FlashArray and FlashBlade JSON File

Portworx CSI uses a single secret for both FlashArray and FlashBlade configurations. If you plan to use both together, specify all your FlashBlade and FlashArray entries in a single JSON file.

pure.json file structure

note

• You must enter the Everpure Cloud Dedicated endpoint details in the FlashArray section of the pure.json file.
• You must remove the comments and fields that are not relevant to your deployment.

Without CSI topology

{
    "FlashArrays": [
        {
            "MgmtEndPoint": "<management-endpoint-of-first-fa>",
            "APIToken": "<first-fa-api-token>",
            "Realm": "<first-fa-realm>", # This field is required only for Secure Multi-tenancy.
            "NFSEndPoint": "<nfs-endpoint-of-fa>", # This field is required only for FA file services. Secure Multi-tenancy is not supported with file services.
            "VLAN": "<vlan-id>", ## This field is required only for VLAN binding.
            "Configuration": {
                "ProvisioningDisabled": false # Optional. When true, this array is excluded from new volume provisioning; existing volumes and all other operations remain unaffected.
            }
        },
        {
            "MgmtEndPoint": "<management-endpoint-of-second-fa>",
            "APIToken": "<second-fa-api-token>",
            "Realm": "<second-fa-realm>", # This field is required only for Secure Multi-tenancy.
            "NFSEndPoint": "<nfs-endpoint-of-fa>", # This field is required only for FA file services. Secure Multi-tenancy is not supported with file services.
            "VLAN": "<vlan-id>" ## This field is required only for VLAN binding.
        }
    ],
    "FlashBlades": [
        {
            "MgmtEndPoint": "<management-endpoint-of-first-fb>",
            "APIToken": "<api-token-of-first-fb>",
            "Realm": "<first-fb-realm>", # This field is required only for FlashBlade with secure multi-tenancy.
            "NFSEndPoint": "<nfs-endpoints-of-first-fb>",
            "Configuration": {
                "ProvisioningDisabled": false # Optional. When true, this blade is excluded from new volume provisioning; existing volumes and all other operations remain unaffected.
            }
        },
        {
            "MgmtEndPoint": "<management-endpoint-of-second-fb>",
            "APIToken": "<api-token-of-second-fb>",
            "Realm": "<second-fb-realm>", # This field is required only for FlashBlade with secure multi-tenancy.
            "NFSEndPoint": "<nfs-endpoints-of-second-fb>"
        }
    ],
    "SSLOptions": {
        "VerifySSL": false, # Optional: set to true to enable TLS certificate verification for all management API connections.
        "CABundle": "<base64-encoded-PEM-CA-bundle>" # Optional: required only when VerifySSL is true and the endpoint certificate is signed by a private CA.
    }
}

With CSI topology

{
    "FlashArrays": [
        {
            "MgmtEndPoint": "<management-endpoint-of-first-fa>",
            "APIToken": "<first-fa-api-token>",
            "Realm": "<first-fa-realm>", # This field is required only for Secure Multi-tenancy.
            "NFSEndPoint": "<nfs-endpoint-of-fa>", # This field is required only for FA file services. Secure Multi-tenancy is not supported with file services.
            "VLAN": "<vlan-id>", ## This field is required only for VLAN binding.
            "Labels": {
                "topology.portworx.io/zone": "zone-0",
                "topology.portworx.io/region": "region-0"
            },
            "Configuration": {
                "ProvisioningDisabled": false # Optional. When true, this array is excluded from new volume provisioning; existing volumes and all other operations remain unaffected.
            }
        },
        {
            "MgmtEndPoint": "<management-endpoint-of-second-fa>",
            "APIToken": "<second-fa-api-token>",
            "Realm": "<second-fa-realm>", # This field is required only for Secure Multi-tenancy.
            "NFSEndPoint": "<nfs-endpoint-of-fa>", # This field is required only for FA file services. Secure Multi-tenancy is not supported with file services.
            "VLAN": "<vlan-id>", ## This field is required only for VLAN binding.
            "Labels": {
                "topology.portworx.io/zone": "zone-1",
                "topology.portworx.io/region": "region-1"
            }
        }
    ],
    "FlashBlades": [
        {
            "MgmtEndPoint": "<management-endpoint-of-first-fb>",
            "APIToken": "<api-token-of-first-fb>",
            "Realm": "<first-fb-realm>", # This field is required only for FlashBlade with secure multi-tenancy.
            "NFSEndPoint": "<nfs-endpoints-of-first-fb>",
            "Labels": {
                "topology.portworx.io/zone": "zone-0",
                "topology.portworx.io/region": "region-0"
            },
            "Configuration": {
                "ProvisioningDisabled": false # Optional. When true, this blade is excluded from new volume provisioning; existing volumes and all other operations remain unaffected.
            }
        },
        {
            "MgmtEndPoint": "<management-endpoint-of-second-fb>",
            "APIToken": "<api-token-of-second-fb>",
            "Realm": "<second-fb-realm>", # This field is required only for FlashBlade with secure multi-tenancy.
            "NFSEndPoint": "<nfs-endpoints-of-second-fb>",
            "Labels": {
                "topology.portworx.io/zone": "zone-1",
                "topology.portworx.io/region": "region-1"
            }
        }
    ],
    "SSLOptions": {
        "VerifySSL": false, # Optional: set to true to enable TLS certificate verification for all management API connections.
        "CABundle": "<base64-encoded-PEM-CA-bundle>" # Optional: required only when VerifySSL is true and the endpoint certificate is signed by a private CA.
    }
}

FlashArray object reference

Key	Value	Required?
MgmtEndPoint	Management endpoint of the FlashArray you want to use as backend storage for Kubernetes applications. Data type: string Format: Either an IP address or a fully qualified domain name (without a protocol). Note: For IPv6 addresses, ensure that the IP address is enclosed in square brackets, for example: "MgmtEndPoint": "[XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX]". If you're using FlashArray file services, the fileVIF can be used as a management endpoint. It accepts HTTPS traffic and is created using subinterfaces on both controllers, making it a floating management virtual IP (VIP). This configuration enables high availability. You can configure fileVIF as the mgmtEndpoint in PX-CSI if you want to consolidate management and data communication onto the same interface.	Yes
APIToken	API token for the user account you want to use to perform storage operations on the FlashArray. Data type: string Format: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXX	Yes
Realm	Realms define the boundaries of a tenant. When multiple FlashArrays are attached to a cluster, the admin can specify the realm, and FlashArray volumes will be placed inside this realm.	Yes (only for secure multi-tenancy feature)
NFSEndPoint	NFS endpoint of the FA file services. Data type: string Format: Either an IP address or a fully qualified domain name (without a protocol). Note: If you are using an IPv6 address for NFSEndPoint, ensure that the IP address is enclosed in square brackets, for example: "NFSEndpoint": "[XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX]".	Yes (only for FA file services)
VLAN	VLAN ID for VLAN binding. When set, PX-CSI registers the Kubernetes node as a FlashArray host bound to the specified VLAN, restricting storage traffic to that VLAN. Requires Purity 6.4.1 or later. For more information about VLAN tagging, see the VLAN Tagging section in the Purity//FA Administration Guide.	Yes (only for VLAN binding)
Labels	When you enable CSI topology, you need to specify Labels that describe the topology for each FlashArray. The keys must match a set of specific strings, but you can define your own values. The following CSI topology Labels keys are available: topology.portworx.io/region topology.portworx.io/zone topology.portworx.io/datacenter topology.portworx.io/provider topology.portworx.io/row topology.portworx.io/rack topology.portworx.io/chassis topology.portworx.io/hypervisor Note: If you are a PSO user, you can use topology.purestorage.com labels when you migrate from PSO to Portworx using the pso2px tool.	Yes (only for CSI topology feature)
Configuration	Optional object containing per-array behavioral settings. ProvisioningDisabled (bool, default: false): When true, excludes this array from being selected for new volume provisioning. Existing volumes and all other operations, including attach, detach, and snapshots, remain unaffected.	Optional

FlashBlade object reference

Key	Value	Required?
MgmtEndPoint	Management endpoint of the FlashBlade you want to use as backend storage for Kubernetes applications. Data type: string Format: Either an IP address or a fully qualified domain name (without a protocol).	Yes
APIToken	API token for the user account you want to use to perform storage operations on the FlashBlade. Data type: string Format: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXX Note: When you use FlashBlade Realms, the API token must be from a user with access to the specified Realm.	Yes
Realm	Realms define the boundaries of a tenant. When multiple FlashBlades are attached to a cluster, the admin can specify the realm, and FlashBlade file systems will be placed inside this realm.	Yes (only for secure multi-tenancy feature)
NFSEndPoint	NFS endpoint of the FlashBlade. Data type: string Format: Either an IP address or a fully qualified domain name (without a protocol).	Yes
Labels	When you enable CSI topology, you need to specify Labels that describe the topology for each FlashBlade. The keys must match a set of specific strings, but you can define your own values. The following CSI topology Labels keys are available: topology.portworx.io/region topology.portworx.io/zone topology.portworx.io/datacenter topology.portworx.io/provider topology.portworx.io/row topology.portworx.io/rack topology.portworx.io/chassis topology.portworx.io/hypervisor Note: If you are a PSO user, you can use topology.purestorage.com labels when you migrate from PSO to Portworx using the pso2px tool.	Yes (only for CSI topology feature)
Configuration	Optional object containing per-blade behavioral settings. ProvisioningDisabled (bool, default: false): When true, excludes this blade from being selected for new volume provisioning. Existing volumes and all other operations, including attach, detach, and snapshots, remain unaffected.	Optional

Everpure Cloud Dedicated object reference

Key	Value	Required?
MgmtEndPoint	Management endpoint of the Everpure Cloud Dedicated you want to use as backend storage for Kubernetes applications. Data type: string Format: Either an IP address or a fully qualified domain name (without a protocol).	Yes
APIToken	API token for the user account you want to use to perform storage operations on the Everpure Cloud Dedicated. Data type: string Format: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXX	Yes
Realm	Realms define the boundaries of a tenant. When multiple Everpure Cloud Dedicated instances are attached to a cluster, the admin can specify the realm, and Everpure Cloud Dedicated volumes will be placed inside this realm.	Yes (only for secure multi-tenancy feature)
VLAN	VLAN ID for VLAN binding. When set, PX-CSI registers the Kubernetes node as an Everpure Cloud Dedicated host bound to the specified VLAN, restricting storage traffic to that VLAN. Requires Purity 6.4.1 or later. For more information about VLAN tagging, see the VLAN Tagging section in the Purity//FA Administration Guide.	Yes (only for VLAN binding)
Labels	When you enable CSI topology, you need to specify Labels that describe the topology for each Everpure Cloud Dedicated. The keys must match a set of specific strings, but you can define your own values. The following CSI topology Labels keys are available: topology.portworx.io/region topology.portworx.io/zone topology.portworx.io/datacenter topology.portworx.io/provider topology.portworx.io/row topology.portworx.io/rack topology.portworx.io/chassis topology.portworx.io/hypervisor	Yes (only for CSI topology feature)
Configuration	Optional object containing per-array behavioral settings. ProvisioningDisabled (bool, default: false): When true, excludes this instance from being selected for new volume provisioning. Existing volumes and all other operations, including attach, detach, and snapshots, remain unaffected.	Optional

SSLOptions object reference

SSLOptions is an optional top-level object in pure.json that controls TLS certificate verification for all FlashArray and FlashBlade management API connections. By default, PX-CSI connects over HTTPS without verifying the server certificate. Set VerifySSL to true to enforce certificate validation.

Key	Value	Required?
VerifySSL	When true, PX-CSI validates the TLS certificate presented by each management endpoint against the system root CA pool and any certificates provided in CABundle. When false (default), certificate validation is skipped and connections proceed without verifying the server identity. Data type: boolean Default: false Note: When VerifySSL is true, the management endpoint certificate must contain a Subject Alternative Name (SAN) that matches the MgmtEndPoint value (IP address or DNS name).	No
CABundle	Base64-encoded PEM CA certificate bundle. When provided and VerifySSL is true, PX-CSI appends these certificates to the system root pool so that management endpoint certificates signed by a private CA are trusted. You can concatenate multiple PEM blocks before encoding. Ignored when VerifySSL is false. Data type: string To encode a PEM file: openssl base64 -in ca-cert.pem -A	No