# AIStor Operator RELEASE.2026-07-21T22-41-48Z Released: 2026-07-22 This release spreads KES pods across nodes by default, so one node failure cannot take down every replica, and makes MinIO release tag handling case-insensitive. Five operator chart releases shipped against this image between July and September, moving the default MinIO, `mc`, KES, MinKMS and WARP images forward. --- ## Component Versions | Component | Tag | Previous | | --- | --- | --- | | Operator | `RELEASE.2026-07-21T22-41-48Z` | `RELEASE.2026-07-16T23-53-30Z` | | MinIO Sidecar | `RELEASE.2026-07-14T22-07-12Z` | unchanged | | KES Sidecar | `RELEASE.2026-07-14T22-03-37Z` | unchanged | | MinKMS Sidecar | `RELEASE.2026-07-14T22-12-08Z` | unchanged | Images the operator deploys, at the last chart release in this cycle (`aistor-operator` 5.11.4, `minkms-operator` 1.10.1): | Image | Tag | Previous | | --- | --- | --- | | `minio` | [`RELEASE.2026-09-07T08-39-31Z`](https://dl.min.io/aistor/minio/release/notes/release-notes-RELEASE.2026-09-07T08-39-31Z.md) | [`RELEASE.2026-06-06T02-44-06Z`](https://dl.min.io/aistor/minio/release/notes/release-notes-RELEASE.2026-06-06T02-44-06Z.md) | | `mc` | [`RELEASE.2026-09-06T02-44-40Z`](https://dl.min.io/aistor/mc/release/notes/release-notes-RELEASE.2026-09-06T02-44-40Z.md) | `RELEASE.2026-06-24T01-47-10Z` | | `kes` | [`RELEASE.2026-08-24T11-11-49Z`](https://dl.min.io/aistor/kes/release/notes/release-notes-RELEASE.2026-08-24T11-11-49Z.md) | `RELEASE.2026-04-13T20-11-36Z` | | `minkms` | [`RELEASE.2026-08-04T13-17-26Z`](https://dl.min.io/aistor/minkms/release/notes/release-notes-RELEASE.2026-08-04T13-17-26Z.md) | [`RELEASE.2026-07-17T11-53-00Z`](https://dl.min.io/aistor/minkms/release/notes/release-notes-RELEASE.2026-07-17T11-53-00Z.md) | | `minwall` | `RELEASE.2026-05-21T06-25-56Z` | unchanged | | `aihub` | `RELEASE.2025-12-11T18-08-15Z` | unchanged | | `prompt` | `RELEASE.2025-01-17T21-55-43Z` | unchanged | | `warp` | `v1.7.0` | `v1.5.0` | ### Helm Charts | Chart | Versions | Previous | | --- | --- | --- | | `aistor-operator` | `5.11.0` – `5.11.4` | `5.10.0` | | `minkms-operator` | `1.10.0`, `1.10.1` | `1.9.0` | | `aistor-objectstore` | `1.0.17` | `1.0.16` | ### OpenShift Operator Bundles | Bundle | Version | | --- | --- | | `minio-object-store-operator` | `2026.7.21224148` | ### Container Images ```bash docker pull quay.io/minio/aistor/operator:RELEASE.2026-07-21T22-41-48Z docker pull quay.io/minio/aistor/operator:RELEASE.2026-07-21T22-41-48Z.fips ``` ```bash helm repo add minio https://helm.min.io helm upgrade --install aistor-operator minio/aistor-operator --version 5.11.4 ``` --- ## New Features - **`extraResources` in both operator charts.** Ship your own custom resources, ConfigMaps, Secrets, RBAC and policies alongside the operator without forking the chart. Each entry goes through the chart's template pipeline, so it may reference other values (#1617). --- ## Bug Fixes - **Lower-cased and hotfix-suffixed MinIO tags upgrade correctly.** Release tags were compared case-sensitively throughout the update path, so an image tagged `release.2026-...` or carrying a hotfix suffix broke rolling-upgrade detection, denied-version checks and per-node comparison (#1603). - **`disablePodDisruptionBudget: true` now removes the budgets.** The object store ClusterRole lacked `delete` on `policy/poddisruptionbudgets`, so the sync errored on every pass and the budget stayed. Fixed in chart 5.11.4; 5.11.3 and earlier are affected (#1705). - **`secrets.existingSecret` works with no configuration secret set.** With `secrets.name` cleared, the object store chart still demanded `secrets.accessKey`, so root credentials could not be kept in a pre-existing secret (#1667). --- ## CRD Changes No schema changes. The CRDs carry new version labels only. --- ## Helm Chart Changes | Chart | Version | Released | Change | | --- | --- | --- | --- | | `aistor-operator` | `5.11.0` | 2026-07-24 | Adds `extraResources`; operator image moves to this release | | `aistor-operator` | `5.11.1` | 2026-07-27 | Default `minio` → `RELEASE.2026-07-24T16-43-31Z`, `mc` → `RELEASE.2026-07-24T01-15-12Z` (#1628) | | `aistor-operator` | `5.11.2` | 2026-07-31 | Default `kes` → `RELEASE.2026-07-30T10-52-13Z` (#1653) | | `aistor-operator` | `5.11.3` | 2026-08-08 | Default `minio` → `RELEASE.2026-08-07T18-34-35Z` (#1668) | | `aistor-operator` | `5.11.4` | 2026-09-10 | ClusterRole gains `delete` on `policy/poddisruptionbudgets`; `minio`, `mc`, `kes` and `warp` move forward | | `minkms-operator` | `1.10.0` | 2026-07-24 | Adds `extraResources` | | `minkms-operator` | `1.10.1` | 2026-08-08 | Default `minkms` → `RELEASE.2026-08-04T13-17-26Z` (#1668) | | `aistor-objectstore` | `1.0.17` | 2026-08-08 | `secrets.existingSecret` honoured on the root-credential path | A custom resource can only be listed in `extraResources` once its CRD exists in the cluster: Helm builds every object before applying any, so a CRD shipped in the same release fails with `no matches for kind`. --- ## Breaking Changes - **KES pods will not share a node by default.** With `.spec.kes.affinity` unset, the operator applies a required anti-affinity on `kubernetes.io/hostname`. Replicas beyond the number of schedulable nodes stay `Pending`. Set `.spec.kes.affinity` to keep best-effort spreading (#1610, #1625). - **The `mc` image in chart 5.11.4 drops `--node` from `mc admin cordon` and `mc admin uncordon`.** The flag was never read. An AdminJob that still passes it now fails with an unknown-flag error. - **`mc support telemetry` samples 1 in 100 calls by default** in chart 5.11.4. Pass `--sample 100%` to restore the previous behaviour. - **The MinKMS server in chart 1.10.1 refuses to start on an unrecognized configuration key,** including a misspelled one. Only deployments supplying their own MinKMS configuration are affected. --- ## Security Updates - **The KES image in charts 5.11.2 and 5.11.4 clears seven Go standard library advisories,** including unbounded post-handshake TLS key derivation a malicious client can use to burn server CPU ([GO-2026-6090](https://pkg.go.dev/vuln/GO-2026-6090) / [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862)). - **The MinIO image in chart 5.11.4 hardens the IAM, STS and admin paths.** Policy evaluation fails closed when a policy cannot be read, and session tokens are accepted only with the access key they were issued to. - **The MinKMS server in chart 1.10.1 hardens the trust boundary between nodes.** A node rejects cluster traffic from outside its own cluster. No CVE or GHSA applies. --- ## Security & Compliance ### Software Bill of Materials (SBOM) - [SPDX JSON](sbom-RELEASE.2026-07-21T22-41-48Z.spdx.json) - [CycloneDX JSON](sbom-RELEASE.2026-07-21T22-41-48Z.cyclonedx.json) - [Go Modules](go-modules-RELEASE.2026-07-21T22-41-48Z.txt) --- ## Upgrade Instructions For detailed upgrade instructions, please read: https://docs.min.io/aistor/upgrade-aistor-server/upgrade-aistor-kubernetes-helm/ Environment-specific upgrade guides: - **Public registries**: https://docs.min.io/aistor/upgrade-aistor-server/upgrade-kubernetes-standard/ - **Private registries**: https://docs.min.io/aistor/upgrade-aistor-server/upgrade-kubernetes-private-registry/ - **Airgap**: https://docs.min.io/aistor/upgrade-aistor-server/upgrade-kubernetes-airgapped/ Chart, operator and sidecar images are only validated in the combination listed above. Only update single component versions when MinIO support asks for it. ### New Configuration Options | Value | Purpose | | --- | --- | | `extraResources` | Render your own Kubernetes objects as part of the operator release | ### Migration Notes - Set `.spec.kes.affinity` before upgrading if an object store runs more KES replicas than it has schedulable nodes. - Update any `AdminJob` passing `--node` to `mc admin cordon` or `mc admin uncordon` before moving to chart 5.11.4. - KES pods restart on a KES image change, and an object store cannot serve encrypted objects while no replica is available. - Pin `.spec.image` on the `ObjectStore` to hold a MinIO version; several of these charts move the default forward. - To move root credentials out of your values file, create `-root-creds`, set `secrets.existingSecret: true`, and clear `secrets.name`, `secrets.accessKey` and `secrets.secretKey`. - Check any hand-written MinKMS configuration for misspelled keys before moving to chart 1.10.1. ### Support For enterprise support: - SUBNET Support: https://subnet.min.io - Documentation: https://docs.min.io