How to change file permissions after mounting bucket with gcsfuse?

[erkanerol]

We mount our bucket to pods with Cloud Storage FUSE CSI driver as below

  - csi:
      driver: gcsfuse.csi.storage.gke.io
      readOnly: false
      volumeAttributes:
        bucketName: my-bucket
        mountOptions: implicit-dirs,uid=0,gid=0,file-mode=0666,dir-mode=0777
    name: my-storage

I tried to change file permissions of some files in the volume by running `chmod` and `chown` commands. Even though the commands don't fail, the permissions don't change. I think gcsfuse drivers don't allow. Is there a way to do it?

I am aware that I can use `only-dir=` flag to mount some specific folders and change uid and gid in the pod spec but I don't know which directory to mount during pod creation. I have to do it on the fly in the pod. I couldn't find a way to do it. 

[KyleMari]

Hi @erkanerol,

Welcome to Google Cloud Community!

In general, POSIX-style access control does not work as long as the file or folder is mounted to Cloud Storage FUSE. By default, Cloud Storage FUSE file system sets permission bits of “644” for all files and “755” for all directories.

While you’re aware of using file_mode and dir_mode flags as a workaround to override these defaults, unfortunately, there’s no way to dynamically change the permission (via file_mode and dir_mode) after the bucket has already been mounted. 

In the CLI, the only way to make changes each time is to unmount the current folder and then remount the folder on your desired bucket with the new file_mode and dir_mode. You can check this solution given by @haraldhaas when definingfile_mode and dir_mode through a mount command.

In Kubernetes, you can only update the value of yourfile-mode and dir-mode when updating your PersistentVolume definition, then recreate the pod that mounts the volume.

In conclusion, there’s no way to change thefile_mode and dir_mode settings without remounting. For more information, you can read more about how permission and ownership works in Cloud Storage FUSE.

You can also share your feedback by logging a Cloud Storage issue tracker. The Google Cloud team is regularly evaluating the bug reports and feature requests filed there, but there’s no specific timetable as to how long before each receives a proper closure.

I hope the above information is helpful.