Add ID token support to gcp-auth-extension - #2999
Conversation
There was a problem hiding this comment.
Pull request overview
Adds support in gcp-auth-extension for authenticating OTLP exports with Google-signed OIDC ID tokens (for IAM-protected OTLP endpoints such as Cloud Run / IAP), while keeping the default access token behavior unchanged for Google Cloud APIs (e.g., telemetry.googleapis.com).
Changes:
- Introduces
GOOGLE_OTEL_AUTH_TOKEN_TYPE(access_tokendefault, orid_token) plusGOOGLE_OTEL_AUTH_ID_TOKEN_AUDIENCEfor configuring ID token minting. - Implements ID token credential wrapping via
IdTokenCredentialsand skips GCP-specific quota/project behaviors when inid_tokenmode. - Adds unit tests for the new
id_tokenconfiguration path and updates the module README.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| gcp-auth-extension/src/main/java/io/opentelemetry/contrib/gcp/auth/GcpAuthAutoConfigurationCustomizerProvider.java | Adds token-type selection, ID token credential wrapping, and conditional behavior for quota/project attributes. |
| gcp-auth-extension/src/main/java/io/opentelemetry/contrib/gcp/auth/ConfigurableOption.java | Adds the two new configuration options and documents their semantics. |
| gcp-auth-extension/src/test/java/io/opentelemetry/contrib/gcp/auth/GcpAuthAutoConfigurationCustomizerProviderTest.java | Adds unit tests for ID token behavior, missing/invalid config handling, and unsupported token type. |
| gcp-auth-extension/README.md | Documents the new environment variables and when to use ID tokens vs access tokens. |
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
| } | ||
| return IdTokenCredentials.newBuilder() | ||
| .setIdTokenProvider((IdTokenProvider) applicationDefaultCredentials) | ||
| .setTargetAudience(audience) |
There was a problem hiding this comment.
I think for impersonated credentials, you would also need to set
.setOptions(asList(IdTokenProvider.Option.INCLUDE_EMAIL))From Authenticate with a service account OIDC token, the note mentions
Note: The generated ID token must have an email claim for IAP to accept it.
The PR description mentions that this was tested with Cloud Run - just to confirm, was the OTel Collector running in Cloud Run behind an IAP service?
Based on my testing this seems required.
| `GOOGLE_CLOUD_PROJECT` option is not required and the `gcp.project_id` | ||
| resource attribute is not added. | ||
|
|
||
| The value names are consistent with the `token_type` option of the |
There was a problem hiding this comment.
nit: IMO, a better position for this text would be either after the third bullet point or at the very beginning after the text: "Valid values are ..."
| * href="https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/extension/googleclientauthextension">Google | ||
| * Client Auth Extension for the OpenTelemetry Collector</a>. | ||
| */ | ||
| GOOGLE_OTEL_AUTH_TOKEN_TYPE("Token Type for Google Authentication Extension"), |
There was a problem hiding this comment.
Nit: Rename this to GOOGLE_AUTH_TOKEN_TYPE.
Rationale: Auth being configured here is not specific to OpenTelemetry.
| * <p>For Cloud Run, this is the URL of the receiving service or one of its configured custom | ||
| * audiences. For Identity-Aware Proxy, this is the OAuth 2.0 client ID. | ||
| */ | ||
| GOOGLE_OTEL_AUTH_ID_TOKEN_AUDIENCE("Google ID Token Audience"); |
There was a problem hiding this comment.
Nit: Rename this to GOOGLE_AUTH_ID_TOKEN_AUDIENCE
Rationale: Auth being configured here is not specific to OpenTelemetry.
|
Hi @tknhs, thanks for the PR! |
Description:
Feature addition.
gcp-auth-extensioncurrently attaches an OAuth 2.0 access token from ADC, which works for Google Cloud endpoints liketelemetry.googleapis.combut not for OTLP endpoints protected by Google IAM (e.g. a Collector running on Cloud Run, or behind IAP), which require a Google-signed OIDC ID token with a matchingaud.This adds two config options:
GOOGLE_OTEL_AUTH_TOKEN_TYPE:access_token(default) orid_tokenGOOGLE_OTEL_AUTH_ID_TOKEN_AUDIENCE: audience for the ID token, required whenid_tokenFor
id_token, the extension wraps ADC inIdTokenCredentialsfor the given audience, and skips the quota-project header and thegcp.project_idresource attribute (both specific to the GCP APIs). Default behavior is unchanged, so this is backward compatible. This mirrors thetoken_type: id_tokenoption of the Collector'sgoogleclientauthextension.Existing Issue(s):
#2996
Testing:
id_tokenpath (audience present, HTTP/gRPC exporters, missing-audience and non-IdTokenProvider credential errors, unsupported token type).Documentation:
id_token(Cloud Run / IAP), including the audience semantics.