Connect Google Cloud Profiler.
Connect profiles from one Google Cloud project. Perfloop uses a dedicated service account to read profiles and stores the ones it uses for performance work.
Access you need
A project IAM administrator runs the commands from Setup to create a dedicated service account for your Perfloop account and Google Cloud project. Its custom role contains only cloudprofiler.profiles.list.
- cloudprofiler.profiles.listLists Cloud Profiler profiles for the selected project. No write permission.
- Workload Identity impersonationPerfloop uses Workload Identity to act as the dedicated reader with short-lived credentials. You do not need to upload a service-account key or authorize your personal Google account.
Perfloop uses the credential to read profiles. Models and execution sandboxes do not receive it.
Setup
1 · select the project
In Perfloop Setup, choose Google Cloud Profiler and enter the project that holds your profiles.
2 · install the dedicated reader
Run the Cloud Shell commands from Setup in your selected project. They create the service account, assign its read permission, and allow Perfloop to use it through Workload Identity.
Check the project, service account, and permissions in the generated commands before you run them.
3 · validate the read
Return to Setup and validate the connection. Perfloop saves the connection after this check passes.
Data Perfloop reads
The service account can read every profile in the project. To restrict which profiles Perfloop can receive from Google, use a separate project.
Perfloop stores selected profiles in pprof format. Its models can read stack samples, function and file names, build IDs, and labels. Review these fields before connecting a project if they contain sensitive names or identifiers.
Repo access
Work on a repo uses only the profile scopes assigned to that repo. To assign them, contact us with the repo and their names. Until a repo has an assignment, its work runs without telemetry. Saving the connection again in Setup removes its assignments; contact us to restore them.
Change or remove access
To change the project or service account, run a new install from Setup and validate it. The existing connection stays active until the new one passes validation. To stop reads, remove the Workload Identity binding or the service account's custom role in Google Cloud. This does not delete profiles already stored in Perfloop.
Provider documentation
Security questions: security@perfloop.ai