--- title: "Create a Kubernetes Secret with VMS User Credentials for VAST CSI Driver" slug: "create-a-kubernetes-secret-with-vms-user-credentials-for-vast-csi-driver-2-5" updated: 2026-11-06T00:50:57Z published: 2026-11-06T00:50:57Z canonical: "docs.vastdata.com/create-a-kubernetes-secret-with-vms-user-credentials-for-vast-csi-driver-2-5" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.vastdata.com/llms.txt > Use this file to discover all available pages before exploring further. # Create a Kubernetes Secret with VMS User Credentials for VAST CSI Driver Create a Kubernetes [secret](https://kubernetes.io/docs/concepts/configuration/secret/) to keep [VMS user](/develop/docs/configure-vast-cluster-for-vast-csi-driver-2-5#set-up-a-vms-user) credentials that VAST CSI Driver uses to communicate with the VAST cluster. You need to supply the name of the secret when [creating](/develop/docs/en/create-a-helm-chart-configuration-file-for-vast-csi-driver-2-5) the driver's Helm chart configuration file. The Kubernetes secret can also specify the VAST cluster on which you want to provision volumes for a particular storage class or snapshot class. - [Create a Kubernetes Secret to Provision Storage on a Single VAST Cluster](/develop/docs/create-a-kubernetes-secret-with-vms-user-credentials-for-vast-csi-driver-2-5#create-a-kubernetes-secret-to-provision-storage-on-a-single-vast-cluster) - [Create a Kubernetes Secret to Provision Storage on Multiple VAST Clusters](/develop/docs/create-a-kubernetes-secret-with-vms-user-credentials-for-vast-csi-driver-2-5#create-a-kubernetes-secret-to-provision-storage-on-multiple-vast-clusters) ## Create a Kubernetes Secret to Provision Storage on a Single VAST Cluster Use this procedure to create a single Kubernetes secret that contains VMS user credentials to connect to a single VAST cluster. The Kubernetes secret will be used for all storage classes and snapshot classes defined in the VAST CSI Driver Helm chart configuration file. The VAST cluster to connect is specified on the `endpoint` parameter in the configuration file. To create a Kubernetes secret that will be used to provision storage on a single VAST cluster: 1. Create a YAML file with the following content. Note that the VMS user's username and password must be Base64-encoded. ```plaintext apiVersion: v1 kind: Secret metadata:  name: type: Opaque data:  username:  password: ``` 2. Apply the YAML file: ```plaintext kubectl apply -f ``` Alternatively, you can create a secret with the following command: ```plaintext kubectl create secret generic \    --from-literal=username='' \    --from-literal=password='' ``` > [!NOTE] > **Note** > > If you are creating the secret in a Kubernetes namespace that is different from the namespace used to install the VAST CSI Driver Helm chart, specify the secret's namespace on the command: `-n <secret's namespace>`. ## Create a Kubernetes Secret to Provision Storage on Multiple VAST Clusters Use this procedure to create one or more Kubernetes secrets that can be specified individually per storage class or snapshot class. Each of these Kubernetes secrets specifies the VAST cluster to connect to and the VMS user credentials, enabling you to [provision](/develop/docs/provisioning-volumes-on-multiple-vast-clusters-2-5) volumes on multiple VAST clusters or using multiple VMS users on the same VAST cluster. > [!TIP] > **Tip** > > This type of secret can be used not only when there are multiple VAST clusters, but also anytime when the `secretName` and `secretNamespace` parameters in the Helm chart configuration file (`values.yaml`) are specified within a storage class or under `StorageClassDefaults`. To create a Kubernetes secret that will be used to provision storage on multiple VAST clusters: 1. Create a YAML file with the following content: ```plaintext apiVersion: v1 kind: Secret metadata:  name: type: Opaque data:  endpoint:  username:  password:  sslCert: ``` Where: - (Required) `endpoint` sets the hostname FQDN or IP address of the VMS URL of the VAST cluster where you want to provision volumes. - (Required) `username` is the username of the VMS user to connect to the VAST cluster. The username must be Base64-encoded. - (Required) `password` is the password for the VMS user connecting to the VAST cluster. The password must be Base64-encoded. - (Optional) `sslCert` is only required if you are using [SSL encryption](/develop/docs/configuring-ssl-encryption-for-vast-csi-driver-2-5) with a self-signed SSL certificate. It specifies the path to the SSL certificate. 2. Apply the YAML file: ```plaintext kubectl apply -f ``` > [!NOTE] > **Note** > > If you are creating the secret in a namespace that is different from the namespace used to install the VAST CSI Driver Helm chart, specify the secret's namespace on the command: `-n <secret's namespace>`. Alternatively, you can create a secret with the following command: ```plaintext kubectl create secret generic \    --from-literal=endpoint='vms.example.com' \    --from-literal=username='' \    --from-literal=password='' \    --from-file=ssl_cert='' \    -n ``` For example: ```plaintext kubectl create secret generic vast-mgmt \    --from-literal=endpoint='vms.example.com' \    --from-literal=username='user1' \    --from-literal=password='xxxxxxxxx' \    --from-file=ssl_cert='VastCerts/RootCA.crt' \    -n secret_namespace ```