diff --git a/deployment/flexvolume/flexvolume-ds.yaml b/deployment/flexvolume/flexvolume-ds.yaml
new file mode 100644
index 0000000..de14f4d
--- /dev/null
+++ b/deployment/flexvolume/flexvolume-ds.yaml
@@ -0,0 +1,99 @@
+# Copyright (c) 2017 OpenStack Foundation.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+kind: DaemonSet
+apiVersion: extensions/v1beta1
+metadata:
+  name: cinder-flexvolume
+  namespace: kube-system
+  labels:
+    component: cinder-flexvolume
+    k8s-app: cinder-flexvolume
+    name: cinder-flexvolume
+spec:
+  selector:
+    matchLabels:
+      component: cinder-flexvolume
+      k8s-app: cinder-flexvolume
+      name: cinder-flexvolume
+  template:
+    metadata:
+      labels:
+        component: cinder-flexvolume
+        k8s-app: cinder-flexvolume
+        name: cinder-flexvolume
+      annotations:
+        runtime.frakti.alpha.kubernetes.io/OSContainer: "true"
+        scheduler.alpha.kubernetes.io/critical-pod: ''
+        scheduler.alpha.kubernetes.io/tolerations: |
+          [{"key": "dedicated", "value": "master", "effect": "NoSchedule" },
+           {"key":"CriticalAddonsOnly", "operator":"Exists"}]
+    spec:
+      securityContext: {}
+      containers:
+        - name: cinder-flexvolume
+          resources: {}
+          image: stackube/flex-volume:v1.0
+          command: ["/bin/bash", "install.sh"]
+          env:
+            # The endpoint of openstack authentication.
+            - name: AUTH_URL
+              valueFrom:
+                configMapKeyRef:
+                  name: stackube-config
+                  key: auth-url
+            # The username for openstack authentication.
+            - name: USERNAME
+              valueFrom:
+                configMapKeyRef:
+                  name: stackube-config
+                  key: username
+            # The password for openstack authentication.
+            - name: PASSWORD
+              valueFrom:
+                configMapKeyRef:
+                  name: stackube-config
+                  key: password
+            # The tenant name for openstack authentication.
+            - name: TENANT_NAME
+              valueFrom:
+                configMapKeyRef:
+                  name: stackube-config
+                  key: tenant-name
+            # The region for openstack authentication.
+            - name: REGION
+              valueFrom:
+                configMapKeyRef:
+                  name: stackube-config
+                  key: region
+            # The keyring for cinder client.
+            - name: KEYRING
+              valueFrom:
+                configMapKeyRef:
+                  name: stackube-config
+                  key: keyring
+          volumeMounts:
+            - mountPath: /mnt/binary
+              name: binarydir
+            - mountPath: /mnt/config
+              name: cinderconfig
+      volumes:
+        # Used for flexvolume binary.
+        - name: binarydir
+          hostPath:
+            path: /usr/libexec/kubernetes/kubelet-plugins/volume/exec/cinder~flexvolume_driver/
+        # Used to cinder client.
+        - name: cinderconfig
+          hostPath:
+            path: /etc/kubernetes
\ No newline at end of file
diff --git a/devstack/plugin.sh b/devstack/plugin.sh
index bb693d1..c2ec32e 100644
--- a/devstack/plugin.sh
+++ b/devstack/plugin.sh
@@ -14,6 +14,8 @@
 # limitations under the License.
 
 STACKUBE_ROOT=$(dirname "${BASH_SOURCE}")
+# TODO(harry) clone frakti? or maintain yaml?
+FRAKTI_ROOT=${}
 
 function install_docker {
     if is_ubuntu; then
@@ -130,6 +132,9 @@ function install_stackube_addons {
 
     source openrc admin admin
     public_network=$(openstack network list --long -f value | grep External | awk '{print $1}')
+
+    keyring=`cat /etc/ceph/ceph.client.cinder.keyring  | grep 'key = ' | awk -F\ \=\  '{print $2}'`
+
     cat >stackube-configmap.yaml <<EOF
 kind: ConfigMap
 apiVersion: v1
@@ -149,12 +154,17 @@ data:
   user-gateway: "${CLUSTER_GATEWAY}"
   kubernetes-host: "${SERVICE_HOST}"
   kubernetes-port: "6443"
+  keyring: "${keyring}" 
 EOF
     kubectl create -f stackube-configmap.yaml
     kubectl create -f ${STACKUBE_ROOT}/../deployment/stackube.yaml
     kubectl create -f ${STACKUBE_ROOT}/../deployment/stackube-proxy.yaml
 }
 
+function install_flexvolume_plugin {
+    kubectl create -f ${STACKUBE_ROOT}/../deployment/flexvolume/flexvolume-ds.yaml
+}
+
 function install_node {
     if [ "${KUBEADM_TOKEN}" = "" ]; then
         echo "KUBEADM_TOKEN must be set for node"
@@ -215,6 +225,7 @@ function init_stackube {
     if is_service_enabled kubernetes_master; then
         install_master
         install_stackube_addons
+        install_flexvolume_plugin
     elif is_service_enabled kubernetes_node; then
         install_node
     fi