导出TimeSeries异常：GCP Cloud Run中SpringBoot启用Bigtable指标遇认证错误

问题场景 #

在GCP Cloud Run部署的SpringBoot应用中，启用BigtableDataSettings.enableBuiltinMetrics()后，持续抛出以下认证错误，此前应用运行正常，已检查IAM策略但未找到问题：

com.google.api.gax.rpc.UnknownException: io.grpc.StatusRuntimeException: UNKNOWN: Authentication backend unknown error.
    at com.google.api.gax.rpc.ApiExceptionFactory.createException(ApiExceptionFactory.java:119)
    at com.google.api.gax.rpc.ApiExceptionFactory.createException(ApiExceptionFactory.java:41)
    at com.google.api.gax.grpc.GrpcApiExceptionFactory.create(GrpcApiExceptionFactory.java:86)
    at com.google.api.gax.grpc.GrpcApiExceptionFactory.create(GrpcApiExceptionFactory.java:66)
    at com.google.api.gax.grpc.GrpcExceptionCallable$ExceptionTransformingFuture.onFailure(GrpcExceptionCallable.java:97)
    at com.google.api.core.ApiFutures$1.onFailure(ApiFutures.java:67)
    at com.google.common.util.concurrent.Futures$CallbackListener.run(Futures.java:1132)
    at com.google.common.util.concurrent.DirectExecutor.execute(DirectExecutor.java:31)
    at com.google.common.util.concurrent.AbstractFuture.executeListener(AbstractFuture.java:1270)
    at com.google.common.util.concurrent.AbstractFuture.complete(AbstractFuture.java:1038)
    at com.google.common.util.concurrent.AbstractFuture.setException(AbstractFuture.java:808)
    at io.grpc.stub.ClientCalls$GrpcFuture.setException(ClientCalls.java:574)
    at io.grpc.stub.ClientCalls$UnaryStreamToFuture.onClose(ClientCalls.java:544)
    at io.grpc.PartialForwardingClientCallListener.onClose(PartialForwardingClientCallListener.java:39)
    at io.grpc.ForwardingClientCallListener.onClose(ForwardingClientCallListener.java:23)
    at io.grpc.ForwardingClientCallListener$SimpleForwardingClientCallListener.onClose(ForwardingClientCallListener.java:40)
    at com.google.api.gax.grpc.ChannelPool$ReleasingClientCall$1.onClose(ChannelPool.java:535)
    at io.grpc.internal.ClientCallImpl.closeObserver(ClientCallImpl.java:563)
    at io.grpc.internal.ClientCallImpl.access$300(ClientCallImpl.java:70)
    at io.grpc.internal.ClientCallImpl$ClientStreamListenerImpl$1StreamClosed.runInternal(ClientCallImpl.java:744)
    at io.grpc.internal.ClientCallImpl$ClientStreamListenerImpl$1StreamClosed.runInContext(ClientCallImpl.java:723)
    at io.grpc.internal.ContextRunnable.run(ContextRunnable.java:37)
    at io.grpc.internal.SerializingExecutor.run(SerializingExecutor.java:133)
    at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
    at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
    at java.base/java.lang.Thread.run(Thread.java:833)
    Suppressed: com.google.api.gax.rpc.AsyncTaskException: Asynchronous task failed
        at com.google.api.gax.rpc.ApiExceptions.callAndTranslateApiException(ApiExceptions.java:57)
        at com.google.api.gax.rpc.UnaryCallable.call(UnaryCallable.java:112)
        at com.google.cloud.monitoring.v3.MetricServiceClient.createServiceTimeSeries(MetricServiceClient.java:1876)
        at com.google.cloud.bigtable.stats.BigtableCreateTimeSeriesExporter.export(BigtableCreateTimeSeriesExporter.java:80)
        at com.google.bigtable.veneer.repackaged.io.opencensus.exporter.metrics.util.MetricReader.readAndExport(MetricReader.java:167)
        at com.google.bigtable.veneer.repackaged.io.opencensus.exporter.metrics.util.IntervalMetricReader$Worker.readAndExport(IntervalMetricReader.java:177)
        at com.google.bigtable.veneer.repackaged.io.opencensus.exporter.metrics.util.IntervalMetricReader$Worker.run(IntervalMetricReader.java:170)
        ... 1 common frames omitted
Caused by: io.grpc.StatusRuntimeException: UNKNOWN: Authentication backend unknown error.
    at io.grpc.Status.asRuntimeException(Status.java:539)
    ... 14 common frames omitted

解决方案 #

• 补充Cloud Monitoring权限：启用Bigtable内置指标后，应用需要向Cloud Monitoring写入时间序列数据，因此Cloud Run使用的服务账号必须拥有monitoring.timeSeries.create权限。可直接为账号添加roles/monitoring.metricWriter预定义角色，该角色包含所需的写入权限。
• 验证自定义服务账号范围：如果使用了自定义服务账号而非Cloud Run默认账号，需确保部署时未限制API访问范围，且账号已被授予访问Cloud Monitoring API的权限。
• 升级依赖版本：检查google-cloud-bigtable及相关gax、grpc依赖版本，存在版本冲突或兼容性问题时，升级到最新稳定版，确保各依赖版本匹配。
• 检查VPC网络配置：若应用使用VPC连接器，确认VPC防火墙规则允许出站访问monitoring.googleapis.com的gRPC流量（默认允许，自定义规则需排查）。
• 手动测试权限：通过gcloud命令模拟服务账号调用Monitoring API，验证权限是否生效：

  gcloud auth activate-service-account --key-file=your-service-account-key.json
  gcloud monitoring time-series create --project=your-project-id --time-series='[{"metric": {"type": "custom.googleapis.com/test/metric"}, "resource": {"type": "global"}, "points": [{"interval": {"endTime": "'$(date -u +%Y-%m-%dT%H:%M:%SZ)'"}, "value": {"int64Value": 1}}]}]'
  

  命令失败则说明权限未配置正确，成功则需排查应用内部依赖或配置问题。

内容的提问来源于stack exchange，提问作者Nani