title: How to get IAM/service account used by juicefs to access GCS in GKE?
body: <p>I'm using a <a href="https://github.com/juicedata/juicefs-csi-driver" rel="nofollow noreferrer">juicefs-csi</a> in GKE. I use postgre as meta-store and GCS as storage. The corresponding setting is as follow:</p>
  <pre class="lang-yaml prettyprint-override"><code>node:
    # ...
    storageClasses:
      - name: juicefs-sc
        enabled: true
        reclaimPolicy: Retain
        backend:
          name: juicefs
          metaurl: postgres://user:password@my-ec2-where-postgre-installed.ap-southeast-1.compute.amazonaws.com:5432/the-database?sslmode=disable
          storage: gs
          bucket: gs://my-bucket
     # ...
  </code></pre>
  <p>According to <a href="https://juicefs.com/docs/community/how_to_setup_object_storage/#google-cloud-storage" rel="nofollow noreferrer">this</a> documentation, I don't have to specify access key/secret (like in S3).</p>
  <p>But unfortunately, whenever I try to write anything to the mounted volume (with <code>juicefs-sc</code> storage class), I always get this error:</p>
  <pre><code>AccessDeniedException: 403 Caller does not have storage.objects.create access to the Google Cloud Storage object.
  </code></pre>
  <p>I believe it should be related to IAM role.</p>
  <p>My question is, <strong>how could I know which IAM user/service account is used by juicefs</strong> to access GCS, so that I can assign a sufficient role to it?</p>
  <p>Thanks in advance.</p>
  <p><strong>EDIT</strong></p>
  <p>Step by step:</p>
  <ul>
  <li>Download juicefs-csi helm chart</li>
  <li>Add values as described in the question, apply</li>
  <li>Create a pod that mount from PV with <code>juicefs-sc</code> storage class</li>
  <li>Try to read/write file to the mount point</li>
  </ul>