out_stackdriver: add trust_payload_local_resource_id option

[erain]

Summary

Adds a trust_payload_local_resource_id option (default: true, existing behavior unchanged) to the Stackdriver output.

The plugin reads logging.googleapis.com/local_resource_id from the log payload to derive the k8s_container / k8s_pod / k8s_node monitored-resource labels. In multi-tenant pipelines the payload is workload-controlled: a compromised or malicious workload can forge this field and attribute its log entries to another namespace/pod/container across trust boundaries (log-injection/forgery). The Go-based logging agent addressed the same issue in GoogleCloudPlatform/k8s-stackdriver#1186.

With trust_payload_local_resource_id false:

• the payload local_resource_id is ignored; resource labels are derived only from trusted sources — the tag (tag_prefix + regex), configured resource_labels, or a payload monitored-resource map;
• when none of those sources is available, entries fall back to the cluster-scoped k8s_cluster resource (project/location/cluster labels from plugin config) rather than packing workload-scoped labels forged from the payload.

This is defense-in-depth for pipelines that currently trust the payload value; pipelines where the tag regex always resolves (e.g. standard tail + kubernetes setups) see no behavioral difference other than the forged value being ignored.

Note: #12023 (the multi-worker data-race fix this change was based on) has merged. This PR is now rebased onto current master and contains only the two trust_payload_local_resource_id commits.

Testing

• New runtime tests:
  • resource_k8s_container_untrusted: payload-supplied local_resource_id with a non-matching tag falls back to k8s_cluster with no workload labels.
  • resource_k8s_container_untrusted_tag_wins: a tag matching the default regex still resolves the full k8s_container resource; the untrusted payload value is ignored.
• ctest -R flb-rt-out_stackdriver passes (full suite, including the multi-worker concurrency test).
• Valgrind memcheck on the new tests: 0 errors, no leaks.

Documentation

• Docs PR for the new config option to follow in fluent/fluent-bit-docs once the option name/semantics are settled in review.

Backporting

• [N/A] New optional feature, no backport needed.

---

Fluent Bit is licensed under Apache 2.0, by submitting this pull request I understand that this code will be released under the terms of that license.

Summary by CodeRabbit

• New Features

  • Added an option to control whether resource identifiers supplied in log payloads are trusted.
  • Untrusted identifiers now fall back to cluster-level resource attribution when trusted resource details are unavailable.
  • Trusted tag-based resource information takes precedence over untrusted payload data.

• Bug Fixes

  • Prevented forged payload metadata from generating misleading namespace, pod, or container labels.

• Tests

  • Added coverage for untrusted payload identifiers and trusted tag overrides.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds configurable trust handling for Stackdriver payload local_resource_id, with cluster-scoped fallback when trusted resource labels are unavailable. Updates resource label generation and adds runtime tests for untrusted payloads and trusted tags.

Changes

Stackdriver resource attribution

Layer / File(s)	Summary
Trust configuration and payload inspection plugins/out_stackdriver/stackdriver.h, plugins/out_stackdriver/stackdriver.c	Adds the trust_payload_local_resource_id setting, detects monitored-resource labels, and gates payload identifier and label extraction.
Computed resource attribution plugins/out_stackdriver/stackdriver.c	Computes resource_type, falls back to k8s_cluster when trusted labels are unavailable, and uses the result for resource labels.
Runtime validation of trust behavior tests/runtime/out_stackdriver.c	Tests cluster fallback for untrusted payload identifiers and tag-based precedence over untrusted payload data.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant LogPayload
  participant Formatter as stackdriver_format()
  participant StackdriverEntry
  LogPayload->>Formatter: Provides local_resource_id and monitored-resource data
  Formatter->>Formatter: Selects configured resource_type or k8s_cluster fallback
  Formatter->>StackdriverEntry: Emits resource.type and resource-specific labels

Loading

Possibly related PRs

• fluent/fluent-bit#12023: Refactors related Stackdriver Kubernetes resource extraction and label state handling.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 25.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding the trust_payload_local_resource_id option to out_stackdriver.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[JeffLuoo]

/assign

[JeffLuoo]

/assign me

[erain]

Rebased onto current master now that #12023 has merged; this PR is down to the two trust_payload_local_resource_id commits. Full flb-rt-out_stackdriver suite passes locally. Marking ready for review.