GoogleCloudPlatform / GoogleCloudPlatform/gcsfuse

Application default credentials aren't reloaded on expiration

Open
#1,632 2 comments 1 reaction 0 assignees View on GitHub
feature request p2
Dominant language
Go
Stars
2.3k
Forks
510
Avg merge
2d 17h
Merged PRs (30d)
35

Description

**Describe the issue**
For security purposes, our application default credentials are set to expire every 16 hrs (in local dev environments). When a developer refreshes their credentials, GCS fuse doesn't seem to reload the credential file, and continues to get `invalid_grant` errors since it is using the old, expired credentials. This requires the additional step of restarting GCSFuse — not the end of the world, but an extra layer of complexity that would ideally be handled by fuse.

**To Collect more Debug logs**
Steps to reproduce the behavior:
1. Create application default creations: `gcloud auth application-default login`
2. Start GCS fuse, which will use these credentials
3. Revoke / expire the credentials. GCS fuse will start logging errors.
4. Refresh the credentials: `gcloud auth application-default login`
5. Within a reasonable period of time, we would expect fuse to reload the credentials file and start working again, but it currently doesn't.

**System (please complete the following information):**
- OS: Debian 11 (bullseye)
- Platform: local kubernetes
- Version: 1.4.0

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.