Skip to main content

Client Access Control (ACL)

In JuiceFS, Metadata such as directory, file attributes, timestamps are stored in Metadata servers. ACL is supported via tokens, users can manage tokens in JuiceFS web console. You can create access control rules using IP range, read / write permission and subdirectory mount restrictions.

Access token

When running juicefs mount to mount JuiceFS, or using juicefs auth, a token is needed for authentication. The default token can be found in the file system setting page, you can also create multiple tokens with different ACL and other mount settings.

The default token grants full access to the file system from any IP range. Finer access control can be configured in Access Control tab.

There are two types of tokens, one for client to access file system content, the other for accessing monitoring API.

Client Access Token

Client access token grants client access to file system, while also controlling some client behavior, you can customize the following settings on the Access Control tab in console:

  • IP range: Allow access from specified IP range only
  • Read / Write Permission
    • Read only: Allow read operations only (e.g. open, read, readdir and etc.)
    • Read, append only: In addition to read operations, allow open file with append option to write, but deny overwrite and truncation of existing content.
    • Read write: Allow all read write operations.
  • Mount options
    • Mount subdirectory: Restrict mount subdirectory under this path only, must add --subdir when mounting this file system.
    • Allow background jobs: By default, client executes background jobs such as chunk delete, compaction, and cross-region replication (feature is not scoped by read/write and subdirectory permission). For low bandwidth hosts, disabling background jobs is recommended for better system performance.

API Only Token

JuiceFS exports monitoring metrics of each file system via Prometheus API. API only token grants access only to the monitoring API, and cannot be used to mount JuiceFS.