# AIStor Operator RELEASE.2026-06-10T05-02-21Z

Released: 2026-06-10

This release adds namespace-scoped operation, so the operator can be restricted to an explicit list of namespaces and bound with `RoleBinding`s instead of cluster-wide `ClusterRoleBinding`s, and rewrites every controller's RBAC to least privilege. It also hardens the admission webhook and all three sidecars, and closes a path-traversal bypass in the secret updater.

---

## Component Versions

| Component | Tag | Previous |
| --- | --- | --- |
| Operator | `RELEASE.2026-06-10T05-02-21Z` | `RELEASE.2026-04-13T10-27-16Z` |
| MinIO Sidecar | `RELEASE.2026-06-09T23-40-36Z` | `RELEASE.2026-04-11T08-21-39Z` |
| KES Sidecar | `RELEASE.2026-06-10T04-53-14Z` | `RELEASE.2026-04-08T22-44-27Z` |
| MinKMS Sidecar | `RELEASE.2026-06-10T04-57-39Z` | `RELEASE.2026-04-11T08-18-20Z` |

Images the operator deploys, as pinned by the Helm charts in this cycle:

| Image | Tag | Previous |
| --- | --- | --- |
| `minio` | [`RELEASE.2026-05-28T20-50-32Z`](https://dl.min.io/aistor/minio/release/notes/release-notes-RELEASE.2026-05-28T20-50-32Z.md) | [`RELEASE.2026-05-04T23-02-27Z`](https://dl.min.io/aistor/minio/release/notes/release-notes-RELEASE.2026-05-04T23-02-27Z.md) |
| `mc` | [`RELEASE.2026-04-21T04-26-49Z`](https://dl.min.io/aistor/mc/release/notes/release-notes-RELEASE.2026-04-21T04-26-49Z.md) | unchanged |
| `kes` | `RELEASE.2026-04-13T20-11-36Z` | unchanged |
| `minkms` | [`RELEASE.2026-06-03T18-18-01Z`](https://dl.min.io/aistor/minkms/release/notes/release-notes-RELEASE.2026-06-03T18-18-01Z.md) | [`RELEASE.2026-05-20T12-12-28Z`](https://dl.min.io/aistor/minkms/release/notes/release-notes-RELEASE.2026-05-20T12-12-28Z.md) |
| `aihub` | `RELEASE.2025-12-11T18-08-15Z` | unchanged |
| `prompt` | `RELEASE.2025-01-17T21-55-43Z` | unchanged |
| `warp` | `v1.5.0` | unchanged |

The `minwall` (firewall) image entry is removed in this release; see Breaking Changes.

### Helm Charts

| Chart | Version | Previous |
| --- | --- | --- |
| `aistor-operator` | `5.7.0` | `5.6.3` |
| `minkms-operator` | `1.6.0` | `1.5.3` |

### Container Images

```bash
docker pull quay.io/minio/aistor/operator:RELEASE.2026-06-10T05-02-21Z
docker pull quay.io/minio/aistor/minio-sidecar:RELEASE.2026-06-09T23-40-36Z
docker pull quay.io/minio/aistor/kes-sidecar:RELEASE.2026-06-10T04-53-14Z
docker pull quay.io/minio/aistor/minkms-sidecar:RELEASE.2026-06-10T04-57-39Z
```

A `.fips` tag of each image carries the FIPS 140-3 build.

```bash
helm repo add minio https://helm.min.io
helm upgrade --install aistor-operator minio/aistor-operator --version 5.7.0
```

---

## New Features

- **Namespace-scoped operation.** `watchedNamespaces` restricts an operator to the listed namespaces, granting access through a `RoleBinding` in each instead of a cluster-wide `ClusterRoleBinding`. Only minimal cluster-scoped reads remain. Leaving it unset keeps cluster-wide behaviour (#1507, #1513, #1520).

- **The rack-awareness webhook honours the same list** and carries a matching `namespaceSelector`, so the API server never calls it for unwatched namespaces (#1513).

- **`optOutAutomaticCertificates`.** For deployments issuing operator TLS certificates through cert-manager or the OpenShift Service CA. The certificate-management cluster role is then not granted (#1507).

- **Certificate secret types are detected automatically.** The `type` field on a server or client certificate reference is now optional. This also fixes AdminJob failing with an external-only certificate and automatic certificates disabled (#1458).

- **`nodeSelector` for the MinKMS operator deployment**, settable per operator or globally (#1477).

---

## Bug Fixes

### Object store

- **Environment drift detection no longer hashes secret-derived values.** The operator asks AIStor to validate the expected hash through a dedicated admin endpoint. Older AIStor versions fall back to the previous `ServerInfo` comparison (#1502).

- **Conflicting object stores name the blocking resource.** A second object store in a namespace now logs which object store holds leadership, instead of only reporting the conflict (#1490).

- **The `operator-ca-tls` root CA secret prefix is accepted again,** after a refactor renamed it to `aistor-ca-tls` and broke upgrades relying on the original name. Both are now accepted (#1454).

- **Correct endpoint names in upgrade logs.** Already-upgraded nodes logged the MinIO version where the endpoint belonged (#1500).

### MinKMS

- **The operator trusts MinKMS instances using custom certificates.** Certificates referenced through `externalCertSecret` reach the operator's root CA pool, so it can read status and scale the cluster with automatic certificates disabled (#1517).

### Webhook

- **Start-up and shutdown fixed.** A race could prevent the webhook starting at all, and `SIGTERM` did not stop it, so pods could not terminate gracefully (#1447).

### Sidecars

- **Path-traversal bypass through a sibling directory, in all three sidecars.** A Secret key decoding to `../aistor-evil/x` escaped a base of `/var/lib/aistor`, because the containment check compared prefixes without a separator boundary (#1467).

### Telemetry

- **Each operator reports its own OTLP service name.** All of them logged as `aistor-operator`, making them indistinguishable in an OTLP backend (#1429).

---

## CRD Changes

### ObjectStore (`aistor.min.io/v1`)

| Field | Change |
| --- | --- |
| `spec.firewall` | **Removed.** The capability moved into MinIO AIStor as its `qos` feature |
| Hostname fields | Validation added: `maxLength: 253` and a DNS-style pattern |
| Image reference fields | Validation added: `maxLength: 512` and a reference pattern |
| Mount and path fields | Validation added: `maxLength: 4096` and a path pattern |
| Label key and value fields | Validation added: `maxLength` 317 and 63, at most 64 entries |

Invalid values are now rejected by the API server instead of failing later in reconciliation.

---

## Helm Chart Changes

| Value | Purpose |
| --- | --- |
| `global.operator.watchedNamespaces` / per operator | Restrict the operator to the listed namespaces; empty means cluster-wide |
| `global.operator.optOutAutomaticCertificates` / per operator | Skip the certificate CSR flow and its cluster role |
| `global.operator.nodeSelector` / per operator | Node placement for the MinKMS operator deployment |

- **RBAC is restructured in both charts.** Each controller and the webhook get their own cluster role and service account, the cluster-scoped subset moves to `cluster-role-cluster-scoped.yaml`, and tenant pod RBAC is pre-installed rather than created at reconcile time.
- **`helm uninstall` no longer deletes the CRDs.** Every CRD carries `helm.sh/resource-policy: keep`, which matters most for `policybindings.sts.min.io`, shared with the community MinIO operator during a migration (#1448).
- `aistor.resolveImage` no longer fails when `images` or `repositories` is absent from a values file (#1518).
- The MinKMS cluster-scoped role template is removed entirely, since dropping unused permissions left it empty.

---

## Breaking Changes

- **The operator no longer adds signer CA certificates automatically.** If an object store uses an external server certificate and talks to another service signed by the same CA, add that CA to `.spec.certificates.trustedCAs` before upgrading (#1458).

- **Firewall (`minwall`) support is removed from `ObjectStore`.** The capability is now built into MinIO AIStor as its `qos` feature. Remove `.spec.firewall` from your manifests. It was restored in `RELEASE.2026-07-14T19-42-05Z` (#1475).

- **RBAC is restructured across both charts.** Upgrade the chart and the operator image together; a partial upgrade leaves the operator without the roles it needs (#1395, #1512).

---

## Security Updates

- **Least-privilege RBAC across every controller.** The shared cluster role is split per controller and reduced to the verbs each one calls. MinKMS loses PVC, Prometheus and CRD reads it never used, and OpenShift clusters receive a smaller grant (#1395, #1512).

- **The admission webhook is hardened against resource exhaustion.** It served port 8443 with no timeouts and no body cap. It now sets conservative timeouts, a 1 MiB header cap, and a 3 MiB body limit failing closed with HTTP 413 (#1465).

- **All three sidecars' HTTP servers on port 4444 are hardened the same way** — a 10-second read-header timeout, 30-second read and write timeouts, a 60-second idle timeout and a 1 MiB header cap (#1466).

- **Files written by the sidecars are readable only by their owner.** Secret contents, including private keys, were written `0644`; they are now `0600` (#1461).

- **The unused `POST /sync` route is removed from all three sidecars.** Each request forced a `Get` against the API server, making it an amplification vector (#1466).

- **The sidecars' `/hash` response no longer exposes secret metadata,** returning only the resource version last applied (#1462).

- **Sensitive values no longer reach the logs.** The webhook logged full admission bodies at `-v=2`, putting token audiences, environment values and Secret references into log aggregation. Root CA material is no longer logged either (#1469, #1453).

- **Webhook TLS certificates are renewed before they expire,** regenerated at 80% of lifetime and served through a reloading certificate manager, so rotation needs no restart (#1457).

- **Operator hardening.** Aligned TLS cipher suites and curves, escaped bucket names in IAM policy JSON, rejected newlines in `config.env` values, disabled directory listing on the upgrade server, mounted the license secret `0400`, and set `allowPrivilegeEscalation: false` on every container (#1462).

- **Safer artifact handling.** Files extracted during a non-rolling MinIO update are written `0644`, or `0755` for the binary, instead of world-writable `0777` (#1472). Release tags from image labels are validated before use in paths or URLs (#1473).

- Rebuilt with Go 1.26.4, up from 1.26.2, and upgraded the Kubernetes client libraries to v0.36.1 to clear known vulnerabilities (#1483, #1505, #1511).

- The sidecar base image is pinned to an explicit digest rather than `ubi9/ubi-micro:latest`, so a rebuild cannot silently change the base layer (#1462, #1505, #1511).

---

## Security & Compliance

### Software Bill of Materials (SBOM)

- [SPDX JSON](sbom-RELEASE.2026-06-10T05-02-21Z.spdx.json)
- [CycloneDX JSON](sbom-RELEASE.2026-06-10T05-02-21Z.cyclonedx.json)
- [Go Modules](go-modules-RELEASE.2026-06-10T05-02-21Z.txt)

---

## Upgrade Instructions

For detailed upgrade instructions, please read: https://docs.min.io/aistor/upgrade-aistor-server/upgrade-aistor-kubernetes-helm/

Environment-specific upgrade guides:

- **Public registries**: https://docs.min.io/aistor/upgrade-aistor-server/upgrade-kubernetes-standard/
- **Private registries**: https://docs.min.io/aistor/upgrade-aistor-server/upgrade-kubernetes-private-registry/
- **Airgap**: https://docs.min.io/aistor/upgrade-aistor-server/upgrade-kubernetes-airgapped/

Chart, operator and sidecar images are only validated in the combination listed above. Only update single component versions when MinIO support asks for it.

### New Configuration Options

| Value | Purpose |
| --- | --- |
| `watchedNamespaces` | Restrict the operator to the listed namespaces, as `WATCHED_NAMESPACES`. Its own namespace must not appear |
| `optOutAutomaticCertificates` | Skip the in-operator certificate CSR flow and the certificate-management cluster role |
| `nodeSelector` | Node placement for the MinKMS operator deployment |

### Migration Notes

- Review `.spec.certificates` on every object store and add any shared signer CA to `.spec.certificates.trustedCAs` before upgrading.
- Remove `.spec.firewall` from object store manifests.
- Apply the matching chart version or Kustomize manifests; RBAC is restructured and a partial upgrade leaves the operator short of permissions.
- Pin `.spec.image` on the `ObjectStore` to hold a MinIO version; the chart default moved.

### Support

For enterprise support:

- SUBNET Support: https://subnet.min.io
- Documentation: https://docs.min.io