StorageClasses with serverless mount mode on GKE use gke service account to authenticate with gcs instead of HMAC access-key

[v2kk]

I'm using juicefs-csi-driver helm chart version 0.29.0 to deploy juicefs on GKE clusters, mountMode serverless. Everythings work fine instead of authentication with gcs bucket is used via gke service account, it not use backend secret and access key have been configurated.

This is log from my pod's jfs-mount container:

2025/07/11 05:36:40.993613 juicefs[51] <INFO>: Meta address: postgres://juicefs_rw:****@host:5432/juicefs [NewClient@interfac
e.go:578]                                                                                                                                                                
2025/07/11 05:36:41.039915 juicefs[51] <WARNING>: The latency to database is too high: 45.565587ms [[email protected]:506]                                               
2025/07/11 05:36:41.055623 juicefs[51] <INFO>: Data use gs://juicefs-dev/jfs/ [[email protected]:588]                                                                       
2025/07/11 05:36:41.055734 juicefs[51] <INFO>: JuiceFS version 1.3.0+2025-07-03.30190ca1 [[email protected]:631]                                                            
2025/07/11 05:36:41.076743 juicefs[51] <INFO>: Disk cache (/var/jfsCache/f9dd8b65-a45e-4ddd-bead-01eb3d711ace/): used ratio - [space 16.6%, inode 3.7%] [newCacheStore@di
sk_cache.go:147]                                                                                                                                                         
2025/07/11 05:36:41.076877 juicefs[51] <INFO>: Adjusted cache capacity based on freeratio: from 107374182400 to 43524663781 bytes [setlimitByFreeRatio@disk_cache.go:171]
2025/07/11 05:36:41.076994 juicefs[51] <INFO>: Adjusted max items based on freeratio: from 0 to 2695247 items [setlimitByFreeRatio@disk_cache.go:176]                    
2025/07/11 05:36:41.205151 juicefs[51] <INFO>: Create session 4 OK with version: 1.3.0+2025-07-03.30190ca1 [[email protected]:535]                                      
2025/07/11 05:36:41.210014 juicefs[51] <INFO>: Prometheus metrics listening on [::]:9567 [[email protected]:134]                                                    
2025/07/11 05:36:41.211259 juicefs[51] <INFO>: Mounting volume jfs at /jfs/obddgw ... [mountMain@mount_unix.go:1027]                                                     
2025/07/11 05:36:41.540947 juicefs[1] <INFO>: OK, jfs is ready at /jfs/obddgw [checkMountpoint@mount_unix.go:235]                                                        
..JuiceFS:jfs on /jfs/obddgw type fuse.juicefs (rw,nosuid,nodev,relatime,user_id=0,group_id=0,default_permissions,allow_other,max_read=131072)                           
2025-07-11 05:36:43                                                                                                                                                      
succeed in checking mount point /jfs/obddgw                                                                                                                              
set quota in pvc-4797bfcc-8b66-4a3b-8bc3-bb5b46e0e1a1                                                                                                                    
2025-07-11 05:36:45.142639 I | Unimplemented opcode POLL                                                                                                                 
2025/07/11 05:36:45.144214 juicefs[1] <INFO>: watching /jfs/obddgw, pid 51 [watchdog@mount_unix.go:162]                                                                  
+------------------------------------------+--------+------+------+-----------+-------+-------+                                                                          
|                   Path                   |  Size  | Used | Use% |   Inodes  | IUsed | IUse% |                                                                          
+------------------------------------------+--------+------+------+-----------+-------+-------+                                                                          
| pvc-4797bfcc-8b66-4a3b-8bc3-bb5b46e0e1a1 | 10 GiB |  0 B |   0% | unlimited |     0 |       |                                                                          
+------------------------------------------+--------+------+------+-----------+-------+-------+

2025/07/11 05:36:27.034263 juicefs[7] <WARNING>: Test storage gs://juicefs-dev/juicefs/ failed: Failed to create bucket gs://juicefs-dev/juicefs/: googleapi: Error 403: 
Caller does not have storage.buckets.create access to the Google Cloud project. Permission 'storage.buckets.create' denied on resource (or it may not exist)., forbidden,
 previous error: googleapi: Error 403: Caller does not have storage.objects.create access to the Google Cloud Storage object. Permission 'storage.objects.create' denied 
on resource (or it may not exist)., forbidden, tries: #1 [[email protected]:374]

From GCP logging explorer

{
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "status": {
      "code": 7,
      "message": "Caller does not have storage.objects.list access to the Google Cloud Storage bucket. Permission 'storage.objects.list' denied on resource (or it may not exist)."
    },
    "authenticationInfo": {
      "serviceAccountDelegationInfo": [
        {}
      ],
      "principalSubject": "serviceAccount:myproject.svc.id.goog[mynamespace/default]"
    },
    "requestMetadata": {
      "callerIp": "10.0.0.12",
      "callerSuppliedUserAgent": "gcloud-golang-storage/1.48.0,gzip(gfe)",
      "callerNetwork": "//compute.googleapis.com/projects/myproject/global/networks/__unknown__",
      "requestAttributes": {
        "time": "2025-07-11T05:36:26.921460173Z",
        "auth": {}
      },
      "destinationAttributes": {}
    },
    "serviceName": "storage.googleapis.com",
    "methodName": "storage.objects.list",
    "authorizationInfo": [
      {
        "resource": "projects/_/buckets/juicefs-dev",
        "permission": "storage.objects.list",
        "granted": false,
        "resourceAttributes": {}
      }
    ],
    "resourceName": "projects/_/buckets/juicefs-dev",
    "resourceLocation": {
      "currentLocations": [
        "us-central1"
      ]
    }
  },
  "insertId": "64fprteh6bas",
  "resource": {
    "type": "gcs_bucket",
    "labels": {
      "project_id": "myproject",
      "bucket_name": "juicefs-dev",
      "location": "us-central1"
    }
  },
  "timestamp": "2025-07-11T05:36:26.912616629Z",
  "severity": "ERROR",
  "logName": "projects/myproject/logs/cloudaudit.googleapis.com%2Fdata_access",
  "receiveTimestamp": "2025-07-11T05:36:27.505626772Z"
}

Am I missing some configuration? Thanks!

[Xuyuchao-juice]

In GCP environments, JuiceFS defaults to using the service account credentials provided by GKE's metadata server instead of user-configured Secrets. Explicit environment variable settings are required to override this behavior.