--- title: "Deploy VAST COSI Driver" slug: "deploy-vast-cosi-driver-2-6" updated: 2026-11-04T00:49:38Z published: 2026-11-04T00:49:38Z canonical: "docs.vastdata.com/deploy-vast-cosi-driver-2-6" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.vastdata.com/llms.txt > Use this file to discover all available pages before exploring further. # Deploy VAST COSI Driver - Use the following method to deploy VAST COSI Driver: - [Helm chart-based deployment](/develop/docs/deploy-vast-cosi-driver-2-6#deploy-vast-cosi-driver-with-helm-chart) ## VAST COSI Driver Requirements Ensure that your environment meets the following requirements: - A Kubernetes cluster is up and running. - A VAST cluster is up and running. - All nodes of the Kubernetes cluster are networked with the VAST cluster. - At least one node can communicate with the VAST Cluster management virtual IP. - A host is available with a [Helm](https://helm.sh/) client installed, preferably in the VMS network. ### Supported Versions - Kubernetes 1.25 - 1.31.1 - VAST Cluster 4.7.0-SP6 with the *Trash Folder Access* feature enabled > **Note:** Driver versions earlier than 2.6.4 cannot be used with VAST Cluster 5.5.0 or later. - Helm 3.x.x ### Required Permissions VAST COSI Driver requires root (sysadmin) privileges. ## Deploy VAST COSI Driver with Helm Chart Before you begin, ensure that your environment meets the [requirements](/develop/docs/deploy-vast-cosi-driver-2-6#vast-cosi-driver-requirements). VAST COSI Driver is deployed using [Helm](https://helm.sh) charts. A *Helm chart* is an installation template that can be reused to install multiple instances of the software being deployed. Each instance is referred to as a *release*. Helm charts are available from *Helm repositories*. Steps to deploy VAST COSI Driver include: 1. (Optional) [Install](/develop/docs/deploy-vast-cosi-driver-2-6#install-crds-for-cosi) CustomResourceDefinitions for COSI. 2. [Install](/develop/docs/deploy-vast-cosi-driver-2-6#install-crds-for-vast-snapshots) CustomResourceDefinitions for snapshots. 3. (Optional) [Create](/develop/docs/deploy-vast-cosi-driver-2-6#create-kubernetes-namespace-for-vast-cosi-driver) a Kubernetes namespace for VAST COSI Driver. > **Note:** This step is required if you are going to deploy VAST COSI Driver in a Kubernetes namespace other than `default`. Otherwise, skip to step 4. 4. [Configure](/develop/docs/deploy-vast-cosi-driver-2-6#configure-vast-cluster-for-vast-cosi-driver) the VAST cluster. 5. [Create](/develop/docs/deploy-vast-cosi-driver-2-6#create-kubernetes-secret-for-vast-cosi-driver) a Kubernetes secret with VMS user credentials or API token for VAST COSI Driver. 6. [Add](/develop/docs/deploy-vast-cosi-driver-2-6#add-helm-repository-for-vast-cosi-driver) the Helm repository that contains the VAST COSI Driver chart. 7. [Create](/develop/docs/deploy-vast-cosi-driver-2-6#create-helm-chart-configuration-file-for-vast-cosi-driver) a Helm chart configuration file for VAST COSI Driver. 8. [Install](/develop/docs/deploy-vast-cosi-driver-2-6#install-vast-cosi-driver-helm-chart) the Helm chart for VAST COSI Driver. 9. (Optional) [Verify](/develop/docs/deploy-vast-cosi-driver-2-6#verify-vast-cosi-driver-deployment) the deployment by launching a test application. ### Install CRDs for COSI Run the following commands to install the Custom Resource Definitions (CRDs) for COSI: ``` kubectl create -k github.com/kubernetes-sigs/container-object-storage-interface-api kubectl create -k github.com/kubernetes-sigs/container-object-storage-interface-controller ``` ### Install CRDs for VAST Snapshots Complete this step if you are going to use VAST snapshots on your Kubernetes cluster. The Custom Resource Definitions (CRDs) installed in this step are only required for using VAST snapshots. Run the following commands to install the CRDs for snapshots: ``` kubectl apply -f https://raw.githubusercontent.com/kubernetes-csi/external-snapshotter/v6.0.1/client/config/crd/snapshot.storage.k8s.io_volumesnapshotclasses.yaml kubectl apply -f https://raw.githubusercontent.com/kubernetes-csi/external-snapshotter/v6.0.1/client/config/crd/snapshot.storage.k8s.io_volumesnapshotcontents.yaml kubectl apply -f https://raw.githubusercontent.com/kubernetes-csi/external-snapshotter/v6.0.1/client/config/crd/snapshot.storage.k8s.io_volumesnapshots.yaml kubectl apply -f https://raw.githubusercontent.com/kubernetes-csi/external-snapshotter/v6.0.1/deploy/kubernetes/snapshot-controller/rbac-snapshot-controller.yaml kubectl apply -f https://raw.githubusercontent.com/kubernetes-csi/external-snapshotter/v6.0.1/deploy/kubernetes/snapshot-controller/setup-snapshot-controller.yaml ``` ### Create Kubernetes Namespace for VAST COSI Driver By default, VAST COSI Driver is deployed to the `default` namespace on the Kubernetes cluster. If you want to use a different Kubernetes namespace for VAST COSI Driver, create it prior to deployment by running the following command: ``` kubectl create ns ``` ### Configure VAST Cluster for VAST COSI Driver Complete the following steps to make your VAST cluster ready for integration with Kubernetes through the use of VAST COSI Driver: - [Set up](/develop/docs/deploy-vast-cosi-driver-2-6#set-up-virtual-ip-pools) virtual IP pools to be used by VAST COSI Driver. - [Configure](/develop/docs/deploy-vast-cosi-driver-2-6#configure-view-policies) a view policy to be used for views created by VAST COSI Driver. - [Set up](/develop/docs/deploy-vast-cosi-driver-2-6#set-up-vms-user) a VMS Manager user to be used by VAST COSI Driver. - [Enable](/develop/docs/deploy-vast-cosi-driver-2-6#enable-trash-folder-access) trash folder access on the VAST cluster. - (Optional) [Upload](/develop/docs/deploy-vast-cosi-driver-2-6#upload-casigned-ssl-certificate-to-vast-cluster) your CA-signed SSL certificate to the VAST cluster. - (Optional): [Configure](/develop/docs/deploy-vast-cosi-driver-2-6#configure-qos-policy) a QoS policy to be associated with views created by VAST COSI Driver. #### Set Up Virtual IP Pools VAST COSI Driver distributes the load among virtual IPs in one or more VAST virtual IP pools. The virtual IP pool is specified in the Kubernetes [bucket class](/develop/docs/provision-object-storage-with-vast-cosi-driver-2-6#define-bucket-class) defined in the VAST COSI Driver chart configuration file. The virtual IP pool specified for a bucket class is used when processing read and write operations requested by the application that is using that particular bucket class To view and manage virtual IP pools in VAST Web UI, log in and choose **Network Access** -> **Virtual IP Pools** in the main navigation menu. For more information about VAST cluster's virtual IP pools, see *VAST Cluster Administrator's Guide*. #### Configure View Policies VAST COSI Driver automatically creates a VAST cluster view for each storage claim being provisioned. These views are controlled using VAST cluster view policies. The view policy is specified in the Kubernetes [bucket class](/develop/docs/provision-object-storage-with-vast-cosi-driver-2-6#define-bucket-class) defined in the VAST COSI Driver chart configuration file. The view policy specified for a bucket class is used when processing read and write operations requested by the application that is using that particular bucket class. To view and manage existing view policies in VAST Web UI, log in and choose **Element Store** -> **View Policies**. For more information about VAST cluster view policies, see *VAST Cluster Administrator's Guide*. #### Set Up VMS User Set up a VMS user for VAST COSI Driver to communicate with the VAST Management Service (VMS) via VAST REST API. You'll need to supply the VMS user credentials or authentication token in a Kubernetes secret that is specified when creating the VAST COSI Driver's Helm chart configuration file. VAST COSI Driver can use the default `admin` user that is created by VAST during the initial install, or you can create a new VMS user. The user does not need to have full VMS permissions. The required permissions are **Create**, **View**, **Edit** and **Delete** permissions in the **Security** and **Logical** realm. Permissions are granted to a VMS user by assigning a role. To view and manage roles in VAST Web UI, log in and choose **Administrators** -> **Roles** in the main navigation menu. For more information about managing roles, see *VAST Cluster Administrator's Guide*. To view and manage VMS users in VAST Web UI, log in and choose **Administrators** -> **Managers** in the main navigation menu. For more information about managing VMS Manager users, see *VAST Cluster Administrator's Guide*. To view and manage VMS authentication tokens, use `apitoken *` commands of VAST CLI or VAST REST API. #### Enable Trash Folder Access Trash folder access is required to allow for COSI cleanup. To enable trash folder access in VAST Web UI, log in and choose **Settings** -> **Cluster**. In the **General** tab of cluster settings, toggle the **Trash folder access** option on. #### Upload CA-Signed SSL Certificate to VAST Cluster If you want to use a Certificate Authority-signed SSL certificate to secure the connection to the VAST cluster, follow the SSL certificate upload procedure in the *VAST Cluster Administrator's Guide* to upload your SSL certificate to the VAST cluster. For more information about configuring SSL encryption for VAST COSI Driver, see [Configure SSL Encryption for VAST COSI Driver](/develop/docs/deploy-vast-cosi-driver-2-6#configure-ssl-encryption-for-vast-cosi-driver). #### Configure QoS Policy You can optionally set up a Quality of Service (QoS) policy to be associated with the views that VAST COSI Driver creates. A QoS policy is specified per Kubernetes storage or bucket class configured for the VAST driver. > **Note:** This capability requires VAST Cluster 4.6 or later. To view and manage QoS policies via VAST Web UI, log in and choose **Element Store** -> **QoS Policies**. For more information about VAST cluster's QoS policies, see *VAST Cluster Administrator's Guide*. ### Create Kubernetes Secret for VAST COSI Driver Create a Kubernetes [secret](https://kubernetes.io/docs/concepts/configuration/secret/) to keep [VMS user](/develop/docs/deploy-vast-cosi-driver-2-6#set-up-vms-user) credentials or API token that VAST COSI Driver will use to communicate with the VAST cluster. You need to supply the name of the secret when creating the VAST COSI Driver's Helm chart configuration file. This Kubernetes secret will be used for all bucket classes defined for the VAST COSI Driver in its Helm chart configuration file. The VAST cluster to connect is specified on the `endpoint` parameter in the configuration file. Do either of the following: - [Create](/develop/docs/deploy-vast-cosi-driver-2-6#create-secret-with-vms-api-token-recommended) a secret with a VMS API token, or - [create](/develop/docs/deploy-vast-cosi-driver-2-6#create-secret-with-vms-user-credentials) a secret with VMS user credentials. Using VMS API tokens is recommended over supplying VMS user credentials. #### Create Secret with VMS API Token (Recommended) > **Note:** VMS API tokens are supported with VAST Cluster 5.3 or later. To create a Kubernetes secret with the VMS user's API token: 1. Create a YAML file with the following content: ``` apiVersion: v1 kind: Secret metadata: name: type: Opaque data: endpoint: token: sslCert: ``` Where: - (Required) `name` is the name of the Kubernetes secret. - (Required) `endpoint` sets the hostname FQDN or IP address of the VMS URL of the VAST cluster where you want to provision block volumes. - (Required) `token` is the VMS API token of the VMS user to connect to the VAST cluster. The token must be Base64-encoded. - (Optional) `sslCert` is only required if you are using [SSL encryption](/develop/docs/deploy-vast-cosi-driver-2-6#configure-ssl-encryption-for-vast-cosi-driver) with a self-signed SSL certificate. It specifies the path to the SSL certificate. 2. Apply the YAML file: ``` kubectl apply -f ``` > **Note:** If you are creating the secret in a namespace that is different from the namespace used to install the driver's Helm chart, specify the secret's namespace on the command: `-n <secret's namespace>`. Alternatively, you can create a secret with the following command: ``` kubectl create secret generic \ --from-literal=endpoint='vms.example.com' \ --from-literal=token='' \ --from-file=ssl_cert='' \ -n ``` For example: ``` kubectl create secret generic vast-mgmt \ --from-literal=endpoint='vms.example.com' \ --from-literal=token='xxxxxxxxxххххххххххххххххххххххххххххххх' \ --from-file=ssl_cert='VastCerts/RootCA.crt' \ -n secret_namespace ``` #### Create Secret with VMS User Credentials To create a Kubernetes secret with VMS user credentials: 1. Create a YAML file with the following content: ``` apiVersion: v1 kind: Secret metadata: name: type: Opaque data: endpoint: username: password: sslCert: ``` Where: - (Required) `name` is the name of the Kubernetes secret. - (Required) `endpoint` sets the hostname FQDN or IP address of the VMS URL of the VAST cluster where you want to provision block volumes. - (Required) `username` is the username of the VMS user to connect to the VAST cluster. The username must be Base64-encoded. - (Required) `password` is the password for the VMS user connecting to the VAST cluster. The password must be Base64-encoded. - (Optional) `sslCert` is only required if you are using [SSL encryption](/develop/docs/deploy-vast-cosi-driver-2-6#configure-ssl-encryption-for-vast-cosi-driver) with a self-signed SSL certificate. It specifies the path to the SSL certificate. 2. Apply the YAML file: ``` kubectl apply -f ``` > **Note:** If you are creating the secret in a namespace that is different from the namespace used to install the driver's Helm chart, specify the secret's namespace on the command: `-n <secret's namespace>`. Alternatively, you can create a secret with the following command: ``` kubectl create secret generic \ --from-literal=endpoint='vms.example.com' \ --from-literal=username='' \ --from-literal=password='' \ --from-file=ssl_cert='' \ -n ``` For example: ``` kubectl create secret generic vast-mgmt \ --from-literal=endpoint='vms.example.com' \ --from-literal=username='user1' \ --from-literal=password='xxxxxxxxx' \ --from-file=ssl_cert='VastCerts/RootCA.crt' \ -n secret_namespace ``` ### Create Helm Chart Configuration File for VAST COSI Driver The driver's Helm chart configuration file lets you override default installation settings provided in the chart with parameters that are specific to your environment. The configuration file is a YAML file typically named `values.yaml`, although you can use any arbitrary name for it. - [Create](/develop/docs/deploy-vast-cosi-driver-2-6#create-configuration-file) a configuration file - [Verify](/develop/docs/deploy-vast-cosi-driver-2-6#verify-configuration-file) the configuration file #### Create Configuration File Create a YAML file as follows (see also the example below: > **Note:** For a detailed reference for parameters and values, see [here](https://github.com/vast-data/vast-csi/blob/v2.6/charts/vastcosi/values.yaml). ``` secretName: "" endpoint: "" verifySsl: true|false sslCertsSecretName: "" bucketClassDefaults: