# AIStor Operator RELEASE.2026-03-18T17-36-17Z Released: 2026-03-18 This release makes Kubernetes `TokenReview` the default way AIStor validates service account tokens, and lets object stores run without a configuration secret so credentials can come entirely from `.spec.env`. It also corrects Prometheus scraping, which had been collecting metrics from one random pod instead of every pool member. --- ## Component Versions | Component | Tag | Previous | | --- | --- | --- | | Operator | `RELEASE.2026-03-18T17-36-17Z` | `RELEASE.2026-02-09T03-12-43Z` | | Migration Tool | `RELEASE.2026-03-18T17-36-17Z` | `RELEASE.2026-01-23T16-29-10Z` | | MinIO Sidecar | `RELEASE.2026-03-18T17-20-10Z` | `RELEASE.2026-02-09T03-10-35Z` | | KES Sidecar | `RELEASE.2026-03-18T11-55-01Z` | `RELEASE.2026-02-09T03-08-34Z` | | MinKMS Sidecar | `RELEASE.2026-03-18T17-16-13Z` | `RELEASE.2026-02-08T21-05-50Z` | Images the operator deploys, at the last chart release in this cycle (`aistor-operator` 5.5.2): | Image | Tag | Previous | | --- | --- | --- | | `minio` | [`RELEASE.2026-03-26T21-24-40Z`](https://dl.min.io/aistor/minio/release/notes/release-notes-RELEASE.2026-03-26T21-24-40Z.md) | [`RELEASE.2026-02-07T07-43-34Z`](https://dl.min.io/aistor/minio/release/notes/release-notes-RELEASE.2026-02-07T07-43-34Z.md) | | `mc` | `RELEASE.2026-03-12T19-18-47Z` | [`RELEASE.2026-02-07T19-37-38Z`](https://dl.min.io/aistor/mc/release/notes/release-notes-RELEASE.2026-02-07T19-37-38Z.md) | | `kes` | [`RELEASE.2026-03-14T05-28-50Z`](https://dl.min.io/aistor/kes/release/notes/release-notes-RELEASE.2026-03-14T05-28-50Z.md) | `RELEASE.2025-12-30T19-30-40Z` | | `minkms` | `RELEASE.2025-11-12T19-14-51Z` | unchanged | | `aihub` | `RELEASE.2025-12-11T18-08-15Z` | unchanged | | `firewall` | `minwall:RELEASE.2024-11-01T19-53-30Z` | unchanged | | `prompt` | `RELEASE.2025-01-17T21-55-43Z` | unchanged | | `warp` | `v1.4.0` | unchanged | ### Helm Charts | Chart | Version | Previous | | --- | --- | --- | | `aistor-operator` | `5.5.0`, `5.5.1`, `5.5.2` | `5.4.0` | | `minkms-operator` | `1.4.0` | `1.3.0` | ### Container Images ```bash docker pull quay.io/minio/aistor/operator:RELEASE.2026-03-18T17-36-17Z docker pull quay.io/minio/aistor/operator-migration:RELEASE.2026-03-18T17-36-17Z docker pull quay.io/minio/aistor/minio-sidecar:RELEASE.2026-03-18T17-20-10Z docker pull quay.io/minio/aistor/kes-sidecar:RELEASE.2026-03-18T11-55-01Z docker pull quay.io/minio/aistor/minkms-sidecar:RELEASE.2026-03-18T17-16-13Z ``` A `.fips` tag of each image carries the FIPS 140-3 build. ```bash helm repo add minio https://helm.min.io helm upgrade --install aistor-operator minio/aistor-operator --version 5.5.2 ``` --- ## New Features - **Kubernetes token validation modes.** `TokenReview`, the new default, calls the Kubernetes API and works on every cluster, including those that block the OIDC endpoints. It requires the operator to bind `aistor-tokenreview` to AIStor service accounts (#1360). - **`OIDC` mode** validates tokens against the cluster OIDC discovery and JWKS documents instead, for clusters whose RBAC policy does not permit that binding (#1360). - **Object stores can run without a configuration secret.** `.spec.configuration` is now optional. Root credentials and MinIO settings can come entirely from `.spec.env`, as literals or through `configMapKeyRef`/`secretKeyRef` (#1349). - **MinKMS health and certificate status.** The resource reports custom certificate status, updates health independently of initialization, and retries every 5 seconds until green. `status.nodesAdded` is replaced by `status.nodes` (#1341). - **Migration tool: `--token` for clusters using an exec credential plugin.** A kubeconfig authenticating through `kubelogin` or `aws-iam-authenticator` cannot work inside the container, because the plugin binary is absent (#1362). - **Migration tool: `--host` to skip the kubeconfig entirely.** With `--token` it is enough to reach the cluster. The tool logs that it is not verifying the API server's TLS certificate (#1376). --- ## Bug Fixes ### Monitoring - **Prometheus now scrapes every MinIO pod.** The generated scrape configuration used a single ClusterIP address, so each scrape was load-balanced onto one random pod and the other nodes' metrics were never collected (#1363). ### Workload configuration - **A custom pod security context is no longer overridden.** With a pod security context set but no container one, the operator applied its own defaults, so MinIO ran as UID 1000 rather than the requested identity (#1368). ### Reconciliation - **PodDisruptionBudgets are no longer patched on every reconcile.** `spec.selector` carries `patchStrategy: replace`, so the merge patch always emitted a replace for that field and produced a write every loop (#1373). ### Upgrades - **Automatic recovery when MinIO cannot be reached during an in-place upgrade.** An `unauthenticated token found` rejection could stall the upgrade forever. The operator now warns and recreates the pool StatefulSets, at the cost of brief downtime (#1399). - **The upgrade server waits for its OpenShift certificate** instead of starting without a working TLS configuration, and exits to trigger a restart on any other certificate error (#1356). ### Sidecars - **All three sidecars wait for the Kubernetes API server instead of failing immediately.** Where a service mesh routes API traffic, its init container installs that route concurrently, so the sidecar could start first and fail. It now retries for 30 seconds (#1345). ### Migration tool - **Correct field name for volume size.** The tool emitted `volumeSize` where the object store chart expects `size`, so the size was silently dropped from every generated values file (#1382). - Fixed the indentation of the generated certificate configuration block (#1349). --- ## CRD Changes ### MinKMS (`minkms.min.io/v1alpha1`) | Field | Change | | --- | --- | | `status.nodesAdded` | **Renamed** to `status.nodes`, now reporting per-node detail instead of a name list | | `status.podsRunning`, `podsPending`, `podsCrashing` | **Replaced** by `status.podStatus.running`, `.pending`, `.crashing` | | `status.availableReplicas` | **Removed** | | `status.customCertificates` | Added. Server, client and trusted-CA entries with name, domains, serial and expiry | --- ## Helm Chart Changes | Chart | Version | Change | | --- | --- | --- | | `aistor-operator` | `5.5.0` | Adds `operators.object-store.tokenValidation`; installs the `aistor-tokenreview` cluster role | | `aistor-operator` | `5.5.1` | Default `minio` → `RELEASE.2026-03-20T23-11-32Z` (#1413) | | `aistor-operator` | `5.5.2` | Default `minio` → `RELEASE.2026-03-26T21-24-40Z`, `mc` → `RELEASE.2026-03-12T19-18-47Z` (#1426) | | `minkms-operator` | `1.4.0` | Ships the expanded MinKMS status schema; CRD, RBAC and metadata templates updated (#1405, #1406) | - **Default image versions moved from `templates/_helpers.tpl` into `values.yaml`** in both charts, so overriding one no longer means editing a template. The `images` map accepts a full reference or a bare name combined with `repositories` (#1354). --- ## Breaking Changes - **`status.nodesAdded` on the MinKMS resource is replaced by `status.nodes`.** Update any tooling that reads it. The operator, sidecar and chart must be upgraded together; they have to agree on the field name (#1341). --- ## Security Updates - Rebuilt with Go 1.26.1, up from 1.25.7 across the operator, sidecars and migration tool, picking up the security fixes in the Go 1.26 release line (#1338, #1353, #1396). - Updated `golang.org/x/net` to v0.51.0, which carries a security fix. The sidecars link it through their Kubernetes client (#1387). --- ## Security & Compliance ### Software Bill of Materials (SBOM) - [SPDX JSON](sbom-RELEASE.2026-03-18T17-36-17Z.spdx.json) - [CycloneDX JSON](sbom-RELEASE.2026-03-18T17-36-17Z.cyclonedx.json) - [Go Modules](go-modules-RELEASE.2026-03-18T17-36-17Z.txt) --- ## Upgrade Instructions For detailed upgrade instructions, please read: https://docs.min.io/aistor/upgrade-aistor-server/upgrade-aistor-kubernetes-helm/ Environment-specific upgrade guides: - **Public registries**: https://docs.min.io/aistor/upgrade-aistor-server/upgrade-kubernetes-standard/ - **Private registries**: https://docs.min.io/aistor/upgrade-aistor-server/upgrade-kubernetes-private-registry/ - **Airgap**: https://docs.min.io/aistor/upgrade-aistor-server/upgrade-kubernetes-airgapped/ Chart, operator and sidecar images are only validated in the combination listed above. Only update single component versions when MinIO support asks for it. ### New Configuration Options | Value | Default | Purpose | | --- | --- | --- | | `operators.object-store.tokenValidation` | `TokenReview` | `TokenReview` or `OIDC` | | `.spec.configuration` on `ObjectStore` | unset | Now optional | | `images.` in `values.yaml` | per chart | Override any default image | | `--token`, `--host` on the migration tool | unset | Reach the cluster without a usable kubeconfig | ### Migration Notes - Change consumers of the MinKMS status from `status.nodesAdded` to `status.nodes`. - Set `tokenValidation: OIDC` where policy forbids the operator managing cluster role bindings, and confirm AIStor pods can reach the OIDC discovery and JWKS endpoints. - Regenerate any Helm values file produced by an earlier migration tool; older files carry `volumeSize`, which the chart ignores. - Pin `.spec.image` on the `ObjectStore` to hold a MinIO version; the chart default moved. ### Support For enterprise support: - SUBNET Support: https://subnet.min.io - Documentation: https://docs.min.io