# AIStor Operator RELEASE.2026-07-14T19-42-05Z

Released: 2026-07-14

This release makes MinKMS declarative: three new CRDs manage enclaves, SSE keys and per-tenant admin identities, so a MinKMS-backed object store can be driven through GitOps. It restores working `minwall` support, adds a cert-manager path for the webhook certificate, and introduces the standalone Sidekick injection operator.

---

## Component Versions

| Component | Tag | Previous |
| --- | --- | --- |
| Operator | `RELEASE.2026-07-14T19-42-05Z` | `RELEASE.2026-06-10T05-02-21Z` |
| MinIO Sidecar | `RELEASE.2026-07-14T22-07-12Z` | `RELEASE.2026-06-09T23-40-36Z` |
| KES Sidecar | `RELEASE.2026-07-14T22-03-37Z` | `RELEASE.2026-06-10T04-53-14Z` |
| MinKMS Sidecar | `RELEASE.2026-07-14T22-12-08Z` | `RELEASE.2026-06-10T04-57-39Z` |
| Sidekick Operator | `RELEASE.2026-07-14T21-50-22Z` | new component |
| Sidekick Sidecar | `RELEASE.2026-07-14T22-13-51Z` | new component |

Images the operator deploys, as pinned by the Helm charts in this cycle:

| Image | Tag | Previous |
| --- | --- | --- |
| `minio` | [`RELEASE.2026-06-06T02-44-06Z`](https://dl.min.io/aistor/minio/release/notes/release-notes-RELEASE.2026-06-06T02-44-06Z.md) | [`RELEASE.2026-05-28T20-50-32Z`](https://dl.min.io/aistor/minio/release/notes/release-notes-RELEASE.2026-05-28T20-50-32Z.md) |
| `mc` | `RELEASE.2026-06-24T01-47-10Z` | [`RELEASE.2026-04-21T04-26-49Z`](https://dl.min.io/aistor/mc/release/notes/release-notes-RELEASE.2026-04-21T04-26-49Z.md) |
| `kes` | `RELEASE.2026-04-13T20-11-36Z` | unchanged |
| `minkms` | `RELEASE.2026-06-24T10-30-16Z` | [`RELEASE.2026-06-03T18-18-01Z`](https://dl.min.io/aistor/minkms/release/notes/release-notes-RELEASE.2026-06-03T18-18-01Z.md) |
| `minwall` | `RELEASE.2026-05-21T06-25-56Z` | new in this release |
| `aihub` | `RELEASE.2025-12-11T18-08-15Z` | unchanged |
| `prompt` | `RELEASE.2025-01-17T21-55-43Z` | unchanged |
| `warp` | `v1.5.0` | unchanged |

### Helm Charts

| Chart | Version | Previous |
| --- | --- | --- |
| `aistor-operator` | `5.8.0` | `5.7.0` |
| `minkms-operator` | `1.7.0` | `1.6.0` |
| `minkms` | `2.5.0` | `2.3.0` |
| `aistor-objectstore` | `1.0.15` | `1.0.14` |
| `minkms-enclave` | `1.0.0` | new chart |
| `sidekick-operator` | `1.0.0` | new chart |

### Container Images

```bash
# Operator and sidecars
docker pull quay.io/minio/aistor/operator:RELEASE.2026-07-14T19-42-05Z
docker pull quay.io/minio/aistor/minio-sidecar:RELEASE.2026-07-14T22-07-12Z
docker pull quay.io/minio/aistor/kes-sidecar:RELEASE.2026-07-14T22-03-37Z
docker pull quay.io/minio/aistor/minkms-sidecar:RELEASE.2026-07-14T22-12-08Z

# Sidekick
docker pull quay.io/minio/aistor/sidekick-operator:RELEASE.2026-07-14T21-50-22Z
docker pull quay.io/minio/aistor/sidekick-sidecar:RELEASE.2026-07-14T22-13-51Z
```

A `.fips` tag of each image carries the FIPS 140-3 build.

```bash
helm repo add minio https://helm.min.io
helm upgrade --install aistor-operator minio/aistor-operator --version 5.8.0
```

---

## New Features

- **Declarative MinKMS enclaves, keys and identities.** Three namespaced CRDs replace out-of-band `minkms add-enclave` / `add-key` / `add-identity` calls, so encryption setup can be managed through GitOps (#1539).

- **`MinKMSIdentity` emits a ready-to-use consumer Secret** carrying the full MinIO KMS contract, so an object store enables SSE with one `secretKeyRef` block plus `trustedCAs` (#1539).

- **Client certificates for outbound mTLS from MinKMS.** Secrets in `certificates.externalClientCertSecrets` are mounted as projected volumes, enabling HSM backends that require mutual TLS such as HashiCorp Vault and OpenBao (#1550).

- **`minwall` (firewall) support works again.** `.spec.firewall`, its service-port routing and the sidecar injection are rebuilt; the previous implementation did nothing even when enabled. A console target port bug is fixed with it (#1538).

- **cert-manager can issue the admission webhook's certificate.** The webhook previously crash-looped on vanilla and cert-manager clusters, where the kubelet-serving CSR stays pending. Set `WEBHOOK_AUTO_CERT_DISABLED` and `WEBHOOK_CUSTOM_TLS_SECRET_NAME` (#1515).

- **A standalone Sidekick injection operator.** It injects the Sidekick load balancer into pods annotated with `sidekick.min.io/config-name`, so applications reach AIStor through a local endpoint. It ships separately because Sidekick usually runs where the AIStor operator does not (#1587).

- **Sidekick configuration reloads without a pod restart.** The supervisor polls the mounted arguments file and relaunches only the Sidekick process. Injection is idempotent and the webhook uses `failurePolicy: Ignore`, so it can never block pod creation (#1587).

---

## Bug Fixes

- **In-place MinIO updates no longer deadlock.** Exporting the image to a tar file could hang and leave the update stuck. Fixed by upgrading `go-containerregistry` to v0.21.7 (#1559).

- **Image paths may contain dots.** The parser rejected any path with a dot, so `quay.io/minio/min.io:edge` failed to parse (#1568).

- **Fixed a segmentation fault on Apple M5 Pro hardware** caused by the transitive `go-m1cpu` dependency probing CPU information (#1556).

- **Custom `labels` render valid YAML** in the object store templates, where a whitespace defect could break the manifest (#1474, #1594).

---

## CRD Changes

### New CRDs (`minkms.min.io/v1alpha1`)

| Resource | Purpose |
| --- | --- |
| `MinKMSEnclave` | An enclave in a referenced MinKMS, with a cross-namespace consumer allowlist |
| `MinKMSKey` | One SSE key inside an enclave. Name immutable; `deletionPolicy` defaults to `Retain` |
| `MinKMSIdentity` | A per-tenant enclave-scoped admin identity, plus its consumer Secret |

### Changed fields

| Resource | Field | Change |
| --- | --- | --- |
| `ObjectStore` | `spec.firewall` | Restored, having been removed in `RELEASE.2026-06-10T05-02-21Z` |
| `MinKMS` | `spec.certificates.externalClientCertSecrets` | Added, for outbound mTLS to an HSM backend |

---

## Helm Chart Changes

| Chart | Change |
| --- | --- |
| `aistor-operator` 5.8.0 | Adds `operators.object-store.webhook.extraEnv` and reinstates the `images.minwall` key |
| `minkms-operator` 1.7.0 | Ships the three MinKMS CRDs and the RBAC to reconcile them |
| `minkms` 2.5.0 | Documents outbound mTLS to an HSM backend; adds an OpenBao example. No template change |
| `aistor-objectstore` 1.0.15 | Removes the default root credentials |
| `minkms-enclave` 1.0.0 | New. Renders one enclave with its identities and SSE keys |
| `sidekick-operator` 1.0.0 | New. Deploys the Sidekick injection webhook |

A custom webhook certificate requires `operators.object-store.webhook.caBundle`. The chart fails the install without it, rather than deploying a webhook the API server cannot verify.

---

## Breaking Changes

- **Port 9000 is removed from the `minio` service.** Connect through port 80 or 443 instead. It is still exposed when `minwall` is enabled. Update any client, script or NetworkPolicy that targets it (#1538).

- **Tenant-facing cluster roles are renamed** — `aistor:object-store:pods` to `aistor-object-store-pods`, `aistor:tokenreview` to `aistor-tokenreview`. Colons break OLM unpacking on OpenShift 4.16 through 4.20. The operator handles the rename; external policy must be updated (#1574).

- **The operator image-configuration key `firewall` is renamed to `minwall`.** Deployments overriding it through Helm `images.minwall` or a patched ConfigMap must use the new name. `.spec.firewall` on the CRD is unchanged (#1584).

- **The `aistor-objectstore` chart no longer defaults the root credentials.** `secrets.accessKey` and `secrets.secretKey` are now required, and the chart rejects the `minio`/`minio123` pair even when set explicitly (#1474).

---

## Security Updates

- Rebuilt with Go 1.26.5, up from 1.26.4, with refreshed module dependencies across the operator and every sidecar (#1578).

- Updated the sidecars' `ubi9/ubi-micro` base image to `9.8-1782840931` (#1578).

- **Well-known default root credentials are gone from the `aistor-objectstore` chart.** An install that never set them previously came up with `minio`/`minio123`. The upgrade will not proceed until they are rotated (#1474).

- **`MinKMSIdentity` mints enclave-scoped Admin identities only** — never SysAdmin, never the cluster key — so a per-tenant credential cannot reach beyond its enclave (#1539).

- **The injected Sidekick listens on `127.0.0.1:8080` by default,** reachable only from inside the pod and never through the pod IP (#1587).

---

## Security & Compliance

### Software Bill of Materials (SBOM)

- [SPDX JSON](sbom-RELEASE.2026-07-14T19-42-05Z.spdx.json)
- [CycloneDX JSON](sbom-RELEASE.2026-07-14T19-42-05Z.cyclonedx.json)
- [Go Modules](go-modules-RELEASE.2026-07-14T19-42-05Z.txt)

---

## Upgrade Instructions

For detailed upgrade instructions, please read: https://docs.min.io/aistor/upgrade-aistor-server/upgrade-aistor-kubernetes-helm/

Environment-specific upgrade guides:

- **Public registries**: https://docs.min.io/aistor/upgrade-aistor-server/upgrade-kubernetes-standard/
- **Private registries**: https://docs.min.io/aistor/upgrade-aistor-server/upgrade-kubernetes-private-registry/
- **Airgap**: https://docs.min.io/aistor/upgrade-aistor-server/upgrade-kubernetes-airgapped/

Chart, operator and sidecar images are only validated in the combination listed above. Only update single component versions when MinIO support asks for it.

### New Configuration Options

| Value | Purpose |
| --- | --- |
| `WEBHOOK_AUTO_CERT_DISABLED`, `WEBHOOK_CUSTOM_TLS_SECRET_NAME` | Point the webhook at a cert-manager secret, via `webhook.extraEnv` |
| `certificates.externalClientCertSecrets` on `MinKMS` | Client certificates for outbound mTLS, with the `___CLIENT_CERT_DIR___` placeholder |
| `images.minwall` | The firewall sidecar image, previously `images.firewall` |

### Migration Notes

- Repoint anything using port 9000 on the `minio` service to port 80 or 443.
- Rename `images.firewall` to `images.minwall` in any values file or patched ConfigMap.
- Update external RBAC references to `aistor-object-store-pods` and `aistor-tokenreview`.
- Set explicit root credentials before upgrading the `aistor-objectstore` chart.
- Pin `.spec.image` on the `ObjectStore` to hold a MinIO version; the chart default moved.

### Support

For enterprise support:

- SUBNET Support: https://subnet.min.io
- Documentation: https://docs.min.io