Set up Filestore agent volumes

Before you create volume pools or provision volumes, whether you plan to deploy workloads on Google Kubernetes Engine (GKE) or use your own orchestration framework, you must complete a one-time project setup to enable the required APIs, grant IAM roles, initialize the Filestore service agent, and configure Virtual Private Cloud (VPC) networking using Private Service Connect (PSC).

Create a project and enable APIs

  1. Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

  2. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    Go to project selector

  3. If you're using an existing project for this guide, verify that you have the permissions required to complete this guide. If you created a new project, then you already have the required permissions.

  4. Verify that billing is enabled for your Google Cloud project.

  5. Enable the Filestore APIs, if any are not already enabled.

    Roles required to enable APIs

    To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

    Enable the APIs

  6. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    Go to project selector

  7. If you're using an existing project for this guide, verify that you have the permissions required to complete this guide. If you created a new project, then you already have the required permissions.

  8. Verify that billing is enabled for your Google Cloud project.

  9. Enable the Filestore APIs, if any are not already enabled.

    Roles required to enable APIs

    To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

    Enable the APIs

    10.

Required roles

To get the permissions that you need to set up Filestore agent volumes, ask your administrator to grant you the following IAM roles on your project:

  • Configure Service Connection Policies and VPC networking: Compute Network Admin (roles/compute.networkAdmin)
  • View and manage Filestore instances and related resources, including volume pools and agent volumes: Cloud Filestore Editor (roles/file.editor)

For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

Initialize the service agent

If you haven't created a Filestore instance in your project, initialize the Filestore service agent by running the following command:

gcloud beta services identity create \
    --service=file.googleapis.com \
    --project=PROJECT_ID

Replace PROJECT_ID with the ID of your Google Cloud project.

Grant permissions to the service agent

To set up Filestore agent volumes, grant the Cloud Filestore Editor (roles/file.editor) role to the Filestore service agent:

gcloud projects add-iam-policy-binding PROJECT_ID \
    --member="serviceAccount:service-PROJECT_NUMBER@cloud-filer.iam.gserviceaccount.com" \
    --role="roles/file.editor"

Replace the following:

  • PROJECT_ID: the ID of your Google Cloud project.
  • PROJECT_NUMBER: the project number of your Google Cloud project.

Configure Private Service Connect networking

Filestore agent volumes use Private Service Connect to connect managed storage infrastructure directly to your VPC network. Private Service Connect ensures private, high-bandwidth, and low-latency communication without requiring public IP addresses or VPC Network Peering configurations.

To create a service connection policy, run the following command:

gcloud network-connectivity service-connection-policies create POLICY_NAME \
    --project=PROJECT_ID \
    --region=REGION \
    --network=projects/PROJECT_ID/global/networks/VPC_NETWORK \
    --subnets=SUBNET_NAME \
    --service-class=google-cloud-filestore

Replace the following:

  • POLICY_NAME: a name for the service connection policy, such as filestore-agent-psc-policy.
  • PROJECT_ID: the ID of your Google Cloud project.
  • REGION: the region where the volume pool and workloads will reside, such as us-central1.
  • VPC_NETWORK: the name of an existing VPC network.
  • SUBNET_NAME: the name of a regular VPC subnet in the specified region where Private Service Connect endpoint IP addresses are allocated. For example, you can use the default subnet with the --purpose flag set to PRIVATE.

Create volume pools

Create and manage volume pools to reserve shared regional capacity and IOPS.

Choose your orchestration path