GoogleCloudPlatform / GoogleCloudPlatform/gcsfuse
Application default credentials aren't reloaded on expiration
- Dominant language
- Go
- Stars
- 2.3k
- Forks
- 510
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 35
Description
**Describe the issue**
For security purposes, our application default credentials are set to expire every 16 hrs (in local dev environments). When a developer refreshes their credentials, GCS fuse doesn't seem to reload the credential file, and continues to get `invalid_grant` errors since it is using the old, expired credentials. This requires the additional step of restarting GCSFuse — not the end of the world, but an extra layer of complexity that would ideally be handled by fuse.
**To Collect more Debug logs**
Steps to reproduce the behavior:
1. Create application default creations: `gcloud auth application-default login`
2. Start GCS fuse, which will use these credentials
3. Revoke / expire the credentials. GCS fuse will start logging errors.
4. Refresh the credentials: `gcloud auth application-default login`
5. Within a reasonable period of time, we would expect fuse to reload the credentials file and start working again, but it currently doesn't.
**System (please complete the following information):**
- OS: Debian 11 (bullseye)
- Platform: local kubernetes
- Version: 1.4.0
Contributor guide
Assessment
This issue has not been assessed yet.