--- title: "Deploy VAST CSI Driver" slug: "deploy-vast-csi-driver-2-6" updated: 2026-11-03T22:57:04Z published: 2026-11-03T22:57:04Z canonical: "docs.vastdata.com/deploy-vast-csi-driver-2-6" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.vastdata.com/llms.txt > Use this file to discover all available pages before exploring further. # Deploy VAST CSI Driver Use one of the following methods to deploy VAST CSI Driver: - [Helm chart-based deployment](/develop/docs/deploy-vast-csi-driver-2-6#deploy-vast-csi-driver-with-helm-chart) - [VAST CSI Operator for Kubernetes](/develop/docs/deploy-vast-csi-driver-2-6#deploy-vast-csi-driver-with-vast-csi-operator-for-kubernetes) - [VAST CSI Operator for OpenShift](/develop/docs/deploy-vast-csi-driver-2-6#deploy-vast-csi-driver-on-openshift-with-vast-csi-operator) ## VAST CSI Driver Requirements Ensure that your environment meets the following requirements: - A Kubernetes cluster is up and running. - A VAST cluster is up and running. - All nodes of the Kubernetes cluster are networked with the VAST cluster and can mount VAST cluster volumes via NFS. - At least one node can communicate with the VAST Cluster management virtual IP. - A host is available with a [Helm](https://helm.sh/) client installed, preferably in the VMS network. ### Supported Versions VAST CSI Driver 2.6.x requires: - Helm 3.x.x - Kubernetes 1.25 - 1.36 - VAST Cluster 4.1 or later > **Note:** Driver versions earlier than 2.6.4 cannot be used with VAST Cluster 5.5.0 or later. - To use [mTLS authentication](/develop/docs/deploy-vast-csi-driver-2-6#configure-mtls-authentication-for-vast-csi-driver): 5.5.0 or later - To [specify a VAST cluster tenant](/develop/docs/about-vast-csi-driver-2-6#support-of-vast-cluster-multitenancy) on which to provision storage: 5.3.3 or later - To [work with multiple VAST Cluster tenants](/develop/docs/about-vast-csi-driver-2-6#support-of-vast-cluster-multitenancy): 4.7.0-SP10 or later - To [handle deletions](/develop/docs/about-vast-csi-driver-2-6#leveraging-trash-folder-access-to-handle-deletions) via *Trash Folder Access*: 4.7.0-SP6 or later - To [[clone volumes or snapshots](/develop/docs/protect-volumes-with-snapshot-and-clones-2-6): 4.6.0 or later ### Required Permissions VAST CSI Driver requires root (sysadmin) privileges. ## Deploy VAST CSI Driver with Helm Chart Before you begin, ensure that your environment meets the [requirements](/develop/docs/deploy-vast-csi-driver-2-6#vast-csi-driver-requirements). The following procedure uses a [Helm](https://helm.sh) chart to deploy the driver. A *Helm chart* is an installation template that can be reused to install multiple instances of the software being deployed. Each instance is referred to as a *release*. Helm charts are available from *Helm repositories*. Steps to deploy VAST CSI Driver include: 1. [Install](/develop/docs/deploy-vast-csi-driver-2-6#install-crds-for-vast-snapshots) Custom Resource Definitions for snapshots. > **Note:** This step is required if the driver's Helm chart configuration file (`values.yaml`) has `secretName` and `Endpoint` specified as global options (on top of `values.yaml`). This step is optional only when `secretName` and `secretNamespace` are specified within one or more storage classes (or under `StorageClassDefaults`). 2. (Optional) [Create](/develop/docs/deploy-vast-csi-driver-2-6#create-kubernetes-namespace-for-vast-csi-driver) a Kubernetes namespace for VAST CSI Driver. > **Note:** This step is required if you are going to deploy VAST CSI Driver in a Kubernetes namespace other than `default`. Otherwise, skip to step 4. 3. [Configure](/develop/docs/deploy-vast-csi-driver-2-6#configure-vast-cluster-for-vast-csi-driver) the VAST cluster. 4. [Create](/develop/docs/deploy-vast-csi-driver-2-6#create-kubernetes-secret-for-vast-csi-driver) a Kubernetes secret with VMS user credentials or API token for VAST CSI Driver. 5. [Add](/develop/docs/deploy-vast-csi-driver-2-6#add-helm-repository-for-vast-csi-driver) the Helm repository that contains the VAST CSI Driver chart. 6. [Create](/develop/docs/deploy-vast-csi-driver-2-6#create-helm-chart-configuration-file-for-vast-csi-driver) a Helm chart configuration file for VAST CSI Driver. 7. [Install](/develop/docs/deploy-vast-csi-driver-2-6#install-vast-csi-driver-helm-chart) the Helm chart for VAST CSI Driver. 8. (Optional) [Verify](/develop/docs/deploy-vast-csi-driver-2-6#verify-vast-csi-driver-deployment) the deployment by launching a test application. ### Install CRDs for VAST Snapshots CRDs for VAST snapshots are a prerequisite for using VAST snapshots. The CRDs are required if your deployment includes one or more snapshot classes. The driver's logic for creating snapshot classes varies depending on whether you specify the Kubernetes secret as a global or a storage class-specific option: - If the driver's Helm chart configuration file (`values.yaml`) has `secretName` and `Endpoint` specified as global options (on top of `values.yaml`), the driver follows legacy logic and creates one snapshot class named `vastdata-snapshot` to be used for all PVCs. This configuration requires that you install the CRDs for VAST snapshots during driver deployment. - When `secretName` and `secretNamespace` are specified within one or more storage classes (or under `StorageClassDefaults`), the driver creates snapshot classes only when they are defined explicitly. This means that in this case, you need to install the CRDs for VAST snapshots only when you have an explicit `snapshotClass` definition in place. Run the following commands to install the CRDs for snapshots: ``` kubectl apply -f https://raw.githubusercontent.com/kubernetes-csi/external-snapshotter/v7.0.1/client/config/crd/snapshot.storage.k8s.io_volumesnapshotclasses.yaml kubectl apply -f https://raw.githubusercontent.com/kubernetes-csi/external-snapshotter/v7.0.1/client/config/crd/snapshot.storage.k8s.io_volumesnapshotcontents.yaml kubectl apply -f https://raw.githubusercontent.com/kubernetes-csi/external-snapshotter/v7.0.1/client/config/crd/snapshot.storage.k8s.io_volumesnapshots.yaml kubectl apply -f https://raw.githubusercontent.com/kubernetes-csi/external-snapshotter/v7.0.1/deploy/kubernetes/snapshot-controller/rbac-snapshot-controller.yaml kubectl apply -f https://raw.githubusercontent.com/kubernetes-csi/external-snapshotter/v7.0.1/deploy/kubernetes/snapshot-controller/setup-snapshot-controller.yaml ``` ### Create Kubernetes Namespace for VAST CSI Driver By default, VAST CSI Driver is deployed to the `default` namespace on the Kubernetes cluster. If you want to use a different Kubernetes namespace for VAST CSI Driver, create it prior to deployment by running the following command: ``` kubectl create ns ``` ### Configure VAST Cluster for VAST CSI Driver Complete the following steps to make your VAST cluster ready for integration with Kubernetes: - (Optionally) With VAST Cluster 5.3.3 or later, if you are going to [provision](/develop/docs/about-vast-csi-driver-2-6#support-of-vast-cluster-multitenancy) storage on a particular VAST tenant, [create](/develop/docs/deploy-vast-csi-driver-2-6#create-tenant-for-dynamic-volume-provisioning) a tenant that will host the dynamic volumes. - [Set up](/develop/docs/deploy-vast-csi-driver-2-6#set-up-virtual-ip-pools) virtual IP pools to be used by VAST CSI Driver. - [Configure](/develop/docs/deploy-vast-csi-driver-2-6#configure-view-policies) a view policy to be used for views created by VAST CSI Driver. - [Set up](/develop/docs/deploy-vast-csi-driver-2-6#set-up-vms-user) a VMS user to be used by VAST CSI Driver. - (Optional) [Upload](/develop/docs/deploy-vast-csi-driver-2-6#upload-casigned-ssl-certificate-to-vast-cluster) your CA-signed SSL certificate to the VAST cluster. - (Optional): [Configure](/develop/docs/deploy-vast-csi-driver-2-6#configure-qos-policy) a QoS policy to be associated with views created by VAST CSI Driver. > **Note:** If you are going to use VAST CSI Driver with a VAST cluster where the Trash Folder Access feature is disabled or not used for any reason, you also need to complete [additional configuration steps](/develop/docs/deploy-vast-csi-driver-2-6#extra-configuration-steps-for-legacy-csi-localmount-deletions). #### Create Tenant for Dynamic Volume Provisioning If you run the driver with VAST Cluster 5.3.3 or later, it is recommended to set up a dedicated VAST Cluster tenant for dynamic volume provisioning to allow for control plane isolation of privileges that would prevent the service account used by the driver from acting outside the scope of dynamic provisioning. For more information about support of multiple VAST tenants by the driver, see [Support of VAST Cluster Multi-Tenancy](/develop/docs/about-vast-csi-driver-2-6#support-of-vast-cluster-multitenancy). To create a tenant in VAST Web UI, log in and choose **Element Store** -> **Tenants** in the main navigation menu. Click **Create Tenant** and follow the tenant creation guidelines in *VAST Cluster Administrator's Guide*. #### Set Up Virtual IP Pools VAST CSI Driver distributes the load among virtual IPs in one or more VAST virtual IP pools. You specify a virtual IP pool in the [storage class](/develop/docs/provision-volumes-with-vast-csi-driver-2-6#create-storage-classes) definition. The virtual IP pool specified for a storage class is used to process read and write operations requested by the application that is using that particular class. When using VAST Cluster 4.6.0 or later, ensure that the virtual IP pool set for a storage class belongs to the same VAST Cluster tenant as the [view policy](/develop/docs/deploy-vast-csi-driver-2-6#configure-view-policies) specified for that class. In the VAST CSI Driver chart configuration file, the virtual IP pool can be specified by its name (`vipPool`) or FQDN (`vipPoolFQDN`). If you are going to use the FQDN, ensure that the VAST cluster has DNS configured, and the virtual IP pool has *Virtual IP Pool Domain Name* defined in its settings. To view and manage virtual IP pools in VAST Web UI, log in and choose **Network Access** -> **Virtual IP Pools** in the main navigation menu. For more information about VAST Cluster virtual IP pools, see *VAST Cluster Administrator's Guide*. #### Configure View Policies VAST CSI Driver can automatically create a VAST Cluster view for each storage claim being provisioned. These views are controlled using VAST Cluster view policies. You specify a view policy to be assigned to the automatically created views in the [storage class](/develop/docs/provision-volumes-with-vast-csi-driver-2-6#create-storage-classes) definition. The view policy specified for a storage class is used when processing read and write operations requested by the application that is using that particular storage class. When using VAST Cluster 4.6.0 or later, ensure that the view policy set for a storage class belongs to the same VAST Cluster tenant as the [virtual IP pool](/develop/docs/deploy-vast-csi-driver-2-6#set-up-virtual-ip-pools) specified for that class. To view and manage existing view policies in VAST Web UI, log in and choose **Element Store** -> **View Policies**. For more information about VAST Cluster view policies, see *VAST Cluster Administrator's Guide*. #### Set Up VMS User Set up a VMS user for VAST CSI Driver to communicate with the VAST Management Service (VMS) via VAST REST API. You'll need to supply the VMS user credentials or API token in a Kubernetes secret that is specified when creating the VAST CSI Driver's Helm chart configuration file. To set up a VMS user for VAST CSI Driver: 1. Create a new role (in VAST Web UI: **Administrators** -> **Roles** -> **Create Role**) that grants the **Create**, **View**, **Edit** and **Delete** permissions in the **Logical** realm. > **Note:** Do not use the `csi` role provided with the cluster. 2. Create a new VMS manager user for VAST CSI Driver (in VAST Web UI: **Administrators** -> **Managers** -> **Create Manager**) and assign the newly created role to this user. > **Note:** Alternatively, assign the newly created role to the `admin` user provided with the cluster. With VAST Cluster 5.3.3 or later, if you are going to [provision](/develop/docs/about-vast-csi-driver-2-6#support-of-vast-cluster-multitenancy) storage on a particular VAST tenant, set the **User type** to **Tenant Admin** and select the desired tenant from the dropdown list. This is the tenant you'll need to specify in the driver's Kubernetes secret. 3. If you want to have the user authenticated with a VMS API token instead of a password, generate the token as follows: - If the user is a *Cluster Admin*, run the `apitoken create` command of VAST CLI. - If the user is a *Tenant Admin*, with VAST Cluster 5.3.3 or later: 1. Install `vastpy` and `vastpy-cli` tools with the following command (which installs both tools): ``` pip install vastpy ``` 2. Run the following command to generate the VMS API token: ``` vastpy-cli --user   \ --password '' \ --tenant-name   \ post apitokens owner= name= ``` For example: ``` vastpy-cli   --user admina  \  --password 'P@ssw0rd'   \ --tenant-name ten-a   \ post apitokens owner=admina name=new‑token9898 ``` #### Upload CA-Signed SSL Certificate to VAST Cluster If you want to use a Certificate Authority-signed SSL certificate to secure the connection to the VAST cluster, follow the SSL certificate upload procedure in the *VAST Cluster Administrator's Guide* to upload your SSL certificate to the VAST cluster. For more information about configuring SSL encryption for VAST CSI Driver, see [Configure SSL Encryption for VAST CSI Driver](/develop/docs/deploy-vast-csi-driver-2-6#configure-ssl-encryption-for-vast-csi-driver). #### Configure QoS Policy You can optionally set up a Quality of Service (QoS) policy to be associated with the views that VAST CSI Driver creates. A QoS policy is specified per Kubernetes storage class configured for the VAST driver. > **Note:** This capability requires VAST Cluster 4.6 or later. To view and manage QoS policies via VAST Web UI, log in and choose **Element Store** -> **QoS Policies**. For more information about VAST Cluster QoS policies, see *VAST Cluster Administrator's Guide*. #### Extra Configuration Steps for Legacy CSI Local-Mount Deletions If you are going to use VAST CSI Driver with a VAST cluster where the Trash Folder Access feature is disabled or not used for any reason, you need to specify a deletion view policy and a deletion virtual IP pool. The deletion view policy and pool are used solely for deletions and must enable VAST CSI Driver to effectively handle deletions across all storage classes defined. The deletion view policy and pool can be the same as those used for the volume views, or they can be different. Ensure that the deletion view policy and pool meet the following requirements: - For all versions of VAST Cluster: The deletion view policy has the same security flavor as the view policy set for the storage class. - For VAST Cluster 4.6.0 up to 4.7.0-SP3: The deletion view policy and pool belong to the same VAST Cluster tenant as the view policy and pool specified for the storage class. - For VAST Cluster earlier than 4.7.0-SP6: The deletion view policy does not have the *Root Squash* setting enabled. ### Create Kubernetes Secret for VAST CSI Driver Create a Kubernetes [secret](https://kubernetes.io/docs/concepts/configuration/secret/) to keep [VMS user](/develop/docs/deploy-vast-csi-driver-2-6#set-up-vms-user) credentials or API token that VAST CSI Driver uses to communicate with the VAST cluster. You need to supply the name of the secret when [creating](/develop/docs/deploy-vast-csi-driver-2-6#create-helm-chart-configuration-file-for-vast-csi-driver) the driver's Helm chart configuration file. The Kubernetes secret can also specify the VAST cluster on which you want to provision volumes for a particular storage class or snapshot class. Choose one of the following: - [Create](/develop/docs/deploy-vast-csi-driver-2-6#create-kubernetes-secret-to-provision-storage-on-mltile-vast-clusters) a secret to provision storage on multiple VAST clusters, which can be either - A [secret with a VMS API token](/develop/docs/deploy-vast-csi-driver-2-6#create-secret-with-vms-api-token-recommended) (recommended), or - A [secret with VMS user credentials](/develop/docs/deploy-vast-csi-driver-2-6#create-secret-with-vms-user-credentials) - [Create](/develop/docs/deploy-vast-csi-driver-2-6#) a Kubernetes secret to provision storage on a single VAST Cluster #### Create Kubernetes Secret to Provision Storage on Multiple VAST Clusters Use this procedure to create one or more Kubernetes secrets that can be specified individually per storage class or snapshot class. Each of these Kubernetes secrets specifies the VAST cluster to connect to and the VMS user credentials or an API token, enabling you to [provision](/develop/docs/provision-volumes-with-vast-csi-driver-2-6#provision-volumes-on-multiple-vast-clusters) volumes on multiple VAST clusters or using multiple VMS users on the same VAST cluster. > **Tip:** This type of secret can be used not only when there are multiple VAST clusters, but also anytime when the `secretName` and `secretNamespace` parameters in the Helm chart configuration file (`values.yaml`) are specified within a storage class or under `StorageClassDefaults`. Do either of the following: ``` - [Create](#create-secret-with-vms-api-token-recommended) a secret with a VMS API token (recommended), or - [Create](#create-secret-with-vms-user-credentials) a secret with VMS user credentials ``` Using VMS API tokens is recommended over supplying VMS user credentials. #### Create Secret with VMS API Token (Recommended) > **Note:** VMS API tokens are supported with VAST Cluster 5.3 or later. To create a Kubernetes secret with the VMS user's API token: 1. Create a YAML file with the following content: ``` apiVersion: v1 kind: Secret metadata: name: type: Opaque data: endpoint: tenant: token: sslCert: ``` Where: - (Required) `name` is the name of the Kubernetes secret. - (Required) `endpoint` sets the hostname FQDN or IP address of the VMS URL of the VAST cluster where you want to provision block volumes. - (Optional) `tenant` lets you connect to a particular [VAST cluster tenant](/develop/docs/about-vast-csi-driver-2-6#support-of-vast-cluster-multitenancy). Supplying a tenant requires that the VMS user has a user type of *Tenant Admin* for the specified tenant (in VAST Web UI: **Administrators** -> **Managers** -> open manager details -> **User type**: **Tenant Admin**). > **Note:** The `tenant` parameter is supported starting with VAST CSI Driver 2.6.3. - (Required) `token` is the VMS API token of the VMS user to connect to the VAST cluster. The token must be Base64-encoded. - (Optional) `sslCert` is only required if you are using [SSL encryption](/develop/docs/deploy-vast-csi-driver-2-6#configure-ssl-encryption-for-vast-csi-driver) with a self-signed SSL certificate. It specifies the path to the SSL certificate. 2. Apply the YAML file: ``` kubectl apply -f ``` > **Note:** If you are creating the secret in a namespace that is different from the namespace used to install the driver's Helm chart, specify the secret's namespace on the command: `-n <secret's namespace>`. Alternatively, you can create a secret with the following command: ``` kubectl create secret generic \ --from-literal=endpoint='vms.example.com' \ --from-literal=tenant='' \ --from-literal=token='' \ --from-file=ssl_cert='' \ -n ``` For example: ``` kubectl create secret generic vast-mgmt \ --from-literal=endpoint='vms.example.com' \ --from-literal=tenant='Operations' \ --from-literal=token='xxxxxxxxxххххххххххххххххххххххххххххххх' \ --from-file=ssl_cert='VastCerts/RootCA.crt' \ -n secret_namespace ``` #### Create Secret with VMS User Credentials To create a Kubernetes secret with VMS user credentials: 1. Create a YAML file with the following content: ``` apiVersion: v1 kind: Secret metadata: name: type: Opaque data: endpoint: tenant: username: password: sslCert: mtlsClientCert: mtlsClientPrivkey: ``` Where: - (Required) `name` is the name of the Kubernetes secret. - (Required) `endpoint` sets the hostname FQDN or IP address of the VMS URL of the VAST cluster where you want to provision block volumes. - (Optional) `tenant` lets you connect to a particular VAST cluster tenant. Supplying a tenant requires that the VMS user has a user type of *Tenant Admin* for the specified tenant (in VAST Web UI: **Administrators** -> **Managers** -> open manager details -> **User type**: **Tenant Admin**). > **Note:** The `tenant` parameter is supported starting with VAST CSI Driver 2.6.3. - (Required) `username` is the username of the VMS user to connect to the VAST cluster. The username must be Base64-encoded. - (Required) `password` is the password for the VMS user connecting to the VAST cluster. The password must be Base64-encoded. - (Optional) `sslCert` is only required if you are using [SSL encryption](/develop/docs/deploy-vast-csi-driver-2-6#configure-ssl-encryption-for-vast-csi-driver) with a self-signed SSL certificate. It specifies the path to the SSL certificate. - (Optional) `mtlsClientCert` and `mtlsClientPrivkey` are only required if you want to use [mTLS authentication](/develop/docs/deploy-vast-csi-driver-2-6#configure-mtls-authentication-for-vast-csi-driver). They specify the client certificate and the private key, respectively. Both certificate and key must be provided in PEM format. 2. Apply the YAML file: ``` kubectl apply -f ``` > **Note:** If you are creating the secret in a namespace that is different from the namespace used to install the driver's Helm chart, specify the secret's namespace on the command: `-n <secret's namespace>`. Alternatively, you can create a secret with the following command: ``` kubectl create secret generic \ --from-literal=endpoint='vms.example.com' \ --from-literal=tenant='' \ --from-literal=username='' \ --from-literal=password='' \ --from-file=ssl_cert='' \ --from-file=mtls_client_cert= \ --from-file=mtls_client_privkey= \ -n ``` For example: ``` kubectl create secret generic vast-mgmt \ --from-literal=endpoint='vms.example.com' \ --from-literal=tenant='Operations' \ --from-literal=username='user1' \ --from-literal=password='xxxxxxxxx' \ --from-file=ssl_cert='VastCerts/RootCA.crt' \ --from-file=mtls_client_cert=client.pem \ --from-file=mtls_client_privkey=client-key.pem \ -n secret_namespace ``` #### Create Kubernetes Secret to Provision Storage on Single VAST Cluster Use this procedure to create a single Kubernetes secret that contains VMS user credentials to connect to a single VAST cluster. The Kubernetes secret will be used for all storage classes and snapshot classes defined in the VAST CSI Driver Helm chart configuration file. The VAST cluster to connect is specified on the `endpoint` parameter in the configuration file. To create a Kubernetes secret that will be used to provision storage on a single VAST cluster: 1. Create a YAML file with the following content. Note that the VMS user's username and password must be Base64-encoded. ``` apiVersion: v1 kind: Secret metadata: name: type: Opaque data: username: password: tenant: ``` 2. Apply the YAML file: ``` kubectl apply -f ``` Alternatively, you can create a secret with the following command: ``` kubectl create secret generic \ --from-literal=username='' \ --from-literal=password='' \ --from-literal=tenant='' ``` > **Note:** If you are creating the secret in a Kubernetes namespace that is different from the namespace used to install the VAST CSI Driver Helm chart, specify the secret's namespace on the command: `-n <secret's namespace>`. ### Add Helm Repository for VAST CSI Driver Add the Helm repository that contains the VAST CSI Driver Helm chart to the list of available repositories: 1. Add the Helm repository for VAST CSI Driver: ``` helm repo add https://vast-data.github.io/vast-csi ``` Specify any suitable name for `repo`. This name will be used to refer to the VAST CSI Driver repository when running Helm commands. For example: *vastcsi* 2. Verify that the repository has been added: ``` helm repo list ``` The output is similar to the following: ``` NAME URL vastcsi https://vast-data.github.io/vast-csi ``` ### Create Helm Chart Configuration File for VAST CSI Driver In Helm-based deployments, VAST CSI Driver's Helm chart configuration file lets you override default installation settings provided in the chart with parameters that are specific to your environment. The configuration file is a YAML file typically named `values.yaml`, although you can use any arbitrary name for it. - [Create](/develop/docs/deploy-vast-csi-driver-2-6#create-configuration-file) a configuration file - [Verify](/develop/docs/deploy-vast-csi-driver-2-6#verify-configuration-file) the configuration file #### Create Configuration File Create a YAML file as follows (see also the example below): > **Note:** For a detailed reference for parameters and values, see [here](https://github.com/vast-data/vast-csi/blob/v2.6/charts/vastcsi/values.yaml). ``` secretName: "" endpoint: "" verifySsl: true|false sslCertsSecretName: "" deletionVipPool: "" deletionViewPolicy: "" StorageClassDefaults: