googleapis / googleapis/google-cloud-java

[java-bigtable] Bigtable: Use same project to write bigtable resource metrics and application resource metrics

Đang mở
#13,068 2 bình luận 1 reaction 0 người được giao Xem trên GitHub
api: bigtable
Ngôn ngữ chính
Java
Star
2.1k
Fork
1.2k
Merge trung bình
1 ngày 23 giờ
Pull request đã merge (30 ngày)
157

Mô tả

#### Environment details
1. OS type and version: GCP / GKE
2. Java version: 21+
3. bigtable version(s): 2.47.0

#### Steps to reproduce

1. Deploy an application to GKE in a common project (e.g. mycompany-pro)
2. Use a custom project for Bigtable resources (e.g. mycompany-myapp-pro)
3. Use a service account that does have `monitoring.timeSeries.create` permissions on the custom project, but not on the common project
4. Enable client side metrics (enabled by default)

#### Code example

```java
// Create a default BigtableDataClient
BigtableDataSettings
.newBuilder()
.setProjectId(bigtableProperties.projectId)
.setInstanceId(bigtableProperties.instanceId)
.setAppProfileId(bigtableProperties.appProfileId)
```

#### Stack trace
```
createServiceTimeSeries request failed for bigtable metrics. Need monitoring metric writer permission on project= ... . Follow https://cloud.google.com/bigtable/docs/client-side-metrics-setup to set up permissions.
com.google.api.gax.rpc.PermissionDeniedException: io.grpc.StatusRuntimeException: PERMISSION_DENIED: Permission monitoring.timeSeries.create denied (or the resource may not exist).
```

#### External references such as API reference guides

- https://cloud.google.com/bigtable/docs/client-side-metrics-setup

#### Any additional information below

This seems to happen because in `BigtableCloudMonitoringExporter` different metrics are created for Bigtable resource metrics and what it calls `application resource metrics`. For Bigtable resource metrics, the Bigtable project is used and this is fine. However, the project for the application resource metrics is not customizable. The only metric it tries to record there seems to be `per_connection_error_count`. If the service account does not have the permission to create the time series in this common project, you receive the error above.

I'm not sure why the application resource metrics are needed for `per_connection_error_count` and why it defaults to using the project the application is running in instead of the pre-specified Bigtable project (which may be different).

Solving this could be done by either using the specified project, removing the application resource metrics or something else entirely.

Hướng dẫn đóng góp

Mở hướng dẫn đóng góp

Hướng nghiên cứu

Start with BigtableCloudMonitoringExporter and trace how Bigtable resource metrics and application resource metrics select their projects, focusing on per_connection_error_count. Reproduce the permission failure using the BigtableDataSettings project configuration and the monitoring setup described in the issue. Done means the exporter no longer requires monitoring.timeSeries.create on an unrelated common project, with the chosen behavior documented and verified.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Đánh giá

Công nghệ
gcp, java
Lĩnh vực
cloud, observability
Loại issue
Lỗi
Độ khó
4/5
Thời gian dự kiến
3-5 ngày
Mức độ hoạt động
Đình trệ
Độ rõ ràng
Khá rõ ràng
Mức phù hợp với người mới
30/100

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.