aws-efs-csi-driver
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
Compare:
1
# Default values for aws-efs-csi-driver.
2
# This is a YAML-formatted file.
3
# Declare variables to be passed into your templates.
4
5
nameOverride: ""
6
fullnameOverride: ""
7
useFIPS: false
8
portRangeUpperBound: "21049"
9
debugLogs: false
10
image:
11
repository: cgr.dev/chainguard-private/aws-efs-csi-driver-fips
12
tag: 3.5.4-r0@sha256:13ce3f57e1db043e5f5ec51d8ea5ba2adce54e3e397debeae8ddbaec827b2166
13
pullPolicy: IfNotPresent
14
sidecars:
15
livenessProbe:
16
image:
17
repository: cgr.dev/chainguard-private/kubernetes-csi-livenessprobe-fips
18
tag: 2.20.0-r5@sha256:9c2b23e2ab16e5ea1bf940569c7a409c30af67232e50cf95a644f65195095035
19
pullPolicy: IfNotPresent
20
resources: {}
21
securityContext:
22
readOnlyRootFilesystem: true
23
allowPrivilegeEscalation: false
24
nodeDriverRegistrar:
25
image:
26
repository: cgr.dev/chainguard-private/kubernetes-csi-node-driver-registrar-fips
27
tag: 2.18.0-r5@sha256:d8fe100b5d827d65444b86dad9e0b3e486b7a7249fe5583a762b9fd69de9d2d8
28
pullPolicy: IfNotPresent
29
resources: {}
30
securityContext:
31
readOnlyRootFilesystem: true
32
allowPrivilegeEscalation: false
33
csiProvisioner:
34
image:
35
repository: cgr.dev/chainguard-private/kubernetes-csi-external-provisioner-fips
36
tag: 6.4.0-r4@sha256:010bc786a1ff010dbcc64562edb9c854cea9b2dd263aae60ace8fd12a3c3f056
37
pullPolicy: IfNotPresent
38
resources: {}
39
securityContext:
40
readOnlyRootFilesystem: true
41
allowPrivilegeEscalation: false
42
additionalArgs: []
43
env: []
44
imagePullSecrets: []
45
## Controller deployment variables
46
controller:
47
# Specifies whether a deployment should be created
48
create: true
49
# Name of the CSI controller service
50
name: efs-csi-controller
51
# Number of replicas for the CSI controller service deployment
52
replicaCount: 2
53
# enableMetrics enables the Prometheus metrics endpoint on the controller.
54
# When true, the driver exposes metrics on port 3301.
55
enableMetrics: false
56
# enablePrometheusAnnotations adds prometheus.io scrape annotations to the controller pod.
57
enablePrometheusAnnotations: true
58
# serviceMonitor controls creation of Prometheus Operator ServiceMonitor resources.
59
# Requires the Prometheus Operator CRDs to be installed.
60
serviceMonitor:
61
enabled: false
62
# Number for the log level verbosity
63
logLevel: 2
64
# If set, add pv/pvc metadata to plugin create requests as parameters.
65
extraCreateMetadata: true
66
# Add additional tags to access points.
67
# NOTE: Custom tags require the controller's IAM policy to allow the extra tag
68
# keys on elasticfilesystem:CreateAccessPoint. The AWS-managed
69
# AmazonEFSCSIDriverPolicy only permits the default efs.csi.aws.com/cluster tag
70
# key, so custom tags will cause access point creation to fail (PVCs stuck in
71
# Pending) unless you attach a custom policy. See docs/install.md
72
# ("Custom tags require additional IAM permissions").
73
tags: {}
74
# environment: prod
75
# region: us-east-1
76
# Enable if you want the controller to also delete the
77
# path on efs when deleteing an access point
78
deleteAccessPointRootDir: false
79
podAnnotations: {}
80
podLabels: {}
81
# Replaces the selector of the controller Deployment, PodDisruptionBudget,
82
# and metrics Service, and adds these labels to its pods. Selectors cannot
83
# change, so set this to an existing Deployment's selector to adopt it.
84
selectorLabelsOverride: {}
85
hostNetwork: false
86
priorityClassName: system-cluster-critical
87
dnsPolicy: ClusterFirst
88
dnsConfig: {}
89
additionalLabels: {}
90
resources: {}
91
# We usually recommend not to specify default resources and to leave this as a conscious
92
# choice for the user. This also increases chances charts run on environments with little
93
# resources, such as Minikube. If you do want to specify resources, uncomment the following
94
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
95
# limits:
96
# cpu: 100m
97
# memory: 128Mi
98
# requests:
99
# cpu: 100m
100
# memory: 128Mi
101
revisionHistoryLimit: 10
102
nodeSelector: {}
103
tolerations:
104
- key: CriticalAddonsOnly
105
operator: Exists
106
- key: efs.csi.aws.com/agent-not-ready
107
operator: Exists
108
affinity: {}
109
env: []
110
volumes: []
111
volumeMounts: []
112
socketDirVolume:
113
emptyDir: {}
114
# Specifies whether a service account should be created
115
serviceAccount:
116
create: true
117
name: efs-csi-controller-sa
118
annotations: {}
119
## Enable if EKS IAM for SA is used
120
# eks.amazonaws.com/role-arn: arn:aws:iam::111122223333:role/efs-csi-role
121
healthPort: 9909
122
regionalStsEndpoints: false
123
# Liveness probe configuration for the controller
124
livenessProbe:
125
httpGet:
126
path: /healthz
127
port: healthz
128
initialDelaySeconds: 10
129
timeoutSeconds: 3
130
periodSeconds: 10
131
failureThreshold: 5
132
# Readiness probe configuration for the controller (optional)
133
readinessProbe: {}
134
# httpGet:
135
# path: /healthz
136
# port: healthz
137
# initialDelaySeconds: 10
138
# timeoutSeconds: 3
139
# periodSeconds: 10
140
# failureThreshold: 3
141
# Startup probe configuration for the controller (optional)
142
startupProbe: {}
143
# httpGet:
144
# path: /healthz
145
# port: healthz
146
# initialDelaySeconds: 10
147
# timeoutSeconds: 3
148
# periodSeconds: 10
149
# failureThreshold: 30
150
# Pod Disruption Budget
151
podDisruptionBudget:
152
enabled: false
153
# Set only one of maxUnavailable and minAvailable. If neither is set,
154
# the chart renders minAvailable: 1.
155
# maxUnavailable: 1
156
minAvailable: null
157
unhealthyPodEvictionPolicy: IfHealthyBudget
158
# securityContext on the controller pod
159
securityContext:
160
runAsNonRoot: false
161
runAsUser: 0
162
runAsGroup: 0
163
fsGroup: 0
164
# securityContext on the controller container
165
# Setting privileged=false will cause the "delete-access-point-root-dir" controller option to fail
166
containerSecurityContext:
167
privileged: true
168
leaderElectionRenewDeadline: 10s
169
leaderElectionLeaseDuration: 15s
170
# Timeout for Create/DeleteVolume calls to Controller. We recommend increasing for high concurrency workloads
171
timeout: 15s
172
# Number of concurrent threads controller will handle at once.
173
workerThreads: 100
174
# TSCs without the label selector stanza
175
#
176
# Example:
177
#
178
# topologySpreadConstraints:
179
# - maxSkew: 1
180
# topologyKey: topology.kubernetes.io/zone
181
# whenUnsatisfiable: ScheduleAnyway
182
# - maxSkew: 1
183
# topologyKey: kubernetes.io/hostname
184
# whenUnsatisfiable: ScheduleAnyway
185
topologySpreadConstraints: []
186
# Enable reading filesystem IDs from configmap/secret
187
fileSystemIdRefs:
188
enabled: false
189
# rollingUpdate for controller deployment strategy
190
rollingUpdate: {}
191
# maxUnavailable: 1
192
# maxSurge: 1
193
## Node daemonset variables
194
node:
195
# Number for the log level verbosity
196
logLevel: 2
197
volMetricsOptIn: false
198
volMetricsRefreshPeriod: 240
199
volMetricsFsRateLimit: 5
200
hostAliases: {}
201
# For cross VPC EFS, you need to poison or overwrite the DNS for the efs volume as per
202
# https://docs.aws.amazon.com/efs/latest/ug/efs-different-vpc.html#wt6-efs-utils-step3
203
# implementing the suggested solution found here:
204
# https://github.com/kubernetes-sigs/aws-efs-csi-driver/issues/240#issuecomment-676849346
205
# EFS Vol ID, IP, Region
206
# "fs-01234567":
207
# ip: 10.10.2.2
208
# region: us-east-2
209
priorityClassName: system-node-critical
210
dnsPolicy: ClusterFirst
211
dnsConfig: {}
212
# Example config which uses the AWS nameservers
213
# dnsPolicy: "None"
214
# dnsConfig:
215
# nameservers:
216
# - 169.254.169.253
217
podLabels: {}
218
# Replaces the selector of the node DaemonSet and adds these labels to its
219
# pods. Selectors cannot change, so set this to an existing DaemonSet's
220
# selector to adopt it.
221
selectorLabelsOverride: {}
222
podAnnotations: {}
223
additionalLabels: {}
224
resources: {}
225
# limits:
226
# cpu: 100m
227
# memory: 128Mi
228
# requests:
229
# cpu: 100m
230
# memory: 128Mi
231
revisionHistoryLimit: 10
232
nodeSelector: {}
233
tolerations:
234
- operator: Exists
235
affinity:
236
nodeAffinity:
237
requiredDuringSchedulingIgnoredDuringExecution:
238
nodeSelectorTerms:
239
- matchExpressions:
240
- key: eks.amazonaws.com/compute-type
241
operator: NotIn
242
values:
243
- fargate
244
- hybrid
245
# Specifies whether a service account should be created
246
serviceAccount:
247
create: true
248
name: efs-csi-node-sa
249
annotations: {}
250
## Enable if EKS IAM for SA is used
251
# eks.amazonaws.com/role-arn: arn:aws:iam::111122223333:role/efs-csi-role
252
# Disable mutating permissions for the node service account.
253
# When disableMutation is true, some features of the EFS CSI Driver node pods will not function, such as taint removal.
254
# Primarily useful in particularly security-sensitive environments, or on multi-tenant clusters that isolate tenants by node.
255
disableMutation: false
256
healthPort: 9809
257
# Liveness probe configuration for the node
258
livenessProbe:
259
httpGet:
260
path: /healthz
261
port: healthz
262
initialDelaySeconds: 10
263
timeoutSeconds: 3
264
periodSeconds: 2
265
failureThreshold: 5
266
# Readiness probe configuration for the node (optional)
267
readinessProbe: {}
268
# httpGet:
269
# path: /healthz
270
# port: healthz
271
# initialDelaySeconds: 10
272
# timeoutSeconds: 3
273
# periodSeconds: 2
274
# failureThreshold: 3
275
# Startup probe configuration for the node (optional)
276
startupProbe: {}
277
# httpGet:
278
# path: /healthz
279
# port: healthz
280
# initialDelaySeconds: 10
281
# timeoutSeconds: 3
282
# periodSeconds: 2
283
# failureThreshold: 30
284
# securityContext on the node pod
285
securityContext:
286
# The node pod must be run as root to bind to the registration/driver sockets
287
runAsNonRoot: false
288
runAsUser: 0
289
runAsGroup: 0
290
fsGroup: 0
291
env: []
292
volumes: []
293
volumeMounts: []
294
kubeletPath: /var/lib/kubelet
295
# rollingUpdate for node deamonset updateStrategy.
296
rollingUpdate: {}
297
# maxSurge: 0
298
# maxUnavailable: 20%
299
300
# Comma-separated section:key=value overrides for efs-utils.conf.
301
# Example: "mount-watchdog:stunnel_health_check_interval_min=1,mount-watchdog:tls_cert_renewal_interval_min=30"
302
efsUtilsConfOverrides: ""
303
# Comma-separated section:key=value overrides for s3files-utils.conf.
304
# Example: "proxy:read_bypass_denylist_size=20000"
305
s3filesUtilsConfOverrides: ""
306
storageClasses: []
307
# Add StorageClass resources like:
308
# - name: efs-sc
309
# annotations:
310
# # Use that annotation if you want this to your default storageclass
311
# storageclass.kubernetes.io/is-default-class: "true"
312
# parameters:
313
# provisioningMode: efs-ap
314
# fileSystemId: fs-1122aabb
315
# directoryPerms: "700"
316
# gidRangeStart: "1000"
317
# gidRangeEnd: "2000"
318
# basePath: "/dynamic_provisioning"
319
# subPathPattern: "/subPath"
320
# ensureUniqueDirectory: true
321
# reclaimPolicy: Delete
322
# volumeBindingMode: Immediate
323
324
# Specifies whether to use helm hooks to apply the CSI driver
325
useHelmHooksForCSIDriver: true
326
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.