---
title: "Set Up VAST Tenants and VIP Pools"
slug: "initial-vast-setup"
description: "Set up your VAST environment with essential resources, including tenants, VIP pools, and policies for DataEngine and CSI Driver installation."
tags: ["DataEngine"]
updated: 2026-10-30T22:07:21Z
published: 2026-10-30T22:07:21Z
canonical: "docs.vastdata.com/initial-vast-setup"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vastdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Set Up VAST Tenants and VIP Pools

> [!NOTE]
> ℹ️ Info
> 
> **Outcome:** DataEngine and optional CSI tenants, VIP pools, policies, service accounts, and a DataEngine user are ready.
> 
> **Before you begin:** Complete the lab-values worksheet and sign in to the VAST Management System (VMS) as a cluster administrator.
> 
> **Previous:** [Collect VAST DataEngine Lab Values](/develop/docs/dataengine-before-you-begin) | **Next:** [Install an RKE2 Cluster](/develop/docs/rke2-cluster)

Sign in to the VAST Management System (VMS) and create the resources required by the lab.

> [!NOTE]
> ℹ️ Info
> 
> Installing the VAST CSI Driver is an optional, but recommended step in the process. If you choose not to install the VAST CSI Driver, steps that are titled with “*CSI*” can be skipped.

## Prerequisites

### Prerequisites for Data Engine

- A new Tenant for DataEngine
- A VIP Pool for the DataEngine Tenant
- S3 Native View Policy for DataEngine Tenant
- A DataEngine Bucket Owner User and Group
- Group granted DataEngine Access on the tenant

### Prerequisites for VAST CSI Driver (Optional)

- Trash Folder enabled for Cluster
- A new Tenant for CSI with Trash Folder enabled
- A VIP Pool for the CSI Tenant
- A View Policy for CSI
- VMS Roles for CSI Tenant admin and CSI Service Account
- VMS Managers for CSI Tenant admin and CSI Service Account

### Prerequisites for Docker Repository

- A View for the Docker Repo

### If Using AD/LDAP to authenticate users

- Enable AD/LDAP Authentication for VMS

## Enable AD/LDAP Authentication for VMS (optional)

1. Navigate to User Management → Active Directory (or LDAP)
2. Right-click AD/LDAP provider → Choose “Edit”
3. Under “Advanced”
  1. Enable “VMS Authentication Provider”

![image-20260828-120106.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/image-20260828-120106.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A14%3A21Z&se=2026-11-08T10%3A14%3A21Z&sr=c&sp=r&sig=M4i4%2FJT8TpK1eO8RiKSvGkn1%2BzbQ5OTjvS2S4g0H%2FA0%3D)
4. Select “Update”

## DataEngine Resources

For VAST Cluster 5.3.3+, configure a dedicated tenant for dynamic volume provisioning. This restricts the driver's service account privileges to dynamic provisioning tasks and provides necessary control plane isolation.

Similarly, isolate DataEngine in its own dedicated tenant to maintain a strong security posture and enforce strict separation of concerns.

### Create a local identity provider

![image-20260819-133741.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/image-20260819-133741.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A14%3A21Z&se=2026-11-08T10%3A14%3A21Z&sr=c&sp=r&sig=M4i4%2FJT8TpK1eO8RiKSvGkn1%2BzbQ5OTjvS2S4g0H%2FA0%3D)

1. Navigate to User Management → VAST Providers → Add New Provider
2. Select “VAST Provider”
  1. Create a new identity provider (for example `de-lab-provider`)
  2. Verify “Cluster Admin” and “Tenant Admin” are both selected (this allows the cluster admin to edit logical elements within the Tenant)
3. Select “Create”

![image-20260819-134001.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/image-20260819-134001.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A14%3A21Z&se=2026-11-08T10%3A14%3A21Z&sr=c&sp=r&sig=M4i4%2FJT8TpK1eO8RiKSvGkn1%2BzbQ5OTjvS2S4g0H%2FA0%3D)

### Create the DataEngine Tenant

1. Navigate to Element Store → Tenants → Create Tenant
  1. Fill in the tenant name (for example `de-lab-tenant`)
2. Under “Providers and Users Access”
  1. Select your Identity Provider (for example `de-lab-provider` local provider or AD/LDAP)
3. Select “Create”

![image-20260819-134249.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/image-20260819-134249.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A14%3A21Z&se=2026-11-08T10%3A14%3A21Z&sr=c&sp=r&sig=M4i4%2FJT8TpK1eO8RiKSvGkn1%2BzbQ5OTjvS2S4g0H%2FA0%3D)

### Create the DataEngine tenant VIP pool

1. Navigate to “Network Access → Virtual IP Pools → Create Virtual IP Pool”
2. Choose the tenant (for example `de-lab-tenant`)
3. Name the VIP Pool (for example `de-lab-vippool`)
4. Choose Role “Protocols”
5. Enter your Subnet CIDR (for example `16`) also enter VLAN and Gateway if needed

![image-20260819-141447.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/image-20260819-141447.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A14%3A21Z&se=2026-11-08T10%3A14%3A21Z&sr=c&sp=r&sig=M4i4%2FJT8TpK1eO8RiKSvGkn1%2BzbQ5OTjvS2S4g0H%2FA0%3D)
6. In “IP Range List” enter your “Start IP and End IP” (for example `172.200.205.13` and `172.200.205.18`)

![image-20260819-141129.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/image-20260819-141129.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A14%3A21Z&se=2026-11-08T10%3A14%3A21Z&sr=c&sp=r&sig=M4i4%2FJT8TpK1eO8RiKSvGkn1%2BzbQ5OTjvS2S4g0H%2FA0%3D)
7. **ONLY IF USING DNS:** in “DNS Configurations → Virtual IP Pool name” enter a name (for example `de-lab-vippool`)
  1. This will populate below as a FQDN (for example “DNS Service FQDN: de-lab-vippool.cluster.lab.vastdata.com”

![image-20260819-141329.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/image-20260819-141329.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A14%3A21Z&se=2026-11-08T10%3A14%3A21Z&sr=c&sp=r&sig=M4i4%2FJT8TpK1eO8RiKSvGkn1%2BzbQ5OTjvS2S4g0H%2FA0%3D)
8. Select “Create”

### Create view policies

#### Create the DataEngine S3 Native view policy

1. Navigate to “Element Store → View Polices ->Create Policy”
2. Choose the tenant (for example `de-lab-tenant`)
3. Name the Policy (for example `de-lab-s3-policy`)
4. Choose Security Flavor “S3 Native”

![image-20260828-120420.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/image-20260828-120420.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A14%3A21Z&se=2026-11-08T10%3A14%3A21Z&sr=c&sp=r&sig=M4i4%2FJT8TpK1eO8RiKSvGkn1%2BzbQ5OTjvS2S4g0H%2FA0%3D)
5. Under “NFS → Common Settings → Group membership source”
6. Choose “NFS RPC and Providers”

![image-20260828-120519.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/image-20260828-120519.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A14%3A21Z&se=2026-11-08T10%3A14%3A21Z&sr=c&sp=r&sig=M4i4%2FJT8TpK1eO8RiKSvGkn1%2BzbQ5OTjvS2S4g0H%2FA0%3D)
7. Select “Create”

#### Create a DataEngine NFS view policy

1. Navigate to “Element Store → View Polices ->Create Policy”
  1. Choose the tenant (for example `de-lab-tenant`)
  2. Name the Policy (for example `de-lab-nfs-policy`)
  3. Choose Security Flavor “NFS”

![image-20260828-120701.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/image-20260828-120701.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A14%3A21Z&se=2026-11-08T10%3A14%3A21Z&sr=c&sp=r&sig=M4i4%2FJT8TpK1eO8RiKSvGkn1%2BzbQ5OTjvS2S4g0H%2FA0%3D)
2. Under “Host-Based Access → No Squash”
  1. Select “+ Add New Rule”
  2. Enter “*” in the dialog
  3. Select “ +Add Rule”
3. Under “Host-Based Access → Root Squash”
  1. Hover over “*”
  2. Select “X” - this should remove the “*” from this line.

![image-20260828-120739.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/image-20260828-120739.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A14%3A21Z&se=2026-11-08T10%3A14%3A21Z&sr=c&sp=r&sig=M4i4%2FJT8TpK1eO8RiKSvGkn1%2BzbQ5OTjvS2S4g0H%2FA0%3D)
4. Under “NFS → Common Settings → Group membership source”
  1. Choose “NFS RPC”
  2. Select “Create”

![image-20260828-120822.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/image-20260828-120822.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A14%3A21Z&se=2026-11-08T10%3A14%3A21Z&sr=c&sp=r&sig=M4i4%2FJT8TpK1eO8RiKSvGkn1%2BzbQ5OTjvS2S4g0H%2FA0%3D)

### Create a view for the container registry

It is recommended that you leverage an NFS share for the container registry’s storage.

1. Navigate to “Element Store → Views ->Create View”
  1. Choose the tenant (for example `de-lab-tenant`)
  2. Enter a Path (for example `/de-lab-docker/images`
  3. Check “Create Directory”
  4. Select the View Policy (for example `de-lab-nfs-policy`)
  5. Select Protocols “NFSv3” and “NFSv4”

![image-20260828-121210.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/image-20260828-121210.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A14%3A21Z&se=2026-11-08T10%3A14%3A21Z&sr=c&sp=r&sig=M4i4%2FJT8TpK1eO8RiKSvGkn1%2BzbQ5OTjvS2S4g0H%2FA0%3D)
  6. Select “Create”

> [!NOTE]
> ℹ️ Info
> 
> It is not necessary to create a view for the CSI Driver the driver will create views dynamically for each PVC.

### Create a DataEngine user and group

#### Create the Group

1. User Management → Local Groups → Create Local Group
2. General
  1. Name: `de-lab-group`
  2. GID: `854321`
  3. Local Provider: `de-lab-provider`
3. Select “Create”

![image-20260828-125107.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/image-20260828-125107.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A14%3A21Z&se=2026-11-08T10%3A14%3A21Z&sr=c&sp=r&sig=M4i4%2FJT8TpK1eO8RiKSvGkn1%2BzbQ5OTjvS2S4g0H%2FA0%3D)

#### Create the User

1. User Management → Local Users → Create Local User
2. General
  1. Name: `de-lab-user`
  2. Local Provider: `de-lab-provider`
  3. Leading Group: `de-lab-group`
  4. Temporary Password: `<choose-a-strong-password>`

![image-20260828-125301.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/image-20260828-125301.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A14%3A21Z&se=2026-11-08T10%3A14%3A21Z&sr=c&sp=r&sig=M4i4%2FJT8TpK1eO8RiKSvGkn1%2BzbQ5OTjvS2S4g0H%2FA0%3D)
3. Permissions Access
  1. Select tenant…: `de-lab-tenant`
  2. Verify “Allow Create Bucket” and “Allow Delete Bucket” are selected

![image-20260811-161038.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/image-20260811-161038.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A14%3A21Z&se=2026-11-08T10%3A14%3A21Z&sr=c&sp=r&sig=M4i4%2FJT8TpK1eO8RiKSvGkn1%2BzbQ5OTjvS2S4g0H%2FA0%3D)
4. Select “Create”

#### Create access and secret keys

1. User Management → Query User or Group
2. Query User
  1. Tenant: `de-lab-tenant`
  2. User Name: `de-lab-user`
3. Select “Query User”

![image-20260813-131755.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/image-20260813-131755.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A14%3A21Z&se=2026-11-08T10%3A14%3A21Z&sr=c&sp=r&sig=M4i4%2FJT8TpK1eO8RiKSvGkn1%2BzbQ5OTjvS2S4g0H%2FA0%3D)

1. Access Keys
  1. Select “Add Key”
2. Copy your Secret Key and Access Key and note them in a safe place.
3. Choose “Save”

![image-20260813-132052.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/image-20260813-132052.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A14%3A21Z&se=2026-11-08T10%3A14%3A21Z&sr=c&sp=r&sig=M4i4%2FJT8TpK1eO8RiKSvGkn1%2BzbQ5OTjvS2S4g0H%2FA0%3D)

### Grant Group DataEngine Access on Tenant

1. Element Store → Tenants
2. Right-click on the Tenant (for example `de-lab-tenant`)
  1. Choose “Edit”

![image-20260813-153902.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/image-20260813-153902.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A14%3A21Z&se=2026-11-08T10%3A14%3A21Z&sr=c&sp=r&sig=M4i4%2FJT8TpK1eO8RiKSvGkn1%2BzbQ5OTjvS2S4g0H%2FA0%3D)
3. User Access Management
  1. Users Group - Enter the group we created earlier (for example `de-lab-group`)
  2. Check both “Assign User group to Data Engine role” and “Assign Data Engine identity policy to group”
4. Choose “Update”

![image-20260813-154213.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/image-20260813-154213.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A14%3A21Z&se=2026-11-08T10%3A14%3A21Z&sr=c&sp=r&sig=M4i4%2FJT8TpK1eO8RiKSvGkn1%2BzbQ5OTjvS2S4g0H%2FA0%3D)

### Add Group to View Policy

1. Element Store → View Policies
2. Right-click on the View Policy (for example `de-lab-viewpolicy`)
  1. Choose “Edit”
3. S3
  1. Bucket listing permissions group - Enter the group we created earlier (for example `de-lab-group`)
4. Choose “Update”

![image-20260819-152359.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/image-20260819-152359.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A14%3A21Z&se=2026-11-08T10%3A14%3A21Z&sr=c&sp=r&sig=M4i4%2FJT8TpK1eO8RiKSvGkn1%2BzbQ5OTjvS2S4g0H%2FA0%3D)

## VAST CSI Driver Resources

### Enable Trash folder on the VAST Cluster (if installing CSI Driver)

1. Navigate to Settings → Cluster → General Cluster Setup and Actions
2. Make Sure “Trash Folder Access” is enabled
3. Select “Save”

![image-20260819-135214.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/image-20260819-135214.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A14%3A21Z&se=2026-11-08T10%3A14%3A21Z&sr=c&sp=r&sig=M4i4%2FJT8TpK1eO8RiKSvGkn1%2BzbQ5OTjvS2S4g0H%2FA0%3D)

### Create the CSI Tenant

1. Navigate to Element Store → Tenants → Create Tenant
  1. Fill in the tenant name (for example `de-lab-csi-tenant`)
  2. Select your Identity Provider (for example `de-lab-provider` local provider)
2. Under “Advanced Protocol Settings → NFS Settings”
  1. Enable “Trash Folder”
  2. In “Trash Folder GID” enter “0” (you MUST enter a value here)

![image-20260819-135905.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/image-20260819-135905.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A14%3A21Z&se=2026-11-08T10%3A14%3A21Z&sr=c&sp=r&sig=M4i4%2FJT8TpK1eO8RiKSvGkn1%2BzbQ5OTjvS2S4g0H%2FA0%3D)
3. Select “Create”

![image-20260819-135735.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/image-20260819-135735.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A14%3A21Z&se=2026-11-08T10%3A14%3A21Z&sr=c&sp=r&sig=M4i4%2FJT8TpK1eO8RiKSvGkn1%2BzbQ5OTjvS2S4g0H%2FA0%3D)

### Create the CSI tenant VIP pool

1. Navigate to “Network Access → Virtual IP Pools → Create Virtual IP Pool”
2. Choose the tenant (for example `de-lab-csi-tenant`)
3. Name the VIP Pool (for example `de-lab-csi-vippool`)
4. Choose Role “Protocols”
5. Enter your Subnet CIDR (for example `16`) also enter VLAN and Gateway if needed

![image-20260819-141747.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/image-20260819-141747.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A14%3A21Z&se=2026-11-08T10%3A14%3A21Z&sr=c&sp=r&sig=M4i4%2FJT8TpK1eO8RiKSvGkn1%2BzbQ5OTjvS2S4g0H%2FA0%3D)
6. In “IP Range List” enter your “Start IP and End IP” (for example `172.200.205.19` and `172.200.205.24`)

![image-20260819-141907.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/image-20260819-141907.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A14%3A21Z&se=2026-11-08T10%3A14%3A21Z&sr=c&sp=r&sig=M4i4%2FJT8TpK1eO8RiKSvGkn1%2BzbQ5OTjvS2S4g0H%2FA0%3D)
7. 
  1. **ONLY IF USING DNS:** in “DNS Configurations → Virtual IP Pool name” enter a name (for example `de-csi`)
  2. This will populate below as a FQDN (for example “DNS Service FQDN: de-lab-csi-vippool.cluster.lab.vastdata.com”

![image-20260819-142016.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/image-20260819-142016.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A14%3A21Z&se=2026-11-08T10%3A14%3A21Z&sr=c&sp=r&sig=M4i4%2FJT8TpK1eO8RiKSvGkn1%2BzbQ5OTjvS2S4g0H%2FA0%3D)
8. Select “Create”

### Create the CSI view policy

1. Navigate to “Element Store → View Polices ->Create Policy”
  1. Choose the tenant (for example `de-lab-csi-tenant`)
  2. Name the Policy (for example `de-lab-csi-policy`)
  3. Choose Security Flavor “NFS”
  4. Choose VIP Pool (for example `de-lab-csi-vippool`)

![image-20260828-120701.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/image-20260828-120701.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A14%3A21Z&se=2026-11-08T10%3A14%3A21Z&sr=c&sp=r&sig=M4i4%2FJT8TpK1eO8RiKSvGkn1%2BzbQ5OTjvS2S4g0H%2FA0%3D)
2. Under “Host-Based Access → No Squash”
  1. Select “+ Add New Rule”
  2. Enter “*” in the dialog
  3. Select “ +Add Rule”
3. Under “Host-Based Access → Root Squash”
  1. Hover over “*”
  2. Select “X” - this should remove the “*” from this line.

![image-20260828-120739.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/image-20260828-120739.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A14%3A21Z&se=2026-11-08T10%3A14%3A21Z&sr=c&sp=r&sig=M4i4%2FJT8TpK1eO8RiKSvGkn1%2BzbQ5OTjvS2S4g0H%2FA0%3D)
4. Under “NFS → Common Settings → Group membership source”
  1. Choose “NFS RPC”
  2. Select “Create”

![image-20260828-120822.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/image-20260828-120822.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A14%3A21Z&se=2026-11-08T10%3A14%3A21Z&sr=c&sp=r&sig=M4i4%2FJT8TpK1eO8RiKSvGkn1%2BzbQ5OTjvS2S4g0H%2FA0%3D)

### Create VMS roles for CSI

1. Administrators → Administrative Roles
2. Tenant Admin
  1. Create Administrative Role
  2. Change “Cluster Admin” to “Tenant Admin”
  3. Name: `de-lab-csi-tenant-admin`
  4. Choose Tenant `de-lab-csi-tenant`
  5. Select All, then Deselect Support (optional)
  6. Select “Create”

![image-20260828-124352.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/image-20260828-124352.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A14%3A21Z&se=2026-11-08T10%3A14%3A21Z&sr=c&sp=r&sig=M4i4%2FJT8TpK1eO8RiKSvGkn1%2BzbQ5OTjvS2S4g0H%2FA0%3D)
3. CSI service account
  1. Create Administrative Role
  2. Change “Cluster Admin” to “Tenant Admin”
  3. Name: `de-lab-csi-service-account`
  4. Choose Tenant `de-lab-csi-tenant`
  5. Select Logical only: Full Control (create/view/edit/delete)
  6. Select “Create”

![image-20260828-124558.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/image-20260828-124558.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A14%3A21Z&se=2026-11-08T10%3A14%3A21Z&sr=c&sp=r&sig=M4i4%2FJT8TpK1eO8RiKSvGkn1%2BzbQ5OTjvS2S4g0H%2FA0%3D)

### Create VMS manager accounts for CSI

1. Administrators → Manager → Create Manager
2. CSI Tenant Admin
  1. Name: `de-lab-csi-admin`
  2. Password: `<choose-a-strong-password>`
  3. Toggle “Password is Temporary” off
  4. User Type: Tenant Admin
  5. Select your tenant `de-lab-csi-tenant`
  6. Select Administrative role `de-lab-csi-tenant-admin`
  7. Select “Create”

![image-20260828-124812.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/image-20260828-124812.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A14%3A21Z&se=2026-11-08T10%3A14%3A21Z&sr=c&sp=r&sig=M4i4%2FJT8TpK1eO8RiKSvGkn1%2BzbQ5OTjvS2S4g0H%2FA0%3D)
3. CSI Service Account
  1. Name: `de-lab-csi-driver`
  2. Password: `<choose-a-strong-password>`
  3. Toggle “Password is Temporary” off
  4. User Type: Tenant Admin
  5. Select your tenant `de-lab-csi-tenant`
  6. Select Administrative role `de-lab-csi-service-account`
  7. Select “Create”

![image-20260828-124928.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/image-20260828-124928.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A14%3A21Z&se=2026-11-08T10%3A14%3A21Z&sr=c&sp=r&sig=M4i4%2FJT8TpK1eO8RiKSvGkn1%2BzbQ5OTjvS2S4g0H%2FA0%3D)

## Verify the VAST setup

- The DataEngine tenant and optional CSI tenant exist.
- Each tenant has the expected VIP pool and view policy.
- The DataEngine group has tenant access and bucket-listing permission.
- The generated S3 access and secret keys are stored in an approved secret manager.