About This Tool

Primary Use Case

Key Features

• Supports dynamic provisioning and attachment of Alibaba Cloud Disk, NAS, CPFS, and OSS storage
• Compatible with Kubernetes 1.14+
• Supports multi-node mount for NAS and OSS storage
• Supports block storage with ReadWriteOnce mode for Cloud Disk
• Features in GA: Topology awareness, volume resize, and snapshot support
• OSS bucket mount support without volume provisioning
• Integration recommended via ACK Add-ons for automatic deployment and management

Insights & Recommendations

Manual deployment of the driver in Alibaba Cloud ACK clusters is not officially supported and not recommended; users should rely on ACK Add-ons for deployment and lifecycle management. The driver supports Kubernetes versions 1.14 and above, with some features requiring higher versions. OSS CSI plugin supports mounting but does not support volume provisioning. CPFS plugin has been removed in favor of NAS CSI plugin for CPFS 2.0. For security issues, report via kubernetes-security@service.aliyun.com.

Installation

Do not manually deploy the driver in ACK clusters; use ACK Add-ons for automatic deployment and management
Refer to the installation guide at ./docs/install.md for detailed steps

Smart Usage Notes

• Integrate Alibaba Cloud CSI Driver with Kubernetes admission controllers to enforce secure storage provisioning policies.
• Use the driver’s dynamic provisioning capabilities to automate secure volume lifecycle management, reducing human error.
• Combine with cloud-native monitoring tools to detect anomalous storage access patterns indicating potential misuse or compromise.
• Leverage topology awareness and snapshot features to enhance backup and disaster recovery strategies in Kubernetes clusters.
• Incorporate the CSI driver into purple team exercises to simulate attacks on persistent storage and validate defensive controls.

Security Capability Profile