Header matchers received as part of RouteConfiguration are processed at the xdsClient and the update is sent to the xdsResolver. One of the supported header matcher types is a regex matcher, which needs to be compiled using a call to regexp.Compile() before it can be used. This call to regexp.Compile() can fail. See: https://github.com/grpc/grpc-go/blob/master/xds/internal/resolver/matcher.go#L57
This check is better performed at the xdsClient layer so that if the call to regexp.Compile fails, the xdsClient can reject the resource and NACK it.