stackdriver_exporter | Google Stackdriver Prometheus exporter | GCP library

Be aware that in gcloud the final permissions are a "mask" between the roles/permissions of the service account and the scopes of the instance.

When you set up an instance to run as a service account, the level of access the service account has is determined by the combination of access scopes granted to the instance and IAM roles granted to the service account.

So if you are running this with a service account with the role monitoring viewer in a instance without the scope https://www.googleapis.com/auth/monitoring.read you won't be able to read the monitor metrics.

1.- Check the scope of your instance with gcloud compute instances describe INSTANCE. You'll see something like this:

- email: 487724816353-compute@developer.gserviceaccount.com scopes: - https://www.googleapis.com/auth/monitoring.write - https://www.googleapis.com/auth/logging.write - https://www.googleapis.com/auth/devstorage.read_only Can you see the right scopes there?

2.- If not try to set the scopes that you need with: (You need to stop the instance for that)

gcloud compute instances set-service-account INSTANCE \ --service-account SERVICE_ACCOUNT@xxxxxxxx.iam.gserviceaccount.com \ --scopes cloud-platform

3.- The previous command allows full access to all the APIS in the instance as recommended in the gcloud best practices (https://cloud.google.com/compute/docs/access/create-enable-service-accounts-for-instances#best_practices). And then you can control the final permissions just adding/removing roles to the service account.

You should use a global exporter. It was not intended for a new export thread to be created for every Tracer. There should be one background thread running which handles all exporting to StackDriver.

As for the aggregation, it shouldn't be aggregating all the spans together. That may be a bug in the StackDriver UI (there are a number of known issues).