https://cloud.google.com/logging/docs/access-control
The logging.configWriter role grants permissions to create, update, and delete log exports. This is the correct role to give team members who need to export logs2.

Google recommends using managed collection for GKE monitoring to reduce operational overhead. This sends Kubernetes metrics and custom workload metrics directly to Cloud Monitoring.
"You can enable Managed Service for Prometheus, which provides a fully managed Prometheus-compatible monitoring solution integrated with Cloud Monitoring."
- Managed Collection in GKE
"It automatically collects and stores metrics in Cloud Monitoring with no need to manage a Prometheus server."
- Google Cloud Managed Prometheus
It's scalable, cost-effective, and requires no additional infrastructure like Thanos or Prometheus federation.

The best option for building a CI/CD pipeline for a containerized application in Google Cloud is to trigger Cloud Build to run unit tests when the code is pushed, if all unit tests are successful, build and push the application container to a central registry, trigger Cloud Build to deploy the container to a testing environment, and run integration tests and acceptance tests, and if all tests are successful, the pipeline deploys the application to the production environment and runs smoke tests. This option follows the best practices for CI/CD pipelines, such as running tests at different stages of the pipeline, using a central registry for storing and managing containers, deploying to different environments, and using Cloud Build as a unified tool for building, testing, and deploying.