Helm Chart Reference¶

This page describes what the meshstor-csi Helm chart deploys and how it integrates with your cluster's policies. Pair it with the auto-generated charts/meshstor-csi/README.md, which lists every value key.

Chart Coordinates¶

OCI installs require Helm 3.8.0 or newer. See Installation for the install/upgrade commands.

What the Chart Installs¶

flowchart TB
  subgraph cluster[Cluster-scoped]
    direction LR
    CRDs[2 × CustomResourceDefinition<br/>meshstorvolumes · meshstornodedevices]
    CSI[CSIDriver<br/>io.meshstor.csi.mesh]
    SC[2 × StorageClass<br/>meshstor-replicated · meshstor-local-storage]
    CR[2 × ClusterRole + ClusterRoleBinding<br/>controller · node]
  end
  subgraph ns[Release namespace]
    direction LR
    SS[StatefulSet · controller<br/>1 replica · 4 containers]
    DS[DaemonSet · node<br/>1 per Linux node · 3 containers]
    SA[2 × ServiceAccount]
    Role[Role + RoleBinding<br/>csi-resizer leader-election lease]
  end

A default install (crds.enabled=true, rbac.create=true, serviceAccount.*.create=true, default storageClasses) creates:

Resource names are derived from the release name. Never run multiple instances side-by-side.

Cluster Integration¶

MeshStor's chart touches several cluster-wide policies.

RBAC¶

rbac.create=true (default) renders ClusterRoles for the controller and node, plus their bindings, plus a Role/RoleBinding pair in the release namespace for csi-resizer's leader-election lease. Set rbac.create=false if you manage RBAC out-of-band (sealed-secrets, vault, GitOps).

Pod Security Admission¶

The controller pod fits PSA restricted. The node pod's csi-plugin container requires privileged and cannot be reduced — mdadm, nvme-cli, and mount(2) are not optional. If you label namespaces with PSA enforcement, the namespace hosting the DaemonSet must be enforce=privileged. Both pods set seccompProfile: RuntimeDefault, which the baseline policy requires for privileged pods.

Host Requirements¶

The node pod takes a privileged container, real node IPs, and several host paths. None of these are reducible without losing functionality. If your cluster enforces host access via Kyverno, OPA, or admission webhooks, pre-clear these.

The node pod runs a preStop that deletes its CSI socket so kubelet rebinds cleanly on restart.

CRD Management¶

Helm does not upgrade CRDs on helm upgrade — they are installed only on the first helm install. Releases that change CRD schema include reapply instructions in the release notes.

Default StorageClasses¶

The chart ships with two StorageClasses; storageClasses is a list, so you can add your own or set it to [] to skip creation entirely.

Both default to reclaimPolicy: Delete, allowVolumeExpansion: true, and memberMissingTimeout: "900". Per-StorageClass tunables are in StorageClass Parameters.

Two fields are intentionally not exposed per StorageClass:

• volumeBindingMode is hardcoded to WaitForFirstConsumer. The driver doesn't consume CSI topology hints today, but binding deferral still avoids zombie PVs from PVCs that are never claimed.
• allowedTopologies passes through to the rendered StorageClass but is not honored by the driver — placement is driven by internal/nodeinfo's scoring algorithm, not by Kubernetes topology. Setting it does not constrain where MeshStor places replicas.

Container Images & Sidecars¶

The driver and four sidecars are configured separately under image.* and sidecars.* so a single sidecar bump is one focused PR.

pullPolicy defaults to IfNotPresent for every image. imagePullSecrets accepts a string, a list of names, or a list of {name: …} dicts; the chart references existing secrets — it does not create them from username/password.

Where to Tune¶

The full list of values lives in the auto-generated charts/meshstor-csi/README.md. Two cluster-level defaults worth surfacing here:

• defaultRelocationReservePercent (default 10) — per-node free-space reserve so a failed node's replicas can relocate to survivors. Set 0 cluster-wide, or override per node with the meshstor.io/relocation-reserve-percent label.
• node.kubeletDir — change from /var/lib/kubelet if your distro uses a different path (k0s, microk8s, talos).

Common production knobs (image pinning, resources, tolerations, custom StorageClasses, extraObjects) are documented per-key in the chart README.

What's Next¶

• Installation — install and upgrade commands
• StorageClass Parameters — tunables exposed through StorageClass parameters
• Compatibility — supported Kubernetes versions, kernel requirements, distributions
• Prerequisites — node-side setup the chart does not handle (udev rule, drive selection labels)