# AIStor Operator Migration Tool RELEASE.2026-05-06T15-08-11Z

Released: 2026-05-06

This is a standalone release of the migration tool; no operator or sidecar images ship with it. It adds a `protect-crds` command that stops `helm uninstall` of the community MinIO operator from deleting the `PolicyBinding` CRD AIStor shares with it, and fixes several defects in the generated Helm values.

---

## Component Versions

| Component | Tag | Previous |
| --- | --- | --- |
| Migration Tool | `RELEASE.2026-05-06T15-08-11Z` | `RELEASE.2026-04-11T08-24-01Z` |

The operator, sidecars and Helm charts are unchanged by this release. The current operator at the time of publication is `RELEASE.2026-04-13T10-27-16Z`, with `aistor-operator` chart 5.6.3.

### Container Images

```bash
docker pull quay.io/minio/aistor/operator-migration:RELEASE.2026-05-06T15-08-11Z
docker pull quay.io/minio/aistor/operator-migration:RELEASE.2026-05-06T15-08-11Z.fips
```

---

## New Features

- **`protect-crds` keeps the shared PolicyBinding CRD alive through an OSS uninstall.** Both the community MinIO operator and AIStor own `policybindings.sts.min.io`, and uninstalling the community operator deletes it along with every `PolicyBinding` in the cluster (#1448).

- Installing the AIStor chart with `--take-ownership` is not enough, because Helm decides what to remove from its own stored release manifest rather than from the live object's annotations (#1448).

- `protect-crds` patches that stored manifest to carry `helm.sh/resource-policy: keep`. Run it before uninstalling the community operator (#1448):

  ```bash
  docker run --pull=always --rm -v ~/.kube/config:/root/.kube/config \
         quay.io/minio/aistor/operator-migration:RELEASE.2026-05-06T15-08-11Z protect-crds \
         --namespace $OSS_NAMESPACE --release $OSS_RELEASE
  ```

---

## Bug Fixes

### Generated Helm values

- **Duplicate environment variables.** A variable present in both `Tenant.spec.env` and the tool's defaults was emitted twice. The value from `Tenant.spec.env` now wins and is emitted once (#1451).

- **Misindented `.objectStore.logging` block**, which made the generated values file invalid for that section (#1451).

- **Duplicated `app=minio` label.** The `aistor-objectstore` chart already applies it, so the tool no longer emits it (#1451).

- **Hardcoded configuration secret name.** Secrets are now named `<name>-config-secrets` per tenant, so migrating more than one tenant no longer produces colliding names (#1451).

- Generated environment variables are sorted, so regenerating values for an unchanged tenant produces an identical file and diffs stay readable (#1451).

---

## Security & Compliance

### Software Bill of Materials (SBOM)

- [SPDX JSON](sbom-RELEASE.2026-05-06T15-08-11Z.spdx.json)
- [CycloneDX JSON](sbom-RELEASE.2026-05-06T15-08-11Z.cyclonedx.json)
- [Go Modules](go-modules-RELEASE.2026-05-06T15-08-11Z.txt)

The SBOM covers the migration module, which is versioned separately from the operator.

---

## Upgrade Instructions

For detailed upgrade instructions, please read: https://docs.min.io/aistor/upgrade-aistor-server/upgrade-aistor-kubernetes-helm/

### New Configuration Options

| Command | Purpose |
| --- | --- |
| `protect-crds --namespace <ns> --release <name>` | Mark the community operator's stored manifest so its uninstall keeps the shared CRD |

### Migration Notes

- If you migrated from the community operator with an earlier version of this tool and have not yet run `helm uninstall` on it, run `protect-crds` first.
- If the uninstall already removed `policybindings.sts.min.io`, reinstall the CRD and recreate the affected `PolicyBinding` objects.

### Support

For enterprise support:

- SUBNET Support: https://subnet.min.io
- Documentation: https://docs.min.io