diff --git a/class/csi-driver-nfs.yml b/class/csi-driver-nfs.yml
index dcaf2648..cb1fb452 100644
--- a/class/csi-driver-nfs.yml
+++ b/class/csi-driver-nfs.yml
@@ -1,11 +1,28 @@
 parameters:
   kapitan:
+    dependencies:
+      - type: helm
+        source: ${csi_driver_nfs:charts:csi-driver-nfs:source}
+        chart_name: csi-driver-nfs
+        version: ${csi_driver_nfs:charts:csi-driver-nfs:version}
+        output_path: ${_base_directory}/helmcharts/csi-driver-nfs/v${csi_driver_nfs:charts:csi-driver-nfs:version}
+
     compile:
       - input_paths:
           - ${_base_directory}/component/app.jsonnet
         input_type: jsonnet
         output_path: .
+      - output_path: ${_instance}/10_helmchart
+        input_type: helm
+        output_type: yaml
+        input_paths:
+          - ${_base_directory}/helmcharts/csi-driver-nfs/v${csi_driver_nfs:charts:csi-driver-nfs:version}
+        helm_values: ${csi_driver_nfs:helmValues}
+        helm_params:
+          name: csi-driver-nfs
+          namespace: '${csi_driver_nfs:namespace}'
       - input_paths:
           - ${_base_directory}/component/main.jsonnet
+          - ${_base_directory}/component/storageclasses.jsonnet
         input_type: jsonnet
         output_path: csi-driver-nfs/
diff --git a/class/defaults.yml b/class/defaults.yml
index dee6d559..744060a1 100644
--- a/class/defaults.yml
+++ b/class/defaults.yml
@@ -3,3 +3,32 @@ parameters:
     =_metadata:
       multi_tenant: true
     namespace: syn-csi-driver-nfs
+
+    charts:
+      csi-driver-nfs:
+        source: https://raw.githubusercontent.com/kubernetes-csi/csi-driver-nfs/master/charts
+        version: 4.13.2
+
+    images:
+      nfs:
+        registry: registry.k8s.io
+        repository: sig-storage/nfsplugin
+        tag: v4.13.2
+
+    storageClassDefaults: {}
+    storageClasses: {}
+
+    controller:
+      serviceAccountName: csi-nfs-controller-sa
+
+    node:
+      serviceAccountName: csi-nfs-node-sa
+
+    helmValues:
+      serviceAccount:
+        controller: ${csi_driver_nfs:controller:serviceAccountName}
+        node: ${csi_driver_nfs:node:serviceAccountName}
+      image:
+        nfs:
+          repository: ${csi_driver_nfs:images:nfs:registry}/${csi_driver_nfs:images:nfs:repository}
+          tag: ${csi_driver_nfs:images:nfs:tag}
diff --git a/component/main.jsonnet b/component/main.jsonnet
index 55e93ae8..3f664198 100644
--- a/component/main.jsonnet
+++ b/component/main.jsonnet
@@ -2,9 +2,40 @@
 local kap = import 'lib/kapitan.libjsonnet';
 local kube = import 'lib/kube.libjsonnet';
 local inv = kap.inventory();
-// The hiera parameters for the component
 local params = inv.parameters.csi_driver_nfs;
 
-// Define outputs below
+local isOpenshift = std.member([ 'openshift4', 'oke' ], inv.parameters.facts.distribution);
+
+local sccRBAC = [
+  kube.RoleBinding('scc-privileged') {
+    roleRef: {
+      apiGroup: 'rbac.authorization.k8s.io',
+      kind: 'ClusterRole',
+      name: 'system:openshift:scc:privileged',
+    },
+    subjects: [
+      {
+        kind: 'ServiceAccount',
+        name: params.controller.serviceAccountName,
+      },
+      {
+        kind: 'ServiceAccount',
+        name: params.node.serviceAccountName,
+      },
+    ],
+  },
+];
+
 {
+  '00_namespace': kube.Namespace(params.namespace) {
+    metadata+: {
+      annotations: {
+        'openshift.io/node-selector': '',
+      },
+      labels: {
+        'openshift.io/cluster-monitoring': 'true',
+      },
+    },
+  },
+  [if isOpenshift then '02_scc_rbac']: sccRBAC,
 }
diff --git a/component/storageclasses.jsonnet b/component/storageclasses.jsonnet
new file mode 100644
index 00000000..ec7aed51
--- /dev/null
+++ b/component/storageclasses.jsonnet
@@ -0,0 +1,39 @@
+local com = import 'lib/commodore.libjsonnet';
+local kap = import 'lib/kapitan.libjsonnet';
+local kube = import 'lib/kube.libjsonnet';
+local sc = import 'lib/storageclass.libsonnet';
+
+local inv = kap.inventory();
+local params = inv.parameters.csi_driver_nfs;
+
+local scDefaults = params.storageClassDefaults;
+// get provisioner name from Helm values, falling back on driver default of
+// `nfs.csi.k8s.io`.
+local provisionerName =
+  std.get(
+    params.helmValues, 'driver', { name: 'nfs.csi.k8s.io' }
+  ).name;
+
+local storageclasses = std.map(
+  function(sc)
+    if
+      !std.objectHas(sc, 'parameters') ||
+      !std.isObject(sc.parameters) ||
+      !std.objectHas(sc.parameters, 'server') ||
+      !std.objectHas(sc.parameters, 'share')
+    then
+      error 'StorageClass "%s" for NFS CSI driver is invalid: one or more of `parameters.server` and `parameters.share` are missing!' % [ sc.metadata.name ]
+    else
+      sc {
+        provisioner: provisionerName,
+      },
+  com.generateResources(
+    params.storageClasses,
+    function(name) sc.storageClass(name) + com.makeMergeable(scDefaults)
+  )
+);
+
+
+{
+  [if std.length(storageclasses) > 0 then '50_storageclasses']: storageclasses,
+}
diff --git a/docs/modules/ROOT/pages/references/parameters.adoc b/docs/modules/ROOT/pages/references/parameters.adoc
index 344b0083..b640a2b8 100644
--- a/docs/modules/ROOT/pages/references/parameters.adoc
+++ b/docs/modules/ROOT/pages/references/parameters.adoc
@@ -10,6 +10,88 @@ default:: `syn-csi-driver-nfs`
 
 The namespace in which to deploy this component.
 
+== `charts`
+
+[horizontal]
+type:: object
+default:: https://github.com/projectsyn/component-csi-driver-nfs/blob/master/class/defaults.yml[See `class/defaults.yml`]
+
+The Helm chart for the NFS CSI driver.
+
+== `images`
+
+[horizontal]
+type:: object
+default:: https://github.com/projectsyn/component-csi-driver-nfs/blob/master/class/defaults.yml[See `class/defaults.yml`]
+
+The container image used by the NFS CSI driver.
+
+TIP: Helm value `image.baseRepo` allows overriding the container image registry for all images that aren't defined in this parameter.
+
+== `storageClassDefaults`
+
+[horizontal]
+type:: object
+default:: `{}`
+
+Storage class configurations which are used as the base configuration for each storage class defined in parameter `storageClasses`.
+
+== `storageClasses`
+
+[horizontal]
+type:: object
+default:: `{}`
+
+Each key-value pair defined in this parameter is used to render a `StorageClass` resource.
+Entries with `null` values are dropped.
+The key is used as `metadata.name` of the resulting `StorageClass` resource.
+The value merged over the configuration defined in parameter `storageClassDefaults` to form the `StorageClass` resource.
+Field `provisioner` of each `StorageClass` resource is set to `helmValues.driver.name`, falling back to `nfs.csi.k8s.io` if the Helm value isn't set.
+Values for `provisioner` which are set in parameter `storageClassDefaults` or the value of an entry of this parameter are overwritten.
+
+TIP: The component uses component [`storageclass`], so this component respects globally defined storage class default configurations and the globally defined default storage class.
+
+NOTE: Apart from enforcing that each storage class sets `parameters.server` and `parameters.share`, the component doesn't validate whether the resulting `StorageClass` resources are valid.
+
+== `controller`
+
+[horizontal]
+type:: object
+
+Configurations for the NFS CSI controller.
+
+=== `controller.serviceAccountName`
+
+[horizontal]
+type:: string
+default:: `csi-nfs-controller-sa`
+
+The service account name for the NFS CSI controller.
+This parameter is passed to the Helm chart and used by the component to configure a `RoleBinding` to grant the controller access to the `privileged` SCC on OpenShift.
+
+== `node`
+
+[horizontal]
+type:: object
+
+Configurations for the NFS CSI node daemonset.
+
+=== `node.serviceAccountName`
+
+[horizontal]
+type:: string
+default:: `csi-nfs-node-sa`
+
+The service account name for the NFS CSI node daemonset.
+This parameter is passed to the Helm chart and used by the component to configure a `RoleBinding` to grant the node daemonset access to the `privileged` SCC on OpenShift.
+
+== `helmValues`
+
+[horizontal]
+type:: object
+default:: https://github.com/projectsyn/component-csi-driver-nfs/blob/master/class/defaults.yml[See `class/defaults.yml]
+
+The Helm values that are used to render the Helm chart.
 
 == Example
 
diff --git a/renovate.json b/renovate.json
index f2e1d671..dd60c3fd 100644
--- a/renovate.json
+++ b/renovate.json
@@ -37,6 +37,10 @@
         "automerge",
         "bump:patch"
       ]
+    },
+    {
+      "matchPackageNames": ["csi-driver-nfs", "registry.k8s.io/sig-storage/nfsplugin"],
+      "groupName": "dependency csi-driver-nfs"
     }
   ]
 }
diff --git a/tests/defaults.yml b/tests/defaults.yml
index a4da5b7b..b6eda06b 100644
--- a/tests/defaults.yml
+++ b/tests/defaults.yml
@@ -1,3 +1,28 @@
-# Overwrite parameters here
+parameters:
+  kapitan:
+    dependencies:
+      - type: https
+        source: https://raw.githubusercontent.com/projectsyn/component-storageclass/v1.0.0/lib/storageclass.libsonnet
+        output_path: vendor/lib/storageclass.libsonnet
 
-# parameters: {...}
+  storageclass:
+    defaultClass: nfs
+    defaults: {}
+
+  csi_driver_nfs:
+    storageClassDefaults:
+      reclaimPolicy: Delete
+      volumeBindingMode: WaitForFirstConsumer
+      allowVolumeExpansion: true
+      mountOptions:
+        - nfsvers=4.1
+    storageClasses:
+      nfs1-example-com:
+        parameters:
+          server: nfs1.example.com
+          share: /
+      nfs2-example-net:
+        parameters:
+          server: nfs2.example.net
+          share: /exports/k8s
+      removed: null
diff --git a/tests/golden/defaults/csi-driver-nfs/csi-driver-nfs/00_namespace.yaml b/tests/golden/defaults/csi-driver-nfs/csi-driver-nfs/00_namespace.yaml
new file mode 100644
index 00000000..ccf08f15
--- /dev/null
+++ b/tests/golden/defaults/csi-driver-nfs/csi-driver-nfs/00_namespace.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  annotations:
+    openshift.io/node-selector: ''
+  labels:
+    openshift.io/cluster-monitoring: 'true'
+  name: syn-csi-driver-nfs
diff --git a/tests/golden/defaults/csi-driver-nfs/csi-driver-nfs/10_helmchart/csi-driver-nfs/templates/csi-nfs-controller.yaml b/tests/golden/defaults/csi-driver-nfs/csi-driver-nfs/10_helmchart/csi-driver-nfs/templates/csi-nfs-controller.yaml
new file mode 100644
index 00000000..f287184a
--- /dev/null
+++ b/tests/golden/defaults/csi-driver-nfs/csi-driver-nfs/10_helmchart/csi-driver-nfs/templates/csi-nfs-controller.yaml
@@ -0,0 +1,210 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app.kubernetes.io/instance: csi-driver-nfs
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: csi-driver-nfs
+    app.kubernetes.io/version: 4.13.2
+    helm.sh/chart: csi-driver-nfs-4.13.2
+  name: csi-nfs-controller
+  namespace: syn-csi-driver-nfs
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: csi-nfs-controller
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: csi-nfs-controller
+        app.kubernetes.io/instance: csi-driver-nfs
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: csi-driver-nfs
+        app.kubernetes.io/version: 4.13.2
+        helm.sh/chart: csi-driver-nfs-4.13.2
+    spec:
+      containers:
+        - args:
+            - -v=2
+            - --csi-address=$(ADDRESS)
+            - --leader-election
+            - --leader-election-namespace=syn-csi-driver-nfs
+            - --extra-create-metadata=true
+            - --feature-gates=HonorPVReclaimPolicy=true,VolumeAttributesClass=false
+            - --timeout=1200s
+            - --retry-interval-max=30m
+          env:
+            - name: ADDRESS
+              value: /csi/csi.sock
+          image: registry.k8s.io/sig-storage/csi-provisioner:v6.1.0
+          imagePullPolicy: IfNotPresent
+          name: csi-provisioner
+          resources:
+            limits:
+              memory: 400Mi
+            requests:
+              cpu: 10m
+              memory: 20Mi
+          securityContext:
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+          volumeMounts:
+            - mountPath: /csi
+              name: socket-dir
+        - args:
+            - -csi-address=$(ADDRESS)
+            - -v=2
+            - -leader-election
+            - --leader-election-namespace=syn-csi-driver-nfs
+            - -handle-volume-inuse-error=false
+            - -feature-gates=VolumeAttributesClass=false
+          env:
+            - name: ADDRESS
+              value: /csi/csi.sock
+          image: registry.k8s.io/sig-storage/csi-resizer:v2.0.0
+          imagePullPolicy: IfNotPresent
+          name: csi-resizer
+          resources:
+            limits:
+              memory: 400Mi
+            requests:
+              cpu: 10m
+              memory: 20Mi
+          securityContext:
+            capabilities:
+              drop:
+                - ALL
+          volumeMounts:
+            - mountPath: /csi
+              name: socket-dir
+        - args:
+            - --v=2
+            - --csi-address=$(ADDRESS)
+            - --leader-election-namespace=syn-csi-driver-nfs
+            - --leader-election
+            - --timeout=1200s
+            - --retry-interval-max=30m
+          env:
+            - name: ADDRESS
+              value: /csi/csi.sock
+          image: registry.k8s.io/sig-storage/csi-snapshotter:v8.4.0
+          imagePullPolicy: IfNotPresent
+          name: csi-snapshotter
+          resources:
+            limits:
+              memory: 200Mi
+            requests:
+              cpu: 10m
+              memory: 20Mi
+          securityContext:
+            capabilities:
+              drop:
+                - ALL
+          volumeMounts:
+            - mountPath: /csi
+              name: socket-dir
+        - args:
+            - --csi-address=/csi/csi.sock
+            - --probe-timeout=3s
+            - --http-endpoint=localhost:29652
+            - --v=2
+          image: registry.k8s.io/sig-storage/livenessprobe:v2.17.0
+          imagePullPolicy: IfNotPresent
+          name: liveness-probe
+          resources:
+            limits:
+              memory: 100Mi
+            requests:
+              cpu: 10m
+              memory: 20Mi
+          securityContext:
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+          volumeMounts:
+            - mountPath: /csi
+              name: socket-dir
+        - args:
+            - --v=5
+            - --nodeid=$(NODE_ID)
+            - --endpoint=$(CSI_ENDPOINT)
+            - --drivername=nfs.csi.k8s.io
+            - --mount-permissions=0
+            - --working-mount-dir=/tmp
+            - --default-ondelete-policy=delete
+            - --use-tar-command-in-snapshot=false
+            - --enable-snapshot-compression=true
+          env:
+            - name: NODE_ID
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+            - name: CSI_ENDPOINT
+              value: unix:///csi/csi.sock
+          image: registry.k8s.io/sig-storage/nfsplugin:v4.13.2
+          imagePullPolicy: IfNotPresent
+          livenessProbe:
+            failureThreshold: 5
+            httpGet:
+              host: localhost
+              path: /healthz
+              port: 29652
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            timeoutSeconds: 10
+          name: nfs
+          resources:
+            limits:
+              memory: 200Mi
+            requests:
+              cpu: 10m
+              memory: 20Mi
+          securityContext:
+            allowPrivilegeEscalation: true
+            capabilities:
+              add:
+                - SYS_ADMIN
+              drop:
+                - ALL
+            privileged: true
+          volumeMounts:
+            - mountPath: /var/lib/kubelet/pods
+              mountPropagation: Bidirectional
+              name: pods-mount-dir
+            - mountPath: /csi
+              name: socket-dir
+      dnsPolicy: ClusterFirstWithHostNet
+      hostNetwork: true
+      nodeSelector:
+        kubernetes.io/os: linux
+      priorityClassName: system-cluster-critical
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
+      serviceAccountName: csi-nfs-controller-sa
+      tolerations:
+        - effect: NoSchedule
+          key: node-role.kubernetes.io/master
+          operator: Exists
+        - effect: NoSchedule
+          key: node-role.kubernetes.io/controlplane
+          operator: Exists
+        - effect: NoSchedule
+          key: node-role.kubernetes.io/control-plane
+          operator: Exists
+        - effect: NoSchedule
+          key: CriticalAddonsOnly
+          operator: Exists
+      volumes:
+        - hostPath:
+            path: /var/lib/kubelet/pods
+            type: Directory
+          name: pods-mount-dir
+        - emptyDir: {}
+          name: socket-dir
diff --git a/tests/golden/defaults/csi-driver-nfs/csi-driver-nfs/10_helmchart/csi-driver-nfs/templates/csi-nfs-driverinfo.yaml b/tests/golden/defaults/csi-driver-nfs/csi-driver-nfs/10_helmchart/csi-driver-nfs/templates/csi-nfs-driverinfo.yaml
new file mode 100644
index 00000000..151dc5dd
--- /dev/null
+++ b/tests/golden/defaults/csi-driver-nfs/csi-driver-nfs/10_helmchart/csi-driver-nfs/templates/csi-nfs-driverinfo.yaml
@@ -0,0 +1,9 @@
+apiVersion: storage.k8s.io/v1
+kind: CSIDriver
+metadata:
+  name: nfs.csi.k8s.io
+spec:
+  attachRequired: false
+  fsGroupPolicy: File
+  volumeLifecycleModes:
+    - Persistent
diff --git a/tests/golden/defaults/csi-driver-nfs/csi-driver-nfs/10_helmchart/csi-driver-nfs/templates/csi-nfs-node.yaml b/tests/golden/defaults/csi-driver-nfs/csi-driver-nfs/10_helmchart/csi-driver-nfs/templates/csi-nfs-node.yaml
new file mode 100644
index 00000000..6bd43995
--- /dev/null
+++ b/tests/golden/defaults/csi-driver-nfs/csi-driver-nfs/10_helmchart/csi-driver-nfs/templates/csi-nfs-node.yaml
@@ -0,0 +1,164 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  labels:
+    app.kubernetes.io/instance: csi-driver-nfs
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: csi-driver-nfs
+    app.kubernetes.io/version: 4.13.2
+    helm.sh/chart: csi-driver-nfs-4.13.2
+  name: csi-nfs-node
+  namespace: syn-csi-driver-nfs
+spec:
+  selector:
+    matchLabels:
+      app: csi-nfs-node
+  template:
+    metadata:
+      labels:
+        app: csi-nfs-node
+        app.kubernetes.io/instance: csi-driver-nfs
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: csi-driver-nfs
+        app.kubernetes.io/version: 4.13.2
+        helm.sh/chart: csi-driver-nfs-4.13.2
+    spec:
+      containers:
+        - args:
+            - --csi-address=/csi/csi.sock
+            - --probe-timeout=3s
+            - --http-endpoint=localhost:29653
+            - --v=2
+          image: registry.k8s.io/sig-storage/livenessprobe:v2.17.0
+          imagePullPolicy: IfNotPresent
+          name: liveness-probe
+          resources:
+            limits:
+              memory: 100Mi
+            requests:
+              cpu: 10m
+              memory: 20Mi
+          securityContext:
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+          volumeMounts:
+            - mountPath: /csi
+              name: socket-dir
+        - args:
+            - --v=2
+            - --csi-address=/csi/csi.sock
+            - --kubelet-registration-path=$(DRIVER_REG_SOCK_PATH)
+            - --http-endpoint=localhost:19809
+          env:
+            - name: DRIVER_REG_SOCK_PATH
+              value: /var/lib/kubelet/plugins/csi-nfsplugin/csi.sock
+            - name: KUBE_NODE_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+          image: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.15.0
+          imagePullPolicy: IfNotPresent
+          livenessProbe:
+            failureThreshold: 2
+            httpGet:
+              host: localhost
+              path: /healthz
+              port: healthz
+            initialDelaySeconds: 20
+            periodSeconds: 5
+            timeoutSeconds: 10
+          name: node-driver-registrar
+          ports:
+            - containerPort: 19809
+              name: healthz
+              protocol: TCP
+          resources:
+            limits:
+              memory: 100Mi
+            requests:
+              cpu: 10m
+              memory: 20Mi
+          securityContext:
+            capabilities:
+              drop:
+                - ALL
+          volumeMounts:
+            - mountPath: /csi
+              name: socket-dir
+            - mountPath: /registration
+              name: registration-dir
+        - args:
+            - --v=5
+            - --nodeid=$(NODE_ID)
+            - --endpoint=$(CSI_ENDPOINT)
+            - --drivername=nfs.csi.k8s.io
+            - --mount-permissions=0
+          env:
+            - name: NODE_ID
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+            - name: CSI_ENDPOINT
+              value: unix:///csi/csi.sock
+          image: registry.k8s.io/sig-storage/nfsplugin:v4.13.2
+          imagePullPolicy: IfNotPresent
+          livenessProbe:
+            failureThreshold: 5
+            httpGet:
+              host: localhost
+              path: /healthz
+              port: 29653
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            timeoutSeconds: 10
+          name: nfs
+          resources:
+            limits:
+              memory: 300Mi
+            requests:
+              cpu: 10m
+              memory: 20Mi
+          securityContext:
+            allowPrivilegeEscalation: true
+            capabilities:
+              add:
+                - SYS_ADMIN
+              drop:
+                - ALL
+            privileged: true
+          volumeMounts:
+            - mountPath: /csi
+              name: socket-dir
+            - mountPath: /var/lib/kubelet/pods
+              mountPropagation: Bidirectional
+              name: pods-mount-dir
+      dnsPolicy: ClusterFirstWithHostNet
+      hostNetwork: true
+      nodeSelector:
+        kubernetes.io/os: linux
+      priorityClassName: system-cluster-critical
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
+      serviceAccountName: csi-nfs-node-sa
+      tolerations:
+        - operator: Exists
+      volumes:
+        - hostPath:
+            path: /var/lib/kubelet/plugins/csi-nfsplugin
+            type: DirectoryOrCreate
+          name: socket-dir
+        - hostPath:
+            path: /var/lib/kubelet/pods
+            type: Directory
+          name: pods-mount-dir
+        - hostPath:
+            path: /var/lib/kubelet/plugins_registry
+            type: Directory
+          name: registration-dir
+  updateStrategy:
+    rollingUpdate:
+      maxUnavailable: 1
+    type: RollingUpdate
diff --git a/tests/golden/defaults/csi-driver-nfs/csi-driver-nfs/10_helmchart/csi-driver-nfs/templates/rbac-csi-nfs.yaml b/tests/golden/defaults/csi-driver-nfs/csi-driver-nfs/10_helmchart/csi-driver-nfs/templates/rbac-csi-nfs.yaml
new file mode 100644
index 00000000..a218a029
--- /dev/null
+++ b/tests/golden/defaults/csi-driver-nfs/csi-driver-nfs/10_helmchart/csi-driver-nfs/templates/rbac-csi-nfs.yaml
@@ -0,0 +1,230 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app.kubernetes.io/instance: csi-driver-nfs
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: csi-driver-nfs
+    app.kubernetes.io/version: 4.13.2
+    helm.sh/chart: csi-driver-nfs-4.13.2
+  name: csi-nfs-controller-sa
+  namespace: syn-csi-driver-nfs
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app.kubernetes.io/instance: csi-driver-nfs
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: csi-driver-nfs
+    app.kubernetes.io/version: 4.13.2
+    helm.sh/chart: csi-driver-nfs-4.13.2
+  name: csi-nfs-node-sa
+  namespace: syn-csi-driver-nfs
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/instance: csi-driver-nfs
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: csi-driver-nfs
+    app.kubernetes.io/version: 4.13.2
+    helm.sh/chart: csi-driver-nfs-4.13.2
+  name: nfs-external-provisioner-role
+rules:
+  - apiGroups:
+      - ''
+    resources:
+      - persistentvolumes
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - patch
+      - delete
+  - apiGroups:
+      - ''
+    resources:
+      - persistentvolumeclaims
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - storage.k8s.io
+    resources:
+      - storageclasses
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - snapshot.storage.k8s.io
+    resources:
+      - volumesnapshotclasses
+      - volumesnapshots
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - snapshot.storage.k8s.io
+    resources:
+      - volumesnapshotcontents
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+      - patch
+  - apiGroups:
+      - snapshot.storage.k8s.io
+    resources:
+      - volumesnapshotcontents/status
+    verbs:
+      - get
+      - update
+      - patch
+  - apiGroups:
+      - ''
+    resources:
+      - events
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+  - apiGroups:
+      - storage.k8s.io
+    resources:
+      - csinodes
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - ''
+    resources:
+      - nodes
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - coordination.k8s.io
+    resources:
+      - leases
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+  - apiGroups:
+      - ''
+    resources:
+      - secrets
+    verbs:
+      - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/instance: csi-driver-nfs
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: csi-driver-nfs
+    app.kubernetes.io/version: 4.13.2
+    helm.sh/chart: csi-driver-nfs-4.13.2
+  name: nfs-external-resizer-role
+rules:
+  - apiGroups:
+      - ''
+    resources:
+      - persistentvolumes
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+      - patch
+  - apiGroups:
+      - ''
+    resources:
+      - persistentvolumeclaims
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - ''
+    resources:
+      - persistentvolumeclaims/status
+    verbs:
+      - update
+      - patch
+  - apiGroups:
+      - ''
+    resources:
+      - events
+    verbs:
+      - list
+      - watch
+      - create
+      - update
+      - patch
+  - apiGroups:
+      - coordination.k8s.io
+    resources:
+      - leases
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/instance: csi-driver-nfs
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: csi-driver-nfs
+    app.kubernetes.io/version: 4.13.2
+    helm.sh/chart: csi-driver-nfs-4.13.2
+  name: nfs-csi-resizer-role
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: nfs-external-resizer-role
+subjects:
+  - kind: ServiceAccount
+    name: csi-nfs-controller-sa
+    namespace: syn-csi-driver-nfs
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/instance: csi-driver-nfs
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: csi-driver-nfs
+    app.kubernetes.io/version: 4.13.2
+    helm.sh/chart: csi-driver-nfs-4.13.2
+  name: nfs-csi-provisioner-binding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: nfs-external-provisioner-role
+subjects:
+  - kind: ServiceAccount
+    name: csi-nfs-controller-sa
+    namespace: syn-csi-driver-nfs
diff --git a/tests/golden/defaults/csi-driver-nfs/csi-driver-nfs/50_storageclasses.yaml b/tests/golden/defaults/csi-driver-nfs/csi-driver-nfs/50_storageclasses.yaml
new file mode 100644
index 00000000..8b9ec852
--- /dev/null
+++ b/tests/golden/defaults/csi-driver-nfs/csi-driver-nfs/50_storageclasses.yaml
@@ -0,0 +1,33 @@
+allowVolumeExpansion: true
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  annotations: {}
+  labels:
+    name: nfs1-example-com
+  name: nfs1-example-com
+mountOptions:
+  - nfsvers=4.1
+parameters:
+  server: nfs1.example.com
+  share: /
+provisioner: nfs.csi.k8s.io
+reclaimPolicy: Delete
+volumeBindingMode: WaitForFirstConsumer
+---
+allowVolumeExpansion: true
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  annotations: {}
+  labels:
+    name: nfs2-example-net
+  name: nfs2-example-net
+mountOptions:
+  - nfsvers=4.1
+parameters:
+  server: nfs2.example.net
+  share: /exports/k8s
+provisioner: nfs.csi.k8s.io
+reclaimPolicy: Delete
+volumeBindingMode: WaitForFirstConsumer
diff --git a/tests/golden/openshift/csi-driver-nfs/csi-driver-nfs/00_namespace.yaml b/tests/golden/openshift/csi-driver-nfs/csi-driver-nfs/00_namespace.yaml
new file mode 100644
index 00000000..ccf08f15
--- /dev/null
+++ b/tests/golden/openshift/csi-driver-nfs/csi-driver-nfs/00_namespace.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  annotations:
+    openshift.io/node-selector: ''
+  labels:
+    openshift.io/cluster-monitoring: 'true'
+  name: syn-csi-driver-nfs
diff --git a/tests/golden/openshift/csi-driver-nfs/csi-driver-nfs/02_scc_rbac.yaml b/tests/golden/openshift/csi-driver-nfs/csi-driver-nfs/02_scc_rbac.yaml
new file mode 100644
index 00000000..2de42abf
--- /dev/null
+++ b/tests/golden/openshift/csi-driver-nfs/csi-driver-nfs/02_scc_rbac.yaml
@@ -0,0 +1,16 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  annotations: {}
+  labels:
+    name: scc-privileged
+  name: scc-privileged
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:openshift:scc:privileged
+subjects:
+  - kind: ServiceAccount
+    name: csi-nfs-controller-sa
+  - kind: ServiceAccount
+    name: csi-nfs-node-sa
diff --git a/tests/golden/openshift/csi-driver-nfs/csi-driver-nfs/10_helmchart/csi-driver-nfs/templates/csi-nfs-controller.yaml b/tests/golden/openshift/csi-driver-nfs/csi-driver-nfs/10_helmchart/csi-driver-nfs/templates/csi-nfs-controller.yaml
new file mode 100644
index 00000000..f287184a
--- /dev/null
+++ b/tests/golden/openshift/csi-driver-nfs/csi-driver-nfs/10_helmchart/csi-driver-nfs/templates/csi-nfs-controller.yaml
@@ -0,0 +1,210 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app.kubernetes.io/instance: csi-driver-nfs
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: csi-driver-nfs
+    app.kubernetes.io/version: 4.13.2
+    helm.sh/chart: csi-driver-nfs-4.13.2
+  name: csi-nfs-controller
+  namespace: syn-csi-driver-nfs
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: csi-nfs-controller
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: csi-nfs-controller
+        app.kubernetes.io/instance: csi-driver-nfs
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: csi-driver-nfs
+        app.kubernetes.io/version: 4.13.2
+        helm.sh/chart: csi-driver-nfs-4.13.2
+    spec:
+      containers:
+        - args:
+            - -v=2
+            - --csi-address=$(ADDRESS)
+            - --leader-election
+            - --leader-election-namespace=syn-csi-driver-nfs
+            - --extra-create-metadata=true
+            - --feature-gates=HonorPVReclaimPolicy=true,VolumeAttributesClass=false
+            - --timeout=1200s
+            - --retry-interval-max=30m
+          env:
+            - name: ADDRESS
+              value: /csi/csi.sock
+          image: registry.k8s.io/sig-storage/csi-provisioner:v6.1.0
+          imagePullPolicy: IfNotPresent
+          name: csi-provisioner
+          resources:
+            limits:
+              memory: 400Mi
+            requests:
+              cpu: 10m
+              memory: 20Mi
+          securityContext:
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+          volumeMounts:
+            - mountPath: /csi
+              name: socket-dir
+        - args:
+            - -csi-address=$(ADDRESS)
+            - -v=2
+            - -leader-election
+            - --leader-election-namespace=syn-csi-driver-nfs
+            - -handle-volume-inuse-error=false
+            - -feature-gates=VolumeAttributesClass=false
+          env:
+            - name: ADDRESS
+              value: /csi/csi.sock
+          image: registry.k8s.io/sig-storage/csi-resizer:v2.0.0
+          imagePullPolicy: IfNotPresent
+          name: csi-resizer
+          resources:
+            limits:
+              memory: 400Mi
+            requests:
+              cpu: 10m
+              memory: 20Mi
+          securityContext:
+            capabilities:
+              drop:
+                - ALL
+          volumeMounts:
+            - mountPath: /csi
+              name: socket-dir
+        - args:
+            - --v=2
+            - --csi-address=$(ADDRESS)
+            - --leader-election-namespace=syn-csi-driver-nfs
+            - --leader-election
+            - --timeout=1200s
+            - --retry-interval-max=30m
+          env:
+            - name: ADDRESS
+              value: /csi/csi.sock
+          image: registry.k8s.io/sig-storage/csi-snapshotter:v8.4.0
+          imagePullPolicy: IfNotPresent
+          name: csi-snapshotter
+          resources:
+            limits:
+              memory: 200Mi
+            requests:
+              cpu: 10m
+              memory: 20Mi
+          securityContext:
+            capabilities:
+              drop:
+                - ALL
+          volumeMounts:
+            - mountPath: /csi
+              name: socket-dir
+        - args:
+            - --csi-address=/csi/csi.sock
+            - --probe-timeout=3s
+            - --http-endpoint=localhost:29652
+            - --v=2
+          image: registry.k8s.io/sig-storage/livenessprobe:v2.17.0
+          imagePullPolicy: IfNotPresent
+          name: liveness-probe
+          resources:
+            limits:
+              memory: 100Mi
+            requests:
+              cpu: 10m
+              memory: 20Mi
+          securityContext:
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+          volumeMounts:
+            - mountPath: /csi
+              name: socket-dir
+        - args:
+            - --v=5
+            - --nodeid=$(NODE_ID)
+            - --endpoint=$(CSI_ENDPOINT)
+            - --drivername=nfs.csi.k8s.io
+            - --mount-permissions=0
+            - --working-mount-dir=/tmp
+            - --default-ondelete-policy=delete
+            - --use-tar-command-in-snapshot=false
+            - --enable-snapshot-compression=true
+          env:
+            - name: NODE_ID
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+            - name: CSI_ENDPOINT
+              value: unix:///csi/csi.sock
+          image: registry.k8s.io/sig-storage/nfsplugin:v4.13.2
+          imagePullPolicy: IfNotPresent
+          livenessProbe:
+            failureThreshold: 5
+            httpGet:
+              host: localhost
+              path: /healthz
+              port: 29652
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            timeoutSeconds: 10
+          name: nfs
+          resources:
+            limits:
+              memory: 200Mi
+            requests:
+              cpu: 10m
+              memory: 20Mi
+          securityContext:
+            allowPrivilegeEscalation: true
+            capabilities:
+              add:
+                - SYS_ADMIN
+              drop:
+                - ALL
+            privileged: true
+          volumeMounts:
+            - mountPath: /var/lib/kubelet/pods
+              mountPropagation: Bidirectional
+              name: pods-mount-dir
+            - mountPath: /csi
+              name: socket-dir
+      dnsPolicy: ClusterFirstWithHostNet
+      hostNetwork: true
+      nodeSelector:
+        kubernetes.io/os: linux
+      priorityClassName: system-cluster-critical
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
+      serviceAccountName: csi-nfs-controller-sa
+      tolerations:
+        - effect: NoSchedule
+          key: node-role.kubernetes.io/master
+          operator: Exists
+        - effect: NoSchedule
+          key: node-role.kubernetes.io/controlplane
+          operator: Exists
+        - effect: NoSchedule
+          key: node-role.kubernetes.io/control-plane
+          operator: Exists
+        - effect: NoSchedule
+          key: CriticalAddonsOnly
+          operator: Exists
+      volumes:
+        - hostPath:
+            path: /var/lib/kubelet/pods
+            type: Directory
+          name: pods-mount-dir
+        - emptyDir: {}
+          name: socket-dir
diff --git a/tests/golden/openshift/csi-driver-nfs/csi-driver-nfs/10_helmchart/csi-driver-nfs/templates/csi-nfs-driverinfo.yaml b/tests/golden/openshift/csi-driver-nfs/csi-driver-nfs/10_helmchart/csi-driver-nfs/templates/csi-nfs-driverinfo.yaml
new file mode 100644
index 00000000..151dc5dd
--- /dev/null
+++ b/tests/golden/openshift/csi-driver-nfs/csi-driver-nfs/10_helmchart/csi-driver-nfs/templates/csi-nfs-driverinfo.yaml
@@ -0,0 +1,9 @@
+apiVersion: storage.k8s.io/v1
+kind: CSIDriver
+metadata:
+  name: nfs.csi.k8s.io
+spec:
+  attachRequired: false
+  fsGroupPolicy: File
+  volumeLifecycleModes:
+    - Persistent
diff --git a/tests/golden/openshift/csi-driver-nfs/csi-driver-nfs/10_helmchart/csi-driver-nfs/templates/csi-nfs-node.yaml b/tests/golden/openshift/csi-driver-nfs/csi-driver-nfs/10_helmchart/csi-driver-nfs/templates/csi-nfs-node.yaml
new file mode 100644
index 00000000..6bd43995
--- /dev/null
+++ b/tests/golden/openshift/csi-driver-nfs/csi-driver-nfs/10_helmchart/csi-driver-nfs/templates/csi-nfs-node.yaml
@@ -0,0 +1,164 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  labels:
+    app.kubernetes.io/instance: csi-driver-nfs
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: csi-driver-nfs
+    app.kubernetes.io/version: 4.13.2
+    helm.sh/chart: csi-driver-nfs-4.13.2
+  name: csi-nfs-node
+  namespace: syn-csi-driver-nfs
+spec:
+  selector:
+    matchLabels:
+      app: csi-nfs-node
+  template:
+    metadata:
+      labels:
+        app: csi-nfs-node
+        app.kubernetes.io/instance: csi-driver-nfs
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: csi-driver-nfs
+        app.kubernetes.io/version: 4.13.2
+        helm.sh/chart: csi-driver-nfs-4.13.2
+    spec:
+      containers:
+        - args:
+            - --csi-address=/csi/csi.sock
+            - --probe-timeout=3s
+            - --http-endpoint=localhost:29653
+            - --v=2
+          image: registry.k8s.io/sig-storage/livenessprobe:v2.17.0
+          imagePullPolicy: IfNotPresent
+          name: liveness-probe
+          resources:
+            limits:
+              memory: 100Mi
+            requests:
+              cpu: 10m
+              memory: 20Mi
+          securityContext:
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+          volumeMounts:
+            - mountPath: /csi
+              name: socket-dir
+        - args:
+            - --v=2
+            - --csi-address=/csi/csi.sock
+            - --kubelet-registration-path=$(DRIVER_REG_SOCK_PATH)
+            - --http-endpoint=localhost:19809
+          env:
+            - name: DRIVER_REG_SOCK_PATH
+              value: /var/lib/kubelet/plugins/csi-nfsplugin/csi.sock
+            - name: KUBE_NODE_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+          image: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.15.0
+          imagePullPolicy: IfNotPresent
+          livenessProbe:
+            failureThreshold: 2
+            httpGet:
+              host: localhost
+              path: /healthz
+              port: healthz
+            initialDelaySeconds: 20
+            periodSeconds: 5
+            timeoutSeconds: 10
+          name: node-driver-registrar
+          ports:
+            - containerPort: 19809
+              name: healthz
+              protocol: TCP
+          resources:
+            limits:
+              memory: 100Mi
+            requests:
+              cpu: 10m
+              memory: 20Mi
+          securityContext:
+            capabilities:
+              drop:
+                - ALL
+          volumeMounts:
+            - mountPath: /csi
+              name: socket-dir
+            - mountPath: /registration
+              name: registration-dir
+        - args:
+            - --v=5
+            - --nodeid=$(NODE_ID)
+            - --endpoint=$(CSI_ENDPOINT)
+            - --drivername=nfs.csi.k8s.io
+            - --mount-permissions=0
+          env:
+            - name: NODE_ID
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+            - name: CSI_ENDPOINT
+              value: unix:///csi/csi.sock
+          image: registry.k8s.io/sig-storage/nfsplugin:v4.13.2
+          imagePullPolicy: IfNotPresent
+          livenessProbe:
+            failureThreshold: 5
+            httpGet:
+              host: localhost
+              path: /healthz
+              port: 29653
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            timeoutSeconds: 10
+          name: nfs
+          resources:
+            limits:
+              memory: 300Mi
+            requests:
+              cpu: 10m
+              memory: 20Mi
+          securityContext:
+            allowPrivilegeEscalation: true
+            capabilities:
+              add:
+                - SYS_ADMIN
+              drop:
+                - ALL
+            privileged: true
+          volumeMounts:
+            - mountPath: /csi
+              name: socket-dir
+            - mountPath: /var/lib/kubelet/pods
+              mountPropagation: Bidirectional
+              name: pods-mount-dir
+      dnsPolicy: ClusterFirstWithHostNet
+      hostNetwork: true
+      nodeSelector:
+        kubernetes.io/os: linux
+      priorityClassName: system-cluster-critical
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
+      serviceAccountName: csi-nfs-node-sa
+      tolerations:
+        - operator: Exists
+      volumes:
+        - hostPath:
+            path: /var/lib/kubelet/plugins/csi-nfsplugin
+            type: DirectoryOrCreate
+          name: socket-dir
+        - hostPath:
+            path: /var/lib/kubelet/pods
+            type: Directory
+          name: pods-mount-dir
+        - hostPath:
+            path: /var/lib/kubelet/plugins_registry
+            type: Directory
+          name: registration-dir
+  updateStrategy:
+    rollingUpdate:
+      maxUnavailable: 1
+    type: RollingUpdate
diff --git a/tests/golden/openshift/csi-driver-nfs/csi-driver-nfs/10_helmchart/csi-driver-nfs/templates/rbac-csi-nfs.yaml b/tests/golden/openshift/csi-driver-nfs/csi-driver-nfs/10_helmchart/csi-driver-nfs/templates/rbac-csi-nfs.yaml
new file mode 100644
index 00000000..a218a029
--- /dev/null
+++ b/tests/golden/openshift/csi-driver-nfs/csi-driver-nfs/10_helmchart/csi-driver-nfs/templates/rbac-csi-nfs.yaml
@@ -0,0 +1,230 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app.kubernetes.io/instance: csi-driver-nfs
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: csi-driver-nfs
+    app.kubernetes.io/version: 4.13.2
+    helm.sh/chart: csi-driver-nfs-4.13.2
+  name: csi-nfs-controller-sa
+  namespace: syn-csi-driver-nfs
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app.kubernetes.io/instance: csi-driver-nfs
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: csi-driver-nfs
+    app.kubernetes.io/version: 4.13.2
+    helm.sh/chart: csi-driver-nfs-4.13.2
+  name: csi-nfs-node-sa
+  namespace: syn-csi-driver-nfs
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/instance: csi-driver-nfs
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: csi-driver-nfs
+    app.kubernetes.io/version: 4.13.2
+    helm.sh/chart: csi-driver-nfs-4.13.2
+  name: nfs-external-provisioner-role
+rules:
+  - apiGroups:
+      - ''
+    resources:
+      - persistentvolumes
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - patch
+      - delete
+  - apiGroups:
+      - ''
+    resources:
+      - persistentvolumeclaims
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - storage.k8s.io
+    resources:
+      - storageclasses
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - snapshot.storage.k8s.io
+    resources:
+      - volumesnapshotclasses
+      - volumesnapshots
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - snapshot.storage.k8s.io
+    resources:
+      - volumesnapshotcontents
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+      - patch
+  - apiGroups:
+      - snapshot.storage.k8s.io
+    resources:
+      - volumesnapshotcontents/status
+    verbs:
+      - get
+      - update
+      - patch
+  - apiGroups:
+      - ''
+    resources:
+      - events
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+  - apiGroups:
+      - storage.k8s.io
+    resources:
+      - csinodes
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - ''
+    resources:
+      - nodes
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - coordination.k8s.io
+    resources:
+      - leases
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+  - apiGroups:
+      - ''
+    resources:
+      - secrets
+    verbs:
+      - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/instance: csi-driver-nfs
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: csi-driver-nfs
+    app.kubernetes.io/version: 4.13.2
+    helm.sh/chart: csi-driver-nfs-4.13.2
+  name: nfs-external-resizer-role
+rules:
+  - apiGroups:
+      - ''
+    resources:
+      - persistentvolumes
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+      - patch
+  - apiGroups:
+      - ''
+    resources:
+      - persistentvolumeclaims
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - ''
+    resources:
+      - persistentvolumeclaims/status
+    verbs:
+      - update
+      - patch
+  - apiGroups:
+      - ''
+    resources:
+      - events
+    verbs:
+      - list
+      - watch
+      - create
+      - update
+      - patch
+  - apiGroups:
+      - coordination.k8s.io
+    resources:
+      - leases
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/instance: csi-driver-nfs
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: csi-driver-nfs
+    app.kubernetes.io/version: 4.13.2
+    helm.sh/chart: csi-driver-nfs-4.13.2
+  name: nfs-csi-resizer-role
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: nfs-external-resizer-role
+subjects:
+  - kind: ServiceAccount
+    name: csi-nfs-controller-sa
+    namespace: syn-csi-driver-nfs
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/instance: csi-driver-nfs
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: csi-driver-nfs
+    app.kubernetes.io/version: 4.13.2
+    helm.sh/chart: csi-driver-nfs-4.13.2
+  name: nfs-csi-provisioner-binding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: nfs-external-provisioner-role
+subjects:
+  - kind: ServiceAccount
+    name: csi-nfs-controller-sa
+    namespace: syn-csi-driver-nfs
diff --git a/tests/openshift.yml b/tests/openshift.yml
index a4da5b7b..d4ec4611 100644
--- a/tests/openshift.yml
+++ b/tests/openshift.yml
@@ -1,3 +1,9 @@
-# Overwrite parameters here
+parameters:
+  kapitan:
+    dependencies:
+      - type: https
+        source: https://raw.githubusercontent.com/projectsyn/component-storageclass/v1.0.0/lib/storageclass.libsonnet
+        output_path: vendor/lib/storageclass.libsonnet
 
-# parameters: {...}
+  facts:
+    distribution: openshift4