# AIStor Operator RELEASE.2026-04-02T21-08-25Z Released: 2026-04-02 This release removes the downtime that adding a pool caused on a running object store — a 10-minute outage on a 74-node cluster in customer testing. TLS certificates added to a running object store are now picked up without a restart, and MinKMS no longer requires a license. --- ## Component Versions | Component | Tag | Previous | | --- | --- | --- | | Operator | `RELEASE.2026-04-02T21-08-25Z` | `RELEASE.2026-03-18T17-36-17Z` | | MinIO Sidecar | `RELEASE.2026-04-02T13-20-39Z` | `RELEASE.2026-03-18T17-20-10Z` | | KES Sidecar | `RELEASE.2026-04-02T20-56-12Z` | `RELEASE.2026-03-18T11-55-01Z` | | MinKMS Sidecar | `RELEASE.2026-03-18T17-16-13Z` | unchanged | Images the operator deploys, as pinned by the Helm charts in this cycle: | Image | Tag | Previous | | --- | --- | --- | | `minio` | [`RELEASE.2026-03-26T21-24-40Z`](https://dl.min.io/aistor/minio/release/notes/release-notes-RELEASE.2026-03-26T21-24-40Z.md) | unchanged | | `mc` | [`RELEASE.2026-03-27T15-57-12Z`](https://dl.min.io/aistor/mc/release/notes/release-notes-RELEASE.2026-03-27T15-57-12Z.md) | `RELEASE.2026-03-12T19-18-47Z` | | `kes` | [`RELEASE.2026-03-14T05-28-50Z`](https://dl.min.io/aistor/kes/release/notes/release-notes-RELEASE.2026-03-14T05-28-50Z.md) | unchanged | | `minkms` | [`RELEASE.2026-03-27T09-51-41Z`](https://dl.min.io/aistor/minkms/release/notes/release-notes-RELEASE.2026-03-27T09-51-41Z.md) | `RELEASE.2025-11-12T19-14-51Z` | | `aihub` | `RELEASE.2025-12-11T18-08-15Z` | unchanged | | `firewall` | `minwall:RELEASE.2024-11-01T19-53-30Z` | unchanged | | `prompt` | `RELEASE.2025-01-17T21-55-43Z` | unchanged | | `warp` | `v1.4.0` | unchanged | ### Helm Charts | Chart | Version | Previous | | --- | --- | --- | | `aistor-operator` | `5.6.0` | `5.5.2` | | `minkms-operator` | `1.5.0` | `1.4.0` | | `aistor-objectstore` | `1.0.14` | `1.0.13` | | `minkms` | `2.3.0` | `2.2.0` | ### Container Images ```bash docker pull quay.io/minio/aistor/operator:RELEASE.2026-04-02T21-08-25Z docker pull quay.io/minio/aistor/minio-sidecar:RELEASE.2026-04-02T13-20-39Z docker pull quay.io/minio/aistor/kes-sidecar:RELEASE.2026-04-02T20-56-12Z ``` A `.fips` tag of each image carries the FIPS 140-3 build. ```bash helm repo add minio https://helm.min.io helm upgrade --install aistor-operator minio/aistor-operator --version 5.6.0 ``` --- ## New Features - **Pool expansion no longer takes the object store down.** The new StatefulSet and the MinIO restart happened in one reconcile pass, so MinIO came up before the new pods had addresses, failed to resolve them and lost quorum (#1411). - The operator now marks a new pool with `aistor.min.io/pool-awaiting-pods` and defers the restart until every pod in it has an address, proceeding with a warning after the timeout. Established pools are untouched (#1411). - **Certificate changes are applied without a restart.** The MinIO sidecar sends `SIGHUP` when certificates change, and MinIO pods run with `shareProcessNamespace` so the signal lands. CA root certificates still need a restart (#1416). - **MinKMS no longer requires a license.** The license check, its propagation and the `--license` flag are gone from the MinKMS controller, and the license secret volume is no longer mounted (#1425). - **`secrets.disableRoot`** in the object store chart turns off API access through the root credentials. Default `false` (#1349). - **`minkms.env` and `minkms.annotations`** set custom environment variables and annotations on MinKMS pods and the StatefulSet. The HSM secret can also come from `hsm.existingSecret` instead of an inline key (#1424). --- ## Bug Fixes ### TLS - **Automatic certificates are loaded when external server certificates are also in use.** The operator wrote them into the `hostname-X` directory as `tls.crt`/`tls.key` rather than the `public.crt`/`private.key` names MinIO reads, so they were silently ignored. OpenShift was unaffected (#1415). ### MinKMS chart - **MinKMS and Vault HSM backends can be configured together.** The HSM block rendered one backend or the other, so a configuration naming both silently lost one (#1424). - **`topologySpreadConstraints` and `affinity` are rendered again** in the MinKMS resource template, and annotations are rendered in the HSM secret template (#1424). --- ## CRD Changes No schema changes in this release. --- ## Helm Chart Changes | Chart | Change | | --- | --- | | `aistor-operator` 5.6.0 | Image bumps only. Templates and values schema unchanged | | `minkms-operator` 1.5.0 | Drops the license secret; `templates/secret-license.yaml` is removed | | `aistor-objectstore` 1.0.14 | KES scheduling fields move under `kes.*`; adds `secrets.disableRoot` | | `minkms` 2.3.0 | `imagePullSecret` becomes a list; adds `minkms.env` and `minkms.annotations` (#1424) | - The `aistor-objectstore` chart can now run an object store with no `config.env` secret: clear `secrets.name` and supply credentials and settings as values, or through `configMapKeyRef`/`secretKeyRef` (#1349). - It also stops emitting container security context defaults when only a pod-level context is set (#1368). --- ## Breaking Changes - **MinKMS images older than `RELEASE.2025-11-12T19-14-51Z` no longer start.** The operator no longer passes `--license` or mounts the license secret into the MinKMS StatefulSet. Move a pinned MinKMS image forward before upgrading (#1425, #1433). - **The `minkms-operator` chart no longer creates or mounts a license secret,** so `license` and `global.license` have no effect there. External tooling expecting a `minio-license` secret in that namespace must be adjusted. - **KES scheduling fields move under `kes.*` in the object store chart.** `resources`, `nodeSelector`, `affinity`, `tolerations`, `annotations` and `labels` for the KES deployment are no longer ambiguous with the identically named top-level fields. Move any you set (#1364). - **`objectStore.configuration` is no longer defaulted** to `myminio-env-configuration`. Set it explicitly if you rely on a `config.env` secret (#1349). - **`minkms.imagePullSecret` is replaced by the list `minkms.imagePullSecrets`.** The chart fails rendering with an explicit message when the old key is still present, rather than ignoring it (#1424). - **`minkms.affinity` no longer defaults to empty affinity maps.** Set it explicitly if you relied on those being present (#1424). - **A MinKMS chart image must specify both a repository and a tag or digest.** Put a digest in `image.digest` rather than embedding it in the repository (#1424). --- ## Security & Compliance ### Software Bill of Materials (SBOM) - [SPDX JSON](sbom-RELEASE.2026-04-02T21-08-25Z.spdx.json) - [CycloneDX JSON](sbom-RELEASE.2026-04-02T21-08-25Z.cyclonedx.json) - [Go Modules](go-modules-RELEASE.2026-04-02T21-08-25Z.txt) --- ## Upgrade Instructions For detailed upgrade instructions, please read: https://docs.min.io/aistor/upgrade-aistor-server/upgrade-aistor-kubernetes-helm/ Environment-specific upgrade guides: - **Public registries**: https://docs.min.io/aistor/upgrade-aistor-server/upgrade-kubernetes-standard/ - **Private registries**: https://docs.min.io/aistor/upgrade-aistor-server/upgrade-kubernetes-private-registry/ - **Airgap**: https://docs.min.io/aistor/upgrade-aistor-server/upgrade-kubernetes-airgapped/ Chart, operator and sidecar images are only validated in the combination listed above. Only update single component versions when MinIO support asks for it. ### New Configuration Options | Value | Default | Purpose | | --- | --- | --- | | `POOL_AWAITING_PODS_TIMEOUT` | 15 minutes | How long the operator waits for a new pool's pods, set in `.spec.env` | | `secrets.disableRoot` | `false` | Turn off API access through the root credentials | ### Migration Notes - Verify your MinKMS image is `RELEASE.2025-11-12T19-14-51Z` or newer before upgrading the operator. - Move KES scheduling values under `kes.*` in the object store chart. - Set `objectStore.configuration` explicitly if you rely on a `config.env` secret. - Convert `minkms.imagePullSecret` to the `minkms.imagePullSecrets` list before upgrading the `minkms` chart. - Pair this MinIO sidecar with operator `RELEASE.2026-04-02T21-08-25Z` or newer; certificate reload needs the `shareProcessNamespace` that operator sets. ### Support For enterprise support: - SUBNET Support: https://subnet.min.io - Documentation: https://docs.min.io