feat(bigquery-jdbc): implement custom OTel SpanExporter credentials injector and authentication bypass

[keshavdandeva]

b/516416076

This PR introduces a custom credentials resolver and authentication injector in the JDBC driver's OpenTelemetry engine (BigQueryJdbcOpenTelemetry.java).

The Problem

Previously, the Google Cloud OpenTelemetry exporter relied on the official opentelemetry-gcp-auth-extension to authenticate tracing exports. However, that extension only supports Application Default Credentials (ADC) out-of-the-box. If a client wanted to configure explicit Service Account credentials (via a raw JSON string or a specific credentials file path) using the driver's gcpTelemetryCredentials property, the exporter was unable to authenticate, preventing tracing egress in custom deployment sandboxes.

The Solution

We bypassed the official GCP auth extension's auto-configuration entirely for custom credentials. Instead, we implemented our own custom authentication injection pipeline:

1. Credentials Resolution: Dynamically parses and instantiates Google Credentials from either a raw Service Account JSON string or a local file path using our core oauth utility:
2. OTEL Exporter Customizer Interception: Utilizes OTel's addSpanExporterCustomizer block to intercept the instantiated span exporters at startup:
   • We inspect if the active exporter is an HTTP (OtlpHttpSpanExporter) or gRPC (OtlpGrpcSpanExporter) transport engine.
   • We programmatically extract the raw OAuth2 Access Token/Refresh Token headers by calling credentials.getRequestMetadata(...) against the OTLP endpoint (https://telemetry.googleapis.com:443).
   • We dynamically inject these authorization headers directly into the OTel exporter's builder header supplier:

This custom-header injection bypasses the gcp-auth-extension entirely, unlocking full OTel E2E tracing support under custom Service Accounts for all JDBC clients.

[gemini-code-assist]

Code Review

This pull request implements custom credential injection for OpenTelemetry OTLP exporters within the BigQuery JDBC driver, enabling authenticated trace exports via both HTTP and gRPC. The changes introduce a utility to extract authentication headers from credentials and update the OpenTelemetry SDK configuration to use a span exporter customizer. Review feedback points out that the newly added integration tests are currently empty placeholders and should be fully implemented. Additionally, it is recommended to handle exceptions more gracefully during header retrieval to avoid crashing background exporter threads and to refactor the SDK builder logic to reduce code duplication.

[gemini-code-assist]

The newly added test methods are empty and only contain comments describing the test goals. These tests should be implemented to verify the custom credentials injection and authentication bypass logic introduced in this PR. Submitting a feature without functional tests is discouraged as it increases the risk of regressions. If the implementation is not ready, consider removing these placeholder comments to avoid stale documentation.

References

1. Remove comments that refer to stale implementations instead of updating them.

[gemini-code-assist]

Throwing a RuntimeException inside the header supplier may cause the background exporter thread to terminate unexpectedly if an error occurs during credential metadata retrieval (e.g., a network failure during token refresh). It is generally safer to log the error and return an empty map, allowing the exporter to handle the failure through standard OTLP response codes (like 401 Unauthorized) rather than crashing the thread.

[gemini-code-assist]

The AutoConfiguredOpenTelemetrySdk builder logic is duplicated between the if and else blocks. This can be refactored to use a single builder chain, which improves maintainability and reduces code duplication. When refactoring, ensure that any null checks or validation steps are not redundant with preceding logic.

          final Credentials finalCreds = credentials;
          AutoConfiguredOpenTelemetrySdk autoConfigured =
              AutoConfiguredOpenTelemetrySdk.builder()
                  .addPropertiesSupplier(() -> props)
                  .addSpanExporterCustomizer(
                      (spanExporter, configProperties) -> {
                        if (finalCreds != null) {
                          if (spanExporter instanceof OtlpHttpSpanExporter) {
                            return ((OtlpHttpSpanExporter) spanExporter)
                                .toBuilder().setHeaders(() -> getAuthHeaders(finalCreds)).build();
                          }
                          if (spanExporter instanceof OtlpGrpcSpanExporter) {
                            return ((OtlpGrpcSpanExporter) spanExporter)
                                .toBuilder().setHeaders(() -> getAuthHeaders(finalCreds)).build();
                          }
                        }
                        return spanExporter;
                      })
                  .build();

References

1. When implementing property parsing or validation logic, ensure that null checks and validation steps are not redundant with checks already performed by upstream callers or preceding logic in the same method.