# AIStor Memory (aimem) RELEASE.2026-09-30T18-30-42Z Released: 2026-09-30 AIStor Memory (aimem) now works with an AIStor whose certificate comes from a private CA, including on Kubernetes, where a mount can reach AIStor by ClusterIP and still verify the certificate's DNS name. The `aimem bucket`, `search`, `history`, `secret` and `bio` commands can also sign with a rotated `AIMEM_CREDENTIALS_FILE`, so they work inside a sandbox that has no static keys. --- ## Downloads ### Binaries | Platform | Architecture | Download | | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------- | | Linux | amd64 | [aimem.RELEASE.2026-09-30T18-30-42Z](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem.RELEASE.2026-09-30T18-30-42Z) | | Linux | arm64 | [aimem.RELEASE.2026-09-30T18-30-42Z](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem.RELEASE.2026-09-30T18-30-42Z) | The setuid `aimem-fusermount` mount helper, the `aimem-bio` binary that `aimem bio` runs, and the Kubernetes CSI node driver are published beside it: | Binary | Architecture | Download | | ------------------ | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------- | | `aimem-fusermount` | amd64 | [aimem-fusermount.RELEASE.2026-09-30T18-30-42Z](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem-fusermount.RELEASE.2026-09-30T18-30-42Z) | | `aimem-fusermount` | arm64 | [aimem-fusermount.RELEASE.2026-09-30T18-30-42Z](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem-fusermount.RELEASE.2026-09-30T18-30-42Z) | | `aimem-bio` | amd64 | [aimem-bio.RELEASE.2026-09-30T18-30-42Z](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem-bio.RELEASE.2026-09-30T18-30-42Z) | | `aimem-bio` | arm64 | [aimem-bio.RELEASE.2026-09-30T18-30-42Z](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem-bio.RELEASE.2026-09-30T18-30-42Z) | | `aimem-csi-driver` | amd64 | [aimem-csi-driver.RELEASE.2026-09-30T18-30-42Z](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem-csi-driver.RELEASE.2026-09-30T18-30-42Z) | | `aimem-csi-driver` | arm64 | [aimem-csi-driver.RELEASE.2026-09-30T18-30-42Z](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem-csi-driver.RELEASE.2026-09-30T18-30-42Z) | Each binary has `.sha256sum`, `.minisig`, and `.asc` files at the same path. These links point into `archive/`, where a release's files stay after a newer release ships, so they always serve this build. The unversioned `…/linux-{arch}/aimem` path serves whatever release is newest. ### Packages `.deb`, `.rpm`, and `.apk` install the `aimem` client, the setuid `aimem-fusermount` mount helper (`/usr/bin/aimem-fusermount`, mode 4755), and `aimem-bio`. They also install a disabled example `mnt-aimem.mount` systemd unit and the `/sbin/mount.aimem` helper it needs. | Format | Architecture | Download | | ------ | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------- | | DEB | amd64 | [aimem_20260930183042.0.0_amd64.deb](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem_20260930183042.0.0_amd64.deb) | | DEB | arm64 | [aimem_20260930183042.0.0_arm64.deb](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem_20260930183042.0.0_arm64.deb) | | RPM | amd64 | [aimem-20260930183042.0.0-1.x86_64.rpm](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem-20260930183042.0.0-1.x86_64.rpm) | | RPM | arm64 | [aimem-20260930183042.0.0-1.aarch64.rpm](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem-20260930183042.0.0-1.aarch64.rpm) | | APK | amd64 | [aimem_20260930183042.0.0_x86_64.apk](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem_20260930183042.0.0_x86_64.apk) | | APK | arm64 | [aimem_20260930183042.0.0_aarch64.apk](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem_20260930183042.0.0_aarch64.apk) | The packages depend only on libc (`libc-bin` / `glibc-common`); no `libfuse` is needed. ### Container Images ```bash # The aimem client, pinned to this release: docker pull quay.io/minio/aistor/aimem:RELEASE.2026-09-30T18-30-42Z # The Kubernetes CSI node driver, pinned to this release: docker pull quay.io/minio/aistor/aimem-csi-driver:RELEASE.2026-09-30T18-30-42Z ``` The `latest` tag of each image also points at this release, but moves when the next one ships. To verify a build, pin the release tag or a `@sha256:` digest, never `latest`. Mounting from a container needs `/dev/fuse` and `CAP_SYS_ADMIN` (or `--privileged`). ### Verification Each binary is signed with minisign (preferred) and GPG, and has a sha256sum file. ```bash BASE=https://dl.min.io/aistor/aimem/release/linux-amd64/archive curl -fsSLO $BASE/aimem.RELEASE.2026-09-30T18-30-42Z curl -fsSLO $BASE/aimem.RELEASE.2026-09-30T18-30-42Z.minisig curl -fsSLO $BASE/aimem.RELEASE.2026-09-30T18-30-42Z.sha256sum # minisign minisign -Vm aimem.RELEASE.2026-09-30T18-30-42Z \ -P RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav # sha256: the checksum file names the versioned binary, so keep that file name sha256sum -c aimem.RELEASE.2026-09-30T18-30-42Z.sha256sum ``` The minisign public key above is the MinIO release-signing key, used across the AIStor product line. --- ## Changes since RELEASE.2026-09-28T01-24-19Z ### New Features - **Reach AIStor by IP and verify its DNS name.** New `--tls-server-name` (`AIMEM_TLS_SERVER_NAME`, config key `tls_server_name`, CSI volume attribute `tlsServerName`) gives the name to verify and send as SNI, while aimem connects to the host in `--endpoint-url`. Use it when a node reaches AIStor by ClusterIP. (#230) - **Give a Kubernetes mount a private CA inline.** New CSI volume attribute `caCert` takes the CA's PEM text, so it needs no file on the node and works in inline volumes. It cannot be combined with `tlsCaFile`. (#229) - **The management commands accept a private CA.** `aimem bucket`, `search`, `history`, `secret provision` and `bio` now take `--tls-ca-file` / `AIMEM_TLS_CA_FILE`, and `--tls-server-name`. The CA is trusted in addition to the system roots. (#229, #230) - **Token exchange over https with a private CA.** New CSI driver option `--token-exchange-ca-file` (`AIMEM_CSI_TOKEN_EXCHANGE_CA_FILE`) names the CAs to trust for `--token-exchange-url`, in place of the public roots. The driver will not start if the file cannot be read or holds no certificate. (#230) - **Management commands sign with `AIMEM_CREDENTIALS_FILE`.** When no `AIMEM_ACCESS_KEY` / `AIMEM_SECRET_KEY` is set, `aimem bucket`, `search`, `history`, `secret` and `bio` read the credentials file, including its session token, afresh each time. A long-running `aimem bio serve` collector keeps exporting across rotations. (#228) - **`aimem secret provision` withholds `AIMEM_CREDENTIALS_FILE` from the agent** it launches, as it already did for the other store credentials. (#228) The [Kubernetes guide](https://docs.min.io/aimem/integrations/kubernetes/#volume-attributes) lists the new volume attributes, and the [configuration reference](https://docs.min.io/aimem/configuration/#recognised-keys) lists `tls_server_name`. ### Bug Fixes #### TLS - A mount against an AIStor with a private CA failed at startup even with `--tls-ca-file` given: the Memory Bucket check and the endpoint health checks did not use the CA. They now use the same CA and `insecure_skip_tls_verify` setting as the mount. (#229) - A mount started with `--bio-agent` did not pass `--tls-ca-file` to its `aimem-bio` sidecar, so the sidecar could not reach a private-CA AIStor. It now passes both `--tls-ca-file` and `--tls-server-name`. (#230) ### Known Limitations - `aimem bio` table-data uploads ignore `--tls-server-name`: they connect to and verify the `--endpoint-url` host. For them, a private CA is used only through `SSL_CERT_FILE`, which aimem points at `--tls-ca-file` when it is unset; there the CA replaces the system roots. CSI mounts are not affected, because they start no `aimem-bio` sidecar. (#229, #230) - With `--tls-server-name`, a DNS host in `--endpoint-url` is resolved once, when aimem starts. If that address changes, restart the mount. (#230) ### Platform / Compatibility - Linux amd64 and arm64, glibc 2.34 or later. - Mounting needs `/dev/fuse`. FUSE passthrough also needs `CAP_SYS_ADMIN`; without it, a mount serves ordinary FUSE reads. --- ## Security & Compliance Software bills of materials (SBOMs) for this release, generated from the `Cargo.lock` files at the release tag: | Component | SPDX | CycloneDX | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | | `aimem` | [aimem-RELEASE.2026-09-30T18-30-42Z.spdx.json](https://dl.min.io/aistor/aimem/release/notes/aimem-RELEASE.2026-09-30T18-30-42Z.spdx.json) | [aimem-RELEASE.2026-09-30T18-30-42Z.cdx.json](https://dl.min.io/aistor/aimem/release/notes/aimem-RELEASE.2026-09-30T18-30-42Z.cdx.json) | | `aimem-bio` | [aimem-bio-RELEASE.2026-09-30T18-30-42Z.spdx.json](https://dl.min.io/aistor/aimem/release/notes/aimem-bio-RELEASE.2026-09-30T18-30-42Z.spdx.json) | [aimem-bio-RELEASE.2026-09-30T18-30-42Z.cdx.json](https://dl.min.io/aistor/aimem/release/notes/aimem-bio-RELEASE.2026-09-30T18-30-42Z.cdx.json) | | `aimem-csi-driver` | [aimem-csi-RELEASE.2026-09-30T18-30-42Z.spdx.json](https://dl.min.io/aistor/aimem/release/notes/aimem-csi-RELEASE.2026-09-30T18-30-42Z.spdx.json) | [aimem-csi-RELEASE.2026-09-30T18-30-42Z.cdx.json](https://dl.min.io/aistor/aimem/release/notes/aimem-csi-RELEASE.2026-09-30T18-30-42Z.cdx.json) | The `aimem` dependency list is also published as plain text: [crate list](https://dl.min.io/aistor/aimem/release/notes/aimem-RELEASE.2026-09-30T18-30-42Z.crates.txt) and [dependency tree](https://dl.min.io/aistor/aimem/release/notes/aimem-RELEASE.2026-09-30T18-30-42Z.cargo-tree.txt). --- ## Upgrade Instructions - **Credentials precedence differs between the mount and the management commands.** When both are set, `aimem bucket`, `search`, `history`, `secret` and `bio` use `AIMEM_ACCESS_KEY` / `AIMEM_SECRET_KEY` over `AIMEM_CREDENTIALS_FILE`; the mount uses the file. Those commands fail if the file they fall back to is expired or unreadable. Set only one source to avoid surprises. - **Upgrading from a release before RELEASE.2026-09-28T01-24-19Z?** Read the [RELEASE.2026-09-28T01-24-19Z notes](https://dl.min.io/aistor/aimem/release/notes/release-notes-RELEASE.2026-09-28T01-24-19Z.md) too. They cover credential rotation and token exchange for the CSI driver, which this release builds on. - **Kubernetes:** pin the driver image to `quay.io/minio/aistor/aimem-csi-driver:RELEASE.2026-09-30T18-30-42Z`. `tlsServerName` and `caCert` apply only to the mount's AIStor connection; the token exchange's trust is set for the whole driver with `--token-exchange-ca-file`. ## Documentation - Hosted docs: ## Support - Security disclosures: security@min.io - Licensed customers and contributors: contact MinIO support.