aws-efs-csi-driver
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
1
# Default values for aws-efs-csi-driver.
2
# This is a YAML-formatted file.
3
# Declare variables to be passed into your templates.
4
5
nameOverride: ""
6
fullnameOverride: ""
7
useFIPS: false
8
portRangeUpperBound: "21049"
9
debugLogs: false
10
image:
11
repository: cgr.dev/chainguard-private/aws-efs-csi-driver-fips
12
tag: latest@sha256:1410ff42985c98aa075808a384f05391a0800e4a57227cbb195d5c5e2a37b3a1
13
pullPolicy: IfNotPresent
14
sidecars:
15
livenessProbe:
16
image:
17
repository: cgr.dev/chainguard-private/kubernetes-csi-livenessprobe-fips
18
tag: latest@sha256:3b51c622ef928833173f86fa0f4f085293ddd4ee7c1647323c3ca00f993d757d
19
pullPolicy: IfNotPresent
20
resources: {}
21
securityContext:
22
readOnlyRootFilesystem: true
23
allowPrivilegeEscalation: false
24
nodeDriverRegistrar:
25
image:
26
repository: cgr.dev/chainguard-private/kubernetes-csi-node-driver-registrar-fips
27
tag: latest@sha256:3a339af0c93a6a9e742cedce10e8150674270f6ac46d9e603ffb27687bfb4009
28
pullPolicy: IfNotPresent
29
resources: {}
30
securityContext:
31
readOnlyRootFilesystem: true
32
allowPrivilegeEscalation: false
33
csiProvisioner:
34
image:
35
repository: cgr.dev/chainguard-private/kubernetes-csi-external-provisioner-fips
36
tag: latest@sha256:4871126cd22e151802fcfda263d93b4fc4f09001186bb8e949781e3c997e1a5f
37
pullPolicy: IfNotPresent
38
resources: {}
39
securityContext:
40
readOnlyRootFilesystem: true
41
allowPrivilegeEscalation: false
42
additionalArgs: []
43
imagePullSecrets: []
44
## Controller deployment variables
45
controller:
46
# Specifies whether a deployment should be created
47
create: true
48
# Name of the CSI controller service
49
name: efs-csi-controller
50
# Number of replicas for the CSI controller service deployment
51
replicaCount: 2
52
# enableMetrics enables the Prometheus metrics endpoint on the controller.
53
# When true, the driver exposes metrics on port 3301.
54
enableMetrics: false
55
# enablePrometheusAnnotations adds prometheus.io scrape annotations to the controller pod.
56
enablePrometheusAnnotations: true
57
# serviceMonitor controls creation of Prometheus Operator ServiceMonitor resources.
58
# Requires the Prometheus Operator CRDs to be installed.
59
serviceMonitor:
60
enabled: false
61
# Number for the log level verbosity
62
logLevel: 2
63
# If set, add pv/pvc metadata to plugin create requests as parameters.
64
extraCreateMetadata: true
65
# Add additional tags to access points
66
tags: {}
67
# environment: prod
68
# region: us-east-1
69
# Enable if you want the controller to also delete the
70
# path on efs when deleteing an access point
71
deleteAccessPointRootDir: false
72
podAnnotations: {}
73
podLabels: {}
74
hostNetwork: false
75
priorityClassName: system-cluster-critical
76
dnsPolicy: ClusterFirst
77
dnsConfig: {}
78
additionalLabels: {}
79
resources: {}
80
# We usually recommend not to specify default resources and to leave this as a conscious
81
# choice for the user. This also increases chances charts run on environments with little
82
# resources, such as Minikube. If you do want to specify resources, uncomment the following
83
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
84
# limits:
85
# cpu: 100m
86
# memory: 128Mi
87
# requests:
88
# cpu: 100m
89
# memory: 128Mi
90
revisionHistoryLimit: 10
91
nodeSelector: {}
92
tolerations:
93
- key: CriticalAddonsOnly
94
operator: Exists
95
- key: efs.csi.aws.com/agent-not-ready
96
operator: Exists
97
affinity: {}
98
env: []
99
volumes: []
100
volumeMounts: []
101
socketDirVolume:
102
emptyDir: {}
103
# Specifies whether a service account should be created
104
serviceAccount:
105
create: true
106
name: efs-csi-controller-sa
107
annotations: {}
108
## Enable if EKS IAM for SA is used
109
# eks.amazonaws.com/role-arn: arn:aws:iam::111122223333:role/efs-csi-role
110
healthPort: 9909
111
regionalStsEndpoints: false
112
# Liveness probe configuration for the controller
113
livenessProbe:
114
httpGet:
115
path: /healthz
116
port: healthz
117
initialDelaySeconds: 10
118
timeoutSeconds: 3
119
periodSeconds: 10
120
failureThreshold: 5
121
# Readiness probe configuration for the controller (optional)
122
readinessProbe: {}
123
# httpGet:
124
# path: /healthz
125
# port: healthz
126
# initialDelaySeconds: 10
127
# timeoutSeconds: 3
128
# periodSeconds: 10
129
# failureThreshold: 3
130
# Startup probe configuration for the controller (optional)
131
startupProbe: {}
132
# httpGet:
133
# path: /healthz
134
# port: healthz
135
# initialDelaySeconds: 10
136
# timeoutSeconds: 3
137
# periodSeconds: 10
138
# failureThreshold: 30
139
# Pod Disruption Budget
140
podDisruptionBudget:
141
enabled: false
142
# maxUnavailable: 1
143
minAvailable: 1
144
unhealthyPodEvictionPolicy: IfHealthyBudget
145
# securityContext on the controller pod
146
securityContext:
147
runAsNonRoot: false
148
runAsUser: 0
149
runAsGroup: 0
150
fsGroup: 0
151
# securityContext on the controller container
152
# Setting privileged=false will cause the "delete-access-point-root-dir" controller option to fail
153
containerSecurityContext:
154
privileged: true
155
leaderElectionRenewDeadline: 10s
156
leaderElectionLeaseDuration: 15s
157
# Timeout for Create/DeleteVolume calls to Controller. We recommend increasing for high concurrency workloads
158
timeout: 15s
159
# Number of concurrent threads controller will handle at once.
160
workerThreads: 100
161
# TSCs without the label selector stanza
162
#
163
# Example:
164
#
165
# topologySpreadConstraints:
166
# - maxSkew: 1
167
# topologyKey: topology.kubernetes.io/zone
168
# whenUnsatisfiable: ScheduleAnyway
169
# - maxSkew: 1
170
# topologyKey: kubernetes.io/hostname
171
# whenUnsatisfiable: ScheduleAnyway
172
topologySpreadConstraints: []
173
# Enable reading filesystem IDs from configmap/secret
174
fileSystemIdRefs:
175
enabled: false
176
# rollingUpdate for controller deployment strategy
177
rollingUpdate: {}
178
# maxUnavailable: 1
179
# maxSurge: 1
180
## Node daemonset variables
181
node:
182
# Number for the log level verbosity
183
logLevel: 2
184
volMetricsOptIn: false
185
volMetricsRefreshPeriod: 240
186
volMetricsFsRateLimit: 5
187
hostAliases: {}
188
# For cross VPC EFS, you need to poison or overwrite the DNS for the efs volume as per
189
# https://docs.aws.amazon.com/efs/latest/ug/efs-different-vpc.html#wt6-efs-utils-step3
190
# implementing the suggested solution found here:
191
# https://github.com/kubernetes-sigs/aws-efs-csi-driver/issues/240#issuecomment-676849346
192
# EFS Vol ID, IP, Region
193
# "fs-01234567":
194
# ip: 10.10.2.2
195
# region: us-east-2
196
priorityClassName: system-node-critical
197
dnsPolicy: ClusterFirst
198
dnsConfig: {}
199
# Example config which uses the AWS nameservers
200
# dnsPolicy: "None"
201
# dnsConfig:
202
# nameservers:
203
# - 169.254.169.253
204
podLabels: {}
205
podAnnotations: {}
206
additionalLabels: {}
207
resources: {}
208
# limits:
209
# cpu: 100m
210
# memory: 128Mi
211
# requests:
212
# cpu: 100m
213
# memory: 128Mi
214
revisionHistoryLimit: 10
215
nodeSelector: {}
216
tolerations:
217
- operator: Exists
218
affinity:
219
nodeAffinity:
220
requiredDuringSchedulingIgnoredDuringExecution:
221
nodeSelectorTerms:
222
- matchExpressions:
223
- key: eks.amazonaws.com/compute-type
224
operator: NotIn
225
values:
226
- fargate
227
- hybrid
228
# Specifies whether a service account should be created
229
serviceAccount:
230
create: true
231
name: efs-csi-node-sa
232
annotations: {}
233
## Enable if EKS IAM for SA is used
234
# eks.amazonaws.com/role-arn: arn:aws:iam::111122223333:role/efs-csi-role
235
# Disable mutating permissions for the node service account.
236
# When disableMutation is true, some features of the EFS CSI Driver node pods will not function, such as taint removal.
237
# Primarily useful in particularly security-sensitive environments, or on multi-tenant clusters that isolate tenants by node.
238
disableMutation: false
239
healthPort: 9809
240
# Liveness probe configuration for the node
241
livenessProbe:
242
httpGet:
243
path: /healthz
244
port: healthz
245
initialDelaySeconds: 10
246
timeoutSeconds: 3
247
periodSeconds: 2
248
failureThreshold: 5
249
# Readiness probe configuration for the node (optional)
250
readinessProbe: {}
251
# httpGet:
252
# path: /healthz
253
# port: healthz
254
# initialDelaySeconds: 10
255
# timeoutSeconds: 3
256
# periodSeconds: 2
257
# failureThreshold: 3
258
# Startup probe configuration for the node (optional)
259
startupProbe: {}
260
# httpGet:
261
# path: /healthz
262
# port: healthz
263
# initialDelaySeconds: 10
264
# timeoutSeconds: 3
265
# periodSeconds: 2
266
# failureThreshold: 30
267
# securityContext on the node pod
268
securityContext:
269
# The node pod must be run as root to bind to the registration/driver sockets
270
runAsNonRoot: false
271
runAsUser: 0
272
runAsGroup: 0
273
fsGroup: 0
274
env: []
275
volumes: []
276
volumeMounts: []
277
kubeletPath: /var/lib/kubelet
278
# rollingUpdate for node deamonset updateStrategy.
279
rollingUpdate: {}
280
# maxSurge: 0
281
# maxUnavailable: 20%
282
283
# Comma-separated section:key=value overrides for efs-utils.conf.
284
# Example: "mount-watchdog:stunnel_health_check_interval_min=1,mount-watchdog:tls_cert_renewal_interval_min=30"
285
efsUtilsConfOverrides: ""
286
# Comma-separated section:key=value overrides for s3files-utils.conf.
287
# Example: "proxy:read_bypass_denylist_size=20000"
288
s3filesUtilsConfOverrides: ""
289
storageClasses: []
290
# Add StorageClass resources like:
291
# - name: efs-sc
292
# annotations:
293
# # Use that annotation if you want this to your default storageclass
294
# storageclass.kubernetes.io/is-default-class: "true"
295
# parameters:
296
# provisioningMode: efs-ap
297
# fileSystemId: fs-1122aabb
298
# directoryPerms: "700"
299
# gidRangeStart: "1000"
300
# gidRangeEnd: "2000"
301
# basePath: "/dynamic_provisioning"
302
# subPathPattern: "/subPath"
303
# ensureUniqueDirectory: true
304
# reclaimPolicy: Delete
305
# volumeBindingMode: Immediate
306
307
# Specifies whether to use helm hooks to apply the CSI driver
308
useHelmHooksForCSIDriver: true
309
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.