Overview¶

The HPE COSI Driver for Kubernetes is deployed by using industry standard means, a Helm chart.

Delivery Vehicles¶

Helm is currently the only supported delivery vehicle for the deployment of the HPE COSI Driver.

Helm¶

Helm is the package manager for Kubernetes. Software is being delivered in a format designated as a "chart". Helm is a standalone CLI that interacts with the Kubernetes API server using your KUBECONFIG file.

The official Helm chart for the HPE COSI Driver for Kubernetes is hosted on Artifact Hub. The chart supports Helm 3 from version 1.0.0 of the HPE COSI Driver. In an effort to avoid duplicate documentation, please see the chart for instructions on how to deploy the COSI driver using Helm.

• Go to the chart on Artifact Hub.

Helm for Air-gapped Environments¶

In the event of deploying the HPE COSI Driver in a secure air-gapped environment, the images used by the Helm chart and the upstream SIG Storage COSI controller need to be mirrored to a private registry.

Establish a working directory on a bastion Linux host that has HTTP access to the Internet, the private registry and the Kubernetes cluster where the COSI driver needs to be installed. The bastion host is assumed to have the docker, helm and kubectl command installed. It's also assumed throughout that the user executing docker has logged in to the private registry and that pulling images from the private registry is allowed anonymously by the Kubernetes compute nodes.

Create a working directory and set environment variables referenced throughout the procedure.

mkdir hpe-cosi-driver
cd hpe-cosi-driver
export MY_REGISTRY=registry.enterprise.example.com
export MY_COSI_DRIVER=2.0.0

Next, create a list with the COSI driver images.

helm repo add hpe-storage https://hpe-storage.github.io/co-deployments/
helm repo update
helm template hpe-storage/hpe-cosi-driver --version ${MY_COSI_DRIVER} \
| grep 'image:' | awk '{print $2}' | tr -d '"' | sort | uniq > images

The upstream SIG Storage COSI controller is deployed separately from the Helm chart and its image needs to be added to the list.

kubectl kustomize "github.com/kubernetes-sigs/container-object-storage-interface//?ref=release-0.2" \
| grep 'image:' | awk '{print $2}' | sort | uniq >> images

Pull, tag and push the images to the private registry.

cat images | xargs -n 1 docker pull
awk '{ print $1" "$1 }' images | sed -E -e "s/ quay.io| registry.k8s.io| gcr.io/ ${MY_REGISTRY}/" | xargs -n 2 docker tag
sed -E -e "s/quay.io|registry.k8s.io|gcr.io/${MY_REGISTRY}/" images | xargs -n 1 docker push

All images used by the HPE COSI Driver Helm chart are parameterized individually with the fully qualified URL. Create a values.yaml file with the mirrored locations.

containers:
  cosiDriver:
    image: registry.enterprise.example.com/hpestorage/cosi-driver:v2.0.0
  sideCar:
    image: registry.enterprise.example.com/sig-storage/objectstorage-sidecar:v0.2.2

Install the chart with the values.yaml file.

helm install my-hpe-cosi-driver hpe-storage/hpe-cosi-driver \
-n default --version ${MY_COSI_DRIVER} \
-f values.yaml

The SIG Storage COSI controller manifests need the image reference replaced before being applied.

kubectl kustomize "github.com/kubernetes-sigs/container-object-storage-interface//?ref=release-0.2" \
| sed -e "s/container-object-storage-system/default/g" \
| sed -E -e "s|gcr.io|${MY_REGISTRY}|" \
| kubectl apply -f -

Add an HPE Storage Backend¶

Once the COSI driver is deployed, you must create a Secret with the following details before you can use the COSI API resources.

Secret Parameters¶

Example Secret manifest for an HPE Alletra Storage MP X10000 deployment:

apiVersion: v1
kind: Secret
metadata:
  name: hpe-object-backend
  namespace: default
stringData:
  accessKey: testuser
  secretKey: testkey
  endpoint: http://192.168.1.100:8080
  glcpUserClientId: 00000000-0000-0000-0000-000000000000
  glcpUserSecretKey: 00000000000000000000000000000000
  glcpWorkspaceId: 00000000000000000000000000000000
  dsccZone: us1.data.cloud.hpe.com
  clusterSerialNumber: 0000000000

apiVersion: v1
kind: Secret
metadata:
  name: hpe-object-backend
  namespace: default
stringData:
  accessKey: testuser
  secretKey: testkey
  endpoint: http://192.168.1.100:8080
  glcpUserClientId: 00000000-0000-0000-0000-000000000000
  glcpUserSecretKey: 00000000000000000000000000000000
  dsccZone: dscc-api.example.lab.nimblestorage.com
  clusterSerialNumber: 0000000000
  # Optional: include if the DSCC CA certificate is not in the cluster's truststore
  # onPremCloudCA: <base64-encoded-ca-certificate>

Create the Secret.

kubectl create -f hpe-object-backend.yaml

Creating and Locating Resources¶

1. To create the S3 user:
   • Follow the steps in the HPE documentation to create an access policy.
     • Choose All Buckets.
     • Add custom actions for the policy: CreateBucket, DeleteBucket, PutBucketTagging.
   • To create the user, refer to the HPE documentation for this purpose and select the access policy created in the previous step.
     • Save the user name and password. These will be used as the S3 access key and S3 secret key respectively in the COSI secret.
2. To create the HPE Green Lake API client ID and secret, refer to the following HPE documentation.
3. To locate the Data Services Cloud Console zone FQDN:
   • Log into HPE Data Services Cloud Console.
   • On the Services page, click My Services to view all services available in your workspace.
   • Select the service that your HPE Alletra Storage MP X10000 device is assigned to and click Launch.
   • After the service is launched, save the value of the URL from the browser. E.g.: https://console-us1.data.cloud.hpe.com.
   • After dropping the prefix https://console-, the Data Services Cloud Console zone FQDN value to be used in the Secret should have the following format: us1.data.cloud.hpe.com.
   • Supported Data Services Cloud Console zone FQDNs as of June 2026 are:
     • us1.data.cloud.hpe.com
     • jp1.data.cloud.hpe.com
     • eu1.data.cloud.hpe.com
     • uk1.data.cloud.hpe.com
     • uae1.data.cloud.hpe.com
   • For the latest list of supported zones, refer to the HPE documentation.
4. To locate the S3 endpoint:
   • Log into HPE Data Services Cloud Console.
   • Launch the service that your HPE Alletra Storage MP X10000 device is assigned to.
   • Select Data Ops Manager.
   • From the menu on the left, select Systems. From the list click on the name of the system you want to use for COSI operations.
   • Click on the Networking tab. Under the Frontend Network section, save the value of the Network DNS Subdomains field.
   • The S3 endpoint can be constructed from the Network DNS Subdomains value by using the format: http://<Network DNS Subdomains>.
5. To locate the cluster serial number of the HPE Alletra Storage MP X10000 system, refer to the following HPE documentation.
6. To view the workspace ID and manage the workspace (required from 2.0.0):
   • Log into the HPE Data Services Cloud Console UI.
   • Navigate to Quick links → Manage Workspace.
   • The Workspace ID is displayed on the page and is used as the glcpWorkspaceId field in the Secret.
   • For more details, refer to the Manage workspace documentation.
7. To obtain the CA certificate (required for HPE Alletra Storage MP Disconnected with X10000 setups):
   • Retrieve the CA certificate from the HPE Data Services Cloud Console instance being used. For the download steps, refer to the Downloading your CA certificates documentation.
   • Encode the certificate in Base64 format and use the resulting value as the onPremCloudCA field in the Secret.

Next Steps¶

Next you need to create a BucketClass.