feat: Add otelcol.auth.google client auth provider

[dashpole]

Brief description of Pull Request

Add the opentelemetry collector's googleclientauthextension as otelcol.auth.google.

Issue(s) fixed by this Pull Request

Fixes #5368

PR Checklist

• Documentation added
• Tests updated
• Config converters updated

[CLAassistant]

All committers have signed the CLA.

[dashpole]

cc @kalleep

[dashpole]

I'm running into an issue I can't figure out how to solve, and could use some help. I need the google client auth to be started before the OTLP exporter, but I can't seem to figure out how to make that happen. I'm trying this configuration:

tracing {
	// Sample all traces. This value should be lower for production configs!
	sampling_fraction = 1

	write_to = [otelcol.exporter.otlphttp.google.input]
}

otelcol.exporter.otlphttp "google" {
	client {
		endpoint = "telemetry.googleapis.com"
		auth     = otelcol.auth.google.creds.handler
	}
}

otelcol.auth.google "creds" {
	project = "dashpole-dev"
}

I added a panic when the auth extension successfully starts:

ts=2026-02-18T18:44:52.791487865Z level=info boringcrypto_enabled=false
ts=2026-02-18T18:44:52.780691855Z level=info source=/go/pkg/mod/github.com/!kim!machine!gun/automemlimit@v0.7.4/memlimit/memlimit.go:175 msg="memory is not limited, skipping" package=github.com/KimMachineGun/automemlimit/memlimit
ts=2026-02-18T18:44:52.791586579Z level=info msg="no peer discovery configured: both join and discover peers are empty" service=cluster
ts=2026-02-18T18:44:52.791607459Z level=info msg="running usage stats reporter"
ts=2026-02-18T18:44:52.791613605Z level=info msg="starting complete graph evaluation" controller_path=/ controller_id="" trace_id=380a7d5da35b56f60406d43ae83901c8
ts=2026-02-18T18:44:52.791638958Z level=info msg="finished node evaluation" controller_path=/ controller_id="" trace_id=380a7d5da35b56f60406d43ae83901c8 node_id=otel duration=1.962µs
ts=2026-02-18T18:44:52.791649155Z level=info msg="finished node evaluation" controller_path=/ controller_id="" trace_id=380a7d5da35b56f60406d43ae83901c8 node_id=livedebugging duration=12.675µs
ts=2026-02-18T18:44:52.791657281Z level=info msg="finished node evaluation" controller_path=/ controller_id="" trace_id=380a7d5da35b56f60406d43ae83901c8 node_id=otelcol.auth.google.creds duration=163.457µs
ts=2026-02-18T18:44:52.791665418Z level=info msg="finished node evaluation" controller_path=/ controller_id="" trace_id=380a7d5da35b56f60406d43ae83901c8 node_id=otelcol.exporter.otlphttp.google duration=495.142µs
ts=2026-02-18T18:44:52.791673476Z level=info msg="finished node evaluation" controller_path=/ controller_id="" trace_id=380a7d5da35b56f60406d43ae83901c8 node_id=tracing duration=46.786µs
ts=2026-02-18T18:44:52.791685121Z level=info msg="finished node evaluation" controller_path=/ controller_id="" trace_id=380a7d5da35b56f60406d43ae83901c8 node_id=logging duration=213.354µs
ts=2026-02-18T18:44:52.791717352Z level=info msg="finished node evaluation" controller_path=/ controller_id="" trace_id=380a7d5da35b56f60406d43ae83901c8 node_id=labelstore duration=8.737µs
ts=2026-02-18T18:44:52.791800016Z level=info msg="finished node evaluation" controller_path=/ controller_id="" trace_id=380a7d5da35b56f60406d43ae83901c8 node_id=remotecfg duration=61.797µs
ts=2026-02-18T18:44:52.791827759Z level=info msg="applying non-TLS config to HTTP server" service=http
ts=2026-02-18T18:44:52.791836121Z level=info msg="finished node evaluation" controller_path=/ controller_id="" trace_id=380a7d5da35b56f60406d43ae83901c8 node_id=http duration=17.242µs
ts=2026-02-18T18:44:52.791850006Z level=info msg="finished node evaluation" controller_path=/ controller_id="" trace_id=380a7d5da35b56f60406d43ae83901c8 node_id=ui duration=2.636µs
ts=2026-02-18T18:44:52.791865438Z level=info msg="finished node evaluation" controller_path=/ controller_id="" trace_id=380a7d5da35b56f60406d43ae83901c8 node_id=cluster duration=3.927µs
ts=2026-02-18T18:44:52.791875398Z level=info msg="finished complete graph evaluation" controller_path=/ controller_id="" trace_id=380a7d5da35b56f60406d43ae83901c8 duration=1.339045ms
ts=2026-02-18T18:44:52.79193023Z level=debug msg="changing node state" service=cluster from=viewer to=participant
ts=2026-02-18T18:44:52.791994442Z level=info msg="scheduling loaded components and services"
ts=2026-02-18T18:44:52.792273761Z level=error msg="failed to start scheduled component" component_path=/ component_id=otelcol.exporter.otlphttp.google err="not started"
ts=2026-02-18T18:44:52.792291686Z level=debug msg="finished node evaluation" controller_path=/ controller_id="" node_id=tracing duration=138.264µs
ts=2026-02-18T18:44:52.792321074Z level=info msg="starting cluster node" service=cluster peers_count=0 peers="" advertise_addr=127.0.0.1:12345 minimum_cluster_size=0 minimum_size_wait_timeout=0s
ts=2026-02-18T18:44:52.792314184Z level=error msg="failed to start scheduled component" component_path=/ component_id=otelcol.exporter.otlphttp.google err="not started"
ts=2026-02-18T18:44:52.792371835Z level=info msg="failed to register collector with remote server" service=remotecfg id=8c8cdab3-5d7b-4e81-8224-6b7ac8c31487 name="" err="noop client"
ts=2026-02-18T18:44:52.792393695Z level=error msg="failed to start scheduled component" component_path=/ component_id=otelcol.exporter.otlphttp.google err="not started"
ts=2026-02-18T18:44:52.79245562Z level=info msg="peers changed" service=cluster peers_count=1 min_cluster_size=0 peers=452a81310b8b
ts=2026-02-18T18:44:52.792480855Z level=error msg="node exited with error" node=otelcol.exporter.otlphttp.google err="no components started successfully: not started; not started; not started"
ts=2026-02-18T18:44:52.792275092Z level=debug msg="finished node evaluation" controller_path=/ controller_id="" node_id=otelcol.exporter.otlphttp.google duration=160.248µs
panic: GOT TOKEN

As you can see, the otelcol.exporter.otlphttp.google component attempts to start 3 times before giving up, and only then is the auth extension started.

[dashpole]

Test failures seem unrelated to this PR. I still haven't been able to figure out #5526 (comment)

[kalleep]

Test failures seem unrelated to this PR

Yeah seems like a flaky test.

I still haven't been able to figure out #5526 (comment)

Yes this is a known problem in alloy, I have #5613 up to fix both order on startup and shutdown.

But I am not entirely sure this would solve your problem either because start would run in it's own gorutine, and looking at it I am pretty sure this is a problem for other auth extentions as well, need to think a bit about this.

[dashpole]

Sounds good. I'll do some testing on top of #5613 if I have time.

[dashpole]

I tested this on top of your patch, and verified that it mostly fixes the issue.

The only remaining issue seems to be that components are started in parallel, so it can sometimes still race at startup. I implemented a workaround in 778b653, but I suspect there is probably a better way to do that.

[kalleep]

The only remaining issue seems to be that components are started in parallel, so it can sometimes still race at startup. I implemented a workaround in 778b653, but I suspect there is probably a better way to do that.

Just took a quick look at the code managing auth extensions and we do re-recreate the component on each update call, but will delay Start until Run is triggered and that's where the race happens.

Maybe we need to do some kind of workaround like the one you added for all auth extentions, e.g. trigger Start on update instead of Run. This also only seems to be a problem when alloy start the first time and not if config is reloaded.

I will set aside some time today and experiment a bit with the wrapper auth component and make sure this is correct for other auth extentions we have.

[kalleep]

I am working on updating our otel dependencies and with the update I hit issues around scheduling. So made the fix in that pr. So when that one is merged and scheduling ordering it should work as expected

[kalleep]

We have now merged both prs. So if you could rebase on main it should work now, do you follow the same release schedule as upstream otel, if so you should add v0.147.0 to alloy :)

[dashpole]

Excellent. I'll rebase in the next day or two.

[dashpole]

rebased, and removed the workaround for auth startup ordering.

[kalleep]

LGTM, you just have to format one of the files. We have a code freeze during release but I expect that to be removed within a day or two. So onece the file is correctly formated and a new Alloy version is release I will merge this pr

[kalleep]

I pushed a commit with the format fix

[kalleep]

Great work. This took a bit more time than anticipated, thanks for your patience!