NetApp Astra Trident & Kubernetes Storage Guide

1. Astra Trident Architectural Core

Astra Trident operates as an in-cluster dynamic storage provisioner complying fully with the CNCF Container Storage Interface (CSI) v1.5+ specification. Built for enterprise containerized workloads, Trident abstracts the underlying storage infrastructure while exposing native ONTAP enterprise data management capabilities to Kubernetes developers and platform engineers.

The system is architected across two distinct Kubernetes control planes:

• Trident Controller Pod (Deployment / StatefulSet): Runs the CSI sidecar containers (csi-provisioner, csi-attacher, csi-snapshotter, csi-resizer, csi-node-driver-registrar) alongside the core trident-main container. It communicates with the ONTAP cluster management LIF over HTTPS using the ONTAP REST API (or ZAPI in legacy versions) to create, modify, snapshot, and delete storage volumes.
• Trident Node Pods (DaemonSet): Runs on every Kubernetes worker node. It registers with the node's local kubelet, manages the host-level storage transport layers (discovering iSCSI LUNs via open-iscsi, negotiating NVMe-oF connections, establishing NFS mounts), configures DM-Multipath paths, formats raw block devices with filesystems (ext4, xfs), and mounts targets into container pod directory namespaces (e.g., /var/lib/kubelet/pods/<pod-uuid>/volumes/).

Trident leverages Kubernetes Custom Resource Definitions (CRDs) for state persistence and reconciliation, eliminating the need for external etcd clusters:

• TridentOrchestrator (torc): Defines and governs the Trident installation state, image registry, debug log levels, and driver parameters.
• TridentBackendConfig (tbc): Namespaced or cluster-wide custom resource declaring connection credentials, SVM targets, data LIFs, storage pools, and management options for an ONTAP array.
• TridentStorageClass (tsc): Internal mapping linking standard Kubernetes StorageClass definitions to qualified Trident storage backends and pools.
• TridentVolume (tv): Tracks the lifecycle, status, backing ONTAP volume name, and binding of every persistent volume.
• TridentSnapshot (ts): Represents point-in-time ONTAP volume snapshots created via Kubernetes CSI volume snapshotting.

2. Trident Storage Drivers Comparison Matrix

Selecting the optimal storage driver depends on workload access patterns (single-node RWO vs multi-node RWX), density requirements, aggregate capacity, and snapshot granularity. ONTAP supports five core Trident drivers alongside dedicated hyperscaler cloud drivers.

3. Prerequisites & ONTAP Preparation

Before deploying Trident, configure Kubernetes worker host operating systems and provision a dedicated, least-privilege ONTAP Storage Virtual Machine (SVM) role.

Worker Node Operating System Setup

All Kubernetes worker nodes requiring NAS or SAN volume attachments must have host utilities and daemons enabled:

# Ubuntu / Debian Worker Nodes:
sudo apt-get update && sudo apt-get install -y open-iscsi nfs-common util-linux dm-multipath
sudo systemctl enable --now iscsid
sudo systemctl enable --now multipathd

# RHEL / Rocky / CentOS Worker Nodes:
sudo dnf install -y iscsi-initiator-utils nfs-utils util-linux device-mapper-multipath
sudo mpathconf --enable --with_multipathd y
sudo systemctl enable --now iscsid
sudo systemctl enable --now multipathd

Configure /etc/multipath.conf on all nodes to prevent multipathd from claiming non-NetApp local OS drives:

defaults {
    user_friendly_names yes
    find_multipaths yes
}

blacklist {
    devnode "^(ram|raw|loop|fd|md|dm-|sr|scd|st)[0-9]*"
    devnode "^(hd|vd)[a-z]"
}

devices {
    device {
        vendor "NETAPP"
        product "LUN.*"
        path_grouping_policy "group_by_prio"
        path_checker "tur"
        features "3 queue_if_no_path 0"
        hardware_handler "1 alua"
        prio "alua"
        failback immediate
        rr_weight "uniform"
        rr_min_io_rq 1
    }
}

ONTAP SVM RBAC Scoping

Create a dedicated REST API administration role and user for Trident on your ONTAP cluster to avoid using the global admin cluster account:

::> security login role create -role trident-role -cmddirname "DEFAULT" -access none
::> security login role create -role trident-role -cmddirname "volume" -access all
::> security login role create -role trident-role -cmddirname "volume snapshot" -access all
::> security login role create -role trident-role -cmddirname "volume clone" -access all
::> security login role create -role trident-role -cmddirname "volume qtree" -access all
::> security login role create -role trident-role -cmddirname "volume quota" -access all
::> security login role create -role trident-role -cmddirname "lun" -access all
::> security login role create -role trident-role -cmddirname "igroup" -access all
::> security login role create -role trident-role -cmddirname "vserver export-policy" -access all
::> security login role create -role trident-role -cmddirname "vserver" -access readonly
::> security login role create -role trident-role -cmddirname "storage aggregate" -access readonly
::> security login role create -role trident-role -cmddirname "network interface" -access readonly

# Create the trident service user bound to the SVM:
::> security login create -user-or-group-name trident_user -application http -authentication-method password -role trident-role -vserver svm_k8s_prod
::> security login create -user-or-group-name trident_user -application ontapi -authentication-method password -role trident-role -vserver svm_k8s_prod

4. Step-by-Step Installation & Backend Configuration

The recommended deployment method for production Kubernetes is the Trident Operator via Helm.

Step 1: Install Trident Operator via Helm

# Add Trident Helm repository
helm repo add netapp-trident https://netapp.github.io/trident-helm-chart
helm repo update

# Install the Trident Operator into the 'trident' namespace
helm install trident netapp-trident/trident-operator \
  --namespace trident \
  --create-namespace \
  --set nodePrep='{iscsi,nfs}' \
  --set enableNodePrep=true

Verify that the operator pod and CRDs are initialized:

kubectl get pods -n trident
kubectl get crds | grep trident

Step 2: Create Storage Backend Secret

Store your SVM credentials in a Kubernetes Secret inside the trident namespace:

apiVersion: v1
kind: Secret
metadata:
  name: ontap-san-nas-secret
  namespace: trident
type: Opaque
stringData:
  username: trident_user
  password: "SecureProductionPassword123!"

Step 3: Define TridentBackendConfig (TBC)

The TridentBackendConfig CRD establishes the connection to ONTAP. Below are production configurations for both NAS (NFS) and SAN (iSCSI):

NAS Backend Config (ontap-nas):

apiVersion: trident.netapp.io/v1
kind: TridentBackendConfig
metadata:
  name: backend-ontap-nas-prod
  namespace: trident
spec:
  version: 1
  storageDriverName: ontap-nas
  managementLIF: 192.168.10.50
  dataLIF: 192.168.20.101
  svm: svm_k8s_prod
  credentials:
    name: ontap-san-nas-secret
  storagePrefix: k8s_nas_
  autoExportPolicy: true
  autoExportCIDRs:
    - "10.244.0.0/16"
    - "192.168.20.0/24"
  defaults:
    spaceReserve: none
    snapshotPolicy: default
    encryption: "true"

SAN Backend Config (ontap-san):

apiVersion: trident.netapp.io/v1
kind: TridentBackendConfig
metadata:
  name: backend-ontap-san-prod
  namespace: trident
spec:
  version: 1
  storageDriverName: ontap-san
  managementLIF: 192.168.10.50
  dataLIF: 192.168.30.101
  svm: svm_k8s_prod
  credentials:
    name: ontap-san-nas-secret
  storagePrefix: k8s_san_
  igroupName: k8s-trident-prod-igroup
  useCHAP: false
  defaults:
    spaceReserve: none
    spaceAllocation: "true"
    fileSystemType: ext4

Apply the backend configs and check backend status:

kubectl apply -f tbc-nas.yaml -f tbc-san.yaml
kubectl get tbc -n trident -o wide

Both backends must display Phase: Bound and Status: Success.

5. Kubernetes StorageClasses & Dynamic PVC Provisioning

Kubernetes StorageClasses link user volume requests to Trident backends with specific performance and lifecycle properties.

StorageClass Definitions

# 1. Standard Production NAS (ReadWriteMany)
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: ontap-nas-standard
provisioner: csi.trident.netapp.io
allowVolumeExpansion: true
reclaimPolicy: Delete
volumeBindingMode: Immediate
parameters:
  backendType: "ontap-nas"
  media: "ssd"
  provisioningType: "thin"
  snapshots: "true"

---
# 2. Ultra-Dense Economy NAS (Qtrees)
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: ontap-nas-economy
provisioner: csi.trident.netapp.io
allowVolumeExpansion: true
reclaimPolicy: Delete
parameters:
  backendType: "ontap-nas-economy"

---
# 3. High Performance Block SAN (ReadWriteOnce)
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: ontap-san-premium
provisioner: csi.trident.netapp.io
allowVolumeExpansion: true
reclaimPolicy: Retain
volumeBindingMode: WaitForFirstConsumer
parameters:
  backendType: "ontap-san"
  media: "ssd"
  spaceAllocation: "true"
  fsType: "ext4"

Dynamic PersistentVolumeClaim (PVC) Example

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: postgres-data-pvc
  namespace: database
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: ontap-san-premium
  resources:
    requests:
      storage: 100Gi

Online Volume Expansion

Trident supports zero-downtime online volume expansion. When a PVC is resized in Kubernetes, Trident dynamically resizes the backing ONTAP FlexVol or LUN and triggers the node filesystem resize (resize2fs / xfs_growfs) automatically:

kubectl patch pvc postgres-data-pvc -n database -p '{"spec":{"resources":{"requests":{"storage":"250Gi"}}}}'

6. Advanced Data Management: Snapshots, Clones & QoS

CSI Volume Snapshots

Trident implements standard Kubernetes VolumeSnapshot CRDs. Snapshot creation executes instantaneously on ONTAP as a redirect-on-write pointer snapshot consuming zero additional capacity at creation:

# Define VolumeSnapshotClass
apiVersion: snapshot.storage.k8s.io/v1
kind: VolumeSnapshotClass
metadata:
  name: ontap-snapshot-class
driver: csi.trident.netapp.io
deletionPolicy: Delete

---
# Create VolumeSnapshot
apiVersion: snapshot.storage.k8s.io/v1
kind: VolumeSnapshot
metadata:
  name: postgres-backup-snap-01
  namespace: database
spec:
  volumeSnapshotClassName: ontap-snapshot-class
  source:
    persistentVolumeClaimName: postgres-data-pvc

Instantaneous Zero-Copy Volume Cloning (FlexClone)

Developers can instantly spin up multi-terabyte staging or testing environments in seconds by referencing a VolumeSnapshot or existing PVC as the dataSource in a new PVC manifest. Trident provisions an ONTAP FlexClone sharing common storage blocks:

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: postgres-staging-clone-pvc
  namespace: database
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: ontap-san-premium
  dataSource:
    name: postgres-backup-snap-01
    kind: VolumeSnapshot
    apiGroup: snapshot.storage.k8s.io
  resources:
    requests:
      storage: 100Gi

Dynamic QoS Enforcement via StorageClass

Enforce predictable I/O limits across noisy neighbor pods by binding ONTAP Fixed or Adaptive QoS policies directly to StorageClasses:

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: ontap-san-gold-qos
provisioner: csi.trident.netapp.io
parameters:
  backendType: "ontap-san"
  qosPolicy: "gold_db_policy"           # Fixed QoS (e.g. min 2000 IOPS, max 8000 IOPS)
  # OR Adaptive QoS:
  # adaptiveQosPolicy: "extreme_adaptive" # Scales IOPS per allocated GB

7. Astra Control Center (ACC) & Application Data Management

While Astra Trident manages storage provisioning at the volume level, Astra Control Center (ACC) and Astra Control Service (ACS) provide application-aware data lifecycle management for stateful Kubernetes workloads.

8. Operational Troubleshooting & Diagnostics Matrix

When Kubernetes storage provisioning or volume attachment fails, use this targeted troubleshooting checklist to diagnose root cause rapidly:

Essential Diagnostic Commands

# View all Trident Backends and Status
kubectl get tridentbackendconfigs -n trident -o wide

# View all registered Trident Storage Classes
kubectl get tridentstorageclasses -n trident

# Inspect Trident Volume internal state and ONTAP mapping
kubectl get tridentvolumes -n trident -o wide

# Dump Trident Controller logs for recent failures
kubectl logs -n trident -l app=controller.csi.trident.netapp.io -c trident-main --tail=100

# Run tridentctl utility diagnostics inside container or CLI
tridentctl version -n trident
tridentctl get backend -n trident

9. Production Best Practices Checklist

• Separate Management and Data Traffic: Assign dedicated VLANs and subnets for ONTAP cluster management LIFs vs iSCSI/NFS Data LIFs.
• Enable Thin Provisioning & Space Allocation: Set spaceReserve: none and spaceAllocation: "true" for SAN backends to ensure SCSI UNMAP / TRIM reclamation functions properly.
• Enforce Storage Quotas: When using ontap-nas-economy, enforce hard tree quotas to prevent a single pod from monopolizing the shared parent FlexVolume.
• Use WaitForFirstConsumer Binding: Set volumeBindingMode: WaitForFirstConsumer on SAN StorageClasses so volumes are provisioned in the aggregate closest to the scheduled pod.
• Automate Snapshot Retention: Use standard Kubernetes VolumeSnapshot schedules or integrate Astra Control Center to automate enterprise backup schedules and off-site replication.