# AIStor Memory (aimem) RELEASE.2026-09-28T01-24-19Z Released: 2026-09-28 Kubernetes mounts now keep working on short-lived credentials: the CSI node driver refreshes a live mount's credentials from a rotated Secret, or from a service-account token exchange that needs no Secret at all. The driver hands the mount its credentials in a root-only file, so they never appear in the node's systemd unit. --- ## Downloads ### Binaries | Platform | Architecture | Download | | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------ | | Linux | amd64 | [aimem.RELEASE.2026-09-28T01-24-19Z](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem.RELEASE.2026-09-28T01-24-19Z) | | Linux | arm64 | [aimem.RELEASE.2026-09-28T01-24-19Z](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem.RELEASE.2026-09-28T01-24-19Z) | The setuid `aimem-fusermount` mount helper, the `aimem-bio` binary that `aimem bio` runs, and the Kubernetes CSI node driver are published beside it: | Binary | Architecture | Download | | ------------------ | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | | `aimem-fusermount` | amd64 | [aimem-fusermount.RELEASE.2026-09-28T01-24-19Z](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem-fusermount.RELEASE.2026-09-28T01-24-19Z) | | `aimem-fusermount` | arm64 | [aimem-fusermount.RELEASE.2026-09-28T01-24-19Z](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem-fusermount.RELEASE.2026-09-28T01-24-19Z) | | `aimem-bio` | amd64 | [aimem-bio.RELEASE.2026-09-28T01-24-19Z](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem-bio.RELEASE.2026-09-28T01-24-19Z) | | `aimem-bio` | arm64 | [aimem-bio.RELEASE.2026-09-28T01-24-19Z](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem-bio.RELEASE.2026-09-28T01-24-19Z) | | `aimem-csi-driver` | amd64 | [aimem-csi-driver.RELEASE.2026-09-28T01-24-19Z](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem-csi-driver.RELEASE.2026-09-28T01-24-19Z) | | `aimem-csi-driver` | arm64 | [aimem-csi-driver.RELEASE.2026-09-28T01-24-19Z](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem-csi-driver.RELEASE.2026-09-28T01-24-19Z) | Each binary has `.sha256sum`, `.minisig`, and `.asc` files at the same path. These links point into `archive/`, where a release's files stay after a newer release ships, so they always serve this build. The unversioned `…/linux-{arch}/aimem` path serves whatever release is newest. ### Packages `.deb`, `.rpm`, and `.apk` install the `aimem` client, the setuid `aimem-fusermount` mount helper (`/usr/bin/aimem-fusermount`, mode 4755), and `aimem-bio`. They also install a disabled example `mnt-aimem.mount` systemd unit and the `/sbin/mount.aimem` helper it needs. | Format | Architecture | Download | | ------ | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------- | | DEB | amd64 | [aimem\_20260928012419.0.0_amd64.deb](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem_20260928012419.0.0_amd64.deb) | | DEB | arm64 | [aimem\_20260928012419.0.0_arm64.deb](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem_20260928012419.0.0_arm64.deb) | | RPM | amd64 | [aimem-20260928012419.0.0-1.x86_64.rpm](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem-20260928012419.0.0-1.x86_64.rpm) | | RPM | arm64 | [aimem-20260928012419.0.0-1.aarch64.rpm](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem-20260928012419.0.0-1.aarch64.rpm) | | APK | amd64 | [aimem\_20260928012419.0.0_x86_64.apk](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem_20260928012419.0.0_x86_64.apk) | | APK | arm64 | [aimem\_20260928012419.0.0_aarch64.apk](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem_20260928012419.0.0_aarch64.apk) | The packages depend only on libc (`libc-bin` / `glibc-common`); no `libfuse` is needed. ### Container Images ```bash # The aimem client, pinned to this release: docker pull quay.io/minio/aistor/aimem:RELEASE.2026-09-28T01-24-19Z # The Kubernetes CSI node driver, pinned to this release: docker pull quay.io/minio/aistor/aimem-csi-driver:RELEASE.2026-09-28T01-24-19Z ``` The `latest` tag of each image also points at this release, but moves when the next one ships. To verify a build, pin the release tag or a `@sha256:` digest, never `latest`. Mounting from a container needs `/dev/fuse` and `CAP_SYS_ADMIN` (or `--privileged`). ### Verification Each binary is signed with minisign (preferred) and GPG, and has a sha256sum file. ```bash BASE=https://dl.min.io/aistor/aimem/release/linux-amd64/archive curl -fsSLO $BASE/aimem.RELEASE.2026-09-28T01-24-19Z curl -fsSLO $BASE/aimem.RELEASE.2026-09-28T01-24-19Z.minisig curl -fsSLO $BASE/aimem.RELEASE.2026-09-28T01-24-19Z.sha256sum # minisign minisign -Vm aimem.RELEASE.2026-09-28T01-24-19Z \ -P RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav # sha256: the checksum file names the versioned binary, so keep that file name sha256sum -c aimem.RELEASE.2026-09-28T01-24-19Z.sha256sum ``` The minisign public key above is the MinIO release-signing key, used across the AIStor product line. --- ## Changes since RELEASE.2026-09-24T13-48-28Z ### New Features - **Kubernetes mounts pick up rotated credentials without a remount.** Update the `nodePublishSecretRef` Secret and a running mount switches to the new keys. (#225) - **Mount with no Secret, using the pod's service account.** Driver options `--token-exchange-url` and `--token-audience` trade the pod's token for a session and renew it before it expires. (#225) - **Credentials stay out of the node's process table.** The CSI driver passes each mount its credentials in a root-only file, not environment variables, so `systemctl show` does not reveal them. (#225) - **`AIMEM_CREDENTIALS_FILE` lets any mount run on renewed short-lived credentials.** aimem reloads the named JSON file (`access_key_id`, `secret_access_key`, optional `session_token`) when it is replaced, and takes it over `AIMEM_ACCESS_KEY` / `AIMEM_SECRET_KEY`. (#225) The [Kubernetes guide](https://docs.min.io/aimem/integrations/kubernetes/#credentials) covers the `CSIDriver` settings and the token-exchange contract. ### Platform / Compatibility - Linux amd64 and arm64, glibc 2.34 or later. - Mounting needs `/dev/fuse`. FUSE passthrough also needs `CAP_SYS_ADMIN`; without it, a mount serves ordinary FUSE reads. --- ## Security & Compliance Software bills of materials (SBOMs) for this release, generated from the `Cargo.lock` files at the release tag: | Component | SPDX | CycloneDX | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | | `aimem` | [aimem-RELEASE.2026-09-28T01-24-19Z.spdx.json](https://dl.min.io/aistor/aimem/release/notes/aimem-RELEASE.2026-09-28T01-24-19Z.spdx.json) | [aimem-RELEASE.2026-09-28T01-24-19Z.cdx.json](https://dl.min.io/aistor/aimem/release/notes/aimem-RELEASE.2026-09-28T01-24-19Z.cdx.json) | | `aimem-bio` | [aimem-bio-RELEASE.2026-09-28T01-24-19Z.spdx.json](https://dl.min.io/aistor/aimem/release/notes/aimem-bio-RELEASE.2026-09-28T01-24-19Z.spdx.json) | [aimem-bio-RELEASE.2026-09-28T01-24-19Z.cdx.json](https://dl.min.io/aistor/aimem/release/notes/aimem-bio-RELEASE.2026-09-28T01-24-19Z.cdx.json) | | `aimem-csi-driver` | [aimem-csi-RELEASE.2026-09-28T01-24-19Z.spdx.json](https://dl.min.io/aistor/aimem/release/notes/aimem-csi-RELEASE.2026-09-28T01-24-19Z.spdx.json) | [aimem-csi-RELEASE.2026-09-28T01-24-19Z.cdx.json](https://dl.min.io/aistor/aimem/release/notes/aimem-csi-RELEASE.2026-09-28T01-24-19Z.cdx.json) | The `aimem` dependency list is also published as plain text: [crate list](https://dl.min.io/aistor/aimem/release/notes/aimem-RELEASE.2026-09-28T01-24-19Z.crates.txt) and [dependency tree](https://dl.min.io/aistor/aimem/release/notes/aimem-RELEASE.2026-09-28T01-24-19Z.cargo-tree.txt). --- ## Upgrade Instructions - **Upgrading from a release before RELEASE.2026-09-24T13-48-28Z?** Read the [RELEASE.2026-09-24T13-48-28Z notes](https://dl.min.io/aistor/aimem/release/notes/release-notes-RELEASE.2026-09-24T13-48-28Z.md) too. They cover the removal of `aimem bio provision` and the collector's new spool, which this release also contains. - **Kubernetes:** pin the driver image to `quay.io/minio/aistor/aimem-csi-driver:RELEASE.2026-09-28T01-24-19Z`. ## Documentation - Hosted docs: ## Support - Security disclosures: security@min.io - Licensed customers and contributors: contact MinIO support.