Module csi-nfs: Custom Resources

NFSStorageClass

Short names: nsc

Scope: Cluster
Version: v1alpha1

• spec

  object

  Defines a Kubernetes StorageClass configuration.
  • spec.chmodPermissions

    string

    chmod rights for PVs subdirectory.

    Pattern: ^[0-7]{3,4}$

  • spec.connection

    object

    Required value

    NFS server connection settings.
    • spec.connection.host

      string

      Required value

      NFS server host.

      Minimum length: 1

    • spec.connection.mtls

      boolean

      Available in SE, SE+, EE, and FE editions.

      Whether to use mTLS — requires TLS to be enabled.

      Default: false

    • spec.connection.nfsVersion

      string

      Required value

      NFS version.

      Allowed values: 3, 4.1, 4.2

    • spec.connection.share

      string

      Required value

      NFS server share path.

      Minimum length: 1

    • spec.connection.tls

      boolean

      Available in SE, SE+, EE, and FE editions.

      Whether to use TLS for connection.

      Default: false

  • spec.mountOptions

    object

    StorageClass mount options.
    • spec.mountOptions.mountMode

      string

      NFS share mount mode.

      Allowed values: hard, soft

    • spec.mountOptions.nodev

      boolean

      Mount with nodev on the node: device files on the share cannot be opened there. The container runtime bind-mounts the volume into a container without the flag.
    • spec.mountOptions.nosuid

      boolean

      Mount with nosuid on the node: the set-user-ID and set-group-ID bits of the files on the share do not take effect there. The container runtime bind-mounts the volume into a container without the flag.
    • spec.mountOptions.readOnly

      boolean

      Share read-only flag.
    • spec.mountOptions.retransmissions

      integer

      The number of repeated attempts by the NFS client to execute the request before it takes further steps to restore the connection.

      Allowed values: 1 <= X

    • spec.mountOptions.timeout

      integer

      The time during which the NFS client waits for a response before repeating the NFS request, in tenths of a second.

      For example, 600 is 60 seconds.

      Allowed values: 1 <= X

  • spec.reclaimPolicy

    string

    Required value

    Defines the behavior when a PersistentVolumeClaim (PVC) is deleted.

    Allowed values:

    • Delete — when the PVC is deleted, the associated PersistentVolume (PV) and corresponding data on the NFS server are also deleted;
    • Retain — when the PVC is deleted, the associated PersistentVolume and data on the NFS server are not deleted and require manual removal by the user. See more in the Kubernetes documentation.

    Allowed values: Delete, Retain

  • spec.tlsParameters

    object

    Available in SE, SE+, EE, and FE editions.

    RPC-with-TLS parameters of the class, for connection.tls: true. With them a class with TLS does not need tlsParameters.ca of the module.

    • spec.tlsParameters.ca

      string

      Required value

      Root certificate in PEM format, encoded in Base64, that verifies the certificate of the NFS server of this class. The nodes trust it together with the CAs of the other classes and tlsParameters.ca of the module: the truststore of a node is one for all its mounts, so a class adds a CA rather than limiting which servers its volumes trust.

      Minimum length: 1

      Pattern: ^[A-Za-z0-9+/]*={0,2}$

  • spec.volumeBindingMode

    string

    Required value

    Defines the volume binding mode.

    Allowed values:

    • Immediate — the volume is provisioned immediately after the PersistentVolumeClaim (PVC) is created;
    • WaitForFirstConsumer — the volume is provisioned only when the PVC is first used by a pod. See more in the Kubernetes documentation.

    Allowed values: Immediate, WaitForFirstConsumer

  • spec.volumeCleanup

    string

    This feature is available in Enterprise Edition.

    Specifies the cleanup method to be applied to the PV’s subdirectory content before deletion.

    If the parameter is omitted, the NFS CSI driver deletes the directory created for the Persistent Volume (PV) on the NFS server without performing any data cleanup. If the parameter is set, the driver erases each file in the PV directory.

    Allowed values:

    • Discard — uses the filesystem’s discard (trim) functionality to free data blocks (this option is available only when supported, for example with NFSv4.2);
    • RandomFillSinglePass — overwrites the content of each file once with random data before deletion. This is implemented by invoking the utility shred;
    • RandomFillThreePass — overwrites the content of each file three times with random data before deletion. This is implemented by invoking the utility shred.

    Allowed values: Discard, RandomFillSinglePass, RandomFillThreePass

  • spec.workloadNodes

    object
    • spec.workloadNodes.nodeSelector

      object

      Node selector to specify rules for selecting nodes where Persistent Volumes (PVs) created by this StorageClass are allowed to connect.

      Combines simple label matches and advanced matching expressions.

      If this parameter is omitted, NFS shares can be mounted on any node in the cluster running the Linux OS.

      • spec.workloadNodes.nodeSelector.matchExpressions

        array of objects

        A list of advanced node selector requirements.

        Each requirement specifies a key, an operator, and optional values for filtering nodes based on their labels or other fields.

        • spec.workloadNodes.nodeSelector.matchExpressions.key

          string

          The label key that the requirement applies to.
        • spec.workloadNodes.nodeSelector.matchExpressions.operator

          string

          The operator to apply for the key.

          Allowed values: In, NotIn, Exists, DoesNotExist

        • spec.workloadNodes.nodeSelector.matchExpressions.values

          array of strings

          A list of string values. Required for operators such as In or NotIn, and ignored for Exists or DoesNotExist.
      • spec.workloadNodes.nodeSelector.matchLabels

        object

        A map of labels that must match exactly with the labels of a node.

        Nodes that do not match any of the specified labels will be excluded.

• status

  object

  Displays current information about the StorageClass.
  • status.clientCA

    string

    Available in SE, SE+, EE, and FE editions.

    The CA of the client certificate the nodes present when they mount the volumes of a class with spec.connection.mtls, in PEM format, encoded in Base64. The NFS server of the class has to trust it. Empty when the class does not use mTLS, or when tlsParameters.mtls of the module sets a client certificate without clientCA.

  • status.conditions

    array of objects

    The latest observations of the resource state. Condition types: Ready, RootSquash.
    • status.conditions.lastTransitionTime

      string

      Timestamp of the last status transition for this condition. It is not bumped when only the reason or the message changes.
    • status.conditions.message

      string

      Human-readable explanation of the current status.

      Maximum length: 32768

    • status.conditions.observedGeneration

      integer

      The value of metadata.generation this condition was set against.

      Allowed values: 0 <= X

    • status.conditions.reason

      string

      Machine-readable reason for the current status, suitable for log filtering and alerting.

      Length: 1..1024

      Pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$

    • status.conditions.status

      string

      Current status of the condition.

      Allowed values: True, False, Unknown

    • status.conditions.type

      string

      Condition type.

      Ready is True once the StorageClass, the mount-options secret and the VolumeSnapshotClass are in place, False when a reconcile pass failed, and Unknown before the controller has observed the resource.

      RootSquash is True when the NFS server maps root to another user on the export (root_squash or all_squash), False when root keeps its identity, and Unknown when the check could not reach a verdict: the export could not be mounted (reason MountFailed), it is read-only (ExportReadOnly), or the check failed otherwise (ProbeFailed). The CSI controller checks the export when the NFSStorageClass is created and every 10 minutes after that. The condition only warns and does not affect Ready.

      Maximum length: 316

      Pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$

  • status.observedGeneration

    integer

    The value of metadata.generation the controller has last acted on. When it trails metadata.generation, the controller has not yet processed the latest spec, and the conditions below still describe the previous one.
  • status.phase

    string

    The StorageClass current state.

    Possible values:

    • Failed — the controller received incorrect resource configuration or some errors occurred during the operation;
    • Created — the StorageClass was created successfully.

    Allowed values: Failed, Created

  • status.reason

    string

    Additional information about the current state of the StorageClass.