out_stackdriver: Fix service account regression

[cosmo0920]

Confirmed the v5.0.0 cause: the legacy OAuth2 constructor leaves authentication disabled. Fix 95824885d is already in this checkout; removing it makes the new regression test fail.

Added coverage for JWT-bearer authentication, both credential sources, config precedence, and metadata bypass. Your real key passed both authentication paths; logs went only to a local receiver.

Valgrind also exposed a shutdown use-after-free. Fixed theOAuth2 cleanup order: flb_oauth2.c: line 1286.

Verification: build and focused C tests passed. Both integration suites passed normally and under strict Valgrind—4 tests each, with no memory errors.

Exact integration commands run:

STACKDRIVER_TEST_CREDENTIALS="$PWD/gen-lang-client-0818063289-bd890c05a0ab.json" tests/integration/.venv/bin/python -m pytest tests/integration/scenarios/out_stackdriver -q
STACKDRIVER_TEST_CREDENTIALS="$PWD/gen-lang-client-0818063289-bd890c05a0ab.json" VALGRIND=1 VALGRIND_STRICT=1 tests/integration/.venv/bin/python -m pytest tests/integration/scenarios/out_stackdriver -q
tests/integration/.venv/bin/python -m pytest tests/integration/scenarios/out_http/tests/test_out_http_001.py -k oauth2 -q
VALGRIND=1 VALGRIND_STRICT=1 tests/integration/.venv/bin/python -m pytest tests/integration/scenarios/out_http/tests/test_out_http_001.py -k oauth2 -q

Related to #11619.

---

Enter [N/A] in the box, if an item is not applicable to your change.

Testing
Before we can approve your change; please submit the following in a comment:

• Example configuration file for the change
• Debug log output from testing the change

• Attached Valgrind output that shows no leaks or memory corruption was found

If this is a change to packaging of containers or native binaries then please confirm it works for all targets.

• Run local packaging test showing all targets (including any new ones) build.
• Set ok-package-test label to test for all targets (requires maintainer to do).

Documentation

• Documentation required for this feature

Backporting

• Backport to latest stable release.

---

Fluent Bit is licensed under Apache 2.0, by submitting this pull request I understand that this code will be released under the terms of that license.

Summary by CodeRabbit

• Bug Fixes

  • Improved connection cleanup ordering to help prevent issues when releasing TLS-enabled connections.

• Tests

  • Expanded OAuth2 coverage for client-credentials and JWT-bearer authentication flows.
  • Added optional Stackdriver integration coverage for service-account authentication, including configuration precedence and avoidance of unnecessary metadata-server requests.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-18T06:49:31.325742Z	68a1d9f	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 19ac419f-01df-4d50-b7fc-e0716e2b2495

📥 Commits

Reviewing files that changed from the base of the PR and between 64d2dd8 and 68a1d9f.

📒 Files selected for processing (3)

• src/flb_oauth2.c
• tests/integration/scenarios/out_stackdriver/tests/test_service_account.py
• tests/internal/oauth2.c

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

The change reverses OAuth teardown order and adds coverage for JWT-bearer and client-credentials flows. It also adds an opt-in Stackdriver integration test for service-account credentials from configuration and environment sources.

Changes

OAuth lifecycle and credential flows

Layer / File(s)	Summary
OAuth teardown ordering src/flb_oauth2.c	The upstream connection context is destroyed before the TLS context.
Legacy OAuth flow test coverage tests/internal/oauth2.c	The manual-payload test helper now covers client-credentials and JWT-bearer grants. The JWT-bearer test is added to the test registry.
Stackdriver service-account exchange test tests/integration/scenarios/out_stackdriver/tests/test_service_account.py	An opt-in parameterized test verifies configuration and environment credentials, authenticated logging, and no metadata-server request.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~12 minutes

Change: Bug fix

Suggested reviewers: edsiper

Merge Risk: ⚪ Minimal · up to 68a1d

The OAuth cleanup ordering and credential-flow coverage changes have no identified merge-blocking risk.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 11 functions across 3 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the primary change: fixing the service account authentication regression in out_stackdriver. The OAuth2 cleanup and added tests are supporting changes.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 68a1d9fb2a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".