> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# CSI Provider Helm chart

> Deploy the Infisical CSI Provider on Kubernetes using the official Helm chart.

The Infisical CSI Provider integrates with the [Secrets Store CSI Driver](https://secrets-store-csi-driver.sigs.k8s.io/) to mount Infisical secrets directly into Kubernetes pods as files, without creating Kubernetes Secret resources.

For usage details including `SecretProviderClass` configuration and pod mounting, see the [CSI Provider documentation](https://infisical.com/docs/integrations/platforms/kubernetes-csi.md).

## Installation

**1. Install the Secrets Store CSI Driver**

The CSI Driver must be installed first:

```bash theme={"dark"}
helm repo add secrets-store-csi-driver https://kubernetes-sigs.github.io/secrets-store-csi-driver/charts
```

> [tab] Standard
>
> ```bash theme={"dark"}
> helm install csi secrets-store-csi-driver/secrets-store-csi-driver \
>   --namespace kube-system \
>   --set "tokenRequests[0].audience=infisical" \
>   --set enableSecretRotation=true \
>   --set rotationPollInterval=2m \
>   --set "syncSecret.enabled=true"
> ```

> [tab] Without custom audience (e.g., EKS)
>
> ```bash theme={"dark"}
> helm install csi secrets-store-csi-driver/secrets-store-csi-driver \
>   --namespace kube-system \
>   --set enableSecretRotation=true \
>   --set rotationPollInterval=2m \
>   --set "syncSecret.enabled=true"
> ```
>
> > [!WARNING]
> >
> > Set `useDefaultAudience: "true"` in your `SecretProviderClass` when using this installation.

**2. Install the Infisical CSI Provider**

```bash theme={"dark"}
helm repo add infisical-helm-charts 'https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/'
helm repo update

helm install infisical-csi-provider infisical-helm-charts/infisical-csi-provider
```

**3. Verify the deployment**

```bash theme={"dark"}
kubectl get pods -n kube-system -l app=infisical-csi-provider
```

## Uninstall

```bash theme={"dark"}
helm uninstall infisical-csi-provider
```

## Configuration reference

| Parameter | Default | Description |
| - | - | - |
| `name` | `infisical-csi-provider` | Name of the CSI provider deployment. |
| `namespace` | `kube-system` | Namespace for the provider. |
| `image.repository` | `infisical/infisical-csi-provider` | Container image. |
| `image.tag` | `v0.0.7` | Image tag. |
| `image.pullPolicy` | `IfNotPresent` | Image pull policy. |
| `resources.requests.cpu` | `50m` | CPU request. |
| `resources.requests.memory` | `100Mi` | Memory request. |
| `resources.limits.cpu` | `50m` | CPU limit. |
| `resources.limits.memory` | `100Mi` | Memory limit. |
| `nodeSelector` | `{ kubernetes.io/os: linux }` | Node selector. Defaults to Linux nodes only. |
| `tolerations` | `[]` | Pod tolerations. |
| `labels` | `{}` | Additional labels for resources. |
| `podLabels` | `{}` | Additional labels for pods. |

## Default Helm values

```yaml theme={"dark"}
# Name of the CSI provider deployment
name: infisical-csi-provider
# Namespace where CSI provider will be deployed
namespace: kube-system

# Container image configuration
image:
  repository: infisical/infisical-csi-provider
  tag: v0.0.7
  pullPolicy: IfNotPresent

# Infisical provider arguments
args:
  - -endpoint=/provider/infisical.sock

# Unix domain socket path for CSI driver communication
endpoint: /provider/infisical.sock

# Resource limits and requests
resources:
  requests:
    cpu: 50m
    memory: 100Mi
  limits:
    cpu: 50m
    memory: 100Mi

# Volume configuration for provider socket
providerVolume:
  mountPath: /provider
  hostPath: /etc/kubernetes/secrets-store-csi-providers

# Health check for container liveness
livenessProbe:
  httpGet:
    path: /health/ready
    port: 8080
    scheme: HTTP
  failureThreshold: 2
  initialDelaySeconds: 5
  periodSeconds: 5
  successThreshold: 1
  timeoutSeconds: 3

# Health check for container readiness
readinessProbe:
  httpGet:
    path: /health/ready
    port: 8080
    scheme: HTTP
  failureThreshold: 2
  initialDelaySeconds: 5
  periodSeconds: 5
  successThreshold: 1
  timeoutSeconds: 3

# Node selection criteria
nodeSelector:
  kubernetes.io/os: linux

# Optional configurations
labels: {}
podLabels: {}
tolerations: []
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.