I've spent the past our trying to figure out (still haven't) why am I getting these errors on Istio –which is a service mesh that requires users to explicitly whitelist all the external hosts that are called.

ERROR:@google-cloud/trace-agent: TraceWriter#publish: Received error status code unknown. Original error: Error: Unexpected error while acquiring application default credentials: Could not load the default credentials. Browse to https://developers.google.com/accounts/docs/application-default-credentials for more information.

This error doesn't explain why it failed. Received error status code unknown. Original error: Error: Unexpected error might be one of the most unhelpful errors to return here.

Here are some better examples:

• Failed to upload traces: Could not retrieve credentials: could not connect to metadata service: TLS handshake failed
• Failed to upload traces: Could not retrieve credentials: could not connect to metadata service: unknown host metadata.google.internal

Here's another unhelpful error:

TraceWriter#publish: Received error status code unknown. Original error: Error: Sorry, we cannot connect to Cloud Services without a project ID. You may specify one with an environment variable named "GOOGLE_CLOUD_PROJECT".

Why is it unhelpful? I can't tell:

• was it trying to find the project ID (from gce metadata) and that's why it failed?
• did it actually failed to connect cloudtrace.googleapis.com
  • if so, which port/protocol (grpc/https) did it use?

Here's a suggestion:

• TraceWriter#publish: Failed to determine project ID from metadata service: unknown host metadata.google.internal
• TraceWriter#publish: Failed to upload traces (cloudtrace.googleapis.com:443): tls handshake failed