# Kubernetes
Tigris is S3-compatible, so any Kubernetes workload that uses S3 works with Tigris. There are two ways to connect:
| Approach | Use when | How it works |
| --------------------------------------------------------- | ---------------------------------------------- | ------------------------------------------------- |
| [**Environment variables**](#environment-variables) | Your app uses an S3 SDK (boto3, AWS SDK, etc.) | Store credentials in a Secret, inject as env vars |
| [**Filesystem mount (CSI-S3)**](#filesystem-mount-csi-s3) | Your app reads/writes files from disk | Mount a Tigris bucket as a PersistentVolume |
## Environment variables[](#environment-variables "Direct link to Environment variables")
Store your Tigris credentials in a Kubernetes Secret and inject them into your Deployment as environment variables. This is the most common approach.
### Create a bucket and access key[](#create-a-bucket-and-access-key "Direct link to Create a bucket and access key")
1. Create a Tigris bucket at [storage.new](https://storage.new).
2. Create an access key in the [dashboard](https://console.storage.dev). Give it editor permissions on your bucket and copy the credentials.
### Create a Secret[](#create-a-secret "Direct link to Create a Secret")
```
# secret-tigris-key-mybucket.yaml
apiVersion: v1
kind: Secret
metadata:
name: tigris-key-mybucket
type: Opaque
stringData:
AWS_ACCESS_KEY_ID: tid_*
AWS_SECRET_ACCESS_KEY: tsec_*
AWS_ENDPOINT_URL_S3: https://t3.storage.dev
AWS_ENDPOINT_URL_IAM: https://iam.storage.dev
AWS_REGION: auto
BUCKET_NAME: mybucket
```
```
kubectl apply -f secret-tigris-key-mybucket.yaml
```
### Attach the Secret to your Deployment[](#attach-the-secret-to-your-deployment "Direct link to Attach the Secret to your Deployment")
Reference the Secret in your container spec using `envFrom`:
```
# deployment-myapp.yaml
# inside the spec field of a apps/v1 Deployment
containers:
- name: web
image: myuser/myimage
envFrom:
- secretRef:
name: tigris-key-mybucket
```
```
kubectl apply -f deployment-myapp.yaml
```
Your application can now use any S3 SDK to read and write objects in Tigris.
## Filesystem mount (CSI-S3)[](#filesystem-mount-csi-s3 "Direct link to Filesystem mount (CSI-S3)")
Use [csi-s3](https://github.com/yandex-cloud/k8s-csi-s3) to mount a Tigris bucket as a PersistentVolume. This is useful for workloads that expect a filesystem rather than an S3 API. The driver supports ReadWriteMany access, so multiple Pods across multiple Nodes can use the same bucket.
tip
For workloads that need more control over caching and performance tuning (such as AI/ML training), consider [TigrisFS](/docs/training/tigrisfs/.md) instead. TigrisFS is a Tigris-optimized FUSE filesystem with configurable memory limits, flusher threads, and metadata cache TTLs. It requires manual setup per node rather than a CSI driver, but gives you fine-grained control over I/O behavior.
### Install csi-s3[](#install-csi-s3 "Direct link to Install csi-s3")
If you don't already have Helm installed:
```
brew install helm
```
Create an access key in the [Tigris dashboard](https://console.storage.dev), then install the csi-s3 Helm chart:
```
helm repo add yandex-s3 https://yandex-cloud.github.io/k8s-csi-s3/charts
helm install csi-s3 yandex-s3/csi-s3 \
--set secret.accessKey=tid_... \
--set secret.secretKey=tsec_... \
--set secret.endpoint=https://t3.storage.dev \
--set secret.region=auto \
--set storageClass.name=tigris \
--namespace=kube-system
```
### Use a dynamically created bucket[](#use-a-dynamically-created-bucket "Direct link to Use a dynamically created bucket")
Create a PersistentVolumeClaim with the `tigris` StorageClass. Kubernetes will automatically create a new Tigris bucket:
```
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: infinite-storage
namespace: default
spec:
accessModes:
- ReadWriteMany
- ReadWriteOnce
resources:
requests:
storage: 5Gi
storageClassName: tigris
```
Mount it in a Pod or Deployment:
```
apiVersion: v1
kind: Pod
metadata:
name: tigris-test-nginx
namespace: default
spec:
containers:
- name: www
image: nginx
volumeMounts:
- mountPath: /usr/share/nginx/html
name: webroot
volumes:
- name: webroot
persistentVolumeClaim:
claimName: infinite-storage
readOnly: false
```
The bucket name will match the PersistentVolume name assigned by Kubernetes (e.g. `pvc-836006cd-f687-4819-92b9-6ff0fb908d61`).
### Test the mount[](#test-the-mount "Direct link to Test the mount")
To verify the volume is working, upload a test file and serve it with nginx. Create an `index.html`:
```
Test!
Test!
If you see this, then csi-s3 works!
```
Port-forward the pod:
```
kubectl port-forward pod/tigris-test-nginx 8080:80
```
Open in your browser. You should see the test page:
### Use an existing bucket[](#use-an-existing-bucket "Direct link to Use an existing bucket")
To mount a bucket that already exists, create both a PersistentVolume and a PersistentVolumeClaim. These must be created at the same time so Kubernetes establishes the bidirectional link between them.
```
apiVersion: v1
kind: PersistentVolume
metadata:
name: mybucket
spec:
storageClassName: tigris
capacity:
storage: 10Ti
accessModes:
- ReadWriteMany
claimRef:
namespace: default
name: mybucket
csi:
driver: ru.yandex.s3.csi
controllerPublishSecretRef:
name: csi-s3-secret
namespace: csi-s3
nodePublishSecretRef:
name: csi-s3-secret
namespace: csi-s3
nodeStageSecretRef:
name: csi-s3-secret
namespace: csi-s3
volumeAttributes:
capacity: 10Ti
mounter: geesefs
options: --memory-limit 1000 --dir-mode 0777 --file-mode 0666
volumeHandle: mybucket
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: mybucket
spec:
storageClassName: "tigris"
resources:
requests:
storage: 10Ti
volumeMode: Filesystem
accessModes:
- ReadWriteMany
volumeName: mybucket
```
Then mount it in your Pod or Deployment the same way as above, using `claimName: mybucket`.