Simply mount options for uid/gid

[msau42]

Right now users have to set the driver's mount options to match the uid/gid settings.

Is UID required, or is gid/fsgroup sufficient? Normally for pod volumes, having the volume ownership match the fsgroup (ie supplemental group of the contaner) is enough and uid for the volume doesn't matter.

If you enable delegate fsgroup to csidriver, then k8s will send over the fsgroup id to the NodePublishVolume call, so that could eliminate needing to repeat gid in the mount options.

[msau42]

Also related, evaluate fsGroupPolicy as well.

[songjiaxun]

The driver supports Delegate fsGroup to CSI Driver after the commit. This will be included in the next release.

With this feature, users do not need to explicitly specify uid or gid on the gcsfuse mount options. They can just specify Pod.spec.securityContext.fsGroup, and the fsGroup id will be automatically passed to gcsfuse gid flag. Meanwhile, the file-mode and dir-mode will be set as 664 and 775 respectively. Users can still overwrite these flags, meaning the exiting workloads won't be affected.

[zevisert]

I haven't tested yet, but isn't this closed by release 0.1.7?

[zevisert]

I have a PodTemplateSpec.spec.securityContext.fsGroup and I still see

gcsfuse mounting with args [gcsfuse --uid 0 --gid 0 --temp-dir /gcsfuse-tmp/...

Is there a mount option or annotation I need to provide to use this, or is it simply not rolled out to the GKE-managed version yet?

[songjiaxun]

Hi @zevisert , could you provide your cluster version? It is highly likely that the new version that includes this enhancement has not been rolled out to all the cluster versions yet.

[zevisert]

We're using the regular release channel default right now, so that's 1.27.3-gke.100 as of today

[songjiaxun]

I can confirm that 1.27.3-gke.100 does not container the new feature. I am updating the release note, from where you can see which GKE version contains the new feature. The documentation will be updated shortly.

[songjiaxun]

The doc is updated to describe which GKE version includes the feature: /~https://github.com/GoogleCloudPlatform/gcs-fuse-csi-driver/tree/main?tab=readme-ov-file#gke-compatibility

@zevisert This feature was included in CSI version v0.1.7. As of today, the GKE version 1.27.8-gke.1067000 in the regular channel includes the feature.