[Yandex Cloud documentation](../../../index.md) > [Yandex Managed Service for Kubernetes](../../index.md) > [Step-by-step guides](../index.md) > Installing applications from Cloud Marketplace > Installing Container Storage Interface for S3

# Installing Container Storage Interface for S3


[Container Storage Interface for S3](https://yandex.cloud/en/marketplace/products/yc/csi-s3) (_CSI_) enables you to dynamically reserve [buckets](../../../storage/concepts/bucket.md) of S3-compatible storages and mount them in [Managed Service for Kubernetes cluster](../../concepts/index.md#kubernetes-cluster) [pods](../../concepts/index.md#pod) as [persistent volumes](../../concepts/volume.md#persistent-volume) (_PersistentVolume_). The connection is made using the [FUSE](https://en.wikipedia.org/wiki/Filesystem_in_Userspace) implementation of the [GeeseFS](https://github.com/yandex-cloud/geesefs) file system.

{% note info %}

Before being published on the Yandex Cloud Marketplace, new application versions are performance tested in the Yandex Cloud infrastructure, so they may get updates with a delay. To use the latest version, [install it using a Helm chart from the GitHub repository](csi-s3.md#helm-github-install).

{% endnote %}

You can install Container Storage Interface for S3 in the following ways:
* [Using Cloud Marketplace in the management console](#marketplace-install).
* [Using a Helm chart from the Cloud Marketplace repository](#helm-install).
* [Using a Helm chart from the GitHub repository](#helm-github-install).

## Getting started {#before-you-begin}

1. [Create](../../../iam/operations/sa/create.md) a service account with the `storage.editor` [role](../../../storage/security/index.md#storage-editor).
1. [Create](../../../iam/operations/authentication/manage-access-keys.md#create-access-key) a static access key for the service account. Save the key ID and secret key; you will need them when installing the application.
1. Optionally, [create](../../../storage/operations/buckets/create.md) a Yandex Object Storage bucket to place new volumes into a single bucket with different prefixes. Save the bucket name; you will need it when installing the application. Skip this step if you need to create a separate bucket for each volume.

1. [Make sure](../connect/security-groups.md) the security groups for the Managed Service for Kubernetes cluster and its node groups are configured correctly. If a rule is missing, [add it](../../../vpc/operations/security-group-add-rule.md).

    {% note warning %}
    
    The configuration of security groups determines performance and availability of the cluster and the services and applications running in it.
    
    {% endnote %}

## Installation in the management console using Cloud Marketplace {#marketplace-install}

1. In the [management console](https://console.yandex.cloud), select a folder.
1. Navigate to **Managed Service for Kubernetes**.
1. Click the name of the Managed Service for Kubernetes cluster you need and select the ![image](../../../_assets/console-icons/shopping-cart.svg) **Marketplace** tab.
1. Under **Application available for installation**, select [Container Storage Interface for S3](https://yandex.cloud/en/marketplace/products/yc/csi-s3) and click **Go to install**.
1. Configure the application:
   * **Namespace**: Select the `kube-system` [namespace](../../concepts/index.md#namespace).

      {% note warning %}
      
      The application works correctly only with the `kube-system` namespace.
      
      {% endnote %}

   * **Application name**: Specify the application name, e.g., `csi-s3`.
   * **Create storage class**: Select this option to create a new [storage class](../volumes/manage-storage-class.md) when deploying the application.
   * **Create secret**: Select this option to create a new secret for a storage class when installing the application.
   * **S3 key ID**: Copy and paste the service account key ID into this field.
   * **S3 secret key**: Copy and paste the service account secret key into this field.
   * **General S3 bucket for volumes**: Specify the name of the general bucket to contain your [dynamically provisioned volumes](../../concepts/volume.md#dynamic-provisioning). For CSI to create a new bucket for each volume, leave this field blank.
   * **S3 service address**: Address of the S3 service the application will use. The default is `https://storage.yandexcloud.net`.
   * **GeeseFS mounting options**: Mounting options for GeeseFS. For a complete list of options, see [our GeeseFS guide](https://github.com/yandex-cloud/geesefs).
   * **Volume cleanup policy**: Select the policy to clean up PersistentVolumes when deleting PersistentVolumeClaims:
     * **Retain**: Retain a volume.
     * **Delete**: Delete a volume.
   * **Storage class name**: If you selected **Create storage class**, specify the name for the new storage class.
   * **Secret name**: If you selected **Create secret**, specify the name for the new secret for the storage class. Otherwise, specify the name of the existing secret to use for the storage class.
   * **Ignore all taints**: Select this option if you want the CSI driver used to mount the file system on nodes to ignore all taints set for the Managed Service for Kubernetes cluster nodes.
1. Click **Install**.
1. Wait for the application to change its status to `Deployed`.

## Installation using a Helm chart from the Cloud Marketplace repository {#helm-install}

1. [Install Helm](https://helm.sh/docs/intro/install/) v3.8.0 or higher.
1. [Install kubect](https://kubernetes.io/docs/tasks/tools/install-kubectl) and [configure it to work with the new cluster](../connect/index.md#kubectl-connect).
1. To install a [Helm chart](https://helm.sh/docs/topics/charts/) with CSI, run the following command, specifying the parameters of the key you created [earlier](#before-you-begin):

   ```bash
   helm pull oci://cr.yandex/yc-marketplace/yandex-cloud/csi-s3/csi-s3 \
     --version 0.43.7 \
     --untar && \
   helm install \
     --namespace kube-system \
     --set secret.accessKey=<key_ID> \
     --set secret.secretKey=<secret_key> \
     csi-s3 ./csi-s3/
   ```

   {% note info %}
   
   If you are using a Helm version below 3.8.0, add the `export HELM_EXPERIMENTAL_OCI=1 && \` string at the beginning of the command to enable [Open Container Initiative](https://opencontainers.org/) (OCI) support in the Helm client.
   
   {% endnote %}

   You can also [set additional parameters](#installation-parameters) for Container Storage Interface for S3.

## Installation using a Helm chart from the GitHub repository {#helm-github-install}

The [GitHub repository](https://github.com/yandex-cloud/k8s-csi-s3) contains the latest version of Container Storage Interface for S3 with Object Storage support.

1. [Install Helm](https://helm.sh/docs/intro/install/) v3.8.0 or higher.
1. [Install kubect](https://kubernetes.io/docs/tasks/tools/install-kubectl) and [configure it to work with the new cluster](../connect/index.md#kubectl-connect).
1. To install a [Helm chart](https://helm.sh/docs/topics/charts/) with CSI, run this command:

    ```bash
    helm repo add yandex-s3 https://yandex-cloud.github.io/k8s-csi-s3/charts && \
    helm repo update && \
    helm pull yandex-s3/csi-s3 --untar && \
    helm install \
      --namespace kube-system \
      --set secret.accessKey=<key_ID> \
      --set secret.secretKey=<secret_key> \
      csi-s3 ./csi-s3/
    ```

    You can also [set additional parameters](#installation-parameters) for Container Storage Interface for S3.

    Learn more about [upgrading from different versions of k8s-csi-s3](https://github.com/yandex-cloud/k8s-csi-s3/tree/master#upgrading).

## Parameters for installation using a Helm chart {#installation-parameters}

When installing Container Storage Interface for S3 application, the only required parameters are `secret.accessKey` and `secret.secretKey`. You can skip other parameters or redefine them in the install command using this key: `--set <parameter_name>=<new_value>`.

See the table below for a list of redefinable parameters and their default values:

Parameter name | Description | Default value
--- | --- | ---
`storageClass.create` | Whether a new storage class should be created. | `true`
`storageClass.name` | Storage class name. | `csi-s3`
`storageClass.singleBucket` | Use a single bucket for all PersistentVolumeClaims. |
`storageClass.mountOptions` | GeeseFS mounting options. | `--memory-limit 1000 --dir-mode 0777 --file-mode 0666`
`storageClass.reclaimPolicy` | Volume cleanup policy. | `Delete`
`storageClass.annotations` | Storage class description. |
`secret.create` | Whether a new secret should be created. | `true`
`secret.name` | Secret name. | `csi-s3-secret`
`secret.accessKey` | Key ID. |
`secret.secretKey` | Secret key. |
`secret.endpoint` | S3 service address. | `https://storage.yandexcloud.net`

## Useful links {#see-also}

* [CSI specification](https://github.com/container-storage-interface/spec/blob/master/spec.md)
* [Container Storage Interface for S3 with Object Storage support in GitHub](https://github.com/yandex-cloud/k8s-csi-s3)
* [Integration with Object Storage](../volumes/s3-csi-integration.md)
* [CSI use cases](../volumes/s3-csi-integration.md#examples)
* [Working with persistent and dynamic volumes in Kubernetes](../../concepts/volume.md)