Configuration Reference

CSI driver flags

The csi.flexfs start command accepts the following flags:

Flag	Type	Default	Description
--bindAddr	string	unix:///csi/csi.sock	Address to bind the CSI gRPC socket. Must use the unix:// scheme.
--kubeletDir	string	/var/lib/kubelet	Kubelet root directory on the host. Must match the node’s real kubelet --root-dir; the driver builds its FUSE base mounts under {kubeletDir}/flexfs.
--verbose, -v	bool	false	Enable verbose logging.

Secret fields

The Kubernetes Secret referenced by PersistentVolumes and StorageClasses supports the following fields in stringData:

Field	Required	Description
adminAddr	Yes	Address of the admin server (e.g., admin.example.com:443). For Community edition, use the free server address.
token	Yes	Account token for authenticating with the admin server.
secret	No	Encryption secret for volumes with end-to-end encryption enabled.

Example

apiVersion: v1
kind: Secret
metadata:
  name: flexfs-secret
  namespace: default
stringData:
  adminAddr: admin.example.com:443
  token: $TOKEN
  secret: $SECRET

StorageClass parameters

When using dynamic provisioning, the following parameters can be set on the StorageClass to control how new volumes are created:

Required secret references

Parameter	Description
csi.storage.k8s.io/provisioner-secret-namespace	Namespace of the Secret used for volume creation, deletion, and expansion.
csi.storage.k8s.io/provisioner-secret-name	Name of that Secret.
csi.storage.k8s.io/node-publish-secret-namespace	Namespace of the Secret used for mounting (node operations).
csi.storage.k8s.io/node-publish-secret-name	Name of that Secret.
csi.storage.k8s.io/controller-expand-secret-namespace	Namespace of the Secret used for volume expansion. Required if you enable allowVolumeExpansion.
csi.storage.k8s.io/controller-expand-secret-name	Name of that Secret.

Use these prefixed names. The provisioner sidecar also accepts unprefixed equivalents (csiProvisionerSecretName, csiNodePublishSecretName, and their namespace counterparts), but it treats those as deprecated: it logs a warning and passes them to the driver as ordinary parameters rather than consuming them.

Placing the volume (required)

A StorageClass must tell the admin server where to put the volume, in one of two ways:

• provider + region — the admin server picks a matching block store and metadata store. blockAPI is inferred for provider: aws and must be given otherwise.
• metaStore + blockStore — explicit IDs, which bypass the lookup.

A StorageClass with neither combination is rejected: CreateVolume returns failed to create volume ... statusCode: 400, and the claim stays Pending with a ProvisioningFailed event. Note that provider and region are the parameter names — not providerCode/regionCode, which are block-store fields in configure.flexfs and are ignored here.

Volume creation parameters

Parameter	Type	Default	Description
blockAPI	string	(auto)	Block storage API code (e.g., s3, gcs, azure, oci).
blockSize	string	4Mi	Block size. Accepts human-readable values: 256Ki, 512Ki, 1Mi, 2Mi, 4Mi, 8Mi, or raw byte values (262144, 524288, 1048576, 2097152, 4194304, 8388608).
blockStore	string	(auto)	Block store ID (integer).
compression	string	true	Enable block compression. Accepts true/false/yes/no.
compressionAlgo	string	(lz4)	Compression algorithm: lz4 or zstd. Setting this implicitly enables compression.
encryption	string	false	Enable end-to-end encryption. Requires a secret in the referenced Secret.
flags	string	(none)	Volume-level mount flags (e.g., ro,noatime).
maxInodes	string	(unlimited)	Inode quota for the volume. A claim only expresses bytes, so an inode cap has to be stated here. Exceeding it fails with ENOSPC.
metaStore	string	(auto)	Metadata store ID (integer).
notes	string	(none)	Descriptive notes for the volume.
provider	string	(auto)	Provider code (e.g., aws, gcp, azure, oci).
proxyGroup	string	(none)	Proxy group ID or auto for automatic selection.
region	string	(auto)	Region code (e.g., us-east-1).
retention	string	(none)	Data retention period in seconds. Controls how long deleted data is preserved for time-travel.

Example StorageClass

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: flexfs-genomics
provisioner: csi.flexfs.io
allowVolumeExpansion: true
parameters:
  csi.storage.k8s.io/provisioner-secret-namespace: default
  csi.storage.k8s.io/provisioner-secret-name: flexfs-secret
  csi.storage.k8s.io/node-publish-secret-namespace: default
  csi.storage.k8s.io/node-publish-secret-name: flexfs-secret
  csi.storage.k8s.io/controller-expand-secret-namespace: default
  csi.storage.k8s.io/controller-expand-secret-name: flexfs-secret
  provider: aws
  region: us-east-1
  blockSize: 4Mi
  compression: "true"
  compressionAlgo: lz4

Mount option passthrough

Mount options can be passed to the underlying mount.flexfs process via the mountOptions field on a PersistentVolume:

spec:
  mountOptions:
    - acl
    - xattr
    - rootsquash
    - verbose

Caution

The following options are managed by the CSI driver and are silently ignored if specified: noremount, noupdate, credsfile, logfile. The ro flag is controlled by the pod’s persistentVolumeClaim.readOnly field instead.

Option names are normalized to lowercase with hyphens removed before being passed to mount.flexfs via the -o flag; option values are passed through exactly as written, so case- and hyphen-sensitive values such as an atTime timestamp are preserved.

Next steps

• CSI Driver Overview
• Dynamic provisioning
• Static provisioning
• Troubleshooting