Manifest Installation

If you prefer not to use Helm, you can apply the individual YAML manifests directly. The manifests below are the rendered output of the Helm chart with default values.

Tip

For most deployments, the Helm installation is simpler and easier to customize. Use raw manifests when Helm is not available or when you need to commit exact manifests to a GitOps repository.

The same manifests, rendered with default values, are published as a single file. To apply them directly:

kubectl apply -f https://get.flexfs.io/v1.9.x/k8s/csi.yaml

To use non-default values, render the manifests yourself from the published chart instead. Download and extract it (see Download the chart), then:

helm template flexfs-csi-driver ./flexfs-csi-driver --namespace kube-system > flexfs-csi-manifests.yaml

Pass --set flags (for example --set kubeletDir=/var/snap/microk8s/common/var/lib/kubelet) to helm template exactly as you would for helm install.

Apply all manifests

Apply the following six resources in order. All resources are created in the kube-system namespace except the cluster-scoped objects (CSIDriver, ClusterRole, ClusterRoleBinding).

1. CSIDriver

apiVersion: storage.k8s.io/v1
kind: CSIDriver
metadata:
  name: csi.flexfs.io
spec:
  attachRequired: false
  fsGroupPolicy: None

2. ServiceAccount

apiVersion: v1
kind: ServiceAccount
metadata:
  name: flexfs-csi-controller
  namespace: kube-system

3. ClusterRole

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: flexfs-csi-controller
rules:
  - apiGroups: ["coordination.k8s.io"]
    resources: ["leases"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - apiGroups: ["storage.k8s.io"]
    resources: ["csinodes"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["events"]
    verbs: ["create", "list", "patch", "update", "watch"]
  - apiGroups: [""]
    resources: ["nodes"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["persistentvolumeclaims"]
    verbs: ["get", "list", "patch", "update", "watch"]
  - apiGroups: [""]
    resources: ["persistentvolumeclaims/status"]
    verbs: ["patch", "update"]
  - apiGroups: [""]
    resources: ["persistentvolumes"]
    verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get", "list"]
  - apiGroups: ["storage.k8s.io"]
    resources: ["storageclasses"]
    verbs: ["get", "list", "watch"]

4. ClusterRoleBinding

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: flexfs-csi-controller
subjects:
  - kind: ServiceAccount
    name: flexfs-csi-controller
    namespace: kube-system
roleRef:
  kind: ClusterRole
  name: flexfs-csi-controller
  apiGroup: rbac.authorization.k8s.io

5. Controller Deployment

apiVersion: apps/v1
kind: Deployment
metadata:
  name: flexfs-csi-controller
  namespace: kube-system
spec:
  replicas: 2
  selector:
    matchLabels:
      app: flexfs-csi-controller
  template:
    metadata:
      labels:
        app: flexfs-csi-controller
    spec:
      serviceAccountName: flexfs-csi-controller
      priorityClassName: system-cluster-critical
      tolerations:
        - key: CriticalAddonsOnly
          operator: Exists
      nodeSelector:
        kubernetes.io/os: linux
      containers:
        - name: flexfs-csi-driver
          image: flexfs/csi-driver-1.9:latest
          imagePullPolicy: Always
          volumeMounts:
            - name: driver-dir
              mountPath: /csi
        - name: csi-provisioner
          image: registry.k8s.io/sig-storage/csi-provisioner:v3.6.4
          args:
            - "--csi-address=/csi/csi.sock"
            - "--leader-election=true"
            - "--leader-election-namespace=$(POD_NAMESPACE)"
          env:
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
          volumeMounts:
            - name: driver-dir
              mountPath: /csi
        - name: csi-resizer
          image: registry.k8s.io/sig-storage/csi-resizer:v1.10.1
          args:
            - "--csi-address=/csi/csi.sock"
            - "--leader-election=true"
            - "--leader-election-namespace=$(POD_NAMESPACE)"
          env:
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
          volumeMounts:
            - name: driver-dir
              mountPath: /csi
      volumes:
        - name: driver-dir
          emptyDir: {}

Note

csi-resizer is what performs a PVC resize; the driver only implements the call it makes. Omit it and a resize sits at “waiting for an external controller to expand this PVC”. The leases rule is equally essential: both sidecars use leader election, and without it neither ever starts work.

6. Node DaemonSet

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: flexfs-csi-node
  namespace: kube-system
spec:
  updateStrategy:
    type: OnDelete
  selector:
    matchLabels:
      app: flexfs-csi-node
  template:
    metadata:
      labels:
        app: flexfs-csi-node
    spec:
      priorityClassName: system-node-critical
      nodeSelector:
        kubernetes.io/os: linux
      containers:
        - name: flexfs-csi-driver
          image: flexfs/csi-driver-1.9:latest
          imagePullPolicy: Always
          args:
            - "--kubeletDir=/var/lib/kubelet"
          securityContext:
            privileged: true
          volumeMounts:
            - name: driver-dir
              mountPath: /csi
            - name: kubelet-dir
              mountPath: /var/lib/kubelet
              mountPropagation: Bidirectional
        - name: csi-node-driver-registrar
          image: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.10.1
          args:
            - "--csi-address=/csi/csi.sock"
            - "--kubelet-registration-path=/var/lib/kubelet/plugins/csi.flexfs.io/csi.sock"
          volumeMounts:
            - name: driver-dir
              mountPath: /csi
            - name: registration-dir
              mountPath: /registration
      tolerations:
        - operator: Exists
      volumes:
        - name: driver-dir
          hostPath:
            path: /var/lib/kubelet/plugins/csi.flexfs.io
            type: DirectoryOrCreate
        - name: kubelet-dir
          hostPath:
            path: /var/lib/kubelet
            type: Directory
        - name: registration-dir
          hostPath:
            path: /var/lib/kubelet/plugins_registry
            type: Directory

Caution

These manifests assume the default kubelet root directory, /var/lib/kubelet. If your kubelet uses a custom --root-dir (for example MicroK8s, which uses /var/snap/microk8s/common/var/lib/kubelet), you must replace every occurrence of /var/lib/kubelet above — the --kubeletDir argument, the kubelet-dir mountPath, the --kubelet-registration-path, and all three hostPath entries. All of them must point at the real kubelet root, or per-pod bind mounts will silently fail to reach the pod. See MicroK8s and custom kubelet directories for details.

Applying everything at once

Save all six manifests into a single file (separated by ---) or a directory, then apply:

kubectl apply -f flexfs-csi-manifests.yaml

Or if using a directory:

kubectl apply -f ./flexfs-csi-manifests/

Upgrading

Follow the Helm upgrade procedure, which applies to manifest installations as well, with these commands in place of its chart upgrade in Step 2:

kubectl -n kube-system delete statefulset flexfs-csi-controller --ignore-not-found
kubectl apply -f https://get.flexfs.io/v1.9.x/k8s/csi.yaml

The first command removes the controller StatefulSet that installations earlier than v1.8.56 use. kubectl apply does not remove it, and leaving it in place runs two controllers side by side. If you render your own manifests, apply those in place of the published file.

Everything else in the procedure is unchanged: set the node DaemonSet to OnDelete beforehand, restart the node plugin one node at a time, and verify.

Verifying the installation

# Check that the CSIDriver is registered
kubectl get csidriver csi.flexfs.io

# Check controller pods
kubectl get pods -n kube-system -l app=flexfs-csi-controller

# Check node pods (one per node)
kubectl get pods -n kube-system -l app=flexfs-csi-node

Removing the driver

kubectl delete -f flexfs-csi-manifests.yaml

Next steps

• Dynamic provisioning (Enterprise)
• Static provisioning
• Configuration reference