aws-ebs-csi-driver
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
1
# Default values for aws-ebs-csi-driver.
2
# This is a YAML-formatted file.
3
# Declare variables to be passed into your templates.
4
5
image:
6
repository: cgr.dev/chainguard-private/aws-ebs-csi-driver
7
# Overrides the image tag whose default is v{{ .Chart.AppVersion }}
8
tag: latest@sha256:79ac54be77a627428ab18f00f023ca2c143efc544e4dad864f1b5b192a17805e
9
pullPolicy: IfNotPresent
10
# -- Custom labels to add into metadata
11
customLabels: {}
12
# k8s-app: aws-ebs-csi-driver
13
14
# Enable FIPS 140-3 mode: activates the Go Cryptographic Module (CMVP #5247) at runtime and
15
# instructs the AWS SDK to use FIPS endpoints via AWS_USE_FIPS_ENDPOINT.
16
# See docs/fips.md for details.
17
fips: false
18
sidecars:
19
provisioner:
20
env: []
21
image:
22
pullPolicy: IfNotPresent
23
repository: cgr.dev/chainguard-private/kubernetes-csi-external-provisioner
24
tag: latest@sha256:858cfd338b8a205c69dc12c971d6bd9507ee593ffdbf7fbe250a33e407cf369a
25
logLevel: 2
26
# Additional parameters provided by csi-provisioner.
27
additionalArgs: []
28
# Grant additional permissions to csi-provisioner
29
additionalClusterRoleRules:
30
resources: {}
31
# Tune leader lease election for csi-provisioner.
32
# Leader election is on by default.
33
leaderElection:
34
enabled: true
35
# Optional values to tune lease behavior.
36
# The arguments provided must be in an acceptable time.ParseDuration format.
37
# Ref: https://pkg.go.dev/flag#Duration
38
# leaseDuration: "15s"
39
# renewDeadline: "10s"
40
# retryPeriod: "5s"
41
securityContext:
42
seccompProfile:
43
type: RuntimeDefault
44
readOnlyRootFilesystem: true
45
allowPrivilegeEscalation: false
46
attacher:
47
env: []
48
image:
49
pullPolicy: IfNotPresent
50
repository: cgr.dev/chainguard-private/kubernetes-csi-external-attacher
51
tag: latest@sha256:64f5862646961b309f58a5ef7423377acbf25d142cc6ed43053455b127c5e700
52
# Tune leader lease election for csi-attacher.
53
# Leader election is on by default.
54
leaderElection:
55
enabled: true
56
# Optional values to tune lease behavior.
57
# The arguments provided must be in an acceptable time.ParseDuration format.
58
# Ref: https://pkg.go.dev/flag#Duration
59
# leaseDuration: "15s"
60
# renewDeadline: "10s"
61
# retryPeriod: "5s"
62
logLevel: 2
63
# Additional parameters provided by csi-attacher.
64
additionalArgs: []
65
# Grant additional permissions to csi-attacher
66
additionalClusterRoleRules: []
67
resources: {}
68
securityContext:
69
seccompProfile:
70
type: RuntimeDefault
71
readOnlyRootFilesystem: true
72
allowPrivilegeEscalation: false
73
snapshotter:
74
# Enables the snapshotter sidecar even if the snapshot CRDs are not installed
75
forceEnable: false
76
env: []
77
image:
78
pullPolicy: IfNotPresent
79
repository: cgr.dev/chainguard-private/kubernetes-csi-external-snapshotter
80
tag: latest@sha256:908e9a17f84d1e52afd027cb22f911535980142649f056c250b285e1659704cc
81
logLevel: 2
82
# Additional parameters provided by csi-snapshotter.
83
additionalArgs: []
84
# Grant additional permissions to csi-snapshotter
85
additionalClusterRoleRules: []
86
resources: {}
87
securityContext:
88
seccompProfile:
89
type: RuntimeDefault
90
readOnlyRootFilesystem: true
91
allowPrivilegeEscalation: false
92
metadataLabeler:
93
# ALPHA: Enable the metadata-labeler sidecar to label Kubernetes Nodes with
94
# information from the EC2 API (e.g. number of ENIs)
95
# Also requires using metadata-labeler as the node's metadata source
96
enabled: false
97
logLevel: 2
98
# Additional parameters provided by metadataLabeler.
99
additionalArgs: []
100
resources: {}
101
securityContext:
102
readOnlyRootFilesystem: true
103
allowPrivilegeEscalation: false
104
livenessProbe:
105
image:
106
pullPolicy: IfNotPresent
107
repository: cgr.dev/chainguard-private/kubernetes-csi-livenessprobe
108
tag: latest@sha256:e8be58a0e72ca9afa628749822e34fcf714a63695a246bbb5c225e212b438132
109
# Additional parameters provided by livenessprobe.
110
additionalArgs: []
111
resources: {}
112
securityContext:
113
readOnlyRootFilesystem: true
114
allowPrivilegeEscalation: false
115
resizer:
116
env: []
117
image:
118
pullPolicy: IfNotPresent
119
repository: cgr.dev/chainguard-private/kubernetes-csi-external-resizer
120
tag: latest@sha256:0ff6a9906253dd77be15f38a3914cb6c734afeae5604ef8dcbdda6dbc6ab19ef
121
# Tune leader lease election for csi-resizer.
122
# Leader election is on by default.
123
leaderElection:
124
enabled: true
125
# Optional values to tune lease behavior.
126
# The arguments provided must be in an acceptable time.ParseDuration format.
127
# Ref: https://pkg.go.dev/flag#Duration
128
# leaseDuration: "15s"
129
# renewDeadline: "10s"
130
# retryPeriod: "5s"
131
logLevel: 2
132
# Additional parameters provided by csi-resizer.
133
additionalArgs: []
134
# Grant additional permissions to csi-resizer
135
additionalClusterRoleRules: []
136
resources: {}
137
securityContext:
138
seccompProfile:
139
type: RuntimeDefault
140
readOnlyRootFilesystem: true
141
allowPrivilegeEscalation: false
142
nodeDriverRegistrar:
143
env: []
144
image:
145
pullPolicy: IfNotPresent
146
repository: cgr.dev/chainguard-private/kubernetes-csi-node-driver-registrar
147
tag: latest@sha256:9b28d0c15faa56b3a700ea07681dea87423ef465450cf162364289492b965068
148
logLevel: 2
149
# The port the health probe is bound to.
150
healthPort: 9809
151
# Additional parameters provided by node-driver-registrar.
152
additionalArgs: []
153
resources: {}
154
securityContext:
155
readOnlyRootFilesystem: true
156
allowPrivilegeEscalation: false
157
livenessProbe:
158
httpGet:
159
path: /healthz
160
port: healthz-ndr
161
initialDelaySeconds: 30
162
periodSeconds: 90
163
timeoutSeconds: 15
164
volumemodifier:
165
env: []
166
image:
167
pullPolicy: IfNotPresent
168
repository: cgr.dev/chainguard-private/aws-volume-modifier-for-k8s
169
tag: latest@sha256:7ab90d92daf54b076932ef3c2e243f52cb4d4920b8083cd6e8389b046980b0b9
170
leaderElection:
171
enabled: true
172
# Optional values to tune lease behavior.
173
# The arguments provided must be in an acceptable time.ParseDuration format.
174
# Ref: https://pkg.go.dev/flag#Duration
175
# leaseDuration: "15s"
176
# renewDeadline: "10s"
177
# retryPeriod: "5s"
178
logLevel: 2
179
# Additional parameters provided by volume-modifier-for-k8s.
180
additionalArgs: []
181
resources: {}
182
# Add additional volume mounts on the volumemodifier container with sidecars.volumemodifier.volumeMounts
183
volumeMounts: []
184
# And add mount paths for those additional volumes:
185
# - name: custom-dir
186
# mountPath: /mount/path
187
securityContext:
188
seccompProfile:
189
type: RuntimeDefault
190
readOnlyRootFilesystem: true
191
allowPrivilegeEscalation: false
192
proxy:
193
http_proxy:
194
no_proxy:
195
imagePullSecrets: []
196
nameOverride:
197
fullnameOverride:
198
awsAccessSecret:
199
name: aws-secret
200
keyId: key_id
201
accessKey: access_key
202
controller:
203
batching: true
204
volumeModificationFeature:
205
enabled: false
206
# Enable support for node-local volumes that use pre-attached EBS volumes
207
enableNodeLocalVolumes: false
208
# Additional parameters provided by aws-ebs-csi-driver controller.
209
additionalArgs: []
210
sdkDebugLog: false
211
loggingFormat: text
212
affinity:
213
nodeAffinity:
214
preferredDuringSchedulingIgnoredDuringExecution:
215
- weight: 1
216
preference:
217
matchExpressions:
218
- key: eks.amazonaws.com/compute-type
219
operator: NotIn
220
values:
221
- fargate
222
- auto
223
- hybrid
224
podAntiAffinity:
225
preferredDuringSchedulingIgnoredDuringExecution:
226
- podAffinityTerm:
227
labelSelector:
228
matchExpressions:
229
- key: app
230
operator: In
231
values:
232
- ebs-csi-controller
233
topologyKey: kubernetes.io/hostname
234
weight: 100
235
# The default filesystem type of the volume to provision when fstype is unspecified in the StorageClass.
236
# If the default is not set and fstype is unset in the StorageClass, then no fstype will be set
237
defaultFsType: ext4
238
env: []
239
# Use envFrom to reference ConfigMaps and Secrets across all containers in the deployment
240
envFrom: []
241
# If set, add pv/pvc metadata to plugin create and modify requests as parameters.
242
extraCreateMetadata: true
243
# Extra volume tags to attach to each dynamically provisioned volume.
244
# ---
245
# extraVolumeTags:
246
# key1: value1
247
# key2: value2
248
extraVolumeTags: {}
249
httpEndpoint:
250
# (deprecated) The TCP network address where the prometheus metrics endpoint
251
# will run (example: `:8080` which corresponds to port 8080 on local host).
252
# The default is empty string, which means metrics endpoint is disabled.
253
# ---
254
enableMetrics: false
255
# If metrics are enabled, add prometheus.io/scrape and prometheus.io/port
256
# annotations to the metrics services.
257
enablePrometheusAnnotations: true
258
serviceMonitor:
259
# Enables the ServiceMonitor resource even if the prometheus-operator CRDs are not installed
260
forceEnable: false
261
# Additional labels for ServiceMonitor object
262
labels: {}
263
interval: "15s"
264
# If set to true, AWS API call metrics will be exported to the following
265
# TCP endpoint: "0.0.0.0:3301"
266
# ---
267
# ID of the Kubernetes cluster used for tagging provisioned EBS volumes (optional).
268
k8sTagClusterId:
269
logLevel: 2
270
userAgentExtra: "helm"
271
nodeSelector: {}
272
deploymentAnnotations: {}
273
podAnnotations: {}
274
podLabels: {}
275
podDisruptionBudget:
276
# Warning: Disabling PodDisruptionBudget may lead to delays in stateful workloads starting due to controller
277
# pod restarts or evictions.
278
enabled: true
279
# unhealthyPodEvictionPolicy:
280
# Configure the maxUnavailable or minAvailable for the PDB
281
# If either parameter is non-null, no default is used for both
282
# maxUnavailable:
283
# minAvailable:
284
priorityClassName: system-cluster-critical
285
# AWS region to use. If not specified then the region will be looked up via the AWS EC2 metadata
286
# service.
287
# ---
288
# region: us-east-1
289
region:
290
replicaCount: 2
291
revisionHistoryLimit: 10
292
socketDirVolume:
293
emptyDir: {}
294
updateStrategy:
295
type: RollingUpdate
296
rollingUpdate:
297
maxUnavailable: 1
298
# type: RollingUpdate
299
# rollingUpdate:
300
# maxSurge: 0
301
# maxUnavailable: 1
302
resources:
303
requests:
304
cpu: 10m
305
memory: 40Mi
306
limits:
307
memory: 256Mi
308
serviceAccount:
309
# A service account will be created for you if set to true. Set to false if you want to use your own.
310
create: true
311
name: ebs-csi-controller-sa
312
annotations: {}
313
## Enable if EKS IAM for SA is used
314
# eks.amazonaws.com/role-arn: arn:<partition>:iam::<account>:role/ebs-csi-role
315
automountServiceAccountToken: true
316
tolerations:
317
- key: CriticalAddonsOnly
318
operator: Exists
319
- effect: NoExecute
320
operator: Exists
321
tolerationSeconds: 300
322
# TSCs without the label selector stanza
323
#
324
# Example:
325
#
326
# topologySpreadConstraints:
327
# - maxSkew: 1
328
# topologyKey: topology.kubernetes.io/zone
329
# whenUnsatisfiable: ScheduleAnyway
330
# - maxSkew: 1
331
# topologyKey: kubernetes.io/hostname
332
# whenUnsatisfiable: ScheduleAnyway
333
topologySpreadConstraints: []
334
# securityContext on the controller pod
335
securityContext:
336
runAsNonRoot: true
337
runAsUser: 1000
338
runAsGroup: 1000
339
fsGroup: 1000
340
# Add additional volume mounts on the controller with controller.volumes and controller.volumeMounts
341
volumes: []
342
# Add additional volumes to be mounted onto the controller:
343
# - name: custom-dir
344
# hostPath:
345
# path: /path/to/dir
346
# type: Directory
347
volumeMounts: []
348
# And add mount paths for those additional volumes:
349
# - name: custom-dir
350
# mountPath: /mount/path
351
# ---
352
# securityContext on the controller container (see sidecars for securityContext on sidecar containers)
353
containerSecurityContext:
354
seccompProfile:
355
type: RuntimeDefault
356
readOnlyRootFilesystem: true
357
allowPrivilegeEscalation: false
358
initContainers: []
359
# containers to be run before the controller's container starts.
360
#
361
# Example:
362
#
363
# - name: wait
364
# image: public.ecr.aws/amazonlinux/amazonlinux
365
# command: [ 'sh', '-c', "sleep 20" ]
366
# Enable opentelemetry tracing for the plugin running on the daemonset
367
otelTracing: {}
368
# otelServiceName: ebs-csi-controller
369
# otelExporterEndpoint: "http://localhost:4317"
370
371
# dnsConfig for the controller pods
372
dnsConfig: {}
373
node:
374
# Enable SELinux-only optimizations on the EBS CSI Driver node pods
375
# Must only be set true if all linux nodes in the DaemonSet have SELinux enabled
376
selinux: false
377
env: []
378
envFrom: []
379
kubeletPath: /var/lib/kubelet
380
loggingFormat: text
381
logLevel: 2
382
enableMetrics: false
383
# If metrics are enabled, add prometheus.io/scrape and prometheus.io/port
384
# annotations to the metrics services.
385
enablePrometheusAnnotations: true
386
serviceMonitor:
387
# Enables the ServiceMonitor resource even if the prometheus-operator CRDs are not installed
388
forceEnable: false
389
# Additional labels for ServiceMonitor object
390
labels: {}
391
interval: "15s"
392
priorityClassName:
393
additionalArgs: []
394
affinity:
395
nodeAffinity:
396
requiredDuringSchedulingIgnoredDuringExecution:
397
nodeSelectorTerms:
398
- matchExpressions:
399
- key: eks.amazonaws.com/compute-type
400
operator: NotIn
401
values:
402
- fargate
403
- auto
404
- hybrid
405
nodeSelector: {}
406
daemonSetAnnotations: {}
407
podAnnotations: {}
408
podLabels: {}
409
terminationGracePeriodSeconds: 30
410
tolerateAllTaints: true
411
tolerations:
412
- operator: Exists
413
effect: NoExecute
414
tolerationSeconds: 300
415
resources:
416
requests:
417
cpu: 10m
418
memory: 40Mi
419
limits:
420
memory: 256Mi
421
revisionHistoryLimit: 10
422
probeDirVolume:
423
emptyDir: {}
424
serviceAccount:
425
create: true
426
name: ebs-csi-node-sa
427
annotations: {}
428
## Enable if EKS IAM for SA is used
429
# eks.amazonaws.com/role-arn: arn:<partition>:iam::<account>:role/ebs-csi-role
430
automountServiceAccountToken: true
431
# Disable mutating permissions for the node service account.
432
# When enabled, some features of the EBS CSI Driver node pods will not function, such as taint removal.
433
# Primarily useful in particularly security-sensitive environments, or on multi-tenant clusters that isolate tenants by node.
434
disableMutation: false
435
# Enable the linux daemonset creation
436
enableLinux: true
437
enableWindows: true
438
# Comma separated list of metadata sources that override the default used by the EBS CSI Driver. Valid sources include 'imds', 'kubernetes', and (ALPHA) 'metadata-labeler'
439
metadataSources:
440
# Warning: This option will be removed in a future release. It is a temporary workaround for users unable to immediately migrate off of older kernel versions.
441
# Formats XFS volumes with bigtime=0,inobtcount=0,reflink=0, for mounting onto nodes with linux kernel version <= 5.4.
442
# Note that XFS volumes formatted with this option will only have timestamp records until 2038.
443
legacyXFS: false
444
# The number of attachment slots to reserve for system use (and not to be used for CSI volumes)
445
# When this parameter is not specified (or set to -1), the EBS CSI Driver will attempt to determine the number of reserved slots via heuristic
446
# Cannot be specified at the same time as `node.volumeAttachLimit`
447
reservedVolumeAttachments:
448
# The "maximum number of attachable volumes" per node
449
# Cannot be specified at the same time as `node.reservedVolumeAttachments`
450
volumeAttachLimit:
451
updateStrategy:
452
type: RollingUpdate
453
rollingUpdate:
454
maxUnavailable: "10%"
455
hostNetwork: false
456
# securityContext on the node pod
457
securityContext:
458
# The node pod must be run as root to bind to the registration/driver sockets
459
runAsNonRoot: false
460
runAsUser: 0
461
runAsGroup: 0
462
fsGroup: 0
463
# allows you to deploy aws-ebs-csi-node daemonset to separate namespace (make sure namespace exists before deploy)
464
namespaceOverride: ""
465
# Add additional volume mounts on the node pods with node.volumes and node.volumeMounts
466
volumes: []
467
# Add additional volumes to be mounted onto the node pods:
468
# - name: custom-dir
469
# hostPath:
470
# path: /path/to/dir
471
# type: Directory
472
volumeMounts: []
473
# And add mount paths for those additional volumes:
474
# - name: custom-dir
475
# mountPath: /mount/path
476
# ---
477
# securityContext on the node container (see sidecars for securityContext on sidecar containers)
478
# Privileged containers always run as `Unconfined`, which means that they are not restricted by a seccomp profile.
479
containerSecurityContext:
480
readOnlyRootFilesystem: true
481
privileged: true
482
initContainers: []
483
# containers to be run before the csi-node's container starts.
484
#
485
# Example:
486
#
487
# - name: wait
488
# image: public.ecr.aws/amazonlinux/amazonlinux
489
# command: [ 'sh', '-c', "sleep 20" ]
490
# Enable opentelemetry tracing for the plugin running on the daemonset
491
otelTracing: {}
492
# otelServiceName: ebs-csi-node
493
# otelExporterEndpoint: "http://localhost:4317"
494
495
# dnsConfig for the node pods
496
dnsConfig: {}
497
additionalDaemonSets:
498
# Additional node DaemonSets, using the node config structure
499
# See docs/additional-daemonsets.md for more information
500
#
501
# example:
502
# nodeSelector:
503
# node.kubernetes.io/instance-type: c5.large
504
# volumeAttachLimit: 15
505
storageClasses: []
506
# Add StorageClass resources like:
507
# - name: ebs-sc
508
# # annotation metadata
509
# annotations:
510
# storageclass.kubernetes.io/is-default-class: "true"
511
# # label metadata
512
# labels:
513
# my-label-is: supercool
514
# # defaults to WaitForFirstConsumer
515
# volumeBindingMode: WaitForFirstConsumer
516
# # defaults to Delete
517
# reclaimPolicy: Retain
518
# parameters:
519
# encrypted: "true"
520
521
defaultStorageClass:
522
enabled: false
523
volumeSnapshotClasses: []
524
# Add VolumeSnapshotClass resources like:
525
# - name: ebs-vsc
526
# # annotation metadata
527
# annotations:
528
# snapshot.storage.kubernetes.io/is-default-class: "true"
529
# # label metadata
530
# labels:
531
# my-label-is: supercool
532
# # deletionPolicy must be specified
533
# deletionPolicy: Delete
534
# parameters:
535
536
# Use old CSIDriver without an fsGroupPolicy set
537
# Intended for use with older clusters that cannot easily replace the CSIDriver object
538
# This parameter should always be false for new installations
539
useOldCSIDriver: false
540
# nodeAllocatableUpdatePeriodSeconds updates the node's max attachable volume count by directing Kubelet to periodically call NodeGetInfo at the configured interval.
541
# Kubernetes enforces a minimum update interval of 10 seconds. A value of -1 uses a automatically determined value dependent on metadata sources.
542
# This parameter is supported in Kubernetes 1.33+ and requires the MutableCSINodeAllocatableCount feature gate to be enabled in kubelet and kube-apiserver.
543
nodeAllocatableUpdatePeriodSeconds: -1
544
# Deploy EBS CSI Driver without controller and associated resources
545
nodeComponentOnly: false
546
# Set maximum verbosity for logs of each container and other recommended debugging parameters such as enabling AWS SDK debug logging
547
debugLogs: false
548
helmTester:
549
enabled: true
550
# Supply a custom image to the ebs-csi-driver-test pod in helm-tester.yaml
551
image: "us-central1-docker.pkg.dev/k8s-staging-test-infra/images/kubekins-e2e:v20260720-39d457d26c-master"
552
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.