feat(gcp-auth-extension): Support custom credentials via configuration properties by keshavdandeva · Pull Request #2767 · open-telemetry/opentelemetry-java-contrib

keshavdandeva · 2026-04-17T15:32:15Z

feat(gcp-auth-extension): Support custom credentials via configuration properties

Description

Currently, gcp-auth-extension is hardcoded to use Application Default Credentials (ADC). This PR adds support for specifying custom Service Account credentials via configuration properties (file path or JSON string), while maintaining backward compatibility by falling back to ADC.

Key Changes

`gcp-auth-extension`

New Properties: Added google.cloud.credentials.path and google.cloud.credentials.json options in ConfigurableOption.java.
Lazy & Cached Resolution: Moved credentials resolution to be lazy and cached per ConfigProperties instance in GcpAuthAutoConfigurationCustomizerProvider.java to avoid redundant I/O.
Type-Safe Loading: Uses ServiceAccountCredentials.fromStream instead of the obsolete generic GoogleCredentials.fromStream to address security concerns.
Improved Error Handling: Distinguishes between a missing file (ConfigurationException) and a failure to create credentials (GoogleAuthException).
Tests: Added unit tests for file path, JSON string, precedence rules, missing files, and malformed JSON.
Docs: Updated Javadoc to clarify that both relative and absolute paths are supported, and to reflect the new capabilities.

Verification Results

Executed unit tests: ./gradlew :gcp-auth-extension:test -> BUILD SUCCESSFUL

…n properties

linux-foundation-easycla · 2026-04-17T15:32:23Z

The committers listed above are authorized under a signed CLA.

✅ login: Copilot / name: Copilot Autofix powered by AI (ef176b5)
✅ login: keshavdandeva / name: Keshav Dandeva (ef176b5, a25296c, a28b0be, a63594d, c5cafe2, d228216, e96eb35)

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds support for supplying Google Cloud credentials via configuration (file path or inline JSON) for the GCP auth extension, with tests covering the new resolution behavior.

Changes:

Add new configuration options for credentials file path and inline JSON.
Resolve credentials from config properties before falling back to Application Default Credentials.
Add unit tests validating credential loading and fallback behavior.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 8 comments.

File	Description
gcp-auth-extension/src/main/java/io/opentelemetry/contrib/gcp/auth/GcpAuthAutoConfigurationCustomizerProvider.java	Adds credential resolution from config properties (file/JSON) with ADC fallback.
gcp-auth-extension/src/main/java/io/opentelemetry/contrib/gcp/auth/ConfigurableOption.java	Introduces new configurable options for credentials path and JSON.
gcp-auth-extension/src/test/java/io/opentelemetry/contrib/gcp/auth/GcpAuthAutoConfigurationCustomizerProviderTest.java	Adds tests for credentials loading from file path/JSON and ADC fallback.

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds configuration-driven credential loading to gcp-auth-extension, allowing users to supply Google Cloud credentials via file path or raw JSON while preserving ADC fallback behavior.

Changes:

Added new configuration options for credentials path and credentials JSON.
Implemented lazy, prioritized credential resolution (path → JSON → ADC) with caching.
Added unit tests covering custom credential sources and fallback behavior.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
gcp-auth-extension/src/main/java/io/opentelemetry/contrib/gcp/auth/ConfigurableOption.java	Adds new configuration enum entries for credentials path/JSON.
gcp-auth-extension/src/main/java/io/opentelemetry/contrib/gcp/auth/GcpAuthAutoConfigurationCustomizerProvider.java	Adds lazy credential resolution with a small cache and a defined precedence chain.
gcp-auth-extension/src/test/java/io/opentelemetry/contrib/gcp/auth/GcpAuthAutoConfigurationCustomizerProviderTest.java	Adds tests for credentials loading from path/JSON and ADC fallback.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

jaydeluca · 2026-04-22T10:16:05Z

@keshavdandeva are you able to sign the CLA?

keshavdandeva · 2026-04-22T13:52:52Z

@keshavdandeva are you able to sign the CLA?

Yes, done

psx95 · 2026-05-04T20:47:00Z

+   * `google.cloud.credentials.json`.
+   */
+  GOOGLE_CLOUD_CREDENTIALS_JSON("Google Cloud Credentials JSON String");



To improve clarity, the documentation should indicate if the path should be relative or absolute.
Current documentation comments simply state - "Represents the Google Cloud Credentials Path option", but does not explain what these options are.

Updated the comments

psx95 · 2026-05-04T21:00:41Z


  private static final Logger logger =
      Logger.getLogger(GcpAuthAutoConfigurationCustomizerProvider.class.getName());
+  private static final Map<ConfigProperties, GoogleCredentials> credentialsCache =


Does this need to be a map? The map implicates that there could be multiple GoogleCredentials object for authenticating to the same backend.

IIUC, the same configProperties are used, so the Map will only ever have a single entry.

You are correct that within a single auto-configuration pass, the same ConfigProperties instance is shared, so the map will indeed only have a single entry.

I used a map (specifically a WeakHashMap) to defensively support scenarios where multiple SDK instances might be created in the same JVM or sequential unit tests with different configurations, ensuring they don't conflict.

However, if you disagree and prefer to simplify it to a single cached instance, I am happy to change it back

psx95 · 2026-05-04T21:33:58Z

+    }
+  }
+
+  private static GoogleCredentials loadCredentials(ConfigProperties props) {


Nit: Rename props to configProperties to maintain consistency.

psx95 · 2026-05-04T21:38:08Z

+        ConfigurableOption.GOOGLE_CLOUD_CREDENTIALS_PATH.getConfiguredValueAsOptional(props);
+    if (credsPath.isPresent()) {
+      try (FileInputStream fis = new FileInputStream(credsPath.get())) {
+        return GoogleCredentials.fromStream(fis);


This method is marked as obsolete citing potential security risk.

See google-auth-library-java.

Thanks for the pointer. I have removed the use of GoogleCredentials.fromStream and switched to ServiceAccountCredentials.fromStream for now, as service accounts might be fine for our use case.

However, I'm wondering how we should ideally support other credential types (like external accounts or user credentials) in the future without re-implementing the auto-detection logic of the obsolete method. Do you have a recommendation on whether we should stick to Service Accounts for these properties, or if we should implement a custom detector to route to other specific load methods?

psx95 · 2026-05-04T21:44:07Z

+          new ByteArrayInputStream(credsJson.get().getBytes(StandardCharsets.UTF_8))) {
+        return GoogleCredentials.fromStream(bais);
+      } catch (IOException e) {
+        throw new ConfigurationException("Failed to load credentials from JSON string", e);


Since this error would be generated from the line GoogleCredentials.fromStream - I would think to wrap this and throw a GoogleAuthException instead.

You can add a new Reason: FAILED_CREDENTIAL_CREATION and then re-use it in above case as well.

psx95 · 2026-05-04T21:45:55Z

+      try (FileInputStream fis = new FileInputStream(credsPath.get())) {
+        return GoogleCredentials.fromStream(fis);
+      } catch (IOException e) {
+        throw new ConfigurationException(
+            "Failed to load credentials from file: " + new File(credsPath.get()).getName(), e);
+      }


This handling should distinguish between 2 different scenarios:

credsPath is invalid/wrong: ConfigurationException.

Unable to create GoogleCredentials from a valid credsPath: GoogleAuthException.

psx95 · 2026-05-05T00:04:27Z


+  @Test
+  void testCredentialsLoadedFromFilePath() throws IOException {
+    File tempFile = File.createTempFile("gcp-creds", ".json");


WDYT about adding a dummy creds file in test/resources.
The file could contain valid looking fields to see if GoogleCredentials can be actually parsed from it.

I looked into adding a dummy file, but generating a valid private key structure without real keys proved to be complicated and prone to JSON parsing issues. I think the existing unit tests with mocks are sufficient to verify the logic, but I can try to add it if you insist.

psx95 · 2026-05-05T00:17:28Z

There could also be tests that exercise the case where either the file (JSON/Creds) is not found or the content in the file is malformed/invalid.

feat(gcp-auth-extension): Support custom credentials via configuratio…

a28b0be

…n properties

Copilot AI review requested due to automatic review settings April 17, 2026 15:32

keshavdandeva requested a review from a team as a code owner April 17, 2026 15:32

github-actions Bot requested review from jsuereth and psx95 April 17, 2026 15:35

keshavdandeva marked this pull request as draft April 17, 2026 15:36

Copilot AI reviewed Apr 17, 2026

View reviewed changes

Copilot started reviewing on behalf of keshavdandeva April 17, 2026 15:54 View session

chore: refactor based on pr review

a25296c

keshavdandeva requested a review from Copilot April 17, 2026 15:57

Copilot AI reviewed Apr 17, 2026

View reviewed changes

Potential fix for pull request finding

ef176b5

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot started reviewing on behalf of keshavdandeva April 17, 2026 16:29 View session

keshavdandeva marked this pull request as ready for review April 20, 2026 12:46

SylvainJuge added the component:gcp-auth-extension label Apr 29, 2026

psx95 suggested changes May 5, 2026

View reviewed changes

chore: address pr feedback

c5cafe2

keshavdandeva requested a review from psx95 May 7, 2026 14:13

keshavdandeva added 3 commits May 7, 2026 14:16

chore: run spotless

d228216

chore: add scope for SA

e96eb35

chore: run spotless

a63594d

Conversation

keshavdandeva commented Apr 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

feat(gcp-auth-extension): Support custom credentials via configuration properties

Description

Key Changes

gcp-auth-extension

Verification Results

Uh oh!

linux-foundation-easycla Bot commented Apr 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jaydeluca commented Apr 22, 2026

Uh oh!

keshavdandeva commented Apr 22, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

keshavdandeva commented Apr 17, 2026 •

edited

Loading

`gcp-auth-extension`

linux-foundation-easycla Bot commented Apr 17, 2026 •

edited

Loading