Manifest Installation

If you prefer not to use Helm, you can apply the individual YAML manifests directly. The manifests below are the rendered output of the Helm chart with default values.

Tip

For most deployments, the Helm installation is simpler and easier to customize. Use raw manifests when Helm is not available or when you need to commit exact manifests to a GitOps repository.

Apply all manifests

Apply the following six resources in order. All resources are created in the kube-system namespace except the cluster-scoped objects (CSIDriver, ClusterRole, ClusterRoleBinding).

1. CSIDriver

apiVersion: storage.k8s.io/v1
kind: CSIDriver
metadata:
  name: csi.flexfs.io
spec:
  attachRequired: false
  fsGroupPolicy: None

2. ServiceAccount

apiVersion: v1
kind: ServiceAccount
metadata:
  name: flexfs-csi-controller
  namespace: kube-system

3. ClusterRole

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: flexfs-csi-controller
rules:
  - apiGroups: ["storage.k8s.io"]
    resources: ["csinodes"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["events"]
    verbs: ["create", "list", "patch", "update", "watch"]
  - apiGroups: [""]
    resources: ["nodes"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["persistentvolumeclaims"]
    verbs: ["get", "list", "update", "watch"]
  - apiGroups: [""]
    resources: ["persistentvolumes"]
    verbs: ["create", "delete", "get", "list", "watch"]
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get", "list"]
  - apiGroups: ["storage.k8s.io"]
    resources: ["storageclasses"]
    verbs: ["get", "list", "watch"]

4. ClusterRoleBinding

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: flexfs-csi-controller
subjects:
  - kind: ServiceAccount
    name: flexfs-csi-controller
    namespace: kube-system
roleRef:
  kind: ClusterRole
  name: flexfs-csi-controller
  apiGroup: rbac.authorization.k8s.io

5. Controller Deployment

apiVersion: apps/v1
kind: Deployment
metadata:
  name: flexfs-csi-controller
  namespace: kube-system
spec:
  replicas: 2
  selector:
    matchLabels:
      app: flexfs-csi-controller
  template:
    metadata:
      labels:
        app: flexfs-csi-controller
    spec:
      serviceAccountName: flexfs-csi-controller
      priorityClassName: system-cluster-critical
      tolerations:
        - key: "CriticalAddonsOnly"
          operator: "Exists"
      nodeSelector:
        kubernetes.io/os: linux
      containers:
        - name: flexfs-csi-driver
          image: flexfs/csi-driver-1.9:latest
          imagePullPolicy: Always
          volumeMounts:
            - name: driver-dir
              mountPath: /csi
        - name: csi-provisioner
          image: registry.k8s.io/sig-storage/csi-provisioner:v3.6.4
          args:
            - "--csi-address=/csi/csi.sock"
            - "--leader-election=true"
            - "--leader-election-namespace=$(POD_NAMESPACE)"
          env:
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
          volumeMounts:
            - name: driver-dir
              mountPath: /csi
      volumes:
        - name: driver-dir
          emptyDir: {}

6. Node DaemonSet

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: flexfs-csi-node
  namespace: kube-system
spec:
  updateStrategy:
    type: OnDelete
  selector:
    matchLabels:
      app: flexfs-csi-node
  template:
    metadata:
      labels:
        app: flexfs-csi-node
    spec:
      priorityClassName: system-node-critical
      nodeSelector:
        kubernetes.io/os: linux
      containers:
        - name: flexfs-csi-driver
          image: flexfs/csi-driver-1.9:latest
          imagePullPolicy: Always
          securityContext:
            privileged: true
          volumeMounts:
            - name: driver-dir
              mountPath: /csi
            - name: kubelet-dir
              mountPath: /var/lib/kubelet
              mountPropagation: Bidirectional
        - name: csi-node-driver-registrar
          image: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.10.1
          args:
            - "--csi-address=/csi/csi.sock"
            - "--kubelet-registration-path=/var/lib/kubelet/plugins/csi.flexfs.io/csi.sock"
          volumeMounts:
            - name: driver-dir
              mountPath: /csi
            - name: registration-dir
              mountPath: /registration
      tolerations:
        - operator: Exists
      volumes:
        - name: driver-dir
          hostPath:
            path: /var/lib/kubelet/plugins/csi.flexfs.io
            type: DirectoryOrCreate
        - name: kubelet-dir
          hostPath:
            path: /var/lib/kubelet
            type: Directory
        - name: registration-dir
          hostPath:
            path: /var/lib/kubelet/plugins_registry
            type: Directory

Applying everything at once

Save all six manifests into a single file (separated by ---) or a directory, then apply:

kubectl apply -f flexfs-csi-manifests.yaml

Or if using a directory:

kubectl apply -f ./flexfs-csi-manifests/

Verifying the installation

# Check that the CSIDriver is registered
kubectl get csidriver csi.flexfs.io

# Check controller pods
kubectl get pods -n kube-system -l app=flexfs-csi-controller

# Check node pods (one per node)
kubectl get pods -n kube-system -l app=flexfs-csi-node

Removing the driver

kubectl delete -f flexfs-csi-manifests.yaml

Next steps

• Dynamic provisioning (Enterprise)
• Static provisioning
• Configuration reference