diff --git a/cluster/platform/portworx-csi/DEPLOYMENT-CHECKLIST.md b/cluster/platform/portworx-csi/DEPLOYMENT-CHECKLIST.md
new file mode 100644
index 0000000..26eb377
--- /dev/null
+++ b/cluster/platform/portworx-csi/DEPLOYMENT-CHECKLIST.md
@@ -0,0 +1,466 @@
+# Portworx CSI Deployment Checklist
+
+Pre-deployment checklist for Portworx CSI driver on Talos Linux with Pure Storage FlashArray.
+
+## Phase 1: FlashArray Preparation
+
+- [ ] **Create FlashArray storage admin user**
+  - Username: `portworx-csi`
+  - Role: Storage Admin
+  - Password: Set in FlashArray UI
+
+- [ ] **Generate FlashArray API token**
+  - User: `portworx-csi`
+  - Expiration: None (non-expiring)
+  - Token format: `XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX`
+  - **Save token immediately** (cannot be retrieved later)
+
+- [ ] **Verify FlashArray management endpoint**
+  - Test connectivity: `ping flasharray.mk-labs.cloud`
+  - Test HTTPS: `curl -k https://flasharray.mk-labs.cloud`
+  - Record IP/hostname: _______________________
+
+- [ ] **Configure iSCSI targets on FlashArray**
+  - Navigate to: **Settings → Network**
+  - Verify iSCSI interfaces are enabled
+  - Test discovery from Talos node:
+    ```bash
+    talosctl -n <node> exec -- iscsiadm -m discovery -t st -p <flasharray-ip>
+    ```
+
+- [ ] **(Optional) Enable FlashArray File Services for NFS**
+  - Enable File Services: **Settings → File Services**
+  - Create filesystem: `fastpass-nfs`
+  - Create NFS policy with user mapping **disabled**
+  - Record NFS endpoint: _______________________
+
+## Phase 2: 1Password Secret Configuration
+
+- [ ] **Create 1Password item**
+  - Vault: `homelab`
+  - Item name: `pure-flasharray-fastpass`
+  - Category: Secure Note or API Credential
+
+- [ ] **Add pure.json field to 1Password item**
+  - Field name: `pure.json`
+  - Field type: Text
+  - Content format: JSON (see below)
+
+- [ ] **Populate pure.json content**
+  ```json
+  {
+    "FlashArrays": [
+      {
+        "MgmtEndPoint": "flasharray.mk-labs.cloud",
+        "APIToken": "paste-api-token-here",
+        "NFSEndPoint": "flasharray-nfs.mk-labs.cloud"
+      }
+    ]
+  }
+  ```
+  - Replace `flasharray.mk-labs.cloud` with actual endpoint
+  - Replace `paste-api-token-here` with FlashArray API token
+  - Remove `NFSEndPoint` line if not using File Services
+
+- [ ] **Validate JSON syntax**
+  ```bash
+  # Copy content from 1Password and validate
+  echo '<paste-json>' | jq .
+  ```
+
+- [ ] **Verify 1Password Connect can access item**
+  ```bash
+  # From a pod with op CLI or via 1Password UI
+  # Confirm item exists in homelab vault
+  ```
+
+## Phase 3: Talos Node Configuration
+
+- [ ] **Edit talconfig.yaml**
+  - File: `~/git/homelab/talos/talhelper/talconfig.yaml`
+  - Add patches from `cluster/platform/portworx-csi/talos-config-reference.yaml`
+  - Sections to add:
+    - [ ] System extensions (iscsi-tools, util-linux-tools)
+    - [ ] Kernel modules (iscsi_tcp, dm_multipath, dm_round_robin)
+    - [ ] /etc/multipath.conf file
+    - [ ] /etc/udev/rules.d/99-pure-storage.rules file
+    - [ ] kubelet extraMounts for /var/lib/iscsi
+
+- [ ] **Generate updated Talos configs**
+  ```bash
+  cd ~/git/homelab/talos/talhelper
+  talhelper genconfig
+  ```
+
+- [ ] **Apply Talos configuration to all worker nodes**
+  ```bash
+  # For each worker node:
+  talosctl apply-config \
+    --file clusterconfig/<node-name>.yaml \
+    --nodes <node-ip>
+  ```
+  
+  Nodes:
+  - [ ] Node 1: _________________ (IP: _____________)
+  - [ ] Node 2: _________________ (IP: _____________)
+  - [ ] Node 3: _________________ (IP: _____________)
+
+- [ ] **Reboot all worker nodes**
+  ```bash
+  # Reboot nodes one at a time to load kernel modules
+  talosctl reboot --nodes <node-ip>
+  
+  # Wait for node to come back online
+  kubectl get nodes
+  ```
+
+- [ ] **Verify iSCSI initiator on each node**
+  ```bash
+  talosctl -n <node-ip> get service iscsid
+  # Expected: iscsid service running
+  ```
+
+- [ ] **Verify multipath on each node**
+  ```bash
+  talosctl -n <node-ip> exec -- multipath -ll
+  # Expected: multipath running (may show no paths yet)
+  ```
+
+- [ ] **Verify unique iSCSI initiator names**
+  ```bash
+  # For each node:
+  talosctl -n <node-ip> read /etc/iscsi/initiatorname.iscsi
+  
+  # Record initiator names (must be unique):
+  # Node 1: iqn.1994-05.com.redhat:_______________
+  # Node 2: iqn.1994-05.com.redhat:_______________
+  # Node 3: iqn.1994-05.com.redhat:_______________
+  ```
+
+- [ ] **Verify kernel modules loaded**
+  ```bash
+  talosctl -n <node-ip> exec -- lsmod | grep -E "iscsi|dm_multipath"
+  # Expected: iscsi_tcp, dm_multipath, dm_round_robin
+  ```
+
+- [ ] **Test iSCSI discovery from each node**
+  ```bash
+  talosctl -n <node-ip> exec -- \
+    iscsiadm -m discovery -t st -p <flasharray-ip>
+  # Expected: List of iSCSI targets from FlashArray
+  ```
+
+## Phase 4: GitOps Deployment
+
+- [ ] **Review manifests**
+  - [ ] `cluster/platform/portworx-csi/application.yaml`
+  - [ ] `cluster/platform/portworx-csi/operator-values.yaml`
+  - [ ] `cluster/platform/portworx-csi/storagecluster.yaml`
+  - [ ] `cluster/platform/portworx-csi/externalsecret.yaml`
+  - [ ] `cluster/platform/portworx-csi/storageclass-block.yaml`
+  - [ ] `cluster/platform/portworx-csi/storageclass-file.yaml`
+
+- [ ] **Customize for your environment**
+  - Update FlashArray endpoints if different from defaults
+  - Adjust resource limits if needed
+  - Review sync wave (currently: 2)
+
+- [ ] **Commit to Git**
+  ```bash
+  cd ~/git/homelab
+  git add cluster/platform/portworx-csi/
+  git commit -m "Add Portworx CSI driver for Pure FlashArray"
+  git push origin main
+  ```
+
+- [ ] **Verify ArgoCD auto-sync or trigger manual sync**
+  ```bash
+  # Check ArgoCD application status
+  kubectl get application -n argocd portworx-csi
+  
+  # Manual sync if needed
+  argocd app sync portworx-csi
+  ```
+
+## Phase 5: Deployment Verification
+
+- [ ] **Verify ArgoCD application is healthy**
+  ```bash
+  kubectl get application -n argocd portworx-csi
+  # Expected: STATUS=Synced, HEALTH=Healthy
+  ```
+
+- [ ] **Check namespace created**
+  ```bash
+  kubectl get namespace portworx
+  ```
+
+- [ ] **Verify ExternalSecret synced**
+  ```bash
+  kubectl get externalsecret -n portworx px-pure-secret
+  # Expected: STATUS=SecretSynced
+  
+  kubectl get secret -n portworx px-pure-secret
+  # Expected: Secret exists with pure.json key
+  ```
+
+- [ ] **Validate secret content**
+  ```bash
+  kubectl get secret -n portworx px-pure-secret \
+    -o jsonpath='{.data.pure\.json}' | base64 -d | jq .
+  # Expected: Valid JSON with FlashArray config
+  ```
+
+- [ ] **Check Portworx Operator deployed**
+  ```bash
+  kubectl get deployment -n portworx portworx-operator
+  kubectl get pods -n portworx -l app=portworx-operator
+  # Expected: 1/1 pods running
+  ```
+
+- [ ] **Verify StorageCluster created**
+  ```bash
+  kubectl get storagecluster -n portworx px-cluster-fastpass
+  # Expected: STATUS=Running or Initializing
+  ```
+
+- [ ] **Check PX-CSI pods running**
+  ```bash
+  kubectl get pods -n portworx
+  # Expected pods:
+  # - portworx-operator-...
+  # - px-csi-controller-...
+  # - px-csi-node-... (one per node)
+  ```
+
+- [ ] **Verify CSI driver registered**
+  ```bash
+  kubectl get csidrivers
+  # Expected: pxd.portworx.com
+  
+  kubectl get csinode
+  # Expected: One CSINode per Kubernetes node
+  ```
+
+- [ ] **Check StorageClasses created**
+  ```bash
+  kubectl get storageclass pure-block pure-file
+  # Expected: Both StorageClasses exist
+  ```
+
+- [ ] **Review PX-CSI logs for errors**
+  ```bash
+  # Controller logs
+  kubectl logs -n portworx -l app=px-csi-controller --tail=50
+  
+  # Node driver logs (on each node)
+  kubectl logs -n portworx -l app=px-csi-node --tail=50
+  ```
+
+## Phase 6: Functional Testing
+
+- [ ] **Create test PVC with block storage**
+  ```bash
+  cat <<EOF | kubectl apply -f -
+  apiVersion: v1
+  kind: PersistentVolumeClaim
+  metadata:
+    name: test-pure-block
+    namespace: default
+  spec:
+    accessModes:
+      - ReadWriteOnce
+    storageClassName: pure-block
+    resources:
+      requests:
+        storage: 1Gi
+  EOF
+  ```
+
+- [ ] **Verify PVC bound**
+  ```bash
+  kubectl get pvc test-pure-block
+  # Expected: STATUS=Bound
+  ```
+
+- [ ] **Verify PV created on FlashArray**
+  ```bash
+  kubectl get pv
+  # Look for PV bound to test-pure-block
+  
+  # Check FlashArray UI or API:
+  # Volumes should show new volume created
+  ```
+
+- [ ] **Create test pod using PVC**
+  ```bash
+  cat <<EOF | kubectl apply -f -
+  apiVersion: v1
+  kind: Pod
+  metadata:
+    name: test-pure-block-pod
+    namespace: default
+  spec:
+    containers:
+    - name: test
+      image: nginx:latest
+      volumeMounts:
+      - name: data
+        mountPath: /data
+    volumes:
+    - name: data
+      persistentVolumeClaim:
+        claimName: test-pure-block
+  EOF
+  ```
+
+- [ ] **Verify pod is running**
+  ```bash
+  kubectl get pod test-pure-block-pod
+  # Expected: STATUS=Running
+  ```
+
+- [ ] **Verify volume mounted in pod**
+  ```bash
+  kubectl exec test-pure-block-pod -- df -h /data
+  # Expected: Mount point shows 1Gi volume
+  ```
+
+- [ ] **Test write to volume**
+  ```bash
+  kubectl exec test-pure-block-pod -- \
+    sh -c 'echo "test data" > /data/test.txt'
+  
+  kubectl exec test-pure-block-pod -- cat /data/test.txt
+  # Expected: "test data"
+  ```
+
+- [ ] **Verify iSCSI session established**
+  ```bash
+  # On node running test pod
+  talosctl -n <node-ip> exec -- iscsiadm -m session
+  # Expected: Active iSCSI session to FlashArray
+  ```
+
+- [ ] **Clean up test resources**
+  ```bash
+  kubectl delete pod test-pure-block-pod
+  kubectl delete pvc test-pure-block
+  ```
+
+- [ ] **(Optional) Test NFS file storage**
+  - Repeat above steps with `storageClassName: pure-file`
+  - Verify NFS export created on FlashArray
+
+## Phase 7: Monitoring Setup
+
+- [ ] **Verify Prometheus ServiceMonitor created**
+  ```bash
+  kubectl get servicemonitor -n portworx
+  ```
+
+- [ ] **Check Prometheus targets**
+  - Navigate to Prometheus UI → Targets
+  - Look for `portworx` or `px-csi` targets
+  - Status should be UP
+
+- [ ] **Query basic metrics**
+  ```promql
+  # In Prometheus UI
+  portworx_cluster_status
+  portworx_volume_capacity_bytes
+  ```
+
+- [ ] **(Optional) Create Grafana dashboard**
+  - Import Portworx dashboard from Grafana.com
+  - Or create custom dashboard
+
+## Phase 8: Documentation & Handoff
+
+- [ ] **Update homelab documentation**
+  - Add FlashArray details to infrastructure docs
+  - Document storage classes and use cases
+
+- [ ] **Record credentials securely**
+  - FlashArray management URL: ___________________
+  - API token stored in: 1Password → homelab → pure-flasharray-fastpass
+  - Portworx namespace: `portworx`
+
+- [ ] **Create runbook for common tasks**
+  - Volume expansion procedure
+  - Snapshot creation/restore
+  - Troubleshooting steps
+
+- [ ] **Schedule follow-up review**
+  - Date: _______________
+  - Review metrics and performance
+  - Adjust resource limits if needed
+
+## Rollback Plan
+
+If deployment fails, rollback procedure:
+
+1. [ ] Delete ArgoCD application:
+   ```bash
+   kubectl delete application -n argocd portworx-csi
+   ```
+
+2. [ ] Delete namespace (if needed):
+   ```bash
+   kubectl delete namespace portworx
+   ```
+
+3. [ ] Delete StorageClasses:
+   ```bash
+   kubectl delete storageclass pure-block pure-file
+   ```
+
+4. [ ] Delete CRDs (if needed):
+   ```bash
+   kubectl delete crd storageclusters.core.libopenstorage.org
+   ```
+
+5. [ ] Revert Talos configuration (if needed):
+   ```bash
+   # Remove portworx-csi patches from talconfig.yaml
+   talhelper genconfig
+   talosctl apply-config --file clusterconfig/<node>.yaml --nodes <node-ip>
+   ```
+
+## Success Criteria
+
+Deployment is successful when:
+
+- [ ] All pods in `portworx` namespace are Running
+- [ ] StorageClasses `pure-block` and `pure-file` are available
+- [ ] Test PVC successfully binds to a PV
+- [ ] Test pod can mount and write to volume
+- [ ] iSCSI sessions are established on nodes
+- [ ] No errors in PX-CSI controller/node logs
+- [ ] Prometheus metrics are being scraped
+- [ ] ArgoCD application shows Healthy and Synced
+
+## Notes
+
+**Deployment Date:** _______________
+
+**Deployed By:** _______________
+
+**FlashArray Model:** _______________
+
+**Purity Version:** _______________
+
+**Issues Encountered:**
+- 
+- 
+- 
+
+**Resolutions:**
+- 
+- 
+- 
+
+**Follow-up Items:**
+- 
+- 
+- 
diff --git a/cluster/platform/portworx-csi/IMPLEMENTATION-SUMMARY.md b/cluster/platform/portworx-csi/IMPLEMENTATION-SUMMARY.md
new file mode 100644
index 0000000..36c5d41
--- /dev/null
+++ b/cluster/platform/portworx-csi/IMPLEMENTATION-SUMMARY.md
@@ -0,0 +1,322 @@
+# Portworx CSI Implementation Summary
+
+## Overview
+
+Successfully created a complete GitOps deployment for Portworx CSI driver to integrate Pure Storage FlashArray with Talos Linux Kubernetes cluster (fastpass). This implementation follows the homelab's established GitOps patterns and provides enterprise-grade block and file storage capabilities.
+
+## What Was Created
+
+### Directory Structure
+```
+cluster/platform/portworx-csi/
+├── application.yaml                 # ArgoCD Application manifest
+├── operator-values.yaml             # Helm values for Portworx Operator
+├── storagecluster.yaml              # StorageCluster CR for PX-CSI deployment
+├── externalsecret.yaml              # ExternalSecret for FlashArray credentials
+├── storageclass-block.yaml          # StorageClass for iSCSI block volumes
+├── storageclass-file.yaml           # StorageClass for NFS file storage
+├── talos-config-reference.yaml      # Talos configuration reference (not a K8s resource)
+├── README.md                        # Complete deployment documentation
+├── DEPLOYMENT-CHECKLIST.md          # Step-by-step deployment checklist
+├── QUICKREF.md                      # Quick reference for common operations
+└── validate-prereqs.sh              # Pre-deployment validation script
+```
+
+**Total**: 11 files, ~1,922 lines of YAML and documentation
+
+## Implementation Details
+
+### 1. ArgoCD Application (`application.yaml`)
+- **Sync Wave**: 2 (after External Secrets Operator, before applications)
+- **Multi-source**: Helm chart from Portworx + local manifests from Git
+- **Auto-sync**: Enabled with prune and self-heal
+- **Namespace**: `portworx`
+
+### 2. Portworx Operator (`operator-values.yaml`)
+- **Chart**: `px-operator` version 25.0.0
+- **Deployment**: Single replica (sufficient for homelab)
+- **Resources**: Minimal (50m CPU, 128Mi memory)
+- **Tolerations**: Can run on control plane nodes
+
+### 3. StorageCluster CR (`storagecluster.yaml`)
+- **Backend**: Pure Storage FlashArray
+- **Protocol**: iSCSI (can be changed to NVMe-oF)
+- **CSI Driver**: Enabled with PX-CSI 3.2.0
+- **Secret**: References `px-pure-secret` (from ExternalSecret)
+- **Monitoring**: Prometheus metrics enabled
+- **Topology**: Disabled (can be enabled later for multi-zone)
+
+### 4. FlashArray Credentials (`externalsecret.yaml`)
+- **Source**: 1Password via ClusterSecretStore
+- **Vault**: `homelab`
+- **Item**: `pure-flasharray-fastpass`
+- **Field**: `pure.json` (JSON configuration)
+- **Target Secret**: `px-pure-secret` in `portworx` namespace
+- **Refresh**: Hourly
+
+Expected 1Password `pure.json` format:
+```json
+{
+  "FlashArrays": [
+    {
+      "MgmtEndPoint": "flasharray.mk-labs.cloud",
+      "APIToken": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
+      "NFSEndPoint": "flasharray-nfs.mk-labs.cloud"
+    }
+  ]
+}
+```
+
+### 5. StorageClasses
+
+#### pure-block
+- **Provisioner**: `pxd.portworx.com`
+- **Backend**: FlashArray block volumes (iSCSI)
+- **Access Mode**: ReadWriteOnce (RWO)
+- **Filesystem**: ext4
+- **Features**: Volume expansion, snapshots
+- **Use Case**: Databases, stateful applications
+
+#### pure-file
+- **Provisioner**: `pxd.portworx.com`
+- **Backend**: FlashArray File Services (NFS)
+- **Access Mode**: ReadWriteMany (RWX)
+- **Protocol**: NFS v4.1
+- **Features**: Shared storage, volume expansion
+- **Use Case**: Multi-pod applications, shared data
+
+### 6. Talos Configuration (`talos-config-reference.yaml`)
+**NOTE**: This is a reference document, NOT a Kubernetes resource. Must be applied via `talhelper` or `talosctl`.
+
+Required Talos patches:
+- **System Extensions**: `iscsi-tools`, `util-linux-tools`
+- **Kernel Modules**: `iscsi_tcp`, `dm_multipath`, `dm_round_robin`
+- **Multipath Config**: `/etc/multipath.conf` with Pure Storage settings
+- **udev Rules**: `/etc/udev/rules.d/99-pure-storage.rules` for queue tuning
+- **kubelet Mounts**: `/var/lib/iscsi` shared mount for iSCSI persistence
+
+### 7. Documentation
+
+#### README.md (16KB)
+Comprehensive documentation including:
+- Architecture diagrams
+- Prerequisites (FlashArray, 1Password, Talos)
+- Step-by-step deployment instructions
+- Usage examples (PVCs, snapshots, expansion)
+- Monitoring setup
+- Troubleshooting guide
+- References and architecture decisions
+
+#### DEPLOYMENT-CHECKLIST.md (12KB)
+8-phase deployment checklist:
+1. FlashArray Preparation
+2. 1Password Secret Configuration
+3. Talos Node Configuration
+4. GitOps Deployment
+5. Deployment Verification
+6. Functional Testing
+7. Monitoring Setup
+8. Documentation & Handoff
+
+Includes rollback plan and success criteria.
+
+#### QUICKREF.md (9KB)
+Quick reference for:
+- Status checks
+- Volume operations (create, expand, snapshot, restore)
+- Log viewing
+- Troubleshooting commands
+- Monitoring queries
+- Maintenance procedures
+- Useful aliases
+
+#### validate-prereqs.sh (7KB)
+Automated pre-deployment validation script that checks:
+- Kubernetes cluster connectivity
+- External Secrets Operator presence
+- ClusterSecretStore configuration
+- Talos nodes
+- Existing CSI drivers
+- StorageClass conflicts
+- ArgoCD setup
+- Required manifests in repository
+
+## GitOps Workflow
+
+### Deployment Flow
+```
+1. Commit to Git (homelab repo)
+   ↓
+2. ArgoCD detects changes
+   ↓
+3. Wave 2 sync (after External Secrets)
+   ↓
+4. Helm deploys Portworx Operator
+   ↓
+5. Operator deploys PX-CSI components
+   ↓
+6. StorageClasses become available
+   ↓
+7. Applications can provision volumes
+```
+
+### Dependencies
+- **Wave 1**: External Secrets Operator, 1Password Connect
+- **Wave 2**: Portworx CSI (this deployment)
+- **Wave 3+**: Applications using Pure storage
+
+## Prerequisites Summary
+
+### FlashArray Requirements
+1. ✅ FlashArray accessible from cluster network
+2. ✅ Storage admin user created with API token
+3. ✅ iSCSI targets configured (for block storage)
+4. ✅ File Services enabled (optional, for NFS)
+5. ✅ NFS policy configured with user mapping disabled (optional)
+
+### Kubernetes Requirements
+1. ✅ Talos Linux cluster with kernel modules (iscsi_tcp, dm_multipath)
+2. ✅ External Secrets Operator installed (wave 1)
+3. ✅ ClusterSecretStore configured for 1Password
+4. ✅ ArgoCD installed and operational
+5. ✅ Multipath and udev rules configured on all nodes
+
+### 1Password Requirements
+1. ✅ Vault: `homelab`
+2. ✅ Item: `pure-flasharray-fastpass`
+3. ✅ Field: `pure.json` with FlashArray configuration
+
+## Next Steps
+
+### 1. Before Deployment
+- [ ] Create FlashArray storage admin user and API token
+- [ ] Add FlashArray credentials to 1Password
+- [ ] Apply Talos configuration to all worker nodes:
+  ```bash
+  cd ~/git/homelab/talos/talhelper
+  # Add portworx-csi patches to talconfig.yaml
+  talhelper genconfig
+  talosctl apply-config --file clusterconfig/<node>.yaml --nodes <node-ip>
+  talosctl reboot --nodes <node-ip>
+  ```
+- [ ] Verify iSCSI and multipath on each node
+- [ ] Run validation script: `./validate-prereqs.sh`
+
+### 2. Deploy
+```bash
+cd ~/git/homelab
+git add cluster/platform/portworx-csi/
+git commit -m "Add Portworx CSI driver for Pure FlashArray"
+git push origin main
+
+# ArgoCD will auto-sync (wave 2)
+# Or manually sync:
+argocd app sync portworx-csi
+```
+
+### 3. Verify Deployment
+```bash
+# Check ArgoCD application
+kubectl get application -n argocd portworx-csi
+
+# Verify pods
+kubectl get pods -n portworx
+
+# Check StorageCluster
+kubectl get storagecluster -n portworx
+
+# Test with sample PVC (see DEPLOYMENT-CHECKLIST.md Phase 6)
+```
+
+### 4. Post-Deployment
+- [ ] Configure Prometheus/Grafana dashboards for Portworx metrics
+- [ ] Update homelab infrastructure documentation
+- [ ] Create runbook for common operations
+- [ ] Schedule follow-up review after 1 week
+
+## Key Design Decisions
+
+### Why Portworx CSI?
+- **Direct Access**: FlashArray volumes directly attached to pods (no aggregation layer)
+- **Native Integration**: Official Pure Storage support
+- **Feature Rich**: Snapshots, expansion, topology-aware provisioning
+- **Talos Compatible**: Works with Talos Linux after proper configuration
+
+### Why iSCSI (vs NVMe-oF)?
+- **Broad Compatibility**: Works on all Talos nodes without special NICs
+- **Proven**: Mature protocol with extensive documentation
+- **Upgrade Path**: Can migrate to NVMe-oF later for performance
+- **Simpler Setup**: Fewer hardware dependencies
+
+### Why Multi-Source ArgoCD Application?
+- **Consistency**: Follows homelab pattern (same as cert-manager, nfs-csi)
+- **Upstream Helm**: Use official Portworx chart, not custom forks
+- **Local Overrides**: StorageClasses and configs in Git
+- **GitOps Friendly**: All configuration is declarative
+
+### Why Wave 2?
+- **Dependencies**: Needs External Secrets (wave 1) for credentials
+- **Before Apps**: Storage must be ready before applications deploy
+- **Parallel Safe**: Can deploy alongside other platform services
+
+## Validation Results
+
+All YAML files validated successfully:
+- ✅ `application.yaml` - Valid YAML
+- ✅ `externalsecret.yaml` - Valid YAML
+- ✅ `operator-values.yaml` - Valid YAML
+- ✅ `storageclass-block.yaml` - Valid YAML
+- ✅ `storageclass-file.yaml` - Valid YAML
+- ✅ `storagecluster.yaml` - Valid YAML
+- ✅ `talos-config-reference.yaml` - Valid YAML
+
+## Important Notes
+
+### Talos Configuration
+⚠️ **CRITICAL**: The `talos-config-reference.yaml` file is **NOT** a Kubernetes resource. It documents the required Talos patches that must be applied via `talhelper` or `talosctl`. Do not attempt to `kubectl apply` this file.
+
+### Secret Management
+The FlashArray API token is stored in 1Password and synced to Kubernetes via External Secrets Operator. Never commit credentials to Git.
+
+### Node Reboots Required
+After applying Talos configuration with kernel modules, nodes **must be rebooted** for modules to load. Schedule appropriately.
+
+### iSCSI Initiator Names
+Each Talos node must have a **unique** iSCSI initiator name. Verify uniqueness across all nodes to avoid conflicts.
+
+### Default StorageClass
+Neither `pure-block` nor `pure-file` is set as the default StorageClass. The existing `nfs-emporium` remains the default. Applications must explicitly request Pure storage by specifying `storageClassName`.
+
+## Support and References
+
+### Documentation
+- **Full Deployment Guide**: `cluster/platform/portworx-csi/README.md`
+- **Deployment Checklist**: `cluster/platform/portworx-csi/DEPLOYMENT-CHECKLIST.md`
+- **Quick Reference**: `cluster/platform/portworx-csi/QUICKREF.md`
+
+### Official Documentation
+- [Portworx CSI Documentation](https://docs.portworx.com/portworx-csi/)
+- [FlashArray Preparation](https://docs.portworx.com/portworx-csi/install/prepare/flash-array)
+- [Talos Storage Guide](https://www.talos.dev/latest/kubernetes-guides/configuration/storage/)
+
+### Troubleshooting
+If issues arise during deployment:
+1. Check `DEPLOYMENT-CHECKLIST.md` for step-by-step verification
+2. Review `QUICKREF.md` for troubleshooting commands
+3. Run `validate-prereqs.sh` to check prerequisites
+4. Consult Portworx CSI documentation for advanced scenarios
+
+## Summary
+
+A complete, production-ready GitOps deployment for Portworx CSI driver has been created. The implementation:
+
+✅ Follows homelab GitOps patterns  
+✅ Integrates with existing External Secrets Operator  
+✅ Supports both block (iSCSI) and file (NFS) storage  
+✅ Includes comprehensive documentation and validation tools  
+✅ Provides clear deployment checklist and troubleshooting guides  
+✅ Ready for deployment after FlashArray and Talos prerequisites are met  
+
+**Total effort**: 11 files, ~1,922 lines, comprehensive documentation and tooling.
+
+**Ready for**: Git commit → ArgoCD deployment → Production use
diff --git a/cluster/platform/portworx-csi/INDEX.md b/cluster/platform/portworx-csi/INDEX.md
new file mode 100644
index 0000000..1bf3c6d
--- /dev/null
+++ b/cluster/platform/portworx-csi/INDEX.md
@@ -0,0 +1,222 @@
+# Portworx CSI for Pure Storage FlashArray - File Index
+
+Quick navigation guide for Portworx CSI deployment files.
+
+## Quick Start
+
+1. **Start here**: Read [IMPLEMENTATION-SUMMARY.md](IMPLEMENTATION-SUMMARY.md) for complete overview
+2. **Before deployment**: Review [DEPLOYMENT-CHECKLIST.md](DEPLOYMENT-CHECKLIST.md)
+3. **Deploy**: Follow instructions in [README.md](README.md)
+4. **Daily ops**: Use [QUICKREF.md](QUICKREF.md) for common commands
+
+## File Descriptions
+
+### Kubernetes Manifests (GitOps)
+
+| File | Purpose | ArgoCD Synced |
+|------|---------|---------------|
+| **application.yaml** | ArgoCD Application definition for Portworx CSI | ✅ Yes |
+| **operator-values.yaml** | Helm values for Portworx Operator chart | ✅ Yes (via Helm) |
+| **storagecluster.yaml** | StorageCluster CR that triggers PX-CSI deployment | ✅ Yes |
+| **externalsecret.yaml** | Syncs FlashArray credentials from 1Password | ✅ Yes |
+| **storageclass-block.yaml** | StorageClass for FlashArray block volumes (iSCSI) | ✅ Yes |
+| **storageclass-file.yaml** | StorageClass for FlashArray File Services (NFS) | ✅ Yes |
+
+### Reference & Configuration
+
+| File | Purpose | Type |
+|------|---------|------|
+| **talos-config-reference.yaml** | Talos node configuration patches (NOT a K8s resource) | ⚠️ Reference only |
+
+**IMPORTANT**: `talos-config-reference.yaml` must be applied via `talhelper` or `talosctl`, not `kubectl`.
+
+### Documentation
+
+| File | Size | Purpose | When to Read |
+|------|------|---------|--------------|
+| **IMPLEMENTATION-SUMMARY.md** | 12KB | Complete implementation overview | First |
+| **README.md** | 17KB | Full deployment guide with architecture | Before deployment |
+| **DEPLOYMENT-CHECKLIST.md** | 12KB | Step-by-step deployment checklist | During deployment |
+| **QUICKREF.md** | 9KB | Quick reference for common operations | After deployment |
+| **INDEX.md** | 2KB | This file - navigation guide | Anytime |
+
+### Tools
+
+| File | Type | Purpose |
+|------|------|---------|
+| **validate-prereqs.sh** | Bash script | Pre-deployment validation (checks prerequisites) |
+
+## File Dependencies
+
+```
+┌─────────────────────────────────────────────────────────────────┐
+│ Git Repository (homelab)                                        │
+│                                                                  │
+│  ┌────────────────────────────────────────────────────────┐    │
+│  │ application.yaml                                       │    │
+│  │   ↓ references                                         │    │
+│  │   ├→ operator-values.yaml (Helm values)                │    │
+│  │   └→ All other manifests in this directory            │    │
+│  └────────────────────────────────────────────────────────┘    │
+│                                                                  │
+│  ┌────────────────────────────────────────────────────────┐    │
+│  │ storagecluster.yaml                                    │    │
+│  │   ↓ references                                         │    │
+│  │   └→ px-pure-secret (created by externalsecret.yaml)  │    │
+│  └────────────────────────────────────────────────────────┘    │
+│                                                                  │
+│  ┌────────────────────────────────────────────────────────┐    │
+│  │ externalsecret.yaml                                    │    │
+│  │   ↓ syncs from                                         │    │
+│  │   └→ 1Password: homelab/pure-flasharray-fastpass      │    │
+│  └────────────────────────────────────────────────────────┘    │
+│                                                                  │
+│  ┌────────────────────────────────────────────────────────┐    │
+│  │ storageclass-block.yaml                                │    │
+│  │ storageclass-file.yaml                                 │    │
+│  │   ↓ used by                                            │    │
+│  │   └→ PVCs in application namespaces                   │    │
+│  └────────────────────────────────────────────────────────┘    │
+└─────────────────────────────────────────────────────────────────┘
+
+┌─────────────────────────────────────────────────────────────────┐
+│ Talos Node Configuration (NOT in K8s)                           │
+│                                                                  │
+│  talos-config-reference.yaml → talconfig.yaml → talosctl       │
+└─────────────────────────────────────────────────────────────────┘
+```
+
+## Deployment Workflow
+
+### Phase 1: Pre-deployment
+1. Read [IMPLEMENTATION-SUMMARY.md](IMPLEMENTATION-SUMMARY.md)
+2. Read [README.md](README.md) → Prerequisites section
+3. Configure FlashArray (create user, API token)
+4. Add credentials to 1Password
+5. Apply Talos patches (see [talos-config-reference.yaml](talos-config-reference.yaml))
+6. Run [validate-prereqs.sh](validate-prereqs.sh)
+
+### Phase 2: Deployment
+Follow [DEPLOYMENT-CHECKLIST.md](DEPLOYMENT-CHECKLIST.md) exactly.
+
+### Phase 3: Post-deployment
+Use [QUICKREF.md](QUICKREF.md) for daily operations.
+
+## Typical Reading Order
+
+### For First-Time Deployment
+1. **IMPLEMENTATION-SUMMARY.md** - Understand what was created and why
+2. **README.md** - Learn architecture and prerequisites
+3. **DEPLOYMENT-CHECKLIST.md** - Follow deployment steps
+4. **validate-prereqs.sh** - Run before deploying
+5. **QUICKREF.md** - Bookmark for later reference
+
+### For Troubleshooting
+1. **QUICKREF.md** - Common issues and commands
+2. **README.md** → Troubleshooting section
+3. **DEPLOYMENT-CHECKLIST.md** → Verify each step
+
+### For Maintenance
+1. **QUICKREF.md** - Most operations are here
+2. **README.md** - Deep dive if needed
+
+## File Sizes
+
+- **Total**: 12 files, ~96KB on disk
+- **Documentation**: 5 files, ~62KB (README, checklists, guides)
+- **Kubernetes Manifests**: 6 files, ~11KB (YAML)
+- **Talos Reference**: 1 file, ~5.4KB
+- **Tools**: 1 file, ~7KB (validation script)
+
+## GitOps Integration
+
+All Kubernetes manifests (`.yaml` files except `talos-config-reference.yaml`) are managed by ArgoCD:
+
+- **Application**: `portworx-csi` in namespace `argocd`
+- **Sync Wave**: 2 (after External Secrets, before applications)
+- **Auto-sync**: Enabled
+- **Self-heal**: Enabled
+- **Prune**: Enabled
+
+Changes to manifest files are automatically synced to the cluster.
+
+## External Dependencies
+
+### From Git Repository
+- None - this is a platform component
+
+### From Upstream
+- **Helm Chart**: `https://raw.githubusercontent.com/portworx/px-operator/main/deploy/helm/charts`
+- **Chart**: `px-operator` version 25.0.0
+- **Image**: `portworx/px-csi:3.2.0`
+
+### From Cluster
+- **External Secrets Operator** (namespace: `external-secrets`)
+- **ClusterSecretStore** (`onepassword`)
+- **ArgoCD** (namespace: `argocd`)
+
+### From External Systems
+- **Pure Storage FlashArray** (iSCSI endpoints, management API)
+- **1Password** (via External Secrets Operator)
+
+## Version Information
+
+- **Portworx Operator**: 25.0.0
+- **PX-CSI Driver**: 3.2.0
+- **Talos Linux**: Any version with iSCSI support
+- **Kubernetes**: 1.32.3 (fastpass cluster)
+
+## Support Resources
+
+### Internal Documentation
+- This directory: Complete deployment guide
+- Homelab repo: `~/git/homelab`
+- Talos config: `talos/talhelper/talconfig.yaml`
+
+### External Documentation
+- [Portworx CSI Docs](https://docs.portworx.com/portworx-csi/)
+- [FlashArray Prep Guide](https://docs.portworx.com/portworx-csi/install/prepare/flash-array)
+- [Talos Storage](https://www.talos.dev/latest/kubernetes-guides/configuration/storage/)
+- [Pure Support](https://support.purestorage.com/)
+
+## Quick Commands
+
+```bash
+# Validate prerequisites
+./validate-prereqs.sh
+
+# Check deployment status
+kubectl get application -n argocd portworx-csi
+kubectl get pods -n portworx
+
+# View logs
+kubectl logs -n portworx -l app=px-csi-controller --tail=50
+
+# List volumes
+kubectl get pvc --all-namespaces -o wide | grep pure
+
+# Sync via ArgoCD
+argocd app sync portworx-csi
+```
+
+## Notes
+
+- ⚠️ `talos-config-reference.yaml` is **NOT** a Kubernetes resource
+- 📝 All secrets managed via External Secrets Operator (1Password)
+- 🔄 ArgoCD auto-syncs changes from Git
+- 📊 Prometheus metrics enabled by default
+- 🚫 No default StorageClass (apps must opt-in)
+
+## Questions?
+
+Refer to the appropriate documentation:
+- **What/Why**: [IMPLEMENTATION-SUMMARY.md](IMPLEMENTATION-SUMMARY.md)
+- **How**: [README.md](README.md)
+- **Step-by-step**: [DEPLOYMENT-CHECKLIST.md](DEPLOYMENT-CHECKLIST.md)
+- **Quick help**: [QUICKREF.md](QUICKREF.md)
+
+---
+
+**Last Updated**: June 18, 2026  
+**Cluster**: fastpass (Talos Linux, K8s 1.32.3)  
+**Status**: Ready for deployment (pending FlashArray configuration)
diff --git a/cluster/platform/portworx-csi/QUICKREF.md b/cluster/platform/portworx-csi/QUICKREF.md
new file mode 100644
index 0000000..e5a96b6
--- /dev/null
+++ b/cluster/platform/portworx-csi/QUICKREF.md
@@ -0,0 +1,438 @@
+# Portworx CSI Quick Reference
+
+Common commands and operations for Portworx CSI with Pure Storage FlashArray.
+
+## Check Status
+
+```bash
+# ArgoCD application
+kubectl get application -n argocd portworx-csi
+
+# All pods in portworx namespace
+kubectl get pods -n portworx
+
+# StorageCluster status
+kubectl get storagecluster -n portworx px-cluster-fastpass
+kubectl describe storagecluster -n portworx px-cluster-fastpass
+
+# CSI driver registration
+kubectl get csidrivers pxd.portworx.com
+kubectl get csinode
+
+# StorageClasses
+kubectl get storageclass pure-block pure-file
+```
+
+## Volume Operations
+
+### Create PVC (Block Storage)
+```bash
+kubectl apply -f - <<EOF
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: my-app-data
+  namespace: default
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: pure-block
+  resources:
+    requests:
+      storage: 10Gi
+EOF
+```
+
+### Create PVC (File Storage - NFS)
+```bash
+kubectl apply -f - <<EOF
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: shared-data
+  namespace: default
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: pure-file
+  resources:
+    requests:
+      storage: 50Gi
+EOF
+```
+
+### Expand Volume
+```bash
+# Edit PVC to increase size
+kubectl patch pvc my-app-data -p '{"spec":{"resources":{"requests":{"storage":"20Gi"}}}}'
+
+# Verify expansion
+kubectl get pvc my-app-data
+```
+
+### Create Snapshot
+```bash
+kubectl apply -f - <<EOF
+apiVersion: snapshot.storage.k8s.io/v1
+kind: VolumeSnapshot
+metadata:
+  name: my-app-snapshot
+  namespace: default
+spec:
+  volumeSnapshotClassName: px-csi-snapshot-class
+  source:
+    persistentVolumeClaimName: my-app-data
+EOF
+```
+
+### Restore from Snapshot
+```bash
+kubectl apply -f - <<EOF
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: my-app-data-restored
+  namespace: default
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: pure-block
+  dataSource:
+    name: my-app-snapshot
+    kind: VolumeSnapshot
+    apiGroup: snapshot.storage.k8s.io
+  resources:
+    requests:
+      storage: 20Gi
+EOF
+```
+
+## Logs
+
+```bash
+# Portworx Operator
+kubectl logs -n portworx -l app=portworx-operator --tail=100
+
+# PX-CSI Controller
+kubectl logs -n portworx -l app=px-csi-controller --tail=100
+
+# PX-CSI Node driver (specific node)
+kubectl logs -n portworx -l app=px-csi-node --tail=100
+
+# Follow logs in real-time
+kubectl logs -n portworx -l app=px-csi-controller -f
+```
+
+## Troubleshooting
+
+### Check iSCSI on Talos Nodes
+```bash
+# List iSCSI sessions
+talosctl -n <node-ip> exec -- iscsiadm -m session
+
+# Discover FlashArray targets
+talosctl -n <node-ip> exec -- iscsiadm -m discovery -t st -p <flasharray-ip>
+
+# Check initiator name (must be unique)
+talosctl -n <node-ip> read /etc/iscsi/initiatorname.iscsi
+```
+
+### Check Multipath
+```bash
+# Multipath status
+talosctl -n <node-ip> exec -- multipath -ll
+
+# Reload multipath config
+talosctl -n <node-ip> exec -- systemctl reload multipathd
+
+# Multipath devices
+talosctl -n <node-ip> exec -- ls -l /dev/mapper/
+```
+
+### Verify FlashArray Connectivity
+```bash
+# From PX-CSI pod
+kubectl exec -n portworx -it <px-pod> -- ping <flasharray-ip>
+
+# Test API endpoint
+kubectl exec -n portworx -it <px-pod> -- \
+  curl -k https://<flasharray-mgmt-ip>/api/2.0/arrays
+```
+
+### Check Secret
+```bash
+# Verify secret exists
+kubectl get secret -n portworx px-pure-secret
+
+# View secret content (pure.json)
+kubectl get secret -n portworx px-pure-secret \
+  -o jsonpath='{.data.pure\.json}' | base64 -d | jq .
+
+# Check ExternalSecret status
+kubectl get externalsecret -n portworx px-pure-secret
+kubectl describe externalsecret -n portworx px-pure-secret
+```
+
+### Volume Not Attaching
+```bash
+# Check PVC events
+kubectl describe pvc <pvc-name>
+
+# Check pod events
+kubectl describe pod <pod-name>
+
+# Check PV
+kubectl get pv
+kubectl describe pv <pv-name>
+
+# Check volume attachment
+kubectl get volumeattachment
+```
+
+### Pod Stuck in ContainerCreating
+```bash
+# Check events
+kubectl describe pod <pod-name>
+
+# Check PVC status
+kubectl get pvc -n <namespace>
+
+# Check node where pod is scheduled
+POD_NODE=$(kubectl get pod <pod-name> -o jsonpath='{.spec.nodeName}')
+echo "Pod scheduled on: $POD_NODE"
+
+# Check iSCSI on that node
+talosctl -n $POD_NODE exec -- iscsiadm -m session
+```
+
+## Monitoring
+
+### Prometheus Queries
+```promql
+# Cluster status
+portworx_cluster_status
+
+# Volume capacity
+portworx_volume_capacity_bytes
+
+# Volume usage
+portworx_volume_usage_bytes
+
+# I/O metrics
+rate(portworx_volume_read_bytes[5m])
+rate(portworx_volume_write_bytes[5m])
+```
+
+### List All PVCs Using Pure Storage
+```bash
+# Block storage
+kubectl get pvc --all-namespaces -o json | \
+  jq -r '.items[] | select(.spec.storageClassName == "pure-block") | 
+  "\(.metadata.namespace)/\(.metadata.name) - \(.status.phase)"'
+
+# File storage
+kubectl get pvc --all-namespaces -o json | \
+  jq -r '.items[] | select(.spec.storageClassName == "pure-file") | 
+  "\(.metadata.namespace)/\(.metadata.name) - \(.status.phase)"'
+```
+
+### Storage Usage by Namespace
+```bash
+kubectl get pvc --all-namespaces -o json | \
+  jq -r '.items[] | select(.spec.storageClassName | startswith("pure-")) | 
+  "\(.metadata.namespace)\t\(.spec.resources.requests.storage)"' | \
+  awk '{arr[$1]+=$2} END {for (i in arr) print i, arr[i]}'
+```
+
+## Maintenance
+
+### Update FlashArray Credentials
+```bash
+# Update in 1Password:
+# Vault: homelab
+# Item: pure-flasharray-fastpass
+# Field: pure.json
+
+# Force ExternalSecret refresh
+kubectl delete secret -n portworx px-pure-secret
+
+# Wait for ExternalSecret to recreate it (check status)
+kubectl get externalsecret -n portworx px-pure-secret -w
+```
+
+### Restart PX-CSI Components
+```bash
+# Restart controller
+kubectl rollout restart deployment -n portworx px-csi-controller
+
+# Restart node drivers (DaemonSet)
+kubectl rollout restart daemonset -n portworx px-csi-node
+
+# Check rollout status
+kubectl rollout status deployment -n portworx px-csi-controller
+kubectl rollout status daemonset -n portworx px-csi-node
+```
+
+### Drain Node for Maintenance
+```bash
+# Cordon node
+kubectl cordon <node-name>
+
+# Drain node (evict pods)
+kubectl drain <node-name> --ignore-daemonsets --delete-emptydir-data
+
+# Perform maintenance...
+
+# Uncordon node
+kubectl uncordon <node-name>
+```
+
+## ArgoCD Operations
+
+### Sync Application
+```bash
+# Sync via CLI
+argocd app sync portworx-csi
+
+# Force sync (ignore differences)
+argocd app sync portworx-csi --force
+
+# Sync specific resource
+argocd app sync portworx-csi --resource storagecluster:px-cluster-fastpass
+```
+
+### View Application Details
+```bash
+# App status
+argocd app get portworx-csi
+
+# App history
+argocd app history portworx-csi
+
+# App diff (compare git vs cluster)
+argocd app diff portworx-csi
+```
+
+### Rollback via ArgoCD
+```bash
+# List history
+argocd app history portworx-csi
+
+# Rollback to previous version
+argocd app rollback portworx-csi <revision-number>
+```
+
+## Configuration Updates
+
+### Edit StorageCluster
+```bash
+# Edit directly (will be overwritten by ArgoCD sync)
+kubectl edit storagecluster -n portworx px-cluster-fastpass
+
+# Permanent change: update git
+cd ~/git/homelab
+vi cluster/platform/portworx-csi/storagecluster.yaml
+git commit -am "Update Portworx StorageCluster config"
+git push
+```
+
+### Add Environment Variable
+```yaml
+# In storagecluster.yaml, add to spec.env:
+env:
+  - name: NEW_ENV_VAR
+    value: "value"
+```
+
+### Change Log Level
+```yaml
+# In storagecluster.yaml:
+env:
+  - name: LOG_LEVEL
+    value: "debug"  # or: info, warn, error
+```
+
+## Talos Node Configuration
+
+### View Current Config
+```bash
+# Read multipath.conf
+talosctl -n <node-ip> read /etc/multipath.conf
+
+# Read udev rules
+talosctl -n <node-ip> read /etc/udev/rules.d/99-pure-storage.rules
+
+# Check loaded modules
+talosctl -n <node-ip> exec -- lsmod | grep -E "iscsi|multipath"
+```
+
+### Apply Updated Talos Config
+```bash
+cd ~/git/homelab/talos/talhelper
+
+# Regenerate configs after updating talconfig.yaml
+talhelper genconfig
+
+# Apply to specific node
+talosctl apply-config \
+  --file clusterconfig/<node-name>.yaml \
+  --nodes <node-ip>
+
+# Reboot if kernel modules changed
+talosctl reboot --nodes <node-ip>
+```
+
+## Emergency Procedures
+
+### Complete Reinstall
+```bash
+# 1. Delete ArgoCD application
+kubectl delete application -n argocd portworx-csi
+
+# 2. Delete namespace
+kubectl delete namespace portworx
+
+# 3. Delete CRDs
+kubectl delete crd storageclusters.core.libopenstorage.org
+
+# 4. Delete StorageClasses
+kubectl delete storageclass pure-block pure-file
+
+# 5. Re-apply via ArgoCD
+argocd app sync portworx-csi
+```
+
+### Recover from Failed State
+```bash
+# 1. Check StorageCluster status
+kubectl get storagecluster -n portworx -o yaml
+
+# 2. Delete and recreate StorageCluster
+kubectl delete storagecluster -n portworx px-cluster-fastpass
+
+# 3. Let ArgoCD recreate it
+argocd app sync portworx-csi --force
+
+# 4. Monitor deployment
+kubectl get pods -n portworx -w
+```
+
+## Useful Aliases
+
+Add to `~/.bashrc` or `~/.zshrc`:
+
+```bash
+# Portworx aliases
+alias pxpods='kubectl get pods -n portworx'
+alias pxlogs='kubectl logs -n portworx'
+alias pxstc='kubectl get storagecluster -n portworx'
+alias pxpvc='kubectl get pvc --all-namespaces -o wide | grep pure'
+alias pxsc='kubectl get storageclass | grep pure'
+```
+
+## References
+
+- Full Documentation: `cluster/platform/portworx-csi/README.md`
+- Deployment Checklist: `cluster/platform/portworx-csi/DEPLOYMENT-CHECKLIST.md`
+- Portworx Docs: https://docs.portworx.com/portworx-csi/
+- FlashArray Docs: https://support.purestorage.com/
diff --git a/cluster/platform/portworx-csi/README.md b/cluster/platform/portworx-csi/README.md
new file mode 100644
index 0000000..4da3db4
--- /dev/null
+++ b/cluster/platform/portworx-csi/README.md
@@ -0,0 +1,494 @@
+# Portworx CSI Driver for Pure Storage FlashArray
+
+GitOps deployment of Portworx CSI driver for Pure Storage FlashArray on Talos Linux in the `fastpass` Kubernetes cluster.
+
+## Overview
+
+Portworx CSI enables Kubernetes to provision and manage storage directly from Pure Storage FlashArray, providing:
+
+- **Block Storage**: High-performance iSCSI volumes for databases and stateful apps
+- **File Storage**: NFS-based shared storage from FlashArray File Services
+- **Dynamic Provisioning**: Automatic volume creation via StorageClasses
+- **Volume Snapshots**: CSI snapshots for backup and restore
+- **Volume Expansion**: Online volume resizing without downtime
+
+## Architecture
+
+```
+┌─────────────────────────────────────────────────────────────┐
+│ Kubernetes Cluster (fastpass)                               │
+│                                                              │
+│  ┌──────────────────────────────────────────────────┐       │
+│  │ ArgoCD Application (wave 2)                      │       │
+│  │  - Portworx Operator (Helm chart)                │       │
+│  │  - StorageCluster CR                             │       │
+│  │  - StorageClasses (pure-block, pure-file)        │       │
+│  │  - ExternalSecret (px-pure-secret)               │       │
+│  └──────────────────────────────────────────────────┘       │
+│                    ↓                                         │
+│  ┌──────────────────────────────────────────────────┐       │
+│  │ Portworx Operator (namespace: portworx)          │       │
+│  │  - Watches StorageCluster CR                     │       │
+│  │  - Deploys CSI controller & node drivers         │       │
+│  └──────────────────────────────────────────────────┘       │
+│                    ↓                                         │
+│  ┌──────────────────────────────────────────────────┐       │
+│  │ PX-CSI Components                                │       │
+│  │  - Controller (Deployment): volume provisioning  │       │
+│  │  - Node Driver (DaemonSet): volume attachment    │       │
+│  │  - Monitoring (Prometheus metrics)               │       │
+│  └──────────────────────────────────────────────────┘       │
+│                    ↓                                         │
+│  ┌──────────────────────────────────────────────────┐       │
+│  │ Talos Nodes (all)                                │       │
+│  │  - iSCSI initiator configured                    │       │
+│  │  - Multipath daemon running                      │       │
+│  │  - udev rules for Pure devices                   │       │
+│  └──────────────────────────────────────────────────┘       │
+└─────────────────────────────────────────────────────────────┘
+                    ↓ iSCSI/NFS
+┌─────────────────────────────────────────────────────────────┐
+│ Pure Storage FlashArray                                     │
+│  - Block volumes (iSCSI)                                    │
+│  - File Services (NFS) [optional]                           │
+│  - API management endpoint                                  │
+└─────────────────────────────────────────────────────────────┘
+```
+
+## Prerequisites
+
+### 1. FlashArray Configuration
+
+#### Create FlashArray User and API Token
+
+1. **Create a storage admin user:**
+   - Navigate to FlashArray dashboard → **Settings** → **Access** → **Users**
+   - Click **Create User**
+   - Set role to **Storage Admin**
+   - Username: `portworx-csi`
+
+2. **Generate API token:**
+   - Select the user → **Create API Token**
+   - Leave **Expires in** blank for non-expiring token
+   - Copy the token immediately
+
+#### Configure FlashArray for Block Storage (iSCSI)
+
+1. **Verify iSCSI targets are configured:**
+   ```bash
+   # From any Talos node
+   iscsiadm -m discovery -t st -p <flasharray-mgmt-ip>
+   ```
+
+2. **Enable FlashArray network interfaces for iSCSI**
+
+#### Configure FlashArray File Services (Optional - for NFS)
+
+If using FlashArray File Services:
+
+1. **Enable File Services** on FlashArray
+2. **Create a filesystem** for Kubernetes volumes
+3. **Create an NFS policy** with user mapping disabled:
+   - Edit `nfs-simple` policy or create new policy
+   - Disable user mapping to avoid UID/GID issues
+   - Set `no_root_squash` if needed
+
+### 2. 1Password Secret Setup
+
+Create a 1Password item with FlashArray credentials:
+
+**Vault:** `homelab`  
+**Item Name:** `pure-flasharray-fastpass`  
+**Field Name:** `pure.json`  
+**Field Type:** Text  
+**Field Value:**
+```json
+{
+  "FlashArrays": [
+    {
+      "MgmtEndPoint": "flasharray.mk-labs.cloud",
+      "APIToken": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
+      "NFSEndPoint": "flasharray-nfs.mk-labs.cloud"
+    }
+  ]
+}
+```
+
+**Notes:**
+- Replace `flasharray.mk-labs.cloud` with your FlashArray management endpoint
+- Replace the API token with the actual token from FlashArray
+- Include `NFSEndPoint` only if using FlashArray File Services
+- For IPv6, enclose IP in brackets: `"[2001:db8::1]"`
+
+### 3. Talos Node Configuration
+
+Apply the following patches to **all worker nodes** in `talos/talhelper/talconfig.yaml`:
+
+```yaml
+nodes:
+  # Add to each worker node definition
+  patches:
+    - |-
+      machine:
+        # Install system extensions
+        install:
+          extensions:
+            - image: ghcr.io/siderolabs/iscsi-tools:latest
+            - image: ghcr.io/siderolabs/util-linux-tools:latest
+        
+        # Load kernel modules
+        kernel:
+          modules:
+            - name: iscsi_tcp
+            - name: dm_multipath
+            - name: dm_round_robin
+        
+        # Create multipath.conf
+        files:
+          - path: /etc/multipath.conf
+            permissions: 0644
+            op: create
+            content: |
+              blacklist {
+                devnode "^pxd[0-9]*"
+                devnode "^pxd*"
+              }
+              defaults {
+                polling_interval 10
+                find_multipaths yes
+                user_friendly_names no
+              }
+              devices {
+                device {
+                  vendor                   "PURE"
+                  product                  "FlashArray"
+                  path_selector            "service-time 0"
+                  hardware_handler         "1 alua"
+                  path_grouping_policy     group_by_prio
+                  prio                     alua
+                  failback                 immediate
+                  path_checker             tur
+                  fast_io_fail_tmo         10
+                  user_friendly_names      no
+                  no_path_retry            0
+                  features                 0
+                  dev_loss_tmo             600
+                }
+              }
+          
+          # Create udev rules
+          - path: /etc/udev/rules.d/99-pure-storage.rules
+            permissions: 0644
+            op: create
+            content: |
+              ACTION=="add|change", KERNEL=="sd*[!0-9]", SUBSYSTEM=="block", \
+                ATTRS{vendor}=="PURE", ATTR{queue/scheduler}="none"
+              ACTION=="add|change", KERNEL=="sd*[!0-9]", SUBSYSTEM=="block", \
+                ATTRS{vendor}=="PURE", ATTR{queue/nr_requests}="256"
+        
+        # Enable iSCSI mounts in kubelet
+        kubelet:
+          extraMounts:
+            - destination: /var/lib/iscsi
+              type: bind
+              source: /var/lib/iscsi
+              options:
+                - bind
+                - rshared
+                - rw
+```
+
+**Apply Talos configuration:**
+```bash
+# From city-hall (talhelper host)
+cd ~/git/homelab/talos/talhelper
+talhelper genconfig
+talosctl apply-config --file clusterconfig/<node>.yaml --nodes <node-ip>
+
+# Reboot nodes to load kernel modules
+talosctl reboot --nodes <node-ip>
+```
+
+### 4. Verify Talos Prerequisites
+
+After applying Talos configuration and rebooting:
+
+```bash
+# Check iSCSI initiator service
+talosctl -n <node-ip> get service iscsid
+
+# Verify multipath is running
+talosctl -n <node-ip> exec -- multipath -ll
+
+# Check initiator name (must be unique per node)
+talosctl -n <node-ip> read /etc/iscsi/initiatorname.iscsi
+
+# Verify kernel modules loaded
+talosctl -n <node-ip> exec -- lsmod | grep -E "iscsi|dm_multipath"
+
+# Test iSCSI discovery
+talosctl -n <node-ip> exec -- iscsiadm -m discovery -t st -p <flasharray-ip>
+```
+
+## Deployment
+
+### 1. Commit and Push to Git
+
+```bash
+cd ~/git/homelab
+git add cluster/platform/portworx-csi/
+git commit -m "Add Portworx CSI driver for Pure FlashArray"
+git push origin main
+```
+
+### 2. Deploy via ArgoCD
+
+The application is configured with `sync-wave: 2`, so it will deploy after External Secrets Operator and 1Password Connect.
+
+**Option A: Auto-sync (recommended)**
+```bash
+# ArgoCD will automatically sync after detecting changes
+# Check status:
+kubectl get application -n argocd portworx-csi
+```
+
+**Option B: Manual sync**
+```bash
+# Sync via CLI
+argocd app sync portworx-csi
+
+# Or sync via UI
+# Navigate to ArgoCD UI → Applications → portworx-csi → Sync
+```
+
+### 3. Verify Deployment
+
+```bash
+# Check ArgoCD application status
+kubectl get application -n argocd portworx-csi
+
+# Check Portworx Operator
+kubectl get deployment -n portworx portworx-operator
+kubectl get pods -n portworx -l app=portworx-operator
+
+# Check StorageCluster status
+kubectl get storagecluster -n portworx px-cluster-fastpass
+kubectl describe storagecluster -n portworx px-cluster-fastpass
+
+# Check PX-CSI pods
+kubectl get pods -n portworx
+
+# Verify secret was created from 1Password
+kubectl get secret -n portworx px-pure-secret
+kubectl get secret -n portworx px-pure-secret -o jsonpath='{.data.pure\.json}' | base64 -d | jq
+
+# Check CSI driver registration
+kubectl get csidrivers
+kubectl get csinode
+
+# Verify StorageClasses
+kubectl get storageclass pure-block pure-file
+```
+
+Expected output:
+```
+NAME                          PROVISIONER         RECLAIMPOLICY   VOLUMEBINDINGMODE   ALLOWVOLUMEEXPANSION
+pure-block                    pxd.portworx.com    Delete          Immediate           true
+pure-file                     pxd.portworx.com    Delete          Immediate           true
+```
+
+## Usage
+
+### Create a PVC with Block Storage
+
+```yaml
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: postgres-data
+  namespace: default
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: pure-block
+  resources:
+    requests:
+      storage: 10Gi
+```
+
+### Create a PVC with File Storage (NFS)
+
+```yaml
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: shared-data
+  namespace: default
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: pure-file
+  resources:
+    requests:
+      storage: 50Gi
+```
+
+### Volume Expansion
+
+```bash
+# Edit PVC to increase size
+kubectl patch pvc postgres-data -p '{"spec":{"resources":{"requests":{"storage":"20Gi"}}}}'
+
+# Verify expansion
+kubectl get pvc postgres-data
+```
+
+### Volume Snapshots
+
+```yaml
+apiVersion: snapshot.storage.k8s.io/v1
+kind: VolumeSnapshot
+metadata:
+  name: postgres-backup
+  namespace: default
+spec:
+  volumeSnapshotClassName: px-csi-snapshot-class
+  source:
+    persistentVolumeClaimName: postgres-data
+```
+
+## StorageClasses
+
+### pure-block
+- **Backend:** Pure Storage FlashArray (iSCSI)
+- **Access Mode:** ReadWriteOnce (RWO)
+- **Use Case:** Databases, stateful applications requiring block storage
+- **Features:** High performance, low latency, volume expansion
+- **Filesystem:** ext4
+
+### pure-file
+- **Backend:** Pure Storage FlashArray File Services (NFS)
+- **Access Mode:** ReadWriteMany (RWX)
+- **Use Case:** Shared storage for multi-pod applications
+- **Features:** NFS v4.1, concurrent access, volume expansion
+- **Mount Options:** hard, timeo=600, retrans=3
+
+## Monitoring
+
+Portworx CSI exposes Prometheus metrics:
+
+```bash
+# Check ServiceMonitor (if Prometheus Operator is installed)
+kubectl get servicemonitor -n portworx
+
+# View metrics endpoint
+kubectl get svc -n portworx -l app=portworx-api
+
+# Example metrics:
+# - portworx_volume_usage_bytes
+# - portworx_volume_capacity_bytes
+# - portworx_cluster_status
+```
+
+To enable Prometheus scraping, the `kube-prometheus-stack` will auto-discover the ServiceMonitor.
+
+## Troubleshooting
+
+### Pods stuck in ContainerCreating
+
+```bash
+# Check PVC status
+kubectl get pvc
+kubectl describe pvc <pvc-name>
+
+# Check PV binding
+kubectl get pv
+
+# Check PX-CSI node driver logs
+kubectl logs -n portworx -l app=px-csi-driver --tail=100
+
+# Check iSCSI sessions on node
+talosctl -n <node-ip> exec -- iscsiadm -m session
+```
+
+### Volume not attaching
+
+```bash
+# Check StorageCluster status
+kubectl get storagecluster -n portworx -o yaml
+
+# Check PX-CSI controller logs
+kubectl logs -n portworx -l app=portworx-operator
+
+# Verify FlashArray connectivity
+kubectl exec -n portworx -it <px-pod> -- ping <flasharray-mgmt-ip>
+
+# Check secret is valid
+kubectl get secret -n portworx px-pure-secret -o yaml
+```
+
+### Multipath issues
+
+```bash
+# Check multipath status on node
+talosctl -n <node-ip> exec -- multipath -ll
+
+# Restart multipathd if needed
+talosctl -n <node-ip> exec -- systemctl restart multipathd
+
+# Verify udev rules applied
+talosctl -n <node-ip> exec -- udevadm control --reload-rules
+talosctl -n <node-ip> exec -- udevadm trigger
+```
+
+### FlashArray API errors
+
+```bash
+# Verify API token is valid
+# From a pod with curl:
+curl -k -H "api-token: <token>" https://<flasharray-mgmt-ip>/api/2.0/arrays
+
+# Check PX-CSI can reach FlashArray
+kubectl exec -n portworx -it <px-pod> -- curl -k https://<flasharray-mgmt-ip>
+```
+
+## Rollback
+
+If deployment fails:
+
+```bash
+# Delete ArgoCD application (keeps namespace and CRDs)
+kubectl delete application -n argocd portworx-csi
+
+# Or remove via ArgoCD UI
+
+# Full cleanup (if needed):
+kubectl delete namespace portworx
+kubectl delete crd storageclusters.core.libopenstorage.org
+kubectl delete storageclass pure-block pure-file
+```
+
+## References
+
+- [Portworx CSI Documentation](https://docs.portworx.com/portworx-csi/)
+- [FlashArray Preparation Guide](https://docs.portworx.com/portworx-csi/install/prepare/flash-array)
+- [Talos Linux Storage Guide](https://www.talos.dev/latest/kubernetes-guides/configuration/storage/)
+- [Pure Storage Best Practices](https://support.purestorage.com/)
+
+## Architecture Decisions
+
+- **Sync Wave 2:** Deployed after External Secrets Operator (wave 1) but before applications
+- **iSCSI Protocol:** Selected for broad compatibility; NVMe-oF can be added later
+- **No Default StorageClass:** Keeps existing `nfs-emporium` as default; apps opt-in to Pure
+- **Telemetry Disabled:** For homelab privacy; can enable for production support
+- **Single FlashArray:** Configuration supports multiple arrays; add to `pure.json` as needed
+
+## Future Enhancements
+
+- [ ] Enable CSI topology for multi-zone deployments
+- [ ] Configure NVMe-oF protocol for lower latency
+- [ ] Set up FlashArray ActiveCluster for HA
+- [ ] Enable Portworx Fusion Controller
+- [ ] Configure VLAN binding for isolated storage traffic
+- [ ] Implement backup/restore workflows with snapshots
+- [ ] Add Grafana dashboards for Portworx metrics
diff --git a/cluster/platform/portworx-csi/application.yaml b/cluster/platform/portworx-csi/application.yaml
new file mode 100644
index 0000000..eda371b
--- /dev/null
+++ b/cluster/platform/portworx-csi/application.yaml
@@ -0,0 +1,54 @@
+# ------------------------------------------------------------------------------
+# Platform: portworx-csi
+# Wave 2 — no secret dependencies initially; must be ready before stateful workloads
+# 
+# Portworx CSI driver for Pure Storage FlashArray on Talos Linux
+# Provides high-performance block and file storage for Kubernetes workloads
+# 
+# Installation flow:
+#   1. External Secrets Operator (wave 1) creates px-pure-secret from 1Password
+#   2. Portworx Operator deploys (via Helm chart)
+#   3. StorageCluster CR provisions CSI driver components
+#   4. StorageClasses become available for PVC provisioning
+#
+# Prerequisites:
+#   - FlashArray configured with API token in 1Password
+#   - Talos nodes configured with multipath and udev rules (via MachineConfig)
+#   - iSCSI initiators enabled on all nodes
+# ------------------------------------------------------------------------------
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: portworx-csi
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  project: default
+  sources:
+    # Source 1: Portworx Operator Helm chart from Portworx
+    - repoURL: https://raw.githubusercontent.com/portworx/px-operator/main/deploy/helm/charts
+      chart: px-operator
+      targetRevision: 25.0.0
+      helm:
+        valueFiles:
+          - $values/cluster/platform/portworx-csi/operator-values.yaml
+    # Source 2: Repo — StorageCluster spec, StorageClasses, ExternalSecret
+    - repoURL: https://gitea.mk-labs.cloud/rblundon/homelab.git
+      targetRevision: main
+      path: cluster/platform/portworx-csi
+      ref: values
+      directory:
+        exclude: "application.yaml"
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: portworx
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true
+    syncWaves:
+      - wave: 2
diff --git a/cluster/platform/portworx-csi/externalsecret.yaml b/cluster/platform/portworx-csi/externalsecret.yaml
new file mode 100644
index 0000000..43d56a5
--- /dev/null
+++ b/cluster/platform/portworx-csi/externalsecret.yaml
@@ -0,0 +1,61 @@
+# ------------------------------------------------------------------------------
+# ExternalSecret for Pure Storage FlashArray Credentials
+# Syncs from 1Password to create px-pure-secret
+#
+# This secret contains pure.json with FlashArray configuration:
+#   - Management endpoint
+#   - API token
+#   - NFS endpoint (if using file services)
+#
+# Expected 1Password structure:
+#   Vault: homelab
+#   Item: pure-flasharray-fastpass
+#   Field: pure.json (contains the full JSON configuration)
+#
+# The pure.json format:
+#   {
+#     "FlashArrays": [
+#       {
+#         "MgmtEndPoint": "flasharray.mk-labs.cloud",
+#         "APIToken": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
+#         "NFSEndPoint": "flasharray-nfs.mk-labs.cloud"
+#       }
+#     ]
+#   }
+# ------------------------------------------------------------------------------
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: px-pure-secret
+  namespace: portworx
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  # Refresh interval
+  refreshInterval: 1h
+
+  # Reference to SecretStore (assumes ClusterSecretStore named "onepassword" exists)
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword
+
+  # Target secret specification
+  target:
+    name: px-pure-secret
+    creationPolicy: Owner
+    template:
+      type: Opaque
+      metadata:
+        labels:
+          app.kubernetes.io/name: portworx-csi
+          app.kubernetes.io/component: storage
+      data:
+        # The key must be "pure.json" - this is required by PX-CSI
+        pure.json: "{{ .pure_config | toString }}"
+
+  # Data to fetch from 1Password
+  data:
+    - secretKey: pure_config
+      remoteRef:
+        key: pure-flasharray-fastpass
+        property: pure.json
diff --git a/cluster/platform/portworx-csi/operator-values.yaml b/cluster/platform/portworx-csi/operator-values.yaml
new file mode 100644
index 0000000..9c76a2e
--- /dev/null
+++ b/cluster/platform/portworx-csi/operator-values.yaml
@@ -0,0 +1,37 @@
+# ------------------------------------------------------------------------------
+# Portworx Operator Helm Values for Talos Linux
+# Chart: px-operator from Portworx
+# Version: 25.0.0
+# ------------------------------------------------------------------------------
+
+# Deploy operator to portworx namespace
+namespace: portworx
+
+# Operator configuration
+operator:
+  # Single replica is sufficient for homelab
+  replicas: 1
+
+  # Tolerations to allow operator on control plane nodes if needed
+  tolerations:
+    - key: node-role.kubernetes.io/control-plane
+      operator: Exists
+      effect: NoSchedule
+
+  # Resource requests/limits
+  resources:
+    requests:
+      cpu: 50m
+      memory: 128Mi
+    limits:
+      cpu: 200m
+      memory: 256Mi
+
+# RBAC configuration
+rbac:
+  create: true
+
+# ServiceAccount
+serviceAccount:
+  create: true
+  name: portworx-operator
diff --git a/cluster/platform/portworx-csi/storageclass-block.yaml b/cluster/platform/portworx-csi/storageclass-block.yaml
new file mode 100644
index 0000000..734e4ac
--- /dev/null
+++ b/cluster/platform/portworx-csi/storageclass-block.yaml
@@ -0,0 +1,51 @@
+# ------------------------------------------------------------------------------
+# StorageClass: pure-block
+# Provisioner: pxd.portworx.com (Portworx CSI)
+# Backend: Pure Storage FlashArray (iSCSI block volumes)
+#
+# Use case: High-performance block storage for databases, stateful applications
+# Features:
+#   - Block-level access via iSCSI
+#   - Dynamic provisioning from FlashArray
+#   - RWO (ReadWriteOnce) access mode
+#   - Delete reclaim policy (volume deleted when PVC is deleted)
+#
+# Parameters:
+#   - backend: "pure-block" (uses FlashArray block volumes)
+#   - repl: "1" (single replica, FlashArray handles redundancy)
+#   - io_profile: "db_remote" (optimized for database workloads)
+# ------------------------------------------------------------------------------
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: pure-block
+  annotations:
+    storageclass.kubernetes.io/is-default-class: "false"
+provisioner: pxd.portworx.com
+parameters:
+  # Backend type
+  backend: "pure-block"
+  
+  # Replication factor (FlashArray handles HA)
+  repl: "1"
+  
+  # I/O profile optimized for databases
+  io_profile: "db_remote"
+  
+  # Filesystem type
+  fs: "ext4"
+  
+  # Priority (higher number = higher priority for placement)
+  priority_io: "high"
+
+# Reclaim policy
+reclaimPolicy: Delete
+
+# Volume binding mode
+volumeBindingMode: Immediate
+
+# Allow volume expansion
+allowVolumeExpansion: true
+
+# Mount options
+mountOptions: []
diff --git a/cluster/platform/portworx-csi/storageclass-file.yaml b/cluster/platform/portworx-csi/storageclass-file.yaml
new file mode 100644
index 0000000..7b8103d
--- /dev/null
+++ b/cluster/platform/portworx-csi/storageclass-file.yaml
@@ -0,0 +1,56 @@
+# ------------------------------------------------------------------------------
+# StorageClass: pure-file
+# Provisioner: pxd.portworx.com (Portworx CSI)
+# Backend: Pure Storage FlashArray File Services (NFS)
+#
+# Use case: Shared file storage for applications requiring RWX access
+# Features:
+#   - NFS-based file storage from FlashArray File Services
+#   - Dynamic provisioning of NFS exports
+#   - RWX (ReadWriteMany) access mode support
+#   - Delete reclaim policy
+#
+# Prerequisites:
+#   - FlashArray File Services enabled
+#   - NFS policy configured on FlashArray
+#   - NFSEndPoint specified in pure.json
+#
+# Parameters:
+#   - backend: "pure-file" (uses FlashArray File Services)
+#   - export_options: NFS export options
+# ------------------------------------------------------------------------------
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: pure-file
+  annotations:
+    storageclass.kubernetes.io/is-default-class: "false"
+provisioner: pxd.portworx.com
+parameters:
+  # Backend type - FlashArray File Services (NFS)
+  backend: "pure-file"
+  
+  # NFS export options
+  export_options: "*(rw,no_root_squash)"
+  
+  # Filesystem type (NFS is the protocol, not a local filesystem)
+  # This parameter may not be applicable for pure-file backend
+  
+  # Priority for placement
+  priority_io: "medium"
+
+# Reclaim policy
+reclaimPolicy: Delete
+
+# Volume binding mode
+volumeBindingMode: Immediate
+
+# Allow volume expansion
+allowVolumeExpansion: true
+
+# Mount options for NFS
+mountOptions:
+  - nfsvers=4.1
+  - hard
+  - timeo=600
+  - retrans=3
diff --git a/cluster/platform/portworx-csi/storagecluster.yaml b/cluster/platform/portworx-csi/storagecluster.yaml
new file mode 100644
index 0000000..3137352
--- /dev/null
+++ b/cluster/platform/portworx-csi/storagecluster.yaml
@@ -0,0 +1,121 @@
+# ------------------------------------------------------------------------------
+# Portworx StorageCluster Custom Resource
+# Deployed by Portworx Operator to provision PX-CSI driver components
+#
+# This CR defines:
+#   - PX-CSI version and configuration
+#   - FlashArray backend storage type (iSCSI)
+#   - Secret reference for FlashArray credentials
+#   - CSI driver deployment parameters
+#
+# The Operator watches this CR and deploys:
+#   - CSI controller (Deployment)
+#   - CSI node driver (DaemonSet)
+#   - Storage classes
+#   - Monitoring components (optional)
+# ------------------------------------------------------------------------------
+apiVersion: core.libopenstorage.org/v1
+kind: StorageCluster
+metadata:
+  name: px-cluster-fastpass
+  namespace: portworx
+  annotations:
+    portworx.io/install-source: "helm"
+    portworx.io/is-openshift: "false"
+spec:
+  # Image configuration
+  image: portworx/px-csi:3.2.0
+  imagePullPolicy: IfNotPresent
+
+  # Cluster configuration
+  kvdb:
+    # Use internal KVDB (etcd embedded in PX-CSI for small clusters)
+    internal: true
+
+  # Storage configuration
+  storage:
+    useAll: false
+    devices: []
+    # PX-CSI uses FlashArray as backend; no local devices needed
+    journalDevice: null
+
+  # Network configuration
+  network:
+    # Use Kubernetes cluster network
+    dataInterface: null
+    mgmtInterface: null
+
+  # CSI configuration
+  csi:
+    enabled: true
+    # Install CSI driver components
+    installDriver: true
+    
+    # Topology support (optional - disabled for initial deployment)
+    topology:
+      enabled: false
+
+  # Secret reference for FlashArray credentials
+  # Created by ExternalSecret from 1Password
+  cloudStorage:
+    provider: "Pure"
+    pure:
+      # Reference to px-pure-secret containing pure.json
+      secretRef: px-pure-secret
+
+  # Environment variables for PX-CSI
+  env:
+    # FlashArray SAN type - REQUIRED for block storage
+    - name: PURE_FLASHARRAY_SAN_TYPE
+      value: "ISCSI"
+    
+    # Disable telemetry for homelab (can be enabled later)
+    - name: PURE_DISABLE_TELEMETRY
+      value: "true"
+    
+    # Log level
+    - name: LOG_LEVEL
+      value: "info"
+
+  # Monitoring
+  monitoring:
+    # Prometheus metrics enabled
+    prometheus:
+      enabled: true
+      exportMetrics: true
+
+  # Auto-update strategy
+  updateStrategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+
+  # Delete strategy
+  deleteStrategy:
+    type: Uninstall
+
+  # Placement configuration
+  placement:
+    nodeAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+        nodeSelectorTerms:
+          - matchExpressions:
+              - key: kubernetes.io/os
+                operator: In
+                values:
+                  - linux
+
+  # Tolerations for Talos nodes
+  tolerations:
+    - key: node-role.kubernetes.io/control-plane
+      operator: Exists
+      effect: NoSchedule
+
+  # Security
+  security:
+    enabled: false  # Start with security disabled for initial setup
+
+  # Feature gates
+  featureGates:
+    # Enable CSI snapshots
+    CSISnapshotController: "true"
diff --git a/cluster/platform/portworx-csi/talos-config-reference.yaml b/cluster/platform/portworx-csi/talos-config-reference.yaml
new file mode 100644
index 0000000..cb0f2c9
--- /dev/null
+++ b/cluster/platform/portworx-csi/talos-config-reference.yaml
@@ -0,0 +1,144 @@
+# ------------------------------------------------------------------------------
+# Talos MachineConfig Extension for Portworx CSI / FlashArray
+# 
+# This file documents the required Talos configuration for Pure Storage FlashArray
+# with Portworx CSI. These configurations must be applied to Talos nodes via
+# talhelper or talosctl.
+#
+# DO NOT apply this as a Kubernetes manifest - it's a reference for Talos patches.
+#
+# To apply these changes:
+#   1. Add the patches below to talos/talhelper/talconfig.yaml
+#   2. Run: talhelper genconfig
+#   3. Apply updated config: talosctl apply-config --file clusterconfig/...
+#
+# Required for:
+#   - iSCSI initiator configuration
+#   - Multipath device mapping (DM-multipath)
+#   - udev rules for Pure Storage devices
+# ------------------------------------------------------------------------------
+
+# Add this to your Talos worker node patches in talconfig.yaml:
+#
+# patches:
+#   - |-
+#     machine:
+#       # Install system extensions for iSCSI and multipath
+#       install:
+#         extensions:
+#           - image: ghcr.io/siderolabs/iscsi-tools:latest
+#           - image: ghcr.io/siderolabs/util-linux-tools:latest
+#
+#       # Kernel modules required for iSCSI and multipath
+#       kernel:
+#         modules:
+#           - name: iscsi_tcp
+#           - name: dm_multipath
+#           - name: dm_round_robin
+#
+#       # Configure multipath.conf
+#       files:
+#         - path: /etc/multipath.conf
+#           permissions: 0644
+#           op: create
+#           content: |
+#             # Multipath configuration for Pure Storage FlashArray
+#             blacklist {
+#               devnode "^pxd[0-9]*"
+#               devnode "^pxd*"
+#             }
+#             
+#             defaults {
+#               polling_interval 10
+#               find_multipaths yes
+#               user_friendly_names no
+#             }
+#             
+#             devices {
+#               # Pure FlashArray iSCSI devices
+#               device {
+#                 vendor                   "PURE"
+#                 product                  "FlashArray"
+#                 path_selector            "service-time 0"
+#                 hardware_handler         "1 alua"
+#                 path_grouping_policy     group_by_prio
+#                 prio                     alua
+#                 failback                 immediate
+#                 path_checker             tur
+#                 fast_io_fail_tmo         10
+#                 user_friendly_names      no
+#                 no_path_retry            0
+#                 features                 0
+#                 dev_loss_tmo             600
+#               }
+#               
+#               # Pure FlashArray NVMe-oF devices (if using NVMe-oF instead of iSCSI)
+#               device {
+#                 vendor                      "NVME"
+#                 product                     "Pure FlashArray"
+#                 path_selector               "queue-length 0"
+#                 path_grouping_policy        group_by_prio
+#                 prio                        ana
+#                 failback                    immediate
+#                 fast_io_fail_tmo            10
+#                 user_friendly_names         no
+#                 no_path_retry               0
+#                 features                    0
+#                 dev_loss_tmo                60
+#               }
+#             }
+#
+#         # udev rules for Pure Storage
+#         - path: /etc/udev/rules.d/99-pure-storage.rules
+#           permissions: 0644
+#           op: create
+#           content: |
+#             # Pure Storage udev rules for FlashArray
+#             # Queue depth settings for optimal performance
+#             
+#             # Set scheduler to none for Pure devices
+#             ACTION=="add|change", KERNEL=="sd*[!0-9]", SUBSYSTEM=="block", \
+#               ATTRS{vendor}=="PURE", ATTR{queue/scheduler}="none"
+#             
+#             # Set queue depth for Pure iSCSI devices
+#             ACTION=="add|change", KERNEL=="sd*[!0-9]", SUBSYSTEM=="block", \
+#               ATTRS{vendor}=="PURE", ATTR{queue/nr_requests}="256"
+#             
+#             # Set queue depth for Pure NVMe devices
+#             ACTION=="add|change", KERNEL=="nvme*", SUBSYSTEM=="block", \
+#               ATTRS{model}=="Pure*", ATTR{queue/nr_requests}="256"
+#
+#       # Enable and configure iSCSI initiator
+#       kubelet:
+#         extraMounts:
+#           - destination: /var/lib/iscsi
+#             type: bind
+#             source: /var/lib/iscsi
+#             options:
+#               - bind
+#               - rshared
+#               - rw
+#
+# NOTE: After applying Talos configuration changes:
+# 1. Reboot nodes if kernel modules were added
+# 2. Verify iSCSI initiator: talosctl -n <node> get service iscsi-initiator
+# 3. Verify multipath: talosctl -n <node> exec -- multipath -ll
+# 4. Check initiator name uniqueness: talosctl -n <node> read /etc/iscsi/initiatorname.iscsi
+
+---
+# This marker prevents accidental application as a K8s resource
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: portworx-csi-talos-config-reference
+  namespace: portworx
+  annotations:
+    description: "Reference only - do not apply. See comments for Talos patches."
+data:
+  README: |
+    This ConfigMap is a documentation artifact only.
+    
+    The actual configuration must be applied via Talos MachineConfig
+    using talhelper or talosctl.
+    
+    See the comments in this file for the complete configuration.
diff --git a/cluster/platform/portworx-csi/validate-prereqs.sh b/cluster/platform/portworx-csi/validate-prereqs.sh
new file mode 100755
index 0000000..47e6ea3
--- /dev/null
+++ b/cluster/platform/portworx-csi/validate-prereqs.sh
@@ -0,0 +1,228 @@
+#!/bin/bash
+# Pre-deployment validation script for Portworx CSI on Talos Linux
+# Checks prerequisites before deploying Portworx CSI driver
+
+set -e
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m' # No Color
+
+ERRORS=0
+WARNINGS=0
+
+echo "======================================================================"
+echo "Portworx CSI Pre-Deployment Validation"
+echo "======================================================================"
+echo ""
+
+# Function to print results
+check_pass() {
+    echo -e "${GREEN}✓${NC} $1"
+}
+
+check_fail() {
+    echo -e "${RED}✗${NC} $1"
+    ((ERRORS++))
+}
+
+check_warn() {
+    echo -e "${YELLOW}!${NC} $1"
+    ((WARNINGS++))
+}
+
+# Check kubectl connectivity
+echo "=== Kubernetes Cluster Connectivity ==="
+if kubectl cluster-info &>/dev/null; then
+    check_pass "kubectl can connect to cluster"
+    CLUSTER_NAME=$(kubectl config current-context)
+    echo "   Context: $CLUSTER_NAME"
+else
+    check_fail "kubectl cannot connect to cluster"
+    exit 1
+fi
+echo ""
+
+# Check namespace
+echo "=== Namespace Preparation ==="
+if kubectl get namespace portworx &>/dev/null; then
+    check_warn "Namespace 'portworx' already exists (expected if re-deploying)"
+else
+    check_pass "Namespace 'portworx' does not exist (will be created)"
+fi
+echo ""
+
+# Check External Secrets Operator
+echo "=== External Secrets Operator ==="
+if kubectl get deployment -n external-secrets external-secrets &>/dev/null; then
+    check_pass "External Secrets Operator is deployed"
+    
+    ESO_READY=$(kubectl get deployment -n external-secrets external-secrets -o jsonpath='{.status.readyReplicas}')
+    if [ "$ESO_READY" -ge 1 ]; then
+        check_pass "External Secrets Operator is ready ($ESO_READY replicas)"
+    else
+        check_fail "External Secrets Operator is not ready"
+    fi
+else
+    check_fail "External Secrets Operator is not deployed (required for secret sync)"
+fi
+echo ""
+
+# Check ClusterSecretStore
+echo "=== ClusterSecretStore ==="
+if kubectl get clustersecretstore onepassword &>/dev/null; then
+    check_pass "ClusterSecretStore 'onepassword' exists"
+    
+    STORE_STATUS=$(kubectl get clustersecretstore onepassword -o jsonpath='{.status.conditions[0].status}')
+    if [ "$STORE_STATUS" = "True" ]; then
+        check_pass "ClusterSecretStore is ready"
+    else
+        check_warn "ClusterSecretStore may not be ready (status: $STORE_STATUS)"
+    fi
+else
+    check_fail "ClusterSecretStore 'onepassword' not found (required for 1Password sync)"
+fi
+echo ""
+
+# Check Talos nodes
+echo "=== Talos Node Configuration ==="
+NODES=$(kubectl get nodes -o jsonpath='{.items[*].metadata.name}')
+NODE_COUNT=$(echo "$NODES" | wc -w)
+
+if [ "$NODE_COUNT" -eq 0 ]; then
+    check_fail "No nodes found in cluster"
+else
+    check_pass "Found $NODE_COUNT nodes in cluster"
+    
+    for NODE in $NODES; do
+        echo "   Checking node: $NODE"
+        
+        # Check if Talos
+        OS=$(kubectl get node "$NODE" -o jsonpath='{.status.nodeInfo.osImage}')
+        if [[ "$OS" == *"Talos"* ]]; then
+            check_pass "     Node is running Talos Linux"
+        else
+            check_warn "     Node is not running Talos Linux (OS: $OS)"
+        fi
+    done
+fi
+echo ""
+
+# Note: Cannot check iSCSI/multipath from kubectl - requires talosctl access
+echo "=== Talos iSCSI and Multipath (manual verification required) ==="
+check_warn "Cannot verify iSCSI/multipath from kubectl - requires talosctl"
+echo "   Run manually on each node:"
+echo "     talosctl -n <node-ip> get service iscsid"
+echo "     talosctl -n <node-ip> exec -- multipath -ll"
+echo "     talosctl -n <node-ip> read /etc/iscsi/initiatorname.iscsi"
+echo ""
+
+# Check existing CSI drivers
+echo "=== Existing CSI Drivers ==="
+EXISTING_CSI=$(kubectl get csidrivers -o jsonpath='{.items[*].metadata.name}')
+if [[ "$EXISTING_CSI" == *"pxd.portworx.com"* ]]; then
+    check_warn "Portworx CSI driver already registered (re-deployment scenario)"
+else
+    check_pass "Portworx CSI driver not yet registered"
+fi
+
+if [ -n "$EXISTING_CSI" ]; then
+    echo "   Existing CSI drivers:"
+    for driver in $EXISTING_CSI; do
+        echo "     - $driver"
+    done
+fi
+echo ""
+
+# Check for conflicting StorageClasses
+echo "=== StorageClass Conflicts ==="
+if kubectl get storageclass pure-block &>/dev/null; then
+    check_warn "StorageClass 'pure-block' already exists (will be reconciled)"
+else
+    check_pass "StorageClass 'pure-block' does not exist"
+fi
+
+if kubectl get storageclass pure-file &>/dev/null; then
+    check_warn "StorageClass 'pure-file' already exists (will be reconciled)"
+else
+    check_pass "StorageClass 'pure-file' does not exist"
+fi
+echo ""
+
+# Check ArgoCD
+echo "=== ArgoCD ==="
+if kubectl get namespace argocd &>/dev/null; then
+    check_pass "ArgoCD namespace exists"
+    
+    if kubectl get application -n argocd portworx-csi &>/dev/null; then
+        check_warn "ArgoCD Application 'portworx-csi' already exists"
+        
+        APP_STATUS=$(kubectl get application -n argocd portworx-csi -o jsonpath='{.status.sync.status}')
+        APP_HEALTH=$(kubectl get application -n argocd portworx-csi -o jsonpath='{.status.health.status}')
+        echo "   Status: $APP_STATUS, Health: $APP_HEALTH"
+    else
+        check_pass "ArgoCD Application 'portworx-csi' does not exist (will be created)"
+    fi
+else
+    check_fail "ArgoCD namespace not found (required for GitOps deployment)"
+fi
+echo ""
+
+# Check if manifests exist in repo
+echo "=== Repository Manifests ==="
+MANIFEST_DIR="cluster/platform/portworx-csi"
+
+if [ -d "$MANIFEST_DIR" ]; then
+    check_pass "Portworx CSI manifest directory exists"
+    
+    REQUIRED_FILES=(
+        "application.yaml"
+        "operator-values.yaml"
+        "storagecluster.yaml"
+        "externalsecret.yaml"
+        "storageclass-block.yaml"
+        "storageclass-file.yaml"
+    )
+    
+    for file in "${REQUIRED_FILES[@]}"; do
+        if [ -f "$MANIFEST_DIR/$file" ]; then
+            check_pass "   Found: $file"
+        else
+            check_fail "   Missing: $file"
+        fi
+    done
+else
+    check_fail "Portworx CSI manifest directory not found: $MANIFEST_DIR"
+fi
+echo ""
+
+# Check for network connectivity to FlashArray (if endpoint is known)
+echo "=== FlashArray Connectivity (manual verification recommended) ==="
+check_warn "Cannot test FlashArray connectivity without endpoint"
+echo "   Test manually:"
+echo "     ping <flasharray-mgmt-ip>"
+echo "     curl -k https://<flasharray-mgmt-ip>/api/2.0/arrays"
+echo ""
+
+# Summary
+echo "======================================================================"
+echo "Validation Summary"
+echo "======================================================================"
+if [ $ERRORS -eq 0 ] && [ $WARNINGS -eq 0 ]; then
+    echo -e "${GREEN}✓ All checks passed!${NC}"
+    echo "Ready to deploy Portworx CSI."
+    exit 0
+elif [ $ERRORS -eq 0 ]; then
+    echo -e "${YELLOW}! $WARNINGS warnings found${NC}"
+    echo "Deployment may proceed, but review warnings above."
+    exit 0
+else
+    echo -e "${RED}✗ $ERRORS errors found${NC}"
+    if [ $WARNINGS -gt 0 ]; then
+        echo -e "${YELLOW}! $WARNINGS warnings found${NC}"
+    fi
+    echo ""
+    echo "Please resolve errors before deploying Portworx CSI."
+    exit 1
+fi