc
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
- *
- * Copyright 2017 gRPC authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- */
-
-#include <grpc/support/port_platform.h>
-
-#include <string.h>
-
-#include "src/core/tsi/alts_transport_security.h"
-
-static alts_shared_resource g_alts_resource;
-
-alts_shared_resource* alts_get_shared_resource(void) {
-  return &g_alts_resource;
-}
-
-void grpc_tsi_alts_init() {
-  g_alts_resource.channel = nullptr;
-  gpr_mu_init(&g_alts_resource.mu);
-}
-
-void grpc_tsi_alts_shutdown() {
-  if (g_alts_resource.channel != nullptr) {
-    grpc_channel_destroy(g_alts_resource.channel);
-  }
-  gpr_mu_destroy(&g_alts_resource.mu);
-}
diff --git a/src/core/tsi/alts_transport_security.h b/src/core/tsi/alts_transport_security.h
deleted file mode 100644
index f4319d10d2..0000000000
--- a/src/core/tsi/alts_transport_security.h
+++ /dev/null
@@ -1,38 +0,0 @@
-/*
- *
- * Copyright 2017 gRPC authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- */
-
-#ifndef GRPC_CORE_TSI_ALTS_TRANSPORT_SECURITY_H
-#define GRPC_CORE_TSI_ALTS_TRANSPORT_SECURITY_H
-
-#include <grpc/support/port_platform.h>
-
-#include <grpc/grpc.h>
-#include <grpc/support/sync.h>
-
-#include "src/core/lib/gprpp/thd.h"
-
-typedef struct alts_shared_resource {
-  grpc_channel* channel;
-  gpr_mu mu;
-} alts_shared_resource;
-
-/* This method returns the address of alts_shared_resource object shared by all
- *    TSI handshakes. */
-alts_shared_resource* alts_get_shared_resource(void);
-
-#endif /* GRPC_CORE_TSI_ALTS_TRANSPORT_SECURITY_H */
diff --git a/src/python/grpcio/grpc_core_dependencies.py b/src/python/grpcio/grpc_core_dependencies.py
index 42a4a7aa04..53cc0736af 100644
--- a/src/python/grpcio/grpc_core_dependencies.py
+++ b/src/python/grpcio/grpc_core_dependencies.py
@@ -334,7 +334,6 @@ CORE_SOURCE_FILES = [
     'src/core/ext/filters/client_channel/subchannel_index.cc',
     'src/core/ext/filters/deadline/deadline_filter.cc',
     'src/core/ext/filters/client_channel/health/health.pb.c',
-    'src/core/tsi/alts_transport_security.cc',
     'src/core/tsi/fake_transport_security.cc',
     'src/core/tsi/local_transport_security.cc',
     'src/core/tsi/ssl/session_cache/ssl_session_boringssl.cc',
diff --git a/tools/doxygen/Doxyfile.core.internal b/tools/doxygen/Doxyfile.core.internal
index 791318bf36..67b6cefa09 100644
--- a/tools/doxygen/Doxyfile.core.internal
+++ b/tools/doxygen/Doxyfile.core.internal
@@ -1527,8 +1527,6 @@ src/core/tsi/alts/zero_copy_frame_protector/alts_iovec_record_protocol.cc \
 src/core/tsi/alts/zero_copy_frame_protector/alts_iovec_record_protocol.h \
 src/core/tsi/alts/zero_copy_frame_protector/alts_zero_copy_grpc_protector.cc \
 src/core/tsi/alts/zero_copy_frame_protector/alts_zero_copy_grpc_protector.h \
-src/core/tsi/alts_transport_security.cc \
-src/core/tsi/alts_transport_security.h \
 src/core/tsi/fake_transport_security.cc \
 src/core/tsi/fake_transport_security.h \
 src/core/tsi/grpc_shadow_boringssl.h \
diff --git a/tools/run_tests/generated/sources_and_headers.json b/tools/run_tests/generated/sources_and_headers.json
index 47bc525f0d..27f15abbef 100644
--- a/tools/run_tests/generated/sources_and_headers.json
+++ b/tools/run_tests/generated/sources_and_headers.json
@@ -11111,7 +11111,6 @@
       "tsi_interface"
     ], 
     "headers": [
-      "src/core/tsi/alts_transport_security.h", 
       "src/core/tsi/fake_transport_security.h", 
       "src/core/tsi/local_transport_security.h", 
       "src/core/tsi/ssl/session_cache/ssl_session.h", 
@@ -11124,8 +11123,6 @@
     "language": "c", 
     "name": "tsi", 
     "src": [
-      "src/core/tsi/alts_transport_security.cc", 
-      "src/core/tsi/alts_transport_security.h", 
       "src/core/tsi/fake_transport_security.cc", 
       "src/core/tsi/fake_transport_security.h", 
       "src/core/tsi/local_transport_security.cc",