aws-efs-csi-driver
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
Compare:
1
# Default values for aws-efs-csi-driver.
2
# This is a YAML-formatted file.
3
# Declare variables to be passed into your templates.
4
5
nameOverride: ""
6
fullnameOverride: ""
7
useFIPS: false
8
portRangeUpperBound: "21049"
9
debugLogs: false
10
image:
11
repository: cgr.dev/chainguard-private/aws-efs-csi-driver-fips
12
tag: 3.4.2@sha256:094895b8331f3e1631176e07b2188bf1d33100e45e428715b81d83022be371e4
13
pullPolicy: IfNotPresent
14
sidecars:
15
livenessProbe:
16
image:
17
repository: cgr.dev/chainguard-private/kubernetes-csi-livenessprobe-fips
18
tag: 2.20.0@sha256:e2bcf7a17b6868de02bc66a1f98f8720562815bafb940780381b2ab6dfe3725b
19
pullPolicy: IfNotPresent
20
resources: {}
21
securityContext:
22
readOnlyRootFilesystem: true
23
allowPrivilegeEscalation: false
24
nodeDriverRegistrar:
25
image:
26
repository: cgr.dev/chainguard-private/kubernetes-csi-node-driver-registrar-fips
27
tag: 2.18.0@sha256:4d7da14f4f21215d60c9dc14e0c0092bfe7edb3b5757cce8798da46cb3b6b1ae
28
pullPolicy: IfNotPresent
29
resources: {}
30
securityContext:
31
readOnlyRootFilesystem: true
32
allowPrivilegeEscalation: false
33
csiProvisioner:
34
image:
35
repository: cgr.dev/chainguard-private/kubernetes-csi-external-provisioner-fips
36
tag: 6.3.0@sha256:a967dd55e5a3c0b5ebe8818676daa9db8c261a6f541cd6ac96da9708f6257ce9
37
pullPolicy: IfNotPresent
38
resources: {}
39
securityContext:
40
readOnlyRootFilesystem: true
41
allowPrivilegeEscalation: false
42
additionalArgs: []
43
imagePullSecrets: []
44
## Controller deployment variables
45
controller:
46
# Specifies whether a deployment should be created
47
create: true
48
# Name of the CSI controller service
49
name: efs-csi-controller
50
# Number of replicas for the CSI controller service deployment
51
replicaCount: 2
52
# enableMetrics enables the Prometheus metrics endpoint on the controller.
53
# When true, the driver exposes metrics on port 3301.
54
enableMetrics: false
55
# enablePrometheusAnnotations adds prometheus.io scrape annotations to the controller pod.
56
enablePrometheusAnnotations: true
57
# serviceMonitor controls creation of Prometheus Operator ServiceMonitor resources.
58
# Requires the Prometheus Operator CRDs to be installed.
59
serviceMonitor:
60
enabled: false
61
# Number for the log level verbosity
62
logLevel: 2
63
# If set, add pv/pvc metadata to plugin create requests as parameters.
64
extraCreateMetadata: true
65
# Add additional tags to access points.
66
# NOTE: Custom tags require the controller's IAM policy to allow the extra tag
67
# keys on elasticfilesystem:CreateAccessPoint. The AWS-managed
68
# AmazonEFSCSIDriverPolicy only permits the default efs.csi.aws.com/cluster tag
69
# key, so custom tags will cause access point creation to fail (PVCs stuck in
70
# Pending) unless you attach a custom policy. See docs/install.md
71
# ("Custom tags require additional IAM permissions").
72
tags: {}
73
# environment: prod
74
# region: us-east-1
75
# Enable if you want the controller to also delete the
76
# path on efs when deleteing an access point
77
deleteAccessPointRootDir: false
78
podAnnotations: {}
79
podLabels: {}
80
hostNetwork: false
81
priorityClassName: system-cluster-critical
82
dnsPolicy: ClusterFirst
83
dnsConfig: {}
84
additionalLabels: {}
85
resources: {}
86
# We usually recommend not to specify default resources and to leave this as a conscious
87
# choice for the user. This also increases chances charts run on environments with little
88
# resources, such as Minikube. If you do want to specify resources, uncomment the following
89
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
90
# limits:
91
# cpu: 100m
92
# memory: 128Mi
93
# requests:
94
# cpu: 100m
95
# memory: 128Mi
96
revisionHistoryLimit: 10
97
nodeSelector: {}
98
tolerations:
99
- key: CriticalAddonsOnly
100
operator: Exists
101
- key: efs.csi.aws.com/agent-not-ready
102
operator: Exists
103
affinity: {}
104
env: []
105
volumes: []
106
volumeMounts: []
107
socketDirVolume:
108
emptyDir: {}
109
# Specifies whether a service account should be created
110
serviceAccount:
111
create: true
112
name: efs-csi-controller-sa
113
annotations: {}
114
## Enable if EKS IAM for SA is used
115
# eks.amazonaws.com/role-arn: arn:aws:iam::111122223333:role/efs-csi-role
116
healthPort: 9909
117
regionalStsEndpoints: false
118
# Liveness probe configuration for the controller
119
livenessProbe:
120
httpGet:
121
path: /healthz
122
port: healthz
123
initialDelaySeconds: 10
124
timeoutSeconds: 3
125
periodSeconds: 10
126
failureThreshold: 5
127
# Readiness probe configuration for the controller (optional)
128
readinessProbe: {}
129
# httpGet:
130
# path: /healthz
131
# port: healthz
132
# initialDelaySeconds: 10
133
# timeoutSeconds: 3
134
# periodSeconds: 10
135
# failureThreshold: 3
136
# Startup probe configuration for the controller (optional)
137
startupProbe: {}
138
# httpGet:
139
# path: /healthz
140
# port: healthz
141
# initialDelaySeconds: 10
142
# timeoutSeconds: 3
143
# periodSeconds: 10
144
# failureThreshold: 30
145
# Pod Disruption Budget
146
podDisruptionBudget:
147
enabled: false
148
# maxUnavailable: 1
149
minAvailable: 1
150
unhealthyPodEvictionPolicy: IfHealthyBudget
151
# securityContext on the controller pod
152
securityContext:
153
runAsNonRoot: false
154
runAsUser: 0
155
runAsGroup: 0
156
fsGroup: 0
157
# securityContext on the controller container
158
# Setting privileged=false will cause the "delete-access-point-root-dir" controller option to fail
159
containerSecurityContext:
160
privileged: true
161
leaderElectionRenewDeadline: 10s
162
leaderElectionLeaseDuration: 15s
163
# Timeout for Create/DeleteVolume calls to Controller. We recommend increasing for high concurrency workloads
164
timeout: 15s
165
# Number of concurrent threads controller will handle at once.
166
workerThreads: 100
167
# TSCs without the label selector stanza
168
#
169
# Example:
170
#
171
# topologySpreadConstraints:
172
# - maxSkew: 1
173
# topologyKey: topology.kubernetes.io/zone
174
# whenUnsatisfiable: ScheduleAnyway
175
# - maxSkew: 1
176
# topologyKey: kubernetes.io/hostname
177
# whenUnsatisfiable: ScheduleAnyway
178
topologySpreadConstraints: []
179
# Enable reading filesystem IDs from configmap/secret
180
fileSystemIdRefs:
181
enabled: false
182
# rollingUpdate for controller deployment strategy
183
rollingUpdate: {}
184
# maxUnavailable: 1
185
# maxSurge: 1
186
## Node daemonset variables
187
node:
188
# Number for the log level verbosity
189
logLevel: 2
190
volMetricsOptIn: false
191
volMetricsRefreshPeriod: 240
192
volMetricsFsRateLimit: 5
193
hostAliases: {}
194
# For cross VPC EFS, you need to poison or overwrite the DNS for the efs volume as per
195
# https://docs.aws.amazon.com/efs/latest/ug/efs-different-vpc.html#wt6-efs-utils-step3
196
# implementing the suggested solution found here:
197
# https://github.com/kubernetes-sigs/aws-efs-csi-driver/issues/240#issuecomment-676849346
198
# EFS Vol ID, IP, Region
199
# "fs-01234567":
200
# ip: 10.10.2.2
201
# region: us-east-2
202
priorityClassName: system-node-critical
203
dnsPolicy: ClusterFirst
204
dnsConfig: {}
205
# Example config which uses the AWS nameservers
206
# dnsPolicy: "None"
207
# dnsConfig:
208
# nameservers:
209
# - 169.254.169.253
210
podLabels: {}
211
podAnnotations: {}
212
additionalLabels: {}
213
resources: {}
214
# limits:
215
# cpu: 100m
216
# memory: 128Mi
217
# requests:
218
# cpu: 100m
219
# memory: 128Mi
220
revisionHistoryLimit: 10
221
nodeSelector: {}
222
tolerations:
223
- operator: Exists
224
affinity:
225
nodeAffinity:
226
requiredDuringSchedulingIgnoredDuringExecution:
227
nodeSelectorTerms:
228
- matchExpressions:
229
- key: eks.amazonaws.com/compute-type
230
operator: NotIn
231
values:
232
- fargate
233
- hybrid
234
# Specifies whether a service account should be created
235
serviceAccount:
236
create: true
237
name: efs-csi-node-sa
238
annotations: {}
239
## Enable if EKS IAM for SA is used
240
# eks.amazonaws.com/role-arn: arn:aws:iam::111122223333:role/efs-csi-role
241
# Disable mutating permissions for the node service account.
242
# When disableMutation is true, some features of the EFS CSI Driver node pods will not function, such as taint removal.
243
# Primarily useful in particularly security-sensitive environments, or on multi-tenant clusters that isolate tenants by node.
244
disableMutation: false
245
healthPort: 9809
246
# Liveness probe configuration for the node
247
livenessProbe:
248
httpGet:
249
path: /healthz
250
port: healthz
251
initialDelaySeconds: 10
252
timeoutSeconds: 3
253
periodSeconds: 2
254
failureThreshold: 5
255
# Readiness probe configuration for the node (optional)
256
readinessProbe: {}
257
# httpGet:
258
# path: /healthz
259
# port: healthz
260
# initialDelaySeconds: 10
261
# timeoutSeconds: 3
262
# periodSeconds: 2
263
# failureThreshold: 3
264
# Startup probe configuration for the node (optional)
265
startupProbe: {}
266
# httpGet:
267
# path: /healthz
268
# port: healthz
269
# initialDelaySeconds: 10
270
# timeoutSeconds: 3
271
# periodSeconds: 2
272
# failureThreshold: 30
273
# securityContext on the node pod
274
securityContext:
275
# The node pod must be run as root to bind to the registration/driver sockets
276
runAsNonRoot: false
277
runAsUser: 0
278
runAsGroup: 0
279
fsGroup: 0
280
env: []
281
volumes: []
282
volumeMounts: []
283
kubeletPath: /var/lib/kubelet
284
# rollingUpdate for node deamonset updateStrategy.
285
rollingUpdate: {}
286
# maxSurge: 0
287
# maxUnavailable: 20%
288
289
# Comma-separated section:key=value overrides for efs-utils.conf.
290
# Example: "mount-watchdog:stunnel_health_check_interval_min=1,mount-watchdog:tls_cert_renewal_interval_min=30"
291
efsUtilsConfOverrides: ""
292
# Comma-separated section:key=value overrides for s3files-utils.conf.
293
# Example: "proxy:read_bypass_denylist_size=20000"
294
s3filesUtilsConfOverrides: ""
295
storageClasses: []
296
# Add StorageClass resources like:
297
# - name: efs-sc
298
# annotations:
299
# # Use that annotation if you want this to your default storageclass
300
# storageclass.kubernetes.io/is-default-class: "true"
301
# parameters:
302
# provisioningMode: efs-ap
303
# fileSystemId: fs-1122aabb
304
# directoryPerms: "700"
305
# gidRangeStart: "1000"
306
# gidRangeEnd: "2000"
307
# basePath: "/dynamic_provisioning"
308
# subPathPattern: "/subPath"
309
# ensureUniqueDirectory: true
310
# reclaimPolicy: Delete
311
# volumeBindingMode: Immediate
312
313
# Specifies whether to use helm hooks to apply the CSI driver
314
useHelmHooksForCSIDriver: true
315
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.