feat(gcp-auth): support 'none' option in GOOGLE_OTEL_AUTH_TARGET_SIGNALS by stankiewicz · Pull Request #2899 · open-telemetry/opentelemetry-java-contrib

stankiewicz · 2026-06-02T15:09:39Z

Description

This PR introduces a new none option for the GOOGLE_OTEL_AUTH_TARGET_SIGNALS environment variable (and google.otel.auth.target.signals system property) in the GCP Authentication Extension.

Previously, there was no explicit way to completely disable the extension if it was loaded. This change allows users to explicitly set the target signals to none, which:

Disables authentication (no authorization headers are added) for all signals.
Suppresses the warning logs (e.g., "GCP Authentication Extension is not configured for signal type...") that would otherwise appear when signals are not targeted, ensuring a silent and intentional disablement.

Documentation in README.md and ConfigurableOption Javadoc has been updated to reflect this new option.

Testing

Added a new parameterized test case in GcpAuthAutoConfigurationCustomizerProviderTest to verify that none correctly prevents modification of both traces and metrics exporters, and that warnings are suppressed.

linux-foundation-easycla · 2026-06-02T15:09:49Z

The committers listed above are authorized under a signed CLA.

✅ login: stankiewicz / name: Radek Stankiewicz (28dca2d, 564a917)

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates GCP auth auto-configuration to only treat signals as “targeted” when the OTLP endpoint is a Google Cloud Telemetry endpoint, and adjusts tests to match the new targeting behavior.

Changes:

Add endpoint-based eligibility check in isSignalTargeted (only telemetry.googleapis.com / telemetry.mtls.googleapis.com).
Refactor test cases to reuse a shared OTel properties map and update expected outcomes for non-Google endpoints.
Add/adjust parameterized test coverage for mixed/invalid configured target signals.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
`gcp-auth-extension/src/main/java/io/opentelemetry/contrib/gcp/auth/GcpAuthAutoConfigurationCustomizerProvider.java`	Adds endpoint gating so auth customization only applies when exporting to Google telemetry endpoints.
`gcp-auth-extension/src/test/java/io/opentelemetry/contrib/gcp/auth/GcpAuthAutoConfigurationCustomizerProviderTest.java`	Updates/extends test cases to reflect the new endpoint-based targeting behavior and reuses shared OTel properties.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

psx95

Hi @stankiewicz, thanks for the PR! Based on our discussions, I think adding a adding a none option in the existing GOOGLE_OTEL_AUTH_TARGET_SIGNALS property makes more sense and is less of a disruptive change for your particular use case.

stankiewicz · 2026-06-08T09:43:17Z

Hi @stankiewicz, thanks for the PR! Based on our discussions, I think adding a adding a none option in the existing GOOGLE_OTEL_AUTH_TARGET_SIGNALS property makes more sense and is less of a disruptive change for your particular use case.

done!

Eagerly loading GoogleCredentials.getApplicationDefault() inside the customize method throws a GoogleAuthException during OpenTelemetry SDK initialization if GCP Application Default Credentials are not configured, even if GCP authentication is disabled or not targeting GCP endpoints. This change defers the loading of credentials using a lazy Supplier so that they are only retrieved when a GCP-targeted signal is actually processed. Also restored the check in customizeResource to verify if any signal is targeted for GCP authentication before attempting to customize the resource, preventing ConfigurationException when GCP project ID is missing but GCP auth is disabled. Fixed Java 8 compatibility and static analysis (Error Prone, NullAway) warnings/errors.

psx95 · 2026-06-08T16:44:54Z

  }

  // Checks if the auth extension is configured to target the passed signal for authentication.
  private static boolean isSignalTargeted(String checkSignal, ConfigProperties configProperties) {


This entire thing could be simplified by updating isSignalTargeted to consider none:

private static boolean isSignalTargeted(String checkSignal, ConfigProperties configProperties) { String userSpecifiedTargetedSignals = ConfigurableOption.GOOGLE_OTEL_AUTH_TARGET_SIGNALS.getConfiguredValueWithFallback( configProperties, () -> SIGNAL_TYPE_ALL); List<String> targetedSignals = stream(userSpecifiedTargetedSignals.split(",")).map(String::trim).collect(toList()); if (targetedSignals.contains(SIGNAL_TYPE_NONE)) { return false; } return targetedSignals.contains(checkSignal) || targetedSignals.contains(SIGNAL_TYPE_ALL); }

Now, isSignalTargeted will return false if it finds none specified by the user. This would prevent adding the additional if statement in customize methods and eliminate the need for hasSignal method.

(Out of scope for this PR):
As a follow-up the signals that could actually be checked (METRICS, TRACES) or accepted by this method should be converted to specific enums and isSignalTargeted should be updated to something like:

private static boolean isSignalTargeted(TelemetryTarget checkTelemetryTarget, ConfigProperties configProperties) { ... }

psx95 · 2026-06-08T16:48:15Z

Update this to:

String[] params = {SIGNAL_TYPE_METRICS, SIGNAL_TYPE_NONE, SIGNAL_TARGET_WARNING_FIX_SUGGESTION}; ... "GCP Authentication Extension is not configured for signal type: {0} or is configured with signal type: {1}. {2}",

psx95 · 2026-06-08T16:56:38Z

+                .build()),
+        Arguments.of(
+            TargetSignalBehavior.builder()
+                .setConfiguredTargetSignals("none")


The extension allows setting up multiple signal types at once, add more test case with conflicting signal types like -

"metrics", "traces", "none"

"all", "none"

"metrics, none"

The expected behavior is that if the user sets none, every other signal type gets ignored.

psx95 · 2026-06-08T17:00:25Z

   *   <li>{@code metrics} - Enables authentication for metric exports.
   *   <li>{@code traces} - Enables authentication for trace exports.
   *   <li>{@code all} - Enables authentication for all exports.
+   *   <li>{@code none} - Disables authentication for all exports.


Document the behavior for none:

Disables authentication for all exports. If set alongside other signal types, it takes precedence and all other signal types will be ignored.

Also update README to reflect this behavior.

psx95

LGTM, pending one nit. Thanks for following up on the PR! 💯

psx95 · 2026-06-10T14:15:29Z

  comma-separated list of OpenTelemetry signals for which this authentication
  extension should be active.
-  Valid values are `metrics`, `traces`, and `all`.
+  Valid values are `metrics`, `traces`, `all`, and `none`.


nit: Add information about how none behaves here as well.

psx95 · 2026-06-11T16:57:05Z

Hold off on merging till the pending comment is addressed. GitHub does not allow revoking approval for some reason.

psx95 · 2026-06-12T14:05:47Z

Hold off on merging till the pending comment is addressed. GitHub does not allow revoking approval for some reason.

Ready to merge now.

stankiewicz requested a review from a team as a code owner June 2, 2026 15:09

Copilot AI review requested due to automatic review settings June 2, 2026 15:09

github-actions Bot requested review from jsuereth and psx95 June 2, 2026 15:10

Copilot AI reviewed Jun 2, 2026

View reviewed changes

jaydeluca added the component:gcp-auth-extension label Jun 2, 2026

stankiewicz requested a review from Copilot June 3, 2026 08:26

Copilot AI reviewed Jun 3, 2026

View reviewed changes

psx95 reviewed Jun 5, 2026

View reviewed changes

Implement none option for GOOGLE_OTEL_AUTH_TARGET_SIGNALS

5c751b0

stankiewicz force-pushed the gcp_auth branch from 564a917 to 5c751b0 Compare June 8, 2026 09:39

stankiewicz changed the title ~~Limit targeting of exporters in GCP Auth Extension to GCP endpoints~~ feat(gcp-auth): support 'none' option in GOOGLE_OTEL_AUTH_TARGET_SIGNALS Jun 8, 2026

psx95 suggested changes Jun 8, 2026

View reviewed changes

stankiewicz added 2 commits June 9, 2026 10:03

gcp-auth: refactor, add more tests

66e8019

spotless

f092f72

psx95 reviewed Jun 10, 2026

View reviewed changes

psx95 approved these changes Jun 11, 2026

View reviewed changes

psx95 self-requested a review June 11, 2026 16:47

update readme

3cac6b3

psx95 approved these changes Jun 12, 2026

View reviewed changes

jaydeluca approved these changes Jun 12, 2026

View reviewed changes

jaydeluca added this pull request to the merge queue Jun 12, 2026

Merged via the queue into open-telemetry:main with commit 6b0e5b4 Jun 12, 2026
22 checks passed

Uh oh!

Conversation

stankiewicz commented Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Testing

Uh oh!

linux-foundation-easycla Bot commented Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

psx95 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

stankiewicz commented Jun 8, 2026

Uh oh!

psx95 Jun 8, 2026

Choose a reason for hiding this comment

Uh oh!

psx95 Jun 8, 2026

Choose a reason for hiding this comment

Uh oh!

psx95 Jun 8, 2026

Choose a reason for hiding this comment

Uh oh!

psx95 Jun 8, 2026

Choose a reason for hiding this comment

Uh oh!

psx95 left a comment

Choose a reason for hiding this comment

Uh oh!

psx95 Jun 10, 2026

Choose a reason for hiding this comment

Uh oh!

psx95 commented Jun 11, 2026

Uh oh!

psx95 commented Jun 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

stankiewicz commented Jun 2, 2026 •

edited

Loading

linux-foundation-easycla Bot commented Jun 2, 2026 •

edited

Loading