googleapis / googleapis/google-cloud-java
[java-bigtable] Bigtable: Use same project to write bigtable resource metrics and application resource metrics
- Ngôn ngữ chính
- Java
- Star
- 2.1k
- Fork
- 1.2k
- Merge trung bình
- 1 ngày 23 giờ
- Pull request đã merge (30 ngày)
- 157
Mô tả
#### Environment details
1. OS type and version: GCP / GKE
2. Java version: 21+
3. bigtable version(s): 2.47.0
#### Steps to reproduce
1. Deploy an application to GKE in a common project (e.g. mycompany-pro)
2. Use a custom project for Bigtable resources (e.g. mycompany-myapp-pro)
3. Use a service account that does have `monitoring.timeSeries.create` permissions on the custom project, but not on the common project
4. Enable client side metrics (enabled by default)
#### Code example
```java
// Create a default BigtableDataClient
BigtableDataSettings
.newBuilder()
.setProjectId(bigtableProperties.projectId)
.setInstanceId(bigtableProperties.instanceId)
.setAppProfileId(bigtableProperties.appProfileId)
```
#### Stack trace
```
createServiceTimeSeries request failed for bigtable metrics. Need monitoring metric writer permission on project= ... . Follow https://cloud.google.com/bigtable/docs/client-side-metrics-setup to set up permissions.
com.google.api.gax.rpc.PermissionDeniedException: io.grpc.StatusRuntimeException: PERMISSION_DENIED: Permission monitoring.timeSeries.create denied (or the resource may not exist).
```
#### External references such as API reference guides
- https://cloud.google.com/bigtable/docs/client-side-metrics-setup
#### Any additional information below
This seems to happen because in `BigtableCloudMonitoringExporter` different metrics are created for Bigtable resource metrics and what it calls `application resource metrics`. For Bigtable resource metrics, the Bigtable project is used and this is fine. However, the project for the application resource metrics is not customizable. The only metric it tries to record there seems to be `per_connection_error_count`. If the service account does not have the permission to create the time series in this common project, you receive the error above.
I'm not sure why the application resource metrics are needed for `per_connection_error_count` and why it defaults to using the project the application is running in instead of the pre-specified Bigtable project (which may be different).
Solving this could be done by either using the specified project, removing the application resource metrics or something else entirely.
Hướng dẫn đóng góp
Hướng nghiên cứu
Start with BigtableCloudMonitoringExporter and trace how Bigtable resource metrics and application resource metrics select their projects, focusing on per_connection_error_count. Reproduce the permission failure using the BigtableDataSettings project configuration and the monitoring setup described in the issue. Done means the exporter no longer requires monitoring.timeSeries.create on an unrelated common project, with the chosen behavior documented and verified.
Do mô hình lập chỉ mục viết ra từ nội dung của issue.
Đánh giá
- Công nghệ
- gcp, java
- Lĩnh vực
- cloud, observability
- Loại issue
- Lỗi
- Độ khó
- 4/5
- Thời gian dự kiến
- 3-5 ngày
- Mức độ hoạt động
- Đình trệ
- Độ rõ ràng
- Khá rõ ràng
- Mức phù hợp với người mới
- 30/100