The Container Storage Interface (CSI) allows OpenShift Container Platform to consume storage from storage back ends that implement the CSI interface as persistent storage.
OpenShift Container Platform 4.9 supports version 1.5.0 of the CSI specification.
CSI drivers are typically shipped as container images. These containers are not aware of OpenShift Container Platform where they run. To use CSI-compatible storage back end in OpenShift Container Platform, the cluster administrator must deploy several components that serve as a bridge between OpenShift Container Platform and the storage driver.
The following diagram provides a high-level overview about the components running in pods in the OpenShift Container Platform cluster.
It is possible to run multiple CSI drivers for different storage back ends. Each driver needs its own external controllers deployment and daemon set with the driver and CSI registrar.
External CSI Controllers is a deployment that deploys one or more pods with five containers:
The snapshotter container watches
VolumeSnapshotContent objects and is responsible for the creation and deletion of
The resizer container is a sidecar container that watches for
PersistentVolumeClaim updates and triggers
ControllerExpandVolume operations against a CSI endpoint if you request more storage on
An external CSI attacher container translates
calls from OpenShift Container Platform to respective
ControllerUnpublish calls to the CSI driver.
An external CSI provisioner container that translates
delete calls from OpenShift Container Platform to respective
DeleteVolume calls to the CSI driver.
A CSI driver container
The CSI attacher and CSI provisioner containers communicate with the CSI driver container using UNIX Domain Sockets, ensuring that no CSI communication leaves the pod. The CSI driver is not accessible from outside of the pod.
The external attacher must also run for CSI drivers that do not support
The CSI driver daemon set runs a pod on every node that allows OpenShift Container Platform to mount storage provided by the CSI driver to the node and use it in user workloads (pods) as persistent volumes (PVs). The pod with the CSI driver installed contains the following containers:
A CSI driver registrar, which registers the CSI driver into the
openshift-node service running on the node. The
running on the node then directly connects with the CSI driver using the
UNIX Domain Socket available on the node.
A CSI driver.
The CSI driver deployed on the node should have as few credentials to the
storage back end as possible. OpenShift Container Platform will only use the node plugin
set of CSI calls such as
NodeUnstage, if these calls are implemented.