--- a/compiled/csi-tenant/manifests/kubevirt-csi-driver/kubevirt-csi-node-daemonset.yaml
+++ b/compiled/csi-tenant/manifests/kubevirt-csi-driver/kubevirt-csi-node-daemonset.yaml
@@ -0,0 +1,130 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  labels:
+    app: kubevirt-csi-driver
+    name: kubevirt-csi-node
+  name: kubevirt-csi-node
+  namespace: kubevirt-csi-driver
+spec:
+  selector:
+    matchLabels:
+      app: kubevirt-csi-driver
+  template:
+    metadata:
+      labels:
+        app: kubevirt-csi-driver
+    spec:
+      containers:
+        - args:
+            - --endpoint=unix:/csi/csi.sock
+            - --node-name=$(KUBE_NODE_NAME)
+            - --run-node-service=true
+            - --run-controller-service=false
+            - --v=5
+          env:
+            - name: KUBE_NODE_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+          image: quay.io/kubevirt/kubevirt-csi-driver@sha256:44c98353e6137455d6a393ad13e04f60e10ee49fdcd00cf078f7f7084714f409
+          livenessProbe:
+            failureThreshold: 5
+            httpGet:
+              path: /healthz
+              port: healthz
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 3
+          name: csi-driver
+          ports:
+            - containerPort: 10300
+              name: healthz
+              protocol: TCP
+          resources:
+            requests:
+              cpu: 10m
+              memory: 50Mi
+          securityContext:
+            allowPrivilegeEscalation: true
+            privileged: true
+            runAsUser: 0
+          volumeMounts:
+            - mountPath: /var/lib/kubelet
+              mountPropagation: Bidirectional
+              name: kubelet-dir
+            - mountPath: /csi
+              name: plugin-dir
+            - mountPath: /dev
+              name: device-dir
+            - mountPath: /run/udev
+              name: udev
+        - args:
+            - --csi-address=/csi/csi.sock
+            - --kubelet-registration-path=/var/lib/kubelet/plugins/csi.kubevirt.io/csi.sock
+            - --v=5
+          image: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.15.0@sha256:11f199f6bec47403b03cb49c79a41f445884b213b382582a60710b8c6fdc316a
+          name: csi-node-driver-registrar
+          resources:
+            requests:
+              cpu: 5m
+              memory: 20Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+          volumeMounts:
+            - mountPath: /csi
+              name: plugin-dir
+            - mountPath: /registration
+              name: registration-dir
+        - args:
+            - --csi-address=/csi/csi.sock
+            - --probe-timeout=3s
+            - --health-port=10300
+          image: registry.k8s.io/sig-storage/livenessprobe:v2.17.0@sha256:9b75b9ade162136291d5e8f13a1dfc3dec71ee61419b1bfc112e0796ff8a6aa9
+          name: csi-liveness-probe
+          resources:
+            requests:
+              cpu: 5m
+              memory: 20Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+          volumeMounts:
+            - mountPath: /csi
+              name: plugin-dir
+      priorityClassName: system-node-critical
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
+      serviceAccountName: kubevirt-csi-node-sa
+      tolerations:
+        - operator: Exists
+      volumes:
+        - hostPath:
+            path: /var/lib/kubelet
+            type: Directory
+          name: kubelet-dir
+        - hostPath:
+            path: /var/lib/kubelet/plugins/csi.kubevirt.io/
+            type: DirectoryOrCreate
+          name: plugin-dir
+        - hostPath:
+            path: /var/lib/kubelet/plugins_registry/
+            type: Directory
+          name: registration-dir
+        - hostPath:
+            path: /dev
+            type: Directory
+          name: device-dir
+        - hostPath:
+            path: /run/udev
+          name: udev
+  updateStrategy:
+    type: RollingUpdate
--- a/compiled/csi-infra/manifests/tenant-a-kubevirt-csi-clusterrole.yaml
+++ b/compiled/csi-infra/manifests/tenant-a-kubevirt-csi-clusterrole.yaml
@@ -0,0 +1,14 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app: kubevirt-csi-driver
+    name: tenant-a-kubevirt-csi
+  name: tenant-a-kubevirt-csi
+rules:
+  - apiGroups:
+      - ''
+    resources:
+      - persistentvolumes
+    verbs:
+      - get
--- a/compiled/csi-infra/manifests/tenant-a-kubevirt-csi-clusterrolebinding.yaml
+++ b/compiled/csi-infra/manifests/tenant-a-kubevirt-csi-clusterrolebinding.yaml
@@ -0,0 +1,15 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app: kubevirt-csi-driver
+    name: tenant-a-kubevirt-csi
+  name: tenant-a-kubevirt-csi
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: tenant-a-kubevirt-csi
+subjects:
+  - kind: ServiceAccount
+    name: kubevirt-csi
+    namespace: tenant-a
--- a/compiled/csi-infra/manifests/tenant-a/kubevirt-csi-controller-deployment.yaml
+++ b/compiled/csi-infra/manifests/tenant-a/kubevirt-csi-controller-deployment.yaml
@@ -0,0 +1,197 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: kubevirt-csi-driver
+    name: kubevirt-csi-controller
+  name: kubevirt-csi-controller
+  namespace: tenant-a
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: kubevirt-csi-driver
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: kubevirt-csi-driver
+    spec:
+      containers:
+        - args:
+            - --endpoint=unix:///var/lib/csi/sockets/pluginproxy/csi.sock
+            - --infra-cluster-namespace=tenant-a
+            - --infra-cluster-labels=csi-driver/cluster=tenant-a
+            - --tenant-cluster-kubeconfig=/var/run/secrets/tenantcluster/value
+            - --run-node-service=false
+            - --run-controller-service=true
+            - --enable-vmi-hotplug-fallback=false
+            - --v=5
+          env:
+            - name: INFRA_STORAGE_CLASS_ENFORCEMENT
+              value: |
+                allowAll: false
+                allowDefault: false
+                allowList:
+                - rook-ceph-block
+                storageSnapshotMapping:
+                - storageClasses:
+                  - rook-ceph-block
+                  volumeSnapshotClasses:
+                  - csi-rbdplugin-snapclass
+          image: quay.io/kubevirt/kubevirt-csi-driver@sha256:44c98353e6137455d6a393ad13e04f60e10ee49fdcd00cf078f7f7084714f409
+          livenessProbe:
+            failureThreshold: 5
+            httpGet:
+              path: /healthz
+              port: healthz
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 3
+          name: csi-driver
+          ports:
+            - containerPort: 10301
+              name: healthz
+              protocol: TCP
+          resources:
+            requests:
+              cpu: 10m
+              memory: 50Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+          volumeMounts:
+            - mountPath: /var/lib/csi/sockets/pluginproxy/
+              name: socket-dir
+            - mountPath: /var/run/secrets/tenantcluster
+              name: tenantcluster
+              readOnly: true
+        - args:
+            - --csi-address=/var/lib/csi/sockets/pluginproxy/csi.sock
+            - --default-fstype=ext4
+            - --kubeconfig=/var/run/secrets/tenantcluster/value
+            - --v=5
+            - --timeout=3m
+            - --retry-interval-max=1m
+          image: registry.k8s.io/sig-storage/csi-provisioner:v6.0.2@sha256:80f0225e1b2beeade5734fef6b10ab459e02ac3816570660651b45bd50f178bf
+          name: csi-provisioner
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+          volumeMounts:
+            - mountPath: /var/lib/csi/sockets/pluginproxy/
+              name: socket-dir
+            - mountPath: /var/run/secrets/tenantcluster
+              name: tenantcluster
+              readOnly: true
+        - args:
+            - --csi-address=/var/lib/csi/sockets/pluginproxy/csi.sock
+            - --kubeconfig=/var/run/secrets/tenantcluster/value
+            - --v=5
+            - --timeout=3m
+            - --retry-interval-max=1m
+          image: registry.k8s.io/sig-storage/csi-attacher:v4.10.0@sha256:be59d0556508d3dd419cc34c53062f170a28902ef36e832b947c7796458a083d
+          name: csi-attacher
+          resources:
+            requests:
+              cpu: 10m
+              memory: 50Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+          volumeMounts:
+            - mountPath: /var/lib/csi/sockets/pluginproxy/
+              name: socket-dir
+            - mountPath: /var/run/secrets/tenantcluster
+              name: tenantcluster
+              readOnly: true
+        - args:
+            - --csi-address=/csi/csi.sock
+            - --probe-timeout=3s
+            - --health-port=10301
+          image: registry.k8s.io/sig-storage/livenessprobe:v2.17.0@sha256:9b75b9ade162136291d5e8f13a1dfc3dec71ee61419b1bfc112e0796ff8a6aa9
+          name: csi-liveness-probe
+          resources:
+            requests:
+              cpu: 10m
+              memory: 50Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+          volumeMounts:
+            - mountPath: /csi
+              name: socket-dir
+        - args:
+            - --v=5
+            - --csi-address=/csi/csi.sock
+            - --kubeconfig=/var/run/secrets/tenantcluster/value
+            - --timeout=3m
+          image: registry.k8s.io/sig-storage/csi-snapshotter:v8.7.0@sha256:b03d3334f8035fa42660b166f6eb819a659a14774da020eb1b6c52cd422eaadb
+          name: csi-snapshotter
+          resources:
+            requests:
+              cpu: 10m
+              memory: 20Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+          volumeMounts:
+            - mountPath: /csi
+              name: socket-dir
+            - mountPath: /var/run/secrets/tenantcluster
+              name: tenantcluster
+              readOnly: true
+        - args:
+            - -csi-address=/csi/csi.sock
+            - -kubeconfig=/var/run/secrets/tenantcluster/value
+            - -v=5
+            - -timeout=3m
+            - -handle-volume-inuse-error=false
+          image: registry.k8s.io/sig-storage/csi-resizer:v1.13.1@sha256:2a0b297cc7c4cd376ac7413df339ff2fdaa1ec9d099aed92b5ea1f031ef7f639
+          name: csi-resizer
+          resources:
+            requests:
+              cpu: 10m
+              memory: 20Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+          volumeMounts:
+            - mountPath: /csi
+              name: socket-dir
+            - mountPath: /var/run/secrets/tenantcluster
+              name: tenantcluster
+              readOnly: true
+      enableServiceLinks: false
+      securityContext:
+        runAsGroup: 1001
+        runAsNonRoot: true
+        runAsUser: 1001
+        seccompProfile:
+          type: RuntimeDefault
+      serviceAccountName: kubevirt-csi
+      volumes:
+        - emptyDir: {}
+          name: socket-dir
+        - name: tenantcluster
+          secret:
+            secretName: tenant-a-kubeconfig
--- a/compiled/csi-infra/manifests/tenant-a/kubevirt-csi-role.yaml
+++ b/compiled/csi-infra/manifests/tenant-a/kubevirt-csi-role.yaml
@@ -0,0 +1,54 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  labels:
+    app: kubevirt-csi-driver
+    name: kubevirt-csi
+  name: kubevirt-csi
+  namespace: tenant-a
+rules:
+  - apiGroups:
+      - cdi.kubevirt.io
+    resources:
+      - datavolumes
+    verbs:
+      - get
+      - create
+      - delete
+  - apiGroups:
+      - cdi.kubevirt.io
+    resources:
+      - datavolumes/source
+    verbs:
+      - create
+  - apiGroups:
+      - kubevirt.io
+    resources:
+      - virtualmachineinstances
+      - virtualmachines
+    verbs:
+      - list
+      - get
+  - apiGroups:
+      - subresources.kubevirt.io
+    resources:
+      - virtualmachines/addvolume
+      - virtualmachines/removevolume
+      - virtualmachineinstances/removevolume
+    verbs:
+      - update
+  - apiGroups:
+      - snapshot.storage.k8s.io
+    resources:
+      - volumesnapshots
+    verbs:
+      - get
+      - create
+      - delete
+  - apiGroups:
+      - ''
+    resources:
+      - persistentvolumeclaims
+    verbs:
+      - get
+      - patch
--- a/compiled/csi-infra/manifests/tenant-a/kubevirt-csi-rolebinding.yaml
+++ b/compiled/csi-infra/manifests/tenant-a/kubevirt-csi-rolebinding.yaml
@@ -0,0 +1,16 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels:
+    app: kubevirt-csi-driver
+    name: kubevirt-csi
+  name: kubevirt-csi
+  namespace: tenant-a
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: kubevirt-csi
+subjects:
+  - kind: ServiceAccount
+    name: kubevirt-csi
+    namespace: tenant-a
--- a/compiled/csi-infra/manifests/tenant-a/kubevirt-csi-sa.yaml
+++ b/compiled/csi-infra/manifests/tenant-a/kubevirt-csi-sa.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app: kubevirt-csi-driver
+    name: kubevirt-csi
+  name: kubevirt-csi
+  namespace: tenant-a
--- a/compiled/csi-tenant/manifests/csi.kubevirt.io-csidriver.yaml
+++ b/compiled/csi-tenant/manifests/csi.kubevirt.io-csidriver.yaml
@@ -0,0 +1,11 @@
+apiVersion: storage.k8s.io/v1
+kind: CSIDriver
+metadata:
+  labels:
+    app: kubevirt-csi-driver
+    name: csi.kubevirt.io
+  name: csi.kubevirt.io
+spec:
+  attachRequired: true
+  fsGroupPolicy: ReadWriteOnceWithFSType
+  podInfoOnMount: true
--- a/compiled/csi-tenant/manifests/kubevirt-csi-controller-clusterrole.yaml
+++ b/compiled/csi-tenant/manifests/kubevirt-csi-controller-clusterrole.yaml
@@ -0,0 +1,117 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app: kubevirt-csi-driver
+    name: kubevirt-csi-controller
+  name: kubevirt-csi-controller
+rules:
+  - apiGroups:
+      - ''
+    resources:
+      - persistentvolumes
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - watch
+      - patch
+  - apiGroups:
+      - ''
+    resources:
+      - persistentvolumeclaims
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - ''
+    resources:
+      - persistentvolumeclaims/status
+    verbs:
+      - patch
+  - apiGroups:
+      - ''
+    resources:
+      - nodes
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - storage.k8s.io
+    resources:
+      - volumeattachments
+    verbs:
+      - get
+      - list
+      - watch
+      - patch
+  - apiGroups:
+      - storage.k8s.io
+    resources:
+      - storageclasses
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - ''
+    resources:
+      - events
+    verbs:
+      - list
+      - watch
+      - create
+      - update
+      - patch
+  - apiGroups:
+      - snapshot.storage.k8s.io
+    resources:
+      - volumesnapshotclasses
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - snapshot.storage.k8s.io
+    resources:
+      - volumesnapshotcontents
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+      - patch
+  - apiGroups:
+      - snapshot.storage.k8s.io
+    resources:
+      - volumesnapshotcontents/status
+    verbs:
+      - update
+      - patch
+  - apiGroups:
+      - snapshot.storage.k8s.io
+    resources:
+      - volumesnapshots
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - storage.k8s.io
+    resources:
+      - volumeattachments/status
+    verbs:
+      - patch
+  - apiGroups:
+      - storage.k8s.io
+    resources:
+      - csinodes
+    verbs:
+      - get
+      - list
+      - watch
--- a/compiled/csi-tenant/manifests/kubevirt-csi-controller-clusterrolebinding.yaml
+++ b/compiled/csi-tenant/manifests/kubevirt-csi-controller-clusterrolebinding.yaml
@@ -0,0 +1,15 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app: kubevirt-csi-driver
+    name: kubevirt-csi-controller
+  name: kubevirt-csi-controller
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: kubevirt-csi-controller
+subjects:
+  - kind: ServiceAccount
+    name: kubevirt-csi-controller-sa
+    namespace: kubevirt-csi-driver
--- a/compiled/csi-tenant/manifests/kubevirt-csi-driver-namespace.yaml
+++ b/compiled/csi-tenant/manifests/kubevirt-csi-driver-namespace.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    app: kubevirt-csi-driver
+    name: kubevirt-csi-driver
+    pod-security.kubernetes.io/enforce: privileged
+  name: kubevirt-csi-driver
--- a/compiled/csi-tenant/manifests/kubevirt-csi-driver/kubevirt-csi-controller-sa-token-secret.yaml
+++ b/compiled/csi-tenant/manifests/kubevirt-csi-driver/kubevirt-csi-controller-sa-token-secret.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  annotations:
+    kubernetes.io/service-account.name: kubevirt-csi-controller-sa
+  labels:
+    app: kubevirt-csi-driver
+    name: kubevirt-csi-controller-sa-token
+  name: kubevirt-csi-controller-sa-token
+  namespace: kubevirt-csi-driver
+type: kubernetes.io/service-account-token
--- a/compiled/csi-tenant/manifests/kubevirt-csi-driver/kubevirt-csi-controller-sa.yaml
+++ b/compiled/csi-tenant/manifests/kubevirt-csi-driver/kubevirt-csi-controller-sa.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app: kubevirt-csi-driver
+    name: kubevirt-csi-controller-sa
+  name: kubevirt-csi-controller-sa
+  namespace: kubevirt-csi-driver
--- a/compiled/csi-tenant/manifests/kubevirt-csi-driver/kubevirt-csi-node-sa.yaml
+++ b/compiled/csi-tenant/manifests/kubevirt-csi-driver/kubevirt-csi-node-sa.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app: kubevirt-csi-driver
+    name: kubevirt-csi-node-sa
+  name: kubevirt-csi-node-sa
+  namespace: kubevirt-csi-driver
--- a/compiled/csi-tenant/manifests/kubevirt-csi-node-clusterrole.yaml
+++ b/compiled/csi-tenant/manifests/kubevirt-csi-node-clusterrole.yaml
@@ -0,0 +1,22 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app: kubevirt-csi-driver
+    name: kubevirt-csi-node
+  name: kubevirt-csi-node
+rules:
+  - apiGroups:
+      - ''
+    resources:
+      - nodes
+    verbs:
+      - get
+  - apiGroups:
+      - security.openshift.io
+    resourceNames:
+      - privileged
+    resources:
+      - securitycontextconstraints
+    verbs:
+      - use
--- a/compiled/csi-tenant/manifests/kubevirt-csi-node-clusterrolebinding.yaml
+++ b/compiled/csi-tenant/manifests/kubevirt-csi-node-clusterrolebinding.yaml
@@ -0,0 +1,15 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app: kubevirt-csi-driver
+    name: kubevirt-csi-node
+  name: kubevirt-csi-node
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: kubevirt-csi-node
+subjects:
+  - kind: ServiceAccount
+    name: kubevirt-csi-node-sa
+    namespace: kubevirt-csi-driver
--- a/compiled/csi-tenant/manifests/kubevirt-storageclass.yaml
+++ b/compiled/csi-tenant/manifests/kubevirt-storageclass.yaml
@@ -0,0 +1,13 @@
+allowVolumeExpansion: true
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  annotations:
+    storageclass.kubernetes.io/is-default-class: 'true'
+  labels:
+    app: kubevirt-csi-driver
+    name: kubevirt
+  name: kubevirt
+parameters:
+  infraStorageClassName: rook-ceph-block
+provisioner: csi.kubevirt.io
--- a/compiled/csi-tenant/manifests/kubevirt-volumesnapshotclass.yaml
+++ b/compiled/csi-tenant/manifests/kubevirt-volumesnapshotclass.yaml
@@ -0,0 +1,13 @@
+apiVersion: snapshot.storage.k8s.io/v1
+deletionPolicy: Delete
+driver: csi.kubevirt.io
+kind: VolumeSnapshotClass
+metadata:
+  annotations:
+    snapshot.storage.kubernetes.io/is-default-class: 'true'
+  labels:
+    app: kubevirt-csi-driver
+    name: kubevirt
+  name: kubevirt
+parameters:
+  infraSnapshotClassName: csi-rbdplugin-snapclass