fix: Better check of RPC type requests (#6927)

guessIsRPCReq() considers all POST requests as RPC but doesn't
check if this is an object operation API or not, which is actually
confusing bucket forwarder handler when it receives a new multipart
upload API which is a POST http request.

Due to this bug, users having a federated setup are not able to
upload a multipart object using an endpoint which doesn't actually
contain the specified bucket that will store the object.

Hence this commit will fix the described issue.

cmd/acl-handlers.go

@@ -57,28 +57,28 @@ type accessControlPolicy struct {
 func (api objectAPIHandlers) GetBucketACLHandler(w http.ResponseWriter, r *http.Request) {
 	ctx := newContext(r, w, "GetBucketACL")
 
-	defer logger.AuditLog(ctx, w, r)
+	defer logger.AuditLog(w, r, "GetBucketACL", mustGetClaimsFromToken(r))
 
 	vars := mux.Vars(r)
 	bucket := vars["bucket"]
 
 	objAPI := api.ObjectAPI()
 	if objAPI == nil {
-		writeErrorResponse(w, ErrServerNotInitialized, r.URL)
+		writeErrorResponse(w, ErrServerNotInitialized, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
 	// Allow getBucketACL if policy action is set, since this is a dummy call
 	// we are simply re-purposing the bucketPolicyAction.
 	if s3Error := checkRequestAuthType(ctx, r, policy.GetBucketPolicyAction, bucket, ""); s3Error != ErrNone {
-		writeErrorResponse(w, s3Error, r.URL)
+		writeErrorResponse(w, s3Error, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
 	// Before proceeding validate if bucket exists.
 	_, err := objAPI.GetBucketInfo(ctx, bucket)
 	if err != nil {
-		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 		return
 	}
 
@@ -92,7 +92,7 @@ func (api objectAPIHandlers) GetBucketACLHandler(w http.ResponseWriter, r *http.
 		Permission: "FULL_CONTROL",
 	})
 	if err := xml.NewEncoder(w).Encode(acl); err != nil {
-		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 		return
 	}
 
@@ -106,7 +106,7 @@ func (api objectAPIHandlers) GetBucketACLHandler(w http.ResponseWriter, r *http.
 func (api objectAPIHandlers) GetObjectACLHandler(w http.ResponseWriter, r *http.Request) {
 	ctx := newContext(r, w, "GetObjectACL")
 
-	defer logger.AuditLog(ctx, w, r)
+	defer logger.AuditLog(w, r, "GetObjectACL", mustGetClaimsFromToken(r))
 
 	vars := mux.Vars(r)
 	bucket := vars["bucket"]
@@ -114,21 +114,21 @@ func (api objectAPIHandlers) GetObjectACLHandler(w http.ResponseWriter, r *http.
 
 	objAPI := api.ObjectAPI()
 	if objAPI == nil {
-		writeErrorResponse(w, ErrServerNotInitialized, r.URL)
+		writeErrorResponse(w, ErrServerNotInitialized, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
 	// Allow getObjectACL if policy action is set, since this is a dummy call
 	// we are simply re-purposing the bucketPolicyAction.
 	if s3Error := checkRequestAuthType(ctx, r, policy.GetBucketPolicyAction, bucket, ""); s3Error != ErrNone {
-		writeErrorResponse(w, s3Error, r.URL)
+		writeErrorResponse(w, s3Error, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
 	// Before proceeding validate if object exists.
 	_, err := objAPI.GetObjectInfo(ctx, bucket, object, ObjectOptions{})
 	if err != nil {
-		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 		return
 	}
 
@@ -142,7 +142,7 @@ func (api objectAPIHandlers) GetObjectACLHandler(w http.ResponseWriter, r *http.
 		Permission: "FULL_CONTROL",
 	})
 	if err := xml.NewEncoder(w).Encode(acl); err != nil {
-		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 		return
 	}
 

cmd/admin-handlers.go

@@ -578,7 +578,7 @@ func (a adminAPIHandlers) HealHandler(w http.ResponseWriter, r *http.Request) {
 				StartTime:     nh.startTime,
 			})
 			if err != nil {
-				writeErrorResponse(w, toAdminAPIErrCode(ctx, err), r.URL)
+				writeErrorResponseJSON(w, toAdminAPIErrCode(ctx, err), r.URL)
 				return
 			}
 			// Client token not specified but a heal sequence exists on a path,
@@ -859,7 +859,7 @@ func (a adminAPIHandlers) SetUserStatus(w http.ResponseWriter, r *http.Request)
 
 	// Custom IAM policies not allowed for admin user.
 	if accessKey == globalServerConfig.GetCredential().AccessKey {
-		writeErrorResponse(w, ErrInvalidRequest, r.URL)
+		writeErrorResponseJSON(w, ErrInvalidRequest, r.URL)
 		return
 	}
 
@@ -898,7 +898,7 @@ func (a adminAPIHandlers) AddUser(w http.ResponseWriter, r *http.Request) {
 
 	// Custom IAM policies not allowed for admin user.
 	if accessKey == globalServerConfig.GetCredential().AccessKey {
-		writeErrorResponse(w, ErrInvalidRequest, r.URL)
+		writeErrorResponseJSON(w, ErrInvalidRequest, r.URL)
 		return
 	}
 

cmd/admin-handlers_test.go

@@ -38,7 +38,7 @@ import (
 
 var (
 	configJSON = []byte(`{
-  "version": "32",
+  "version": "33",
   "credential": {
     "accessKey": "minio",
     "secretKey": "minio123"
@@ -152,7 +152,6 @@ var (
         "streaming": {
           "enable": false,
           "clusterID": "",
-          "clientID": "",
           "async": false,
           "maxPubAcksInflight": 0
         }

cmd/api-datatypes.go

@@ -23,6 +23,8 @@ import (
 const (
 	// Response request id.
 	responseRequestIDKey = "x-amz-request-id"
+	// Deployment id.
+	responseDeploymentIDKey = "x-minio-deployment-id"
 )
 
 // ObjectIdentifier carries key name for the object to delete.

cmd/api-response.go

@@ -568,13 +568,22 @@ func writeSuccessResponseHeadersOnly(w http.ResponseWriter) {
 }
 
 // writeErrorRespone writes error headers
-func writeErrorResponse(w http.ResponseWriter, errorCode APIErrorCode, reqURL *url.URL) {
+func writeErrorResponse(w http.ResponseWriter, errorCode APIErrorCode, reqURL *url.URL, browser bool) {
 	switch errorCode {
 	case ErrSlowDown, ErrServerNotInitialized, ErrReadQuorum, ErrWriteQuorum:
 		// Set retry-after header to indicate user-agents to retry request after 120secs.
 		// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Retry-After
 		w.Header().Set("Retry-After", "120")
+	case ErrAccessDenied:
+		// The request is from browser and also if browser
+		// is enabled we need to redirect.
+		if browser && globalIsBrowserEnabled {
+			w.Header().Set("Location", minioReservedBucketPath+reqURL.Path)
+			w.WriteHeader(http.StatusTemporaryRedirect)
+			return
+		}
 	}
+
 	apiError := getAPIError(errorCode)
 	// Generate error response.
 	errorResponse := getAPIErrorResponse(apiError, reqURL.Path, w.Header().Get(responseRequestIDKey))

cmd/auth-handler.go

@@ -19,10 +19,10 @@ package cmd
 import (
 	"bytes"
 	"context"
+	"crypto/subtle"
 	"encoding/base64"
 	"encoding/hex"
 	"errors"
-	"fmt"
 	"io"
 	"io/ioutil"
 	"net/http"
@@ -155,49 +155,66 @@ func getSessionToken(r *http.Request) (token string) {
 	return r.URL.Query().Get("X-Amz-Security-Token")
 }
 
-// Fetch claims in the security token returned by the client and validate the token.
-func getClaimsFromToken(r *http.Request, cred auth.Credentials) (map[string]interface{}, APIErrorCode) {
-	stsTokenCallback := func(jwtToken *jwtgo.Token) (interface{}, error) {
-		if _, ok := jwtToken.Method.(*jwtgo.SigningMethodHMAC); !ok {
-			return nil, fmt.Errorf("Unexpected signing method: %v", jwtToken.Header["alg"])
-		}
-		if err := jwtToken.Claims.Valid(); err != nil {
-			return nil, errAuthentication
-		}
-		if claims, ok := jwtToken.Claims.(jwtgo.MapClaims); ok {
-			if _, ok = claims["accessKey"].(string); !ok {
-				return nil, errInvalidAccessKeyID
-			}
-			// JWT token for x-amz-security-token is signed with admin
-			// secret key, temporary credentials become invalid if
-			// server admin credentials change. This is done to ensure
-			// that clients cannot decode the token using the temp
-			// secret keys and generate an entirely new claim by essentially
-			// hijacking the policies. We need to make sure that this is
-			// based an admin credential such that token cannot be decoded
-			// on the client side and is treated like an opaque value.
-			return []byte(globalServerConfig.GetCredential().SecretKey), nil
-		}
-		return nil, errAuthentication
-	}
+// Fetch claims in the security token returned by the client, doesn't return
+// errors - upon errors the returned claims map will be empty.
+func mustGetClaimsFromToken(r *http.Request) map[string]interface{} {
+	claims, _ := getClaimsFromToken(r)
+	return claims
+}
+
+// Fetch claims in the security token returned by the client.
+func getClaimsFromToken(r *http.Request) (map[string]interface{}, error) {
 	claims := make(map[string]interface{})
 	token := getSessionToken(r)
 	if token == "" {
-		return nil, ErrNone
+		return claims, nil
 	}
+	stsTokenCallback := func(jwtToken *jwtgo.Token) (interface{}, error) {
+		// JWT token for x-amz-security-token is signed with admin
+		// secret key, temporary credentials become invalid if
+		// server admin credentials change. This is done to ensure
+		// that clients cannot decode the token using the temp
+		// secret keys and generate an entirely new claim by essentially
+		// hijacking the policies. We need to make sure that this is
+		// based an admin credential such that token cannot be decoded
+		// on the client side and is treated like an opaque value.
+		return []byte(globalServerConfig.GetCredential().SecretKey), nil
+	}
+	p := &jwtgo.Parser{
+		ValidMethods: []string{
+			jwtgo.SigningMethodHS256.Alg(),
+			jwtgo.SigningMethodHS512.Alg(),
+		},
+	}
+	jtoken, err := p.ParseWithClaims(token, jwtgo.MapClaims(claims), stsTokenCallback)
+	if err != nil {
+		return nil, err
+	}
+	if !jtoken.Valid {
+		return nil, errAuthentication
+	}
+	v, ok := claims["accessKey"]
+	if !ok {
+		return nil, errInvalidAccessKeyID
+	}
+	if _, ok = v.(string); !ok {
+		return nil, errInvalidAccessKeyID
+	}
+	return claims, nil
+}
+
+// Fetch claims in the security token returned by the client and validate the token.
+func checkClaimsFromToken(r *http.Request, cred auth.Credentials) (map[string]interface{}, APIErrorCode) {
+	token := getSessionToken(r)
 	if token != "" && cred.AccessKey == "" {
 		return nil, ErrNoAccessKey
 	}
-	if token != cred.SessionToken {
+	if subtle.ConstantTimeCompare([]byte(token), []byte(cred.SessionToken)) != 1 {
 		return nil, ErrInvalidToken
 	}
-	p := &jwtgo.Parser{}
-	jtoken, err := p.ParseWithClaims(token, jwtgo.MapClaims(claims), stsTokenCallback)
+	claims, err := getClaimsFromToken(r)
 	if err != nil {
-		return nil, toAPIErrorCode(context.Background(), errAuthentication)
-	}
-	if !jtoken.Valid {
-		return nil, toAPIErrorCode(context.Background(), errAuthentication)
+		return nil, toAPIErrorCode(context.Background(), err)
 	}
 	return claims, ErrNone
 }
@@ -233,6 +250,11 @@ func checkRequestAuthType(ctx context.Context, r *http.Request, action policy.Ac
 		return s3Err
 	}
 
+	claims, s3Err := checkClaimsFromToken(r, cred)
+	if s3Err != ErrNone {
+		return s3Err
+	}
+
 	// LocationConstraint is valid only for CreateBucketAction.
 	var locationConstraint string
 	if action == policy.CreateBucketAction {
@@ -256,11 +278,6 @@ func checkRequestAuthType(ctx context.Context, r *http.Request, action policy.Ac
 		r.Body = ioutil.NopCloser(bytes.NewReader(payload))
 	}
 
-	claims, s3Err := getClaimsFromToken(r, cred)
-	if s3Err != ErrNone {
-		return s3Err
-	}
-
 	if cred.AccessKey == "" {
 		if globalPolicySys.IsAllowed(policy.Args{
 			AccountName:     cred.AccessKey,
@@ -399,7 +416,7 @@ func (a authHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		a.handler.ServeHTTP(w, r)
 		return
 	}
-	writeErrorResponse(w, ErrSignatureVersionNotSupported, r.URL)
+	writeErrorResponse(w, ErrSignatureVersionNotSupported, r.URL, guessIsBrowserReq(r))
 }
 
 // isPutAllowed - check if PUT operation is allowed on the resource, this
@@ -421,7 +438,7 @@ func isPutAllowed(atype authType, bucketName, objectName string, r *http.Request
 		return s3Err
 	}
 
-	claims, s3Err := getClaimsFromToken(r, cred)
+	claims, s3Err := checkClaimsFromToken(r, cred)
 	if s3Err != ErrNone {
 		return s3Err
 	}

cmd/bucket-handlers-listobjects.go

@@ -59,19 +59,19 @@ func validateListObjectsArgs(prefix, marker, delimiter string, maxKeys int) APIE
 func (api objectAPIHandlers) ListObjectsV2Handler(w http.ResponseWriter, r *http.Request) {
 	ctx := newContext(r, w, "ListObjectsV2")
 
-	defer logger.AuditLog(ctx, w, r)
+	defer logger.AuditLog(w, r, "ListObjectsV2", mustGetClaimsFromToken(r))
 
 	vars := mux.Vars(r)
 	bucket := vars["bucket"]
 
 	objectAPI := api.ObjectAPI()
 	if objectAPI == nil {
-		writeErrorResponse(w, ErrServerNotInitialized, r.URL)
+		writeErrorResponse(w, ErrServerNotInitialized, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
 	if s3Error := checkRequestAuthType(ctx, r, policy.ListBucketAction, bucket, ""); s3Error != ErrNone {
-		writeErrorResponse(w, s3Error, r.URL)
+		writeErrorResponse(w, s3Error, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
@@ -81,14 +81,14 @@ func (api objectAPIHandlers) ListObjectsV2Handler(w http.ResponseWriter, r *http
 	prefix, token, startAfter, delimiter, fetchOwner, maxKeys, _, errCode := getListObjectsV2Args(urlValues)
 
 	if errCode != ErrNone {
-		writeErrorResponse(w, errCode, r.URL)
+		writeErrorResponse(w, errCode, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
 	// Validate the query params before beginning to serve the request.
 	// fetch-owner is not validated since it is a boolean
 	if s3Error := validateListObjectsArgs(prefix, token, delimiter, maxKeys); s3Error != ErrNone {
-		writeErrorResponse(w, s3Error, r.URL)
+		writeErrorResponse(w, s3Error, r.URL, guessIsBrowserReq(r))
 		return
 	}
 	listObjectsV2 := objectAPI.ListObjectsV2
@@ -100,7 +100,7 @@ func (api objectAPIHandlers) ListObjectsV2Handler(w http.ResponseWriter, r *http
 	// marshaled into S3 compatible XML header.
 	listObjectsV2Info, err := listObjectsV2(ctx, bucket, prefix, token, delimiter, maxKeys, fetchOwner, startAfter)
 	if err != nil {
-		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 		return
 	}
 
@@ -110,7 +110,7 @@ func (api objectAPIHandlers) ListObjectsV2Handler(w http.ResponseWriter, r *http
 			// Read the decompressed size from the meta.json.
 			actualSize = listObjectsV2Info.Objects[i].GetActualSize()
 			if actualSize < 0 {
-				writeErrorResponse(w, ErrInvalidDecompressedSize, r.URL)
+				writeErrorResponse(w, ErrInvalidDecompressedSize, r.URL, guessIsBrowserReq(r))
 				return
 			}
 			// Set the info.Size to the actualSize.
@@ -119,7 +119,7 @@ func (api objectAPIHandlers) ListObjectsV2Handler(w http.ResponseWriter, r *http
 			listObjectsV2Info.Objects[i].ETag = getDecryptedETag(r.Header, listObjectsV2Info.Objects[i], false)
 			listObjectsV2Info.Objects[i].Size, err = listObjectsV2Info.Objects[i].DecryptedSize()
 			if err != nil {
-				writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+				writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 				return
 			}
 		}
@@ -141,37 +141,37 @@ func (api objectAPIHandlers) ListObjectsV2Handler(w http.ResponseWriter, r *http
 func (api objectAPIHandlers) ListObjectsV1Handler(w http.ResponseWriter, r *http.Request) {
 	ctx := newContext(r, w, "ListObjectsV1")
 
-	defer logger.AuditLog(ctx, w, r)
+	defer logger.AuditLog(w, r, "ListObjectsV1", mustGetClaimsFromToken(r))
 
 	vars := mux.Vars(r)
 	bucket := vars["bucket"]
 
 	objectAPI := api.ObjectAPI()
 	if objectAPI == nil {
-		writeErrorResponse(w, ErrServerNotInitialized, r.URL)
+		writeErrorResponse(w, ErrServerNotInitialized, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
 	if s3Error := checkRequestAuthType(ctx, r, policy.ListBucketAction, bucket, ""); s3Error != ErrNone {
-		writeErrorResponse(w, s3Error, r.URL)
+		writeErrorResponse(w, s3Error, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
 	// Extract all the litsObjectsV1 query params to their native values.
 	prefix, marker, delimiter, maxKeys, _, s3Error := getListObjectsV1Args(r.URL.Query())
 	if s3Error != ErrNone {
-		writeErrorResponse(w, s3Error, r.URL)
+		writeErrorResponse(w, s3Error, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
 	// Validate the maxKeys lowerbound. When maxKeys > 1000, S3 returns 1000 but
 	// does not throw an error.
 	if maxKeys < 0 {
-		writeErrorResponse(w, ErrInvalidMaxKeys, r.URL)
+		writeErrorResponse(w, ErrInvalidMaxKeys, r.URL, guessIsBrowserReq(r))
 		return
 	} // Validate all the query params before beginning to serve the request.
 	if s3Error := validateListObjectsArgs(prefix, marker, delimiter, maxKeys); s3Error != ErrNone {
-		writeErrorResponse(w, s3Error, r.URL)
+		writeErrorResponse(w, s3Error, r.URL, guessIsBrowserReq(r))
 		return
 	}
 	listObjects := objectAPI.ListObjects
@@ -183,7 +183,7 @@ func (api objectAPIHandlers) ListObjectsV1Handler(w http.ResponseWriter, r *http
 	// marshaled into S3 compatible XML header.
 	listObjectsInfo, err := listObjects(ctx, bucket, prefix, marker, delimiter, maxKeys)
 	if err != nil {
-		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 		return
 	}
 
@@ -193,7 +193,7 @@ func (api objectAPIHandlers) ListObjectsV1Handler(w http.ResponseWriter, r *http
 			// Read the decompressed size from the meta.json.
 			actualSize = listObjectsInfo.Objects[i].GetActualSize()
 			if actualSize < 0 {
-				writeErrorResponse(w, ErrInvalidDecompressedSize, r.URL)
+				writeErrorResponse(w, ErrInvalidDecompressedSize, r.URL, guessIsBrowserReq(r))
 				return
 			}
 			// Set the info.Size to the actualSize.
@@ -202,7 +202,7 @@ func (api objectAPIHandlers) ListObjectsV1Handler(w http.ResponseWriter, r *http
 			listObjectsInfo.Objects[i].ETag = getDecryptedETag(r.Header, listObjectsInfo.Objects[i], false)
 			listObjectsInfo.Objects[i].Size, err = listObjectsInfo.Objects[i].DecryptedSize()
 			if err != nil {
-				writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+				writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 				return
 			}
 		}

cmd/bucket-handlers.go

@@ -89,19 +89,19 @@ func initFederatorBackend(objLayer ObjectLayer) {
 func (api objectAPIHandlers) GetBucketLocationHandler(w http.ResponseWriter, r *http.Request) {
 	ctx := newContext(r, w, "GetBucketLocation")
 
-	defer logger.AuditLog(ctx, w, r)
+	defer logger.AuditLog(w, r, "GetBucketLocation", mustGetClaimsFromToken(r))
 
 	vars := mux.Vars(r)
 	bucket := vars["bucket"]
 
 	objectAPI := api.ObjectAPI()
 	if objectAPI == nil {
-		writeErrorResponse(w, ErrServerNotInitialized, r.URL)
+		writeErrorResponse(w, ErrServerNotInitialized, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
 	if s3Error := checkRequestAuthType(ctx, r, policy.GetBucketLocationAction, bucket, ""); s3Error != ErrNone {
-		writeErrorResponse(w, s3Error, r.URL)
+		writeErrorResponse(w, s3Error, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
@@ -110,7 +110,7 @@ func (api objectAPIHandlers) GetBucketLocationHandler(w http.ResponseWriter, r *
 		getBucketInfo = api.CacheAPI().GetBucketInfo
 	}
 	if _, err := getBucketInfo(ctx, bucket); err != nil {
-		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 		return
 	}
 
@@ -139,42 +139,42 @@ func (api objectAPIHandlers) GetBucketLocationHandler(w http.ResponseWriter, r *
 func (api objectAPIHandlers) ListMultipartUploadsHandler(w http.ResponseWriter, r *http.Request) {
 	ctx := newContext(r, w, "ListMultipartUploads")
 
-	defer logger.AuditLog(ctx, w, r)
+	defer logger.AuditLog(w, r, "ListMultipartUploads", mustGetClaimsFromToken(r))
 
 	vars := mux.Vars(r)
 	bucket := vars["bucket"]
 
 	objectAPI := api.ObjectAPI()
 	if objectAPI == nil {
-		writeErrorResponse(w, ErrServerNotInitialized, r.URL)
+		writeErrorResponse(w, ErrServerNotInitialized, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
 	if s3Error := checkRequestAuthType(ctx, r, policy.ListBucketMultipartUploadsAction, bucket, ""); s3Error != ErrNone {
-		writeErrorResponse(w, s3Error, r.URL)
+		writeErrorResponse(w, s3Error, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
 	prefix, keyMarker, uploadIDMarker, delimiter, maxUploads, _, s3Error := getBucketMultipartResources(r.URL.Query())
 	if s3Error != ErrNone {
-		writeErrorResponse(w, s3Error, r.URL)
+		writeErrorResponse(w, s3Error, r.URL, guessIsBrowserReq(r))
 		return
 	}
 	if maxUploads < 0 {
-		writeErrorResponse(w, ErrInvalidMaxUploads, r.URL)
+		writeErrorResponse(w, ErrInvalidMaxUploads, r.URL, guessIsBrowserReq(r))
 		return
 	}
 	if keyMarker != "" {
 		// Marker not common with prefix is not implemented.
 		if !hasPrefix(keyMarker, prefix) {
-			writeErrorResponse(w, ErrNotImplemented, r.URL)
+			writeErrorResponse(w, ErrNotImplemented, r.URL, guessIsBrowserReq(r))
 			return
 		}
 	}
 
 	listMultipartsInfo, err := objectAPI.ListMultipartUploads(ctx, bucket, prefix, keyMarker, uploadIDMarker, delimiter, maxUploads)
 	if err != nil {
-		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 		return
 	}
 	// generate response
@@ -192,11 +192,11 @@ func (api objectAPIHandlers) ListMultipartUploadsHandler(w http.ResponseWriter,
 func (api objectAPIHandlers) ListBucketsHandler(w http.ResponseWriter, r *http.Request) {
 	ctx := newContext(r, w, "ListBuckets")
 
-	defer logger.AuditLog(ctx, w, r)
+	defer logger.AuditLog(w, r, "ListBuckets", mustGetClaimsFromToken(r))
 
 	objectAPI := api.ObjectAPI()
 	if objectAPI == nil {
-		writeErrorResponse(w, ErrServerNotInitialized, r.URL)
+		writeErrorResponse(w, ErrServerNotInitialized, r.URL, guessIsBrowserReq(r))
 		return
 	}
 	listBuckets := objectAPI.ListBuckets
@@ -206,7 +206,7 @@ func (api objectAPIHandlers) ListBucketsHandler(w http.ResponseWriter, r *http.R
 	}
 
 	if s3Error := checkRequestAuthType(ctx, r, policy.ListAllMyBucketsAction, "", ""); s3Error != ErrNone {
-		writeErrorResponse(w, s3Error, r.URL)
+		writeErrorResponse(w, s3Error, r.URL, guessIsBrowserReq(r))
 		return
 	}
 	// If etcd, dns federation configured list buckets from etcd.
@@ -214,7 +214,7 @@ func (api objectAPIHandlers) ListBucketsHandler(w http.ResponseWriter, r *http.R
 	if globalDNSConfig != nil {
 		dnsBuckets, err := globalDNSConfig.List()
 		if err != nil && err != dns.ErrNoEntriesFound {
-			writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+			writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 			return
 		}
 		bucketSet := set.NewStringSet()
@@ -233,7 +233,7 @@ func (api objectAPIHandlers) ListBucketsHandler(w http.ResponseWriter, r *http.R
 		var err error
 		bucketsInfo, err = listBuckets(ctx)
 		if err != nil {
-			writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+			writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 			return
 		}
 	}
@@ -250,14 +250,14 @@ func (api objectAPIHandlers) ListBucketsHandler(w http.ResponseWriter, r *http.R
 func (api objectAPIHandlers) DeleteMultipleObjectsHandler(w http.ResponseWriter, r *http.Request) {
 	ctx := newContext(r, w, "DeleteMultipleObjects")
 
-	defer logger.AuditLog(ctx, w, r)
+	defer logger.AuditLog(w, r, "DeleteMultipleObjects", mustGetClaimsFromToken(r))
 
 	vars := mux.Vars(r)
 	bucket := vars["bucket"]
 
 	objectAPI := api.ObjectAPI()
 	if objectAPI == nil {
-		writeErrorResponse(w, ErrServerNotInitialized, r.URL)
+		writeErrorResponse(w, ErrServerNotInitialized, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
@@ -266,7 +266,7 @@ func (api objectAPIHandlers) DeleteMultipleObjectsHandler(w http.ResponseWriter,
 		// In the event access is denied, a 200 response should still be returned
 		// http://docs.aws.amazon.com/AmazonS3/latest/API/multiobjectdeleteapi.html
 		if s3Error != ErrAccessDenied {
-			writeErrorResponse(w, s3Error, r.URL)
+			writeErrorResponse(w, s3Error, r.URL, guessIsBrowserReq(r))
 			return
 		}
 	}
@@ -274,14 +274,14 @@ func (api objectAPIHandlers) DeleteMultipleObjectsHandler(w http.ResponseWriter,
 	// Content-Length is required and should be non-zero
 	// http://docs.aws.amazon.com/AmazonS3/latest/API/multiobjectdeleteapi.html
 	if r.ContentLength <= 0 {
-		writeErrorResponse(w, ErrMissingContentLength, r.URL)
+		writeErrorResponse(w, ErrMissingContentLength, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
 	// Content-Md5 is requied should be set
 	// http://docs.aws.amazon.com/AmazonS3/latest/API/multiobjectdeleteapi.html
 	if _, ok := r.Header["Content-Md5"]; !ok {
-		writeErrorResponse(w, ErrMissingContentMD5, r.URL)
+		writeErrorResponse(w, ErrMissingContentMD5, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
@@ -297,7 +297,7 @@ func (api objectAPIHandlers) DeleteMultipleObjectsHandler(w http.ResponseWriter,
 	// Read incoming body XML bytes.
 	if _, err := io.ReadFull(r.Body, deleteXMLBytes); err != nil {
 		logger.LogIf(ctx, err)
-		writeErrorResponse(w, ErrInternalError, r.URL)
+		writeErrorResponse(w, ErrInternalError, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
@@ -305,7 +305,7 @@ func (api objectAPIHandlers) DeleteMultipleObjectsHandler(w http.ResponseWriter,
 	deleteObjects := &DeleteObjectsRequest{}
 	if err := xml.Unmarshal(deleteXMLBytes, deleteObjects); err != nil {
 		logger.LogIf(ctx, err)
-		writeErrorResponse(w, ErrMalformedXML, r.URL)
+		writeErrorResponse(w, ErrMalformedXML, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
@@ -313,7 +313,7 @@ func (api objectAPIHandlers) DeleteMultipleObjectsHandler(w http.ResponseWriter,
 	if globalWORMEnabled {
 		// Not required to check whether given objects exist or not, because
 		// DeleteMultipleObject is always successful irrespective of object existence.
-		writeErrorResponse(w, ErrMethodNotAllowed, r.URL)
+		writeErrorResponse(w, ErrMethodNotAllowed, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
@@ -397,11 +397,11 @@ func (api objectAPIHandlers) DeleteMultipleObjectsHandler(w http.ResponseWriter,
 func (api objectAPIHandlers) PutBucketHandler(w http.ResponseWriter, r *http.Request) {
 	ctx := newContext(r, w, "PutBucket")
 
-	defer logger.AuditLog(ctx, w, r)
+	defer logger.AuditLog(w, r, "PutBucket", mustGetClaimsFromToken(r))
 
 	objectAPI := api.ObjectAPI()
 	if objectAPI == nil {
-		writeErrorResponse(w, ErrServerNotInitialized, r.URL)
+		writeErrorResponse(w, ErrServerNotInitialized, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
@@ -409,21 +409,21 @@ func (api objectAPIHandlers) PutBucketHandler(w http.ResponseWriter, r *http.Req
 	bucket := vars["bucket"]
 
 	if s3Error := checkRequestAuthType(ctx, r, policy.CreateBucketAction, bucket, ""); s3Error != ErrNone {
-		writeErrorResponse(w, s3Error, r.URL)
+		writeErrorResponse(w, s3Error, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
 	// Parse incoming location constraint.
 	location, s3Error := parseLocationConstraint(r)
 	if s3Error != ErrNone {
-		writeErrorResponse(w, s3Error, r.URL)
+		writeErrorResponse(w, s3Error, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
 	// Validate if location sent by the client is valid, reject
 	// requests which do not follow valid region requirements.
 	if !isValidLocation(location) {
-		writeErrorResponse(w, ErrInvalidRegion, r.URL)
+		writeErrorResponse(w, ErrInvalidRegion, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
@@ -432,12 +432,12 @@ func (api objectAPIHandlers) PutBucketHandler(w http.ResponseWriter, r *http.Req
 			if err == dns.ErrNoEntriesFound {
 				// Proceed to creating a bucket.
 				if err = objectAPI.MakeBucketWithLocation(ctx, bucket, location); err != nil {
-					writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+					writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 					return
 				}
 				if err = globalDNSConfig.Put(bucket); err != nil {
 					objectAPI.DeleteBucket(ctx, bucket)
-					writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+					writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 					return
 				}
 
@@ -447,18 +447,18 @@ func (api objectAPIHandlers) PutBucketHandler(w http.ResponseWriter, r *http.Req
 				writeSuccessResponseHeadersOnly(w)
 				return
 			}
-			writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+			writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 			return
 
 		}
-		writeErrorResponse(w, ErrBucketAlreadyOwnedByYou, r.URL)
+		writeErrorResponse(w, ErrBucketAlreadyOwnedByYou, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
 	// Proceed to creating a bucket.
 	err := objectAPI.MakeBucketWithLocation(ctx, bucket, location)
 	if err != nil {
-		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 		return
 	}
 
@@ -475,11 +475,11 @@ func (api objectAPIHandlers) PutBucketHandler(w http.ResponseWriter, r *http.Req
 func (api objectAPIHandlers) PostPolicyBucketHandler(w http.ResponseWriter, r *http.Request) {
 	ctx := newContext(r, w, "PostPolicyBucket")
 
-	defer logger.AuditLog(ctx, w, r)
+	defer logger.AuditLog(w, r, "PostPolicyBucket", mustGetClaimsFromToken(r))
 
 	objectAPI := api.ObjectAPI()
 	if objectAPI == nil {
-		writeErrorResponse(w, ErrServerNotInitialized, r.URL)
+		writeErrorResponse(w, ErrServerNotInitialized, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
@@ -488,17 +488,17 @@ func (api objectAPIHandlers) PostPolicyBucketHandler(w http.ResponseWriter, r *h
 	// Require Content-Length to be set in the request
 	size := r.ContentLength
 	if size < 0 {
-		writeErrorResponse(w, ErrMissingContentLength, r.URL)
+		writeErrorResponse(w, ErrMissingContentLength, r.URL, guessIsBrowserReq(r))
 		return
 	}
 	resource, err := getResource(r.URL.Path, r.Host, globalDomainName)
 	if err != nil {
-		writeErrorResponse(w, ErrInvalidRequest, r.URL)
+		writeErrorResponse(w, ErrInvalidRequest, r.URL, guessIsBrowserReq(r))
 		return
 	}
 	// Make sure that the URL  does not contain object name.
 	if bucket != filepath.Clean(resource[1:]) {
-		writeErrorResponse(w, ErrMethodNotAllowed, r.URL)
+		writeErrorResponse(w, ErrMethodNotAllowed, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
@@ -507,7 +507,7 @@ func (api objectAPIHandlers) PostPolicyBucketHandler(w http.ResponseWriter, r *h
 	reader, err := r.MultipartReader()
 	if err != nil {
 		logger.LogIf(ctx, err)
-		writeErrorResponse(w, ErrMalformedPOSTRequest, r.URL)
+		writeErrorResponse(w, ErrMalformedPOSTRequest, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
@@ -515,7 +515,7 @@ func (api objectAPIHandlers) PostPolicyBucketHandler(w http.ResponseWriter, r *h
 	form, err := reader.ReadForm(maxFormMemory)
 	if err != nil {
 		logger.LogIf(ctx, err)
-		writeErrorResponse(w, ErrMalformedPOSTRequest, r.URL)
+		writeErrorResponse(w, ErrMalformedPOSTRequest, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
@@ -526,13 +526,13 @@ func (api objectAPIHandlers) PostPolicyBucketHandler(w http.ResponseWriter, r *h
 	fileBody, fileName, fileSize, formValues, err := extractPostPolicyFormValues(ctx, form)
 	if err != nil {
 		logger.LogIf(ctx, err)
-		writeErrorResponse(w, ErrMalformedPOSTRequest, r.URL)
+		writeErrorResponse(w, ErrMalformedPOSTRequest, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
 	// Check if file is provided, error out otherwise.
 	if fileBody == nil {
-		writeErrorResponse(w, ErrPOSTFileRequired, r.URL)
+		writeErrorResponse(w, ErrPOSTFileRequired, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
@@ -554,7 +554,7 @@ func (api objectAPIHandlers) PostPolicyBucketHandler(w http.ResponseWriter, r *h
 	if successRedirect != "" {
 		redirectURL, err = url.Parse(successRedirect)
 		if err != nil {
-			writeErrorResponse(w, ErrMalformedPOSTRequest, r.URL)
+			writeErrorResponse(w, ErrMalformedPOSTRequest, r.URL, guessIsBrowserReq(r))
 			return
 		}
 	}
@@ -562,55 +562,58 @@ func (api objectAPIHandlers) PostPolicyBucketHandler(w http.ResponseWriter, r *h
 	// Verify policy signature.
 	apiErr := doesPolicySignatureMatch(formValues)
 	if apiErr != ErrNone {
-		writeErrorResponse(w, apiErr, r.URL)
+		writeErrorResponse(w, apiErr, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
 	policyBytes, err := base64.StdEncoding.DecodeString(formValues.Get("Policy"))
 	if err != nil {
-		writeErrorResponse(w, ErrMalformedPOSTRequest, r.URL)
+		writeErrorResponse(w, ErrMalformedPOSTRequest, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
-	postPolicyForm, err := parsePostPolicyForm(string(policyBytes))
-	if err != nil {
-		writeErrorResponse(w, ErrMalformedPOSTRequest, r.URL)
-		return
-	}
-
-	// Make sure formValues adhere to policy restrictions.
-	if apiErr = checkPostPolicy(formValues, postPolicyForm); apiErr != ErrNone {
-		writeErrorResponse(w, apiErr, r.URL)
-		return
-	}
-
-	// Ensure that the object size is within expected range, also the file size
-	// should not exceed the maximum single Put size (5 GiB)
-	lengthRange := postPolicyForm.Conditions.ContentLengthRange
-	if lengthRange.Valid {
-		if fileSize < lengthRange.Min {
-			writeErrorResponse(w, toAPIErrorCode(ctx, errDataTooSmall), r.URL)
+	// Handle policy if it is set.
+	if len(policyBytes) > 0 {
+		postPolicyForm, err := parsePostPolicyForm(string(policyBytes))
+		if err != nil {
+			writeErrorResponse(w, ErrMalformedPOSTRequest, r.URL, guessIsBrowserReq(r))
 			return
 		}
 
-		if fileSize > lengthRange.Max || isMaxObjectSize(fileSize) {
-			writeErrorResponse(w, toAPIErrorCode(ctx, errDataTooLarge), r.URL)
+		// Make sure formValues adhere to policy restrictions.
+		if apiErr = checkPostPolicy(formValues, postPolicyForm); apiErr != ErrNone {
+			writeErrorResponse(w, apiErr, r.URL, guessIsBrowserReq(r))
 			return
 		}
+
+		// Ensure that the object size is within expected range, also the file size
+		// should not exceed the maximum single Put size (5 GiB)
+		lengthRange := postPolicyForm.Conditions.ContentLengthRange
+		if lengthRange.Valid {
+			if fileSize < lengthRange.Min {
+				writeErrorResponse(w, toAPIErrorCode(ctx, errDataTooSmall), r.URL, guessIsBrowserReq(r))
+				return
+			}
+
+			if fileSize > lengthRange.Max || isMaxObjectSize(fileSize) {
+				writeErrorResponse(w, toAPIErrorCode(ctx, errDataTooLarge), r.URL, guessIsBrowserReq(r))
+				return
+			}
+		}
 	}
 
 	// Extract metadata to be saved from received Form.
 	metadata := make(map[string]string)
 	err = extractMetadataFromMap(ctx, formValues, metadata)
 	if err != nil {
-		writeErrorResponse(w, ErrInternalError, r.URL)
+		writeErrorResponse(w, ErrInternalError, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
 	hashReader, err := hash.NewReader(fileBody, fileSize, "", "", fileSize)
 	if err != nil {
 		logger.LogIf(ctx, err)
-		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 		return
 	}
 	rawReader := hashReader
@@ -623,19 +626,19 @@ func (api objectAPIHandlers) PostPolicyBucketHandler(w http.ResponseWriter, r *h
 			if crypto.SSEC.IsRequested(formValues) {
 				key, err = ParseSSECustomerHeader(formValues)
 				if err != nil {
-					writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+					writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 					return
 				}
 			}
 			reader, objectEncryptionKey, err = newEncryptReader(hashReader, key, bucket, object, metadata, crypto.S3.IsRequested(formValues))
 			if err != nil {
-				writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+				writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 				return
 			}
 			info := ObjectInfo{Size: fileSize}
 			hashReader, err = hash.NewReader(reader, info.EncryptedSize(), "", "", fileSize) // do not try to verify encrypted content
 			if err != nil {
-				writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+				writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 				return
 			}
 			pReader = NewPutObjReader(rawReader, hashReader, objectEncryptionKey)
@@ -644,7 +647,7 @@ func (api objectAPIHandlers) PostPolicyBucketHandler(w http.ResponseWriter, r *h
 
 	objInfo, err := objectAPI.PutObject(ctx, bucket, object, pReader, metadata, ObjectOptions{})
 	if err != nil {
-		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 		return
 	}
 
@@ -703,7 +706,7 @@ func (api objectAPIHandlers) PostPolicyBucketHandler(w http.ResponseWriter, r *h
 func (api objectAPIHandlers) HeadBucketHandler(w http.ResponseWriter, r *http.Request) {
 	ctx := newContext(r, w, "HeadBucket")
 
-	defer logger.AuditLog(ctx, w, r)
+	defer logger.AuditLog(w, r, "HeadBucket", mustGetClaimsFromToken(r))
 
 	vars := mux.Vars(r)
 	bucket := vars["bucket"]
@@ -735,19 +738,19 @@ func (api objectAPIHandlers) HeadBucketHandler(w http.ResponseWriter, r *http.Re
 func (api objectAPIHandlers) DeleteBucketHandler(w http.ResponseWriter, r *http.Request) {
 	ctx := newContext(r, w, "DeleteBucket")
 
-	defer logger.AuditLog(ctx, w, r)
+	defer logger.AuditLog(w, r, "DeleteBucket", mustGetClaimsFromToken(r))
 
 	vars := mux.Vars(r)
 	bucket := vars["bucket"]
 
 	objectAPI := api.ObjectAPI()
 	if objectAPI == nil {
-		writeErrorResponse(w, ErrServerNotInitialized, r.URL)
+		writeErrorResponse(w, ErrServerNotInitialized, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
 	if s3Error := checkRequestAuthType(ctx, r, policy.DeleteBucketAction, bucket, ""); s3Error != ErrNone {
-		writeErrorResponse(w, s3Error, r.URL)
+		writeErrorResponse(w, s3Error, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
@@ -757,7 +760,7 @@ func (api objectAPIHandlers) DeleteBucketHandler(w http.ResponseWriter, r *http.
 	}
 	// Attempt to delete bucket.
 	if err := deleteBucket(ctx, bucket); err != nil {
-		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 		return
 	}
 
@@ -769,7 +772,7 @@ func (api objectAPIHandlers) DeleteBucketHandler(w http.ResponseWriter, r *http.
 		if err := globalDNSConfig.Delete(bucket); err != nil {
 			// Deleting DNS entry failed, attempt to create the bucket again.
 			objectAPI.MakeBucketWithLocation(ctx, bucket, "")
-			writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+			writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 			return
 		}
 	}

cmd/bucket-notification-handlers.go

@@ -44,30 +44,30 @@ var errNoSuchNotifications = errors.New("The specified bucket does not have buck
 func (api objectAPIHandlers) GetBucketNotificationHandler(w http.ResponseWriter, r *http.Request) {
 	ctx := newContext(r, w, "GetBucketNotification")
 
-	defer logger.AuditLog(ctx, w, r)
+	defer logger.AuditLog(w, r, "GetBucketNotification", mustGetClaimsFromToken(r))
 
 	vars := mux.Vars(r)
 	bucketName := vars["bucket"]
 
 	objAPI := api.ObjectAPI()
 	if objAPI == nil {
-		writeErrorResponse(w, ErrServerNotInitialized, r.URL)
+		writeErrorResponse(w, ErrServerNotInitialized, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
 	if !objAPI.IsNotificationSupported() {
-		writeErrorResponse(w, ErrNotImplemented, r.URL)
+		writeErrorResponse(w, ErrNotImplemented, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
 	if s3Error := checkRequestAuthType(ctx, r, policy.GetBucketNotificationAction, bucketName, ""); s3Error != ErrNone {
-		writeErrorResponse(w, s3Error, r.URL)
+		writeErrorResponse(w, s3Error, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
 	_, err := objAPI.GetBucketInfo(ctx, bucketName)
 	if err != nil {
-		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 		return
 	}
 
@@ -76,7 +76,7 @@ func (api objectAPIHandlers) GetBucketNotificationHandler(w http.ResponseWriter,
 	if err != nil {
 		// Ignore errNoSuchNotifications to comply with AWS S3.
 		if err != errNoSuchNotifications {
-			writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+			writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 			return
 		}
 
@@ -90,7 +90,7 @@ func (api objectAPIHandlers) GetBucketNotificationHandler(w http.ResponseWriter,
 
 	notificationBytes, err := xml.Marshal(nConfig)
 	if err != nil {
-		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 		return
 	}
 
@@ -102,16 +102,16 @@ func (api objectAPIHandlers) GetBucketNotificationHandler(w http.ResponseWriter,
 func (api objectAPIHandlers) PutBucketNotificationHandler(w http.ResponseWriter, r *http.Request) {
 	ctx := newContext(r, w, "PutBucketNotification")
 
-	defer logger.AuditLog(ctx, w, r)
+	defer logger.AuditLog(w, r, "PutBucketNotification", mustGetClaimsFromToken(r))
 
 	objectAPI := api.ObjectAPI()
 	if objectAPI == nil {
-		writeErrorResponse(w, ErrServerNotInitialized, r.URL)
+		writeErrorResponse(w, ErrServerNotInitialized, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
 	if !objectAPI.IsNotificationSupported() {
-		writeErrorResponse(w, ErrNotImplemented, r.URL)
+		writeErrorResponse(w, ErrNotImplemented, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
@@ -119,19 +119,19 @@ func (api objectAPIHandlers) PutBucketNotificationHandler(w http.ResponseWriter,
 	bucketName := vars["bucket"]
 
 	if s3Error := checkRequestAuthType(ctx, r, policy.PutBucketNotificationAction, bucketName, ""); s3Error != ErrNone {
-		writeErrorResponse(w, s3Error, r.URL)
+		writeErrorResponse(w, s3Error, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
 	_, err := objectAPI.GetBucketInfo(ctx, bucketName)
 	if err != nil {
-		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 		return
 	}
 
 	// PutBucketNotification always needs a Content-Length.
 	if r.ContentLength <= 0 {
-		writeErrorResponse(w, ErrMissingContentLength, r.URL)
+		writeErrorResponse(w, ErrMissingContentLength, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
@@ -143,12 +143,12 @@ func (api objectAPIHandlers) PutBucketNotificationHandler(w http.ResponseWriter,
 			apiErr = toAPIErrorCode(ctx, err)
 		}
 
-		writeErrorResponse(w, apiErr, r.URL)
+		writeErrorResponse(w, apiErr, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
 	if err = saveNotificationConfig(ctx, objectAPI, bucketName, config); err != nil {
-		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 		return
 	}
 
@@ -164,24 +164,28 @@ func (api objectAPIHandlers) PutBucketNotificationHandler(w http.ResponseWriter,
 func (api objectAPIHandlers) ListenBucketNotificationHandler(w http.ResponseWriter, r *http.Request) {
 	ctx := newContext(r, w, "ListenBucketNotification")
 
-	defer logger.AuditLog(ctx, w, r)
+	defer logger.AuditLog(w, r, "ListenBucketNotification", mustGetClaimsFromToken(r))
 
 	// Validate if bucket exists.
 	objAPI := api.ObjectAPI()
 	if objAPI == nil {
-		writeErrorResponse(w, ErrServerNotInitialized, r.URL)
+		writeErrorResponse(w, ErrServerNotInitialized, r.URL, guessIsBrowserReq(r))
 		return
 	}
 	if !objAPI.IsNotificationSupported() {
-		writeErrorResponse(w, ErrNotImplemented, r.URL)
+		writeErrorResponse(w, ErrNotImplemented, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
+	if !objAPI.IsListenBucketSupported() {
+		writeErrorResponse(w, ErrNotImplemented, r.URL, guessIsBrowserReq(r))
+		return
+	}
 	vars := mux.Vars(r)
 	bucketName := vars["bucket"]
 
 	if s3Error := checkRequestAuthType(ctx, r, policy.ListenBucketNotificationAction, bucketName, ""); s3Error != ErrNone {
-		writeErrorResponse(w, s3Error, r.URL)
+		writeErrorResponse(w, s3Error, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
@@ -189,11 +193,11 @@ func (api objectAPIHandlers) ListenBucketNotificationHandler(w http.ResponseWrit
 
 	var prefix string
 	if len(values["prefix"]) > 1 {
-		writeErrorResponse(w, ErrFilterNamePrefix, r.URL)
+		writeErrorResponse(w, ErrFilterNamePrefix, r.URL, guessIsBrowserReq(r))
 	}
 	if len(values["prefix"]) == 1 {
 		if err := event.ValidateFilterRuleValue(values["prefix"][0]); err != nil {
-			writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+			writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 			return
 		}
 
@@ -202,11 +206,11 @@ func (api objectAPIHandlers) ListenBucketNotificationHandler(w http.ResponseWrit
 
 	var suffix string
 	if len(values["suffix"]) > 1 {
-		writeErrorResponse(w, ErrFilterNameSuffix, r.URL)
+		writeErrorResponse(w, ErrFilterNameSuffix, r.URL, guessIsBrowserReq(r))
 	}
 	if len(values["suffix"]) == 1 {
 		if err := event.ValidateFilterRuleValue(values["suffix"][0]); err != nil {
-			writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+			writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 			return
 		}
 
@@ -219,7 +223,7 @@ func (api objectAPIHandlers) ListenBucketNotificationHandler(w http.ResponseWrit
 	for _, s := range values["events"] {
 		eventName, err := event.ParseName(s)
 		if err != nil {
-			writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+			writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 			return
 		}
 
@@ -227,19 +231,19 @@ func (api objectAPIHandlers) ListenBucketNotificationHandler(w http.ResponseWrit
 	}
 
 	if _, err := objAPI.GetBucketInfo(ctx, bucketName); err != nil {
-		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 		return
 	}
 
 	host, err := xnet.ParseHost(r.RemoteAddr)
 	if err != nil {
-		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 		return
 	}
 
 	target, err := target.NewHTTPClientTarget(*host, w)
 	if err != nil {
-		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 		return
 	}
 
@@ -247,7 +251,7 @@ func (api objectAPIHandlers) ListenBucketNotificationHandler(w http.ResponseWrit
 
 	if err = globalNotificationSys.AddRemoteTarget(bucketName, target, rulesMap); err != nil {
 		logger.GetReqInfo(ctx).AppendTags("target", target.ID().Name)
-		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 		return
 	}
 	defer globalNotificationSys.RemoveRemoteTarget(bucketName, target.ID())
@@ -255,13 +259,13 @@ func (api objectAPIHandlers) ListenBucketNotificationHandler(w http.ResponseWrit
 
 	thisAddr, err := xnet.ParseHost(GetLocalPeer(globalEndpoints))
 	if err != nil {
-		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 		return
 	}
 
 	if err = SaveListener(objAPI, bucketName, eventNames, pattern, target.ID(), *thisAddr); err != nil {
 		logger.GetReqInfo(ctx).AppendTags("target", target.ID().Name)
-		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 		return
 	}
 
@@ -271,7 +275,7 @@ func (api objectAPIHandlers) ListenBucketNotificationHandler(w http.ResponseWrit
 
 	if err = RemoveListener(objAPI, bucketName, target.ID(), *thisAddr); err != nil {
 		logger.GetReqInfo(ctx).AppendTags("target", target.ID().Name)
-		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 		return
 	}
 }

cmd/bucket-policy-handlers.go

@@ -40,11 +40,11 @@ const (
 func (api objectAPIHandlers) PutBucketPolicyHandler(w http.ResponseWriter, r *http.Request) {
 	ctx := newContext(r, w, "PutBucketPolicy")
 
-	defer logger.AuditLog(ctx, w, r)
+	defer logger.AuditLog(w, r, "PutBucketPolicy", mustGetClaimsFromToken(r))
 
 	objAPI := api.ObjectAPI()
 	if objAPI == nil {
-		writeErrorResponse(w, ErrServerNotInitialized, r.URL)
+		writeErrorResponse(w, ErrServerNotInitialized, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
@@ -52,43 +52,43 @@ func (api objectAPIHandlers) PutBucketPolicyHandler(w http.ResponseWriter, r *ht
 	bucket := vars["bucket"]
 
 	if s3Error := checkRequestAuthType(ctx, r, policy.PutBucketPolicyAction, bucket, ""); s3Error != ErrNone {
-		writeErrorResponse(w, s3Error, r.URL)
+		writeErrorResponse(w, s3Error, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
 	// Check if bucket exists.
 	if _, err := objAPI.GetBucketInfo(ctx, bucket); err != nil {
-		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 		return
 	}
 
 	// Error out if Content-Length is missing.
 	// PutBucketPolicy always needs Content-Length.
 	if r.ContentLength <= 0 {
-		writeErrorResponse(w, ErrMissingContentLength, r.URL)
+		writeErrorResponse(w, ErrMissingContentLength, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
 	// Error out if Content-Length is beyond allowed size.
 	if r.ContentLength > maxBucketPolicySize {
-		writeErrorResponse(w, ErrEntityTooLarge, r.URL)
+		writeErrorResponse(w, ErrEntityTooLarge, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
 	bucketPolicy, err := policy.ParseConfig(io.LimitReader(r.Body, r.ContentLength), bucket)
 	if err != nil {
-		writeErrorResponse(w, ErrMalformedPolicy, r.URL)
+		writeErrorResponse(w, ErrMalformedPolicy, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
 	// Version in policy must not be empty
 	if bucketPolicy.Version == "" {
-		writeErrorResponse(w, ErrMalformedPolicy, r.URL)
+		writeErrorResponse(w, ErrMalformedPolicy, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
 	if err = objAPI.SetBucketPolicy(ctx, bucket, bucketPolicy); err != nil {
-		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 		return
 	}
 
@@ -103,11 +103,11 @@ func (api objectAPIHandlers) PutBucketPolicyHandler(w http.ResponseWriter, r *ht
 func (api objectAPIHandlers) DeleteBucketPolicyHandler(w http.ResponseWriter, r *http.Request) {
 	ctx := newContext(r, w, "DeleteBucketPolicy")
 
-	defer logger.AuditLog(ctx, w, r)
+	defer logger.AuditLog(w, r, "DeleteBucketPolicy", mustGetClaimsFromToken(r))
 
 	objAPI := api.ObjectAPI()
 	if objAPI == nil {
-		writeErrorResponse(w, ErrServerNotInitialized, r.URL)
+		writeErrorResponse(w, ErrServerNotInitialized, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
@@ -115,18 +115,18 @@ func (api objectAPIHandlers) DeleteBucketPolicyHandler(w http.ResponseWriter, r
 	bucket := vars["bucket"]
 
 	if s3Error := checkRequestAuthType(ctx, r, policy.DeleteBucketPolicyAction, bucket, ""); s3Error != ErrNone {
-		writeErrorResponse(w, s3Error, r.URL)
+		writeErrorResponse(w, s3Error, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
 	// Check if bucket exists.
 	if _, err := objAPI.GetBucketInfo(ctx, bucket); err != nil {
-		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 		return
 	}
 
 	if err := objAPI.DeleteBucketPolicy(ctx, bucket); err != nil {
-		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 		return
 	}
 
@@ -141,11 +141,11 @@ func (api objectAPIHandlers) DeleteBucketPolicyHandler(w http.ResponseWriter, r
 func (api objectAPIHandlers) GetBucketPolicyHandler(w http.ResponseWriter, r *http.Request) {
 	ctx := newContext(r, w, "GetBucketPolicy")
 
-	defer logger.AuditLog(ctx, w, r)
+	defer logger.AuditLog(w, r, "GetBucketPolicy", mustGetClaimsFromToken(r))
 
 	objAPI := api.ObjectAPI()
 	if objAPI == nil {
-		writeErrorResponse(w, ErrServerNotInitialized, r.URL)
+		writeErrorResponse(w, ErrServerNotInitialized, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
@@ -153,26 +153,26 @@ func (api objectAPIHandlers) GetBucketPolicyHandler(w http.ResponseWriter, r *ht
 	bucket := vars["bucket"]
 
 	if s3Error := checkRequestAuthType(ctx, r, policy.GetBucketPolicyAction, bucket, ""); s3Error != ErrNone {
-		writeErrorResponse(w, s3Error, r.URL)
+		writeErrorResponse(w, s3Error, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
 	// Check if bucket exists.
 	if _, err := objAPI.GetBucketInfo(ctx, bucket); err != nil {
-		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 		return
 	}
 
 	// Read bucket access policy.
 	bucketPolicy, err := objAPI.GetBucketPolicy(ctx, bucket)
 	if err != nil {
-		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 		return
 	}
 
 	policyData, err := json.Marshal(bucketPolicy)
 	if err != nil {
-		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL)
+		writeErrorResponse(w, toAPIErrorCode(ctx, err), r.URL, guessIsBrowserReq(r))
 		return
 	}
 

cmd/certs.go

@@ -71,9 +71,13 @@ func getRootCAs(certsCAsDir string) (*x509.CertPool, error) {
 	// Get all CA file names.
 	var caFiles []string
 	fis, err := readDir(certsCAsDir)
-	if err != nil {
+	if err != nil && err != errFileNotFound {
 		return nil, err
 	}
+	// Return success if CA's directory is missing.
+	if err == errFileNotFound {
+		return nil, nil
+	}
 	for _, fi := range fis {
 		// Skip all directories.
 		if hasSuffix(fi, slashSeparator) {

cmd/certs_test.go

@@ -223,7 +223,8 @@ func TestGetRootCAs(t *testing.T) {
 		certCAsDir  string
 		expectedErr error
 	}{
-		{"nonexistent-dir", errFileNotFound},
+		// ignores non-existent directories.
+		{"nonexistent-dir", nil},
 		// Ignores directories.
 		{dir1, nil},
 		// Ignore empty directory.

cmd/common-main.go

@@ -32,6 +32,8 @@ import (
 	"github.com/minio/minio-go/pkg/set"
 	"github.com/minio/minio/cmd/crypto"
 	"github.com/minio/minio/cmd/logger"
+	"github.com/minio/minio/cmd/logger/target/console"
+	"github.com/minio/minio/cmd/logger/target/http"
 	"github.com/minio/minio/pkg/auth"
 	"github.com/minio/minio/pkg/dns"
 	xnet "github.com/minio/minio/pkg/net"
@@ -54,25 +56,25 @@ func loadLoggers() {
 	auditEndpoint, ok := os.LookupEnv("MINIO_AUDIT_LOGGER_HTTP_ENDPOINT")
 	if ok {
 		// Enable audit HTTP logging through ENV.
-		logger.AddAuditTarget(logger.NewHTTP(auditEndpoint, NewCustomHTTPTransport()))
+		logger.AddAuditTarget(http.New(auditEndpoint, NewCustomHTTPTransport()))
 	}
 
 	loggerEndpoint, ok := os.LookupEnv("MINIO_LOGGER_HTTP_ENDPOINT")
 	if ok {
 		// Enable HTTP logging through ENV.
-		logger.AddTarget(logger.NewHTTP(loggerEndpoint, NewCustomHTTPTransport()))
+		logger.AddTarget(http.New(loggerEndpoint, NewCustomHTTPTransport()))
 	} else {
 		for _, l := range globalServerConfig.Logger.HTTP {
 			if l.Enabled {
 				// Enable http logging
-				logger.AddTarget(logger.NewHTTP(l.Endpoint, NewCustomHTTPTransport()))
+				logger.AddTarget(http.New(l.Endpoint, NewCustomHTTPTransport()))
 			}
 		}
 	}
 
 	if globalServerConfig.Logger.Console.Enabled {
 		// Enable console logging
-		logger.AddTarget(logger.NewConsole())
+		logger.AddTarget(console.New())
 	}
 
 }
@@ -219,14 +221,18 @@ func handleCommonEnvVars() {
 	minioEndpointsEnv, ok := os.LookupEnv("MINIO_PUBLIC_IPS")
 	if ok {
 		minioEndpoints := strings.Split(minioEndpointsEnv, ",")
-		globalDomainIPs = set.NewStringSet()
 		for i, ip := range minioEndpoints {
 			if net.ParseIP(ip) == nil {
 				logger.FatalIf(errInvalidArgument, "Unable to initialize Minio server with invalid MINIO_PUBLIC_IPS[%d]: %s", i, ip)
 			}
-			globalDomainIPs.Add(ip)
 		}
+		updateDomainIPs(set.CreateStringSet(minioEndpoints...))
+	} else {
+		// Add found interfaces IP address to global domain IPS,
+		// loopback addresses will be naturally dropped.
+		updateDomainIPs(localIP4)
 	}
+
 	if globalDomainName != "" && !globalDomainIPs.IsEmpty() && globalEtcdClient != nil {
 		var err error
 		globalDNSConfig, err = dns.NewCoreDNS(globalDomainName, globalDomainIPs, globalMinioPort, globalEtcdClient)

cmd/config-current.go

@@ -43,9 +43,9 @@ import (
 // 6. Make changes in config-current_test.go for any test change
 
 // Config version
-const serverConfigVersion = "32"
+const serverConfigVersion = "33"
 
-type serverConfig = serverConfigV32
+type serverConfig = serverConfigV33
 
 var (
 	// globalServerConfig server config.
@@ -556,8 +556,10 @@ func (s *serverConfig) loadToCachedConfigs() {
 	if globalPolicyOPA == nil {
 		if s.Policy.OPA.URL != nil && s.Policy.OPA.URL.String() != "" {
 			globalPolicyOPA = iampolicy.NewOpa(iampolicy.OpaArgs{
-				URL:       s.Policy.OPA.URL,
-				AuthToken: s.Policy.OPA.AuthToken,
+				URL:         s.Policy.OPA.URL,
+				AuthToken:   s.Policy.OPA.AuthToken,
+				Transport:   NewCustomHTTPTransport(),
+				CloseRespFn: CloseResponse,
 			})
 		}
 	}

cmd/config-current_test.go

@@ -188,7 +188,7 @@ func TestValidateConfig(t *testing.T) {
 		{`{"version": "` + v + `", "credential": { "accessKey": "minio", "secretKey": "minio123" }, "region": "us-east-1", "browser": "on", "notify": { "amqp": { "1": { "enable": true, "url": "", "exchange": "", "routingKey": "", "exchangeType": "", "mandatory": false, "immediate": false, "durable": false, "internal": false, "noWait": false, "autoDeleted": false }}}}`, false},
 
 		// Test 12 - Test NATS
-		{`{"version": "` + v + `", "credential": { "accessKey": "minio", "secretKey": "minio123" }, "region": "us-east-1", "browser": "on", "notify": { "nats": { "1": { "enable": true, "address": "", "subject": "", "username": "", "password": "", "token": "", "secure": false, "pingInterval": 0, "streaming": { "enable": false, "clusterID": "", "clientID": "", "async": false, "maxPubAcksInflight": 0 } } }}}`, false},
+		{`{"version": "` + v + `", "credential": { "accessKey": "minio", "secretKey": "minio123" }, "region": "us-east-1", "browser": "on", "notify": { "nats": { "1": { "enable": true, "address": "", "subject": "", "username": "", "password": "", "token": "", "secure": false, "pingInterval": 0, "streaming": { "enable": false, "clusterID": "", "async": false, "maxPubAcksInflight": 0 } } }}}`, false},
 
 		// Test 13 - Test ElasticSearch
 		{`{"version": "` + v + `", "credential": { "accessKey": "minio", "secretKey": "minio123" }, "region": "us-east-1", "browser": "on", "notify": { "elasticsearch": { "1": { "enable": true, "url": "", "index": "" } }}}`, false},

cmd/config-dir.go

@@ -74,7 +74,15 @@ func (config *ConfigDir) GetCADir() string {
 
 // Create - creates configuration directory tree.
 func (config *ConfigDir) Create() error {
-	return os.MkdirAll(config.GetCADir(), 0700)
+	err := os.MkdirAll(config.GetCADir(), 0700)
+	// It is possible in kubernetes like deployments this directory
+	// is already mounted and is not writable, ignore any write errors.
+	if err != nil {
+		if os.IsPermission(err) {
+			err = nil
+		}
+	}
+	return err
 }
 
 // GetMinioConfigFile - returns absolute path of config.json file.

cmd/config-migrate.go

@@ -2413,8 +2413,64 @@ func migrateV27ToV28() error {
 	return nil
 }
 
-// Migrates '.minio.sys/config.json' to v32.
+// Migrates ${HOME}/.minio/config.json to '<export_path>/.minio.sys/config/config.json'
+func migrateConfigToMinioSys(objAPI ObjectLayer) (err error) {
+	defer func() {
+		// Rename config.json to config.json.deprecated only upon
+		// success of this function.
+		if err == nil {
+			os.Rename(getConfigFile(), getConfigFile()+".deprecated")
+		}
+	}()
+
+	configFile := path.Join(minioConfigPrefix, minioConfigFile)
+	// Construct path to config.json for the given bucket.
+	transactionConfigFile := configFile + ".transaction"
+
+	// As object layer's GetObject() and PutObject() take respective lock on minioMetaBucket
+	// and configFile, take a transaction lock to avoid data race between readConfig()
+	// and saveConfig().
+	objLock := globalNSMutex.NewNSLock(minioMetaBucket, transactionConfigFile)
+	if err = objLock.GetLock(globalOperationTimeout); err != nil {
+		return err
+	}
+	defer objLock.Unlock()
+
+	// Verify if backend already has the file.
+	if err = checkConfig(context.Background(), objAPI, configFile); err != errConfigNotFound {
+		return err
+	} // if errConfigNotFound proceed to migrate..
+
+	var config = &serverConfig{}
+	if _, err = Load(getConfigFile(), config); err != nil {
+		if !os.IsNotExist(err) {
+			return err
+		}
+		// Read from deprecate file as well if necessary.
+		if _, err = Load(getConfigFile()+".deprecated", config); err != nil {
+			return err
+		}
+	}
+
+	return saveServerConfig(context.Background(), objAPI, config)
+}
+
+// Migrates '.minio.sys/config.json' to v33.
 func migrateMinioSysConfig(objAPI ObjectLayer) error {
+	configFile := path.Join(minioConfigPrefix, minioConfigFile)
+
+	// Construct path to config.json for the given bucket.
+	transactionConfigFile := configFile + ".transaction"
+
+	// As object layer's GetObject() and PutObject() take respective lock on minioMetaBucket
+	// and configFile, take a transaction lock to avoid data race between readConfig()
+	// and saveConfig().
+	objLock := globalNSMutex.NewNSLock(minioMetaBucket, transactionConfigFile)
+	if err := objLock.GetLock(globalOperationTimeout); err != nil {
+		return err
+	}
+	defer objLock.Unlock()
+
 	if err := migrateV27ToV28MinioSys(objAPI); err != nil {
 		return err
 	}
@@ -2427,7 +2483,10 @@ func migrateMinioSysConfig(objAPI ObjectLayer) error {
 	if err := migrateV30ToV31MinioSys(objAPI); err != nil {
 		return err
 	}
-	return migrateV31ToV32MinioSys(objAPI)
+	if err := migrateV31ToV32MinioSys(objAPI); err != nil {
+		return err
+	}
+	return migrateV32ToV33MinioSys(objAPI)
 }
 
 func checkConfigVersion(objAPI ObjectLayer, configFile string, version string) (bool, []byte, error) {
@@ -2623,3 +2682,36 @@ func migrateV31ToV32MinioSys(objAPI ObjectLayer) error {
 	logger.Info(configMigrateMSGTemplate, configFile, "31", "32")
 	return nil
 }
+
+func migrateV32ToV33MinioSys(objAPI ObjectLayer) error {
+	configFile := path.Join(minioConfigPrefix, minioConfigFile)
+
+	ok, data, err := checkConfigVersion(objAPI, configFile, "32")
+	if err == errConfigNotFound {
+		return nil
+	} else if err != nil {
+		return fmt.Errorf("Unable to load config file. %v", err)
+	}
+	if !ok {
+		return nil
+	}
+
+	cfg := &serverConfigV33{}
+	if err = json.Unmarshal(data, cfg); err != nil {
+		return err
+	}
+
+	cfg.Version = "33"
+
+	data, err = json.Marshal(cfg)
+	if err != nil {
+		return err
+	}
+
+	if err = saveConfig(context.Background(), objAPI, configFile, data); err != nil {
+		return fmt.Errorf("Failed to migrate config from  32  to  33 . %v", err)
+	}
+
+	logger.Info(configMigrateMSGTemplate, configFile, "32", "33")
+	return nil
+}

cmd/config-migrate_test.go

@@ -159,8 +159,8 @@ func TestServerConfigMigrateInexistentConfig(t *testing.T) {
 	}
 }
 
-// Test if a config migration from v2 to v30 is successfully done
-func TestServerConfigMigrateV2toV30(t *testing.T) {
+// Test if a config migration from v2 to v33 is successfully done
+func TestServerConfigMigrateV2toV33(t *testing.T) {
 	rootPath, err := ioutil.TempDir(globalTestTmpDir, "minio-")
 	if err != nil {
 		t.Fatal(err)

cmd/config-versions.go

@@ -892,3 +892,47 @@ type serverConfigV32 struct {
 		// Add new external policy enforcements here.
 	} `json:"policy"`
 }
+
+// serverConfigV33 is just like version '32', removes clientID from NATS.
+type serverConfigV33 struct {
+	quick.Config `json:"-"` // ignore interfaces
+
+	Version string `json:"version"`
+
+	// S3 API configuration.
+	Credential auth.Credentials `json:"credential"`
+	Region     string           `json:"region"`
+	Worm       BoolFlag         `json:"worm"`
+
+	// Storage class configuration
+	StorageClass storageClassConfig `json:"storageclass"`
+
+	// Cache configuration
+	Cache CacheConfig `json:"cache"`
+
+	// KMS configuration
+	KMS crypto.KMSConfig `json:"kms"`
+
+	// Notification queue configuration.
+	Notify notifier `json:"notify"`
+
+	// Logger configuration
+	Logger loggerConfig `json:"logger"`
+
+	// Compression configuration
+	Compression compressionConfig `json:"compress"`
+
+	// OpenID configuration
+	OpenID struct {
+		// JWKS validator config.
+		JWKS validator.JWKSArgs `json:"jwks"`
+	} `json:"openid"`
+
+	// External policy enforcements.
+	Policy struct {
+		// OPA configuration.
+		OPA iampolicy.OpaArgs `json:"opa"`
+
+		// Add new external policy enforcements here.
+	} `json:"policy"`
+}

cmd/config.go

@@ -156,30 +156,6 @@ func NewConfigSys() *ConfigSys {
 	return &ConfigSys{}
 }
 
-// Migrates ${HOME}/.minio/config.json to '<export_path>/.minio.sys/config/config.json'
-func migrateConfigToMinioSys(objAPI ObjectLayer) error {
-	defer os.Rename(getConfigFile(), getConfigFile()+".deprecated")
-
-	configFile := path.Join(minioConfigPrefix, minioConfigFile)
-	// Verify if backend already has the file.
-	if err := checkConfig(context.Background(), objAPI, configFile); err != errConfigNotFound {
-		return err
-	} // if errConfigNotFound proceed to migrate..
-
-	var config = &serverConfig{}
-	if _, err := Load(getConfigFile(), config); err != nil {
-		if !os.IsNotExist(err) {
-			return err
-		}
-		// Read from deprecate file as well if necessary.
-		if _, err = Load(getConfigFile()+".deprecated", config); err != nil {
-			return err
-		}
-	}
-
-	return saveServerConfig(context.Background(), objAPI, config)
-}
-
 // Initialize and load config from remote etcd or local config directory
 func initConfig(objAPI ObjectLayer) error {
 	if objAPI == nil {

cmd/copy-part-range.go

@@ -22,16 +22,16 @@ import (
 )
 
 // Writes S3 compatible copy part range error.
-func writeCopyPartErr(w http.ResponseWriter, err error, url *url.URL) {
+func writeCopyPartErr(w http.ResponseWriter, err error, url *url.URL, browser bool) {
 	switch err {
 	case errInvalidRange:
-		writeErrorResponse(w, ErrInvalidCopyPartRange, url)
+		writeErrorResponse(w, ErrInvalidCopyPartRange, url, browser)
 		return
 	case errInvalidRangeSource:
-		writeErrorResponse(w, ErrInvalidCopyPartRangeSource, url)
+		writeErrorResponse(w, ErrInvalidCopyPartRangeSource, url, browser)
 		return
 	default:
-		writeErrorResponse(w, ErrInternalError, url)
+		writeErrorResponse(w, ErrInternalError, url, browser)
 		return
 	}
 }

cmd/crypto/vault.go

@@ -192,6 +192,11 @@ func NewVault(kmsConf KMSConfig) (KMS, error) {
 	if err != nil {
 		return nil, err
 	}
+
+	if ns, ok := os.LookupEnv("MINIO_SSE_VAULT_NAMESPACE"); ok {
+		c.SetNamespace(ns)
+	}
+
 	accessToken, leaseDuration, err := getVaultAccessToken(c, config.Auth.AppRole.ID, config.Auth.AppRole.Secret)
 	if err != nil {
 		return nil, err

cmd/disk-cache.go

@@ -303,7 +303,7 @@ func (c cacheObjects) GetObject(ctx context.Context, bucket, object string, star
 		}
 		dcache.Delete(ctx, bucket, object)
 	}
-	if startOffset != 0 || length != objInfo.Size {
+	if startOffset != 0 || (length > 0 && length != objInfo.Size) {
 		// We don't cache partial objects.
 		return GetObjectFn(ctx, bucket, object, startOffset, length, writer, etag, opts)
 	}

cmd/dummy-object-layer_test.go

@@ -154,6 +154,9 @@ func (api *DummyObjectLayer) DeleteBucketPolicy(context.Context, string) (err er
 func (api *DummyObjectLayer) IsNotificationSupported() (b bool) {
 	return
 }
+func (api *DummyObjectLayer) IsListenBucketSupported() (b bool) {
+	return
+}
 
 func (api *DummyObjectLayer) IsEncryptionSupported() (b bool) {
 	return

cmd/endpoint.go

@@ -455,7 +455,12 @@ func CreateEndpoints(serverAddr string, args ...[]string) (string, EndpointList,
 		return serverAddr, endpoints, setupType, err
 	}
 
-	updateDomainIPs(uniqueArgs)
+	_, dok := os.LookupEnv("MINIO_DOMAIN")
+	_, eok := os.LookupEnv("MINIO_ETCD_ENDPOINTS")
+	_, iok := os.LookupEnv("MINIO_PUBLIC_IPS")
+	if dok && eok && !iok {
+		updateDomainIPs(uniqueArgs)
+	}
 
 	setupType = DistXLSetupType
 	return serverAddr, endpoints, setupType, nil
@@ -509,21 +514,21 @@ func GetRemotePeers(endpoints EndpointList) []string {
 	return peerSet.ToSlice()
 }
 
-// In federated and distributed setup, update IP addresses of the hosts passed in command line
-// if MINIO_PUBLIC_IPS are not set manually
 func updateDomainIPs(endPoints set.StringSet) {
-	_, dok := os.LookupEnv("MINIO_DOMAIN")
-	_, eok := os.LookupEnv("MINIO_ETCD_ENDPOINTS")
-	_, iok := os.LookupEnv("MINIO_PUBLIC_IPS")
-	if dok && eok && !iok {
-		globalDomainIPs = set.NewStringSet()
-		for e := range endPoints {
-			host, _, _ := net.SplitHostPort(e)
-			ipList, _ := getHostIP4(host)
-			remoteIPList := ipList.FuncMatch(func(ip string, matchString string) bool {
-				return !strings.HasPrefix(ip, "127.")
-			}, "")
-			globalDomainIPs.Add(remoteIPList.ToSlice()[0])
+	ipList := set.NewStringSet()
+	for e := range endPoints {
+		host, _, err := net.SplitHostPort(e)
+		if err != nil {
+			if strings.Contains(err.Error(), "missing port in address") {
+				host = e
+			} else {
+				continue
+			}
 		}
+		IPs, _ := getHostIP4(host)
+		ipList = ipList.Union(IPs)
 	}
+	globalDomainIPs = ipList.FuncMatch(func(ip string, matchString string) bool {
+		return !strings.HasPrefix(ip, "127.")
+	}, "")
 }

cmd/format-fs.go

@@ -24,7 +24,6 @@ import (
 	"path"
 	"time"
 
-	"github.com/minio/minio/cmd/logger"
 	"github.com/minio/minio/pkg/lock"
 )
 
@@ -273,7 +272,7 @@ func initFormatFS(ctx context.Context, fsPath string) (rlk *lock.RLockedFile, er
 			rlk.Close()
 			return nil, err
 		}
-		logger.SetDeploymentID(id)
+		globalDeploymentID = id
 		return rlk, nil
 	}
 }

cmd/format-xl.go

@@ -381,6 +381,7 @@ func saveFormatXL(disk StorageAPI, format interface{}) error {
 
 var ignoredHiddenDirectories = []string{
 	minioMetaBucket,
+	".snapshot",
 	"lost+found",
 	"$RECYCLE.BIN",
 	"System Volume Information",

cmd/fs-v1.go

@@ -187,14 +187,9 @@ func (fs *FSObjects) diskUsage(doneCh chan struct{}) {
 		case <-doneCh:
 			return errWalkAbort
 		default:
-			var fi os.FileInfo
-			var err error
-			if hasSuffix(entry, slashSeparator) {
-				fi, err = fsStatDir(ctx, entry)
-			} else {
-				fi, err = fsStatFile(ctx, entry)
-			}
+			fi, err := os.Stat(entry)
 			if err != nil {
+				err = osErrToFSFileErr(err)
 				return err
 			}
 			atomic.AddUint64(&fs.totalUsed, uint64(fi.Size()))
@@ -226,14 +221,9 @@ func (fs *FSObjects) diskUsage(doneCh chan struct{}) {
 					}
 				}
 
-				var fi os.FileInfo
-				var err error
-				if hasSuffix(entry, slashSeparator) {
-					fi, err = fsStatDir(ctx, entry)
-				} else {
-					fi, err = fsStatFile(ctx, entry)
-				}
+				fi, err := os.Stat(entry)
 				if err != nil {
+					err = osErrToFSFileErr(err)
 					return err
 				}
 				usage = usage + uint64(fi.Size())
@@ -1316,6 +1306,11 @@ func (fs *FSObjects) IsNotificationSupported() bool {
 	return true
 }
 
+// IsListenBucketSupported returns whether listen bucket notification is applicable for this layer.
+func (fs *FSObjects) IsListenBucketSupported() bool {
+	return true
+}
+
 // IsEncryptionSupported returns whether server side encryption is applicable for this layer.
 func (fs *FSObjects) IsEncryptionSupported() bool {
 	return true

cmd/gateway-main.go

@@ -41,7 +41,7 @@ func init() {
 var (
 	gatewayCmd = cli.Command{
 		Name:            "gateway",
-		Usage:           "Start object storage gateway.",
+		Usage:           "start object storage gateway",
 		Flags:           append(serverFlags, globalFlags...),
 		HideHelpCommand: true,
 	}
@@ -135,7 +135,8 @@ func StartGateway(ctx *cli.Context, gw Gateway) {
 	handleCommonCmdArgs(ctx)
 
 	// Get port to listen on from gateway address
-	_, gatewayPort, pErr := net.SplitHostPort(gatewayAddr)
+	var pErr error
+	_, globalMinioPort, pErr = net.SplitHostPort(gatewayAddr)
 	if pErr != nil {
 		logger.FatalIf(pErr, "Unable to start gateway")
 	}
@@ -144,7 +145,7 @@ func StartGateway(ctx *cli.Context, gw Gateway) {
 	// to IPv6 address ie minio will start listening on IPv6 address whereas another
 	// (non-)minio process is listening on IPv4 of given port.
 	// To avoid this error situation we check for port availability.
-	logger.FatalIf(checkPortAvailability(gatewayPort), "Unable to start the gateway")
+	logger.FatalIf(checkPortAvailability(globalMinioPort), "Unable to start the gateway")
 
 	// Create certs path.
 	logger.FatalIf(createConfigDir(), "Unable to create configuration directories")
@@ -195,6 +196,15 @@ func StartGateway(ctx *cli.Context, gw Gateway) {
 	// Add API router.
 	registerAPIRouter(router)
 
+	// Dummy endpoint representing gateway instance.
+	globalEndpoints = []Endpoint{{
+		URL:     &url.URL{Path: "/minio/gateway"},
+		IsLocal: true,
+	}}
+
+	// Initialize Admin Peers.
+	initGlobalAdminPeers(globalEndpoints)
+
 	var getCert certs.GetCertificateFunc
 	if globalTLSCerts != nil {
 		getCert = globalTLSCerts.GetCertificate
@@ -220,26 +230,30 @@ func StartGateway(ctx *cli.Context, gw Gateway) {
 
 	// Create a new config system.
 	globalConfigSys = NewConfigSys()
+	if globalEtcdClient != nil && gatewayName == "nas" {
+		// Initialize server config.
+		_ = globalConfigSys.Init(newObject)
+	} else {
+		// Initialize server config.
+		srvCfg := newServerConfig()
 
-	// Initialize server config.
-	srvCfg := newServerConfig()
+		// Override any values from ENVs.
+		srvCfg.loadFromEnvs()
 
-	// Override any values from ENVs.
-	srvCfg.loadFromEnvs()
+		// Load values to cached global values.
+		srvCfg.loadToCachedConfigs()
 
-	// Load values to cached global values.
-	srvCfg.loadToCachedConfigs()
-
-	// hold the mutex lock before a new config is assigned.
-	globalServerConfigMu.Lock()
-	globalServerConfig = srvCfg
-	globalServerConfigMu.Unlock()
+		// hold the mutex lock before a new config is assigned.
+		globalServerConfigMu.Lock()
+		globalServerConfig = srvCfg
+		globalServerConfigMu.Unlock()
+	}
 
 	// Load logger subsystem
 	loadLoggers()
 
 	// This is only to uniquely identify each gateway deployments.
-	logger.SetDeploymentID(os.Getenv("MINIO_GATEWAY_DEPLOYMENT_ID"))
+	globalDeploymentID = os.Getenv("MINIO_GATEWAY_DEPLOYMENT_ID")
 
 	var cacheConfig = globalServerConfig.GetCacheConfig()
 	if len(cacheConfig.Drives) > 0 {
@@ -256,7 +270,7 @@ func StartGateway(ctx *cli.Context, gw Gateway) {
 	globalIAMSys = NewIAMSys()
 	if globalEtcdClient != nil {
 		// Initialize IAM sys.
-		go globalIAMSys.Init(newObject)
+		_ = globalIAMSys.Init(newObject)
 	}
 
 	// Create new policy system.
@@ -267,7 +281,9 @@ func StartGateway(ctx *cli.Context, gw Gateway) {
 
 	// Create new notification system.
 	globalNotificationSys = NewNotificationSys(globalServerConfig, globalEndpoints)
-
+	if globalEtcdClient != nil && newObject.IsNotificationSupported() {
+		_ = globalNotificationSys.Init(newObject)
+	}
 	// Once endpoints are finalized, initialize the new object api.
 	globalObjLayerMutex.Lock()
 	globalObjectAPI = newObject

cmd/gateway-startup-msg.go

@@ -61,6 +61,7 @@ func printGatewayCommonMsg(apiEndpoints []string) {
 		logger.StartupMessage(colorBlue("AccessKey: ") + colorBold(fmt.Sprintf("%s ", cred.AccessKey)))
 		logger.StartupMessage(colorBlue("SecretKey: ") + colorBold(fmt.Sprintf("%s ", cred.SecretKey)))
 	}
+	printEventNotifiers()
 
 	if globalIsBrowserEnabled {
 		logger.StartupMessage(colorBlue("\nBrowser Access:"))

cmd/gateway-unsupported.go

@@ -132,6 +132,11 @@ func (a GatewayUnsupported) IsNotificationSupported() bool {
 	return false
 }
 
+// IsListenBucketSupported returns whether listen bucket notification is applicable for this layer.
+func (a GatewayUnsupported) IsListenBucketSupported() bool {
+	return false
+}
+
 // IsEncryptionSupported returns whether server side encryption is applicable for this layer.
 func (a GatewayUnsupported) IsEncryptionSupported() bool {
 	return false

cmd/gateway/b2/gateway-b2.go

@@ -92,7 +92,7 @@ EXAMPLES:
 `
 	minio.RegisterGatewayCommand(cli.Command{
 		Name:               b2Backend,
-		Usage:              "Backblaze B2.",
+		Usage:              "Backblaze B2",
 		Action:             b2GatewayMain,
 		CustomHelpTemplate: b2GatewayTemplate,
 		HideHelpCommand:    true,

cmd/gateway/gcs/gateway-gcs.go

@@ -147,7 +147,7 @@ EXAMPLES:
 
 	minio.RegisterGatewayCommand(cli.Command{
 		Name:               gcsBackend,
-		Usage:              "Google Cloud Storage.",
+		Usage:              "Google Cloud Storage",
 		Action:             gcsGatewayMain,
 		CustomHelpTemplate: gcsGatewayTemplate,
 		HideHelpCommand:    true,
@@ -206,11 +206,10 @@ func (g *GCS) NewGatewayLayer(creds auth.Credentials) (minio.ObjectLayer, error)
 	gcs := &gcsGateway{
 		client:    client,
 		projectID: g.projectID,
-		ctx:       ctx,
 	}
 
 	// Start background process to cleanup old files in minio.sys.tmp
-	go gcs.CleanupGCSMinioSysTmp()
+	go gcs.CleanupGCSMinioSysTmp(ctx)
 	return gcs, nil
 }
 
@@ -349,7 +348,6 @@ type gcsGateway struct {
 	minio.GatewayUnsupported
 	client    *storage.Client
 	projectID string
-	ctx       context.Context
 }
 
 // Returns projectID from the GOOGLE_APPLICATION_CREDENTIALS file.
@@ -366,8 +364,8 @@ func gcsParseProjectID(credsFile string) (projectID string, err error) {
 }
 
 // Cleanup old files in minio.sys.tmp of the given bucket.
-func (l *gcsGateway) CleanupGCSMinioSysTmpBucket(bucket string) {
-	it := l.client.Bucket(bucket).Objects(l.ctx, &storage.Query{Prefix: minio.GatewayMinioSysTmp, Versions: false})
+func (l *gcsGateway) CleanupGCSMinioSysTmpBucket(ctx context.Context, bucket string) {
+	it := l.client.Bucket(bucket).Objects(ctx, &storage.Query{Prefix: minio.GatewayMinioSysTmp, Versions: false})
 	for {
 		attrs, err := it.Next()
 		if err != nil {
@@ -380,7 +378,7 @@ func (l *gcsGateway) CleanupGCSMinioSysTmpBucket(bucket string) {
 		}
 		if time.Since(attrs.Updated) > gcsMultipartExpiry {
 			// Delete files older than 2 weeks.
-			err := l.client.Bucket(bucket).Object(attrs.Name).Delete(l.ctx)
+			err := l.client.Bucket(bucket).Object(attrs.Name).Delete(ctx)
 			if err != nil {
 				reqInfo := &logger.ReqInfo{BucketName: bucket, ObjectName: attrs.Name}
 				ctx := logger.SetReqInfo(context.Background(), reqInfo)
@@ -392,9 +390,9 @@ func (l *gcsGateway) CleanupGCSMinioSysTmpBucket(bucket string) {
 }
 
 // Cleanup old files in minio.sys.tmp of all buckets.
-func (l *gcsGateway) CleanupGCSMinioSysTmp() {
+func (l *gcsGateway) CleanupGCSMinioSysTmp(ctx context.Context) {
 	for {
-		it := l.client.Buckets(l.ctx, l.projectID)
+		it := l.client.Buckets(ctx, l.projectID)
 		for {
 			attrs, err := it.Next()
 			if err != nil {
@@ -404,7 +402,7 @@ func (l *gcsGateway) CleanupGCSMinioSysTmp() {
 				}
 				break
 			}
-			l.CleanupGCSMinioSysTmpBucket(attrs.Name)
+			l.CleanupGCSMinioSysTmpBucket(ctx, attrs.Name)
 		}
 		// Run the cleanup loop every 1 day.
 		time.Sleep(gcsCleanupInterval)
@@ -431,7 +429,7 @@ func (l *gcsGateway) MakeBucketWithLocation(ctx context.Context, bucket, locatio
 		location = "us"
 	}
 
-	err := bkt.Create(l.ctx, l.projectID, &storage.BucketAttrs{
+	err := bkt.Create(ctx, l.projectID, &storage.BucketAttrs{
 		Location: location,
 	})
 	logger.LogIf(ctx, err)
@@ -440,7 +438,7 @@ func (l *gcsGateway) MakeBucketWithLocation(ctx context.Context, bucket, locatio
 
 // GetBucketInfo - Get bucket metadata..
 func (l *gcsGateway) GetBucketInfo(ctx context.Context, bucket string) (minio.BucketInfo, error) {
-	attrs, err := l.client.Bucket(bucket).Attrs(l.ctx)
+	attrs, err := l.client.Bucket(bucket).Attrs(ctx)
 	if err != nil {
 		logger.LogIf(ctx, err)
 		return minio.BucketInfo{}, gcsToObjectError(err, bucket)
@@ -454,7 +452,7 @@ func (l *gcsGateway) GetBucketInfo(ctx context.Context, bucket string) (minio.Bu
 
 // ListBuckets lists all buckets under your project-id on GCS.
 func (l *gcsGateway) ListBuckets(ctx context.Context) (buckets []minio.BucketInfo, err error) {
-	it := l.client.Buckets(l.ctx, l.projectID)
+	it := l.client.Buckets(ctx, l.projectID)
 
 	// Iterate and capture all the buckets.
 	for {
@@ -479,7 +477,7 @@ func (l *gcsGateway) ListBuckets(ctx context.Context) (buckets []minio.BucketInf
 
 // DeleteBucket delete a bucket on GCS.
 func (l *gcsGateway) DeleteBucket(ctx context.Context, bucket string) error {
-	itObject := l.client.Bucket(bucket).Objects(l.ctx, &storage.Query{
+	itObject := l.client.Bucket(bucket).Objects(ctx, &storage.Query{
 		Delimiter: "/",
 		Versions:  false,
 	})
@@ -509,7 +507,7 @@ func (l *gcsGateway) DeleteBucket(ctx context.Context, bucket string) error {
 	}
 	if gcsMinioPathFound {
 		// Remove minio.sys.tmp before deleting the bucket.
-		itObject = l.client.Bucket(bucket).Objects(l.ctx, &storage.Query{Versions: false, Prefix: minio.GatewayMinioSysTmp})
+		itObject = l.client.Bucket(bucket).Objects(ctx, &storage.Query{Versions: false, Prefix: minio.GatewayMinioSysTmp})
 		for {
 			objAttrs, err := itObject.Next()
 			if err == iterator.Done {
@@ -519,14 +517,14 @@ func (l *gcsGateway) DeleteBucket(ctx context.Context, bucket string) error {
 				logger.LogIf(ctx, err)
 				return gcsToObjectError(err)
 			}
-			err = l.client.Bucket(bucket).Object(objAttrs.Name).Delete(l.ctx)
+			err = l.client.Bucket(bucket).Object(objAttrs.Name).Delete(ctx)
 			if err != nil {
 				logger.LogIf(ctx, err)
 				return gcsToObjectError(err)
 			}
 		}
 	}
-	err := l.client.Bucket(bucket).Delete(l.ctx)
+	err := l.client.Bucket(bucket).Delete(ctx)
 	logger.LogIf(ctx, err)
 	return gcsToObjectError(err, bucket)
 }
@@ -561,7 +559,7 @@ func (l *gcsGateway) ListObjects(ctx context.Context, bucket string, prefix stri
 		return minio.ListObjectsInfo{}, nil
 	}
 
-	it := l.client.Bucket(bucket).Objects(l.ctx, &storage.Query{
+	it := l.client.Bucket(bucket).Objects(ctx, &storage.Query{
 		Delimiter: delimiter,
 		Prefix:    prefix,
 		Versions:  false,
@@ -668,7 +666,7 @@ func (l *gcsGateway) ListObjectsV2(ctx context.Context, bucket, prefix, continua
 		return minio.ListObjectsV2Info{ContinuationToken: continuationToken}, nil
 	}
 
-	it := l.client.Bucket(bucket).Objects(l.ctx, &storage.Query{
+	it := l.client.Bucket(bucket).Objects(ctx, &storage.Query{
 		Delimiter: delimiter,
 		Prefix:    prefix,
 		Versions:  false,
@@ -769,7 +767,7 @@ func (l *gcsGateway) GetObjectNInfo(ctx context.Context, bucket, object string,
 func (l *gcsGateway) GetObject(ctx context.Context, bucket string, key string, startOffset int64, length int64, writer io.Writer, etag string, opts minio.ObjectOptions) error {
 	// if we want to mimic S3 behavior exactly, we need to verify if bucket exists first,
 	// otherwise gcs will just return object not exist in case of non-existing bucket
-	if _, err := l.client.Bucket(bucket).Attrs(l.ctx); err != nil {
+	if _, err := l.client.Bucket(bucket).Attrs(ctx); err != nil {
 		logger.LogIf(ctx, err)
 		return gcsToObjectError(err, bucket)
 	}
@@ -781,7 +779,7 @@ func (l *gcsGateway) GetObject(ctx context.Context, bucket string, key string, s
 	// Calling ReadCompressed with true accomplishes that.
 	object := l.client.Bucket(bucket).Object(key).ReadCompressed(true)
 
-	r, err := object.NewRangeReader(l.ctx, startOffset, length)
+	r, err := object.NewRangeReader(ctx, startOffset, length)
 	if err != nil {
 		logger.LogIf(ctx, err)
 		return gcsToObjectError(err, bucket, key)
@@ -864,12 +862,12 @@ func applyMetadataToGCSAttrs(metadata map[string]string, attrs *storage.ObjectAt
 func (l *gcsGateway) GetObjectInfo(ctx context.Context, bucket string, object string, opts minio.ObjectOptions) (minio.ObjectInfo, error) {
 	// if we want to mimic S3 behavior exactly, we need to verify if bucket exists first,
 	// otherwise gcs will just return object not exist in case of non-existing bucket
-	if _, err := l.client.Bucket(bucket).Attrs(l.ctx); err != nil {
+	if _, err := l.client.Bucket(bucket).Attrs(ctx); err != nil {
 		logger.LogIf(ctx, err)
 		return minio.ObjectInfo{}, gcsToObjectError(err, bucket)
 	}
 
-	attrs, err := l.client.Bucket(bucket).Object(object).Attrs(l.ctx)
+	attrs, err := l.client.Bucket(bucket).Object(object).Attrs(ctx)
 	if err != nil {
 		logger.LogIf(ctx, err)
 		return minio.ObjectInfo{}, gcsToObjectError(err, bucket, object)
@@ -884,14 +882,14 @@ func (l *gcsGateway) PutObject(ctx context.Context, bucket string, key string, r
 
 	// if we want to mimic S3 behavior exactly, we need to verify if bucket exists first,
 	// otherwise gcs will just return object not exist in case of non-existing bucket
-	if _, err := l.client.Bucket(bucket).Attrs(l.ctx); err != nil {
+	if _, err := l.client.Bucket(bucket).Attrs(ctx); err != nil {
 		logger.LogIf(ctx, err)
 		return minio.ObjectInfo{}, gcsToObjectError(err, bucket)
 	}
 
 	object := l.client.Bucket(bucket).Object(key)
 
-	w := object.NewWriter(l.ctx)
+	w := object.NewWriter(ctx)
 	// Disable "chunked" uploading in GCS client if the size of the data to be uploaded is below
 	// the current chunk-size of the writer. This avoids an unnecessary memory allocation.
 	if data.Size() < int64(w.ChunkSize) {
@@ -909,7 +907,7 @@ func (l *gcsGateway) PutObject(ctx context.Context, bucket string, key string, r
 	// Close the object writer upon success.
 	w.Close()
 
-	attrs, err := object.Attrs(l.ctx)
+	attrs, err := object.Attrs(ctx)
 	if err != nil {
 		logger.LogIf(ctx, err)
 		return minio.ObjectInfo{}, gcsToObjectError(err, bucket, key)
@@ -928,7 +926,7 @@ func (l *gcsGateway) CopyObject(ctx context.Context, srcBucket string, srcObject
 	copier := dst.CopierFrom(src)
 	applyMetadataToGCSAttrs(srcInfo.UserDefined, &copier.ObjectAttrs)
 
-	attrs, err := copier.Run(l.ctx)
+	attrs, err := copier.Run(ctx)
 	if err != nil {
 		logger.LogIf(ctx, err)
 		return minio.ObjectInfo{}, gcsToObjectError(err, destBucket, destObject)
@@ -939,7 +937,7 @@ func (l *gcsGateway) CopyObject(ctx context.Context, srcBucket string, srcObject
 
 // DeleteObject - Deletes a blob in bucket
 func (l *gcsGateway) DeleteObject(ctx context.Context, bucket string, object string) error {
-	err := l.client.Bucket(bucket).Object(object).Delete(l.ctx)
+	err := l.client.Bucket(bucket).Object(object).Delete(ctx)
 	if err != nil {
 		logger.LogIf(ctx, err)
 		return gcsToObjectError(err, bucket, object)
@@ -956,7 +954,7 @@ func (l *gcsGateway) NewMultipartUpload(ctx context.Context, bucket string, key
 	// generate name for part zero
 	meta := gcsMultipartMetaName(uploadID)
 
-	w := l.client.Bucket(bucket).Object(meta).NewWriter(l.ctx)
+	w := l.client.Bucket(bucket).Object(meta).NewWriter(ctx)
 	defer w.Close()
 
 	applyMetadataToGCSAttrs(metadata, &w.ObjectAttrs)
@@ -1056,7 +1054,7 @@ func (l *gcsGateway) ListMultipartUploads(ctx context.Context, bucket string, pr
 // Checks if minio.sys.tmp/multipart/v1/<upload-id>/gcs.json exists, returns
 // an object layer compatible error upon any error.
 func (l *gcsGateway) checkUploadIDExists(ctx context.Context, bucket string, key string, uploadID string) error {
-	_, err := l.client.Bucket(bucket).Object(gcsMultipartMetaName(uploadID)).Attrs(l.ctx)
+	_, err := l.client.Bucket(bucket).Object(gcsMultipartMetaName(uploadID)).Attrs(ctx)
 	logger.LogIf(ctx, err)
 	return gcsToObjectError(err, bucket, key, uploadID)
 }
@@ -1073,7 +1071,7 @@ func (l *gcsGateway) PutObjectPart(ctx context.Context, bucket string, key strin
 		etag = minio.GenETag()
 	}
 	object := l.client.Bucket(bucket).Object(gcsMultipartDataName(uploadID, partNumber, etag))
-	w := object.NewWriter(l.ctx)
+	w := object.NewWriter(ctx)
 	// Disable "chunked" uploading in GCS client. If enabled, it can cause a corner case
 	// where it tries to upload 0 bytes in the last chunk and get error from server.
 	w.ChunkSize = 0
@@ -1186,7 +1184,7 @@ func (l *gcsGateway) cleanupMultipartUpload(ctx context.Context, bucket, key, up
 	prefix := fmt.Sprintf("%s/%s/", gcsMinioMultipartPathV1, uploadID)
 
 	// iterate through all parts and delete them
-	it := l.client.Bucket(bucket).Objects(l.ctx, &storage.Query{Prefix: prefix, Versions: false})
+	it := l.client.Bucket(bucket).Objects(ctx, &storage.Query{Prefix: prefix, Versions: false})
 
 	for {
 		attrs, err := it.Next()
@@ -1200,7 +1198,7 @@ func (l *gcsGateway) cleanupMultipartUpload(ctx context.Context, bucket, key, up
 
 		object := l.client.Bucket(bucket).Object(attrs.Name)
 		// Ignore the error as parallel AbortMultipartUpload might have deleted it.
-		object.Delete(l.ctx)
+		object.Delete(ctx)
 	}
 
 	return nil
@@ -1222,13 +1220,13 @@ func (l *gcsGateway) CompleteMultipartUpload(ctx context.Context, bucket string,
 	meta := gcsMultipartMetaName(uploadID)
 	object := l.client.Bucket(bucket).Object(meta)
 
-	partZeroAttrs, err := object.Attrs(l.ctx)
+	partZeroAttrs, err := object.Attrs(ctx)
 	if err != nil {
 		logger.LogIf(ctx, err)
 		return minio.ObjectInfo{}, gcsToObjectError(err, bucket, key, uploadID)
 	}
 
-	r, err := object.NewReader(l.ctx)
+	r, err := object.NewReader(ctx)
 	if err != nil {
 		logger.LogIf(ctx, err)
 		return minio.ObjectInfo{}, gcsToObjectError(err, bucket, key)
@@ -1259,7 +1257,7 @@ func (l *gcsGateway) CompleteMultipartUpload(ctx context.Context, bucket string,
 	for i, uploadedPart := range uploadedParts {
 		parts = append(parts, l.client.Bucket(bucket).Object(gcsMultipartDataName(uploadID,
 			uploadedPart.PartNumber, uploadedPart.ETag)))
-		partAttr, pErr := l.client.Bucket(bucket).Object(gcsMultipartDataName(uploadID, uploadedPart.PartNumber, uploadedPart.ETag)).Attrs(l.ctx)
+		partAttr, pErr := l.client.Bucket(bucket).Object(gcsMultipartDataName(uploadID, uploadedPart.PartNumber, uploadedPart.ETag)).Attrs(ctx)
 		if pErr != nil {
 			logger.LogIf(ctx, pErr)
 			return minio.ObjectInfo{}, gcsToObjectError(pErr, bucket, key, uploadID)
@@ -1305,7 +1303,7 @@ func (l *gcsGateway) CompleteMultipartUpload(ctx context.Context, bucket string,
 			composer.ContentType = partZeroAttrs.ContentType
 			composer.Metadata = partZeroAttrs.Metadata
 
-			if _, err = composer.Run(l.ctx); err != nil {
+			if _, err = composer.Run(ctx); err != nil {
 				logger.LogIf(ctx, err)
 				return minio.ObjectInfo{}, gcsToObjectError(err, bucket, key)
 			}
@@ -1322,7 +1320,7 @@ func (l *gcsGateway) CompleteMultipartUpload(ctx context.Context, bucket string,
 	composer.ContentDisposition = partZeroAttrs.ContentDisposition
 	composer.ContentLanguage = partZeroAttrs.ContentLanguage
 	composer.Metadata = partZeroAttrs.Metadata
-	attrs, err := composer.Run(l.ctx)
+	attrs, err := composer.Run(ctx)
 	if err != nil {
 		logger.LogIf(ctx, err)
 		return minio.ObjectInfo{}, gcsToObjectError(err, bucket, key)
@@ -1362,7 +1360,7 @@ func (l *gcsGateway) SetBucketPolicy(ctx context.Context, bucket string, bucketP
 
 	acl := l.client.Bucket(bucket).ACL()
 	if policies[0].Policy == miniogopolicy.BucketPolicyNone {
-		if err := acl.Delete(l.ctx, storage.AllUsers); err != nil {
+		if err := acl.Delete(ctx, storage.AllUsers); err != nil {
 			logger.LogIf(ctx, err)
 			return gcsToObjectError(err, bucket)
 		}
@@ -1380,7 +1378,7 @@ func (l *gcsGateway) SetBucketPolicy(ctx context.Context, bucket string, bucketP
 		return minio.NotImplemented{}
 	}
 
-	if err := acl.Set(l.ctx, storage.AllUsers, role); err != nil {
+	if err := acl.Set(ctx, storage.AllUsers, role); err != nil {
 		logger.LogIf(ctx, err)
 		return gcsToObjectError(err, bucket)
 	}
@@ -1390,7 +1388,7 @@ func (l *gcsGateway) SetBucketPolicy(ctx context.Context, bucket string, bucketP
 
 // GetBucketPolicy - Get policy on bucket
 func (l *gcsGateway) GetBucketPolicy(ctx context.Context, bucket string) (*policy.Policy, error) {
-	rules, err := l.client.Bucket(bucket).ACL().List(l.ctx)
+	rules, err := l.client.Bucket(bucket).ACL().List(ctx)
 	if err != nil {
 		return nil, gcsToObjectError(err, bucket)
 	}
@@ -1449,7 +1447,7 @@ func (l *gcsGateway) GetBucketPolicy(ctx context.Context, bucket string) (*polic
 // DeleteBucketPolicy - Delete all policies on bucket
 func (l *gcsGateway) DeleteBucketPolicy(ctx context.Context, bucket string) error {
 	// This only removes the storage.AllUsers policies
-	if err := l.client.Bucket(bucket).ACL().Delete(l.ctx, storage.AllUsers); err != nil {
+	if err := l.client.Bucket(bucket).ACL().Delete(ctx, storage.AllUsers); err != nil {
 		return gcsToObjectError(err, bucket)
 	}
 

cmd/gateway/manta/gateway-manta.go

@@ -108,7 +108,7 @@ EXAMPLES:
 
 	minio.RegisterGatewayCommand(cli.Command{
 		Name:               mantaBackend,
-		Usage:              "Manta Object Storage.",
+		Usage:              "Manta Object Storage",
 		Action:             mantaGatewayMain,
 		CustomHelpTemplate: mantaGatewayTemplate,
 		HideHelpCommand:    true,

cmd/gateway/nas/gateway-nas.go

@@ -74,7 +74,7 @@ EXAMPLES:
 
 	minio.RegisterGatewayCommand(cli.Command{
 		Name:               nasBackend,
-		Usage:              "Network-attached storage (NAS).",
+		Usage:              "Network-attached storage (NAS)",
 		Action:             nasGatewayMain,
 		CustomHelpTemplate: nasGatewayTemplate,
 		HideHelpCommand:    true,
@@ -108,7 +108,7 @@ func (g *NAS) NewGatewayLayer(creds auth.Credentials) (minio.ObjectLayer, error)
 	if err != nil {
 		return nil, err
 	}
-	return &nasObjects{newObject.(*minio.FSObjects)}, nil
+	return &nasObjects{newObject}, nil
 }
 
 // Production - nas gateway is production ready.
@@ -116,17 +116,12 @@ func (g *NAS) Production() bool {
 	return true
 }
 
+// IsListenBucketSupported returns whether listen bucket notification is applicable for this gateway.
+func (g *NAS) IsListenBucketSupported() bool {
+	return false
+}
+
 // nasObjects implements gateway for Minio and S3 compatible object storage servers.
 type nasObjects struct {
-	*minio.FSObjects
-}
-
-// IsNotificationSupported returns whether notifications are applicable for this layer.
-func (l *nasObjects) IsNotificationSupported() bool {
-	return false
-}
-
-// IsCompressionSupported returns whether compression is applicable for this layer.
-func (l *nasObjects) IsCompressionSupported() bool {
-	return false
+	minio.ObjectLayer
 }

cmd/gateway/oss/gateway-oss.go

@@ -98,7 +98,7 @@ EXAMPLES:
 
 	minio.RegisterGatewayCommand(cli.Command{
 		Name:               "oss",
-		Usage:              "Alibaba Cloud (Aliyun) Object Storage Service (OSS).",
+		Usage:              "Alibaba Cloud (Aliyun) Object Storage Service (OSS)",
 		Action:             ossGatewayMain,
 		CustomHelpTemplate: ossGatewayTemplate,
 		HideHelpCommand:    true,

cmd/gateway/s3/gateway-s3.go

@@ -111,7 +111,7 @@ EXAMPLES:
 
 	minio.RegisterGatewayCommand(cli.Command{
 		Name:               s3Backend,
-		Usage:              "Amazon Simple Storage Service (S3).",
+		Usage:              "Amazon Simple Storage Service (S3)",
 		Action:             s3GatewayMain,
 		CustomHelpTemplate: s3GatewayTemplate,
 		HideHelpCommand:    true,
@@ -510,12 +510,12 @@ func (l *s3Objects) AbortMultipartUpload(ctx context.Context, bucket string, obj
 
 // CompleteMultipartUpload completes ongoing multipart upload and finalizes object
 func (l *s3Objects) CompleteMultipartUpload(ctx context.Context, bucket string, object string, uploadID string, uploadedParts []minio.CompletePart, opts minio.ObjectOptions) (oi minio.ObjectInfo, e error) {
-	err := l.Client.CompleteMultipartUpload(bucket, object, uploadID, minio.ToMinioClientCompleteParts(uploadedParts))
+	etag, err := l.Client.CompleteMultipartUpload(bucket, object, uploadID, minio.ToMinioClientCompleteParts(uploadedParts))
 	if err != nil {
 		return oi, minio.ErrorRespToObjectError(err, bucket, object)
 	}
 
-	return l.GetObjectInfo(ctx, bucket, object, minio.ObjectOptions{})
+	return minio.ObjectInfo{Bucket: bucket, Name: object, ETag: etag}, nil
 }
 
 // SetBucketPolicy sets policy on bucket

cmd/gateway/sia/gateway-sia.go

@@ -97,7 +97,7 @@ EXAMPLES:
 
 	minio.RegisterGatewayCommand(cli.Command{
 		Name:               siaBackend,
-		Usage:              "Sia Decentralized Cloud.",
+		Usage:              "Sia Decentralized Cloud",
 		Action:             siaGatewayMain,
 		CustomHelpTemplate: siaGatewayTemplate,
 		HideHelpCommand:    true,

cmd/generic-handlers.go

@@ -91,7 +91,7 @@ func setRequestHeaderSizeLimitHandler(h http.Handler) http.Handler {
 // of the user-defined metadata to 2 KB.
 func (h requestHeaderSizeLimitHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	if isHTTPHeaderSizeTooLarge(r.Header) {
-		writeErrorResponse(w, ErrMetadataTooLarge, r.URL)
+		writeErrorResponse(w, ErrMetadataTooLarge, r.URL, guessIsBrowserReq(r))
 		return
 	}
 	h.Handler.ServeHTTP(w, r)
@@ -134,7 +134,7 @@ func filterReservedMetadata(h http.Handler) http.Handler {
 // would be treated as metadata.
 func (h reservedMetadataHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	if containsReservedMetadata(r.Header) {
-		writeErrorResponse(w, ErrUnsupportedMetadata, r.URL)
+		writeErrorResponse(w, ErrUnsupportedMetadata, r.URL, guessIsBrowserReq(r))
 		return
 	}
 	h.Handler.ServeHTTP(w, r)
@@ -228,7 +228,8 @@ func guessIsRPCReq(req *http.Request) bool {
 	if req == nil {
 		return false
 	}
-	return req.Method == http.MethodPost
+	return req.Method == http.MethodPost &&
+		strings.HasPrefix(req.URL.Path, minioReservedBucketPath+"/")
 }
 
 func (h redirectHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
@@ -300,7 +301,7 @@ func (h minioReservedBucketHandler) ServeHTTP(w http.ResponseWriter, r *http.Req
 		// buckets
 		bucketName, _ := urlPath2BucketObjectName(r.URL.Path)
 		if isMinioReservedBucket(bucketName) || isMinioMetaBucket(bucketName) {
-			writeErrorResponse(w, ErrAllAccessDisabled, r.URL)
+			writeErrorResponse(w, ErrAllAccessDisabled, r.URL, guessIsBrowserReq(r))
 			return
 		}
 	}
@@ -363,14 +364,14 @@ func (h timeValidityHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 			// All our internal APIs are sensitive towards Date
 			// header, for all requests where Date header is not
 			// present we will reject such clients.
-			writeErrorResponse(w, apiErr, r.URL)
+			writeErrorResponse(w, apiErr, r.URL, guessIsBrowserReq(r))
 			return
 		}
 		// Verify if the request date header is shifted by less than globalMaxSkewTime parameter in the past
 		// or in the future, reject request otherwise.
 		curTime := UTCNow()
 		if curTime.Sub(amzDate) > globalMaxSkewTime || amzDate.Sub(curTime) > globalMaxSkewTime {
-			writeErrorResponse(w, ErrRequestTimeTooSkewed, r.URL)
+			writeErrorResponse(w, ErrRequestTimeTooSkewed, r.URL, guessIsBrowserReq(r))
 			return
 		}
 	}
@@ -485,20 +486,20 @@ func (h resourceHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	// If bucketName is present and not objectName check for bucket level resource queries.
 	if bucketName != "" && objectName == "" {
 		if ignoreNotImplementedBucketResources(r) {
-			writeErrorResponse(w, ErrNotImplemented, r.URL)
+			writeErrorResponse(w, ErrNotImplemented, r.URL, guessIsBrowserReq(r))
 			return
 		}
 	}
 	// If bucketName and objectName are present check for its resource queries.
 	if bucketName != "" && objectName != "" {
 		if ignoreNotImplementedObjectResources(r) {
-			writeErrorResponse(w, ErrNotImplemented, r.URL)
+			writeErrorResponse(w, ErrNotImplemented, r.URL, guessIsBrowserReq(r))
 			return
 		}
 	}
 	// A put method on path "/" doesn't make sense, ignore it.
 	if r.Method == http.MethodPut && r.URL.Path == "/" {
-		writeErrorResponse(w, ErrNotImplemented, r.URL)
+		writeErrorResponse(w, ErrNotImplemented, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
@@ -601,14 +602,14 @@ func hasBadPathComponent(path string) bool {
 func (h pathValidityHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	// Check for bad components in URL path.
 	if hasBadPathComponent(r.URL.Path) {
-		writeErrorResponse(w, ErrInvalidResourceName, r.URL)
+		writeErrorResponse(w, ErrInvalidResourceName, r.URL, guessIsBrowserReq(r))
 		return
 	}
 	// Check for bad components in URL query values.
 	for _, vv := range r.URL.Query() {
 		for _, v := range vv {
 			if hasBadPathComponent(v) {
-				writeErrorResponse(w, ErrInvalidResourceName, r.URL)
+				writeErrorResponse(w, ErrInvalidResourceName, r.URL, guessIsBrowserReq(r))
 				return
 			}
 		}
@@ -625,7 +626,9 @@ type bucketForwardingHandler struct {
 }
 
 func (f bucketForwardingHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	if globalDNSConfig == nil || globalDomainName == "" || guessIsBrowserReq(r) || guessIsHealthCheckReq(r) || guessIsMetricsReq(r) || guessIsRPCReq(r) {
+	if globalDNSConfig == nil || globalDomainName == "" ||
+		guessIsBrowserReq(r) || guessIsHealthCheckReq(r) ||
+		guessIsMetricsReq(r) || guessIsRPCReq(r) || isAdminReq(r) {
 		f.handler.ServeHTTP(w, r)
 		return
 	}
@@ -653,9 +656,9 @@ func (f bucketForwardingHandler) ServeHTTP(w http.ResponseWriter, r *http.Reques
 	sr, err := globalDNSConfig.Get(bucket)
 	if err != nil {
 		if err == dns.ErrNoEntriesFound {
-			writeErrorResponse(w, ErrNoSuchBucket, r.URL)
+			writeErrorResponse(w, ErrNoSuchBucket, r.URL, guessIsBrowserReq(r))
 		} else {
-			writeErrorResponse(w, toAPIErrorCode(context.Background(), err), r.URL)
+			writeErrorResponse(w, toAPIErrorCode(context.Background(), err), r.URL, guessIsBrowserReq(r))
 		}
 		return
 	}
@@ -716,31 +719,32 @@ func (l rateLimit) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	// potential pileup on the server.
 	if err := l.Wait(ctx); err != nil {
 		// Send an S3 compatible error, SlowDown.
-		writeErrorResponse(w, ErrSlowDown, r.URL)
+		writeErrorResponse(w, ErrSlowDown, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
 	l.handler.ServeHTTP(w, r)
 }
 
-// requestIDHeaderHandler sets x-amz-request-id header.
-// Previously, this value was set right before a response
-// was sent to the client.So, logger and Error response XML
-// were not using this value.
-// This is set here so that this header can be logged as
-// part of the log entry and Error response XML.
-type requestIDHeaderHandler struct {
+// customHeaderHandler sets x-amz-request-id, x-minio-deployment-id header.
+// Previously, this value was set right before a response was sent to
+// the client. So, logger and Error response XML were not using this
+// value. This is set here so that this header can be logged as
+// part of the log entry, Error response XML and auditing.
+type customHeaderHandler struct {
 	handler http.Handler
 }
 
-func addrequestIDHeader(h http.Handler) http.Handler {
-	return requestIDHeaderHandler{handler: h}
+func addCustomHeaders(h http.Handler) http.Handler {
+	return customHeaderHandler{handler: h}
 }
 
-func (s requestIDHeaderHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	// Set unique request ID for each response.
+func (s customHeaderHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	// Set custom headers such as x-amz-request-id and x-minio-deployment-id
+	// for each request.
 	w.Header().Set(responseRequestIDKey, mustGetRequestID(UTCNow()))
-	s.handler.ServeHTTP(w, r)
+	w.Header().Set(responseDeploymentIDKey, globalDeploymentID)
+	s.handler.ServeHTTP(logger.NewResponseWriter(w), r)
 }
 
 type securityHeaderHandler struct {
@@ -767,7 +771,7 @@ type criticalErrorHandler struct{ handler http.Handler }
 func (h criticalErrorHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	defer func() {
 		if err := recover(); err == logger.ErrCritical { // handle
-			writeErrorResponse(w, ErrInternalError, r.URL)
+			writeErrorResponse(w, ErrInternalError, r.URL, guessIsBrowserReq(r))
 		} else if err != nil {
 			panic(err) // forward other panic calls
 		}
@@ -786,7 +790,7 @@ func (h sseTLSHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		if r.Method == http.MethodHead {
 			writeErrorResponseHeadersOnly(w, ErrInsecureSSECustomerRequest)
 		} else {
-			writeErrorResponse(w, ErrInsecureSSECustomerRequest, r.URL)
+			writeErrorResponse(w, ErrInsecureSSECustomerRequest, r.URL, guessIsBrowserReq(r))
 		}
 		return
 	}

cmd/generic-handlers_test.go

@@ -78,9 +78,16 @@ func TestGuessIsRPC(t *testing.T) {
 	if guessIsRPCReq(nil) {
 		t.Fatal("Unexpected return for nil request")
 	}
+
+	u, err := url.Parse("http://localhost:9000/minio/lock")
+	if err != nil {
+		t.Fatal(err)
+	}
+
 	r := &http.Request{
 		Proto:  "HTTP/1.0",
 		Method: http.MethodPost,
+		URL:    u,
 	}
 	if !guessIsRPCReq(r) {
 		t.Fatal("Test shouldn't fail for a possible net/rpc request.")

cmd/globals.go

@@ -255,6 +255,9 @@ var (
 	// OPA policy system.
 	globalPolicyOPA *iampolicy.Opa
 
+	// Deployment ID - unique per deployment
+	globalDeploymentID string
+
 	// Add new variable global values here.
 )
 

cmd/handler-utils.go

@@ -28,6 +28,7 @@ import (
 	"strings"
 
 	"github.com/minio/minio/cmd/logger"
+	"github.com/minio/minio/pkg/auth"
 	"github.com/minio/minio/pkg/handlers"
 	httptracer "github.com/minio/minio/pkg/handlers"
 )
@@ -176,13 +177,13 @@ func getRedirectPostRawQuery(objInfo ObjectInfo) string {
 	return redirectValues.Encode()
 }
 
-// Returns access key in the request Authorization header.
-func getReqAccessKey(r *http.Request, region string) (accessKey string) {
-	cred, _, _ := getReqAccessKeyV4(r, region)
+// Returns access credentials in the request Authorization header.
+func getReqAccessCred(r *http.Request, region string) (cred auth.Credentials) {
+	cred, _, _ = getReqAccessKeyV4(r, region)
 	if cred.AccessKey == "" {
 		cred, _, _ = getReqAccessKeyV2(r)
 	}
-	return cred.AccessKey
+	return cred
 }
 
 // Extract request params to be sent with event notifiation.
@@ -192,10 +193,11 @@ func extractReqParams(r *http.Request) map[string]string {
 	}
 
 	region := globalServerConfig.GetRegion()
+	cred := getReqAccessCred(r, region)
 	// Success.
 	return map[string]string{
 		"region":          region,
-		"accessKey":       getReqAccessKey(r, region),
+		"accessKey":       cred.AccessKey,
 		"sourceIPAddress": handlers.GetSourceIP(r),
 		// Add more fields here.
 	}
@@ -351,6 +353,6 @@ func getResource(path string, host string, domain string) (string, error) {
 
 // If none of the http routes match respond with MethodNotAllowed
 func notFoundHandler(w http.ResponseWriter, r *http.Request) {
-	writeErrorResponse(w, ErrMethodNotAllowed, r.URL)
+	writeErrorResponse(w, ErrMethodNotAllowed, r.URL, guessIsBrowserReq(r))
 	return
 }

cmd/http/listen_others.go

@@ -1,4 +1,4 @@
-// +build windows plan9
+// +build windows plan9 solaris
 
 /*
  * Minio Cloud Storage, (C) 2018 Minio, Inc.

cmd/logger/audit-logger.go

@@ -1,97 +0,0 @@
-/*
- * Minio Cloud Storage, (C) 2018 Minio, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package logger
-
-import (
-	"context"
-	"net/http"
-	"strings"
-	"time"
-)
-
-// Represents the current version of audit log structure.
-const auditLogVersion = "1"
-
-// AuditEntry - audit entry logs.
-type AuditEntry struct {
-	Version      string            `json:"version"`
-	DeploymentID string            `json:"deploymentid,omitempty"`
-	Time         string            `json:"time"`
-	API          *api              `json:"api,omitempty"`
-	RemoteHost   string            `json:"remotehost,omitempty"`
-	RequestID    string            `json:"requestID,omitempty"`
-	UserAgent    string            `json:"userAgent,omitempty"`
-	ReqQuery     map[string]string `json:"requestQuery,omitempty"`
-	ReqHeader    map[string]string `json:"requestHeader,omitempty"`
-	RespHeader   map[string]string `json:"responseHeader,omitempty"`
-}
-
-// AuditTargets is the list of enabled audit loggers
-var AuditTargets = []LoggingTarget{}
-
-// AddAuditTarget adds a new audit logger target to the
-// list of enabled loggers
-func AddAuditTarget(t LoggingTarget) {
-	AuditTargets = append(AuditTargets, t)
-}
-
-// AuditLog - logs audit logs to all targets.
-func AuditLog(ctx context.Context, w http.ResponseWriter, r *http.Request) {
-	if Disable {
-		return
-	}
-
-	req := GetReqInfo(ctx)
-	if req == nil {
-		req = &ReqInfo{API: "SYSTEM"}
-	}
-
-	reqQuery := make(map[string]string)
-	for k, v := range r.URL.Query() {
-		reqQuery[k] = strings.Join(v, ",")
-	}
-	reqHeader := make(map[string]string)
-	for k, v := range r.Header {
-		reqHeader[k] = strings.Join(v, ",")
-	}
-	respHeader := make(map[string]string)
-	for k, v := range w.Header() {
-		respHeader[k] = strings.Join(v, ",")
-	}
-
-	// Send audit logs only to http targets.
-	for _, t := range AuditTargets {
-		t.send(AuditEntry{
-			Version:      auditLogVersion,
-			DeploymentID: deploymentID,
-			RemoteHost:   req.RemoteHost,
-			RequestID:    req.RequestID,
-			UserAgent:    req.UserAgent,
-			Time:         time.Now().UTC().Format(time.RFC3339Nano),
-			API: &api{
-				Name: req.API,
-				Args: &args{
-					Bucket: req.BucketName,
-					Object: req.ObjectName,
-				},
-			},
-			ReqQuery:   reqQuery,
-			ReqHeader:  reqHeader,
-			RespHeader: respHeader,
-		})
-	}
-}

cmd/logger/audit.go

@@ -0,0 +1,68 @@
+/*
+ * Minio Cloud Storage, (C) 2018 Minio, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package logger
+
+import (
+	"net/http"
+
+	"github.com/minio/minio/cmd/logger/message/audit"
+)
+
+// ResponseWriter - is a wrapper to trap the http response status code.
+type ResponseWriter struct {
+	http.ResponseWriter
+	statusCode int
+}
+
+// NewResponseWriter - returns a wrapped response writer to trap
+// http status codes for auditiing purposes.
+func NewResponseWriter(w http.ResponseWriter) *ResponseWriter {
+	return &ResponseWriter{w, http.StatusOK}
+}
+
+// WriteHeader - writes http status code
+func (lrw *ResponseWriter) WriteHeader(code int) {
+	lrw.statusCode = code
+	lrw.ResponseWriter.WriteHeader(code)
+}
+
+// Flush - Calls the underlying Flush.
+func (lrw *ResponseWriter) Flush() {
+	lrw.ResponseWriter.(http.Flusher).Flush()
+}
+
+// AuditTargets is the list of enabled audit loggers
+var AuditTargets = []Target{}
+
+// AddAuditTarget adds a new audit logger target to the
+// list of enabled loggers
+func AddAuditTarget(t Target) {
+	AuditTargets = append(AuditTargets, t)
+}
+
+// AuditLog - logs audit logs to all audit targets.
+func AuditLog(w http.ResponseWriter, r *http.Request, api string, reqClaims map[string]interface{}) {
+	var statusCode int
+	lrw, ok := w.(*ResponseWriter)
+	if ok {
+		statusCode = lrw.statusCode
+	}
+	// Send audit logs only to http targets.
+	for _, t := range AuditTargets {
+		_ = t.Send(audit.ToEntry(w, r, api, statusCode, reqClaims))
+	}
+}

cmd/logger/console.go

@@ -19,87 +19,168 @@ package logger
 import (
 	"encoding/json"
 	"fmt"
+	"os"
 	"strings"
 	"time"
+
+	c "github.com/minio/mc/pkg/console"
+	"github.com/minio/minio/cmd/logger/message/log"
 )
 
-// ConsoleTarget implements loggerTarget to send log
-// in plain or json format to the standard output.
-type ConsoleTarget struct{}
+// Console interface describes the methods that need to be implemented to satisfy the interface requirements.
+type Console interface {
+	json(msg string, args ...interface{})
+	quiet(msg string, args ...interface{})
+	pretty(msg string, args ...interface{})
+}
 
-func (c *ConsoleTarget) send(e interface{}) error {
-	entry, ok := e.(logEntry)
-	if !ok {
-		return fmt.Errorf("Uexpected log entry structure %#v", e)
+func consoleLog(console Console, msg string, args ...interface{}) {
+	switch {
+	case jsonFlag:
+		// Strip escape control characters from json message
+		msg = ansiRE.ReplaceAllLiteralString(msg, "")
+		console.json(msg, args...)
+	case quietFlag:
+		console.quiet(msg, args...)
+	default:
+		console.pretty(msg, args...)
 	}
-	if jsonFlag {
-		logJSON, err := json.Marshal(&entry)
-		if err != nil {
-			return err
+}
+
+// Fatal prints only fatal error message with no stack trace
+// it will be called for input validation failures
+func Fatal(err error, msg string, data ...interface{}) {
+	fatal(err, msg, data...)
+}
+
+func fatal(err error, msg string, data ...interface{}) {
+	var errMsg string
+	if msg != "" {
+		errMsg = errorFmtFunc(fmt.Sprintf(msg, data...), err, jsonFlag)
+	} else {
+		errMsg = err.Error()
+	}
+	consoleLog(fatalMessage, errMsg)
+}
+
+var fatalMessage fatalMsg
+
+type fatalMsg struct {
+}
+
+func (f fatalMsg) json(msg string, args ...interface{}) {
+	logJSON, err := json.Marshal(&log.Entry{
+		Level: FatalLvl.String(),
+		Time:  time.Now().UTC().Format(time.RFC3339Nano),
+		Trace: &log.Trace{Message: fmt.Sprintf(msg, args...), Source: []string{getSource(6)}},
+	})
+	if err != nil {
+		panic(err)
+	}
+	fmt.Println(string(logJSON))
+
+	os.Exit(1)
+
+}
+
+func (f fatalMsg) quiet(msg string, args ...interface{}) {
+	f.pretty(msg, args...)
+}
+
+var (
+	logTag      = "ERROR"
+	logBanner   = ColorBgRed(ColorFgWhite(ColorBold(logTag))) + " "
+	emptyBanner = ColorBgRed(strings.Repeat(" ", len(logTag))) + " "
+	bannerWidth = len(logTag) + 1
+)
+
+func (f fatalMsg) pretty(msg string, args ...interface{}) {
+	// Build the passed error message
+	errMsg := fmt.Sprintf(msg, args...)
+
+	tagPrinted := false
+
+	// Print the error message: the following code takes care
+	// of splitting error text and always pretty printing the
+	// red banner along with the error message. Since the error
+	// message itself contains some colored text, we needed
+	// to use some ANSI control escapes to cursor color state
+	// and freely move in the screen.
+	for _, line := range strings.Split(errMsg, "\n") {
+		if len(line) == 0 {
+			// No more text to print, just quit.
+			break
 		}
-		fmt.Println(string(logJSON))
-		return nil
-	}
 
-	trace := make([]string, len(entry.Trace.Source))
-
-	// Add a sequence number and formatting for each stack trace
-	// No formatting is required for the first entry
-	for i, element := range entry.Trace.Source {
-		trace[i] = fmt.Sprintf("%8v: %s", i+1, element)
-	}
-
-	tagString := ""
-	for key, value := range entry.Trace.Variables {
-		if value != "" {
-			if tagString != "" {
-				tagString += ", "
+		for {
+			// Save the attributes of the current cursor helps
+			// us save the text color of the passed error message
+			ansiSaveAttributes()
+			// Print banner with or without the log tag
+			if !tagPrinted {
+				fmt.Print(logBanner)
+				tagPrinted = true
+			} else {
+				fmt.Print(emptyBanner)
 			}
-			tagString += key + "=" + value
+			// Restore the text color of the error message
+			ansiRestoreAttributes()
+			ansiMoveRight(bannerWidth)
+			// Continue  error message printing
+			fmt.Println(line)
+			break
 		}
 	}
 
-	apiString := "API: " + entry.API.Name + "("
-	if entry.API.Args != nil && entry.API.Args.Bucket != "" {
-		apiString = apiString + "bucket=" + entry.API.Args.Bucket
-	}
-	if entry.API.Args != nil && entry.API.Args.Object != "" {
-		apiString = apiString + ", object=" + entry.API.Args.Object
-	}
-	apiString += ")"
-	timeString := "Time: " + time.Now().Format(loggerTimeFormat)
-
-	var requestID string
-	if entry.RequestID != "" {
-		requestID = "\nRequestID: " + entry.RequestID
-	}
-
-	var remoteHost string
-	if entry.RemoteHost != "" {
-		remoteHost = "\nRemoteHost: " + entry.RemoteHost
-	}
-
-	var userAgent string
-	if entry.UserAgent != "" {
-		userAgent = "\nUserAgent: " + entry.UserAgent
-	}
-
-	if len(entry.Trace.Variables) > 0 {
-		tagString = "\n       " + tagString
-	}
-
-	var msg = colorFgRed(colorBold(entry.Trace.Message))
-	var output = fmt.Sprintf("\n%s\n%s%s%s%s\nError: %s%s\n%s",
-		apiString, timeString, requestID, remoteHost, userAgent,
-		msg, tagString, strings.Join(trace, "\n"))
-
-	fmt.Println(output)
-	return nil
+	// Exit because this is a fatal error message
+	os.Exit(1)
 }
 
-// NewConsole initializes a new logger target
-// which prints log directly in the standard
-// output.
-func NewConsole() LoggingTarget {
-	return &ConsoleTarget{}
+type infoMsg struct{}
+
+var info infoMsg
+
+func (i infoMsg) json(msg string, args ...interface{}) {
+	logJSON, err := json.Marshal(&log.Entry{
+		Level:   InformationLvl.String(),
+		Message: fmt.Sprintf(msg, args...),
+		Time:    time.Now().UTC().Format(time.RFC3339Nano),
+	})
+	if err != nil {
+		panic(err)
+	}
+	fmt.Println(string(logJSON))
+}
+
+func (i infoMsg) quiet(msg string, args ...interface{}) {
+	i.pretty(msg, args...)
+}
+
+func (i infoMsg) pretty(msg string, args ...interface{}) {
+	c.Printf(msg, args...)
+}
+
+// Info :
+func Info(msg string, data ...interface{}) {
+	consoleLog(info, msg+"\n", data...)
+}
+
+var startupMessage startUpMsg
+
+type startUpMsg struct {
+}
+
+func (s startUpMsg) json(msg string, args ...interface{}) {
+}
+
+func (s startUpMsg) quiet(msg string, args ...interface{}) {
+}
+
+func (s startUpMsg) pretty(msg string, args ...interface{}) {
+	c.Printf(msg, args...)
+}
+
+// StartupMessage :
+func StartupMessage(msg string, data ...interface{}) {
+	consoleLog(startupMessage, msg+"\n", data...)
 }

cmd/logger/logger.go

@@ -18,23 +18,20 @@ package logger
 
 import (
 	"context"
-	"encoding/json"
 	"fmt"
 	"go/build"
-	"os"
 	"path/filepath"
 	"runtime"
 	"strings"
 	"time"
 
-	c "github.com/minio/mc/pkg/console"
+	"github.com/minio/minio-go/pkg/set"
+	"github.com/minio/minio/cmd/logger/message/log"
 )
 
 // Disable disables all logging, false by default. (used for "go test")
 var Disable = false
 
-var trimStrings []string
-
 // Level type
 type Level int8
 
@@ -45,7 +42,10 @@ const (
 	FatalLvl
 )
 
-const loggerTimeFormat string = "15:04:05 MST 01/02/2006"
+var trimStrings []string
+
+// TimeFormat - logging time format.
+const TimeFormat string = "15:04:05 MST 01/02/2006"
 
 // List of error strings to be ignored by LogIf
 const (
@@ -91,79 +91,33 @@ func (level Level) String() string {
 	return lvlStr
 }
 
-// Console interface describes the methods that needs to be implemented to satisfy the interface requirements.
-type Console interface {
-	json(msg string, args ...interface{})
-	quiet(msg string, args ...interface{})
-	pretty(msg string, args ...interface{})
-}
-
-func consoleLog(console Console, msg string, args ...interface{}) {
-	switch {
-	case jsonFlag:
-		// Strip escape control characters from json message
-		msg = ansiRE.ReplaceAllLiteralString(msg, "")
-		console.json(msg, args...)
-	case quiet:
-		console.quiet(msg, args...)
-	default:
-		console.pretty(msg, args...)
-	}
-}
-
-type traceEntry struct {
-	Message   string            `json:"message,omitempty"`
-	Source    []string          `json:"source,omitempty"`
-	Variables map[string]string `json:"variables,omitempty"`
-}
-
-type args struct {
-	Bucket   string            `json:"bucket,omitempty"`
-	Object   string            `json:"object,omitempty"`
-	Metadata map[string]string `json:"metadata,omitempty"`
-}
-
-type api struct {
-	Name string `json:"name,omitempty"`
-	Args *args  `json:"args,omitempty"`
-}
-
-type logEntry struct {
-	DeploymentID string      `json:"deploymentid,omitempty"`
-	Level        string      `json:"level"`
-	Time         string      `json:"time"`
-	API          *api        `json:"api,omitempty"`
-	RemoteHost   string      `json:"remotehost,omitempty"`
-	RequestID    string      `json:"requestID,omitempty"`
-	UserAgent    string      `json:"userAgent,omitempty"`
-	Message      string      `json:"message,omitempty"`
-	Trace        *traceEntry `json:"error,omitempty"`
-}
-
-// quiet: Hide startup messages if enabled
+// quietFlag: Hide startup messages if enabled
 // jsonFlag: Display in JSON format, if enabled
 var (
-	quiet, jsonFlag bool
+	quietFlag, jsonFlag bool
 	// Custom function to format error
 	errorFmtFunc func(string, error, bool) string
-
-	deploymentID string
 )
 
-// SetDeploymentID - Used to set the deployment ID, in XL and FS mode
-func SetDeploymentID(id string) {
-	deploymentID = id
-}
-
 // EnableQuiet - turns quiet option on.
 func EnableQuiet() {
-	quiet = true
+	quietFlag = true
 }
 
 // EnableJSON - outputs logs in json format.
 func EnableJSON() {
 	jsonFlag = true
-	quiet = true
+	quietFlag = true
+}
+
+// IsJSON - returns true if jsonFlag is true
+func IsJSON() bool {
+	return jsonFlag
+}
+
+// IsQuiet - returns true if quietFlag is true
+func IsQuiet() bool {
+	return quietFlag
 }
 
 // RegisterUIError registers the specified rendering function. This latter
@@ -172,6 +126,17 @@ func RegisterUIError(f func(string, error, bool) string) {
 	errorFmtFunc = f
 }
 
+// Remove any duplicates and return unique entries.
+func uniqueEntries(paths []string) []string {
+	m := make(set.StringSet)
+	for _, p := range paths {
+		if !m.Contains(p) {
+			m.Add(p)
+		}
+	}
+	return m.ToSlice()
+}
+
 // Init sets the trimStrings to possible GOPATHs
 // and GOROOT directories. Also append github.com/minio/minio
 // This is done to clean up the filename, when stack trace is
@@ -326,20 +291,30 @@ func logIf(ctx context.Context, err error) {
 	// Get the cause for the Error
 	message := err.Error()
 
-	entry := logEntry{
-		DeploymentID: deploymentID,
+	entry := log.Entry{
+		DeploymentID: req.DeploymentID,
 		Level:        ErrorLvl.String(),
 		RemoteHost:   req.RemoteHost,
 		RequestID:    req.RequestID,
 		UserAgent:    req.UserAgent,
 		Time:         time.Now().UTC().Format(time.RFC3339Nano),
-		API:          &api{Name: API, Args: &args{Bucket: req.BucketName, Object: req.ObjectName}},
-		Trace:        &traceEntry{Message: message, Source: trace, Variables: tags},
+		API: &log.API{
+			Name: API,
+			Args: &log.Args{
+				Bucket: req.BucketName,
+				Object: req.ObjectName,
+			},
+		},
+		Trace: &log.Trace{
+			Message:   message,
+			Source:    trace,
+			Variables: tags,
+		},
 	}
 
 	// Iterate over all logger targets to send the log entry
 	for _, t := range Targets {
-		t.send(entry)
+		t.Send(entry)
 	}
 }
 
@@ -362,141 +337,3 @@ func FatalIf(err error, msg string, data ...interface{}) {
 	}
 	fatal(err, msg, data...)
 }
-
-// Fatal prints only fatal error message without no stack trace
-// it will be called for input validation failures
-func Fatal(err error, msg string, data ...interface{}) {
-	fatal(err, msg, data...)
-}
-
-func fatal(err error, msg string, data ...interface{}) {
-	var errMsg string
-	if msg != "" {
-		errMsg = errorFmtFunc(fmt.Sprintf(msg, data...), err, jsonFlag)
-	} else {
-		errMsg = err.Error()
-	}
-	consoleLog(fatalMessage, errMsg)
-}
-
-var fatalMessage fatalMsg
-
-type fatalMsg struct {
-}
-
-func (f fatalMsg) json(msg string, args ...interface{}) {
-	logJSON, err := json.Marshal(&logEntry{
-		Level: FatalLvl.String(),
-		Time:  time.Now().UTC().Format(time.RFC3339Nano),
-		Trace: &traceEntry{Message: fmt.Sprintf(msg, args...), Source: []string{getSource(6)}},
-	})
-	if err != nil {
-		panic(err)
-	}
-	fmt.Println(string(logJSON))
-
-	os.Exit(1)
-
-}
-
-func (f fatalMsg) quiet(msg string, args ...interface{}) {
-	f.pretty(msg, args...)
-}
-
-var (
-	logTag      = "ERROR"
-	logBanner   = colorBgRed(colorFgWhite(colorBold(logTag))) + " "
-	emptyBanner = colorBgRed(strings.Repeat(" ", len(logTag))) + " "
-	bannerWidth = len(logTag) + 1
-)
-
-func (f fatalMsg) pretty(msg string, args ...interface{}) {
-	// Build the passed error message
-	errMsg := fmt.Sprintf(msg, args...)
-
-	tagPrinted := false
-
-	// Print the error message: the following code takes care
-	// of splitting error text and always pretty printing the
-	// red banner along with the error message. Since the error
-	// message itself contains some colored text, we needed
-	// to use some ANSI control escapes to cursor color state
-	// and freely move in the screen.
-	for _, line := range strings.Split(errMsg, "\n") {
-		if len(line) == 0 {
-			// No more text to print, just quit.
-			break
-		}
-
-		for {
-			// Save the attributes of the current cursor helps
-			// us save the text color of the passed error message
-			ansiSaveAttributes()
-			// Print banner with or without the log tag
-			if !tagPrinted {
-				fmt.Print(logBanner)
-				tagPrinted = true
-			} else {
-				fmt.Print(emptyBanner)
-			}
-			// Restore the text color of the error message
-			ansiRestoreAttributes()
-			ansiMoveRight(bannerWidth)
-			// Continue  error message printing
-			fmt.Println(line)
-			break
-		}
-	}
-
-	// Exit because this is a fatal error message
-	os.Exit(1)
-}
-
-type infoMsg struct{}
-
-var info infoMsg
-
-func (i infoMsg) json(msg string, args ...interface{}) {
-	logJSON, err := json.Marshal(&logEntry{
-		Level:   InformationLvl.String(),
-		Message: fmt.Sprintf(msg, args...),
-		Time:    time.Now().UTC().Format(time.RFC3339Nano),
-	})
-	if err != nil {
-		panic(err)
-	}
-	fmt.Println(string(logJSON))
-}
-
-func (i infoMsg) quiet(msg string, args ...interface{}) {
-	i.pretty(msg, args...)
-}
-
-func (i infoMsg) pretty(msg string, args ...interface{}) {
-	c.Printf(msg, args...)
-}
-
-// Info :
-func Info(msg string, data ...interface{}) {
-	consoleLog(info, msg+"\n", data...)
-}
-
-var startupMessage startUpMsg
-
-type startUpMsg struct {
-}
-
-func (s startUpMsg) json(msg string, args ...interface{}) {
-}
-
-func (s startUpMsg) quiet(msg string, args ...interface{}) {
-}
-
-func (s startUpMsg) pretty(msg string, args ...interface{}) {
-	c.Printf(msg, args...)
-}
-
-// StartupMessage :
-func StartupMessage(msg string, data ...interface{}) {
-	consoleLog(startupMessage, msg+"\n", data...)
-}

cmd/logger/message/audit/entry.go

@@ -0,0 +1,92 @@
+/*
+ * Minio Cloud Storage, (C) 2018 Minio, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package audit
+
+import (
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/gorilla/mux"
+	"github.com/minio/minio/pkg/handlers"
+)
+
+// Version - represents the current version of audit log structure.
+const Version = "1"
+
+// Entry - audit entry logs.
+type Entry struct {
+	Version      string `json:"version"`
+	DeploymentID string `json:"deploymentid,omitempty"`
+	Time         string `json:"time"`
+	API          struct {
+		Name       string `json:"name,omitempty"`
+		Bucket     string `json:"bucket,omitempty"`
+		Object     string `json:"object,omitempty"`
+		Status     string `json:"status,omitempty"`
+		StatusCode int    `json:"statusCode,omitempty"`
+	} `json:"api"`
+	RemoteHost string                 `json:"remotehost,omitempty"`
+	RequestID  string                 `json:"requestID,omitempty"`
+	UserAgent  string                 `json:"userAgent,omitempty"`
+	ReqClaims  map[string]interface{} `json:"requestClaims,omitempty"`
+	ReqQuery   map[string]string      `json:"requestQuery,omitempty"`
+	ReqHeader  map[string]string      `json:"requestHeader,omitempty"`
+	RespHeader map[string]string      `json:"responseHeader,omitempty"`
+}
+
+// ToEntry - constructs an audit entry object.
+func ToEntry(w http.ResponseWriter, r *http.Request, api string, statusCode int, reqClaims map[string]interface{}) Entry {
+	vars := mux.Vars(r)
+	bucket := vars["bucket"]
+	object := vars["object"]
+
+	reqQuery := make(map[string]string)
+	for k, v := range r.URL.Query() {
+		reqQuery[k] = strings.Join(v, ",")
+	}
+	reqHeader := make(map[string]string)
+	for k, v := range r.Header {
+		reqHeader[k] = strings.Join(v, ",")
+	}
+	respHeader := make(map[string]string)
+	for k, v := range w.Header() {
+		respHeader[k] = strings.Join(v, ",")
+	}
+	respHeader["Etag"] = strings.Trim(respHeader["Etag"], `"`)
+
+	entry := Entry{
+		Version:      Version,
+		DeploymentID: w.Header().Get("x-minio-deployment-id"),
+		RemoteHost:   handlers.GetSourceIP(r),
+		RequestID:    w.Header().Get("x-amz-request-id"),
+		UserAgent:    r.UserAgent(),
+		Time:         time.Now().UTC().Format(time.RFC3339Nano),
+		ReqQuery:     reqQuery,
+		ReqHeader:    reqHeader,
+		ReqClaims:    reqClaims,
+		RespHeader:   respHeader,
+	}
+
+	entry.API.Name = api
+	entry.API.Bucket = bucket
+	entry.API.Object = object
+	entry.API.Status = http.StatusText(statusCode)
+	entry.API.StatusCode = statusCode
+
+	return entry
+}

cmd/logger/message/log/entry.go

@@ -0,0 +1,50 @@
+/*
+ * Minio Cloud Storage, (C) 2018 Minio, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package log
+
+// Args - defines the arguments for the API.
+type Args struct {
+	Bucket   string            `json:"bucket,omitempty"`
+	Object   string            `json:"object,omitempty"`
+	Metadata map[string]string `json:"metadata,omitempty"`
+}
+
+// Trace - defines the trace.
+type Trace struct {
+	Message   string            `json:"message,omitempty"`
+	Source    []string          `json:"source,omitempty"`
+	Variables map[string]string `json:"variables,omitempty"`
+}
+
+// API - defines the api type and its args.
+type API struct {
+	Name string `json:"name,omitempty"`
+	Args *Args  `json:"args,omitempty"`
+}
+
+// Entry - defines fields and values of each log entry.
+type Entry struct {
+	DeploymentID string `json:"deploymentid,omitempty"`
+	Level        string `json:"level"`
+	Time         string `json:"time"`
+	API          *API   `json:"api,omitempty"`
+	RemoteHost   string `json:"remotehost,omitempty"`
+	RequestID    string `json:"requestID,omitempty"`
+	UserAgent    string `json:"userAgent,omitempty"`
+	Message      string `json:"message,omitempty"`
+	Trace        *Trace `json:"error,omitempty"`
+}

cmd/logger/reqinfo.go

@@ -35,22 +35,24 @@ type KeyVal struct {
 
 // ReqInfo stores the request info.
 type ReqInfo struct {
-	RemoteHost string   // Client Host/IP
-	UserAgent  string   // User Agent
-	RequestID  string   // x-amz-request-id
-	API        string   // API name - GetObject PutObject NewMultipartUpload etc.
-	BucketName string   // Bucket name
-	ObjectName string   // Object name
-	tags       []KeyVal // Any additional info not accommodated by above fields
+	RemoteHost   string   // Client Host/IP
+	UserAgent    string   // User Agent
+	DeploymentID string   // x-minio-deployment-id
+	RequestID    string   // x-amz-request-id
+	API          string   // API name - GetObject PutObject NewMultipartUpload etc.
+	BucketName   string   // Bucket name
+	ObjectName   string   // Object name
+	tags         []KeyVal // Any additional info not accommodated by above fields
 	sync.RWMutex
 }
 
 // NewReqInfo :
-func NewReqInfo(remoteHost, userAgent, requestID, api, bucket, object string) *ReqInfo {
+func NewReqInfo(remoteHost, userAgent, deploymentID, requestID, api, bucket, object string) *ReqInfo {
 	req := ReqInfo{}
 	req.RemoteHost = remoteHost
 	req.UserAgent = userAgent
 	req.API = api
+	req.DeploymentID = deploymentID
 	req.RequestID = requestID
 	req.BucketName = bucket
 	req.ObjectName = object

cmd/logger/target/console/console.go

@@ -0,0 +1,109 @@
+/*
+ * Minio Cloud Storage, (C) 2018 Minio, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package console
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/minio/minio/cmd/logger"
+	"github.com/minio/minio/cmd/logger/message/log"
+)
+
+// Target implements loggerTarget to send log
+// in plain or json format to the standard output.
+type Target struct{}
+
+// Send log message 'e' to console
+func (c *Target) Send(e interface{}) error {
+	entry, ok := e.(log.Entry)
+	if !ok {
+		return fmt.Errorf("Uexpected log entry structure %#v", e)
+	}
+	if logger.IsJSON() {
+		logJSON, err := json.Marshal(&entry)
+		if err != nil {
+			return err
+		}
+		fmt.Println(string(logJSON))
+		return nil
+	}
+
+	trace := make([]string, len(entry.Trace.Source))
+
+	// Add a sequence number and formatting for each stack trace
+	// No formatting is required for the first entry
+	for i, element := range entry.Trace.Source {
+		trace[i] = fmt.Sprintf("%8v: %s", i+1, element)
+	}
+
+	tagString := ""
+	for key, value := range entry.Trace.Variables {
+		if value != "" {
+			if tagString != "" {
+				tagString += ", "
+			}
+			tagString += key + "=" + value
+		}
+	}
+
+	apiString := "API: " + entry.API.Name + "("
+	if entry.API.Args != nil && entry.API.Args.Bucket != "" {
+		apiString = apiString + "bucket=" + entry.API.Args.Bucket
+	}
+	if entry.API.Args != nil && entry.API.Args.Object != "" {
+		apiString = apiString + ", object=" + entry.API.Args.Object
+	}
+	apiString += ")"
+	timeString := "Time: " + time.Now().Format(logger.TimeFormat)
+
+	var requestID string
+	if entry.RequestID != "" {
+		requestID = "\nRequestID: " + entry.RequestID
+	}
+
+	var remoteHost string
+	if entry.RemoteHost != "" {
+		remoteHost = "\nRemoteHost: " + entry.RemoteHost
+	}
+
+	var userAgent string
+	if entry.UserAgent != "" {
+		userAgent = "\nUserAgent: " + entry.UserAgent
+	}
+
+	if len(entry.Trace.Variables) > 0 {
+		tagString = "\n       " + tagString
+	}
+
+	var msg = logger.ColorFgRed(logger.ColorBold(entry.Trace.Message))
+	var output = fmt.Sprintf("\n%s\n%s%s%s%s\nError: %s%s\n%s",
+		apiString, timeString, requestID, remoteHost, userAgent,
+		msg, tagString, strings.Join(trace, "\n"))
+
+	fmt.Println(output)
+	return nil
+}
+
+// New initializes a new logger target
+// which prints log directly in the standard
+// output.
+func New() *Target {
+	return &Target{}
+}

cmd/logger/target/http/http.go

@@ -14,7 +14,7 @@
  * limitations under the License.
  */
 
-package logger
+package http
 
 import (
 	"bytes"
@@ -22,24 +22,24 @@ import (
 	"errors"
 	"io"
 	"io/ioutil"
-	"net/http"
+	gohttp "net/http"
 )
 
-// HTTPTarget implements loggerTarget and sends the json
+// Target implements logger.Target and sends the json
 // format of a log entry to the configured http endpoint.
 // An internal buffer of logs is maintained but when the
 // buffer is full, new logs are just ignored and an error
 // is returned to the caller.
-type HTTPTarget struct {
+type Target struct {
 	// Channel of log entries
 	logCh chan interface{}
 
 	// HTTP(s) endpoint
 	endpoint string
-	client   http.Client
+	client   gohttp.Client
 }
 
-func (h *HTTPTarget) startHTTPLogger() {
+func (h *Target) startHTTPLogger() {
 	// Create a routine which sends json logs received
 	// from an internal channel.
 	go func() {
@@ -49,7 +49,7 @@ func (h *HTTPTarget) startHTTPLogger() {
 				continue
 			}
 
-			req, err := http.NewRequest("POST", h.endpoint, bytes.NewBuffer(logJSON))
+			req, err := gohttp.NewRequest("POST", h.endpoint, bytes.NewBuffer(logJSON))
 			req.Header.Set("Content-Type", "application/json")
 
 			resp, err := h.client.Do(req)
@@ -65,12 +65,12 @@ func (h *HTTPTarget) startHTTPLogger() {
 	}()
 }
 
-// NewHTTP initializes a new logger target which
+// New initializes a new logger target which
 // sends log over http to the specified endpoint
-func NewHTTP(endpoint string, transport *http.Transport) LoggingTarget {
-	h := HTTPTarget{
+func New(endpoint string, transport *gohttp.Transport) *Target {
+	h := Target{
 		endpoint: endpoint,
-		client: http.Client{
+		client: gohttp.Client{
 			Transport: transport,
 		},
 		logCh: make(chan interface{}, 10000),
@@ -80,7 +80,8 @@ func NewHTTP(endpoint string, transport *http.Transport) LoggingTarget {
 	return &h
 }
 
-func (h *HTTPTarget) send(entry interface{}) error {
+// Send log message 'e' to http target.
+func (h *Target) Send(entry interface{}) error {
 	select {
 	case h.logCh <- entry:
 	default:

cmd/logger/targets.go

@@ -16,18 +16,18 @@
 
 package logger
 
-// LoggingTarget is the entity that we will receive
-// a single log entry and send it to the log target
-//   e.g. send the log to a http server
-type LoggingTarget interface {
-	send(entry interface{}) error
+// Target is the entity that we will receive
+// a single log entry and Send it to the log target
+//   e.g. Send the log to a http server
+type Target interface {
+	Send(entry interface{}) error
 }
 
 // Targets is the set of enabled loggers
-var Targets = []LoggingTarget{}
+var Targets = []Target{}
 
 // AddTarget adds a new logger target to the
 // list of enabled loggers
-func AddTarget(t LoggingTarget) {
+func AddTarget(t Target) {
 	Targets = append(Targets, t)
 }

cmd/logger/utils.go

@@ -33,25 +33,25 @@ var (
 		return isatty.IsTerminal(os.Stdout.Fd()) && isatty.IsTerminal(os.Stderr.Fd())
 	}
 
-	colorBold = func() func(a ...interface{}) string {
+	ColorBold = func() func(a ...interface{}) string {
 		if isTerminal() {
 			return color.New(color.Bold).SprintFunc()
 		}
 		return fmt.Sprint
 	}()
-	colorFgRed = func() func(format string, a ...interface{}) string {
+	ColorFgRed = func() func(format string, a ...interface{}) string {
 		if isTerminal() {
 			return color.New(color.FgRed).SprintfFunc()
 		}
 		return fmt.Sprintf
 	}()
-	colorBgRed = func() func(format string, a ...interface{}) string {
+	ColorBgRed = func() func(format string, a ...interface{}) string {
 		if isTerminal() {
 			return color.New(color.BgRed).SprintfFunc()
 		}
 		return fmt.Sprintf
 	}()
-	colorFgWhite = func() func(format string, a ...interface{}) string {
+	ColorFgWhite = func() func(format string, a ...interface{}) string {
 		if isTerminal() {
 			return color.New(color.FgWhite).SprintfFunc()
 		}
@@ -83,17 +83,5 @@ func ansiRestoreAttributes() {
 	if isTerminal() {
 		ansiEscape("8")
 	}
-}
 
-func uniqueEntries(paths []string) []string {
-	found := map[string]bool{}
-	unqiue := []string{}
-
-	for v := range paths {
-		if _, ok := found[paths[v]]; !ok {
-			found[paths[v]] = true
-			unqiue = append(unqiue, paths[v])
-		}
-	}
-	return unqiue
 }

cmd/object-api-interface.go

@@ -94,6 +94,7 @@ type ObjectLayer interface {
 
 	// Supported operations check
 	IsNotificationSupported() bool
+	IsListenBucketSupported() bool
 	IsEncryptionSupported() bool
 
 	// Compression support check.

cmd/object-api-utils.go

@@ -635,12 +635,13 @@ func (p *PutObjReader) MD5CurrentHexString() string {
 func NewPutObjReader(rawReader *hash.Reader, encReader *hash.Reader, encKey []byte) *PutObjReader {
 	p := PutObjReader{Reader: rawReader, rawReader: rawReader}
 
-	var objKey crypto.ObjectKey
-	copy(objKey[:], encKey)
-	p.sealMD5Fn = sealETagFn(objKey)
-	if encReader != nil {
+	if len(encKey) != 0 && encReader != nil {
+		var objKey crypto.ObjectKey
+		copy(objKey[:], encKey)
+		p.sealMD5Fn = sealETagFn(objKey)
 		p.Reader = encReader
 	}
+
 	return &p
 }
 
@@ -651,9 +652,10 @@ func sealETag(encKey crypto.ObjectKey, md5CurrSum []byte) []byte {
 	}
 	return encKey.SealETag(md5CurrSum)
 }
+
 func sealETagFn(key crypto.ObjectKey) SealMD5CurrFn {
-	fn1 := func(md5sumcurr []byte) []byte {
+	fn := func(md5sumcurr []byte) []byte {
 		return sealETag(key, md5sumcurr)
 	}
-	return fn1
+	return fn
 }

cmd/object-handlers-common.go

@@ -75,7 +75,7 @@ func checkCopyObjectPreconditions(w http.ResponseWriter, r *http.Request, objInf
 			if !ifModifiedSince(objInfo.ModTime, givenTime) {
 				// If the object is not modified since the specified time.
 				writeHeaders()
-				writeErrorResponse(w, ErrPreconditionFailed, r.URL)
+				writeErrorResponse(w, ErrPreconditionFailed, r.URL, guessIsBrowserReq(r))
 				return true
 			}
 		}
@@ -89,7 +89,7 @@ func checkCopyObjectPreconditions(w http.ResponseWriter, r *http.Request, objInf
 			if ifModifiedSince(objInfo.ModTime, givenTime) {
 				// If the object is modified since the specified time.
 				writeHeaders()
-				writeErrorResponse(w, ErrPreconditionFailed, r.URL)
+				writeErrorResponse(w, ErrPreconditionFailed, r.URL, guessIsBrowserReq(r))
 				return true
 			}
 		}
@@ -102,7 +102,7 @@ func checkCopyObjectPreconditions(w http.ResponseWriter, r *http.Request, objInf
 		if objInfo.ETag != "" && !isETagEqual(objInfo.ETag, ifMatchETagHeader) {
 			// If the object ETag does not match with the specified ETag.
 			writeHeaders()
-			writeErrorResponse(w, ErrPreconditionFailed, r.URL)
+			writeErrorResponse(w, ErrPreconditionFailed, r.URL, guessIsBrowserReq(r))
 			return true
 		}
 	}
@@ -114,7 +114,7 @@ func checkCopyObjectPreconditions(w http.ResponseWriter, r *http.Request, objInf
 		if objInfo.ETag != "" && isETagEqual(objInfo.ETag, ifNoneMatchETagHeader) {
 			// If the object ETag matches with the specified ETag.
 			writeHeaders()
-			writeErrorResponse(w, ErrPreconditionFailed, r.URL)
+			writeErrorResponse(w, ErrPreconditionFailed, r.URL, guessIsBrowserReq(r))
 			return true
 		}
 	}
@@ -174,7 +174,7 @@ func checkPreconditions(w http.ResponseWriter, r *http.Request, objInfo ObjectIn
 			if ifModifiedSince(objInfo.ModTime, givenTime) {
 				// If the object is modified since the specified time.
 				writeHeaders()
-				writeErrorResponse(w, ErrPreconditionFailed, r.URL)
+				writeErrorResponse(w, ErrPreconditionFailed, r.URL, guessIsBrowserReq(r))
 				return true
 			}
 		}
@@ -187,7 +187,7 @@ func checkPreconditions(w http.ResponseWriter, r *http.Request, objInfo ObjectIn
 		if !isETagEqual(objInfo.ETag, ifMatchETagHeader) {
 			// If the object ETag does not match with the specified ETag.
 			writeHeaders()
-			writeErrorResponse(w, ErrPreconditionFailed, r.URL)
+			writeErrorResponse(w, ErrPreconditionFailed, r.URL, guessIsBrowserReq(r))
 			return true
 		}
 	}

cmd/object-handlers_test.go

@@ -21,6 +21,7 @@ import (
 	"context"
 	"crypto/md5"
 	"encoding/base64"
+	"encoding/hex"
 	"encoding/xml"
 	"fmt"
 	"io"
@@ -1811,9 +1812,13 @@ func testAPICopyObjectHandler(obj ObjectLayer, instanceType, bucketName string,
 	// this is required even to assert the copied object,
 	bytesData := []struct {
 		byteData []byte
+		md5sum   string
 	}{
-		{generateBytesData(6 * humanize.KiByte)},
+		{byteData: generateBytesData(6 * humanize.KiByte)},
 	}
+	h := md5.New()
+	h.Write(bytesData[0].byteData)
+	bytesData[0].md5sum = hex.EncodeToString(h.Sum(nil))
 
 	buffers := []*bytes.Buffer{
 		new(bytes.Buffer),
@@ -1826,23 +1831,29 @@ func testAPICopyObjectHandler(obj ObjectLayer, instanceType, bucketName string,
 		objectName    string
 		contentLength int64
 		textData      []byte
+		md5sum        string
 		metaData      map[string]string
 	}{
 		// case - 1.
-		{bucketName, objectName, int64(len(bytesData[0].byteData)), bytesData[0].byteData, make(map[string]string)},
+		{bucketName, objectName, int64(len(bytesData[0].byteData)), bytesData[0].byteData, bytesData[0].md5sum, make(map[string]string)},
 
 		// case - 2.
 		// used for anonymous HTTP request test.
-		{bucketName, anonObject, int64(len(bytesData[0].byteData)), bytesData[0].byteData, make(map[string]string)},
+		{bucketName, anonObject, int64(len(bytesData[0].byteData)), bytesData[0].byteData, bytesData[0].md5sum, make(map[string]string)},
 	}
+
 	// iterate through the above set of inputs and upload the object.
 	for i, input := range putObjectInputs {
 		// uploading the object.
-		_, err = obj.PutObject(context.Background(), input.bucketName, input.objectName, mustGetPutObjReader(t, bytes.NewBuffer(input.textData), input.contentLength, input.metaData[""], ""), input.metaData, opts)
+		var objInfo ObjectInfo
+		objInfo, err = obj.PutObject(context.Background(), input.bucketName, input.objectName, mustGetPutObjReader(t, bytes.NewBuffer(input.textData), input.contentLength, input.metaData[""], ""), input.metaData, opts)
 		// if object upload fails stop the test.
 		if err != nil {
 			t.Fatalf("Put Object case %d:  Error uploading object: <ERROR> %v", i+1, err)
 		}
+		if objInfo.ETag != input.md5sum {
+			t.Fatalf("Put Object case %d:  Checksum mismatched: <ERROR> got %s, expected %s", i+1, input.md5sum, objInfo.ETag)
+		}
 	}
 
 	// test cases with inputs and expected result for Copy Object.
@@ -2105,6 +2116,16 @@ func testAPICopyObjectHandler(obj ObjectLayer, instanceType, bucketName string,
 			t.Fatalf("Test %d: %s:  Expected the response status to be `%d`, but instead found `%d`", i+1, instanceType, testCase.expectedRespStatus, rec.Code)
 		}
 		if rec.Code == http.StatusOK {
+			var cpObjResp CopyObjectResponse
+			if err = xml.Unmarshal(rec.Body.Bytes(), &cpObjResp); err != nil {
+				t.Fatalf("Test %d: %s: Failed to parse the CopyObjectResult response: <ERROR> %s", i+1, instanceType, err)
+			}
+
+			retag := canonicalizeETag(cpObjResp.ETag)
+			if retag != bytesData[0].md5sum {
+				t.Fatalf("Test %d: %s: Failed to CopyObject: <ERROR> got %s, expected %s", i+1, instanceType, retag, bytesData[0].md5sum)
+			}
+
 			// See if the new object is formed.
 			// testing whether the copy was successful.
 			err = obj.GetObject(context.Background(), testCase.bucketName, testCase.newObjectName, 0, int64(len(bytesData[0].byteData)), buffers[0], "", opts)

cmd/posix-list-dir_other.go

@@ -1,4 +1,4 @@
-// +build plan9
+// +build plan9 solaris
 
 /*
  * Minio Cloud Storage, (C) 2016, 2017, 2018 Minio, Inc.

cmd/posix-list-dir_unix.go

@@ -1,4 +1,4 @@
-// +build darwin dragonfly freebsd linux nacl netbsd openbsd solaris
+// +build darwin dragonfly freebsd linux nacl netbsd openbsd
 
 /*
  * Minio Cloud Storage, (C) 2016, 2017, 2018 Minio, Inc.

cmd/posix.go

@@ -83,8 +83,10 @@ func checkPathLength(pathName string) error {
 		return errFileNameTooLong
 	}
 
-	// Convert any '\' to '/'.
-	pathName = filepath.ToSlash(pathName)
+	if runtime.GOOS == "windows" {
+		// Convert any '\' to '/'.
+		pathName = filepath.ToSlash(pathName)
+	}
 
 	// Check each path segment length is > 255
 	for len(pathName) > 0 && pathName != "." && pathName != "/" {
@@ -374,6 +376,7 @@ func (s *posix) diskUsage(doneCh chan struct{}) {
 		default:
 			fi, err := os.Stat(entry)
 			if err != nil {
+				err = osErrToFSFileErr(err)
 				return err
 			}
 			atomic.AddUint64(&s.totalUsed, uint64(fi.Size()))
@@ -413,6 +416,7 @@ func (s *posix) diskUsage(doneCh chan struct{}) {
 				default:
 					fi, err := os.Stat(entry)
 					if err != nil {
+						err = osErrToFSFileErr(err)
 						return err
 					}
 					usage = usage + uint64(fi.Size())

cmd/prepare-storage.go

@@ -128,6 +128,15 @@ func connectLoadInitFormats(retryCount int, firstDisk bool, endpoints EndpointLi
 	}
 	defer closeStorageDisks(storageDisks)
 
+	// Attempt to load all `format.json` from all disks.
+	formatConfigs, sErrs := loadFormatXLAll(storageDisks)
+	// Check if we have
+	for i, sErr := range sErrs {
+		if _, ok := formatCriticalErrors[sErr]; ok {
+			return nil, fmt.Errorf("Disk %s: %s", endpoints[i], sErr)
+		}
+	}
+
 	// Connect to all storage disks, a connection failure will be
 	// only logged after some retries.
 	for _, disk := range storageDisks {
@@ -139,15 +148,6 @@ func connectLoadInitFormats(retryCount int, firstDisk bool, endpoints EndpointLi
 		}
 	}
 
-	// Attempt to load all `format.json` from all disks.
-	formatConfigs, sErrs := loadFormatXLAll(storageDisks)
-	// Check if we have
-	for i, sErr := range sErrs {
-		if _, ok := formatCriticalErrors[sErr]; ok {
-			return nil, fmt.Errorf("Disk %s: %s", endpoints[i], sErr)
-		}
-	}
-
 	// Pre-emptively check if one of the formatted disks
 	// is invalid. This function returns success for the
 	// most part unless one of the formats is not consistent
@@ -210,7 +210,7 @@ func connectLoadInitFormats(retryCount int, firstDisk bool, endpoints EndpointLi
 		}
 	}
 
-	logger.SetDeploymentID(format.ID)
+	globalDeploymentID = format.ID
 
 	if err = formatXLFixLocalDeploymentID(context.Background(), storageDisks, format); err != nil {
 		return nil, err

cmd/rest/client.go

@@ -35,9 +35,10 @@ const DefaultRESTTimeout = 1 * time.Minute
 
 // Client - http based RPC client.
 type Client struct {
-	httpClient   *http.Client
-	url          *url.URL
-	newAuthToken func() string
+	httpClient          *http.Client
+	httpIdleConnsCloser func()
+	url                 *url.URL
+	newAuthToken        func() string
 }
 
 // Call - make a REST call.
@@ -67,6 +68,13 @@ func (c *Client) Call(method string, values url.Values, body io.Reader) (reply i
 	return resp.Body, nil
 }
 
+// Close closes all idle connections of the underlying http client
+func (c *Client) Close() {
+	if c.httpIdleConnsCloser != nil {
+		c.httpIdleConnsCloser()
+	}
+}
+
 func newCustomDialContext(timeout time.Duration) func(ctx context.Context, network, addr string) (net.Conn, error) {
 	return func(ctx context.Context, network, addr string) (net.Conn, error) {
 		dialer := &net.Dialer{
@@ -84,25 +92,26 @@ func newCustomDialContext(timeout time.Duration) func(ctx context.Context, netwo
 	}
 }
 
-// NewClient - returns new RPC client.
+// NewClient - returns new REST client.
 func NewClient(url *url.URL, tlsConfig *tls.Config, timeout time.Duration, newAuthToken func() string) *Client {
+	// Transport is exactly same as Go default in https://golang.org/pkg/net/http/#RoundTripper
+	// except custom DialContext and TLSClientConfig.
+	tr := &http.Transport{
+		Proxy:                 http.ProxyFromEnvironment,
+		DialContext:           newCustomDialContext(timeout),
+		MaxIdleConnsPerHost:   4096,
+		MaxIdleConns:          4096,
+		IdleConnTimeout:       90 * time.Second,
+		TLSHandshakeTimeout:   10 * time.Second,
+		ExpectContinueTimeout: 1 * time.Second,
+		TLSClientConfig:       tlsConfig,
+		DisableCompression:    true,
+	}
+
 	return &Client{
-		httpClient: &http.Client{
-			// Transport is exactly same as Go default in https://golang.org/pkg/net/http/#RoundTripper
-			// except custom DialContext and TLSClientConfig.
-			Transport: &http.Transport{
-				Proxy:                 http.ProxyFromEnvironment,
-				DialContext:           newCustomDialContext(timeout),
-				MaxIdleConnsPerHost:   4096,
-				MaxIdleConns:          4096,
-				IdleConnTimeout:       90 * time.Second,
-				TLSHandshakeTimeout:   10 * time.Second,
-				ExpectContinueTimeout: 1 * time.Second,
-				TLSClientConfig:       tlsConfig,
-				DisableCompression:    true,
-			},
-		},
-		url:          url,
-		newAuthToken: newAuthToken,
+		httpClient:          &http.Client{Transport: tr},
+		httpIdleConnsCloser: tr.CloseIdleConnections,
+		url:                 url,
+		newAuthToken:        newAuthToken,
 	}
 }

cmd/routers.go

@@ -47,8 +47,8 @@ func registerDistXLRouters(router *mux.Router, endpoints EndpointList) {
 
 // List of some generic handlers which are applied for all incoming requests.
 var globalHandlers = []HandlerFunc{
-	// set x-amz-request-id header.
-	addrequestIDHeader,
+	// set x-amz-request-id, x-minio-deployment-id header.
+	addCustomHeaders,
 	// set HTTP security headers such as Content-Security-Policy.
 	addSecurityHeaders,
 	// Forward path style requests to actual host in a bucket federated setup.

cmd/server-main.go

@@ -41,13 +41,13 @@ var serverFlags = []cli.Flag{
 	cli.StringFlag{
 		Name:  "address",
 		Value: ":" + globalMinioPort,
-		Usage: "Bind to a specific ADDRESS:PORT, ADDRESS can be an IP or hostname.",
+		Usage: "bind to a specific ADDRESS:PORT, ADDRESS can be an IP or hostname",
 	},
 }
 
 var serverCmd = cli.Command{
 	Name:   "server",
-	Usage:  "Start object storage server.",
+	Usage:  "start object storage server",
 	Flags:  append(serverFlags, globalFlags...),
 	Action: serverMain,
 	CustomHelpTemplate: `NAME:
@@ -112,10 +112,10 @@ EXAMPLES:
   4. Start erasure coded minio server on a node with 64 drives.
      $ {{.HelpName}} /mnt/export{1...64}
 
-  5. Start distributed minio server on an 8 node setup with 8 drives each. Run following command on all the 8 nodes.
+  5. Start distributed minio server on an 32 node setup with 32 drives each. Run following command on all the 32 nodes.
      $ export MINIO_ACCESS_KEY=minio
      $ export MINIO_SECRET_KEY=miniostorage
-     $ {{.HelpName}} http://node{1...8}.example.com/mnt/export/{1...8}
+     $ {{.HelpName}} http://node{1...32}.example.com/mnt/export/{1...32}
 
   6. Start minio server with edge caching enabled.
      $ export MINIO_CACHE_DRIVES="/mnt/drive1;/mnt/drive2;/mnt/drive3;/mnt/drive4"
@@ -381,7 +381,7 @@ func serverMain(ctx *cli.Context) {
 
 	// Initialize notification system.
 	if err = globalNotificationSys.Init(newObject); err != nil {
-		logger.Fatal(err, "Unable to initialize notification system")
+		logger.LogIf(context.Background(), err)
 	}
 
 	globalObjLayerMutex.Lock()

cmd/setup-type.go

@@ -28,6 +28,9 @@ const (
 
 	// DistXLSetupType - Distributed XL setup type enum.
 	DistXLSetupType
+
+	// GatewaySetupType - gateway setup type enum.
+	GatewaySetupType
 )
 
 func (setupType SetupType) String() string {
@@ -38,6 +41,8 @@ func (setupType SetupType) String() string {
 		return globalMinioModeXL
 	case DistXLSetupType:
 		return globalMinioModeDistXL
+	case GatewaySetupType:
+		return globalMinioModeGatewayPrefix
 	}
 
 	return ""

cmd/storage-rest-client.go

@@ -322,6 +322,7 @@ func (client *storageRESTClient) RenameFile(srcVolume, srcPath, dstVolume, dstPa
 // Close - marks the client as closed.
 func (client *storageRESTClient) Close() error {
 	client.connected = false
+	client.restClient.Close()
 	return nil
 }
 

cmd/storage-rest-server.go

@@ -377,7 +377,7 @@ func registerStorageRESTHandlers(router *mux.Router, endpoints EndpointList) {
 			Queries(restQueries(storageRESTVolume, storageRESTFilePath)...)
 		subrouter.Methods(http.MethodPost).Path("/" + storageRESTMethodRenameFile).HandlerFunc(httpTraceHdrs(server.RenameFileHandler)).
 			Queries(restQueries(storageRESTSrcVolume, storageRESTSrcPath, storageRESTDstVolume, storageRESTDstPath)...)
-
-		subrouter.NotFoundHandler = http.HandlerFunc(httpTraceAll(notFoundHandler))
 	}
+
+	router.NotFoundHandler = http.HandlerFunc(httpTraceAll(notFoundHandler))
 }

cmd/sts-handlers.go

@@ -127,6 +127,8 @@ type ClientGrantsResult struct {
 func (sts *stsAPIHandlers) AssumeRoleWithClientGrants(w http.ResponseWriter, r *http.Request) {
 	ctx := newContext(r, w, "AssumeRoleWithClientGrants")
 
+	defer logger.AuditLog(w, r, "AssumeRoleWithClientGrants", nil)
+
 	if globalIAMValidators == nil {
 		writeSTSErrorResponse(w, ErrSTSNotInitialized)
 		return

cmd/update-main.go

@@ -40,12 +40,12 @@ import (
 // Check for new software updates.
 var updateCmd = cli.Command{
 	Name:   "update",
-	Usage:  "Check for a new software update.",
+	Usage:  "update minio to latest release",
 	Action: mainUpdate,
 	Flags: []cli.Flag{
 		cli.BoolFlag{
 			Name:  "quiet",
-			Usage: "Disable any update prompt message.",
+			Usage: "disable any update prompt message",
 		},
 	},
 	CustomHelpTemplate: `Name:

cmd/utils.go

@@ -397,12 +397,13 @@ func newContext(r *http.Request, w http.ResponseWriter, api string) context.Cont
 		object = prefix
 	}
 	reqInfo := &logger.ReqInfo{
-		RequestID:  w.Header().Get(responseRequestIDKey),
-		RemoteHost: handlers.GetSourceIP(r),
-		UserAgent:  r.UserAgent(),
-		API:        api,
-		BucketName: bucket,
-		ObjectName: object,
+		DeploymentID: w.Header().Get(responseDeploymentIDKey),
+		RequestID:    w.Header().Get(responseRequestIDKey),
+		RemoteHost:   handlers.GetSourceIP(r),
+		UserAgent:    r.UserAgent(),
+		API:          api,
+		BucketName:   bucket,
+		ObjectName:   object,
 	}
 	return logger.SetReqInfo(context.Background(), reqInfo)
 }

cmd/version-main.go

@@ -23,7 +23,7 @@ import (
 
 var versionCmd = cli.Command{
 	Name:   "version",
-	Usage:  "Print version.",
+	Usage:  "print version",
 	Action: mainVersion,
 	CustomHelpTemplate: `NAME:
    {{.HelpName}} - {{.Usage}}

cmd/web-handlers.go

@@ -707,7 +707,7 @@ func (web *webAPIHandlers) CreateURLToken(r *http.Request, args *WebGenericArgs,
 func (web *webAPIHandlers) Upload(w http.ResponseWriter, r *http.Request) {
 	ctx := newContext(r, w, "WebUpload")
 
-	defer logger.AuditLog(ctx, w, r)
+	defer logger.AuditLog(w, r, "WebUpload", mustGetClaimsFromToken(r))
 
 	objectAPI := web.ObjectAPI()
 	if objectAPI == nil {
@@ -768,7 +768,7 @@ func (web *webAPIHandlers) Upload(w http.ResponseWriter, r *http.Request) {
 	// Extract incoming metadata if any.
 	metadata, err := extractMetadata(context.Background(), r)
 	if err != nil {
-		writeErrorResponse(w, ErrInternalError, r.URL)
+		writeErrorResponse(w, ErrInternalError, r.URL, guessIsBrowserReq(r))
 		return
 	}
 
@@ -845,7 +845,7 @@ func (web *webAPIHandlers) Upload(w http.ResponseWriter, r *http.Request) {
 func (web *webAPIHandlers) Download(w http.ResponseWriter, r *http.Request) {
 	ctx := newContext(r, w, "WebDownload")
 
-	defer logger.AuditLog(ctx, w, r)
+	defer logger.AuditLog(w, r, "WebDownload", mustGetClaimsFromToken(r))
 
 	var wg sync.WaitGroup
 	objectAPI := web.ObjectAPI()
@@ -1027,7 +1027,7 @@ func (web *webAPIHandlers) DownloadZip(w http.ResponseWriter, r *http.Request) {
 	}
 
 	ctx := newContext(r, w, "WebDownloadZip")
-	defer logger.AuditLog(ctx, w, r)
+	defer logger.AuditLog(w, r, "WebDownloadZip", mustGetClaimsFromToken(r))
 
 	var wg sync.WaitGroup
 	objectAPI := web.ObjectAPI()

cmd/xl-sets.go

@@ -516,6 +516,11 @@ func (s *xlSets) IsNotificationSupported() bool {
 	return s.getHashedSet("").IsNotificationSupported()
 }
 
+// IsListenBucketSupported returns whether listen bucket notification is applicable for this layer.
+func (s *xlSets) IsListenBucketSupported() bool {
+	return true
+}
+
 // IsEncryptionSupported returns whether server side encryption is applicable for this layer.
 func (s *xlSets) IsEncryptionSupported() bool {
 	return s.getHashedSet("").IsEncryptionSupported()

cmd/xl-v1-bucket.go

@@ -294,6 +294,11 @@ func (xl xlObjects) IsNotificationSupported() bool {
 	return true
 }
 
+// IsListenBucketSupported returns whether listen bucket notification is applicable for this layer.
+func (xl xlObjects) IsListenBucketSupported() bool {
+	return true
+}
+
 // IsEncryptionSupported returns whether server side encryption is applicable for this layer.
 func (xl xlObjects) IsEncryptionSupported() bool {
 	return true

cmd/xl-v1-healing.go

@@ -636,9 +636,9 @@ func (xl xlObjects) HealObject(ctx context.Context, bucket, object string, dryRu
 	reqInfo := logger.GetReqInfo(ctx)
 	var newReqInfo *logger.ReqInfo
 	if reqInfo != nil {
-		newReqInfo = logger.NewReqInfo(reqInfo.RemoteHost, reqInfo.UserAgent, reqInfo.RequestID, reqInfo.API, bucket, object)
+		newReqInfo = logger.NewReqInfo(reqInfo.RemoteHost, reqInfo.UserAgent, reqInfo.DeploymentID, reqInfo.RequestID, reqInfo.API, bucket, object)
 	} else {
-		newReqInfo = logger.NewReqInfo("", "", "", "Heal", bucket, object)
+		newReqInfo = logger.NewReqInfo("", "", globalDeploymentID, "", "Heal", bucket, object)
 	}
 	healCtx := logger.SetReqInfo(context.Background(), newReqInfo)
 

cmd/xl-v1-multipart.go

@@ -341,8 +341,10 @@ func (xl xlObjects) PutObjectPart(ctx context.Context, bucket, object, uploadID
 
 	// Delete the temporary object part. If PutObjectPart succeeds there would be nothing to delete.
 	defer xl.deleteObject(ctx, minioMetaTmpBucket, tmpPart, writeQuorum, false)
-	if data.Size() > 0 || data.Size() == -1 {
-		if pErr := xl.prepareFile(ctx, minioMetaTmpBucket, tmpPartPath, data.Size(), onlineDisks, xlMeta.Erasure.BlockSize, xlMeta.Erasure.DataBlocks, writeQuorum); pErr != nil {
+
+	if data.Size() >= 0 {
+		if pErr := xl.prepareFile(ctx, minioMetaTmpBucket, tmpPartPath, data.Size(),
+			onlineDisks, xlMeta.Erasure.BlockSize, xlMeta.Erasure.DataBlocks, writeQuorum); pErr != nil {
 			return pi, toObjectErr(pErr, bucket, object)
 
 		}
@@ -369,6 +371,7 @@ func (xl xlObjects) PutObjectPart(ctx context.Context, bucket, object, uploadID
 	if len(buffer) > int(xlMeta.Erasure.BlockSize) {
 		buffer = buffer[:xlMeta.Erasure.BlockSize]
 	}
+
 	writers := make([]*bitrotWriter, len(onlineDisks))
 	for i, disk := range onlineDisks {
 		if disk == nil {
@@ -376,6 +379,7 @@ func (xl xlObjects) PutObjectPart(ctx context.Context, bucket, object, uploadID
 		}
 		writers[i] = newBitrotWriter(disk, minioMetaTmpBucket, tmpPartPath, DefaultBitrotAlgorithm)
 	}
+
 	n, err := erasure.Encode(ctx, data, writers, buffer, erasure.dataBlocks+1)
 	if err != nil {
 		return pi, toObjectErr(err, bucket, object)
@@ -674,13 +678,6 @@ func (xl xlObjects) CompleteMultipartUpload(ctx context.Context, bucket string,
 			}
 		}
 
-		// Last part could have been uploaded as 0bytes, do not need
-		// to save it in final `xl.json`.
-		if (i == len(parts)-1) && currentXLMeta.Parts[partIdx].Size == 0 {
-			xlMeta.Parts = xlMeta.Parts[:i] // Skip the part.
-			continue
-		}
-
 		// Save for total object size.
 		objectSize += currentXLMeta.Parts[partIdx].Size
 

cmd/xl-v1-object.go

@@ -450,12 +450,17 @@ func (xl xlObjects) GetObjectInfo(ctx context.Context, bucket, object string, op
 func (xl xlObjects) isObjectCorrupted(metaArr []xlMetaV1, errs []error) (validMeta xlMetaV1, ok bool) {
 	// We can consider an object data not reliable
 	// when xl.json is not found in read quorum disks.
-	var notFoundXLJSON int
+	var notFoundXLJSON, corruptedXLJSON int
 	for _, readErr := range errs {
 		if readErr == errFileNotFound {
 			notFoundXLJSON++
 		}
 	}
+	for _, readErr := range errs {
+		if readErr == errCorruptedFormat {
+			corruptedXLJSON++
+		}
+	}
 
 	for _, m := range metaArr {
 		if !m.IsValid() {
@@ -466,24 +471,35 @@ func (xl xlObjects) isObjectCorrupted(metaArr []xlMetaV1, errs []error) (validMe
 	}
 
 	// Return if the object is indeed corrupted.
-	return validMeta, len(xl.getDisks())-notFoundXLJSON < validMeta.Erasure.DataBlocks
+	return validMeta, len(xl.getDisks())-notFoundXLJSON < validMeta.Erasure.DataBlocks || len(xl.getDisks()) == corruptedXLJSON
 }
 
 const xlCorruptedSuffix = ".CORRUPTED"
 
 // Renames the corrupted object and makes it visible.
-func renameCorruptedObject(ctx context.Context, bucket, object string, validMeta xlMetaV1, disks []StorageAPI, errs []error) {
+func (xl xlObjects) renameCorruptedObject(ctx context.Context, bucket, object string, validMeta xlMetaV1, disks []StorageAPI, errs []error) {
+	// if errs returned are corrupted
+	if validMeta.Erasure.DataBlocks == 0 {
+		validMeta = newXLMetaV1(object, len(disks)/2, len(disks)/2)
+	}
 	writeQuorum := validMeta.Erasure.DataBlocks + 1
 
 	// Move all existing objects into corrupted suffix.
-	rename(ctx, disks, bucket, object, bucket, object+xlCorruptedSuffix, true, writeQuorum, []error{errFileNotFound})
+	oldObj := mustGetUUID()
+
+	rename(ctx, disks, bucket, object, minioMetaTmpBucket, oldObj, true, writeQuorum, []error{errFileNotFound})
+
+	// Delete temporary object in the event of failure.
+	// If PutObject succeeded there would be no temporary
+	// object to delete.
+	defer xl.deleteObject(ctx, minioMetaTmpBucket, oldObj, writeQuorum, false)
 
 	tempObj := mustGetUUID()
 
 	// Get all the disks which do not have the file.
 	var cdisks = make([]StorageAPI, len(disks))
 	for i, merr := range errs {
-		if merr == errFileNotFound {
+		if merr == errFileNotFound || merr == errCorruptedFormat {
 			cdisks[i] = disks[i]
 		}
 	}
@@ -497,18 +513,24 @@ func renameCorruptedObject(ctx context.Context, bucket, object string, validMeta
 		disk.AppendFile(minioMetaTmpBucket, pathJoin(tempObj, "part.1"), []byte{})
 
 		// Write algorithm hash for empty part file.
-		alg := validMeta.Erasure.Checksums[0].Algorithm.New()
-		alg.Write([]byte{})
+		var algorithm = DefaultBitrotAlgorithm
+		h := algorithm.New()
+		h.Write([]byte{})
 
 		// Update the checksums and part info.
-		validMeta.Erasure.Checksums[0] = ChecksumInfo{
-			Name:      validMeta.Erasure.Checksums[0].Name,
-			Algorithm: validMeta.Erasure.Checksums[0].Algorithm,
-			Hash:      alg.Sum(nil),
+		validMeta.Erasure.Checksums = []ChecksumInfo{
+			{
+				Name:      "part.1",
+				Algorithm: algorithm,
+				Hash:      h.Sum(nil),
+			},
 		}
-		validMeta.Parts[0] = objectPartInfo{
-			Number: 1,
-			Name:   "part.1",
+
+		validMeta.Parts = []objectPartInfo{
+			{
+				Number: 1,
+				Name:   "part.1",
+			},
 		}
 
 		// Write the `xl.json` with the newly calculated metadata.
@@ -530,7 +552,7 @@ func (xl xlObjects) getObjectInfo(ctx context.Context, bucket, object string) (o
 	// Having read quorum means we have xl.json in at least N/2 disks.
 	if !strings.HasSuffix(object, xlCorruptedSuffix) {
 		if validMeta, ok := xl.isObjectCorrupted(metaArr, errs); ok {
-			renameCorruptedObject(ctx, bucket, object, validMeta, disks, errs)
+			xl.renameCorruptedObject(ctx, bucket, object, validMeta, disks, errs)
 			// Return err file not found since we renamed now the corrupted object
 			return objInfo, errFileNotFound
 		}

docs/bucket/notifications/README.md

@@ -87,8 +87,8 @@ We will enable bucket event notification to trigger whenever a JPEG image is upl
 
 ```
 mc mb myminio/images
-mc events add  myminio/images arn:minio:sqs::1:amqp --suffix .jpg
-mc events list myminio/images
+mc event add  myminio/images arn:minio:sqs::1:amqp --suffix .jpg
+mc event list myminio/images
 arn:minio:sqs::1:amqp s3:ObjectCreated:*,s3:ObjectRemoved:* Filter: suffix=”.jpg”
 ```
 
@@ -199,8 +199,8 @@ We will enable bucket event notification to trigger whenever a JPEG image is upl
 
 ```
 mc mb myminio/images
-mc events add  myminio/images arn:minio:sqs::1:mqtt --suffix .jpg
-mc events list myminio/images
+mc event add  myminio/images arn:minio:sqs::1:mqtt --suffix .jpg
+mc event list myminio/images
 arn:minio:sqs::1:amqp s3:ObjectCreated:*,s3:ObjectRemoved:* Filter: suffix=”.jpg”
 ```
 
@@ -314,8 +314,8 @@ With the `mc` tool, the configuration is very simple to add. Let us say that the
 
 ```
 mc mb myminio/images
-mc events add  myminio/images arn:minio:sqs::1:elasticsearch --suffix .jpg
-mc events list myminio/images
+mc event add  myminio/images arn:minio:sqs::1:elasticsearch --suffix .jpg
+mc event list myminio/images
 arn:minio:sqs::1:elasticsearch s3:ObjectCreated:*,s3:ObjectRemoved:* Filter: suffix=”.jpg”
 ```
 
@@ -460,8 +460,8 @@ With the `mc` tool, the configuration is very simple to add. Let us say that the
 
 ```
 mc mb myminio/images
-mc events add  myminio/images arn:minio:sqs::1:redis --suffix .jpg
-mc events list myminio/images
+mc event add  myminio/images arn:minio:sqs::1:redis --suffix .jpg
+mc event list myminio/images
 arn:minio:sqs::1:redis s3:ObjectCreated:*,s3:ObjectRemoved:* Filter: suffix=”.jpg”
 ```
 
@@ -563,8 +563,8 @@ We will enable bucket event notification to trigger whenever a JPEG image is upl
 
 ```
 mc mb myminio/images
-mc events add  myminio/images arn:minio:sqs::1:nats --suffix .jpg
-mc events list myminio/images
+mc event add  myminio/images arn:minio:sqs::1:nats --suffix .jpg
+mc event list myminio/images
 arn:minio:sqs::1:nats s3:ObjectCreated:*,s3:ObjectRemoved:* Filter: suffix=”.jpg”
 ```
 
@@ -745,10 +745,10 @@ With the `mc` tool, the configuration is very simple to add. Let us say that the
 # Create bucket named `images` in myminio
 mc mb myminio/images
 # Add notification configuration on the `images` bucket using the MySQL ARN. The --suffix argument filters events.
-mc events add myminio/images arn:minio:sqs::1:postgresql --suffix .jpg
+mc event add myminio/images arn:minio:sqs::1:postgresql --suffix .jpg
 # Print out the notification configuration on the `images` bucket.
-mc events list myminio/images
-mc events list myminio/images
+mc event list myminio/images
+mc event list myminio/images
 arn:minio:sqs::1:postgresql s3:ObjectCreated:*,s3:ObjectRemoved:* Filter: suffix=”.jpg”
 ```
 
@@ -844,9 +844,9 @@ With the `mc` tool, the configuration is very simple to add. Let us say that the
 # Create bucket named `images` in myminio
 mc mb myminio/images
 # Add notification configuration on the `images` bucket using the MySQL ARN. The --suffix argument filters events.
-mc events add myminio/images arn:minio:sqs::1:postgresql --suffix .jpg
+mc event add myminio/images arn:minio:sqs::1:postgresql --suffix .jpg
 # Print out the notification configuration on the `images` bucket.
-mc events list myminio/images
+mc event list myminio/images
 arn:minio:sqs::1:postgresql s3:ObjectCreated:*,s3:ObjectRemoved:* Filter: suffix=”.jpg”
 ```
 
@@ -908,8 +908,8 @@ We will enable bucket event notification to trigger whenever a JPEG image is upl
 
 ```
 mc mb myminio/images
-mc events add  myminio/images arn:minio:sqs::1:kafka --suffix .jpg
-mc events list myminio/images
+mc event add  myminio/images arn:minio:sqs::1:kafka --suffix .jpg
+mc event list myminio/images
 arn:minio:sqs::1:kafka s3:ObjectCreated:*,s3:ObjectRemoved:* Filter: suffix=”.jpg”
 ```
 
@@ -965,13 +965,13 @@ We will enable bucket event notification to trigger whenever a JPEG image is upl
 ```
 mc mb myminio/images
 mc mb myminio/images-thumbnail
-mc events add myminio/images arn:minio:sqs::1:webhook --events put --suffix .jpg
+mc event add myminio/images arn:minio:sqs::1:webhook --events put --suffix .jpg
 ```
 
 Check if event notification is successfully configured by
 
 ```
-mc events list myminio/images
+mc event list myminio/images
 ```
 
 You should get a response like this
@@ -1055,8 +1055,8 @@ We will enable bucket event notification to trigger whenever a JPEG image is upl
 
 ```
 mc mb myminio/images
-mc events add  myminio/images arn:minio:sqs::1:nsq --suffix .jpg
-mc events list myminio/images
+mc event add  myminio/images arn:minio:sqs::1:nsq --suffix .jpg
+mc event list myminio/images
 arn:minio:sqs::1:nsq s3:ObjectCreated:*,s3:ObjectRemoved:* Filter: suffix=”.jpg”
 ```
 

docs/config/config.sample.json

@@ -1,5 +1,5 @@
 {
-	"version": "31",
+	"version": "33",
 	"credential": {
 		"accessKey": "36J9X8EZI4KEV1G7EHXA",
 		"secretKey": "ECk2uqOoNqvtJIMQ3WYugvmNPL_-zm3WcRqP5vUM",
@@ -115,7 +115,6 @@
 				"streaming": {
 					"enable": false,
 					"clusterID": "",
-					"clientID": "",
 					"async": false,
 					"maxPubAcksInflight": 0
 				}

docs/kms/README.md

@@ -50,6 +50,8 @@ vault write -f auth/approle/role/my-role/secret-id
 
 The AppRole ID, AppRole Secret Id, Vault endpoint and Vault key name can now be used to start minio server with Vault as KMS.
 
+Note: If [Vault Namespaces](https://learn.hashicorp.com/vault/operations/namespaces) are in use, VAULT_NAMESPACE variable needs to be set before setting approle and transit secrets engine.
+
 ### 3. Environment variables
 
 You'll need the Vault endpoint, AppRole ID, AppRole SecretID and encryption key-ring name defined in step 2.2
@@ -67,6 +69,10 @@ Optionally set `MINIO_SSE_VAULT_CAPATH` as the path to a directory of PEM-encode
 export MINIO_SSE_VAULT_CAPATH=/home/user/custom-pems
 ```
 
+Optionally set `MINIO_SSE_VAULT_NAMESPACE` if AppRole and Transit Secrets engine have been scoped to Vault Namespace
+```
+export MINIO_SSE_VAULT_NAMESPACE=ns1
+```
 ### 4. Test your setup
 
 To test this setup, start minio server with environment variables set in Step 3, and server is ready to handle SSE-S3 requests.

docs/logging/README.md

@@ -77,27 +77,45 @@ Setting this environment variable automatically enables audit logging to the HTT
 {
   "version": "1",
   "deploymentid": "1b3002bf-5005-4d9b-853e-64a05008ebb2",
-  "time": "2018-11-02T21:57:58.231480177Z",
+  "time": "2018-11-21T23:16:06.828154172Z",
   "api": {
-    "name": "ListBuckets",
-    "args": {}
+    "name": "PutObject",
+    "bucket": "my-bucketname",
+    "object": "my-objectname",
+    "status": "OK",
+    "statusCode": 200
   },
   "remotehost": "127.0.0.1",
-  "requestID": "15636D7C53428FD4",
-  "userAgent": "Minio (linux; amd64) minio-go/v6.0.8 mc/2018-11-02T21:13:30Z",
+  "requestID": "156946C6C1E7842C",
+  "userAgent": "Minio (linux; amd64) minio-go/v6.0.6",
+  "requestClaims": {
+    "accessKey": "A1YABB5YPX3ZPL4227XJ",
+    "aud": "PoEgXP6uVO45IsENRngDXj5Au5Ya",
+    "azp": "PoEgXP6uVO45IsENRngDXj5Au5Ya",
+    "exp": 1542845766,
+    "iat": 1542842166,
+    "iss": "https://localhost:9443/oauth2/token",
+    "jti": "33527fcc-254f-43d2-a558-4942554b8ff8"
+  },
   "requestHeader": {
-    "Authorization": "AWS4-HMAC-SHA256 Credential=minio/20181102/us-east-1/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=6db486b42a85b23bffba66d654ce60242a7e92fb27cd4a1756e68082c02cc204",
-    "User-Agent": "Minio (linux; amd64) minio-go/v6.0.8 mc/2018-11-02T21:13:30Z",
-    "X-Amz-Content-Sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
-    "X-Amz-Date": "20181102T215758Z"
+    "Authorization": "AWS4-HMAC-SHA256 Credential=A1YABB5YPX3ZPL4227XJ/20181121/us-east-1/s3/aws4_request,SignedHeaders=host;x-amz-content-sha256;x-amz-date;x-amz-decoded-content-length;x-amz-security-token,Signature=689d9b8f67b5625ea2f0b8cbb3f777d8839a91d50aa81e6a5555f5a6360c1714",
+    "Content-Length": "184",
+    "Content-Type": "application/octet-stream",
+    "User-Agent": "Minio (linux; amd64) minio-go/v6.0.6",
+    "X-Amz-Content-Sha256": "STREAMING-AWS4-HMAC-SHA256-PAYLOAD",
+    "X-Amz-Date": "20181121T231606Z",
+    "X-Amz-Decoded-Content-Length": "12",
+    "X-Amz-Security-Token": "eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJhY2Nlc3NLZXkiOiJBMVlBQkI1WVBYM1pQTDQyMjdYSiIsImF1ZCI6IlBvRWdYUDZ1Vk80NUlzRU5SbmdEWGo1QXU1WWEiLCJhenAiOiJQb0VnWFA2dVZPNDVJc0VOUm5nRFhqNUF1NVlhIiwiZXhwIjoxNTQyODQ1NzY2LCJpYXQiOjE1NDI4NDIxNjYsImlzcyI6Imh0dHBzOi8vbG9jYWxob3N0Ojk0NDMvb2F1dGgyL3Rva2VuIiwianRpIjoiMzM1MjdmY2MtMjU0Zi00M2QyLWE1NTgtNDk0MjU1NGI4ZmY4In0.KEuAq2cQ3H7dfIB5DVuvcgBXT38mr0gthrIbVRSZcA2OWo8QiH1-DWXj9xYbndgr1p2tiEUsQ49cuszQGEVGMQ"
   },
   "responseHeader": {
     "Accept-Ranges": "bytes",
     "Content-Security-Policy": "block-all-mixed-content",
     "Content-Type": "application/xml",
-    "Server": "Minio/DEVELOPMENT.2018-11-02T21-57-15Z (linux; amd64)",
+    "Etag": "",
+    "Server": "Minio/DEVELOPMENT.2018-11-21T23-15-06Z (linux; amd64)",
     "Vary": "Origin",
-    "X-Amz-Request-Id": "15636D7C53428FD4",
+    "X-Amz-Request-Id": "156946C6C1E7842C",
+    "X-Minio-Deployment-Id": "1b3002bf-5005-4d9b-853e-64a05008ebb2",
     "X-Xss-Protection": "1; mode=block"
   }
 }

docs/multi-tenancy/README.md

@@ -1,11 +1,19 @@
-# Multi-tenant Minio Deployment Guide [![Slack](https://slack.minio.io/slack?type=svg)](https://slack.minio.io) [![Go Report Card](https://goreportcard.com/badge/minio/minio)](https://goreportcard.com/report/minio/minio) [![Docker Pulls](https://img.shields.io/docker/pulls/minio/minio.svg?maxAge=604800)](https://hub.docker.com/r/minio/minio/) [![codecov](https://codecov.io/gh/minio/minio/branch/master/graph/badge.svg)](https://codecov.io/gh/minio/minio)
+# Minio Multi-Tenant Deployment Guide [![Slack](https://slack.minio.io/slack?type=svg)](https://slack.minio.io) [![Go Report Card](https://goreportcard.com/badge/minio/minio)](https://goreportcard.com/report/minio/minio) [![Docker Pulls](https://img.shields.io/docker/pulls/minio/minio.svg?maxAge=604800)](https://hub.docker.com/r/minio/minio/) [![codecov](https://codecov.io/gh/minio/minio/branch/master/graph/badge.svg)](https://codecov.io/gh/minio/minio)
 
-## Standalone Deployment
-To host multiple tenants on a single machine, run one Minio server per tenant with dedicated HTTPS port, config and data directory.  
+This topic provides commands to set up different configurations of hosts, nodes, and drives. The examples provided here can be used as a starting point for other configurations.
 
-#### Example 1 : Single host, single drive
+1. [Standalone Deployment](#standalone-deployment) 
+2. [Distributed Deployment](#distributed-deployment) 
+3. [Cloud Scale Deployment](#cloud-scale-deployment)
+
+## <a name="standalone-deployment"></a>1. Standalone Deployment
+
+To host multiple tenants on a single machine, run one Minio Server per tenant with a dedicated HTTPS port, configuration, and data directory.  
+
+### 1.1 Host Multiple Tenants on a Single Drive
+
+Use the following commands to host 3 tenants on a single drive:
 
-This example hosts 3 tenants on a single drive.
 ```sh
 minio --config-dir ~/tenant1 server --address :9001 /data/tenant1
 minio --config-dir ~/tenant2 server --address :9002 /data/tenant2
@@ -14,22 +22,25 @@ minio --config-dir ~/tenant3 server --address :9003 /data/tenant3
 
 ![Example-1](https://github.com/minio/minio/blob/master/docs/screenshots/Example-1.jpg?raw=true)
 
-#### Example 2 : Single host, multiple drives (erasure code)
+### 1.2 Host Multiple Tenants on Multiple Drives (Erasure Code)
+
+Use the following commands to host 3 tenants on multiple drives:
 
-This example hosts 3 tenants on multiple drives.
 ```sh
 minio --config-dir ~/tenant1 server --address :9001 /disk1/data/tenant1 /disk2/data/tenant1 /disk3/data/tenant1 /disk4/data/tenant1
 minio --config-dir ~/tenant2 server --address :9002 /disk1/data/tenant2 /disk2/data/tenant2 /disk3/data/tenant2 /disk4/data/tenant2
 minio --config-dir ~/tenant3 server --address :9003 /disk1/data/tenant3 /disk2/data/tenant3 /disk3/data/tenant3 /disk4/data/tenant3
 ```
+
 ![Example-2](https://github.com/minio/minio/blob/master/docs/screenshots/Example-2.jpg?raw=true)
 
-## Distributed Deployment
-To host multiple tenants in a distributed environment, run several distributed Minio instances concurrently.  
+## <a name="distributed-deployment"></a>2. Distributed Deployment
 
-#### Example 1 : Multiple host, multiple drives (erasure code)
+To host multiple tenants in a distributed environment, run several distributed Minio Server instances concurrently.  
 
-This example hosts 3 tenants on a 4 node distributed setup. Execute the following command on all the four nodes. 
+### 2.1 Host Multiple Tenants on Multiple Drives (Erasure Code)
+
+Use the following commands to host 3 tenants on a 4-node distributed configuration:
 
 ```sh
 export MINIO_ACCESS_KEY=<TENANT1_ACCESS_KEY>
@@ -45,14 +56,12 @@ export MINIO_SECRET_KEY=<TENANT3_SECRET_KEY>
 minio --config-dir ~/tenant3 server --address :9003 http://192.168.10.11/data/tenant3 http://192.168.10.12/data/tenant3 http://192.168.10.13/data/tenant3 http://192.168.10.14/data/tenant3
 ```
 
+**Note:** Execute the commands on all 4 nodes. 
+
 ![Example-3](https://github.com/minio/minio/blob/master/docs/screenshots/Example-3.jpg?raw=true)
 
-*Note*
-
-Please remember that defining and exporting credential environment variables, `MINIO_ACCESS_KEY` and  `MINIO_SECRET_KEY`, is **mandatory** on distributed deployments. It is also required to define and export domain environment variable, `MINIO_DOMAIN`, if domain information is needed to be set.
-
-## Cloud Scale Deployment
-
-For large scale multi-tenant Minio deployments, we recommend using one of the popular container orchestration platforms, e.g. Kubernetes, DC/OS or Docker Swarm. Refer [this document](https://docs.minio.io/docs/minio-deployment-quickstart-guide) to get started with Minio on orchestration platforms.  
+**Note**: On distributed systems, credentials must be defined and exported using the `MINIO_ACCESS_KEY` and  `MINIO_SECRET_KEY` environment variables. If a domain is required, it must be specified by defining and exporting the `MINIO_DOMAIN` environment variable.
 
+## <a name="cloud-scale-deployment"></a>Cloud Scale Deployment
 
+A container orchestration platform (e.g. Kubernetes, DC/OS, or Docker Swarm) is recommended for large-scale, multi-tenant Minio deployments. See the [Minio Deployment Quickstart Guide](https://docs.minio.io/docs/minio-deployment-quickstart-guide) to get started with Minio on orchestration platforms.  

docs/multi-user/README.md

@@ -10,7 +10,7 @@ In this document we will explain in detail on how to configure multiple users.
 - Install Minio - [Minio Quickstart Guide](https://docs.minio.io/docs/minio-quickstart-guide)
 
 ### 2. Create a new user with canned policy
-Use [`mc admin policies`](https://docs.minio.io/docs/minio-admin-complete-guide.html#policies) to create canned policies. Server provides a default set of canned policies namely `writeonly`, `readonly` and `readwrite` *(these policies apply to all resources on the server)*. These can be overridden by custom policies using `mc admin policies` command.
+Use [`mc admin policy`](https://docs.minio.io/docs/minio-admin-complete-guide.html#policies) to create canned policies. Server provides a default set of canned policies namely `writeonly`, `readonly` and `readwrite` *(these policies apply to all resources on the server)*. These can be overridden by custom policies using `mc admin policy` command.
 
 Create new canned policy file `getonly.json`. This policy enables users to download all objects under `my-bucketname`.
 ```json
@@ -35,36 +35,36 @@ EOF
 
 Create new canned policy by name `getonly` using `getonly.json` policy file.
 ```
-mc admin policies add myminio getonly getonly.json
+mc admin policy add myminio getonly getonly.json
 ```
 
-Create a new user `newuser` on Minio use `mc admin users`, specify `getonly` canned policy for this `newuser`.
+Create a new user `newuser` on Minio use `mc admin user`, specify `getonly` canned policy for this `newuser`.
 ```
-mc admin users add myminio newuser newuser123 getonly
+mc admin user add myminio newuser newuser123 getonly
 ```
 
 ### 3. Disable user
 Disable user `newuser`.
 ```
-mc admin users disable myminio newuser
+mc admin user disable myminio newuser
 ```
 
 ### 4. Remove user
 Remove the user `newuser`.
 ```
-mc admin users remove myminio newuser
+mc admin user remove myminio newuser
 ```
 
 ### 5. Change user policy
 Change the policy for user `newuser` to `putonly` canned policy.
 ```
-mc admin users policy myminio newuser putonly
+mc admin user policy myminio newuser putonly
 ```
 
 ### 5. List all users
 List all enabled and disabled users.
 ```
-mc admin users list myminio
+mc admin user list myminio
 ```
 
 ### 6. Configure `mc`

docs/orchestration/docker-compose/docker-compose.yaml

@@ -5,7 +5,7 @@ version: '2'
 # 9001 through 9004.
 services:
  minio1:
-  image: minio/minio:RELEASE.2018-11-06T01-01-02Z
+  image: minio/minio:RELEASE.2018-11-30T03-56-59Z
   volumes:
    - data1:/data
   ports:
@@ -15,7 +15,7 @@ services:
    MINIO_SECRET_KEY: minio123
   command: server http://minio1/data http://minio2/data http://minio3/data http://minio4/data 
  minio2:
-  image: minio/minio:RELEASE.2018-11-06T01-01-02Z
+  image: minio/minio:RELEASE.2018-11-30T03-56-59Z
   volumes:
    - data2:/data
   ports:
@@ -25,7 +25,7 @@ services:
    MINIO_SECRET_KEY: minio123
   command: server http://minio1/data http://minio2/data http://minio3/data http://minio4/data 
  minio3:
-  image: minio/minio:RELEASE.2018-11-06T01-01-02Z
+  image: minio/minio:RELEASE.2018-11-30T03-56-59Z
   volumes:
    - data3:/data
   ports:
@@ -35,7 +35,7 @@ services:
    MINIO_SECRET_KEY: minio123
   command: server http://minio1/data http://minio2/data http://minio3/data http://minio4/data 
  minio4:
-  image: minio/minio:RELEASE.2018-11-06T01-01-02Z
+  image: minio/minio:RELEASE.2018-11-30T03-56-59Z
   volumes:
    - data4:/data
   ports:

docs/orchestration/docker-swarm/docker-compose-secrets.yaml

@@ -2,7 +2,7 @@ version: '3.1'
 
 services:
   minio1:
-    image: minio/minio:RELEASE.2018-11-06T01-01-02Z
+    image: minio/minio:RELEASE.2018-11-30T03-56-59Z
     hostname: minio1
     volumes:
       - minio1-data:/export
@@ -24,7 +24,7 @@ services:
       - access_key
 
   minio2:
-    image: minio/minio:RELEASE.2018-11-06T01-01-02Z
+    image: minio/minio:RELEASE.2018-11-30T03-56-59Z
     hostname: minio2
     volumes:
       - minio2-data:/export
@@ -46,7 +46,7 @@ services:
       - access_key
 
   minio3:
-    image: minio/minio:RELEASE.2018-11-06T01-01-02Z
+    image: minio/minio:RELEASE.2018-11-30T03-56-59Z
     hostname: minio3
     volumes:
       - minio3-data:/export
@@ -68,7 +68,7 @@ services:
       - access_key
 
   minio4:
-    image: minio/minio:RELEASE.2018-11-06T01-01-02Z
+    image: minio/minio:RELEASE.2018-11-30T03-56-59Z
     hostname: minio4
     volumes:
       - minio4-data:/export

docs/orchestration/docker-swarm/docker-compose.yaml

@@ -2,7 +2,7 @@ version: '3'
 
 services:
   minio1:
-    image: minio/minio:RELEASE.2018-11-06T01-01-02Z
+    image: minio/minio:RELEASE.2018-11-30T03-56-59Z
     hostname: minio1
     volumes:
       - minio1-data:/export
@@ -24,7 +24,7 @@ services:
     command: server http://minio1/export http://minio2/export http://minio3/export http://minio4/export
 
   minio2:
-    image: minio/minio:RELEASE.2018-11-06T01-01-02Z
+    image: minio/minio:RELEASE.2018-11-30T03-56-59Z
     hostname: minio2
     volumes:
       - minio2-data:/export
@@ -46,7 +46,7 @@ services:
     command: server http://minio1/export http://minio2/export http://minio3/export http://minio4/export
 
   minio3:
-    image: minio/minio:RELEASE.2018-11-06T01-01-02Z
+    image: minio/minio:RELEASE.2018-11-30T03-56-59Z
     hostname: minio3
     volumes:
       - minio3-data:/export
@@ -68,7 +68,7 @@ services:
     command: server http://minio1/export http://minio2/export http://minio3/export http://minio4/export
 
   minio4:
-    image: minio/minio:RELEASE.2018-11-06T01-01-02Z
+    image: minio/minio:RELEASE.2018-11-30T03-56-59Z
     hostname: minio4
     volumes:
       - minio4-data:/export

docs/orchestration/kubernetes/README.md

@@ -8,36 +8,20 @@ Kubernetes concepts like Deployments and StatefulSets provide perfect platform t
 
 ## Table of Contents
 
-- [Prerequisites](#prerequisites)
+- [Prerequisites](#Prerequisites)
 - [Minio Standalone Server Deployment](#minio-standalone-server-deployment)
-    - [Standalone Quickstart](#standalone-quickstart)
-    - [Create Persistent Volume Claim](#create-persistent-volume-claim)
-    - [Create Deployment](#create-minio-deployment)
-    - [Create LoadBalancer Service](#create-minio-service)
-  - [Update existing Minio Deployment](#update-existing-minio-deployment)
-  - [Resource cleanup](#standalone-resource-cleanup)
-
 - [Minio Distributed Server Deployment](#minio-distributed-server-deployment)
-    - [Distributed Quickstart](#distributed-quickstart)
-    - [Create Minio Headless Service](#create-minio-headless-service)
-    - [Create Minio Statefulset](#create-minio-statefulset)
-    - [Create LoadBalancer Service](#create-minio-service)
-  - [Update existing Minio StatefulSet](#update-existing-minio-statefulset)
-  - [Deploying on cluster nodes with local host path](#deploying-on-cluster-nodes-with-local-host-path)
-  - [Resource cleanup](#distributed-resource-cleanup)
-
 - [Minio GCS Gateway Deployment](#minio-gcs-gateway-deployment)
-    - [GCS Gateway Quickstart](#gcs-gateway-quickstart)
-    - [Create GCS Credentials Secret](#create-gcs-credentials-secret)
-    - [Create Minio GCS Gateway Deployment](#create-minio-gcs-gateway-deployment)
-    - [Create Minio LoadBalancer Service](#create-minio-loadbalancer-service)
-    - [Update Existing Minio GCS Deployment](#update-existing-minio-gcs-deployment)
-  - [Resource cleanup](#gcs-gateway-resource-cleanup) 
+- [Monitoring Minio in Kubernetes](#monitoring-minio)
+
+<a name="Prerequisites"></a>
 
 ## Prerequisites
 
 To run this example, you need Kubernetes version >=1.4 cluster installed and running, and that you have installed the [`kubectl`](https://kubernetes.io/docs/tasks/kubectl/install/) command line tool in your path. Please see the [getting started guides](https://kubernetes.io/docs/getting-started-guides/) for installation instructions for your platform.
 
+<a name="minio-standalone-server-deployment"></a>
+
 ## Minio Standalone Server Deployment
 
 The following section describes the process to deploy standalone [Minio](https://minio.io/) server on Kubernetes. The deployment uses the [official Minio Docker image](https://hub.docker.com/r/minio/minio/~/dockerfile/) from Docker Hub.
@@ -61,31 +45,10 @@ kubectl create -f https://github.com/minio/minio/blob/master/docs/orchestration/
 
 ### Create Persistent Volume Claim
 
-Minio needs persistent storage to store objects. If there is no
-persistent storage, the data stored in Minio instance will be stored in the container file system and will be wiped off as soon as the container restarts.
+Minio needs persistent storage to store objects. If there is no persistent storage, the data stored in Minio instance will be stored in the container file system and will be wiped off as soon as the container restarts.
 
-Create a persistent volume claim (PVC) to request storage for the Minio instance. Kubernetes looks out for PVs matching the PVC request in the cluster and binds it to the PVC automatically.
+Create a persistent volume claim (PVC) to request storage for the Minio instance. Kubernetes looks out for PVs matching the PVC request in the cluster and binds it to the PVC automatically. Create the PersistentVolumeClaim 
 
-This is the PVC description.
-
-```sh
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  # This name uniquely identifies the PVC. This is used in deployment.
-  name: minio-pv-claim
-spec:
-  # Read more about access modes here: http://kubernetes.io/docs/user-guide/persistent-volumes/#access-modes
-  accessModes:
-    # The volume is mounted as read-write by a single node
-    - ReadWriteOnce
-  resources:
-    # This is the request for storage. Should be available in the cluster.
-    requests:
-      storage: 10Gi
-```
-
-Create the PersistentVolumeClaim
 
 ```sh
 kubectl create -f https://github.com/minio/minio/blob/master/docs/orchestration/kubernetes/minio-standalone-pvc.yaml?raw=true
@@ -94,75 +57,7 @@ persistentvolumeclaim "minio-pv-claim" created
 
 ### Create Minio Deployment
 
-A deployment encapsulates replica sets and pods — so, if a pod goes down, replication controller makes sure another pod comes up automatically. This way you won’t need to bother about pod failures and will have a stable Minio service available.
-
-This is the deployment description.
-
-```sh
-apiVersion: extensions/v1beta1
-kind: Deployment
-metadata:
-  # This name uniquely identifies the Deployment
-  name: minio
-spec:
-  strategy:
-    # Specifies the strategy used to replace old Pods by new ones
-    # Refer: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy
-    type: Recreate
-  template:
-    metadata:
-      labels:
-        # This label is used as a selector in Service definition
-        app: minio
-    spec:
-      # Volumes used by this deployment
-      volumes:
-      - name: data
-        # This volume is based on PVC
-        persistentVolumeClaim:
-          # Name of the PVC created earlier
-          claimName: minio-pv-claim
-      containers:
-      - name: minio
-        # Volume mounts for this container
-        volumeMounts:
-        # Volume 'data' is mounted to path '/data'
-        - name: data 
-          mountPath: "/data"
-        # Pulls the lastest Minio image from Docker Hub
-        image: minio/minio:RELEASE.2018-11-06T01-01-02Z
-        args:
-        - server
-        - /data
-        env:
-        # Minio access key and secret key
-        - name: MINIO_ACCESS_KEY
-          value: "minio"
-        - name: MINIO_SECRET_KEY
-          value: "minio123"
-        ports:
-        - containerPort: 9000
-        # Readiness probe detects situations when Minio server instance
-        # is not ready to accept traffic. Kubernetes doesn't forward
-        # traffic to the pod till readiness checks fail.
-        readinessProbe:
-          httpGet:
-            path: /minio/health/ready
-            port: 9000
-          initialDelaySeconds: 120
-          periodSeconds: 20
-        # Liveness probe detects situations where Minio server instance
-        # is not working properly and needs restart. Kubernetes automatically
-        # restarts the pods if liveness checks fail.
-        livenessProbe:
-          httpGet:
-            path: /minio/health/live
-            port: 9000
-          initialDelaySeconds: 120
-          periodSeconds: 20
-```
-
-Create the Deployment
+A deployment encapsulates replica sets and pods. If a pod goes down, replication controller makes sure another pod comes up automatically. This way you won’t need to bother about pod failures and will have a stable Minio service available. Create the Deployment using the following command
 
 ```sh
 kubectl create -f https://github.com/minio/minio/blob/master/docs/orchestration/kubernetes/minio-standalone-deployment.yaml?raw=true
@@ -173,25 +68,7 @@ deployment "minio-deployment" created
 
 Now that you have a Minio deployment running, you may either want to access it internally (within the cluster) or expose it as a Service onto an external (outside of your cluster, maybe public internet) IP address, depending on your use case. You can achieve this using Services. There are 3 major service types — default type is ClusterIP, which exposes a service to connection from inside the cluster. NodePort and LoadBalancer are two types that expose services to external traffic.
 
-In this example, we expose the Minio Deployment by creating a LoadBalancer service. This is the service description.
-
-```sh
-apiVersion: v1
-kind: Service
-metadata:
-  # This name uniquely identifies the service
-  name: minio-service
-spec:
-  type: LoadBalancer
-  ports:
-    - port: 9000
-      targetPort: 9000
-      protocol: TCP
-  selector:
-    # Looks for labels `app:minio` in the namespace and applies the spec
-    app: minio
-```
-Create the Minio service
+In this example, we expose the Minio Deployment by creating a LoadBalancer service. Create the Minio service using the following command
 
 ```sh
 kubectl create -f https://github.com/minio/minio/blob/master/docs/orchestration/kubernetes/minio-standalone-service.yaml?raw=true
@@ -230,6 +107,8 @@ kubectl delete deployment minio \
 && kubectl delete svc minio-service
 ```
 
+<a name="minio-distributed-server-deployment"></a>
+
 ## Minio Distributed Server Deployment
 
 The following document describes the process to deploy [distributed Minio](https://docs.minio.io/docs/distributed-minio-quickstart-guide) server on Kubernetes. This example uses the [official Minio Docker image](https://hub.docker.com/r/minio/minio/~/dockerfile/) from Docker Hub.
@@ -252,27 +131,7 @@ kubectl create -f https://github.com/minio/minio/blob/master/docs/orchestration/
 
 ### Create Minio Headless Service
 
-Headless Service controls the domain within which StatefulSets are created. The domain managed by this Service takes the form: `$(service name).$(namespace).svc.cluster.local` (where “cluster.local” is the cluster domain), and the pods in this domain take the form: `$(pod-name-{i}).$(service name).$(namespace).svc.cluster.local`. This is required to get a DNS resolvable URL for each of the pods created within the Statefulset.
-
-This is the Headless service description.
-
-```sh
-apiVersion: v1
-kind: Service
-metadata:
-  name: minio
-  labels:
-    app: minio
-spec:
-  clusterIP: None
-  ports:
-    - port: 9000
-      name: minio
-  selector:
-    app: minio
-```
-
-Create the Headless Service
+Headless Service controls the domain within which StatefulSets are created. The domain managed by this Service takes the form: `$(service name).$(namespace).svc.cluster.local` (where “cluster.local” is the cluster domain), and the pods in this domain take the form: `$(pod-name-{i}).$(service name).$(namespace).svc.cluster.local`. This is required to get a DNS resolvable URL for each of the pods created within the Statefulset. Create the Headless Service using the following command
 
 ```sh
 $ kubectl create -f https://github.com/minio/minio/blob/master/docs/orchestration/kubernetes/minio-distributed-headless-service.yaml?raw=true
@@ -281,71 +140,7 @@ service "minio" created
 
 ### Create Minio Statefulset
 
-A StatefulSet provides a deterministic name and a unique identity to each pod, making it easy to deploy stateful distributed applications. To launch distributed Minio you need to pass drive locations as parameters to the minio server command. Then, you’ll need to run the same command on all the participating pods. StatefulSets offer a perfect way to handle this requirement.
-
-This is the Statefulset description.
-
-```sh
-apiVersion: apps/v1beta1
-kind: StatefulSet
-metadata:
-  # This name uniquely identifies the StatefulSet
-  name: minio
-spec:
-  serviceName: minio
-  replicas: 4
-  selector:
-    matchLabels:
-      app: minio # has to match .spec.template.metadata.labels
-  template:
-    metadata:
-      labels:
-        app: minio # has to match .spec.selector.matchLabels
-    spec:
-      containers:
-      - name: minio
-        env:
-        - name: MINIO_ACCESS_KEY
-          value: "minio"
-        - name: MINIO_SECRET_KEY
-          value: "minio123"
-        image: minio/minio:RELEASE.2018-11-06T01-01-02Z
-        args:
-        - server
-        - http://minio-0.minio.default.svc.cluster.local/data
-        - http://minio-1.minio.default.svc.cluster.local/data
-        - http://minio-2.minio.default.svc.cluster.local/data
-        - http://minio-3.minio.default.svc.cluster.local/data
-        ports:
-        - containerPort: 9000
-        # These volume mounts are persistent. Each pod in the PetSet
-        # gets a volume mounted based on this field.
-        volumeMounts:
-        - name: data
-          mountPath: /data
-        # Liveness probe detects situations where Minio server instance
-        # is not working properly and needs restart. Kubernetes automatically
-        # restarts the pods if liveness checks fail.
-        livenessProbe:
-          httpGet:
-            path: /minio/health/live
-            port: 9000
-          initialDelaySeconds: 120
-          periodSeconds: 20
-  # These are converted to volume claims by the controller
-  # and mounted at the paths mentioned above.
-  volumeClaimTemplates:
-  - metadata:
-      name: data
-    spec:
-      accessModes:
-        - ReadWriteOnce
-      resources:
-        requests:
-          storage: 10Gi
-```
-
-Create the Statefulset
+A StatefulSet provides a deterministic name and a unique identity to each pod, making it easy to deploy stateful distributed applications. To launch distributed Minio you need to pass drive locations as parameters to the minio server command. Then, you’ll need to run the same command on all the participating pods. StatefulSets offer a perfect way to handle this requirement. Create the Statefulset using the following command
 
 ```sh
 $ kubectl create -f https://github.com/minio/minio/blob/master/docs/orchestration/kubernetes/minio-distributed-statefulset.yaml?raw=true
@@ -354,25 +149,7 @@ statefulset "minio" created
 
 ### Create Minio Service
 
-Now that you have a Minio statefulset running, you may either want to access it internally (within the cluster) or expose it as a Service onto an external (outside of your cluster, maybe public internet) IP address, depending on your use case. You can achieve this using Services. There are 3 major service types — default type is ClusterIP, which exposes a service to connection from inside the cluster. NodePort and LoadBalancer are two types that expose services to external traffic.
-
-In this example, we expose the Minio Deployment by creating a LoadBalancer service. This is the service description.
-
-```sh
-apiVersion: v1
-kind: Service
-metadata:
-  name: minio-service
-spec:
-  type: LoadBalancer
-  ports:
-    - port: 9000
-      targetPort: 9000
-      protocol: TCP
-  selector:
-    app: minio
-```
-Create the Minio service
+Now that you have a Minio statefulset running, you may either want to access it internally (within the cluster) or expose it as a Service onto an external (outside of your cluster, maybe public internet) IP address, depending on your use case. You can achieve this using Services. There are 3 major service types — default type is ClusterIP, which exposes a service to connection from inside the cluster. NodePort and LoadBalancer are two types that expose services to external traffic. Create the Minio service using the following command
 
 ```sh
 $ kubectl create -f https://github.com/minio/minio/blob/master/docs/orchestration/kubernetes/minio-distributed-service.yaml?raw=true
@@ -388,6 +165,7 @@ minio-service   10.55.248.23   104.199.249.165   9000:31852/TCP   1m
 ```
 
 ### Update existing Minio StatefulSet
+
 You can update an existing Minio StatefulSet to use a newer Minio release. To do this, use the `kubectl patch statefulset` command:
 
 ```sh
@@ -444,6 +222,8 @@ kubectl label node hostname3  -l minio-server=true
 kubectl label node hostname4  -l minio-server=true
 ```
 
+<a name="minio-gcs-gateway-deployment"></a>
+
 ## Minio GCS Gateway Deployment
 
 The following section describes the process to deploy [Minio](https://minio.io/) GCS Gateway on Kubernetes. The deployment uses the [official Minio Docker image](https://hub.docker.com/r/minio/minio/~/dockerfile/) from Docker Hub.
@@ -494,56 +274,7 @@ kubectl create secret generic gcs-credentials --from-file=/path/to/gcloud/creden
 A deployment encapsulates replica sets and pods — so, if a pod goes down, replication controller makes sure another pod comes up automatically. This way you won’t need to bother about pod failures and will have a stable Minio service available.
 
 Minio Gateway uses GCS as its storage backend and need to use a GCP `projectid` to identify your credentials. Update the section `gcp_project_id` with your
-GCS project ID. This is the deployment description.
-
-```sh
-apiVersion: extensions/v1beta1
-kind: Deployment
-metadata:
-  # This name uniquely identifies the Deployment
-  name: minio-deployment
-spec:
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      labels:
-        # Label is used as selector in the service.
-        app: minio
-    spec:
-      # Refer to the secret created earlier
-      volumes:
-      - name: gcs-credentials
-        secret:
-          # Name of the Secret created earlier
-          secretName: gcs-credentials
-      containers:
-      - name: minio
-        # Pulls the default Minio image from Docker Hub
-        image: minio/minio:RELEASE.2018-11-06T01-01-02Z
-        args:
-        - gateway
-        - gcs
-        - gcp_project_id
-        env:
-        # Minio access key and secret key
-        - name: MINIO_ACCESS_KEY
-          value: "minio"
-        - name: MINIO_SECRET_KEY
-          value: "minio123"
-        # Google Cloud Service uses this variable
-        - name: GOOGLE_APPLICATION_CREDENTIALS
-          value: "/etc/credentials/application_default_credentials.json"
-        ports:
-        - containerPort: 9000
-        # Mount the volume into the pod
-        volumeMounts:
-        - name: gcs-credentials
-          mountPath: "/etc/credentials"
-          readOnly: true
-```
-
-Create the Deployment
+GCS project ID. Create the Deployment using the following command
 
 ```sh
 kubectl create -f https://github.com/minio/minio/blob/master/docs/orchestration/kubernetes/minio-gcs-gateway-deployment.yaml?raw=true
@@ -552,25 +283,7 @@ deployment "minio-deployment" created
 
 ### Create Minio LoadBalancer Service
 
-Now that you have a Minio deployment running, you may either want to access it internally (within the cluster) or expose it as a Service onto an external (outside of your cluster, maybe public internet) IP address, depending on your use case. You can achieve this using Services. There are 3 major service types — default type is ClusterIP, which exposes a service to connection from inside the cluster. NodePort and LoadBalancer are two types that expose services to external traffic.
-
-In this example, we expose the Minio Deployment by creating a LoadBalancer service. This is the service description.
-
-```sh
-apiVersion: v1
-kind: Service
-metadata:
-  name: minio-service
-spec:
-  type: LoadBalancer
-  ports:
-    - port: 9000
-      targetPort: 9000
-      protocol: TCP
-  selector:
-    app: minio
-```
-Create the Minio service
+Now that you have a Minio deployment running, you may either want to access it internally (within the cluster) or expose it as a Service onto an external (outside of your cluster, maybe public internet) IP address, depending on your use case. You can achieve this using Services. There are 3 major service types — default type is ClusterIP, which exposes a service to connection from inside the cluster. NodePort and LoadBalancer are two types that expose services to external traffic. Create the Minio service using the following command
 
 ```sh
 kubectl create -f https://github.com/minio/minio/blob/master/docs/orchestration/kubernetes/minio-gcs-gateway-service.yaml?raw=true
@@ -608,7 +321,15 @@ kubectl delete deployment minio-deployment \
 &&  kubectl delete secret gcs-credentials 
 ```
 
-### Explore Further
+<a name="monitoring-minio"></a>
+
+## Monitoring Minio in Kubernetes
+
+Minio server exposes un-authenticated readiness and liveness endpoints so Kubernetes can natively identify unhealthy Minio containers. Minio also exposes Prometheus compatible data on a different endpoint to enable Prometheus users to natively monitor their Minio deployments.
+
+_Note_ : Readiness check is not allowed in distributed Minio deployment. This is because Kubernetes doesn't allow any traffic to containers whose Readiness checks fail, and in a distributed setup, Minio server can't respond to Readiness checks until all the nodes are reachable. So, Liveness checks are recommended native Kubernetes monitoring approach for distributed Minio StatefulSets. Read more about Kubernetes recommendations for [container probes](https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes).
+
+## Explore Further
 - [Minio Erasure Code QuickStart Guide](https://docs.minio.io/docs/minio-erasure-code-quickstart-guide)
 - [Kubernetes Documentation](https://kubernetes.io/docs/home/)
 - [Helm package manager for kubernetes](https://helm.sh/)

docs/orchestration/kubernetes/minio-distributed-daemonset.yaml

@@ -30,7 +30,7 @@ spec:
           value: "minio"
         - name: MINIO_SECRET_KEY
           value: "minio123"
-        image: minio/minio:RELEASE.2018-04-04T05-20-54Z
+        image: minio/minio:RELEASE.2018-11-30T03-56-59Z
         # Unfortunately you must manually define each server. Perhaps autodiscovery via DNS can be implemented in the future.
         args:
         - server

docs/orchestration/kubernetes/minio-distributed-statefulset.yaml

@@ -21,7 +21,7 @@ spec:
           value: "minio"
         - name: MINIO_SECRET_KEY
           value: "minio123"
-        image: minio/minio:RELEASE.2018-11-06T01-01-02Z
+        image: minio/minio:RELEASE.2018-11-30T03-56-59Z
         args:
         - server
         - http://minio-0.minio.default.svc.cluster.local/data

docs/orchestration/kubernetes/minio-gcs-gateway-deployment.yaml

@@ -21,7 +21,7 @@ spec:
       containers:
       - name: minio
         # Pulls the default Minio image from Docker Hub
-        image: minio/minio:RELEASE.2018-11-06T01-01-02Z
+        image: minio/minio:RELEASE.2018-11-30T03-56-59Z
         args:
         - gateway
         - gcs

docs/orchestration/kubernetes/minio-standalone-deployment.yaml

@@ -29,7 +29,7 @@ spec:
         - name: data 
           mountPath: "/data"
         # Pulls the lastest Minio image from Docker Hub
-        image: minio/minio:RELEASE.2018-11-06T01-01-02Z
+        image: minio/minio:RELEASE.2018-11-30T03-56-59Z
         args:
         - server
         - /data

docs/tls/README.md

@@ -1,90 +1,149 @@
 # How to secure access to Minio server with TLS [![Slack](https://slack.minio.io/slack?type=svg)](https://slack.minio.io)
 
-This document explains how to configure Minio server with TLS certificates on Linux and Windows platforms.
+This guide explains how to configure Minio Server with TLS certificates on Linux and Windows platforms.
 
-## 1. Prerequisites
+1. [Install Minio Server](#install-minio-server) 
+2. [Use an Existing Key and Certificate with Minio](#use-an-existing-key-and-certificate-with-minio) 
+3. [Generate and use Self-signed Keys and Certificates with Minio](#generate-use-self-signed-keys-certificates) 
+4. [Install Certificates from Third-party CAs](#install-certificates-from-third-party-cas)
 
-Download Minio server from [here](https://docs.minio.io/docs/minio-quickstart-guide)
+## <a name="install-minio-server"></a>1. Install Minio Server
 
-## 2. Existing certificates
+Install Minio Server using the instructions in the [Minio Quickstart Guide](http://docs.minio.io/docs/minio-quickstart-guide).
 
-If you have already acquired private keys and public certificates, copy them under `certs` directory in your Minio config directory. By default config directory is `${HOME}/.minio/` or `%%USERPROFILE%%\.minio\` (based on your operating system). Note that the file should be named as `private.key` and `public.crt` for key and certificate respectively.
+## <a name="use-an-existing-key-and-certificate-with-minio"></a>2. Use an Existing Key and Certificate with Minio 
 
-If the certificate is signed by a certificate authority (CA), `public.crt` should be the concatenation of the server's certificate, any intermediates, and the CA's root certificate.
+This section describes how to use a private key and public certificate that have been obtained from a certificate authority (CA). If these files have not been obtained, skip to [3. Generate Self-signed Certificates](#generate-use-self-signed-keys-certificates) or generate them with [Let's Encrypt](https://letsencrypt.org) using these instructions: [https://docs.minio.io/docs/generate-let-s-encypt-certificate-using-concert-for-minio](https://docs.minio.io/docs/).
 
-If you're looking to generate CA certificate for Minio using Let's Encrypt, follow the docs [here](https://docs.minio.io/docs/generate-let-s-encypt-certificate-using-concert-for-minio).
+Copy the existing private key and public certificate to the `certs` directory within the Minio configuration directory. The default configuration directory is:
+* **Linux:** `${HOME}/.minio/`
+* **Windows:** `%%USERPROFILE%%\.minio\`
 
-## 3. Generate self-signed certificates
+**Note:** 
+* The key and certificate files must be appended with `.key` and `.crt`, respectively.
+* A certificate signed by a CA contains information about the issued identity (e.g. name, expiry, public key) and any intermediate certificates. The root CA is not included.
 
-Before generating your self-signed certificate, note that
+## <a name="generate-use-self-signed-keys-certificates"></a>3. Generate and use Self-signed Keys and Certificates with Minio
 
-- Minio supports only key/certificate in PEM format on Linux.
-- Minio supports only key/certificate in PEM format on Windows. We don't support PFX certificates currently.
+This section describes how to generate a self-signed certificate using various tools:
 
-### Using generate_cert.go
+3.1 [Use generate_cert.go to Generate a Certificate](#using-go) 
+3.2 [Use OpenSSL to Generate a Certificate](#using-open-ssl) 
+3.3 [Use OpenSSL (with IP address) to Generate a Certificate](#using-open-ssl-with-ip) 
+3.4 [Use GnuTLS (for Windows) to Generate a Certificate](#using-gnu-tls)
 
-Download [generate_cert.go](https://golang.org/src/crypto/tls/generate_cert.go?m=text). This is a simple go tool to generate self-signed certificates.
+**Note:**
+* Minio only supports keys and certificates in PEM format on Linux and Windows.
+* Minio doesn't currently support PFX certificates.
 
-`generate_cert.go` already provides SAN certificates with DNS and IP entries:
+### <a name="using-go"></a>3.1 Use generate_cert.go to Generate a Certificate
+
+Download [`generate_cert.go`](https://golang.org/src/crypto/tls/generate_cert.go?m=text).
+
+`generate_cert.go` is a simple *Go* tool to generate self-signed certificates, and provides SAN certificates with DNS and IP entries:
 
 ```sh
 go run generate_cert.go -ca --host "10.10.0.3"
 ```
 
-### Using OpenSSL
+A response similar to this one should be displayed:
 
-**Generate the private key**:
+```
+2018/11/21 10:16:18 wrote cert.pem
+2018/11/21 10:16:18 wrote key.pem
+```
+
+Rename `cert.pem` to `public.crt` and `key.pem` to `private.key`.
+
+### <a name="using-open-ssl"></a>3.2 Use OpenSSL to Generate a Certificate
+
+Use one of the following methods to generate a certificate using `openssl`:
+
+* 3.2.1 [Generate a private key with ECDSA](#generate-private-key-with-ecdsa) 
+* 3.2.2 [Generate a private key with RSA](#generate-private-key-with-rsa)
+* 3.2.3 [Generate a self-signed certificate](#generate-a-self-signed-certificate)
+
+
+#### 3.2.1 <a name="generate-private-key-with-ecdsa"></a>Generate a private key with ECDSA.
+
+Use the following command to generate a private key with ECDSA:
 
-1. **ECDSA:**  
 ```sh
 openssl ecparam -genkey -name prime256v1 | openssl ec -out private.key
 ```
-or protect the private key additionally with a password:  
+
+A response similar to this one should be displayed:
+
+```
+read EC key
+writing EC key
+```
+
+Alternatively, use the following command to generate a private ECDSA key protected by a password:
+
 ```sh
 openssl ecparam -genkey -name prime256v1 | openssl ec -aes256 -out private.key -passout pass:PASSWORD
 ```
 
-Notice that the NIST curves P-384 and P-521 are not supported yet.
+**Note:** NIST curves P-384 and P-521 are not currently supported.
+
+#### 3.2.2 <a name="generate-private-key-with-rsa"></a>Generate a private key with RSA.
+
+Use the following command to generate a private key with RSA:
 
-2. **RSA:**
 ```sh
 openssl genrsa -out private.key 2048
 ```  
-or protect the private key additionally with a password:  
+A response similar to this one should be displayed:
+
+```
+Generating RSA private key, 2048 bit long modulus
+............................................+++
+...........+++
+e is 65537 (0x10001)
+```
+
+Alternatively, use the following command to generate a private RSA key protected by a password:
+
 ```sh
 openssl genrsa -aes256 -out private.key 2048 -passout pass:PASSWORD
 ```
 
-If a password-protected private key is used the password must be provided through the environment variable `MINIO_CERT_PASSWD`:
-```sh
-export MINIO_CERT_PASSWD=PASSWORD
-``` 
-Please use your own password instead of PASSWORD.
+**Note:** When using a password-protected private key, the password must be provided through the environment variable `MINIO_CERT_PASSWD` using the following command:
+
+```sh
+export MINIO_CERT_PASSWD=<PASSWORD>
+``` 
+
+The default OpenSSL format for private encrypted keys is PKCS-8, but Minio only supports PKCS-1. An RSA key that has been formatted with PKCS-8 can be converted to PKCS-1 using the following command:
 
-**Notice:**  
-The OpenSSL default format for encrypted private keys is PKCS-8. Minio only supports PKCS-1 encrypted private keys.
-An encrypted private PKCS-8 formated RSA key can be converted to an encrypted private PKCS-1 formated RSA key by:
 ```sh
 openssl rsa -in private-pkcs8-key.key -aes256 -passout pass:PASSWORD -out private.key
 ```  
 
-**Generate the self-signed certificate**:
+#### <a name="generate-a-self-signed-certificate"></a>3.2.3 Generate a self-signed certificate.
 
-Generate self-signed certificate using the below command (remember to replace `<domain.com>` with your actual domain name)
+Use the following command to generate a self-signed certificate and enter a passphrase when prompted:
 
 ```sh
 openssl req -new -x509 -days 3650 -key private.key -out public.crt -subj "/C=US/ST=state/L=location/O=organization/CN=<domain.com>"
 ```
 
-Generate self-signed wildcard certificate using the below command. This certificate will be valid for all the sub-domains under `domain.com`. Wildcard certificates come in handy while deploying distributed Minio instances where there may be multiple sub-domains under a single domain, with each one running a separate Minio instance.
+**Note:** Replace `<domain.com>` with the development domain name.
+
+Alternatively, use the command below to generate a self-signed wildcard certificate that is valid for all subdomains under `<domain.com>`. Wildcard certificates are useful for deploying distributed Minio instances, where each instance runs on a subdomain under a single parent domain.
 
 ```sh
 openssl req -new -x509 -days 3650 -key private.key -out public.crt -subj "/C=US/ST=state/L=location/O=organization/CN=<*.domain.com>"
 ```
 
-### Using OpenSSL (with IP address)
+### <a name="using-open-ssl-with-ip"></a>3.3 Use OpenSSL (with IP address) to Generate a Certificate
 
-Create a file called `openssl.conf` and add the below text in the file. Note that you'll need to change the `IP.1` field to point to correct IP address.
+This section describes how to specify an IP address to `openssl` when generating a certificate.
+
+#### 3.3.1 Create a configuration file.
+
+Create a file named `openssl.conf` with the content below. Change `IP.1` to point to the correct IP address:
 
 ```sh
 [req]
@@ -107,31 +166,43 @@ subjectAltName = @alt_names
 IP.1 = 127.0.0.1
 ```
 
-Then run
+#### 3.3.2 Run `openssl` and specify the configuration file:
 
 ```sh
 openssl req -x509 -nodes -days 730 -newkey rsa:2048 -keyout private.key -out public.crt -config openssl.conf
 ```
 
-### Using GnuTLS (for Windows)
+### <a name="using-gnu-tls"></a>3.4 Use GnuTLS (for Windows) to Generate a Certificate
 
-Download and decompress the Windows version of GnuTLS from [here](http://www.gnutls.org/download.html)
+This section describes how to use GnuTLS on Windows to generate a certificate.
 
-Make sure to add extracted GnuTLS binary path to your system path.
+#### 3.4.1 Install and configure GnuTLS.
+Download and decompress the Windows version of GnuTLS from [here](http://www.gnutls.org/download.html).
+
+Use PowerShell to add the path of the extracted GnuTLS binary to the system path:
 
 ```
 setx path "%path%;C:\Users\MyUser\Downloads\gnutls-3.4.9-w64\bin"
 ```
 
-You may need to restart your powershell console for this to take affect.
+**Note:** PowerShell may need to be restarted for this change to take effect.
 
-- Run the following command to create `private.key`
+#### 3.4.2 Generate a private key:
+Run the following command to generate a private `.key` file:
 
 ```
 certtool.exe --generate-privkey --outfile private.key
 ```
 
-- Create a file `cert.cnf` with all the necessary information to generate a certificate.
+A response similar to this one should be displayed:
+
+```
+Generating a 3072 bit RSA private key...
+```
+
+####3.4.3 Generate a public certificate:
+
+Create a file called `cert.cnf` with the content below. This file contains all of the information necessary to generate a certificate using `certtool.exe`:
 
 ```
 # X.509 Certificate options
@@ -173,15 +244,17 @@ tls_www_server
 encryption_key
 ```
 
-Generate public certificate
+Run `certtool.exe` and specify the configuration file to generate a certificate:
 
 ```
 certtool.exe --generate-self-signed --load-privkey private.key --template cert.cnf --outfile public.crt
 ```
 
-## 4. Install third-party CAs
+## <a name="install-certificates-from-third-party-cas"></a>4. Install Certificates from Third-party CAs
 
-Minio can be configured to connect to other servers, whether Minio nodes or servers like NATs, Redis. If these servers use certificates that are not registered in one of the known certificates authorities, you can make Minio server trust these CAs by dropping these certificates under Minio config path (`~/.minio/certs/CAs/` on Linux or `C:\Users\<Username>\.minio\certs\CAs` on Windows).
+Minio can connect to other servers, including Minio nodes or other server types such as NATs and Redis. If these servers use certificates that were not registered with a known CA, add trust for these certificates to Minio Server by placing these certificates under one of the following Minio configuration paths:
+* **Linux:** `~/.minio/certs/CAs/`
+* **Windows**: `C:\Users\<Username>\.minio\certs\CAs`
 
 # Explore Further
 * [TLS Configuration for Minio server on Kubernetes](https://github.com/minio/minio/tree/master/docs/tls/kubernetes)

docs/zh_CN/bucket/notifications/README.md

@@ -77,8 +77,8 @@ Minio支持[RabbitMQ](https://www.rabbitmq.com/)中所有的交换方式，这
 
 ```
 mc mb myminio/images
-mc events add  myminio/images arn:minio:sqs:us-east-1:1:amqp --suffix .jpg
-mc events list myminio/images
+mc event add  myminio/images arn:minio:sqs:us-east-1:1:amqp --suffix .jpg
+mc event list myminio/images
 arn:minio:sqs:us-east-1:1:amqp s3:ObjectCreated:*,s3:ObjectRemoved:* Filter: suffix=”.jpg”
 ```
 
@@ -183,8 +183,8 @@ Minio支持任何支持MQTT 3.1或3.1.1的MQTT服务器，并且可以通过TCP
 
 ```
 mc mb myminio/images
-mc events add  myminio/images arn:minio:sqs:us-east-1:1:mqtt --suffix .jpg
-mc events list myminio/images
+mc event add  myminio/images arn:minio:sqs:us-east-1:1:mqtt --suffix .jpg
+mc event list myminio/images
 arn:minio:sqs:us-east-1:1:amqp s3:ObjectCreated:*,s3:ObjectRemoved:* Filter: suffix=”.jpg”
 ```
 
@@ -297,8 +297,8 @@ Minio Server的配置文件默认路径是 ``~/.minio/config.json``。ES配置
 
 ```
 mc mb myminio/images
-mc events add  myminio/images arn:minio:sqs:us-east-1:1:elasticsearch --suffix .jpg
-mc events list myminio/images
+mc event add  myminio/images arn:minio:sqs:us-east-1:1:elasticsearch --suffix .jpg
+mc event list myminio/images
 arn:minio:sqs:us-east-1:1:elasticsearch s3:ObjectCreated:*,s3:ObjectRemoved:* Filter: suffix=”.jpg”
 ```
 
@@ -436,8 +436,8 @@ Minio Server的配置文件默认路径是 ``~/.minio/config.json``。Redis配
 
 ```
 mc mb myminio/images
-mc events add  myminio/images arn:minio:sqs:us-east-1:1:redis --suffix .jpg
-mc events list myminio/images
+mc event add  myminio/images arn:minio:sqs:us-east-1:1:redis --suffix .jpg
+mc event list myminio/images
 arn:minio:sqs:us-east-1:1:redis s3:ObjectCreated:*,s3:ObjectRemoved:* Filter: suffix=”.jpg”
 ```
 
@@ -534,8 +534,8 @@ Minio服务也支持 [NATS Streaming mode](http://nats.io/documentation/streamin
 
 ```
 mc mb myminio/images
-mc events add  myminio/images arn:minio:sqs:us-east-1:1:nats --suffix .jpg
-mc events list myminio/images
+mc event add  myminio/images arn:minio:sqs:us-east-1:1:nats --suffix .jpg
+mc event list myminio/images
 arn:minio:sqs:us-east-1:1:nats s3:ObjectCreated:*,s3:ObjectRemoved:* Filter: suffix=”.jpg”
 ```
 
@@ -711,10 +711,10 @@ Minio Server的配置文件默认路径是 ``~/.minio/config.json``。PostgreSQL
 # Create bucket named `images` in myminio
 mc mb myminio/images
 # Add notification configuration on the `images` bucket using the MySQL ARN. The --suffix argument filters events.
-mc events add myminio/images arn:minio:sqs:us-east-1:1:postgresql --suffix .jpg
+mc event add myminio/images arn:minio:sqs:us-east-1:1:postgresql --suffix .jpg
 # Print out the notification configuration on the `images` bucket.
-mc events list myminio/images
-mc events list myminio/images
+mc event list myminio/images
+mc event list myminio/images
 arn:minio:sqs:us-east-1:1:postgresql s3:ObjectCreated:*,s3:ObjectRemoved:* Filter: suffix=”.jpg”
 ```
 
@@ -805,9 +805,9 @@ Minio Server的配置文件默认路径是 ``~/.minio/config.json``。MySQL配
 # Create bucket named `images` in myminio
 mc mb myminio/images
 # Add notification configuration on the `images` bucket using the MySQL ARN. The --suffix argument filters events.
-mc events add myminio/images arn:minio:sqs:us-east-1:1:postgresql --suffix .jpg
+mc event add myminio/images arn:minio:sqs:us-east-1:1:postgresql --suffix .jpg
 # Print out the notification configuration on the `images` bucket.
-mc events list myminio/images
+mc event list myminio/images
 arn:minio:sqs:us-east-1:1:postgresql s3:ObjectCreated:*,s3:ObjectRemoved:* Filter: suffix=”.jpg”
 ```
 
@@ -865,8 +865,8 @@ Minio Server的配置文件默认路径是 ``~/.minio/config.json``。参考下
 
 ```
 mc mb myminio/images
-mc events add  myminio/images arn:minio:sqs:us-east-1:1:kafka --suffix .jpg
-mc events list myminio/images
+mc event add  myminio/images arn:minio:sqs:us-east-1:1:kafka --suffix .jpg
+mc event list myminio/images
 arn:minio:sqs:us-east-1:1:kafka s3:ObjectCreated:*,s3:ObjectRemoved:* Filter: suffix=”.jpg”
 ```
 
@@ -916,13 +916,13 @@ endpoint是监听webhook通知的服务。保存配置文件并重启Minio服务
 ```
 mc mb myminio/images
 mc mb myminio/images-thumbnail
-mc events add myminio/images arn:minio:sqs:us-east-1:1:webhook --events put --suffix .jpg
+mc event add myminio/images arn:minio:sqs:us-east-1:1:webhook --events put --suffix .jpg
 ```
 
 验证事件通知是否配置正确：
 
 ```
-mc events list myminio/images
+mc event list myminio/images
 ```
 
 你应该可以收到如下的响应：

docs/zh_CN/config/README.md

@@ -3,7 +3,7 @@
 Minio server在默认情况下会将所有配置信息存到 `${HOME}/.minio/config.json` 文件中。 以下部分提供每个字段的详细说明以及如何自定义它们。一个完整的 `config.json` 在 [这里](https://raw.githubusercontent.com/minio/minio/master/docs/config/config.sample.json)
 
 ## 配置目录
-默认的配置目录是 `${HOME}/.minio`，你可以使用`--config-dir`命令行选项重写之。  You can override the default configuration directory using `--config-dir` command-line option. Minio server在首次启动时会生成一个新的`config.json`，里面带有自动生成的访问凭据。 
+默认的配置目录是 `${HOME}/.minio`，你可以使用`--config-dir`命令行选项重写之。Minio server在首次启动时会生成一个新的`config.json`，里面带有自动生成的访问凭据。 
 
 ```sh
 minio server --config-dir /etc/minio /data

docs/zh_CN/gateway/azure.md

@@ -21,7 +21,7 @@ minio gateway azure
 Minio Gateway配有嵌入式网络对象浏览器。 将您的Web浏览器指向http://127.0.0.1:9000确保您的服务器已成功启动。
 
 ![截图](https://github.com/minio/minio/blob/master/docs/screenshots/minio-browser-gateway.png?raw=true)
-##使用Minio客户端 `mc`验证
+## 使用Minio客户端 `mc`验证
 `mc` 提供了诸如ls，cat，cp，mirror，diff等UNIX命令的替代方案。它支持文件系统和Amazon S3兼容的云存储服务。
 
 ### 配置 `mc`

docs/zh_CN/gateway/gcs.md

@@ -36,7 +36,7 @@ Minio Gateway配有嵌入式网络对象浏览器。 将您的Web浏览器指向
 
 ![Screenshot](https://github.com/minio/minio/blob/master/docs/screenshots/minio-browser-gateway.png?raw=true)
 
-##使用Minio客户端 `mc`验证
+## 使用Minio客户端 `mc`验证
 `mc` 提供了诸如ls，cat，cp，mirror，diff等UNIX命令的替代方案。它支持文件系统和Amazon S3兼容的云存储服务。
 
 ### 配置  `mc`

docs/zh_CN/multi-tenancy/README.md

@@ -27,7 +27,6 @@ minio --config-dir ~/tenant3 server --address :9003 /disk1/data/tenant3 /disk2/d
 
 ## 分布式部署
 要在分布式环境中托管多个租户，同时运行多个分布式Minio实例。
-To host multiple tenants in a distributed environment, run several distributed Minio instances concurrently.  
 
 #### 示例3 : 多主机，多块磁盘 (erasure code)
 

docs/zh_CN/orchestration/README.md

@@ -1,7 +1,6 @@
 # Minio部署快速入门 [![Slack](https://slack.minio.io/slack?type=svg)](https://slack.minio.io) [![Go Report Card](https://goreportcard.com/badge/minio/minio)](https://goreportcard.com/report/minio/minio) [![Docker Pulls](https://img.shields.io/docker/pulls/minio/minio.svg?maxAge=604800)](https://hub.docker.com/r/minio/minio/) [![codecov](https://codecov.io/gh/minio/minio/branch/master/graph/badge.svg)](https://codecov.io/gh/minio/minio)
 
-Minio是一个[云原生](https://baike.baidu.com/item/Cloud%20Native/19865304?fr=aladdin)的应用程序，旨在在多租户环境中以可持续的方式进行扩展。Orchestration平台为Minio的扩展提供了非常好的支撑。以下是各种orchestration平台的Minio部署文档
-Minio is a cloud-native application designed to scale in a sustainable manner in multi-tenant environments. Orchestration platforms provide perfect launchpad for Minio to scale. Below is the list of Minio deployment documents for various orchestration platforms:
+Minio是一个[云原生](https://baike.baidu.com/item/Cloud%20Native/19865304?fr=aladdin)的应用程序，旨在在多租户环境中以可持续的方式进行扩展。编排（orchestration）平台为Minio的扩展提供了非常好的支撑。以下是各种编排平台的Minio部署文档:
 
 | Orchestration平台|
 |:---|
@@ -11,9 +10,9 @@ Minio is a cloud-native application designed to scale in a sustainable manner in
 | [`DC/OS`](https://docs.minio.io/cn/deploy-minio-on-dc-os) |
 
 ## 为什么说Minio是云原生的（cloud-native）?
-云原生这个词代表的是一些思想的集合，比如微服务部署，可伸缩，而不是说把一个单体应用改造成容器部署。一个云原生的应用在设计时就考虑了移植性和可伸缩性，而且可以通过简单的复制即可实现水平扩展。现在兴起的编排平台，想Swarm,Kubernetes,以及DC/OS，让大规模集群的复制和管理变得前所未有的简单，哪里不会点哪里。
+云原生这个词代表的是一些思想的集合，比如微服务部署，可伸缩，而不是说把一个单体应用改造成容器部署。一个云原生的应用在设计时就考虑了移植性和可伸缩性，而且可以通过简单的复制即可实现水平扩展。现在兴起的编排平台，像Swarm、Kubernetes以及DC/OS，让大规模集群的复制和管理变得前所未有的简单，哪里不会点哪里。
 
-容器提供了隔离的应用执行环境，编排（orchestration）平台通过容器管理以及复制功能提供了无缝的扩展。Minio继承了这些，针对每个租户提供了存储环境的隔离。
+容器提供了隔离的应用执行环境，编排平台通过容器管理以及复制功能提供了无缝的扩展。Minio继承了这些，针对每个租户提供了存储环境的隔离。
 
 Minio是建立在云原生的基础上，有纠删码、分布式和共享存储这些特性。Minio专注于并且只专注于存储，而且做的还不错。它可以通过编排平台复制一个Minio实例就实现了水平扩展。