Add ID token support to gcp-auth-extension

[tknhs]

Description:

Feature addition. gcp-auth-extension currently attaches an OAuth 2.0 access token from ADC, which works for Google Cloud endpoints like telemetry.googleapis.com but not for OTLP endpoints protected by Google IAM (e.g. a Collector running on Cloud Run, or behind IAP), which require a Google-signed OIDC ID token with a matching aud.

This adds two config options:

• GOOGLE_OTEL_AUTH_TOKEN_TYPE: access_token (default) or id_token
• GOOGLE_OTEL_AUTH_ID_TOKEN_AUDIENCE: audience for the ID token, required when id_token

For id_token, the extension wraps ADC in IdTokenCredentials for the given audience, and skips the quota-project header and the gcp.project_id resource attribute (both specific to the GCP APIs). Default behavior is unchanged, so this is backward compatible. This mirrors the token_type: id_token option of the Collector's googleclientauthextension.

Existing Issue(s):

#2996

Testing:

• Added unit tests covering the id_token path (audience present, HTTP/gRPC exporters, missing-audience and non-IdTokenProvider credential errors, unsupported token type).
• Existing tests pass unchanged, confirming backward compatibility.
• Also tested end-to-end against a Collector on Cloud Run over both HTTP and gRPC, including token refresh across the ~1h ID token expiry.

Documentation:

• Updated the module README with the two new options and when to use id_token (Cloud Run / IAP), including the audience semantics.

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: tknhs / name: tknhs (8492f46, dd415cb)

[Copilot]

Pull request overview

Adds support in gcp-auth-extension for authenticating OTLP exports with Google-signed OIDC ID tokens (for IAM-protected OTLP endpoints such as Cloud Run / IAP), while keeping the default access token behavior unchanged for Google Cloud APIs (e.g., telemetry.googleapis.com).

Changes:

• Introduces GOOGLE_OTEL_AUTH_TOKEN_TYPE (access_token default, or id_token) plus GOOGLE_OTEL_AUTH_ID_TOKEN_AUDIENCE for configuring ID token minting.
• Implements ID token credential wrapping via IdTokenCredentials and skips GCP-specific quota/project behaviors when in id_token mode.
• Adds unit tests for the new id_token configuration path and updates the module README.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
gcp-auth-extension/src/main/java/io/opentelemetry/contrib/gcp/auth/GcpAuthAutoConfigurationCustomizerProvider.java	Adds token-type selection, ID token credential wrapping, and conditional behavior for quota/project attributes.
gcp-auth-extension/src/main/java/io/opentelemetry/contrib/gcp/auth/ConfigurableOption.java	Adds the two new configuration options and documents their semantics.
gcp-auth-extension/src/test/java/io/opentelemetry/contrib/gcp/auth/GcpAuthAutoConfigurationCustomizerProviderTest.java	Adds unit tests for ID token behavior, missing/invalid config handling, and unsupported token type.
gcp-auth-extension/README.md	Documents the new environment variables and when to use ID tokens vs access tokens.