Documentation Index

Fetch the complete documentation index at: https://kb.vastdata.com/llms.txt

Use this file to discover all available pages before exploring further.

Configuring mTLS Authentication for VAST CSI Driver

  • Updated on Aug 5, 2026
  • Published on Aug 5, 2026
  • 1 minute(s) read
Prev Next

Starting with version 2.6.6, VAST CSI Driver supports mTLS authentication on client NFS connections to the VAST NFS server. In multi-tenant environments, mTLS authentication allows for certificate-based access control and isolation of workloads per storage class.

NOTE: mTLS authentication for NFS requires VAST Cluster 5.5.0 or later.

​The requirements are as follows:

  • VAST Cluster 5.5.0 or later

  • VASTNFS 4.5.8 or later

  • Client kernel 6.17 or later

    NOTE: VAST CSI Driver leverages ​cert_serial​ and ​privkey_serial​ mount options that are available since Linux kernel 6.17. Note that ​ktls-utils​​ 1.3.0 and 1.4.0 have a known regression related to these mount options.

​To use mTLS authentication with the driver:

  • ​Configure the VAST cluster to enable mTLS authentication for NFS, as described in the ​VAST Cluster's Administrator's Guide​​:

    • ​Supply the cluster-wide or tenant-specific certificate and identify the certificate field that will be used for tenant association.

    • When using a cluster-wide certificate: set the mTLS identifier for the tenant.

    • ​(Optional) Configure the view policy (the one used by the CSI storage class) to enforce mTLS on NFS connections.

  • ​​Add the client certificate and the private key to the Kubernetes ​secret​​ that is used to supply the user's username and password. The secret must contain the certificate signed by the CA that is set on the cluster or tenant.

    For example, if creating the secret from the command line, add these options:

     --from-file=mtls_client_cert=<certificate> \
 --from-file=mtls_client_privkey=<private key> \

    The certificate and the key must be in PEM format.

  • ​​Configure​ the storage class to use mTLS by adding the ​xprtsec=mtls​​ mount option:

    mountOptions:
    - "xprtsec=mtls"

If the storage class has ​vip_pool_fqdn_random_prefix​ set to true (which is by default) and the TLS server certificate contains a wildcarded string for the DNS name, the string must match all related virtual IP pools, for example: ​*.<vippool-dns-domain>.<dns-suffix>​​. If the TLS server certificate contains a wildcarded SAN across all virtual IP pools (for example, ​*.<dns-suffix>​​), set vip_pool_fqdn_random_prefix to false in the storage class.