fix: skip local disks properly in cluster health maintenance check (#19184 )

Fix ilm config at startup (#19189 )
Remove api.expiration_workers config setting which was inadvertently left behind. Per review comment https://github.com/minio/minio/pull/18926, expiration_workers can be configured via ilm.expiration_workers.
2026-08-14 10:43:15 +03:00 · 2024-03-04 20:48:44 -08:00 · 2024-03-04 18:50:24 -08:00 · 2024-03-04 15:58:35 -08:00 · 2024-03-04 10:05:56 -08:00 · 2024-03-04 08:34:14 -08:00
909 changed files with 120362 additions and 65967 deletions
@@ -1,10 +1,17 @@
 .git
 .github
 docs
 default.etcd
 *.gz
 *.tar.gz
 *.bzip2
 *.zip
 browser/node_modules
-node_modules
+node_modules
 docs/debugging/s3-verify/s3-verify
 docs/debugging/xl-meta/xl-meta
 docs/debugging/s3-check-md5/s3-check-md5
 docs/debugging/hash-set/hash-set
 docs/debugging/healing-bin/healing-bin
 docs/debugging/inspect/inspect
 docs/debugging/pprofgoparser/pprofgoparser
 docs/debugging/reorder-disks/reorder-disks
@@ -1,3 +1,9 @@
 ## Community Contribution License
 All community contributions in this pull request are licensed to the project maintainers
 under the terms of the [Apache 2 license](https://www.apache.org/licenses/LICENSE-2.0). 
 By creating this pull request I represent that I have the right to license the 
 contributions to the project maintainers under the Apache 2 license.
 ## Description
@@ -1,5 +0,0 @@
 # Config file for markdownlint-cli
 MD033:
  allowed_elements:
    - details
    - summary
@@ -4,6 +4,7 @@ on:
  pull_request:
    branches:
    - master
    - next
 # This ensures that previous jobs for the PR are canceled when the PR is
 # updated.
@@ -20,11 +21,11 @@ jobs:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
-        go-version: [1.18.x, 1.19.x]
+        go-version: [1.21.x]
        os: [ubuntu-latest]
    steps:
-      - uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
+      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3
-      - uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492 # v2
+      - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3
        with:
          go-version: ${{ matrix.go-version }}
          check-latest: true
@@ -4,6 +4,7 @@ on:
  pull_request:
    branches:
    - master
    - next
 # This ensures that previous jobs for the PR are canceled when the PR is
 # updated.
@@ -20,20 +21,28 @@ jobs:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
-        go-version: [1.18.5b7]
+        go-version: [1.21.x]
        os: [ubuntu-latest]
    steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
      - uses: actions/setup-go@v3
        with:
          go-version: ${{ matrix.go-version }}
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2
      - name: Setup dockerfile for build test
        run: |
-          echo "FROM us-docker.pkg.dev/google.com/api-project-999119582588/go-boringcrypto/golang:${{ matrix.go-version }}" > Dockerfile.fips.test
+          GO_VERSION=$(go version | cut -d ' ' -f 3 | sed 's/go//')
-          echo "COPY . /minio" >> Dockerfile.fips.test
+          echo Detected go version $GO_VERSION
-          echo "WORKDIR /minio" >> Dockerfile.fips.test
+          cat > Dockerfile.fips.test <<EOF
-          echo "RUN make" >> Dockerfile.fips.test
+          FROM golang:${GO_VERSION}
          COPY . /minio
          WORKDIR /minio
          ENV GOEXPERIMENT=boringcrypto
          RUN make
          EOF
      - name: Build
        uses: docker/build-push-action@v3
@@ -48,4 +57,4 @@ jobs:
      - name: Test binary
        run: |
          docker run --rm minio/fips-test:latest ./minio --version
-          docker run --rm -i minio/fips-test:latest /bin/bash -c 'go tool nm ./minio' | grep -q FIPS
+          docker run --rm -i minio/fips-test:latest /bin/bash -c 'go tool nm ./minio | grep FIPS | grep -q FIPS'
@@ -4,6 +4,7 @@ on:
  pull_request:
    branches:
    - master
    - next
 # This ensures that previous jobs for the PR are canceled when the PR is
 # updated.
@@ -20,10 +21,10 @@ jobs:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
-        go-version: [1.18.x, 1.19.x]
+        go-version: [1.21.x]
        os: [ubuntu-latest]
    steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
      - uses: actions/setup-go@v3
        with:
          go-version: ${{ matrix.go-version }}
@@ -4,6 +4,7 @@ on:
  pull_request:
    branches:
    - master
    - next
 # This ensures that previous jobs for the PR are canceled when the PR is
 # updated.
@@ -20,10 +21,10 @@ jobs:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
-        go-version: [1.18.x, 1.19.x]
+        go-version: [1.21.x]
        os: [ubuntu-latest, windows-latest]
    steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
      - uses: actions/setup-go@v3
        with:
          go-version: ${{ matrix.go-version }}
@@ -34,6 +35,7 @@ jobs:
          CGO_ENABLED: 0
          GO111MODULE: on
        run: |
          netsh int ipv4 set dynamicport tcp start=60000 num=61000
          go build --ldflags="-s -w" -o %GOPATH%\bin\minio.exe
          go test -v --timeout 50m ./...
      - name: Build on ${{ matrix.os }}
@@ -4,6 +4,7 @@ on:
  pull_request:
    branches:
    - master
    - next
 # This ensures that previous jobs for the PR are canceled when the PR is
 # updated.
@@ -20,10 +21,10 @@ jobs:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
-        go-version: [1.18.x, 1.19.x]
+        go-version: [1.21.x]
        os: [ubuntu-latest]
    steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
      - uses: actions/setup-go@v3
        with:
          go-version: ${{ matrix.go-version }}
@@ -0,0 +1,31 @@
 name: Helm Chart linting
 on:
  pull_request:
    branches:
    - master
    - next
 # This ensures that previous jobs for the PR are canceled when the PR is
 # updated.
 concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref }}
  cancel-in-progress: true
 permissions:
  contents: read
 jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3
      - name: Install Helm
        uses: azure/setup-helm@v3
      - name: Run helm lint
        run: |
          cd helm/minio
          helm lint .
@@ -4,6 +4,7 @@ on:
  pull_request:
    branches:
    - master
    - next
 # This ensures that previous jobs for the PR are canceled when the PR is
 # updated.
@@ -61,7 +62,7 @@ jobs:
      # are turned off - i.e. if ldap="", then ldap server is not enabled for
      # the tests.
      matrix:
-        go-version: [1.18.x]
+        go-version: [1.21.x]
        ldap: ["", "localhost:389"]
        etcd: ["", "http://localhost:2379"]
        openid: ["", "http://127.0.0.1:5556/dex"]
@@ -75,16 +76,16 @@ jobs:
            openid: "http://127.0.0.1:5556/dex"
    steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
      - uses: actions/setup-go@v3
        with:
          go-version: ${{ matrix.go-version }}
          check-latest: true
      - name: Test LDAP/OpenID/Etcd combo
        env:
-          LDAP_TEST_SERVER: ${{ matrix.ldap }}
+          _MINIO_LDAP_TEST_SERVER: ${{ matrix.ldap }}
-          ETCD_SERVER: ${{ matrix.etcd }}
+          _MINIO_ETCD_TEST_SERVER: ${{ matrix.etcd }}
-          OPENID_TEST_SERVER: ${{ matrix.openid }}
+          _MINIO_OPENID_TEST_SERVER: ${{ matrix.openid }}
        run: |
          sudo sysctl net.ipv6.conf.all.disable_ipv6=0
          sudo sysctl net.ipv6.conf.default.disable_ipv6=0
@@ -92,20 +93,20 @@ jobs:
      - name: Test with multiple OpenID providers
        if: matrix.openid == 'http://127.0.0.1:5556/dex'
        env:
-          LDAP_TEST_SERVER: ${{ matrix.ldap }}
+          _MINIO_LDAP_TEST_SERVER: ${{ matrix.ldap }}
-          ETCD_SERVER: ${{ matrix.etcd }}
+          _MINIO_ETCD_TEST_SERVER: ${{ matrix.etcd }}
-          OPENID_TEST_SERVER: ${{ matrix.openid }}
+          _MINIO_OPENID_TEST_SERVER: ${{ matrix.openid }}
-          OPENID_TEST_SERVER_2: "http://127.0.0.1:5557/dex"
+          _MINIO_OPENID_TEST_SERVER_2: "http://127.0.0.1:5557/dex"
        run: |
          sudo sysctl net.ipv6.conf.all.disable_ipv6=0
          sudo sysctl net.ipv6.conf.default.disable_ipv6=0
          make test-iam
      - name: Test with Access Management Plugin enabled
        env:
-          LDAP_TEST_SERVER: ${{ matrix.ldap }}
+          _MINIO_LDAP_TEST_SERVER: ${{ matrix.ldap }}
-          ETCD_SERVER: ${{ matrix.etcd }}
+          _MINIO_ETCD_TEST_SERVER: ${{ matrix.etcd }}
-          OPENID_TEST_SERVER: ${{ matrix.openid }}
+          _MINIO_OPENID_TEST_SERVER: ${{ matrix.openid }}
-          POLICY_PLUGIN_ENDPOINT: "http://127.0.0.1:8080"
+          _MINIO_POLICY_PLUGIN_TEST_ENDPOINT: "http://127.0.0.1:8080"
        run: |
          sudo sysctl net.ipv6.conf.all.disable_ipv6=0
          sudo sysctl net.ipv6.conf.default.disable_ipv6=0
@@ -0,0 +1,18 @@
 # @format
 name: Issue Workflow
 on:
  issues:
    types:
      - opened
 jobs:
  add-to-project:
    name: Add issue to project
    runs-on: ubuntu-latest
    steps:
      - uses: actions/add-to-project@v0.5.0
        with:
          project-url: https://github.com/orgs/miniohq/projects/2
          github-token: ${{ secrets.BOT_PAT }}
@@ -1,30 +0,0 @@
 name: Markdown Linter
 on:
  pull_request:
    branches:
    - master
 # This ensures that previous jobs for the PR are canceled when the PR is
 # updated.
 concurrency: 
  group: ${{ github.workflow }}-${{ github.head_ref }}
  cancel-in-progress: true
 permissions:
  contents: read
 jobs:
  lint:
    name: Lint all docs
    runs-on: ubuntu-latest
    steps:
    - name: Check out code
      uses: actions/checkout@v2
    - name: Lint all docs
      run: |
        npm install -g markdownlint-cli
        markdownlint --fix '**/*.md' \
          --config /home/runner/work/minio/minio/.github/markdown-lint-cfg.yaml \
          --disable MD013 MD040 MD051
@@ -0,0 +1,77 @@
 name: Mint Tests
 on:
  pull_request:
    branches:
      - master
      - next
 # This ensures that previous jobs for the PR are canceled when the PR is
 # updated.
 concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref }}
  cancel-in-progress: true
 permissions:
  contents: read
 jobs:
  mint-test:
    runs-on: mint
    timeout-minutes: 120
    steps:
      - name: cleanup #https://github.com/actions/checkout/issues/273
        run: |
          sudo -S rm -rf ${GITHUB_WORKSPACE}
          mkdir ${GITHUB_WORKSPACE}
      - name: checkout-step
        uses: actions/checkout@v3
      - name: setup-go-step
        uses: actions/setup-go@v2
        with:
          go-version: 1.21.x
      - name: github sha short
        id: vars
        run: echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
      - name: build-minio
        run: |
          TAG="quay.io/minio/minio:${{ steps.vars.outputs.sha_short }}" make docker
      - name: multipart uploads test
        run: |
          ${GITHUB_WORKSPACE}/.github/workflows/multipart/migrate.sh "${{ steps.vars.outputs.sha_short }}"
      - name: compress and encrypt
        run: |
          ${GITHUB_WORKSPACE}/.github/workflows/run-mint.sh "compress-encrypt" "minio" "minio123" "${{ steps.vars.outputs.sha_short }}"
      - name: multiple pools
        run: |
          ${GITHUB_WORKSPACE}/.github/workflows/run-mint.sh "pools" "minio" "minio123" "${{ steps.vars.outputs.sha_short }}"
      - name: standalone erasure
        run: |
          ${GITHUB_WORKSPACE}/.github/workflows/run-mint.sh "erasure" "minio" "minio123" "${{ steps.vars.outputs.sha_short }}"
      - name: The job must cleanup
        if: ${{ always() }}
        run: |
          export JOB_NAME=${{ steps.vars.outputs.sha_short }}
          for mode in $(echo compress-encrypt pools erasure); do
             docker-compose -f ${GITHUB_WORKSPACE}/.github/workflows/mint/minio-${mode}.yaml down || true
             docker-compose -f ${GITHUB_WORKSPACE}/.github/workflows/mint/minio-${mode}.yaml rm || true
          done
          docker-compose -f ${GITHUB_WORKSPACE}/.github/workflows/multipart/docker-compose-site1.yaml rm -s -f || true
          docker-compose -f ${GITHUB_WORKSPACE}/.github/workflows/multipart/docker-compose-site2.yaml rm -s -f || true
          for volume in $(docker volume ls -q | grep minio); do
            docker volume rm ${volume} || true
          done
          docker rmi -f quay.io/minio/minio:${{ steps.vars.outputs.sha_short }}
          docker system prune -f || true
          docker volume prune -f || true
          docker volume rm $(docker volume ls -q -f dangling=true) || true
@@ -0,0 +1,80 @@
 version: '3.7'
 # Settings and configurations that are common for all containers
 x-minio-common: &minio-common
  image: quay.io/minio/minio:${JOB_NAME}
  command: server --console-address ":9001" http://minio{1...4}/cdata{1...2}
  expose:
    - "9000"
    - "9001"
  environment:
    MINIO_CI_CD: "on"
    MINIO_ROOT_USER: "minio"
    MINIO_ROOT_PASSWORD: "minio123"
    MINIO_COMPRESSION_ENABLE: "on"
    MINIO_COMPRESSION_MIME_TYPES: "*"
    MINIO_COMPRESSION_ALLOW_ENCRYPTION: "on"
    MINIO_KMS_SECRET_KEY: "my-minio-key:OSMM+vkKUTCvQs9YL/CVMIMt43HFhkUpqJxTmGl6rYw="
  healthcheck:
    test: ["CMD", "mc", "ready", "local"]
    interval: 5s
    timeout: 5s
    retries: 5
 # starts 4 docker containers running minio server instances.
 # using nginx reverse proxy, load balancing, you can access
 # it through port 9000.
 services:
  minio1:
    <<: *minio-common
    hostname: minio1
    volumes:
      - cdata1-1:/cdata1
      - cdata1-2:/cdata2
  minio2:
    <<: *minio-common
    hostname: minio2
    volumes:
      - cdata2-1:/cdata1
      - cdata2-2:/cdata2
  minio3:
    <<: *minio-common
    hostname: minio3
    volumes:
      - cdata3-1:/cdata1
      - cdata3-2:/cdata2
  minio4:
    <<: *minio-common
    hostname: minio4
    volumes:
      - cdata4-1:/cdata1
      - cdata4-2:/cdata2
  nginx:
    image: nginx:1.19.2-alpine
    hostname: nginx
    volumes:
      - ./nginx-4-node.conf:/etc/nginx/nginx.conf:ro
    ports:
      - "9000:9000"
      - "9001:9001"
    depends_on:
      - minio1
      - minio2
      - minio3
      - minio4
 ## By default this config uses default local driver,
 ## For custom volumes replace with volume driver configuration.
 volumes:
  cdata1-1:
  cdata1-2:
  cdata2-1:
  cdata2-2:
  cdata3-1:
  cdata3-2:
  cdata4-1:
  cdata4-2:
@@ -0,0 +1,51 @@
 version: '3.7'
 # Settings and configurations that are common for all containers
 x-minio-common: &minio-common
  image: quay.io/minio/minio:${JOB_NAME}
  command: server --console-address ":9001" edata{1...4}
  expose:
    - "9000"
    - "9001"
  environment:
    MINIO_CI_CD: "on"
    MINIO_ROOT_USER: "minio"
    MINIO_ROOT_PASSWORD: "minio123"
    MINIO_KMS_SECRET_KEY: "my-minio-key:OSMM+vkKUTCvQs9YL/CVMIMt43HFhkUpqJxTmGl6rYw="
  healthcheck:
    test: ["CMD", "mc", "ready", "local"]
    interval: 5s
    timeout: 5s
    retries: 5
 # starts 4 docker containers running minio server instances.
 # using nginx reverse proxy, load balancing, you can access
 # it through port 9000.
 services:
  minio1:
    <<: *minio-common
    hostname: minio1
    volumes:
      - edata1-1:/edata1
      - edata1-2:/edata2
      - edata1-3:/edata3
      - edata1-4:/edata4
  nginx:
    image: nginx:1.19.2-alpine
    hostname: nginx
    volumes:
      - ./nginx-1-node.conf:/etc/nginx/nginx.conf:ro
    ports:
      - "9000:9000"
      - "9001:9001"
    depends_on:
      - minio1
 ## By default this config uses default local driver,
 ## For custom volumes replace with volume driver configuration.
 volumes:
  edata1-1:
  edata1-2:
  edata1-3:
  edata1-4:
@@ -0,0 +1,117 @@
 version: '3.7'
 # Settings and configurations that are common for all containers
 x-minio-common: &minio-common
  image: quay.io/minio/minio:${JOB_NAME}
  command: server --console-address ":9001" http://minio{1...4}/pdata{1...2} http://minio{5...8}/pdata{1...2}
  expose:
    - "9000"
    - "9001"
  environment:
    MINIO_CI_CD: "on"
    MINIO_ROOT_USER: "minio"
    MINIO_ROOT_PASSWORD: "minio123"
    MINIO_KMS_SECRET_KEY: "my-minio-key:OSMM+vkKUTCvQs9YL/CVMIMt43HFhkUpqJxTmGl6rYw="
  healthcheck:
    test: ["CMD", "mc", "ready", "local"]
    interval: 5s
    timeout: 5s
    retries: 5
 # starts 4 docker containers running minio server instances.
 # using nginx reverse proxy, load balancing, you can access
 # it through port 9000.
 services:
  minio1:
    <<: *minio-common
    hostname: minio1
    volumes:
      - pdata1-1:/pdata1
      - pdata1-2:/pdata2
  minio2:
    <<: *minio-common
    hostname: minio2
    volumes:
      - pdata2-1:/pdata1
      - pdata2-2:/pdata2
  minio3:
    <<: *minio-common
    hostname: minio3
    volumes:
      - pdata3-1:/pdata1
      - pdata3-2:/pdata2
  minio4:
    <<: *minio-common
    hostname: minio4
    volumes:
      - pdata4-1:/pdata1
      - pdata4-2:/pdata2
  minio5:
    <<: *minio-common
    hostname: minio5
    volumes:
      - pdata5-1:/pdata1
      - pdata5-2:/pdata2
  minio6:
    <<: *minio-common
    hostname: minio6
    volumes:
      - pdata6-1:/pdata1
      - pdata6-2:/pdata2
  minio7:
    <<: *minio-common
    hostname: minio7
    volumes:
      - pdata7-1:/pdata1
      - pdata7-2:/pdata2
  minio8:
    <<: *minio-common
    hostname: minio8
    volumes:
      - pdata8-1:/pdata1
      - pdata8-2:/pdata2
  nginx:
    image: nginx:1.19.2-alpine
    hostname: nginx
    volumes:
      - ./nginx-8-node.conf:/etc/nginx/nginx.conf:ro
    ports:
      - "9000:9000"
      - "9001:9001"
    depends_on:
      - minio1
      - minio2
      - minio3
      - minio4
      - minio5
      - minio6
      - minio7
      - minio8
 ## By default this config uses default local driver,
 ## For custom volumes replace with volume driver configuration.
 volumes:
  pdata1-1:
  pdata1-2:
  pdata2-1:
  pdata2-2:
  pdata3-1:
  pdata3-2:
  pdata4-1:
  pdata4-2:
  pdata5-1:
  pdata5-2:
  pdata6-1:
  pdata6-2:
  pdata7-1:
  pdata7-2:
  pdata8-1:
  pdata8-2:
@@ -0,0 +1,100 @@
 user  nginx;
 worker_processes  auto;
 error_log  /var/log/nginx/error.log warn;
 pid        /var/run/nginx.pid;
 events {
    worker_connections  4096;
 }
 http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
    access_log  /var/log/nginx/access.log  main;
    sendfile        on;
    keepalive_timeout  65;
    # include /etc/nginx/conf.d/*.conf;
    upstream minio {
        server minio1:9000;
    }
    upstream console {
        ip_hash;
        server minio1:9001;
    }
    server {
        listen       9000;
        listen  [::]:9000;
        server_name  localhost;
        # To allow special characters in headers
        ignore_invalid_headers off;
        # Allow any size file to be uploaded.
        # Set to a value such as 1000m; to restrict file size to a specific value
        client_max_body_size 0;
        # To disable buffering
        proxy_buffering off;
        proxy_request_buffering off;
        location / {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_connect_timeout 300;
            # Default is HTTP/1, keepalive is only enabled in HTTP/1.1
            proxy_http_version 1.1;
            proxy_set_header Connection "";
            chunked_transfer_encoding off;
            proxy_pass http://minio;
        }
    }
    server {
        listen       9001;
        listen  [::]:9001;
        server_name  localhost;
        # To allow special characters in headers
        ignore_invalid_headers off;
        # Allow any size file to be uploaded.
        # Set to a value such as 1000m; to restrict file size to a specific value
        client_max_body_size 0;
        # To disable buffering
        proxy_buffering off;
        proxy_request_buffering off;
        location / {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-NginX-Proxy true;
            # This is necessary to pass the correct IP to be hashed
            real_ip_header X-Real-IP;
            proxy_connect_timeout 300;
            # To support websocket
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            chunked_transfer_encoding off;
            proxy_pass http://console;
        }
    }
 }
@@ -0,0 +1,106 @@
 user  nginx;
 worker_processes  auto;
 error_log  /var/log/nginx/error.log warn;
 pid        /var/run/nginx.pid;
 events {
    worker_connections  4096;
 }
 http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
    access_log  /var/log/nginx/access.log  main;
    sendfile        on;
    keepalive_timeout  65;
    # include /etc/nginx/conf.d/*.conf;
    upstream minio {
        server minio1:9000;
        server minio2:9000;
        server minio3:9000;
        server minio4:9000;
    }
    upstream console {
        ip_hash;
        server minio1:9001;
        server minio2:9001;
        server minio3:9001;
        server minio4:9001;
    }
    server {
        listen       9000;
        listen  [::]:9000;
        server_name  localhost;
        # To allow special characters in headers
        ignore_invalid_headers off;
        # Allow any size file to be uploaded.
        # Set to a value such as 1000m; to restrict file size to a specific value
        client_max_body_size 0;
        # To disable buffering
        proxy_buffering off;
        proxy_request_buffering off;
        location / {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_connect_timeout 300;
            # Default is HTTP/1, keepalive is only enabled in HTTP/1.1
            proxy_http_version 1.1;
            proxy_set_header Connection "";
            chunked_transfer_encoding off;
            proxy_pass http://minio;
        }
    }
    server {
        listen       9001;
        listen  [::]:9001;
        server_name  localhost;
        # To allow special characters in headers
        ignore_invalid_headers off;
        # Allow any size file to be uploaded.
        # Set to a value such as 1000m; to restrict file size to a specific value
        client_max_body_size 0;
        # To disable buffering
        proxy_buffering off;
        proxy_request_buffering off;
        location / {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-NginX-Proxy true;
            # This is necessary to pass the correct IP to be hashed
            real_ip_header X-Real-IP;
            proxy_connect_timeout 300;
            # To support websocket
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            chunked_transfer_encoding off;
            proxy_pass http://console;
        }
    }
 }
@@ -0,0 +1,114 @@
 user  nginx;
 worker_processes  auto;
 error_log  /var/log/nginx/error.log warn;
 pid        /var/run/nginx.pid;
 events {
    worker_connections  4096;
 }
 http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
    access_log  /var/log/nginx/access.log  main;
    sendfile        on;
    keepalive_timeout  65;
    # include /etc/nginx/conf.d/*.conf;
    upstream minio {
        server minio1:9000;
        server minio2:9000;
        server minio3:9000;
        server minio4:9000;
        server minio5:9000;
        server minio6:9000;
        server minio7:9000;
        server minio8:9000;
    }
    upstream console {
        ip_hash;
        server minio1:9001;
        server minio2:9001;
        server minio3:9001;
        server minio4:9001;
        server minio5:9001;
        server minio6:9001;
        server minio7:9001;
        server minio8:9001;
    }
    server {
        listen       9000;
        listen  [::]:9000;
        server_name  localhost;
        # To allow special characters in headers
        ignore_invalid_headers off;
        # Allow any size file to be uploaded.
        # Set to a value such as 1000m; to restrict file size to a specific value
        client_max_body_size 0;
        # To disable buffering
        proxy_buffering off;
        proxy_request_buffering off;
        location / {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_connect_timeout 300;
            # Default is HTTP/1, keepalive is only enabled in HTTP/1.1
            proxy_http_version 1.1;
            proxy_set_header Connection "";
            chunked_transfer_encoding off;
            proxy_pass http://minio;
        }
    }
    server {
        listen       9001;
        listen  [::]:9001;
        server_name  localhost;
        # To allow special characters in headers
        ignore_invalid_headers off;
        # Allow any size file to be uploaded.
        # Set to a value such as 1000m; to restrict file size to a specific value
        client_max_body_size 0;
        # To disable buffering
        proxy_buffering off;
        proxy_request_buffering off;
        location / {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-NginX-Proxy true;
            # This is necessary to pass the correct IP to be hashed
            real_ip_header X-Real-IP;
            proxy_connect_timeout 300;
            # To support websocket
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            chunked_transfer_encoding off;
            proxy_pass http://console;
        }
    }
 }
@@ -0,0 +1,106 @@
 user  nginx;
 worker_processes  auto;
 error_log  /var/log/nginx/error.log warn;
 pid        /var/run/nginx.pid;
 events {
    worker_connections  4096;
 }
 http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
    access_log  /var/log/nginx/access.log  main;
    sendfile        on;
    keepalive_timeout  65;
    # include /etc/nginx/conf.d/*.conf;
    upstream minio {
        server minio1:9000;
        server minio2:9000;
        server minio3:9000;
        server minio4:9000;
    }
    upstream console {
        ip_hash;
        server minio1:9001;
        server minio2:9001;
        server minio3:9001;
        server minio4:9001;
    }
    server {
        listen       9000;
        listen  [::]:9000;
        server_name  localhost;
        # To allow special characters in headers
        ignore_invalid_headers off;
        # Allow any size file to be uploaded.
        # Set to a value such as 1000m; to restrict file size to a specific value
        client_max_body_size 0;
        # To disable buffering
        proxy_buffering off;
        proxy_request_buffering off;
        location / {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_connect_timeout 300;
            # Default is HTTP/1, keepalive is only enabled in HTTP/1.1
            proxy_http_version 1.1;
            proxy_set_header Connection "";
            chunked_transfer_encoding off;
            proxy_pass http://minio;
        }
    }
    server {
        listen       9001;
        listen  [::]:9001;
        server_name  localhost;
        # To allow special characters in headers
        ignore_invalid_headers off;
        # Allow any size file to be uploaded.
        # Set to a value such as 1000m; to restrict file size to a specific value
        client_max_body_size 0;
        # To disable buffering
        proxy_buffering off;
        proxy_request_buffering off;
        location / {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-NginX-Proxy true;
            # This is necessary to pass the correct IP to be hashed
            real_ip_header X-Real-IP;
            proxy_connect_timeout 300;
            # To support websocket
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            chunked_transfer_encoding off;
            proxy_pass http://console;
        }
    }
 }
@@ -0,0 +1,66 @@
 version: '3.7'
 # Settings and configurations that are common for all containers
 x-minio-common: &minio-common
  image: quay.io/minio/minio:${RELEASE}
  command: server http://site1-minio{1...4}/data{1...2}
  environment:
    - MINIO_PROMETHEUS_AUTH_TYPE=public
    - CI=true
 # starts 4 docker containers running minio server instances.
 # using nginx reverse proxy, load balancing, you can access
 # it through port 9000.
 services:
  site1-minio1:
    <<: *minio-common
    hostname: site1-minio1
    volumes:
      - site1-data1-1:/data1
      - site1-data1-2:/data2
  site1-minio2:
    <<: *minio-common
    hostname: site1-minio2
    volumes:
      - site1-data2-1:/data1
      - site1-data2-2:/data2
  site1-minio3:
    <<: *minio-common
    hostname: site1-minio3
    volumes:
      - site1-data3-1:/data1
      - site1-data3-2:/data2
  site1-minio4:
    <<: *minio-common
    hostname: site1-minio4
    volumes:
      - site1-data4-1:/data1
      - site1-data4-2:/data2
  site1-nginx:
    image: nginx:1.19.2-alpine
    hostname: site1-nginx
    volumes:
      - ./nginx-site1.conf:/etc/nginx/nginx.conf:ro
    ports:
      - "9001:9001"
    depends_on:
      - site1-minio1
      - site1-minio2
      - site1-minio3
      - site1-minio4
 ## By default this config uses default local driver,
 ## For custom volumes replace with volume driver configuration.
 volumes:
  site1-data1-1:
  site1-data1-2:
  site1-data2-1:
  site1-data2-2:
  site1-data3-1:
  site1-data3-2:
  site1-data4-1:
  site1-data4-2:
@@ -0,0 +1,66 @@
 version: '3.7'
 # Settings and configurations that are common for all containers
 x-minio-common: &minio-common
  image: quay.io/minio/minio:${RELEASE}
  command: server http://site2-minio{1...4}/data{1...2}
  environment:
    - MINIO_PROMETHEUS_AUTH_TYPE=public
    - CI=true
 # starts 4 docker containers running minio server instances.
 # using nginx reverse proxy, load balancing, you can access
 # it through port 9000.
 services:
  site2-minio1:
    <<: *minio-common
    hostname: site2-minio1
    volumes:
      - site2-data1-1:/data1
      - site2-data1-2:/data2
  site2-minio2:
    <<: *minio-common
    hostname: site2-minio2
    volumes:
      - site2-data2-1:/data1
      - site2-data2-2:/data2
  site2-minio3:
    <<: *minio-common
    hostname: site2-minio3
    volumes:
      - site2-data3-1:/data1
      - site2-data3-2:/data2
  site2-minio4:
    <<: *minio-common
    hostname: site2-minio4
    volumes:
      - site2-data4-1:/data1
      - site2-data4-2:/data2
  site2-nginx:
    image: nginx:1.19.2-alpine
    hostname: site2-nginx
    volumes:
      - ./nginx-site2.conf:/etc/nginx/nginx.conf:ro
    ports:
      - "9002:9002"
    depends_on:
      - site2-minio1
      - site2-minio2
      - site2-minio3
      - site2-minio4
 ## By default this config uses default local driver,
 ## For custom volumes replace with volume driver configuration.
 volumes:
  site2-data1-1:
  site2-data1-2:
  site2-data2-1:
  site2-data2-2:
  site2-data3-1:
  site2-data3-2:
  site2-data4-1:
  site2-data4-2:
@@ -0,0 +1,115 @@
 #!/bin/bash
 set -x
 ## change working directory
 cd .github/workflows/multipart/
 function cleanup() {
 	docker-compose -f docker-compose-site1.yaml rm -s -f || true
 	docker-compose -f docker-compose-site2.yaml rm -s -f || true
 	for volume in $(docker volume ls -q | grep minio); do
 		docker volume rm ${volume} || true
 	done
 	docker system prune -f || true
 	docker volume prune -f || true
 	docker volume rm $(docker volume ls -q -f dangling=true) || true
 }
 cleanup
 if [ ! -f ./mc ]; then
 	wget --quiet -O mc https://dl.minio.io/client/mc/release/linux-amd64/mc &&
 		chmod +x mc
 fi
 (
 	cd ./docs/debugging/s3-check-md5
 	go install -v
 )
 export RELEASE=RELEASE.2023-08-29T23-07-35Z
 docker-compose -f docker-compose-site1.yaml up -d
 docker-compose -f docker-compose-site2.yaml up -d
 sleep 30s
 ./mc alias set site1 http://site1-nginx:9001 minioadmin minioadmin --api s3v4
 ./mc alias set site2 http://site2-nginx:9002 minioadmin minioadmin --api s3v4
 ./mc ready site1/
 ./mc ready site2/
 ./mc admin replicate add site1 site2
 ./mc mb site1/testbucket/
 ./mc cp -r --quiet /usr/bin site1/testbucket/
 sleep 5
 s3-check-md5 -h
 failed_count_site1=$(s3-check-md5 -versions -access-key minioadmin -secret-key minioadmin -endpoint http://site1-nginx:9001 -bucket testbucket 2>&1 | grep FAILED | wc -l)
 failed_count_site2=$(s3-check-md5 -versions -access-key minioadmin -secret-key minioadmin -endpoint http://site2-nginx:9002 -bucket testbucket 2>&1 | grep FAILED | wc -l)
 if [ $failed_count_site1 -ne 0 ]; then
 	echo "failed with multipart on site1 uploads"
 	exit 1
 fi
 if [ $failed_count_site2 -ne 0 ]; then
 	echo "failed with multipart on site2 uploads"
 	exit 1
 fi
 ./mc cp -r --quiet /usr/bin site1/testbucket/
 sleep 5
 failed_count_site1=$(s3-check-md5 -versions -access-key minioadmin -secret-key minioadmin -endpoint http://site1-nginx:9001 -bucket testbucket 2>&1 | grep FAILED | wc -l)
 failed_count_site2=$(s3-check-md5 -versions -access-key minioadmin -secret-key minioadmin -endpoint http://site2-nginx:9002 -bucket testbucket 2>&1 | grep FAILED | wc -l)
 ## we do not need to fail here, since we are going to test
 ## upgrading to master, healing and being able to recover
 ## the last version.
 if [ $failed_count_site1 -ne 0 ]; then
 	echo "failed with multipart on site1 uploads ${failed_count_site1}"
 fi
 if [ $failed_count_site2 -ne 0 ]; then
 	echo "failed with multipart on site2 uploads ${failed_count_site2}"
 fi
 export RELEASE=${1}
 docker-compose -f docker-compose-site1.yaml up -d
 docker-compose -f docker-compose-site2.yaml up -d
 ./mc ready site1/
 ./mc ready site2/
 for i in $(seq 1 10); do
 	# mc admin heal -r --remove when used against a LB endpoint
 	# behaves flaky, let this run 10 times before giving up
 	./mc admin heal -r --remove --json site1/ 2>&1 >/dev/null
 	./mc admin heal -r --remove --json site2/ 2>&1 >/dev/null
 done
 failed_count_site1=$(s3-check-md5 -versions -access-key minioadmin -secret-key minioadmin -endpoint http://site1-nginx:9001 -bucket testbucket 2>&1 | grep FAILED | wc -l)
 failed_count_site2=$(s3-check-md5 -versions -access-key minioadmin -secret-key minioadmin -endpoint http://site2-nginx:9002 -bucket testbucket 2>&1 | grep FAILED | wc -l)
 if [ $failed_count_site1 -ne 0 ]; then
 	echo "failed with multipart on site1 uploads"
 	exit 1
 fi
 if [ $failed_count_site2 -ne 0 ]; then
 	echo "failed with multipart on site2 uploads"
 	exit 1
 fi
 cleanup
 ## change working directory
 cd ../../../
@@ -0,0 +1,61 @@
 user  nginx;
 worker_processes  auto;
 error_log  /var/log/nginx/error.log warn;
 pid        /var/run/nginx.pid;
 events {
    worker_connections  4096;
 }
 http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
    access_log  /var/log/nginx/access.log  main;
    sendfile        on;
    keepalive_timeout  65;
    # include /etc/nginx/conf.d/*.conf;
    upstream minio {
        server site1-minio1:9000;
        server site1-minio2:9000;
        server site1-minio3:9000;
        server site1-minio4:9000;
    }
    server {
        listen       9001;
        listen  [::]:9001;
        server_name  localhost;
        # To allow special characters in headers
        ignore_invalid_headers off;
        # Allow any size file to be uploaded.
        # Set to a value such as 1000m; to restrict file size to a specific value
        client_max_body_size 0;
        # To disable buffering
        proxy_buffering off;
        proxy_request_buffering off;
        location / {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_connect_timeout 300;
            # Default is HTTP/1, keepalive is only enabled in HTTP/1.1
            proxy_http_version 1.1;
            proxy_set_header Connection "";
            chunked_transfer_encoding off;
            proxy_pass http://minio;
        }
    }
 }
@@ -0,0 +1,61 @@
 user  nginx;
 worker_processes  auto;
 error_log  /var/log/nginx/error.log warn;
 pid        /var/run/nginx.pid;
 events {
    worker_connections  4096;
 }
 http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
    access_log  /var/log/nginx/access.log  main;
    sendfile        on;
    keepalive_timeout  65;
    # include /etc/nginx/conf.d/*.conf;
    upstream minio {
        server site2-minio1:9000;
        server site2-minio2:9000;
        server site2-minio3:9000;
        server site2-minio4:9000;
    }
    server {
        listen       9002;
        listen  [::]:9002;
        server_name  localhost;
        # To allow special characters in headers
        ignore_invalid_headers off;
        # Allow any size file to be uploaded.
        # Set to a value such as 1000m; to restrict file size to a specific value
        client_max_body_size 0;
        # To disable buffering
        proxy_buffering off;
        proxy_request_buffering off;
        location / {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_connect_timeout 300;
            # Default is HTTP/1, keepalive is only enabled in HTTP/1.1
            proxy_http_version 1.1;
            proxy_set_header Connection "";
            chunked_transfer_encoding off;
            proxy_pass http://minio;
        }
    }
 }
@@ -4,6 +4,7 @@ on:
  pull_request:
    branches:
    - master
    - next
 # This ensures that previous jobs for the PR are canceled when the PR is
 # updated.
@@ -21,10 +22,10 @@ jobs:
    strategy:
      matrix:
-        go-version: [1.18.x, 1.19.x]
+        go-version: [1.21.x]
    steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
      - uses: actions/setup-go@v3
        with:
          go-version: ${{ matrix.go-version }}
@@ -35,6 +36,12 @@ jobs:
          sudo sysctl net.ipv6.conf.default.disable_ipv6=0
          make test-decom
      - name: Test Config File
        run: |
          sudo sysctl net.ipv6.conf.all.disable_ipv6=0
          sudo sysctl net.ipv6.conf.default.disable_ipv6=0
          make test-configfile
      - name: Test Replication
        run: |
          sudo sysctl net.ipv6.conf.all.disable_ipv6=0
@@ -47,3 +54,8 @@ jobs:
          sudo sysctl net.ipv6.conf.default.disable_ipv6=0
          make test-site-replication-minio
      - name: Test Versioning
        run: |
          sudo sysctl net.ipv6.conf.all.disable_ipv6=0
          sudo sysctl net.ipv6.conf.default.disable_ipv6=0
          make test-versioning
@@ -0,0 +1,35 @@
 name: Root lockdown tests
 on:
  pull_request:
    branches:
    - master
    - next
 # This ensures that previous jobs for the PR are canceled when the PR is
 # updated.
 concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref }}
  cancel-in-progress: true
 permissions:
  contents: read
 jobs:
  build:
    name: Go ${{ matrix.go-version }} on ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        go-version: [1.21.x]
        os: [ubuntu-latest]
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-go@v3
        with:
          go-version: ${{ matrix.go-version }}
          check-latest: true
      - name: Start root lockdown tests
        run: |
          make test-root-disable
@@ -0,0 +1,46 @@
 #!/bin/bash
 set -ex
 export MODE="$1"
 export ACCESS_KEY="$2"
 export SECRET_KEY="$3"
 export JOB_NAME="$4"
 export MINT_MODE="full"
 docker system prune -f || true
 docker volume prune -f || true
 docker volume rm $(docker volume ls -f dangling=true) || true
 ## change working directory
 cd .github/workflows/mint
 docker-compose -f minio-${MODE}.yaml up -d
 sleep 30s
 docker system prune -f || true
 docker volume prune -f || true
 docker volume rm $(docker volume ls -q -f dangling=true) || true
 # Stop two nodes, one of each pool, to check that all S3 calls work while quorum is still there
 [ "${MODE}" == "pools" ] && docker-compose -f minio-${MODE}.yaml stop minio2
 [ "${MODE}" == "pools" ] && docker-compose -f minio-${MODE}.yaml stop minio6
 docker run --rm --net=mint_default \
 	--name="mint-${MODE}-${JOB_NAME}" \
 	-e SERVER_ENDPOINT="nginx:9000" \
 	-e ACCESS_KEY="${ACCESS_KEY}" \
 	-e SECRET_KEY="${SECRET_KEY}" \
 	-e ENABLE_HTTPS=0 \
 	-e MINT_MODE="${MINT_MODE}" \
 	docker.io/minio/mint:edge
 docker-compose -f minio-${MODE}.yaml down || true
 sleep 10s
 docker system prune -f || true
 docker volume prune -f || true
 docker volume rm $(docker volume ls -q -f dangling=true) || true
 ## change working directory
 cd ../../../
@@ -0,0 +1,23 @@
 name: Shell formatting checks
 on:
  pull_request:
    branches:
    - master
    - next
 permissions:
  contents: read
 jobs:
  build:
    name: runner / shfmt
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: luizm/action-sh-checker@master
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SHFMT_OPTS: "-s"
        with:
          sh_checker_shellcheck_disable: true # disable for now
@@ -0,0 +1,15 @@
 ---
 name: Test GitHub Action
 on: [pull_request]
 jobs:
  run:
    name: Spell Check with Typos
    runs-on: ubuntu-latest
    steps:
    - name: Checkout Actions Repository
      uses: actions/checkout@v4
    - name: Check spelling of repo
      uses: crate-ci/typos@master
@@ -4,6 +4,7 @@ on:
  pull_request:
    branches:
    - master
    - next
 # This ensures that previous jobs for the PR are canceled when the PR is
 # updated.
@@ -20,11 +21,11 @@ jobs:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
-        go-version: [1.18.x, 1.19.x]
+        go-version: [1.21.x]
        os: [ubuntu-latest]
    steps:
-      - uses: actions/checkout@v1
+      - uses: actions/checkout@v3
      - uses: actions/setup-go@v3
        with:
          go-version: ${{ matrix.go-version }}
@@ -3,9 +3,14 @@ on:
  pull_request:
    branches:
      - master
  push:
    branches:
      - master
 permissions:
  contents: read # to fetch code (actions/checkout)
 jobs:
  vulncheck:
    name: Analysis
@@ -16,7 +21,7 @@ jobs:
      - name: Set up Go
        uses: actions/setup-go@v3
        with:
-          go-version: 1.19.x
+          go-version: 1.21.5
          check-latest: true
      - name: Get official govulncheck
        run: go install golang.org/x/vuln/cmd/govulncheck@latest
@@ -25,16 +25,22 @@ mc.*
 s3-check-md5*
 xl-meta*
 healing-*
-inspect*
+inspect*.zip
 200M*
 hash-set
 minio.RELEASE*
 mc
 nancy
 inspects/*
 .bin/
 *.gz
 docs/debugging/s3-verify/s3-verify
 docs/debugging/xl-meta/xl-meta
 docs/debugging/s3-check-md5/s3-check-md5
 docs/debugging/hash-set/hash-set
 docs/debugging/healing-bin/healing-bin
 docs/debugging/inspect/inspect
 docs/debugging/pprofgoparser/pprofgoparser
 docs/debugging/reorder-disks/reorder-disks
 docs/debugging/populate-hard-links/populate-hardlinks
 docs/debugging/xattr/xattr
@@ -1,39 +1,36 @@
 linters-settings:
  gofumpt:
-    lang-version: "1.18"
+    simplify: true
  misspell:
    locale: US
  staticcheck:
    checks: ['all', '-ST1005', '-ST1000', '-SA4000', '-SA9004', '-SA1019', '-SA1008', '-U1000', '-ST1016']
 linters:
  disable-all: true
  enable:
-    - typecheck
+    - durationcheck
    - goimports
    - misspell
    - govet
    - revive
    - ineffassign
    - gomodguard
    - gofmt
    - unconvert
    - unused
    - gocritic
    - gofumpt
    - goimports
    - gomodguard
    - govet
    - ineffassign
    - misspell
    - revive
    - staticcheck
    - tenv
-    - durationcheck
+    - typecheck
    - unconvert
    - unused
 issues:
  exclude-use-default: false
  exclude:
-      - should have a package comment
+    - "empty-block:"
-      - error strings should not be capitalized or end with punctuation or a newline
+    - "unused-parameter:"
-      # todo fix these when we get enough time.
+    - "dot-imports:"
-      - "singleCaseSwitch: should rewrite switch statement to if statement"
+    - should have a package comment
-      - "unlambda: replace"
+    - error strings should not be capitalized or end with punctuation or a newline
      - "captLocal:"
      - "ifElseChain:"
      - "elseif:"
 service:
  golangci-lint-version: 1.43.0 # use the fixed version to not introduce new linters unexpectedly
@@ -0,0 +1,31 @@
 [files]
 extend-exclude = [
    ".git/",
    "docs/",
 ]
 ignore-hidden = false
 [default]
 extend-ignore-re = [
    "Patrick Collison",
    "Copyright 2014 Unknwon",
    "[0-9A-Za-z/+=]{64}",
    "ZXJuZXQxDjAMBgNVBA-some-junk-Q4wDAYDVQQLEwVNaW5pbzEOMAwGA1UEAxMF",
    "eyJmb28iOiJiYXIifQ",
    'http\.Header\{"X-Amz-Server-Side-Encryptio":',
    'sessionToken',
 ]
 [default.extend-words]
 "encrypter" = "encrypter"
 "requestor" = "requestor"
 [default.extend-identifiers]
 "bui" = "bui"
 "toi" = "toi"
 "ot" = "ot"
 "dm2nd" = "dm2nd"
 "HashiCorp" = "HashiCorp"
 "ParseND" = "ParseND"
 "ParseNDStream" = "ParseNDStream"
 "TestGetPartialObjectMisAligned" = "TestGetPartialObjectMisAligned"
@@ -1,8 +1,6 @@
 FROM minio/minio:latest
-ENV PATH=/opt/bin:$PATH
+COPY ./minio /usr/bin/minio
 COPY ./minio /opt/bin/minio
 COPY dockerscripts/docker-entrypoint.sh /usr/bin/docker-entrypoint.sh
 ENTRYPOINT ["/usr/bin/docker-entrypoint.sh"]
@@ -1,4 +1,31 @@
-FROM registry.access.redhat.com/ubi8/ubi-minimal:8.6
+FROM golang:1.21-alpine as build
 ARG TARGETARCH
 ARG RELEASE
 ENV GOPATH /go
 ENV CGO_ENABLED 0
 # Install curl and minisign
 RUN apk add -U --no-cache ca-certificates && \
    apk add -U --no-cache curl && \
    go install aead.dev/minisign/cmd/minisign@v0.2.1
 # Download minio binary and signature file
 RUN curl -s -q https://dl.min.io/server/minio/hotfixes/linux-${TARGETARCH}/archive/minio.${RELEASE} -o /go/bin/minio && \
    curl -s -q https://dl.min.io/server/minio/hotfixes/linux-${TARGETARCH}/archive/minio.${RELEASE}.minisig -o /go/bin/minio.minisig && \
    chmod +x /go/bin/minio
 # Download mc binary and signature file
 RUN curl -s -q https://dl.min.io/client/mc/release/linux-${TARGETARCH}/mc -o /go/bin/mc && \
    curl -s -q https://dl.min.io/client/mc/release/linux-${TARGETARCH}/mc.minisig -o /go/bin/mc.minisig && \
    chmod +x /go/bin/mc
 # Verify binary signature using public key "RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGavRUN"
 RUN minisign -Vqm /go/bin/minio -x /go/bin/minio.minisig -P RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav && \
    minisign -Vqm /go/bin/mc -x /go/bin/mc.minisig -P RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav
 FROM registry.access.redhat.com/ubi9/ubi-micro:latest
 ARG RELEASE
@@ -17,34 +44,18 @@ ENV MINIO_ACCESS_KEY_FILE=access_key \
    MINIO_KMS_SECRET_KEY_FILE=kms_master_key \
    MINIO_UPDATE_MINISIGN_PUBKEY="RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav" \
    MINIO_CONFIG_ENV_FILE=config.env \
-    PATH=/opt/bin:$PATH
+    MC_CONFIG_DIR=/tmp/.mc
 COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
 COPY --from=build /go/bin/minio /usr/bin/minio
 COPY --from=build /go/bin/mc /usr/bin/mc
 COPY dockerscripts/verify-minio.sh /usr/bin/verify-minio.sh
 COPY dockerscripts/docker-entrypoint.sh /usr/bin/docker-entrypoint.sh
 COPY CREDITS /licenses/CREDITS
 COPY LICENSE /licenses/LICENSE
-
+COPY dockerscripts/docker-entrypoint.sh /usr/bin/docker-entrypoint.sh
 RUN \
     microdnf clean all && \
     microdnf update --nodocs && \
     microdnf install curl ca-certificates shadow-utils util-linux --nodocs && \
     rpm -Uvh https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm && \
     microdnf install minisign --nodocs && \
     mkdir -p /opt/bin && chmod -R 777 /opt/bin && \
     curl -s -q https://dl.min.io/server/minio/hotfixes/linux-amd64/archive/minio.${RELEASE} -o /opt/bin/minio && \
     curl -s -q https://dl.min.io/server/minio/hotfixes/linux-amd64/archive/minio.${RELEASE}.sha256sum -o /opt/bin/minio.sha256sum && \
     curl -s -q https://dl.min.io/server/minio/hotfixes/linux-amd64/archive/minio.${RELEASE}.minisig -o /opt/bin/minio.minisig && \
     microdnf clean all && \
     chmod +x /opt/bin/minio && \
     chmod +x /usr/bin/docker-entrypoint.sh && \
     chmod +x /usr/bin/verify-minio.sh && \
     /usr/bin/verify-minio.sh && \
     microdnf clean all
 EXPOSE 9000
 ENTRYPOINT ["/usr/bin/docker-entrypoint.sh"]
 VOLUME ["/data"]
 ENTRYPOINT ["/usr/bin/docker-entrypoint.sh"]
 CMD ["minio"]
@@ -1,6 +1,31 @@
-FROM registry.access.redhat.com/ubi8/ubi-minimal:8.6
+FROM golang:1.21-alpine as build
 ARG TARGETARCH
 ARG RELEASE
 ENV GOPATH /go
 ENV CGO_ENABLED 0
 # Install curl and minisign
 RUN apk add -U --no-cache ca-certificates && \
    apk add -U --no-cache curl && \
    go install aead.dev/minisign/cmd/minisign@v0.2.1
 # Download minio binary and signature file
 RUN curl -s -q https://dl.min.io/server/minio/release/linux-${TARGETARCH}/archive/minio.${RELEASE} -o /go/bin/minio && \
    curl -s -q https://dl.min.io/server/minio/release/linux-${TARGETARCH}/archive/minio.${RELEASE}.minisig -o /go/bin/minio.minisig && \
    chmod +x /go/bin/minio
 # Download mc binary and signature file
 RUN curl -s -q https://dl.min.io/client/mc/release/linux-${TARGETARCH}/mc -o /go/bin/mc && \
    curl -s -q https://dl.min.io/client/mc/release/linux-${TARGETARCH}/mc.minisig -o /go/bin/mc.minisig && \
    chmod +x /go/bin/mc
 # Verify binary signature using public key "RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGavRUN"
 RUN minisign -Vqm /go/bin/minio -x /go/bin/minio.minisig -P RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav && \
    minisign -Vqm /go/bin/mc -x /go/bin/mc.minisig -P RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav
 FROM registry.access.redhat.com/ubi9/ubi-micro:latest
 ARG RELEASE
@@ -19,34 +44,18 @@ ENV MINIO_ACCESS_KEY_FILE=access_key \
    MINIO_KMS_SECRET_KEY_FILE=kms_master_key \
    MINIO_UPDATE_MINISIGN_PUBKEY="RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav" \
    MINIO_CONFIG_ENV_FILE=config.env \
-    PATH=/opt/bin:$PATH
+    MC_CONFIG_DIR=/tmp/.mc
 COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
 COPY --from=build /go/bin/minio /usr/bin/minio
 COPY --from=build /go/bin/mc /usr/bin/mc
 COPY dockerscripts/verify-minio.sh /usr/bin/verify-minio.sh
 COPY dockerscripts/docker-entrypoint.sh /usr/bin/docker-entrypoint.sh
 COPY CREDITS /licenses/CREDITS
 COPY LICENSE /licenses/LICENSE
-
+COPY dockerscripts/docker-entrypoint.sh /usr/bin/docker-entrypoint.sh
 RUN \
     microdnf clean all && \
     microdnf update --nodocs && \
     microdnf install curl ca-certificates shadow-utils util-linux --nodocs && \
     rpm -Uvh https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm && \
     microdnf install minisign --nodocs && \
     mkdir -p /opt/bin && chmod -R 777 /opt/bin && \
     curl -s -q https://dl.min.io/server/minio/release/linux-${TARGETARCH}/archive/minio.${RELEASE} -o /opt/bin/minio && \
     curl -s -q https://dl.min.io/server/minio/release/linux-${TARGETARCH}/archive/minio.${RELEASE}.sha256sum -o /opt/bin/minio.sha256sum && \
     curl -s -q https://dl.min.io/server/minio/release/linux-${TARGETARCH}/archive/minio.${RELEASE}.minisig -o /opt/bin/minio.minisig && \
     microdnf clean all && \
     chmod +x /opt/bin/minio && \
     chmod +x /usr/bin/docker-entrypoint.sh && \
     chmod +x /usr/bin/verify-minio.sh && \
     /usr/bin/verify-minio.sh && \
     microdnf clean all
 EXPOSE 9000
 ENTRYPOINT ["/usr/bin/docker-entrypoint.sh"]
 VOLUME ["/data"]
 ENTRYPOINT ["/usr/bin/docker-entrypoint.sh"]
 CMD ["minio"]
@@ -1,6 +1,25 @@
-FROM registry.access.redhat.com/ubi8/ubi-minimal:8.6
+FROM golang:1.21-alpine as build
 ARG TARGETARCH
 ARG RELEASE
 ENV GOPATH /go
 ENV CGO_ENABLED 0
 # Install curl and minisign
 RUN apk add -U --no-cache ca-certificates && \
    apk add -U --no-cache curl && \
    go install aead.dev/minisign/cmd/minisign@v0.2.1
 # Download minio binary and signature file
 RUN curl -s -q https://dl.min.io/server/minio/release/linux-${TARGETARCH}/archive/minio.${RELEASE}.fips -o /go/bin/minio && \
    curl -s -q https://dl.min.io/server/minio/release/linux-${TARGETARCH}/archive/minio.${RELEASE}.fips.minisig -o /go/bin/minio.minisig && \
    chmod +x /go/bin/minio
 # Verify binary signature using public key "RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGavRUN"
 RUN minisign -Vqm /go/bin/minio -x /go/bin/minio.minisig -P RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav
 FROM registry.access.redhat.com/ubi9/ubi-micro:latest
 ARG RELEASE
@@ -18,35 +37,17 @@ ENV MINIO_ACCESS_KEY_FILE=access_key \
    MINIO_ROOT_PASSWORD_FILE=secret_key \
    MINIO_KMS_SECRET_KEY_FILE=kms_master_key \
    MINIO_UPDATE_MINISIGN_PUBKEY="RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav" \
-    MINIO_CONFIG_ENV_FILE=config.env \
+    MINIO_CONFIG_ENV_FILE=config.env
-    PATH=/opt/bin:$PATH
+
 COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
 COPY --from=build /go/bin/minio /usr/bin/minio
 COPY dockerscripts/verify-minio.sh /usr/bin/verify-minio.sh
 COPY dockerscripts/docker-entrypoint.sh /usr/bin/docker-entrypoint.sh
 COPY CREDITS /licenses/CREDITS
 COPY LICENSE /licenses/LICENSE
-
+COPY dockerscripts/docker-entrypoint.sh /usr/bin/docker-entrypoint.sh
 RUN \
     microdnf clean all && \
     microdnf update --nodocs && \
     microdnf install curl ca-certificates shadow-utils util-linux --nodocs && \
     rpm -Uvh https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm && \
     microdnf install minisign --nodocs && \
     mkdir -p /opt/bin && chmod -R 777 /opt/bin && \
     curl -s -q https://dl.min.io/server/minio/release/linux-${TARGETARCH}/archive/minio.${RELEASE}.fips -o /opt/bin/minio && \
     curl -s -q https://dl.min.io/server/minio/release/linux-${TARGETARCH}/archive/minio.${RELEASE}.fips.sha256sum -o /opt/bin/minio.sha256sum && \
     curl -s -q https://dl.min.io/server/minio/release/linux-${TARGETARCH}/archive/minio.${RELEASE}.fips.minisig -o /opt/bin/minio.minisig && \
     microdnf clean all && \
     chmod +x /opt/bin/minio && \
     chmod +x /usr/bin/docker-entrypoint.sh && \
     chmod +x /usr/bin/verify-minio.sh && \
     /usr/bin/verify-minio.sh && \
     microdnf clean all
 EXPOSE 9000
 ENTRYPOINT ["/usr/bin/docker-entrypoint.sh"]
 VOLUME ["/data"]
 ENTRYPOINT ["/usr/bin/docker-entrypoint.sh"]
 CMD ["minio"]
@@ -0,0 +1,61 @@
 FROM golang:1.21-alpine as build
 ARG TARGETARCH
 ARG RELEASE
 ENV GOPATH /go
 ENV CGO_ENABLED 0
 # Install curl and minisign
 RUN apk add -U --no-cache ca-certificates && \
    apk add -U --no-cache curl && \
    go install aead.dev/minisign/cmd/minisign@v0.2.1
 # Download minio binary and signature file
 RUN curl -s -q https://dl.min.io/server/minio/release/linux-${TARGETARCH}/archive/minio.${RELEASE} -o /go/bin/minio && \
    curl -s -q https://dl.min.io/server/minio/release/linux-${TARGETARCH}/archive/minio.${RELEASE}.minisig -o /go/bin/minio.minisig && \
    chmod +x /go/bin/minio
 # Download mc binary and signature file
 RUN curl -s -q https://dl.min.io/client/mc/release/linux-${TARGETARCH}/mc -o /go/bin/mc && \
    curl -s -q https://dl.min.io/client/mc/release/linux-${TARGETARCH}/mc.minisig -o /go/bin/mc.minisig && \
    chmod +x /go/bin/mc
 # Verify binary signature using public key "RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGavRUN"
 RUN minisign -Vqm /go/bin/minio -x /go/bin/minio.minisig -P RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav && \
    minisign -Vqm /go/bin/mc -x /go/bin/mc.minisig -P RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav
 FROM registry.access.redhat.com/ubi8/ubi-micro:latest
 ARG RELEASE
 LABEL name="MinIO" \
      vendor="MinIO Inc <dev@min.io>" \
      maintainer="MinIO Inc <dev@min.io>" \
      version="${RELEASE}" \
      release="${RELEASE}" \
      summary="MinIO is a High Performance Object Storage, API compatible with Amazon S3 cloud storage service." \
      description="MinIO object storage is fundamentally different. Designed for performance and the S3 API, it is 100% open-source. MinIO is ideal for large, private cloud environments with stringent security requirements and delivers mission-critical availability across a diverse range of workloads."
 ENV MINIO_ACCESS_KEY_FILE=access_key \
    MINIO_SECRET_KEY_FILE=secret_key \
    MINIO_ROOT_USER_FILE=access_key \
    MINIO_ROOT_PASSWORD_FILE=secret_key \
    MINIO_KMS_SECRET_KEY_FILE=kms_master_key \
    MINIO_UPDATE_MINISIGN_PUBKEY="RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav" \
    MINIO_CONFIG_ENV_FILE=config.env \
    MC_CONFIG_DIR=/tmp/.mc
 COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
 COPY --from=build /go/bin/minio /usr/bin/minio
 COPY --from=build /go/bin/mc /usr/bin/mc
 COPY CREDITS /licenses/CREDITS
 COPY LICENSE /licenses/LICENSE
 COPY dockerscripts/docker-entrypoint.sh /usr/bin/docker-entrypoint.sh
 EXPOSE 9000
 VOLUME ["/data"]
 ENTRYPOINT ["/usr/bin/docker-entrypoint.sh"]
 CMD ["minio"]
@@ -6,7 +6,11 @@ GOARCH := $(shell go env GOARCH)
 GOOS := $(shell go env GOOS)
 VERSION ?= $(shell git describe --tags)
-TAG ?= "minio/minio:$(VERSION)"
+REPO ?= quay.io/minio
 TAG ?= $(REPO)/minio:$(VERSION)
 GOLANGCI_DIR = .bin/golangci/$(GOLANGCI_VERSION)
 GOLANGCI = $(GOLANGCI_DIR)/golangci-lint
 all: build
@@ -19,36 +23,51 @@ help: ## print this help
 getdeps: ## fetch necessary dependencies
 	@mkdir -p ${GOPATH}/bin
-	@echo "Installing golangci-lint" && curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(GOPATH)/bin
+	@echo "Installing golangci-lint" && curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(GOLANGCI_DIR)
-	@echo "Installing msgp" && go install -v github.com/tinylib/msgp@f3635b96e4838a6c773babb65ef35297fe5fe2f9
+	@echo "Installing msgp" && go install -v github.com/tinylib/msgp@6ac204f0b4d48d17ab4fa442134c7fba13127a4e
 	@echo "Installing stringer" && go install -v golang.org/x/tools/cmd/stringer@latest
 crosscompile: ## cross compile minio
 	@(env bash $(PWD)/buildscripts/cross-compile.sh)
-verifiers: getdeps lint check-gen
+verifiers: lint check-gen
 check-gen: ## check for updated autogenerated files
 	@go generate ./... >/dev/null
 	@(! git diff --name-only | grep '_gen.go$$') || (echo "Non-committed changes in auto-generated code is detected, please commit them to proceed." && false)
-lint: ## runs golangci-lint suite of linters
+lint: getdeps ## runs golangci-lint suite of linters
 	@echo "Running $@ check"
-	@${GOPATH}/bin/golangci-lint run --build-tags kqueue --timeout=10m --config ./.golangci.yml
+	@$(GOLANGCI) run --build-tags kqueue --timeout=10m --config ./.golangci.yml
 lint-fix: getdeps ## runs golangci-lint suite of linters with automatic fixes
 	@echo "Running $@ check"
 	@$(GOLANGCI) run --build-tags kqueue --timeout=10m --config ./.golangci.yml --fix
 check: test
-test: verifiers build ## builds minio, runs linters, tests
+test: verifiers build build-debugging ## builds minio, runs linters, tests
 	@echo "Running unit tests"
-	@MINIO_API_REQUESTS_MAX=10000 CGO_ENABLED=0 go test -tags kqueue ./...
+	@MINIO_API_REQUESTS_MAX=10000 CGO_ENABLED=0 go test -v -tags kqueue ./...
-test-decom: install
+test-root-disable: install-race
 	@echo "Running minio root lockdown tests"
 	@env bash $(PWD)/buildscripts/disable-root.sh
 test-decom: install-race
 	@echo "Running minio decom tests"
 	@env bash $(PWD)/docs/distributed/decom.sh
 	@env bash $(PWD)/docs/distributed/decom-encrypted.sh
 	@env bash $(PWD)/docs/distributed/decom-encrypted-sse-s3.sh
 	@env bash $(PWD)/docs/distributed/decom-compressed-sse-s3.sh
-test-upgrade: build
+test-versioning: install-race
 	@echo "Running minio versioning tests"
 	@env bash $(PWD)/docs/bucket/versioning/versioning-tests.sh
 test-configfile: install-race
 	@env bash $(PWD)/docs/distributed/distributed-from-config-file.sh
 test-upgrade: install-race
 	@echo "Running minio upgrade tests"
 	@(env bash $(PWD)/buildscripts/minio-upgrade.sh)
@@ -62,20 +81,30 @@ test-iam: build ## verify IAM (external IDP, etcd backends)
 	@echo "Running tests for IAM (external IDP, etcd backends) with -race"
 	@MINIO_API_REQUESTS_MAX=10000 GORACE=history_size=7 CGO_ENABLED=1 go test -race -tags kqueue -v -run TestIAM* ./cmd
-test-replication: install ## verify multi site replication
+test-sio-error:
-	@echo "Running tests for replicating three sites"
+	@(env bash $(PWD)/docs/bucket/replication/sio-error.sh)
-	@(env bash $(PWD)/docs/bucket/replication/setup_3site_replication.sh)
+
 test-replication-2site:
 	@(env bash $(PWD)/docs/bucket/replication/setup_2site_existing_replication.sh)
-test-site-replication-ldap: install ## verify automatic site replication
+test-replication-3site:
 	@(env bash $(PWD)/docs/bucket/replication/setup_3site_replication.sh)
 test-delete-replication:
 	@(env bash $(PWD)/docs/bucket/replication/delete-replication.sh)
 test-replication: install-race test-replication-2site test-replication-3site test-delete-replication test-sio-error ## verify multi site replication
 	@echo "Running tests for replicating three sites"
 test-site-replication-ldap: install-race ## verify automatic site replication
 	@echo "Running tests for automatic site replication of IAM (with LDAP)"
 	@(env bash $(PWD)/docs/site-replication/run-multi-site-ldap.sh)
-test-site-replication-oidc: install ## verify automatic site replication
+test-site-replication-oidc: install-race ## verify automatic site replication
 	@echo "Running tests for automatic site replication of IAM (with OIDC)"
 	@(env bash $(PWD)/docs/site-replication/run-multi-site-oidc.sh)
-test-site-replication-minio: install ## verify automatic site replication
+test-site-replication-minio: install-race ## verify automatic site replication
 	@echo "Running tests for automatic site replication of IAM (with MinIO IDP)"
 	@(env bash $(PWD)/docs/site-replication/run-multi-site-minio-idp.sh)
@@ -88,7 +117,6 @@ verify-healing: ## verify healing and replacing disks with minio binary
 	@echo "Verify healing build with race"
 	@GORACE=history_size=7 CGO_ENABLED=1 go build -race -tags kqueue -trimpath --ldflags "$(LDFLAGS)" -o $(PWD)/minio 1>/dev/null
 	@(env bash $(PWD)/buildscripts/verify-healing.sh)
 	@(env bash $(PWD)/buildscripts/unaligned-healing.sh)
 	@(env bash $(PWD)/buildscripts/heal-inconsistent-versions.sh)
 verify-healing-with-root-disks: ## verify healing root disks
@@ -106,6 +134,9 @@ verify-healing-inconsistent-versions: ## verify resolving inconsistent versions
 	@GORACE=history_size=7 CGO_ENABLED=1 go build -race -tags kqueue -trimpath --ldflags "$(LDFLAGS)" -o $(PWD)/minio 1>/dev/null
 	@(env bash $(PWD)/buildscripts/resolve-right-versions.sh)
 build-debugging:
 	@(env bash $(PWD)/docs/debugging/build.sh)
 build: checks ## builds minio to $(PWD)
 	@echo "Building minio binary to './minio'"
 	@CGO_ENABLED=0 go build -tags kqueue -trimpath --ldflags "$(LDFLAGS)" -o $(PWD)/minio 1>/dev/null
@@ -114,16 +145,24 @@ hotfix-vars:
 	$(eval LDFLAGS := $(shell MINIO_RELEASE="RELEASE" MINIO_HOTFIX="hotfix.$(shell git rev-parse --short HEAD)" go run buildscripts/gen-ldflags.go $(shell git describe --tags --abbrev=0 | \
    sed 's#RELEASE\.\([0-9]\+\)-\([0-9]\+\)-\([0-9]\+\)T\([0-9]\+\)-\([0-9]\+\)-\([0-9]\+\)Z#\1-\2-\3T\4:\5:\6Z#')))
 	$(eval VERSION := $(shell git describe --tags --abbrev=0).hotfix.$(shell git rev-parse --short HEAD))
 	$(eval TAG := "minio/minio:$(VERSION)")
-hotfix: hotfix-vars install ## builds minio binary with hotfix tags
+hotfix: hotfix-vars clean install ## builds minio binary with hotfix tags
-	@mv -f ./minio ./minio.$(VERSION)
+	@wget -q -c https://github.com/minio/pkger/releases/download/v2.2.1/pkger_2.2.1_linux_amd64.deb
-	@minisign -qQSm ./minio.$(VERSION) -s "${CRED_DIR}/minisign.key" < "${CRED_DIR}/minisign-passphrase"
+	@wget -q -c https://raw.githubusercontent.com/minio/minio-service/v1.0.1/linux-systemd/distributed/minio.service
-	@sha256sum < ./minio.$(VERSION) | sed 's, -,minio.$(VERSION),g' > minio.$(VERSION).sha256sum
+	@sudo apt install ./pkger_2.2.1_linux_amd64.deb --yes
 	@mkdir -p minio-release/$(GOOS)-$(GOARCH)/archive
 	@cp -af ./minio minio-release/$(GOOS)-$(GOARCH)/minio
 	@cp -af ./minio minio-release/$(GOOS)-$(GOARCH)/minio.$(VERSION)
 	@minisign -qQSm minio-release/$(GOOS)-$(GOARCH)/minio.$(VERSION) -s "${CRED_DIR}/minisign.key" < "${CRED_DIR}/minisign-passphrase"
 	@sha256sum < minio-release/$(GOOS)-$(GOARCH)/minio.$(VERSION) | sed 's, -,minio.$(VERSION),g' > minio-release/$(GOOS)-$(GOARCH)/minio.$(VERSION).sha256sum
 	@cp -af minio-release/$(GOOS)-$(GOARCH)/minio.$(VERSION)* minio-release/$(GOOS)-$(GOARCH)/archive/
 	@pkger -r $(VERSION) --ignore
 hotfix-push: hotfix
-	@scp -q -r minio.$(VERSION)* minio@dl-0.minio.io:~/releases/server/minio/hotfixes/linux-amd64/archive/
+	@scp -q -r minio-release/$(GOOS)-$(GOARCH)/* minio@dl-0.minio.io:~/releases/server/minio/hotfixes/linux-amd64/
-	@scp -q -r minio.$(VERSION)* minio@dl-1.minio.io:~/releases/server/minio/hotfixes/linux-amd64/archive/
+	@scp -q -r minio-release/$(GOOS)-$(GOARCH)/* minio@dl-0.minio.io:~/releases/server/minio/hotfixes/linux-amd64/archive
 	@scp -q -r minio-release/$(GOOS)-$(GOARCH)/* minio@dl-1.minio.io:~/releases/server/minio/hotfixes/linux-amd64/
 	@scp -q -r minio-release/$(GOOS)-$(GOARCH)/* minio@dl-1.minio.io:~/releases/server/minio/hotfixes/linux-amd64/archive
 	@echo "Published new hotfix binaries at https://dl.min.io/server/minio/hotfixes/linux-amd64/archive/minio.$(VERSION)"
 docker-hotfix-push: docker-hotfix
@@ -133,10 +172,16 @@ docker-hotfix: hotfix-push checks ## builds minio docker container with hotfix t
 	@echo "Building minio docker image '$(TAG)'"
 	@docker build -q --no-cache -t $(TAG) --build-arg RELEASE=$(VERSION) . -f Dockerfile.hotfix
-docker: build checks ## builds minio docker container
+docker: build ## builds minio docker container
 	@echo "Building minio docker image '$(TAG)'"
 	@docker build -q --no-cache -t $(TAG) . -f Dockerfile
 install-race: checks ## builds minio to $(PWD)
 	@echo "Building minio binary with -race to './minio'"
 	@GORACE=history_size=7 CGO_ENABLED=1 go build -tags kqueue -race -trimpath --ldflags "$(LDFLAGS)" -o $(PWD)/minio 1>/dev/null
 	@echo "Installing minio binary with -race to '$(GOPATH)/bin/minio'"
 	@mkdir -p $(GOPATH)/bin && cp -f $(PWD)/minio $(GOPATH)/bin/minio
 install: build ## builds minio and installs it to $GOPATH/bin.
 	@echo "Installing minio binary to '$(GOPATH)/bin/minio'"
 	@mkdir -p $(GOPATH)/bin && cp -f $(PWD)/minio $(GOPATH)/bin/minio
@@ -152,3 +197,6 @@ clean: ## cleanup all generated assets
 	@rm -rvf build
 	@rm -rvf release
 	@rm -rvf .verify*
 	@rm -rvf minio-release
 	@rm -rvf minio.RELEASE*.hotfix.*
 	@rm -rvf pkger_*.deb
@@ -1,4 +1,4 @@
-MinIO Project, (C) 2015-2021 MinIO, Inc.
+MinIO Project, (C) 2015-2023 MinIO, Inc.
 This product includes software developed at MinIO, Inc.
 (https://min.io/).
@@ -86,8 +86,6 @@ chmod +x minio
 ./minio server /data
 ```
 Replace ``/data`` with the path to the drive or directory in which you want MinIO to store data.
 The following table lists supported architectures. Replace the `wget` URL with the architecture for your Linux host.
 | Architecture                   | URL                                                        |
@@ -125,7 +123,7 @@ You can also connect using any S3-compatible tool, such as the MinIO Client `mc`
 ## Install from Source
-Use the following commands to compile and run a standalone MinIO server from source. Source installation is only intended for developers and advanced users. If you do not have a working Golang environment, please follow [How to install Golang](https://golang.org/doc/install). Minimum version required is [go1.18](https://golang.org/dl/#stable)
+Use the following commands to compile and run a standalone MinIO server from source. Source installation is only intended for developers and advanced users. If you do not have a working Golang environment, please follow [How to install Golang](https://golang.org/doc/install). Minimum version required is [go1.21](https://golang.org/dl/#stable)
 ```sh
 go install github.com/minio/minio@latest
@@ -202,7 +200,7 @@ service iptables restart
 MinIO Server comes with an embedded web based object browser. Point your web browser to <http://127.0.0.1:9000> to ensure your server has started successfully.
-> NOTE: MinIO runs console on random port by default if you wish choose a specific port use `--console-address` to pick a specific interface and port.
+> NOTE: MinIO runs console on random port by default, if you wish to choose a specific port use `--console-address` to pick a specific interface and port.
 ### Things to consider
@@ -243,7 +241,7 @@ mc admin update <minio alias, e.g., myminio>
 ### Upgrade Checklist
 - Test all upgrades in a lower environment (DEV, QA, UAT) before applying to production. Performing blind upgrades in production environments carries significant risk.
- Read the release notes for MinIO *before* performing any upgrade, there is no forced requirement to upgrade to latest releases upon every releases. Some releases may not be relevant to your setup, avoid upgrading production environments unnecessarily.
+- Read the release notes for MinIO *before* performing any upgrade, there is no forced requirement to upgrade to latest release upon every release. Some release may not be relevant to your setup, avoid upgrading production environments unnecessarily.
 - If you plan to use `mc admin update`, MinIO process must have write access to the parent directory where the binary is present on the host system.
 - `mc admin update` is not supported and should be avoided in kubernetes/container environments, please upgrade containers by upgrading relevant container images.
 - **We do not recommend upgrading one MinIO server at a time, the product is designed to support parallel upgrades please follow our recommended guidelines.**
@@ -261,6 +259,6 @@ Please follow MinIO [Contributor's Guide](https://github.com/minio/minio/blob/ma
 ## License
- MinIO source is licensed under the GNU AGPLv3 license that can be found in the [LICENSE](https://github.com/minio/minio/blob/master/LICENSE) file.
+- MinIO source is licensed under the [GNU AGPLv3](https://github.com/minio/minio/blob/master/LICENSE).
- MinIO [Documentation](https://github.com/minio/minio/tree/master/docs) © 2021 by MinIO, Inc is licensed under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/).
+- MinIO [documentation](https://github.com/minio/minio/tree/master/docs) is licensed under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/).
 - [License Compliance](https://github.com/minio/minio/blob/master/COMPLIANCE.md)
@@ -3,19 +3,19 @@
 _init() {
-    shopt -s extglob
+	shopt -s extglob
-    ## Minimum required versions for build dependencies
+	## Minimum required versions for build dependencies
-    GIT_VERSION="1.0"
+	GIT_VERSION="1.0"
-    GO_VERSION="1.16"
+	GO_VERSION="1.16"
-    OSX_VERSION="10.8"
+	OSX_VERSION="10.8"
-    KNAME=$(uname -s)
+	KNAME=$(uname -s)
-    ARCH=$(uname -m)
+	ARCH=$(uname -m)
-    case "${KNAME}" in
+	case "${KNAME}" in
-        SunOS )
+	SunOS)
-            ARCH=$(isainfo -k)
+		ARCH=$(isainfo -k)
-            ;;
+		;;
-    esac
+	esac
 }
 ## FIXME:
@@ -28,24 +28,23 @@ _init() {
 ## }
 ##
 readlink() {
-    TARGET_FILE=$1
+	TARGET_FILE=$1
-    cd `dirname $TARGET_FILE`
+	cd $(dirname $TARGET_FILE)
-    TARGET_FILE=`basename $TARGET_FILE`
+	TARGET_FILE=$(basename $TARGET_FILE)
-    # Iterate down a (possible) chain of symlinks
+	# Iterate down a (possible) chain of symlinks
-    while [ -L "$TARGET_FILE" ]
+	while [ -L "$TARGET_FILE" ]; do
-    do
+		TARGET_FILE=$(env readlink $TARGET_FILE)
-        TARGET_FILE=$(env readlink $TARGET_FILE)
+		cd $(dirname $TARGET_FILE)
-        cd `dirname $TARGET_FILE`
+		TARGET_FILE=$(basename $TARGET_FILE)
-        TARGET_FILE=`basename $TARGET_FILE`
+	done
    done
-    # Compute the canonicalized name by finding the physical path
+	# Compute the canonicalized name by finding the physical path
-    # for the directory we're in and appending the target file.
+	# for the directory we're in and appending the target file.
-    PHYS_DIR=`pwd -P`
+	PHYS_DIR=$(pwd -P)
-    RESULT=$PHYS_DIR/$TARGET_FILE
+	RESULT=$PHYS_DIR/$TARGET_FILE
-    echo $RESULT
+	echo $RESULT
 }
 ## FIXME:
@@ -59,84 +58,86 @@ readlink() {
 ## }
 ##
 check_minimum_version() {
-    IFS='.' read -r -a varray1 <<< "$1"
+	IFS='.' read -r -a varray1 <<<"$1"
-    IFS='.' read -r -a varray2 <<< "$2"
+	IFS='.' read -r -a varray2 <<<"$2"
-    for i in "${!varray1[@]}"; do
+	for i in "${!varray1[@]}"; do
-        if [[ ${varray1[i]} -lt ${varray2[i]} ]]; then
+		if [[ ${varray1[i]} -lt ${varray2[i]} ]]; then
-            return 0
+			return 0
-        elif [[ ${varray1[i]} -gt ${varray2[i]} ]]; then
+		elif [[ ${varray1[i]} -gt ${varray2[i]} ]]; then
-            return 1
+			return 1
-        fi
+		fi
-    done
+	done
-    return 0
+	return 0
 }
 assert_is_supported_arch() {
-    case "${ARCH}" in
+	case "${ARCH}" in
-        x86_64 | amd64 | aarch64 | ppc64le | arm* | s390x )
+	x86_64 | amd64 | aarch64 | ppc64le | arm* | s390x | loong64 | loongarch64)
-            return
+		return
-            ;;
+		;;
-        *)
+	*)
-            echo "Arch '${ARCH}' is not supported. Supported Arch: [x86_64, amd64, aarch64, ppc64le, arm*, s390x]"
+		echo "Arch '${ARCH}' is not supported. Supported Arch: [x86_64, amd64, aarch64, ppc64le, arm*, s390x, loong64, loongarch64]"
-            exit 1
+		exit 1
-    esac
+		;;
 	esac
 }
 assert_is_supported_os() {
-    case "${KNAME}" in
+	case "${KNAME}" in
-        Linux | FreeBSD | OpenBSD | NetBSD | DragonFly | SunOS )
+	Linux | FreeBSD | OpenBSD | NetBSD | DragonFly | SunOS)
-            return
+		return
-            ;;
+		;;
-        Darwin )
+	Darwin)
-            osx_host_version=$(env sw_vers -productVersion)
+		osx_host_version=$(env sw_vers -productVersion)
-            if ! check_minimum_version "${OSX_VERSION}" "${osx_host_version}"; then
+		if ! check_minimum_version "${OSX_VERSION}" "${osx_host_version}"; then
-                echo "OSX version '${osx_host_version}' is not supported. Minimum supported version: ${OSX_VERSION}"
+			echo "OSX version '${osx_host_version}' is not supported. Minimum supported version: ${OSX_VERSION}"
-                exit 1
+			exit 1
-            fi
+		fi
-            return
+		return
-            ;;
+		;;
-        *)
+	*)
-            echo "OS '${KNAME}' is not supported. Supported OS: [Linux, FreeBSD, OpenBSD, NetBSD, Darwin, DragonFly]"
+		echo "OS '${KNAME}' is not supported. Supported OS: [Linux, FreeBSD, OpenBSD, NetBSD, Darwin, DragonFly]"
-            exit 1
+		exit 1
-    esac
+		;;
 	esac
 }
 assert_check_golang_env() {
-    if ! which go >/dev/null 2>&1; then
+	if ! which go >/dev/null 2>&1; then
-        echo "Cannot find go binary in your PATH configuration, please refer to Go installation document at https://golang.org/doc/install"
+		echo "Cannot find go binary in your PATH configuration, please refer to Go installation document at https://golang.org/doc/install"
-        exit 1
+		exit 1
-    fi
+	fi
-    installed_go_version=$(go version | sed 's/^.* go\([0-9.]*\).*$/\1/')
+	installed_go_version=$(go version | sed 's/^.* go\([0-9.]*\).*$/\1/')
-    if ! check_minimum_version "${GO_VERSION}" "${installed_go_version}"; then
+	if ! check_minimum_version "${GO_VERSION}" "${installed_go_version}"; then
-        echo "Go runtime version '${installed_go_version}' is unsupported. Minimum supported version: ${GO_VERSION} to compile."
+		echo "Go runtime version '${installed_go_version}' is unsupported. Minimum supported version: ${GO_VERSION} to compile."
-        exit 1
+		exit 1
-    fi
+	fi
 }
 assert_check_deps() {
-    # support unusual Git versions such as: 2.7.4 (Apple Git-66)
+	# support unusual Git versions such as: 2.7.4 (Apple Git-66)
-    installed_git_version=$(git version | perl -ne '$_ =~ m/git version (.*?)( |$)/; print "$1\n";')
+	installed_git_version=$(git version | perl -ne '$_ =~ m/git version (.*?)( |$)/; print "$1\n";')
-    if ! check_minimum_version "${GIT_VERSION}" "${installed_git_version}"; then
+	if ! check_minimum_version "${GIT_VERSION}" "${installed_git_version}"; then
-        echo "Git version '${installed_git_version}' is not supported. Minimum supported version: ${GIT_VERSION}"
+		echo "Git version '${installed_git_version}' is not supported. Minimum supported version: ${GIT_VERSION}"
-        exit 1
+		exit 1
-    fi
+	fi
 }
 main() {
-    ## Check for supported arch
+	## Check for supported arch
-    assert_is_supported_arch
+	assert_is_supported_arch
-    ## Check for supported os
+	## Check for supported os
-    assert_is_supported_os
+	assert_is_supported_os
-    ## Check for Go environment
+	## Check for Go environment
-    assert_check_golang_env
+	assert_check_golang_env
-    ## Check for dependencies
+	## Check for dependencies
-    assert_check_deps
+	assert_check_deps
 }
 _init && main "$@"
@@ -5,33 +5,33 @@ set -e
 [ -n "$BASH_XTRACEFD" ] && set -x
 function _init() {
-    ## All binaries are static make sure to disable CGO.
+	## All binaries are static make sure to disable CGO.
-    export CGO_ENABLED=0
+	export CGO_ENABLED=0
-    ## List of architectures and OS to test coss compilation.
+	## List of architectures and OS to test coss compilation.
-    SUPPORTED_OSARCH="linux/ppc64le linux/mips64 linux/arm64 linux/s390x darwin/arm64 darwin/amd64 freebsd/amd64 windows/amd64 linux/arm linux/386 netbsd/amd64 linux/mips openbsd/amd64"
+	SUPPORTED_OSARCH="linux/ppc64le linux/mips64 linux/amd64 linux/arm64 linux/s390x darwin/arm64 darwin/amd64 freebsd/amd64 windows/amd64 linux/arm linux/386 netbsd/amd64 linux/mips openbsd/amd64"
 }
 function _build() {
-    local osarch=$1
+	local osarch=$1
-    IFS=/ read -r -a arr <<<"$osarch"
+	IFS=/ read -r -a arr <<<"$osarch"
-    os="${arr[0]}"
+	os="${arr[0]}"
-    arch="${arr[1]}"
+	arch="${arr[1]}"
-    package=$(go list -f '{{.ImportPath}}')
+	package=$(go list -f '{{.ImportPath}}')
-    printf -- "--> %15s:%s\n" "${osarch}" "${package}"
+	printf -- "--> %15s:%s\n" "${osarch}" "${package}"
-    # go build -trimpath to build the binary.
+	# go build -trimpath to build the binary.
-    export GOOS=$os
+	export GOOS=$os
-    export GOARCH=$arch
+	export GOARCH=$arch
-    export GO111MODULE=on
+	export GO111MODULE=on
-    go build -trimpath -tags kqueue -o /dev/null
+	go build -trimpath -tags kqueue -o /dev/null
 }
 function main() {
-    echo "Testing builds for OS/Arch: ${SUPPORTED_OSARCH}"
+	echo "Testing builds for OS/Arch: ${SUPPORTED_OSARCH}"
-    for each_osarch in ${SUPPORTED_OSARCH}; do
+	for each_osarch in ${SUPPORTED_OSARCH}; do
-        _build "${each_osarch}"
+		_build "${each_osarch}"
-    done
+	done
 }
 _init && main "$@"
@@ -0,0 +1,121 @@
 #!/bin/bash
 set -x
 export MINIO_CI_CD=1
 killall -9 minio
 rm -rf ${HOME}/tmp/dist
 scheme="http"
 nr_servers=4
 addr="localhost"
 args=""
 for ((i = 0; i < $((nr_servers)); i++)); do
 	args="$args $scheme://$addr:$((9100 + i))/${HOME}/tmp/dist/path1/$i"
 done
 echo $args
 for ((i = 0; i < $((nr_servers)); i++)); do
 	(minio server --address ":$((9100 + i))" $args 2>&1 >/tmp/log$i.txt) &
 done
 sleep 10s
 if [ ! -f ./mc ]; then
 	wget --quiet -O ./mc https://dl.minio.io/client/mc/release/linux-amd64/./mc &&
 		chmod +x mc
 fi
 set +e
 export MC_HOST_minioadm=http://minioadmin:minioadmin@localhost:9100/
 ./mc ls minioadm/
 ./mc admin config set minioadm/ api root_access=off
 sleep 3s # let things settle a little
 ./mc ls minioadm/
 if [ $? -eq 0 ]; then
 	echo "listing succeeded, 'minioadmin' was not disabled"
 	exit 1
 fi
 set -e
 killall -9 minio
 export MINIO_API_ROOT_ACCESS=on
 for ((i = 0; i < $((nr_servers)); i++)); do
 	(minio server --address ":$((9100 + i))" $args 2>&1 >/tmp/log$i.txt) &
 done
 set +e
 sleep 10
 ./mc ls minioadm/
 if [ $? -ne 0 ]; then
 	echo "listing failed, 'minioadmin' should be enabled"
 	exit 1
 fi
 killall -9 minio
 rm -rf /tmp/multisitea/
 rm -rf /tmp/multisiteb/
 echo "Setup site-replication and then disable root credentials"
 minio server --address 127.0.0.1:9001 "http://127.0.0.1:9001/tmp/multisitea/data/disterasure/xl{1...4}" \
 	"http://127.0.0.1:9002/tmp/multisitea/data/disterasure/xl{5...8}" >/tmp/sitea_1.log 2>&1 &
 minio server --address 127.0.0.1:9002 "http://127.0.0.1:9001/tmp/multisitea/data/disterasure/xl{1...4}" \
 	"http://127.0.0.1:9002/tmp/multisitea/data/disterasure/xl{5...8}" >/tmp/sitea_2.log 2>&1 &
 minio server --address 127.0.0.1:9003 "http://127.0.0.1:9003/tmp/multisiteb/data/disterasure/xl{1...4}" \
 	"http://127.0.0.1:9004/tmp/multisiteb/data/disterasure/xl{5...8}" >/tmp/siteb_1.log 2>&1 &
 minio server --address 127.0.0.1:9004 "http://127.0.0.1:9003/tmp/multisiteb/data/disterasure/xl{1...4}" \
 	"http://127.0.0.1:9004/tmp/multisiteb/data/disterasure/xl{5...8}" >/tmp/siteb_2.log 2>&1 &
 sleep 20s
 export MC_HOST_sitea=http://minioadmin:minioadmin@127.0.0.1:9001
 export MC_HOST_siteb=http://minioadmin:minioadmin@127.0.0.1:9004
 ./mc admin replicate add sitea siteb
 ./mc admin user add sitea foobar foo12345
 ./mc admin policy attach sitea/ consoleAdmin --user=foobar
 ./mc admin user info siteb foobar
 killall -9 minio
 echo "turning off root access, however site replication must continue"
 export MINIO_API_ROOT_ACCESS=off
 minio server --address 127.0.0.1:9001 "http://127.0.0.1:9001/tmp/multisitea/data/disterasure/xl{1...4}" \
 	"http://127.0.0.1:9002/tmp/multisitea/data/disterasure/xl{5...8}" >/tmp/sitea_1.log 2>&1 &
 minio server --address 127.0.0.1:9002 "http://127.0.0.1:9001/tmp/multisitea/data/disterasure/xl{1...4}" \
 	"http://127.0.0.1:9002/tmp/multisitea/data/disterasure/xl{5...8}" >/tmp/sitea_2.log 2>&1 &
 minio server --address 127.0.0.1:9003 "http://127.0.0.1:9003/tmp/multisiteb/data/disterasure/xl{1...4}" \
 	"http://127.0.0.1:9004/tmp/multisiteb/data/disterasure/xl{5...8}" >/tmp/siteb_1.log 2>&1 &
 minio server --address 127.0.0.1:9004 "http://127.0.0.1:9003/tmp/multisiteb/data/disterasure/xl{1...4}" \
 	"http://127.0.0.1:9004/tmp/multisiteb/data/disterasure/xl{5...8}" >/tmp/siteb_2.log 2>&1 &
 sleep 20s
 export MC_HOST_sitea=http://foobar:foo12345@127.0.0.1:9001
 export MC_HOST_siteb=http://foobar:foo12345@127.0.0.1:9004
 ./mc admin user add sitea foobar-admin foo12345
 sleep 2s
 ./mc admin user info siteb foobar-admin
@@ -6,88 +6,87 @@ set -x
 WORK_DIR="$PWD/.verify-$RANDOM"
 MINIO_CONFIG_DIR="$WORK_DIR/.minio"
-MINIO=( "$PWD/minio" --config-dir "$MINIO_CONFIG_DIR" server )
+MINIO=("$PWD/minio" --config-dir "$MINIO_CONFIG_DIR" server)
 if [ ! -x "$PWD/minio" ]; then
-    echo "minio executable binary not found in current directory"
+	echo "minio executable binary not found in current directory"
-    exit 1
+	exit 1
 fi
 if [ ! -x "$PWD/minio" ]; then
-    echo "minio executable binary not found in current directory"
+	echo "minio executable binary not found in current directory"
-    exit 1
+	exit 1
 fi
 function start_minio_4drive() {
-    start_port=$1
+	start_port=$1
-    export MINIO_ROOT_USER=minio
+	export MINIO_ROOT_USER=minio
-    export MINIO_ROOT_PASSWORD=minio123
+	export MINIO_ROOT_PASSWORD=minio123
-    export MC_HOST_minio="http://minio:minio123@127.0.0.1:${start_port}/"
+	export MC_HOST_minio="http://minio:minio123@127.0.0.1:${start_port}/"
-    unset MINIO_KMS_AUTO_ENCRYPTION # do not auto-encrypt objects
+	unset MINIO_KMS_AUTO_ENCRYPTION # do not auto-encrypt objects
-    export MINIO_CI_CD=1
+	export MINIO_CI_CD=1
-    mkdir ${WORK_DIR}
+	mkdir ${WORK_DIR}
-    C_PWD=${PWD}
+	C_PWD=${PWD}
-    if [ ! -x "$PWD/mc" ]; then
+	if [ ! -x "$PWD/mc" ]; then
-	MC_BUILD_DIR="mc-$RANDOM"
+		MC_BUILD_DIR="mc-$RANDOM"
-	if ! git clone --quiet https://github.com/minio/mc "$MC_BUILD_DIR"; then
+		if ! git clone --quiet https://github.com/minio/mc "$MC_BUILD_DIR"; then
-	    echo "failed to download https://github.com/minio/mc"
+			echo "failed to download https://github.com/minio/mc"
-	    purge "${MC_BUILD_DIR}"
+			purge "${MC_BUILD_DIR}"
-	    exit 1
+			exit 1
 		fi
 		(cd "${MC_BUILD_DIR}" && go build -o "$C_PWD/mc")
 		# remove mc source.
 		purge "${MC_BUILD_DIR}"
 	fi
-	(cd "${MC_BUILD_DIR}" && go build -o "$C_PWD/mc")
+	"${MINIO[@]}" --address ":$start_port" "${WORK_DIR}/disk{1...4}" >"${WORK_DIR}/server1.log" 2>&1 &
 	pid=$!
 	disown $pid
 	sleep 5
-	# remove mc source.
+	if ! ps -p ${pid} 1>&2 >/dev/null; then
-	purge "${MC_BUILD_DIR}"
+		echo "server1 log:"
-    fi
+		cat "${WORK_DIR}/server1.log"
 		echo "FAILED"
 		purge "$WORK_DIR"
 		exit 1
 	fi
-    "${MINIO[@]}" --address ":$start_port" "${WORK_DIR}/disk{1...4}" > "${WORK_DIR}/server1.log" 2>&1 &
+	"${PWD}/mc" mb --with-versioning minio/bucket
    pid=$!
    disown $pid
    sleep 5
-    if ! ps -p ${pid} 1>&2 >/dev/null; then
+	for i in $(seq 1 4); do
-	echo "server1 log:"
+		"${PWD}/mc" cp /etc/hosts minio/bucket/testobj
 	cat "${WORK_DIR}/server1.log"
 	echo "FAILED"
 	purge "$WORK_DIR"
 	exit 1
    fi
-    "${PWD}/mc" mb --with-versioning minio/bucket
+		sudo chown -R root. "${WORK_DIR}/disk${i}"
-    for i in $(seq 1 4); do
+		"${PWD}/mc" cp /etc/hosts minio/bucket/testobj
 	"${PWD}/mc" cp /etc/hosts minio/bucket/testobj
-	sudo chown -R root. "${WORK_DIR}/disk${i}"
+		sudo chown -R ${USER}. "${WORK_DIR}/disk${i}"
 	done
-	"${PWD}/mc" cp /etc/hosts minio/bucket/testobj
+	for vid in $("${PWD}/mc" ls --json --versions minio/bucket/testobj | jq -r .versionId); do
 		"${PWD}/mc" cat --vid "${vid}" minio/bucket/testobj | md5sum
 	done
-	sudo chown -R ${USER}. "${WORK_DIR}/disk${i}"
+	pkill minio
-    done
+	sleep 3
    for vid in $("${PWD}/mc" ls --json --versions minio/bucket/testobj | jq -r .versionId); do
 	"${PWD}/mc" cat --vid "${vid}" minio/bucket/testobj | md5sum
    done
    pkill minio
    sleep 3
 }
 function main() {
-    start_port=$(shuf -i 10000-65000 -n 1)
+	start_port=$(shuf -i 10000-65000 -n 1)
-    start_minio_4drive ${start_port}
+	start_minio_4drive ${start_port}
 }
-function purge()
+function purge() {
-{
+	rm -rf "$1"
    rm -rf "$1"
 }
-( main "$@" )
+(main "$@")
 rv=$?
 purge "$WORK_DIR"
 exit "$rv"
@@ -27,7 +27,7 @@ import (
 	"os"
 	"time"
-	"github.com/minio/madmin-go"
+	"github.com/minio/madmin-go/v3"
 )
 func main() {
@@ -44,7 +44,6 @@ func main() {
 	opts := madmin.HealOpts{
 		Recursive: true,                  // recursively heal all objects at 'prefix'
 		Remove:    true,                  // remove content that has lost quorum and not recoverable
 		Recreate:  true,                  // rewrite all old non-inlined xl.meta to new xl.meta
 		ScanMode:  madmin.HealNormalScan, // by default do not do 'deep' scanning
 	}
@@ -4,89 +4,89 @@ trap 'cleanup $LINENO' ERR
 # shellcheck disable=SC2120
 cleanup() {
-    MINIO_VERSION=dev docker-compose \
+	MINIO_VERSION=dev docker-compose \
-                 -f "buildscripts/upgrade-tests/compose.yml" \
+		-f "buildscripts/upgrade-tests/compose.yml" \
-                 rm -s -f
+		rm -s -f
-    docker volume prune -f
+	docker volume prune -f
 }
 verify_checksum_after_heal() {
-    local sum1
+	local sum1
-    sum1=$(curl -s "$2" | sha256sum);
+	sum1=$(curl -s "$2" | sha256sum)
-    mc admin heal --json -r "$1" >/dev/null; # test after healing
+	mc admin heal --json -r "$1" >/dev/null # test after healing
-    local sum1_heal
+	local sum1_heal
-    sum1_heal=$(curl -s "$2" | sha256sum);
+	sum1_heal=$(curl -s "$2" | sha256sum)
-    if [ "${sum1_heal}" != "${sum1}" ]; then
+	if [ "${sum1_heal}" != "${sum1}" ]; then
-        echo "mismatch expected ${sum1_heal}, got ${sum1}"
+		echo "mismatch expected ${sum1_heal}, got ${sum1}"
-        exit 1;
+		exit 1
-    fi
+	fi
 }
 verify_checksum_mc() {
-    local expected
+	local expected
-    expected=$(mc cat "$1" | sha256sum)
+	expected=$(mc cat "$1" | sha256sum)
-    local got
+	local got
-    got=$(mc cat "$2" | sha256sum)
+	got=$(mc cat "$2" | sha256sum)
-    if [ "${expected}" != "${got}" ]; then
+	if [ "${expected}" != "${got}" ]; then
-        echo "mismatch - expected ${expected}, got ${got}"
+		echo "mismatch - expected ${expected}, got ${got}"
-        exit 1;
+		exit 1
-    fi
+	fi
-    echo "matches - ${expected}, got ${got}"
+	echo "matches - ${expected}, got ${got}"
 }
 add_alias() {
-    for i in $(seq 1 4); do
+	for i in $(seq 1 4); do
-        echo "... attempting to add alias $i"
+		echo "... attempting to add alias $i"
-        until (mc alias set minio http://127.0.0.1:9000 minioadmin minioadmin); do
+		until (mc alias set minio http://127.0.0.1:9000 minioadmin minioadmin); do
-            echo "...waiting... for 5secs" && sleep 5
+			echo "...waiting... for 5secs" && sleep 5
-        done
+		done
-    done
+	done
-    echo "Sleeping for nginx"
+	echo "Sleeping for nginx"
-    sleep 20
+	sleep 20
 }
 __init__() {
-    sudo apt install curl -y
+	sudo apt install curl -y
-    export GOPATH=/tmp/gopath
+	export GOPATH=/tmp/gopath
-    export PATH=${PATH}:${GOPATH}/bin
+	export PATH=${PATH}:${GOPATH}/bin
-    go install github.com/minio/mc@latest
+	go install github.com/minio/mc@latest
-    TAG=minio/minio:dev make docker
+	TAG=minio/minio:dev make docker
-    MINIO_VERSION=RELEASE.2019-12-19T22-52-26Z docker-compose \
+	MINIO_VERSION=RELEASE.2019-12-19T22-52-26Z docker-compose \
-                 -f "buildscripts/upgrade-tests/compose.yml" \
+		-f "buildscripts/upgrade-tests/compose.yml" \
-                 up -d --build
+		up -d --build
-    add_alias
+	add_alias
-    mc mb minio/minio-test/
+	mc mb minio/minio-test/
-    mc cp ./minio minio/minio-test/to-read/
+	mc cp ./minio minio/minio-test/to-read/
-    mc cp /etc/hosts minio/minio-test/to-read/hosts
+	mc cp /etc/hosts minio/minio-test/to-read/hosts
-    mc anonymous set download minio/minio-test
+	mc anonymous set download minio/minio-test
-    verify_checksum_mc ./minio minio/minio-test/to-read/minio
+	verify_checksum_mc ./minio minio/minio-test/to-read/minio
-    curl -s http://127.0.0.1:9000/minio-test/to-read/hosts | sha256sum
+	curl -s http://127.0.0.1:9000/minio-test/to-read/hosts | sha256sum
-    MINIO_VERSION=dev docker-compose -f "buildscripts/upgrade-tests/compose.yml" stop
+	MINIO_VERSION=dev docker-compose -f "buildscripts/upgrade-tests/compose.yml" stop
 }
 main() {
-    MINIO_VERSION=dev docker-compose -f "buildscripts/upgrade-tests/compose.yml" up -d --build
+	MINIO_VERSION=dev docker-compose -f "buildscripts/upgrade-tests/compose.yml" up -d --build
-    add_alias
+	add_alias
-    verify_checksum_after_heal minio/minio-test http://127.0.0.1:9000/minio-test/to-read/hosts
+	verify_checksum_after_heal minio/minio-test http://127.0.0.1:9000/minio-test/to-read/hosts
-    verify_checksum_mc ./minio minio/minio-test/to-read/minio
+	verify_checksum_mc ./minio minio/minio-test/to-read/minio
-    verify_checksum_mc /etc/hosts minio/minio-test/to-read/hosts
+	verify_checksum_mc /etc/hosts minio/minio-test/to-read/hosts
-    cleanup
+	cleanup
 }
-( __init__ "$@" && main "$@" )
+(__init__ "$@" && main "$@")
@@ -5,7 +5,6 @@ set -e
 export GORACE="history_size=7"
 export MINIO_API_REQUESTS_MAX=10000
-## TODO remove `dsync` from race detector once this is merged and released https://go-review.googlesource.com/c/go/+/333529/
+for d in $(go list ./...); do
-for d in $(go list ./... | grep -v dsync); do
+	CGO_ENABLED=1 go test -v -race --timeout 100m "$d"
    CGO_ENABLED=1 go test -v -race --timeout 100m "$d"
 done
@@ -3,70 +3,70 @@
 set -E
 set -o pipefail
 set -x
 set -e
 WORK_DIR="$PWD/.verify-$RANDOM"
 MINIO_CONFIG_DIR="$WORK_DIR/.minio"
-MINIO=( "$PWD/minio" --config-dir "$MINIO_CONFIG_DIR" server )
+MINIO=("$PWD/minio" --config-dir "$MINIO_CONFIG_DIR" server)
 if [ ! -x "$PWD/minio" ]; then
-    echo "minio executable binary not found in current directory"
+	echo "minio executable binary not found in current directory"
-    exit 1
+	exit 1
 fi
 function start_minio_5drive() {
-    start_port=$1
+	start_port=$1
-    export MINIO_ROOT_USER=minio
+	export MINIO_ROOT_USER=minio
-    export MINIO_ROOT_PASSWORD=minio123
+	export MINIO_ROOT_PASSWORD=minio123
-    export MC_HOST_minio="http://minio:minio123@127.0.0.1:${start_port}/"
+	export MC_HOST_minio="http://minio:minio123@127.0.0.1:${start_port}/"
-    unset MINIO_KMS_AUTO_ENCRYPTION # do not auto-encrypt objects
+	unset MINIO_KMS_AUTO_ENCRYPTION # do not auto-encrypt objects
-    export MINIO_CI_CD=1
+	export MINIO_CI_CD=1
-    MC_BUILD_DIR="mc-$RANDOM"
+	MC_BUILD_DIR="mc-$RANDOM"
-    if ! git clone --quiet https://github.com/minio/mc "$MC_BUILD_DIR"; then
+	if ! git clone --quiet https://github.com/minio/mc "$MC_BUILD_DIR"; then
-	echo "failed to download https://github.com/minio/mc"
+		echo "failed to download https://github.com/minio/mc"
 		purge "${MC_BUILD_DIR}"
 		exit 1
 	fi
 	(cd "${MC_BUILD_DIR}" && go build -o "$WORK_DIR/mc")
 	# remove mc source.
 	purge "${MC_BUILD_DIR}"
 	exit 1
    fi
-    (cd "${MC_BUILD_DIR}" && go build -o "$WORK_DIR/mc")
+	"${WORK_DIR}/mc" cp --quiet -r "buildscripts/cicd-corpus/" "${WORK_DIR}/cicd-corpus/"
-    # remove mc source.
+	"${MINIO[@]}" --address ":$start_port" "${WORK_DIR}/cicd-corpus/disk{1...5}" >"${WORK_DIR}/server1.log" 2>&1 &
-    purge "${MC_BUILD_DIR}"
+	pid=$!
 	disown $pid
 	sleep 5
-    "${WORK_DIR}/mc" cp --quiet -r "buildscripts/cicd-corpus/" "${WORK_DIR}/cicd-corpus/"
+	if ! ps -p ${pid} 1>&2 >/dev/null; then
 		echo "server1 log:"
 		cat "${WORK_DIR}/server1.log"
 		echo "FAILED"
 		purge "$WORK_DIR"
 		exit 1
 	fi
-    "${MINIO[@]}" --address ":$start_port" "${WORK_DIR}/cicd-corpus/disk{1...5}" > "${WORK_DIR}/server1.log" 2>&1 &
+	"${WORK_DIR}/mc" stat minio/bucket/testobj
    pid=$!
    disown $pid
    sleep 5
-    if ! ps -p ${pid} 1>&2 >/dev/null; then
+	pkill minio
-	echo "server1 log:"
+	sleep 3
 	cat "${WORK_DIR}/server1.log"
 	echo "FAILED"
 	purge "$WORK_DIR"
 	exit 1
    fi
    "${WORK_DIR}/mc" stat minio/bucket/testobj
    pkill minio
    sleep 3
 }
 function main() {
-    start_port=$(shuf -i 10000-65000 -n 1)
+	start_port=$(shuf -i 10000-65000 -n 1)
-    start_minio_5drive ${start_port}
+	start_minio_5drive ${start_port}
 }
-function purge()
+function purge() {
-{
+	rm -rf "$1"
    rm -rf "$1"
 }
-( main "$@" )
+(main "$@")
 rv=$?
 purge "$WORK_DIR"
 exit "$rv"
@@ -6,146 +6,155 @@ set -x
 WORK_DIR="$PWD/.verify-$RANDOM"
 MINIO_CONFIG_DIR="$WORK_DIR/.minio"
-MINIO_OLD=( "$PWD/minio.RELEASE.2020-10-28T08-16-50Z" --config-dir "$MINIO_CONFIG_DIR" server )
+MINIO_OLD=("$PWD/minio.RELEASE.2020-10-28T08-16-50Z" --config-dir "$MINIO_CONFIG_DIR" server)
-MINIO=( "$PWD/minio" --config-dir "$MINIO_CONFIG_DIR" server )
+MINIO=("$PWD/minio" --config-dir "$MINIO_CONFIG_DIR" server)
 if [ ! -x "$PWD/minio" ]; then
-    echo "minio executable binary not found in current directory"
+	echo "minio executable binary not found in current directory"
-    exit 1
+	exit 1
 fi
 function download_old_release() {
-    if [ ! -f minio.RELEASE.2020-10-28T08-16-50Z ]; then
+	if [ ! -f minio.RELEASE.2020-10-28T08-16-50Z ]; then
-	curl --silent -O https://dl.minio.io/server/minio/release/linux-amd64/archive/minio.RELEASE.2020-10-28T08-16-50Z
+		curl --silent -O https://dl.minio.io/server/minio/release/linux-amd64/archive/minio.RELEASE.2020-10-28T08-16-50Z
-	chmod a+x minio.RELEASE.2020-10-28T08-16-50Z
+		chmod a+x minio.RELEASE.2020-10-28T08-16-50Z
-    fi
+	fi
 }
 function verify_rewrite() {
-    start_port=$1
+	start_port=$1
-    export MINIO_ACCESS_KEY=minio
+	export MINIO_ACCESS_KEY=minio
-    export MINIO_SECRET_KEY=minio123
+	export MINIO_SECRET_KEY=minio123
-    export MC_HOST_minio="http://minio:minio123@127.0.0.1:${start_port}/"
+	export MC_HOST_minio="http://minio:minio123@127.0.0.1:${start_port}/"
-    unset MINIO_KMS_AUTO_ENCRYPTION # do not auto-encrypt objects
+	unset MINIO_KMS_AUTO_ENCRYPTION # do not auto-encrypt objects
-    export MINIO_CI_CD=1
+	export MINIO_CI_CD=1
-    MC_BUILD_DIR="mc-$RANDOM"
+	MC_BUILD_DIR="mc-$RANDOM"
-    if ! git clone --quiet https://github.com/minio/mc "$MC_BUILD_DIR"; then
+	if ! git clone --quiet https://github.com/minio/mc "$MC_BUILD_DIR"; then
-	echo "failed to download https://github.com/minio/mc"
+		echo "failed to download https://github.com/minio/mc"
 		purge "${MC_BUILD_DIR}"
 		exit 1
 	fi
 	(cd "${MC_BUILD_DIR}" && go build -o "$WORK_DIR/mc")
 	# remove mc source.
 	purge "${MC_BUILD_DIR}"
 	exit 1
    fi
-    (cd "${MC_BUILD_DIR}" && go build -o "$WORK_DIR/mc")
+	"${MINIO_OLD[@]}" --address ":$start_port" "${WORK_DIR}/xl{1...16}" >"${WORK_DIR}/server1.log" 2>&1 &
 	pid=$!
 	disown $pid
 	sleep 10
-    # remove mc source.
+	if ! ps -p ${pid} 1>&2 >/dev/null; then
-    purge "${MC_BUILD_DIR}"
+		echo "server1 log:"
 		cat "${WORK_DIR}/server1.log"
 		echo "FAILED"
 		purge "$WORK_DIR"
 		exit 1
 	fi
-    "${MINIO_OLD[@]}" --address ":$start_port" "${WORK_DIR}/xl{1...16}" > "${WORK_DIR}/server1.log" 2>&1 &
+	"${WORK_DIR}/mc" mb minio/healing-rewrite-bucket --quiet --with-lock
-    pid=$!
+	"${WORK_DIR}/mc" cp \
-    disown $pid
+		buildscripts/verify-build.sh \
-    sleep 10
+		minio/healing-rewrite-bucket/ \
 		--disable-multipart --quiet
-    if ! ps -p ${pid} 1>&2 >/dev/null; then
+	"${WORK_DIR}/mc" cp \
-	echo "server1 log:"
+		buildscripts/verify-build.sh \
-	cat "${WORK_DIR}/server1.log"
+		minio/healing-rewrite-bucket/ \
-	echo "FAILED"
+		--disable-multipart --quiet
 	purge "$WORK_DIR"
 	exit 1
    fi
-    "${WORK_DIR}/mc" mb minio/healing-rewrite-bucket --quiet --with-lock
+	"${WORK_DIR}/mc" cp \
-    "${WORK_DIR}/mc" cp \
+		buildscripts/verify-build.sh \
-		     buildscripts/verify-build.sh \
+		minio/healing-rewrite-bucket/ \
-		     minio/healing-rewrite-bucket/ \
+		--disable-multipart --quiet
 		     --disable-multipart --quiet
-    "${WORK_DIR}/mc" cp \
+	kill ${pid}
-		     buildscripts/verify-build.sh \
+	sleep 3
 		     minio/healing-rewrite-bucket/ \
 		     --disable-multipart --quiet
-    "${WORK_DIR}/mc" cp \
+	"${MINIO[@]}" --address ":$start_port" "${WORK_DIR}/xl{1...16}" >"${WORK_DIR}/server1.log" 2>&1 &
-		     buildscripts/verify-build.sh \
+	pid=$!
-		     minio/healing-rewrite-bucket/ \
+	disown $pid
-		     --disable-multipart --quiet
+	sleep 10
-    kill ${pid}
+	if ! ps -p ${pid} 1>&2 >/dev/null; then
-    sleep 3
+		echo "server1 log:"
 		cat "${WORK_DIR}/server1.log"
 		echo "FAILED"
 		purge "$WORK_DIR"
 		exit 1
 	fi
-    "${MINIO[@]}" --address ":$start_port" "${WORK_DIR}/xl{1...16}" > "${WORK_DIR}/server1.log" 2>&1 &
+	(
-    pid=$!
+		cd ./docs/debugging/s3-check-md5
-    disown $pid
+		go install -v
-    sleep 10
+	)
-    if ! ps -p ${pid} 1>&2 >/dev/null; then
+	if ! s3-check-md5 \
-	echo "server1 log:"
+		-debug \
-	cat "${WORK_DIR}/server1.log"
+		-versions \
-	echo "FAILED"
+		-access-key minio \
-	purge "$WORK_DIR"
+		-secret-key minio123 \
-	exit 1
+		-endpoint http://127.0.0.1:${start_port}/ 2>&1 | grep INTACT; then
-    fi
+		echo "server1 log:"
 		cat "${WORK_DIR}/server1.log"
 		echo "FAILED"
 		mkdir -p inspects
 		(
 			cd inspects
 			"${WORK_DIR}/mc" admin inspect minio/healing-rewrite-bucket/verify-build.sh/**
 		)
-    go build ./docs/debugging/s3-check-md5/
+		"${WORK_DIR}/mc" mb play/inspects
-    if ! ./s3-check-md5 \
+		"${WORK_DIR}/mc" mirror inspects play/inspects
 	 -debug \
 	 -versions \
 	 -access-key minio \
 	 -secret-key minio123 \
 	 -endpoint http://127.0.0.1:${start_port}/ 2>&1 | grep INTACT; then
 	echo "server1 log:"
 	cat "${WORK_DIR}/server1.log"
 	echo "FAILED"
 	mkdir -p inspects
 	(cd inspects; "${WORK_DIR}/mc" admin inspect minio/healing-rewrite-bucket/verify-build.sh/**)
-	"${WORK_DIR}/mc" mb play/inspects
+		purge "$WORK_DIR"
-	"${WORK_DIR}/mc" mirror inspects play/inspects
+		exit 1
 	fi
-	purge "$WORK_DIR"
+	go run ./buildscripts/heal-manual.go "127.0.0.1:${start_port}" "minio" "minio123"
-	exit 1
+	sleep 1
    fi
-    go run ./buildscripts/heal-manual.go "127.0.0.1:${start_port}" "minio" "minio123"
+	if ! s3-check-md5 \
-    sleep 1
+		-debug \
 		-versions \
 		-access-key minio \
 		-secret-key minio123 \
 		-endpoint http://127.0.0.1:${start_port}/ 2>&1 | grep INTACT; then
 		echo "server1 log:"
 		cat "${WORK_DIR}/server1.log"
 		echo "FAILED"
 		mkdir -p inspects
 		(
 			cd inspects
 			"${WORK_DIR}/mc" admin inspect minio/healing-rewrite-bucket/verify-build.sh/**
 		)
-    if ! ./s3-check-md5 \
+		"${WORK_DIR}/mc" mb play/inspects
-	 -debug \
+		"${WORK_DIR}/mc" mirror inspects play/inspects
 	 -versions \
 	 -access-key minio \
 	 -secret-key minio123 \
 	 -endpoint http://127.0.0.1:${start_port}/ 2>&1 | grep INTACT; then
 	echo "server1 log:"
 	cat "${WORK_DIR}/server1.log"
 	echo "FAILED"
 	mkdir -p inspects
 	(cd inspects; "${WORK_DIR}/mc" admin inspect minio/healing-rewrite-bucket/verify-build.sh/**)
-	"${WORK_DIR}/mc" mb play/inspects
+		purge "$WORK_DIR"
-	"${WORK_DIR}/mc" mirror inspects play/inspects
+		exit 1
 	fi
-	purge "$WORK_DIR"
+	kill ${pid}
 	exit 1
    fi
    kill ${pid}
 }
 function main() {
-    download_old_release
+	download_old_release
-    start_port=$(shuf -i 10000-65000 -n 1)
+	start_port=$(shuf -i 10000-65000 -n 1)
-    verify_rewrite ${start_port}
+	verify_rewrite ${start_port}
 }
-function purge()
+function purge() {
-{
+	rm -rf "$1"
    rm -rf "$1"
 }
-( main "$@" )
+(main "$@")
 rv=$?
 purge "$WORK_DIR"
 exit "$rv"
@@ -1,172 +0,0 @@
 #!/bin/bash -e
 #
 set -E
 set -o pipefail
 set -x
 if [ ! -x "$PWD/minio" ]; then
    echo "minio executable binary not found in current directory"
    exit 1
 fi
 WORK_DIR="$PWD/.verify-$RANDOM"
 MINIO_CONFIG_DIR="$WORK_DIR/.minio"
 MINIO_OLD=( "$PWD/minio.RELEASE.2021-11-24T23-19-33Z" --config-dir "$MINIO_CONFIG_DIR" server )
 MINIO=( "$PWD/minio" --config-dir "$MINIO_CONFIG_DIR" server )
 function download_old_release() {
    if [ ! -f minio.RELEASE.2021-11-24T23-19-33Z ]; then
 	curl --silent -O https://dl.minio.io/server/minio/release/linux-amd64/archive/minio.RELEASE.2021-11-24T23-19-33Z
 	chmod a+x minio.RELEASE.2021-11-24T23-19-33Z
    fi
 }
 function start_minio_16drive() {
    start_port=$1
    export MINIO_ROOT_USER=minio
    export MINIO_ROOT_PASSWORD=minio123
    export MC_HOST_minio="http://minio:minio123@127.0.0.1:${start_port}/"
    unset MINIO_KMS_AUTO_ENCRYPTION # do not auto-encrypt objects
    export _MINIO_SHARD_DISKTIME_DELTA="5s" # do not change this as its needed for tests
    export MINIO_CI_CD=1
    MC_BUILD_DIR="mc-$RANDOM"
    if ! git clone --quiet https://github.com/minio/mc "$MC_BUILD_DIR"; then
 	echo "failed to download https://github.com/minio/mc"
 	purge "${MC_BUILD_DIR}"
 	exit 1
    fi
    (cd "${MC_BUILD_DIR}" && go build -o "$WORK_DIR/mc")
    # remove mc source.
    purge "${MC_BUILD_DIR}"
    "${MINIO_OLD[@]}" --address ":$start_port" "${WORK_DIR}/xl{1...16}" > "${WORK_DIR}/server1.log" 2>&1 &
    pid=$!
    disown $pid
    sleep 30
    if ! ps -p ${pid} 1>&2 >/dev/null; then
 	echo "server1 log:"
 	cat "${WORK_DIR}/server1.log"
 	echo "FAILED"
 	purge "$WORK_DIR"
 	exit 1
    fi
    shred --iterations=1 --size=5241856 - 1>"${WORK_DIR}/unaligned" 2>/dev/null
    "${WORK_DIR}/mc" mb minio/healing-shard-bucket --quiet
    "${WORK_DIR}/mc" cp \
 		     "${WORK_DIR}/unaligned" \
 		     minio/healing-shard-bucket/unaligned \
 		     --disable-multipart --quiet
    ## "unaligned" object name gets consistently distributed
    ## to disks in following distribution order
    ##
    ## NOTE: if you change the name make sure to change the
    ## distribution order present here
    ##
    ## [15, 16, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14]
    ## make sure to remove the "last" data shard
    rm -rf "${WORK_DIR}/xl14/healing-shard-bucket/unaligned"
    sleep 10
    ## Heal the shard
    "${WORK_DIR}/mc" admin heal --quiet --recursive minio/healing-shard-bucket
    ## then remove any other data shard let's pick first disk
    ## - 1st data shard.
    rm -rf "${WORK_DIR}/xl3/healing-shard-bucket/unaligned"
    sleep 10
    go build ./docs/debugging/s3-check-md5/
    if ! ./s3-check-md5 \
 	 -debug \
 	 -access-key minio \
 	 -secret-key minio123 \
 	 -endpoint http://127.0.0.1:${start_port}/ 2>&1 | grep CORRUPTED; then
 	echo "server1 log:"
 	cat "${WORK_DIR}/server1.log"
 	echo "FAILED"
 	purge "$WORK_DIR"
 	exit 1
    fi
    pkill minio
    sleep 3
    "${MINIO[@]}" --address ":$start_port" "${WORK_DIR}/xl{1...16}" > "${WORK_DIR}/server1.log" 2>&1 &
    pid=$!
    disown $pid
    sleep 30
    if ! ps -p ${pid} 1>&2 >/dev/null; then
 	echo "server1 log:"
 	cat "${WORK_DIR}/server1.log"
 	echo "FAILED"
 	purge "$WORK_DIR"
 	exit 1
    fi
    if ! ./s3-check-md5 \
 	 -debug \
 	 -access-key minio \
 	 -secret-key minio123 \
 	 -endpoint http://127.0.0.1:${start_port}/ 2>&1 | grep INTACT; then
 	echo "server1 log:"
 	cat "${WORK_DIR}/server1.log"
 	echo "FAILED"
 	mkdir -p inspects
 	(cd inspects; "${WORK_DIR}/mc" support inspect minio/healing-shard-bucket/unaligned/**)
 	"${WORK_DIR}/mc" mb play/inspects
 	"${WORK_DIR}/mc" mirror inspects play/inspects
 	purge "$WORK_DIR"
 	exit 1
    fi
    "${WORK_DIR}/mc" admin heal --quiet --recursive minio/healing-shard-bucket
    if ! ./s3-check-md5 \
 	 -debug \
 	 -access-key minio \
 	 -secret-key minio123 \
 	 -endpoint http://127.0.0.1:${start_port}/ 2>&1 | grep INTACT; then
 	echo "server1 log:"
 	cat "${WORK_DIR}/server1.log"
 	echo "FAILED"
 	mkdir -p inspects
 	(cd inspects; "${WORK_DIR}/mc" support inspect minio/healing-shard-bucket/unaligned/**)
 	"${WORK_DIR}/mc" mb play/inspects
 	"${WORK_DIR}/mc" mirror inspects play/inspects
 	purge "$WORK_DIR"
 	exit 1
    fi
    pkill minio
    sleep 3
 }
 function main() {
    download_old_release
    start_port=$(shuf -i 10000-65000 -n 1)
    start_minio_16drive ${start_port}
 }
 function purge()
 {
    rm -rf "$1"
 }
 ( main "$@" )
 rv=$?
 purge "$WORK_DIR"
 exit "$rv"
@@ -9,11 +9,6 @@ x-minio-common: &minio-common
  expose:
    - "9000"
    - "9001"
  healthcheck:
    test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
    interval: 30s
    timeout: 20s
    retries: 3
 # starts 4 docker containers running minio server instances.
 # using nginx reverse proxy, load balancing, you can access
@@ -6,8 +6,8 @@ set -E
 set -o pipefail
 if [ ! -x "$PWD/minio" ]; then
-    echo "minio executable binary not found in current directory"
+	echo "minio executable binary not found in current directory"
-    exit 1
+	exit 1
 fi
 WORK_DIR="$PWD/.verify-$RANDOM"
@@ -25,285 +25,270 @@ export ENABLE_ADMIN=1
 export MINIO_CI_CD=1
 MINIO_CONFIG_DIR="$WORK_DIR/.minio"
-MINIO=( "$PWD/minio" --config-dir "$MINIO_CONFIG_DIR" )
+MINIO=("$PWD/minio" --config-dir "$MINIO_CONFIG_DIR")
 FILE_1_MB="$MINT_DATA_DIR/datafile-1-MB"
 FILE_65_MB="$MINT_DATA_DIR/datafile-65-MB"
 FUNCTIONAL_TESTS="$WORK_DIR/functional-tests.sh"
-function start_minio_fs()
+function start_minio_fs() {
-{
+	export MINIO_ROOT_USER=$ACCESS_KEY
-    export MINIO_ROOT_USER=$ACCESS_KEY
+	export MINIO_ROOT_PASSWORD=$SECRET_KEY
-    export MINIO_ROOT_PASSWORD=$SECRET_KEY
+	"${MINIO[@]}" server "${WORK_DIR}/fs-disk" >"$WORK_DIR/fs-minio.log" 2>&1 &
-    "${MINIO[@]}" server "${WORK_DIR}/fs-disk" >"$WORK_DIR/fs-minio.log" 2>&1 &
+	sleep 10
    sleep 10
 }
-function start_minio_erasure()
+function start_minio_erasure() {
-{
+	"${MINIO[@]}" server "${WORK_DIR}/erasure-disk1" "${WORK_DIR}/erasure-disk2" "${WORK_DIR}/erasure-disk3" "${WORK_DIR}/erasure-disk4" >"$WORK_DIR/erasure-minio.log" 2>&1 &
-    "${MINIO[@]}" server "${WORK_DIR}/erasure-disk1" "${WORK_DIR}/erasure-disk2" "${WORK_DIR}/erasure-disk3" "${WORK_DIR}/erasure-disk4" >"$WORK_DIR/erasure-minio.log" 2>&1 &
+	sleep 15
    sleep 15
 }
-function start_minio_erasure_sets()
+function start_minio_erasure_sets() {
-{
+	export MINIO_ENDPOINTS="${WORK_DIR}/erasure-disk-sets{1...32}"
-    export MINIO_ENDPOINTS="${WORK_DIR}/erasure-disk-sets{1...32}"
+	"${MINIO[@]}" server >"$WORK_DIR/erasure-minio-sets.log" 2>&1 &
-    "${MINIO[@]}" server > "$WORK_DIR/erasure-minio-sets.log" 2>&1 &
+	sleep 15
    sleep 15
 }
-function start_minio_pool_erasure_sets()
+function start_minio_pool_erasure_sets() {
-{
+	export MINIO_ROOT_USER=$ACCESS_KEY
-    export MINIO_ROOT_USER=$ACCESS_KEY
+	export MINIO_ROOT_PASSWORD=$SECRET_KEY
-    export MINIO_ROOT_PASSWORD=$SECRET_KEY
+	export MINIO_ENDPOINTS="http://127.0.0.1:9000${WORK_DIR}/pool-disk-sets{1...4} http://127.0.0.1:9001${WORK_DIR}/pool-disk-sets{5...8}"
-    export MINIO_ENDPOINTS="http://127.0.0.1:9000${WORK_DIR}/pool-disk-sets{1...4} http://127.0.0.1:9001${WORK_DIR}/pool-disk-sets{5...8}"
+	"${MINIO[@]}" server --address ":9000" >"$WORK_DIR/pool-minio-9000.log" 2>&1 &
-    "${MINIO[@]}" server --address ":9000" > "$WORK_DIR/pool-minio-9000.log" 2>&1 &
+	"${MINIO[@]}" server --address ":9001" >"$WORK_DIR/pool-minio-9001.log" 2>&1 &
    "${MINIO[@]}" server --address ":9001" > "$WORK_DIR/pool-minio-9001.log" 2>&1 &
-    sleep 40
+	sleep 40
 }
-function start_minio_pool_erasure_sets_ipv6()
+function start_minio_pool_erasure_sets_ipv6() {
-{
+	export MINIO_ROOT_USER=$ACCESS_KEY
-    export MINIO_ROOT_USER=$ACCESS_KEY
+	export MINIO_ROOT_PASSWORD=$SECRET_KEY
-    export MINIO_ROOT_PASSWORD=$SECRET_KEY
+	export MINIO_ENDPOINTS="http://[::1]:9000${WORK_DIR}/pool-disk-sets-ipv6{1...4} http://[::1]:9001${WORK_DIR}/pool-disk-sets-ipv6{5...8}"
-    export MINIO_ENDPOINTS="http://[::1]:9000${WORK_DIR}/pool-disk-sets-ipv6{1...4} http://[::1]:9001${WORK_DIR}/pool-disk-sets-ipv6{5...8}"
+	"${MINIO[@]}" server --address="[::1]:9000" >"$WORK_DIR/pool-minio-ipv6-9000.log" 2>&1 &
-    "${MINIO[@]}" server --address="[::1]:9000" > "$WORK_DIR/pool-minio-ipv6-9000.log" 2>&1 &
+	"${MINIO[@]}" server --address="[::1]:9001" >"$WORK_DIR/pool-minio-ipv6-9001.log" 2>&1 &
    "${MINIO[@]}" server --address="[::1]:9001" > "$WORK_DIR/pool-minio-ipv6-9001.log" 2>&1 &
-    sleep 40
+	sleep 40
 }
-function start_minio_dist_erasure()
+function start_minio_dist_erasure() {
-{
+	export MINIO_ROOT_USER=$ACCESS_KEY
-    export MINIO_ROOT_USER=$ACCESS_KEY
+	export MINIO_ROOT_PASSWORD=$SECRET_KEY
-    export MINIO_ROOT_PASSWORD=$SECRET_KEY
+	export MINIO_ENDPOINTS="http://127.0.0.1:9000${WORK_DIR}/dist-disk1 http://127.0.0.1:9001${WORK_DIR}/dist-disk2 http://127.0.0.1:9002${WORK_DIR}/dist-disk3 http://127.0.0.1:9003${WORK_DIR}/dist-disk4"
-    export MINIO_ENDPOINTS="http://127.0.0.1:9000${WORK_DIR}/dist-disk1 http://127.0.0.1:9001${WORK_DIR}/dist-disk2 http://127.0.0.1:9002${WORK_DIR}/dist-disk3 http://127.0.0.1:9003${WORK_DIR}/dist-disk4"
+	for i in $(seq 0 3); do
-    for i in $(seq 0 3); do
+		"${MINIO[@]}" server --address ":900${i}" >"$WORK_DIR/dist-minio-900${i}.log" 2>&1 &
-        "${MINIO[@]}" server --address ":900${i}" > "$WORK_DIR/dist-minio-900${i}.log" 2>&1 &
+	done
    done
-    sleep 40
+	sleep 40
 }
-function run_test_fs()
+function run_test_fs() {
-{
+	start_minio_fs
    start_minio_fs
-    (cd "$WORK_DIR" && "$FUNCTIONAL_TESTS")
+	(cd "$WORK_DIR" && "$FUNCTIONAL_TESTS")
-    rv=$?
+	rv=$?
-    pkill minio
+	pkill minio
-    sleep 3
+	sleep 3
-    if [ "$rv" -ne 0 ]; then
+	if [ "$rv" -ne 0 ]; then
-        cat "$WORK_DIR/fs-minio.log"
+		cat "$WORK_DIR/fs-minio.log"
-    fi
+	fi
-    rm -f "$WORK_DIR/fs-minio.log"
+	rm -f "$WORK_DIR/fs-minio.log"
-    return "$rv"
+	return "$rv"
 }
-function run_test_erasure_sets()
+function run_test_erasure_sets() {
-{
+	start_minio_erasure_sets
    start_minio_erasure_sets
-    (cd "$WORK_DIR" && "$FUNCTIONAL_TESTS")
+	(cd "$WORK_DIR" && "$FUNCTIONAL_TESTS")
-    rv=$?
+	rv=$?
-    pkill minio
+	pkill minio
-    sleep 3
+	sleep 3
-    if [ "$rv" -ne 0 ]; then
+	if [ "$rv" -ne 0 ]; then
-        cat "$WORK_DIR/erasure-minio-sets.log"
+		cat "$WORK_DIR/erasure-minio-sets.log"
-    fi
+	fi
-    rm -f "$WORK_DIR/erasure-minio-sets.log"
+	rm -f "$WORK_DIR/erasure-minio-sets.log"
-    return "$rv"
+	return "$rv"
 }
-function run_test_pool_erasure_sets()
+function run_test_pool_erasure_sets() {
-{
+	start_minio_pool_erasure_sets
    start_minio_pool_erasure_sets
-    (cd "$WORK_DIR" && "$FUNCTIONAL_TESTS")
+	(cd "$WORK_DIR" && "$FUNCTIONAL_TESTS")
-    rv=$?
+	rv=$?
-    pkill minio
+	pkill minio
-    sleep 3
+	sleep 3
-    if [ "$rv" -ne 0 ]; then
+	if [ "$rv" -ne 0 ]; then
-        for i in $(seq 0 1); do
+		for i in $(seq 0 1); do
-            echo "server$i log:"
+			echo "server$i log:"
-            cat "$WORK_DIR/pool-minio-900$i.log"
+			cat "$WORK_DIR/pool-minio-900$i.log"
-        done
+		done
-    fi
+	fi
-    for i in $(seq 0 1); do
+	for i in $(seq 0 1); do
-        rm -f "$WORK_DIR/pool-minio-900$i.log"
+		rm -f "$WORK_DIR/pool-minio-900$i.log"
-    done
+	done
-    return "$rv"
+	return "$rv"
 }
-function run_test_pool_erasure_sets_ipv6()
+function run_test_pool_erasure_sets_ipv6() {
-{
+	start_minio_pool_erasure_sets_ipv6
    start_minio_pool_erasure_sets_ipv6
-    export SERVER_ENDPOINT="[::1]:9000"
+	export SERVER_ENDPOINT="[::1]:9000"
-    (cd "$WORK_DIR" && "$FUNCTIONAL_TESTS")
+	(cd "$WORK_DIR" && "$FUNCTIONAL_TESTS")
-    rv=$?
+	rv=$?
-    pkill minio
+	pkill minio
-    sleep 3
+	sleep 3
-    if [ "$rv" -ne 0 ]; then
+	if [ "$rv" -ne 0 ]; then
-        for i in $(seq 0 1); do
+		for i in $(seq 0 1); do
-            echo "server$i log:"
+			echo "server$i log:"
-            cat "$WORK_DIR/pool-minio-ipv6-900$i.log"
+			cat "$WORK_DIR/pool-minio-ipv6-900$i.log"
-        done
+		done
-    fi
+	fi
-    for i in $(seq 0 1); do
+	for i in $(seq 0 1); do
-        rm -f "$WORK_DIR/pool-minio-ipv6-900$i.log"
+		rm -f "$WORK_DIR/pool-minio-ipv6-900$i.log"
-    done
+	done
-    return "$rv"
+	return "$rv"
 }
-function run_test_erasure()
+function run_test_erasure() {
-{
+	start_minio_erasure
    start_minio_erasure
-    (cd "$WORK_DIR" && "$FUNCTIONAL_TESTS")
+	(cd "$WORK_DIR" && "$FUNCTIONAL_TESTS")
-    rv=$?
+	rv=$?
-    pkill minio
+	pkill minio
-    sleep 3
+	sleep 3
-    if [ "$rv" -ne 0 ]; then
+	if [ "$rv" -ne 0 ]; then
-        cat "$WORK_DIR/erasure-minio.log"
+		cat "$WORK_DIR/erasure-minio.log"
-    fi
+	fi
-    rm -f "$WORK_DIR/erasure-minio.log"
+	rm -f "$WORK_DIR/erasure-minio.log"
-    return "$rv"
+	return "$rv"
 }
-function run_test_dist_erasure()
+function run_test_dist_erasure() {
-{
+	start_minio_dist_erasure
    start_minio_dist_erasure
-    (cd "$WORK_DIR" && "$FUNCTIONAL_TESTS")
+	(cd "$WORK_DIR" && "$FUNCTIONAL_TESTS")
-    rv=$?
+	rv=$?
-    pkill minio
+	pkill minio
-    sleep 3
+	sleep 3
-    if [ "$rv" -ne 0 ]; then
+	if [ "$rv" -ne 0 ]; then
-        echo "server1 log:"
+		echo "server1 log:"
-        cat "$WORK_DIR/dist-minio-9000.log"
+		cat "$WORK_DIR/dist-minio-9000.log"
-        echo "server2 log:"
+		echo "server2 log:"
-        cat "$WORK_DIR/dist-minio-9001.log"
+		cat "$WORK_DIR/dist-minio-9001.log"
-        echo "server3 log:"
+		echo "server3 log:"
-        cat "$WORK_DIR/dist-minio-9002.log"
+		cat "$WORK_DIR/dist-minio-9002.log"
-        echo "server4 log:"
+		echo "server4 log:"
-        cat "$WORK_DIR/dist-minio-9003.log"
+		cat "$WORK_DIR/dist-minio-9003.log"
-    fi
+	fi
-    rm -f "$WORK_DIR/dist-minio-9000.log" "$WORK_DIR/dist-minio-9001.log" "$WORK_DIR/dist-minio-9002.log" "$WORK_DIR/dist-minio-9003.log"
+	rm -f "$WORK_DIR/dist-minio-9000.log" "$WORK_DIR/dist-minio-9001.log" "$WORK_DIR/dist-minio-9002.log" "$WORK_DIR/dist-minio-9003.log"
-    return "$rv"
+	return "$rv"
 }
-function purge()
+function purge() {
-{
+	rm -rf "$1"
    rm -rf "$1"
 }
-function __init__()
+function __init__() {
-{
+	echo "Initializing environment"
-    echo "Initializing environment"
+	mkdir -p "$WORK_DIR"
-    mkdir -p "$WORK_DIR"
+	mkdir -p "$MINIO_CONFIG_DIR"
-    mkdir -p "$MINIO_CONFIG_DIR"
+	mkdir -p "$MINT_DATA_DIR"
    mkdir -p "$MINT_DATA_DIR"
-    MC_BUILD_DIR="mc-$RANDOM"
+	MC_BUILD_DIR="mc-$RANDOM"
-    if ! git clone --quiet https://github.com/minio/mc "$MC_BUILD_DIR"; then
+	if ! git clone --quiet https://github.com/minio/mc "$MC_BUILD_DIR"; then
-        echo "failed to download https://github.com/minio/mc"
+		echo "failed to download https://github.com/minio/mc"
-        purge "${MC_BUILD_DIR}"
+		purge "${MC_BUILD_DIR}"
-        exit 1
+		exit 1
-    fi
+	fi
-    (cd "${MC_BUILD_DIR}" && go build -o "$WORK_DIR/mc")
+	(cd "${MC_BUILD_DIR}" && go build -o "$WORK_DIR/mc")
-    # remove mc source.
+	# remove mc source.
-    purge "${MC_BUILD_DIR}"
+	purge "${MC_BUILD_DIR}"
-    shred -n 1 -s 1M - 1>"$FILE_1_MB" 2>/dev/null
+	shred -n 1 -s 1M - 1>"$FILE_1_MB" 2>/dev/null
-    shred -n 1 -s 65M - 1>"$FILE_65_MB" 2>/dev/null
+	shred -n 1 -s 65M - 1>"$FILE_65_MB" 2>/dev/null
-    ## version is purposefully set to '3' for minio to migrate configuration file
+	## version is purposefully set to '3' for minio to migrate configuration file
-    echo '{"version": "3", "credential": {"accessKey": "minio", "secretKey": "minio123"}, "region": "us-east-1"}' > "$MINIO_CONFIG_DIR/config.json"
+	echo '{"version": "3", "credential": {"accessKey": "minio", "secretKey": "minio123"}, "region": "us-east-1"}' >"$MINIO_CONFIG_DIR/config.json"
-    if ! wget -q -O "$FUNCTIONAL_TESTS" https://raw.githubusercontent.com/minio/mc/master/functional-tests.sh; then
+	if ! wget -q -O "$FUNCTIONAL_TESTS" https://raw.githubusercontent.com/minio/mc/master/functional-tests.sh; then
-        echo "failed to download https://raw.githubusercontent.com/minio/mc/master/functional-tests.sh"
+		echo "failed to download https://raw.githubusercontent.com/minio/mc/master/functional-tests.sh"
-        exit 1
+		exit 1
-    fi
+	fi
-    sed -i 's|-sS|-sSg|g' "$FUNCTIONAL_TESTS"
+	sed -i 's|-sS|-sSg|g' "$FUNCTIONAL_TESTS"
-    chmod a+x "$FUNCTIONAL_TESTS"
+	chmod a+x "$FUNCTIONAL_TESTS"
 }
-function main()
+function main() {
-{
+	echo "Testing in FS setup"
-    echo "Testing in FS setup"
+	if ! run_test_fs; then
-    if ! run_test_fs; then
+		echo "FAILED"
-        echo "FAILED"
+		purge "$WORK_DIR"
-        purge "$WORK_DIR"
+		exit 1
-        exit 1
+	fi
    fi
-    echo "Testing in Erasure setup"
+	echo "Testing in Erasure setup"
-    if ! run_test_erasure; then
+	if ! run_test_erasure; then
-        echo "FAILED"
+		echo "FAILED"
-        purge "$WORK_DIR"
+		purge "$WORK_DIR"
-        exit 1
+		exit 1
-    fi
+	fi
-    echo "Testing in Distributed Erasure setup"
+	echo "Testing in Distributed Erasure setup"
-    if ! run_test_dist_erasure; then
+	if ! run_test_dist_erasure; then
-        echo "FAILED"
+		echo "FAILED"
-        purge "$WORK_DIR"
+		purge "$WORK_DIR"
-        exit 1
+		exit 1
-    fi
+	fi
-    echo "Testing in Erasure setup as sets"
+	echo "Testing in Erasure setup as sets"
-    if ! run_test_erasure_sets; then
+	if ! run_test_erasure_sets; then
-        echo "FAILED"
+		echo "FAILED"
-        purge "$WORK_DIR"
+		purge "$WORK_DIR"
-        exit 1
+		exit 1
-    fi
+	fi
-    echo "Testing in Distributed Eraure expanded setup"
+	echo "Testing in Distributed Eraure expanded setup"
-    if ! run_test_pool_erasure_sets; then
+	if ! run_test_pool_erasure_sets; then
-        echo "FAILED"
+		echo "FAILED"
-        purge "$WORK_DIR"
+		purge "$WORK_DIR"
-        exit 1
+		exit 1
-    fi
+	fi
-    echo "Testing in Distributed Erasure expanded setup with ipv6"
+	echo "Testing in Distributed Erasure expanded setup with ipv6"
-    if ! run_test_pool_erasure_sets_ipv6; then
+	if ! run_test_pool_erasure_sets_ipv6; then
-        echo "FAILED"
+		echo "FAILED"
-        purge "$WORK_DIR"
+		purge "$WORK_DIR"
-        exit 1
+		exit 1
-    fi
+	fi
-    purge "$WORK_DIR"
+	purge "$WORK_DIR"
 }
-( __init__ "$@" && main "$@" )
+(__init__ "$@" && main "$@")
 rv=$?
 purge "$WORK_DIR"
 exit "$rv"
@@ -4,94 +4,93 @@ set -E
 set -o pipefail
 set -x
 if [ ! -x "$PWD/minio" ]; then
-    echo "minio executable binary not found in current directory"
+	echo "minio executable binary not found in current directory"
-    exit 1
+	exit 1
 fi
 WORK_DIR="$(mktemp -d)"
 MINIO_CONFIG_DIR="$WORK_DIR/.minio"
-MINIO=( "$PWD/minio" --config-dir "$MINIO_CONFIG_DIR" server )
+MINIO=("$PWD/minio" --config-dir "$MINIO_CONFIG_DIR" server)
 function start_minio() {
-    start_port=$1
+	start_port=$1
-    export MINIO_ROOT_USER=minio
+	export MINIO_ROOT_USER=minio
-    export MINIO_ROOT_PASSWORD=minio123
+	export MINIO_ROOT_PASSWORD=minio123
-    unset MINIO_KMS_AUTO_ENCRYPTION # do not auto-encrypt objects
+	unset MINIO_KMS_AUTO_ENCRYPTION # do not auto-encrypt objects
-    unset MINIO_CI_CD
+	unset MINIO_CI_CD
-    unset CI
+	unset CI
-    args=()
+	args=()
-    for i in $(seq 1 4); do
+	for i in $(seq 1 4); do
-            args+=("http://localhost:$[${start_port}+$i]${WORK_DIR}/mnt/disk$i/ ")
+		args+=("http://localhost:$((start_port + i))${WORK_DIR}/mnt/disk$i/ ")
-    done
+	done
-    for i in $(seq 1 4); do
+	for i in $(seq 1 4); do
-            "${MINIO[@]}" --address ":$[$start_port+$i]" ${args[@]} 2>&1 >"${WORK_DIR}/server$i.log" &
+		"${MINIO[@]}" --address ":$((start_port + i))" ${args[@]} 2>&1 >"${WORK_DIR}/server$i.log" &
-    done
+	done
-    # Wait until all nodes return 403
+	# Wait until all nodes return 403
-    for i in $(seq 1 4); do
+	for i in $(seq 1 4); do
-	    while [ "$(curl -m 1 -s -o /dev/null -w "%{http_code}" http://localhost:$[$start_port+$i])" -ne "403" ]; do
+		while [ "$(curl -m 1 -s -o /dev/null -w "%{http_code}" http://localhost:$((start_port + i)))" -ne "403" ]; do
-		    echo -n ".";
+			echo -n "."
-                    sleep 1;
+			sleep 1
-            done
+		done
-    done
+	done
- }
+}
 # Prepare fake disks with losetup
 function prepare_block_devices() {
-        mkdir -p ${WORK_DIR}/disks/ ${WORK_DIR}/mnt/
+	set -e
-        for i in 1 2 3 4; do
+	mkdir -p ${WORK_DIR}/disks/ ${WORK_DIR}/mnt/
-                dd if=/dev/zero of=${WORK_DIR}/disks/img.$i bs=1M count=2048
+	sudo modprobe loop
-                mkfs.ext4 -F ${WORK_DIR}/disks/img.$i
+	for i in 1 2 3 4; do
-                sudo mknod /dev/minio-loopdisk$i b 7 $[256-$i]
+		dd if=/dev/zero of=${WORK_DIR}/disks/img.${i} bs=1M count=2000
-                sudo losetup /dev/minio-loopdisk$i ${WORK_DIR}/disks/img.$i
+		device=$(sudo losetup --find --show ${WORK_DIR}/disks/img.${i})
-                mkdir -p ${WORK_DIR}/mnt/disk$i/
+		sudo mkfs.ext4 -F ${device}
-                sudo mount /dev/minio-loopdisk$i ${WORK_DIR}/mnt/disk$i/
+		mkdir -p ${WORK_DIR}/mnt/disk${i}/
-                sudo chown "$(id -u):$(id -g)" /dev/minio-loopdisk$i ${WORK_DIR}/mnt/disk$i/
+		sudo mount ${device} ${WORK_DIR}/mnt/disk${i}/
-        done
+		sudo chown "$(id -u):$(id -g)" ${device} ${WORK_DIR}/mnt/disk${i}/
 	done
 	set +e
 }
 # Start a distributed MinIO setup, unmount one disk and check if it is formatted
 function main() {
-    start_port=$(shuf -i 10000-65000 -n 1)
+	start_port=$(shuf -i 10000-65000 -n 1)
-    start_minio ${start_port}
+	start_minio ${start_port}
-    # Unmount the disk, after the unmount the device id
+	# Unmount the disk, after the unmount the device id
-    # /tmp/xxx/mnt/disk4 will be the same as '/' and it
+	# /tmp/xxx/mnt/disk4 will be the same as '/' and it
-    # will be detected as root disk
+	# will be detected as root disk
-    while [ "$u" != "0" ]; do
+	while [ "$u" != "0" ]; do
-	    sudo umount ${WORK_DIR}/mnt/disk4/
+		sudo umount ${WORK_DIR}/mnt/disk4/
-	    u=$?
+		u=$?
-	    sleep 1
+		sleep 1
-    done
+	done
-    # Wait until MinIO self heal kicks in
+	# Wait until MinIO self heal kicks in
-    sleep 60
+	sleep 60
-    if [ -f ${WORK_DIR}/mnt/disk4/.minio.sys/format.json ]; then
+	if [ -f ${WORK_DIR}/mnt/disk4/.minio.sys/format.json ]; then
-	    echo "A root disk is formatted unexpectedely"
+		echo "A root disk is formatted unexpectedely"
-            cat "${WORK_DIR}/server4.log"
+		cat "${WORK_DIR}/server4.log"
-            exit -1
+		exit -1
-    fi
+	fi
 }
 function cleanup() {
-    pkill minio
+	pkill minio
-    sudo umount ${WORK_DIR}/mnt/disk{1..3}/
+	sudo umount ${WORK_DIR}/mnt/disk{1..3}/
-    sudo rm /dev/minio-loopdisk*
+	sudo rm /dev/minio-loopdisk*
-    rm -rf "$WORK_DIR"
+	rm -rf "$WORK_DIR"
 }
-( prepare_block_devices )
+(prepare_block_devices)
-( main "$@" )
+(main "$@")
 rv=$?
 cleanup
 exit "$rv"
@@ -5,139 +5,136 @@ set -E
 set -o pipefail
 if [ ! -x "$PWD/minio" ]; then
-    echo "minio executable binary not found in current directory"
+	echo "minio executable binary not found in current directory"
-    exit 1
+	exit 1
 fi
 WORK_DIR="$PWD/.verify-$RANDOM"
 MINIO_CONFIG_DIR="$WORK_DIR/.minio"
-MINIO=( "$PWD/minio" --config-dir "$MINIO_CONFIG_DIR" server )
+MINIO=("$PWD/minio" --config-dir "$MINIO_CONFIG_DIR" server)
 function start_minio_3_node() {
-    export MINIO_ROOT_USER=minio
+	export MINIO_ROOT_USER=minio
-    export MINIO_ROOT_PASSWORD=minio123
+	export MINIO_ROOT_PASSWORD=minio123
-    export MINIO_ERASURE_SET_DRIVE_COUNT=6
+	export MINIO_ERASURE_SET_DRIVE_COUNT=6
-    export MINIO_CI_CD=1
+	export MINIO_CI_CD=1
-    start_port=$2
+	start_port=$2
-    args=""
+	args=""
    for i in $(seq 1 3); do
 	args="$args http://127.0.0.1:$[$start_port+$i]${WORK_DIR}/$i/1/ http://127.0.0.1:$[$start_port+$i]${WORK_DIR}/$i/2/ http://127.0.0.1:$[$start_port+$i]${WORK_DIR}/$i/3/ http://127.0.0.1:$[$start_port+$i]${WORK_DIR}/$i/4/ http://127.0.0.1:$[$start_port+$i]${WORK_DIR}/$i/5/ http://127.0.0.1:$[$start_port+$i]${WORK_DIR}/$i/6/"
    done
    "${MINIO[@]}" --address ":$[$start_port+1]" $args > "${WORK_DIR}/dist-minio-server1.log" 2>&1 &
    pid1=$!
    disown ${pid1}
    "${MINIO[@]}" --address ":$[$start_port+2]" $args > "${WORK_DIR}/dist-minio-server2.log" 2>&1 &
    pid2=$!
    disown $pid2
    "${MINIO[@]}" --address ":$[$start_port+3]" $args > "${WORK_DIR}/dist-minio-server3.log" 2>&1 &
    pid3=$!
    disown $pid3
    sleep "$1"
    if ! ps -p $pid1 1>&2 > /dev/null; then
 	echo "server1 log:"
 	cat "${WORK_DIR}/dist-minio-server1.log"
 	echo "FAILED"
 	purge "$WORK_DIR"
 	exit 1
    fi
    if ! ps -p $pid2 1>&2 > /dev/null; then
 	echo "server2 log:"
 	cat "${WORK_DIR}/dist-minio-server2.log"
 	echo "FAILED"
 	purge "$WORK_DIR"
 	exit 1
    fi
    if ! ps -p $pid3 1>&2 > /dev/null; then
 	echo "server3 log:"
 	cat "${WORK_DIR}/dist-minio-server3.log"
 	echo "FAILED"
 	purge "$WORK_DIR"
 	exit 1
    fi
    if ! pkill minio; then
 	for i in $(seq 1 3); do
-	    echo "server$i log:"
+		args="$args http://127.0.0.1:$((start_port + i))${WORK_DIR}/$i/1/ http://127.0.0.1:$((start_port + i))${WORK_DIR}/$i/2/ http://127.0.0.1:$((start_port + i))${WORK_DIR}/$i/3/ http://127.0.0.1:$((start_port + i))${WORK_DIR}/$i/4/ http://127.0.0.1:$((start_port + i))${WORK_DIR}/$i/5/ http://127.0.0.1:$((start_port + i))${WORK_DIR}/$i/6/"
 	    cat "${WORK_DIR}/dist-minio-server$i.log"
 	done
 	echo "FAILED"
 	purge "$WORK_DIR"
 	exit 1
    fi
-    sleep 1;
+	"${MINIO[@]}" --address ":$((start_port + 1))" $args >"${WORK_DIR}/dist-minio-server1.log" 2>&1 &
-    if pgrep minio; then
+	pid1=$!
-	# forcibly killing, to proceed further properly.
+	disown ${pid1}
-	if ! pkill -9 minio; then
+
-	    echo "no minio process running anymore, proceed."
+	"${MINIO[@]}" --address ":$((start_port + 2))" $args >"${WORK_DIR}/dist-minio-server2.log" 2>&1 &
 	pid2=$!
 	disown $pid2
 	"${MINIO[@]}" --address ":$((start_port + 3))" $args >"${WORK_DIR}/dist-minio-server3.log" 2>&1 &
 	pid3=$!
 	disown $pid3
 	sleep "$1"
 	if ! ps -p $pid1 1>&2 >/dev/null; then
 		echo "server1 log:"
 		cat "${WORK_DIR}/dist-minio-server1.log"
 		echo "FAILED"
 		purge "$WORK_DIR"
 		exit 1
 	fi
    fi
 }
 	if ! ps -p $pid2 1>&2 >/dev/null; then
 		echo "server2 log:"
 		cat "${WORK_DIR}/dist-minio-server2.log"
 		echo "FAILED"
 		purge "$WORK_DIR"
 		exit 1
 	fi
 	if ! ps -p $pid3 1>&2 >/dev/null; then
 		echo "server3 log:"
 		cat "${WORK_DIR}/dist-minio-server3.log"
 		echo "FAILED"
 		purge "$WORK_DIR"
 		exit 1
 	fi
 	if ! pkill minio; then
 		for i in $(seq 1 3); do
 			echo "server$i log:"
 			cat "${WORK_DIR}/dist-minio-server$i.log"
 		done
 		echo "FAILED"
 		purge "$WORK_DIR"
 		exit 1
 	fi
 	sleep 1
 	if pgrep minio; then
 		# forcibly killing, to proceed further properly.
 		if ! pkill -9 minio; then
 			echo "no minio process running anymore, proceed."
 		fi
 	fi
 }
 function check_online() {
-    if grep -q 'Unable to initialize sub-systems' ${WORK_DIR}/dist-minio-*.log; then
+	if ! grep -q 'Status:' ${WORK_DIR}/dist-minio-*.log; then
-	echo "1"
+		echo "1"
-    fi
+	fi
 }
-function purge()
+function purge() {
-{
+	rm -rf "$1"
    rm -rf "$1"
 }
-function __init__()
+function __init__() {
-{
+	echo "Initializing environment"
-    echo "Initializing environment"
+	mkdir -p "$WORK_DIR"
-    mkdir -p "$WORK_DIR"
+	mkdir -p "$MINIO_CONFIG_DIR"
    mkdir -p "$MINIO_CONFIG_DIR"
-    ## version is purposefully set to '3' for minio to migrate configuration file
+	## version is purposefully set to '3' for minio to migrate configuration file
-    echo '{"version": "3", "credential": {"accessKey": "minio", "secretKey": "minio123"}, "region": "us-east-1"}' > "$MINIO_CONFIG_DIR/config.json"
+	echo '{"version": "3", "credential": {"accessKey": "minio", "secretKey": "minio123"}, "region": "us-east-1"}' >"$MINIO_CONFIG_DIR/config.json"
 }
 function perform_test() {
-    start_minio_3_node 120 $2
+	start_minio_3_node 120 $2
-    echo "Testing Distributed Erasure setup healing of drives"
+	echo "Testing Distributed Erasure setup healing of drives"
-    echo "Remove the contents of the disks belonging to '${1}' erasure set"
+	echo "Remove the contents of the disks belonging to '${1}' erasure set"
-    rm -rf ${WORK_DIR}/${1}/*/
+	rm -rf ${WORK_DIR}/${1}/*/
-    start_minio_3_node 120 $2
+	set -x
 	start_minio_3_node 120 $2
-    rv=$(check_online)
+	rv=$(check_online)
-    if [ "$rv" == "1" ]; then
+	if [ "$rv" == "1" ]; then
-	for i in $(seq 1 3); do
+		for i in $(seq 1 3); do
-	    echo "server$i log:"
+			echo "server$i log:"
-	    cat "${WORK_DIR}/dist-minio-server$i.log"
+			cat "${WORK_DIR}/dist-minio-server$i.log"
-	done
+		done
-	pkill -9 minio
+		pkill -9 minio
-	echo "FAILED"
+		echo "FAILED"
-	purge "$WORK_DIR"
+		purge "$WORK_DIR"
-	exit 1
+		exit 1
-    fi
+	fi
 }
-function main()
+function main() {
-{
+	# use same ports for all tests
-    # use same ports for all tests
+	start_port=$(shuf -i 10000-65000 -n 1)
    start_port=$(shuf -i 10000-65000 -n 1)
-    perform_test "2" ${start_port}
+	perform_test "2" ${start_port}
-    perform_test "1" ${start_port}
+	perform_test "1" ${start_port}
-    perform_test "3" ${start_port}
+	perform_test "3" ${start_port}
 }
-( __init__ "$@" && main "$@" )
+(__init__ "$@" && main "$@")
 rv=$?
 purge "$WORK_DIR"
 exit "$rv"
@@ -22,10 +22,10 @@ import (
 	"io"
 	"net/http"
 	"github.com/gorilla/mux"
 	xhttp "github.com/minio/minio/internal/http"
 	"github.com/minio/minio/internal/logger"
-	"github.com/minio/pkg/bucket/policy"
+	"github.com/minio/mux"
 	"github.com/minio/pkg/v2/policy"
 )
 // Data types used for returning dummy access control
@@ -90,8 +90,8 @@ func (api objectAPIHandlers) PutBucketACLHandler(w http.ResponseWriter, r *http.
 	if aclHeader == "" {
 		acl := &accessControlPolicy{}
 		if err = xmlDecoder(r.Body, acl, r.ContentLength); err != nil {
-			if err == io.EOF {
+			if terr, ok := err.(*xml.SyntaxError); ok && terr.Msg == io.EOF.Error() {
-				writeErrorResponse(ctx, w, errorCodes.ToAPIErr(ErrMissingSecurityHeader),
+				writeErrorResponse(ctx, w, errorCodes.ToAPIErr(ErrMalformedXML),
 					r.URL)
 				return
 			}
@@ -29,11 +29,10 @@ import (
 	"strings"
 	"time"
 	"github.com/gorilla/mux"
 	jsoniter "github.com/json-iterator/go"
 	"github.com/klauspost/compress/zip"
-	"github.com/minio/kes"
+	"github.com/minio/kms-go/kes"
-	"github.com/minio/madmin-go"
+	"github.com/minio/madmin-go/v3"
 	"github.com/minio/minio-go/v7/pkg/tags"
 	"github.com/minio/minio/internal/bucket/lifecycle"
 	objectlock "github.com/minio/minio/internal/bucket/object/lock"
@@ -41,8 +40,8 @@ import (
 	"github.com/minio/minio/internal/event"
 	"github.com/minio/minio/internal/kms"
 	"github.com/minio/minio/internal/logger"
-	"github.com/minio/pkg/bucket/policy"
+	"github.com/minio/mux"
-	iampolicy "github.com/minio/pkg/iam/policy"
+	"github.com/minio/pkg/v2/policy"
 )
 const (
@@ -56,11 +55,9 @@ const (
 // specified in the quota configuration will be applied by default
 // to enforce total quota for the specified bucket.
 func (a adminAPIHandlers) PutBucketQuotaConfigHandler(w http.ResponseWriter, r *http.Request) {
-	ctx := newContext(r, w, "PutBucketQuotaConfig")
+	ctx := r.Context()
-	defer logger.AuditLog(ctx, w, r, mustGetClaimsFromToken(r))
+	objectAPI, _ := validateAdminReq(ctx, w, r, policy.SetBucketQuotaAdminAction)
 	objectAPI, _ := validateAdminReq(ctx, w, r, iampolicy.SetBucketQuotaAdminAction)
 	if objectAPI == nil {
 		return
 	}
@@ -85,11 +82,6 @@ func (a adminAPIHandlers) PutBucketQuotaConfigHandler(w http.ResponseWriter, r *
 		return
 	}
 	if quotaConfig.Type == "fifo" {
 		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrInvalidRequest), r.URL)
 		return
 	}
 	updatedAt, err := globalBucketMetadataSys.Update(ctx, bucket, bucketQuotaConfigFile, data)
 	if err != nil {
 		writeErrorResponse(ctx, w, toAPIError(ctx, err), r.URL)
@@ -102,15 +94,12 @@ func (a adminAPIHandlers) PutBucketQuotaConfigHandler(w http.ResponseWriter, r *
 		Quota:     data,
 		UpdatedAt: updatedAt,
 	}
-	if quotaConfig.Quota == 0 {
+	if quotaConfig.Size == 0 && quotaConfig.Quota == 0 {
 		bucketMeta.Quota = nil
 	}
 	// Call site replication hook.
-	if err = globalSiteReplicationSys.BucketMetaHook(ctx, bucketMeta); err != nil {
+	logger.LogIf(ctx, globalSiteReplicationSys.BucketMetaHook(ctx, bucketMeta))
 		writeErrorResponse(ctx, w, toAPIError(ctx, err), r.URL)
 		return
 	}
 	// Write success response.
 	writeSuccessResponseHeadersOnly(w)
@@ -118,11 +107,9 @@ func (a adminAPIHandlers) PutBucketQuotaConfigHandler(w http.ResponseWriter, r *
 // GetBucketQuotaConfigHandler - gets bucket quota configuration
 func (a adminAPIHandlers) GetBucketQuotaConfigHandler(w http.ResponseWriter, r *http.Request) {
-	ctx := newContext(r, w, "GetBucketQuotaConfig")
+	ctx := r.Context()
-	defer logger.AuditLog(ctx, w, r, mustGetClaimsFromToken(r))
+	objectAPI, _ := validateAdminReq(ctx, w, r, policy.GetBucketQuotaAdminAction)
 	objectAPI, _ := validateAdminReq(ctx, w, r, iampolicy.GetBucketQuotaAdminAction)
 	if objectAPI == nil {
 		return
 	}
@@ -153,20 +140,14 @@ func (a adminAPIHandlers) GetBucketQuotaConfigHandler(w http.ResponseWriter, r *
 // SetRemoteTargetHandler - sets a remote target for bucket
 func (a adminAPIHandlers) SetRemoteTargetHandler(w http.ResponseWriter, r *http.Request) {
-	ctx := newContext(r, w, "SetBucketTarget")
+	ctx := r.Context()
 	defer logger.AuditLog(ctx, w, r, mustGetClaimsFromToken(r))
 	vars := mux.Vars(r)
 	bucket := pathClean(vars["bucket"])
 	update := r.Form.Get("update") == "true"
 	if globalIsGateway {
 		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrNotImplemented), r.URL)
 		return
 	}
 	// Get current object layer instance.
-	objectAPI, _ := validateAdminReq(ctx, w, r, iampolicy.SetBucketTargetAction)
+	objectAPI, _ := validateAdminReq(ctx, w, r, policy.SetBucketTargetAction)
 	if objectAPI == nil {
 		return
 	}
@@ -177,7 +158,7 @@ func (a adminAPIHandlers) SetRemoteTargetHandler(w http.ResponseWriter, r *http.
 		return
 	}
-	cred, _, _, s3Err := validateAdminSignature(ctx, r, "")
+	cred, _, s3Err := validateAdminSignature(ctx, r, "")
 	if s3Err != ErrNone {
 		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(s3Err), r.URL)
 		return
@@ -206,12 +187,28 @@ func (a adminAPIHandlers) SetRemoteTargetHandler(w http.ResponseWriter, r *http.
 	if update {
 		ops = madmin.GetTargetUpdateOps(r.Form)
 	} else {
-		target.Arn = globalBucketTargetSys.getRemoteARN(bucket, &target)
+		var exists bool // true if arn exists
 		target.Arn, exists = globalBucketTargetSys.getRemoteARN(bucket, &target, "")
 		if exists && target.Arn != "" { // return pre-existing ARN
 			data, err := json.Marshal(target.Arn)
 			if err != nil {
 				writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 				return
 			}
 			// Write success response.
 			writeSuccessResponseJSON(w, data)
 			return
 		}
 	}
 	if target.Arn == "" {
 		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErrWithErr(ErrAdminConfigBadJSON, err), r.URL)
 		return
 	}
 	if globalSiteReplicationSys.isEnabled() && !update {
 		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErrWithErr(ErrRemoteTargetDenyAddError, err), r.URL)
 		return
 	}
 	if update {
 		// overlay the updates on existing target
 		tgt := globalBucketTargetSys.GetRemoteBucketTargetByArn(ctx, bucket, target.Arn)
@@ -222,10 +219,14 @@ func (a adminAPIHandlers) SetRemoteTargetHandler(w http.ResponseWriter, r *http.
 		for _, op := range ops {
 			switch op {
 			case madmin.CredentialsUpdateType:
-				tgt.Credentials = target.Credentials
+				if !globalSiteReplicationSys.isEnabled() {
-				tgt.TargetBucket = target.TargetBucket
+					// credentials update is possible only in bucket replication. User will never
-				tgt.Secure = target.Secure
+					// know the site replicator creds.
-				tgt.Endpoint = target.Endpoint
+					tgt.Credentials = target.Credentials
 					tgt.TargetBucket = target.TargetBucket
 					tgt.Secure = target.Secure
 					tgt.Endpoint = target.Endpoint
 				}
 			case madmin.SyncUpdateType:
 				tgt.ReplicationSync = target.ReplicationSync
 			case madmin.ProxyUpdateType:
@@ -282,19 +283,14 @@ func (a adminAPIHandlers) SetRemoteTargetHandler(w http.ResponseWriter, r *http.
 // ListRemoteTargetsHandler - lists remote target(s) for a bucket or gets a target
 // for a particular ARN type
 func (a adminAPIHandlers) ListRemoteTargetsHandler(w http.ResponseWriter, r *http.Request) {
-	ctx := newContext(r, w, "ListBucketTargets")
+	ctx := r.Context()
 	defer logger.AuditLog(ctx, w, r, mustGetClaimsFromToken(r))
 	vars := mux.Vars(r)
 	bucket := pathClean(vars["bucket"])
 	arnType := vars["type"]
 	if globalIsGateway {
 		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrNotImplemented), r.URL)
 		return
 	}
 	// Get current object layer instance.
-	objectAPI, _ := validateAdminReq(ctx, w, r, iampolicy.GetBucketTargetAction)
+	objectAPI, _ := validateAdminReq(ctx, w, r, policy.GetBucketTargetAction)
 	if objectAPI == nil {
 		return
 	}
@@ -321,19 +317,14 @@ func (a adminAPIHandlers) ListRemoteTargetsHandler(w http.ResponseWriter, r *htt
 // RemoveRemoteTargetHandler - removes a remote target for bucket with specified ARN
 func (a adminAPIHandlers) RemoveRemoteTargetHandler(w http.ResponseWriter, r *http.Request) {
-	ctx := newContext(r, w, "RemoveBucketTarget")
+	ctx := r.Context()
 	defer logger.AuditLog(ctx, w, r, mustGetClaimsFromToken(r))
 	vars := mux.Vars(r)
 	bucket := pathClean(vars["bucket"])
 	arn := vars["arn"]
 	if globalIsGateway {
 		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrNotImplemented), r.URL)
 		return
 	}
 	// Get current object layer instance.
-	objectAPI, _ := validateAdminReq(ctx, w, r, iampolicy.SetBucketTargetAction)
+	objectAPI, _ := validateAdminReq(ctx, w, r, policy.SetBucketTargetAction)
 	if objectAPI == nil {
 		return
 	}
@@ -369,16 +360,11 @@ func (a adminAPIHandlers) RemoveRemoteTargetHandler(w http.ResponseWriter, r *ht
 // ExportBucketMetadataHandler - exports all bucket metadata as a zipped file
 func (a adminAPIHandlers) ExportBucketMetadataHandler(w http.ResponseWriter, r *http.Request) {
-	ctx := newContext(r, w, "ExportBucketMetadata")
+	ctx := r.Context()
 	defer logger.AuditLog(ctx, w, r, mustGetClaimsFromToken(r))
 	bucket := pathClean(r.Form.Get("bucket"))
 	if globalIsGateway {
 		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrNotImplemented), r.URL)
 		return
 	}
 	// Get current object layer instance.
-	objectAPI, _ := validateAdminReq(ctx, w, r, iampolicy.ExportBucketMetadataAction)
+	objectAPI, _ := validateAdminReq(ctx, w, r, policy.ExportBucketMetadataAction)
 	if objectAPI == nil {
 		return
 	}
@@ -406,7 +392,8 @@ func (a adminAPIHandlers) ExportBucketMetadataHandler(w http.ResponseWriter, r *
 	// of bucket metadata
 	zipWriter := zip.NewWriter(w)
 	defer zipWriter.Close()
-	rawDataFn := func(r io.Reader, filename string, sz int) error {
+
 	rawDataFn := func(r io.Reader, filename string, sz int) {
 		header, zerr := zip.FileInfoHeader(dummyFileInfo{
 			name:    filename,
 			size:    int64(sz),
@@ -415,20 +402,13 @@ func (a adminAPIHandlers) ExportBucketMetadataHandler(w http.ResponseWriter, r *
 			isDir:   false,
 			sys:     nil,
 		})
-		if zerr != nil {
+		if zerr == nil {
-			logger.LogIf(ctx, zerr)
+			header.Method = zip.Deflate
-			return nil
+			zwriter, zerr := zipWriter.CreateHeader(header)
 			if zerr == nil {
 				io.Copy(zwriter, r)
 			}
 		}
 		header.Method = zip.Deflate
 		zwriter, zerr := zipWriter.CreateHeader(header)
 		if zerr != nil {
 			logger.LogIf(ctx, zerr)
 			return nil
 		}
 		if _, err := io.Copy(zwriter, r); err != nil {
 			logger.LogIf(ctx, err)
 		}
 		return nil
 	}
 	cfgFiles := []string{
@@ -460,12 +440,9 @@ func (a adminAPIHandlers) ExportBucketMetadataHandler(w http.ResponseWriter, r *
 					writeErrorResponse(ctx, w, exportError(ctx, err, cfgFile, bucket), r.URL)
 					return
 				}
-				if err = rawDataFn(bytes.NewReader(configData), cfgPath, len(configData)); err != nil {
+				rawDataFn(bytes.NewReader(configData), cfgPath, len(configData))
 					writeErrorResponse(ctx, w, exportError(ctx, err, cfgFile, bucket), r.URL)
 					return
 				}
 			case bucketLifecycleConfig:
-				config, err := globalBucketMetadataSys.GetLifecycleConfig(bucket)
+				config, _, err := globalBucketMetadataSys.GetLifecycleConfig(bucket)
 				if err != nil {
 					if errors.Is(err, BucketLifecycleNotFound{Bucket: bucket}) {
 						continue
@@ -479,10 +456,7 @@ func (a adminAPIHandlers) ExportBucketMetadataHandler(w http.ResponseWriter, r *
 					writeErrorResponse(ctx, w, exportError(ctx, err, cfgFile, bucket), r.URL)
 					return
 				}
-				if err = rawDataFn(bytes.NewReader(configData), cfgPath, len(configData)); err != nil {
+				rawDataFn(bytes.NewReader(configData), cfgPath, len(configData))
 					writeErrorResponse(ctx, w, exportError(ctx, err, cfgFile, bucket), r.URL)
 					return
 				}
 			case bucketQuotaConfigFile:
 				config, _, err := globalBucketMetadataSys.GetQuotaConfig(ctx, bucket)
 				if err != nil {
@@ -497,10 +471,7 @@ func (a adminAPIHandlers) ExportBucketMetadataHandler(w http.ResponseWriter, r *
 					writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 					return
 				}
-				if err = rawDataFn(bytes.NewReader(configData), cfgPath, len(configData)); err != nil {
+				rawDataFn(bytes.NewReader(configData), cfgPath, len(configData))
 					writeErrorResponse(ctx, w, exportError(ctx, err, cfgFile, bucket), r.URL)
 					return
 				}
 			case bucketSSEConfig:
 				config, _, err := globalBucketMetadataSys.GetSSEConfig(bucket)
 				if err != nil {
@@ -515,10 +486,7 @@ func (a adminAPIHandlers) ExportBucketMetadataHandler(w http.ResponseWriter, r *
 					writeErrorResponse(ctx, w, exportError(ctx, err, cfgFile, bucket), r.URL)
 					return
 				}
-				if err = rawDataFn(bytes.NewReader(configData), cfgPath, len(configData)); err != nil {
+				rawDataFn(bytes.NewReader(configData), cfgPath, len(configData))
 					writeErrorResponse(ctx, w, exportError(ctx, err, cfgFile, bucket), r.URL)
 					return
 				}
 			case bucketTaggingConfig:
 				config, _, err := globalBucketMetadataSys.GetTaggingConfig(bucket)
 				if err != nil {
@@ -533,10 +501,7 @@ func (a adminAPIHandlers) ExportBucketMetadataHandler(w http.ResponseWriter, r *
 					writeErrorResponse(ctx, w, exportError(ctx, err, cfgFile, bucket), r.URL)
 					return
 				}
-				if err = rawDataFn(bytes.NewReader(configData), cfgPath, len(configData)); err != nil {
+				rawDataFn(bytes.NewReader(configData), cfgPath, len(configData))
 					writeErrorResponse(ctx, w, exportError(ctx, err, cfgFile, bucket), r.URL)
 					return
 				}
 			case objectLockConfig:
 				config, _, err := globalBucketMetadataSys.GetObjectLockConfig(bucket)
 				if err != nil {
@@ -552,10 +517,7 @@ func (a adminAPIHandlers) ExportBucketMetadataHandler(w http.ResponseWriter, r *
 					writeErrorResponse(ctx, w, exportError(ctx, err, cfgFile, bucket), r.URL)
 					return
 				}
-				if err = rawDataFn(bytes.NewReader(configData), cfgPath, len(configData)); err != nil {
+				rawDataFn(bytes.NewReader(configData), cfgPath, len(configData))
 					writeErrorResponse(ctx, w, exportError(ctx, err, cfgFile, bucket), r.URL)
 					return
 				}
 			case bucketVersioningConfig:
 				config, _, err := globalBucketMetadataSys.GetVersioningConfig(bucket)
 				if err != nil {
@@ -571,10 +533,7 @@ func (a adminAPIHandlers) ExportBucketMetadataHandler(w http.ResponseWriter, r *
 					writeErrorResponse(ctx, w, exportError(ctx, err, cfgFile, bucket), r.URL)
 					return
 				}
-				if err = rawDataFn(bytes.NewReader(configData), cfgPath, len(configData)); err != nil {
+				rawDataFn(bytes.NewReader(configData), cfgPath, len(configData))
 					writeErrorResponse(ctx, w, exportError(ctx, err, cfgFile, bucket), r.URL)
 					return
 				}
 			case bucketReplicationConfig:
 				config, _, err := globalBucketMetadataSys.GetReplicationConfig(ctx, bucket)
 				if err != nil {
@@ -589,11 +548,7 @@ func (a adminAPIHandlers) ExportBucketMetadataHandler(w http.ResponseWriter, r *
 					writeErrorResponse(ctx, w, exportError(ctx, err, cfgFile, bucket), r.URL)
 					return
 				}
-
+				rawDataFn(bytes.NewReader(configData), cfgPath, len(configData))
 				if err = rawDataFn(bytes.NewReader(configData), cfgPath, len(configData)); err != nil {
 					writeErrorResponse(ctx, w, exportError(ctx, err, cfgFile, bucket), r.URL)
 					return
 				}
 			case bucketTargetsFile:
 				config, err := globalBucketMetadataSys.GetBucketTargetsConfig(bucket)
 				if err != nil {
@@ -609,10 +564,7 @@ func (a adminAPIHandlers) ExportBucketMetadataHandler(w http.ResponseWriter, r *
 					writeErrorResponse(ctx, w, exportError(ctx, err, cfgFile, bucket), r.URL)
 					return
 				}
-				if err = rawDataFn(bytes.NewReader(configData), cfgPath, len(configData)); err != nil {
+				rawDataFn(bytes.NewReader(configData), cfgPath, len(configData))
 					writeErrorResponse(ctx, w, exportError(ctx, err, cfgFile, bucket), r.URL)
 					return
 				}
 			}
 		}
 	}
@@ -657,16 +609,10 @@ func (i *importMetaReport) SetStatus(bucket, fname string, err error) {
 // 2. Replication config - is omitted from import as remote target credentials are not available from exported data for security reasons.
 // 3. lifecycle config - if transition rules are present, tier name needs to have been defined.
 func (a adminAPIHandlers) ImportBucketMetadataHandler(w http.ResponseWriter, r *http.Request) {
-	ctx := newContext(r, w, "ImportBucketMetadata")
+	ctx := r.Context()
 	defer logger.AuditLog(ctx, w, r, mustGetClaimsFromToken(r))
 	if globalIsGateway {
 		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrNotImplemented), r.URL)
 		return
 	}
 	// Get current object layer instance.
-	objectAPI, _ := validateAdminReq(ctx, w, r, iampolicy.ImportBucketMetadataAction)
+	objectAPI, _ := validateAdminReq(ctx, w, r, policy.ImportBucketMetadataAction)
 	if objectAPI == nil {
 		return
 	}
@@ -681,12 +627,31 @@ func (a adminAPIHandlers) ImportBucketMetadataHandler(w http.ResponseWriter, r *
 		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrInvalidRequest), r.URL)
 		return
 	}
 	bucketMap := make(map[string]struct{}, 1)
 	rpt := importMetaReport{
 		madmin.BucketMetaImportErrs{
 			Buckets: make(map[string]madmin.BucketStatus, len(zr.File)),
 		},
 	}
 	bucketMap := make(map[string]*BucketMetadata, len(zr.File))
 	updatedAt := UTCNow()
 	for _, file := range zr.File {
 		slc := strings.Split(file.Name, slashSeparator)
 		if len(slc) != 2 { // expecting bucket/configfile in the zipfile
 			rpt.SetStatus(file.Name, "", fmt.Errorf("malformed zip - expecting format bucket/<config.json>"))
 			continue
 		}
 		bucket := slc[0]
 		meta, err := readBucketMetadata(ctx, objectAPI, bucket)
 		if err == nil {
 			bucketMap[bucket] = &meta
 		} else if err != errConfigNotFound {
 			rpt.SetStatus(bucket, "", err)
 		}
 	}
 	// import object lock config if any - order of import matters here.
 	for _, file := range zr.File {
 		slc := strings.Split(file.Name, slashSeparator)
@@ -695,8 +660,7 @@ func (a adminAPIHandlers) ImportBucketMetadataHandler(w http.ResponseWriter, r *
 			continue
 		}
 		bucket, fileName := slc[0], slc[1]
-		switch fileName {
+		if fileName == objectLockConfig {
 		case objectLockConfig:
 			reader, err := file.Open()
 			if err != nil {
 				rpt.SetStatus(bucket, fileName, err)
@@ -715,45 +679,21 @@ func (a adminAPIHandlers) ImportBucketMetadataHandler(w http.ResponseWriter, r *
 			}
 			if _, ok := bucketMap[bucket]; !ok {
 				opts := MakeBucketOptions{
-					LockEnabled: config.ObjectLockEnabled == "Enabled",
+					LockEnabled: config.Enabled(),
 					ForceCreate: true, // ignore if it already exists
 				}
-				err = objectAPI.MakeBucketWithLocation(ctx, bucket, opts)
+				err = objectAPI.MakeBucket(ctx, bucket, opts)
 				if err != nil {
-					if _, ok := err.(BucketExists); !ok {
+					rpt.SetStatus(bucket, fileName, err)
-						rpt.SetStatus(bucket, fileName, err)
+					continue
 						continue
 					}
 				}
-				bucketMap[bucket] = struct{}{}
+				v := newBucketMetadata(bucket)
 				bucketMap[bucket] = &v
 			}
-			// Deny object locking configuration settings on existing buckets without object lock enabled.
+			bucketMap[bucket].ObjectLockConfigXML = configData
-			if _, _, err = globalBucketMetadataSys.GetObjectLockConfig(bucket); err != nil {
+			bucketMap[bucket].ObjectLockConfigUpdatedAt = updatedAt
 				rpt.SetStatus(bucket, fileName, err)
 				continue
 			}
 			updatedAt, err := globalBucketMetadataSys.Update(ctx, bucket, objectLockConfig, configData)
 			if err != nil {
 				rpt.SetStatus(bucket, fileName, err)
 				continue
 			}
 			rpt.SetStatus(bucket, fileName, nil)
 			// Call site replication hook.
 			//
 			// We encode the xml bytes as base64 to ensure there are no encoding
 			// errors.
 			cfgStr := base64.StdEncoding.EncodeToString(configData)
 			if err = globalSiteReplicationSys.BucketMetaHook(ctx, madmin.SRBucketMeta{
 				Type:             madmin.SRBucketMetaTypeObjectLockConfig,
 				Bucket:           bucket,
 				ObjectLockConfig: &cfgStr,
 				UpdatedAt:        updatedAt,
 			}); err != nil {
 				rpt.SetStatus(bucket, fileName, err)
 				continue
 			}
 		}
 	}
@@ -765,8 +705,7 @@ func (a adminAPIHandlers) ImportBucketMetadataHandler(w http.ResponseWriter, r *
 			continue
 		}
 		bucket, fileName := slc[0], slc[1]
-		switch fileName {
+		if fileName == bucketVersioningConfig {
 		case bucketVersioningConfig:
 			reader, err := file.Open()
 			if err != nil {
 				rpt.SetStatus(bucket, fileName, err)
@@ -778,13 +717,14 @@ func (a adminAPIHandlers) ImportBucketMetadataHandler(w http.ResponseWriter, r *
 				continue
 			}
 			if _, ok := bucketMap[bucket]; !ok {
-				if err = objectAPI.MakeBucketWithLocation(ctx, bucket, MakeBucketOptions{}); err != nil {
+				if err = objectAPI.MakeBucket(ctx, bucket, MakeBucketOptions{
-					if _, ok := err.(BucketExists); !ok {
+					ForceCreate: true, // ignore if it already exists
-						rpt.SetStatus(bucket, fileName, err)
+				}); err != nil {
-						continue
+					rpt.SetStatus(bucket, fileName, err)
-					}
+					continue
 				}
-				bucketMap[bucket] = struct{}{}
+				v := newBucketMetadata(bucket)
 				bucketMap[bucket] = &v
 			}
 			if globalSiteReplicationSys.isEnabled() && v.Suspended() {
@@ -807,10 +747,8 @@ func (a adminAPIHandlers) ImportBucketMetadataHandler(w http.ResponseWriter, r *
 				continue
 			}
-			if _, err = globalBucketMetadataSys.Update(ctx, bucket, bucketVersioningConfig, configData); err != nil {
+			bucketMap[bucket].VersioningConfigXML = configData
-				rpt.SetStatus(bucket, fileName, err)
+			bucketMap[bucket].VersioningConfigUpdatedAt = updatedAt
 				continue
 			}
 			rpt.SetStatus(bucket, fileName, nil)
 		}
 	}
@@ -828,16 +766,18 @@ func (a adminAPIHandlers) ImportBucketMetadataHandler(w http.ResponseWriter, r *
 			continue
 		}
 		bucket, fileName := slc[0], slc[1]
 		// create bucket if it does not exist yet.
 		if _, ok := bucketMap[bucket]; !ok {
-			err = objectAPI.MakeBucketWithLocation(ctx, bucket, MakeBucketOptions{})
+			err = objectAPI.MakeBucket(ctx, bucket, MakeBucketOptions{
 				ForceCreate: true, // ignore if it already exists
 			})
 			if err != nil {
-				if _, ok := err.(BucketExists); !ok {
+				rpt.SetStatus(bucket, "", err)
-					rpt.SetStatus(bucket, "", err)
+				continue
 					continue
 				}
 			}
-			bucketMap[bucket] = struct{}{}
+			v := newBucketMetadata(bucket)
 			bucketMap[bucket] = &v
 		}
 		if _, ok := bucketMap[bucket]; !ok {
 			continue
@@ -856,12 +796,7 @@ func (a adminAPIHandlers) ImportBucketMetadataHandler(w http.ResponseWriter, r *
 				continue
 			}
-			if _, err = globalBucketMetadataSys.Update(ctx, bucket, bucketNotificationConfig, configData); err != nil {
+			bucketMap[bucket].NotificationConfigXML = configData
 				rpt.SetStatus(bucket, fileName, err)
 				continue
 			}
 			rulesMap := config.ToRulesMap()
 			globalEventNotifier.AddRulesMap(bucket, rulesMap)
 			rpt.SetStatus(bucket, fileName, nil)
 		case bucketPolicyConfig:
 			// Error out if Content-Length is beyond allowed size.
@@ -876,7 +811,7 @@ func (a adminAPIHandlers) ImportBucketMetadataHandler(w http.ResponseWriter, r *
 				continue
 			}
-			bucketPolicy, err := policy.ParseConfig(bytes.NewReader(bucketPolicyBytes), bucket)
+			bucketPolicy, err := policy.ParseBucketPolicyConfig(bytes.NewReader(bucketPolicyBytes), bucket)
 			if err != nil {
 				rpt.SetStatus(bucket, fileName, err)
 				continue
@@ -884,7 +819,7 @@ func (a adminAPIHandlers) ImportBucketMetadataHandler(w http.ResponseWriter, r *
 			// Version in policy must not be empty
 			if bucketPolicy.Version == "" {
-				rpt.SetStatus(bucket, fileName, fmt.Errorf(ErrMalformedPolicy.String()))
+				rpt.SetStatus(bucket, fileName, fmt.Errorf(ErrPolicyInvalidVersion.String()))
 				continue
 			}
@@ -894,22 +829,9 @@ func (a adminAPIHandlers) ImportBucketMetadataHandler(w http.ResponseWriter, r *
 				continue
 			}
-			updatedAt, err := globalBucketMetadataSys.Update(ctx, bucket, bucketPolicyConfig, configData)
+			bucketMap[bucket].PolicyConfigJSON = configData
-			if err != nil {
+			bucketMap[bucket].PolicyConfigUpdatedAt = updatedAt
 				rpt.SetStatus(bucket, fileName, err)
 				continue
 			}
 			rpt.SetStatus(bucket, fileName, nil)
 			// Call site replication hook.
 			if err = globalSiteReplicationSys.BucketMetaHook(ctx, madmin.SRBucketMeta{
 				Type:      madmin.SRBucketMetaTypePolicy,
 				Bucket:    bucket,
 				Policy:    bucketPolicyBytes,
 				UpdatedAt: updatedAt,
 			}); err != nil {
 				rpt.SetStatus(bucket, fileName, err)
 				continue
 			}
 		case bucketLifecycleConfig:
 			bucketLifecycle, err := lifecycle.ParseLifecycleConfig(io.LimitReader(reader, sz))
 			if err != nil {
@@ -935,10 +857,8 @@ func (a adminAPIHandlers) ImportBucketMetadataHandler(w http.ResponseWriter, r *
 				continue
 			}
-			if _, err = globalBucketMetadataSys.Update(ctx, bucket, bucketLifecycleConfig, configData); err != nil {
+			bucketMap[bucket].LifecycleConfigXML = configData
-				rpt.SetStatus(bucket, fileName, err)
+			bucketMap[bucket].LifecycleConfigUpdatedAt = updatedAt
 				continue
 			}
 			rpt.SetStatus(bucket, fileName, nil)
 		case bucketSSEConfig:
 			// Parse bucket encryption xml
@@ -973,29 +893,9 @@ func (a adminAPIHandlers) ImportBucketMetadataHandler(w http.ResponseWriter, r *
 				continue
 			}
-			// Store the bucket encryption configuration in the object layer
+			bucketMap[bucket].EncryptionConfigXML = configData
-			updatedAt, err := globalBucketMetadataSys.Update(ctx, bucket, bucketSSEConfig, configData)
+			bucketMap[bucket].EncryptionConfigUpdatedAt = updatedAt
 			if err != nil {
 				rpt.SetStatus(bucket, fileName, err)
 				continue
 			}
 			rpt.SetStatus(bucket, fileName, nil)
 			// Call site replication hook.
 			//
 			// We encode the xml bytes as base64 to ensure there are no encoding
 			// errors.
 			cfgStr := base64.StdEncoding.EncodeToString(configData)
 			if err = globalSiteReplicationSys.BucketMetaHook(ctx, madmin.SRBucketMeta{
 				Type:      madmin.SRBucketMetaTypeSSEConfig,
 				Bucket:    bucket,
 				SSEConfig: &cfgStr,
 				UpdatedAt: updatedAt,
 			}); err != nil {
 				rpt.SetStatus(bucket, fileName, err)
 				continue
 			}
 		case bucketTaggingConfig:
 			tags, err := tags.ParseBucketXML(io.LimitReader(reader, sz))
 			if err != nil {
@@ -1009,27 +909,9 @@ func (a adminAPIHandlers) ImportBucketMetadataHandler(w http.ResponseWriter, r *
 				continue
 			}
-			updatedAt, err := globalBucketMetadataSys.Update(ctx, bucket, bucketTaggingConfig, configData)
+			bucketMap[bucket].TaggingConfigXML = configData
-			if err != nil {
+			bucketMap[bucket].TaggingConfigUpdatedAt = updatedAt
 				rpt.SetStatus(bucket, fileName, err)
 				continue
 			}
 			rpt.SetStatus(bucket, fileName, nil)
 			// Call site replication hook.
 			//
 			// We encode the xml bytes as base64 to ensure there are no encoding
 			// errors.
 			cfgStr := base64.StdEncoding.EncodeToString(configData)
 			if err = globalSiteReplicationSys.BucketMetaHook(ctx, madmin.SRBucketMeta{
 				Type:      madmin.SRBucketMetaTypeTags,
 				Bucket:    bucket,
 				Tags:      &cfgStr,
 				UpdatedAt: updatedAt,
 			}); err != nil {
 				rpt.SetStatus(bucket, fileName, err)
 				continue
 			}
 		case bucketQuotaConfigFile:
 			data, err := io.ReadAll(reader)
 			if err != nil {
@@ -1037,42 +919,49 @@ func (a adminAPIHandlers) ImportBucketMetadataHandler(w http.ResponseWriter, r *
 				continue
 			}
-			quotaConfig, err := parseBucketQuota(bucket, data)
+			_, err = parseBucketQuota(bucket, data)
 			if err != nil {
 				rpt.SetStatus(bucket, fileName, err)
 				continue
 			}
-			if quotaConfig.Type == "fifo" {
+			bucketMap[bucket].QuotaConfigJSON = data
-				rpt.SetStatus(bucket, fileName, fmt.Errorf("Detected older 'fifo' quota config, 'fifo' feature is removed and not supported anymore"))
+			bucketMap[bucket].QuotaConfigUpdatedAt = updatedAt
 				continue
 			}
 			updatedAt, err := globalBucketMetadataSys.Update(ctx, bucket, bucketQuotaConfigFile, data)
 			if err != nil {
 				rpt.SetStatus(bucket, fileName, err)
 				continue
 			}
 			rpt.SetStatus(bucket, fileName, nil)
 			bucketMeta := madmin.SRBucketMeta{
 				Type:      madmin.SRBucketMetaTypeQuotaConfig,
 				Bucket:    bucket,
 				Quota:     data,
 				UpdatedAt: updatedAt,
 			}
 			if quotaConfig.Quota == 0 {
 				bucketMeta.Quota = nil
 			}
 			// Call site replication hook.
 			if err = globalSiteReplicationSys.BucketMetaHook(ctx, bucketMeta); err != nil {
 				rpt.SetStatus(bucket, fileName, err)
 				continue
 			}
 		}
 	}
 	enc := func(b []byte) *string {
 		if b == nil {
 			return nil
 		}
 		v := base64.StdEncoding.EncodeToString(b)
 		return &v
 	}
 	for bucket, meta := range bucketMap {
 		err := globalBucketMetadataSys.save(ctx, *meta)
 		if err != nil {
 			rpt.SetStatus(bucket, "", err)
 			continue
 		}
 		// Call site replication hook.
 		if err = globalSiteReplicationSys.BucketMetaHook(ctx, madmin.SRBucketMeta{
 			Bucket:           bucket,
 			Quota:            meta.QuotaConfigJSON,
 			Policy:           meta.PolicyConfigJSON,
 			Versioning:       enc(meta.VersioningConfigXML),
 			Tags:             enc(meta.TaggingConfigXML),
 			ObjectLockConfig: enc(meta.ObjectLockConfigXML),
 			SSEConfig:        enc(meta.EncryptionConfigXML),
 			UpdatedAt:        updatedAt,
 		}); err != nil {
 			rpt.SetStatus(bucket, "", err)
 			continue
 		}
 	}
 	rptData, err := json.Marshal(rpt.BucketMetaImportErrs)
 	if err != nil {
 		writeErrorResponse(ctx, w, toAPIError(ctx, err), r.URL)
@@ -1085,18 +974,12 @@ func (a adminAPIHandlers) ImportBucketMetadataHandler(w http.ResponseWriter, r *
 // ReplicationDiffHandler - POST returns info on unreplicated versions for a remote target ARN
 // to the connected HTTP client.
 func (a adminAPIHandlers) ReplicationDiffHandler(w http.ResponseWriter, r *http.Request) {
-	ctx := newContext(r, w, "ReplicationDiff")
+	ctx := r.Context()
 	defer logger.AuditLog(ctx, w, r, mustGetClaimsFromToken(r))
 	vars := mux.Vars(r)
 	bucket := vars["bucket"]
-	if globalIsGateway {
+	objectAPI, _ := validateAdminReq(ctx, w, r, policy.ReplicationDiff)
 		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrNotImplemented), r.URL)
 		return
 	}
 	objectAPI, _ := validateAdminReq(ctx, w, r, iampolicy.ReplicationDiff)
 	if objectAPI == nil {
 		return
 	}
@@ -1150,3 +1033,62 @@ func (a adminAPIHandlers) ReplicationDiffHandler(w http.ResponseWriter, r *http.
 		}
 	}
 }
 // ReplicationMRFHandler - POST returns info on entries in the MRF backlog for a node or all nodes
 func (a adminAPIHandlers) ReplicationMRFHandler(w http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	vars := mux.Vars(r)
 	bucket := vars["bucket"]
 	objectAPI, _ := validateAdminReq(ctx, w, r, policy.ReplicationDiff)
 	if objectAPI == nil {
 		return
 	}
 	// Check if bucket exists.
 	if bucket != "" {
 		if _, err := objectAPI.GetBucketInfo(ctx, bucket, BucketOptions{}); err != nil {
 			writeErrorResponse(ctx, w, toAPIError(ctx, err), r.URL)
 			return
 		}
 	}
 	q := r.Form
 	node := q.Get("node")
 	keepAliveTicker := time.NewTicker(500 * time.Millisecond)
 	defer keepAliveTicker.Stop()
 	mrfCh, err := globalNotificationSys.GetReplicationMRF(ctx, bucket, node)
 	if err != nil {
 		writeErrorResponse(ctx, w, toAPIError(ctx, err), r.URL)
 		return
 	}
 	enc := json.NewEncoder(w)
 	for {
 		select {
 		case entry, ok := <-mrfCh:
 			if !ok {
 				return
 			}
 			if err := enc.Encode(entry); err != nil {
 				return
 			}
 			if len(mrfCh) == 0 {
 				// Flush if nothing is queued
 				w.(http.Flusher).Flush()
 			}
 		case <-keepAliveTicker.C:
 			if len(mrfCh) > 0 {
 				continue
 			}
 			if _, err := w.Write([]byte(" ")); err != nil {
 				return
 			}
 			w.(http.Flusher).Flush()
 		case <-ctx.Done():
 			return
 		}
 	}
 }
@@ -23,18 +23,18 @@ import (
 	"fmt"
 	"net/http"
-	"github.com/minio/kes"
+	"github.com/minio/kms-go/kes"
-	"github.com/minio/madmin-go"
+	"github.com/minio/madmin-go/v3"
 	"github.com/minio/minio/internal/auth"
 	"github.com/minio/minio/internal/config"
-	iampolicy "github.com/minio/pkg/iam/policy"
+	"github.com/minio/pkg/v2/policy"
 )
 // validateAdminReq will validate request against and return whether it is allowed.
 // If any of the supplied actions are allowed it will be successful.
 // If nil ObjectLayer is returned, the operation is not permitted.
 // When nil ObjectLayer has been returned an error has always been sent to w.
-func validateAdminReq(ctx context.Context, w http.ResponseWriter, r *http.Request, actions ...iampolicy.AdminAction) (ObjectLayer, auth.Credentials) {
+func validateAdminReq(ctx context.Context, w http.ResponseWriter, r *http.Request, actions ...policy.AdminAction) (ObjectLayer, auth.Credentials) {
 	// Get current object layer instance.
 	objectAPI := newObjectLayerFn()
 	if objectAPI == nil || globalNotificationSys == nil {
@@ -78,13 +78,19 @@ func toAdminAPIErr(ctx context.Context, err error) APIError {
 	var apiErr APIError
 	switch e := err.(type) {
-	case iampolicy.Error:
+	case policy.Error:
 		apiErr = APIError{
 			Code:           "XMinioMalformedIAMPolicy",
 			Description:    e.Error(),
 			HTTPStatusCode: http.StatusBadRequest,
 		}
-	case config.Error:
+	case config.ErrConfigNotFound:
 		apiErr = APIError{
 			Code:           "XMinioConfigNotFoundError",
 			Description:    e.Error(),
 			HTTPStatusCode: http.StatusNotFound,
 		}
 	case config.ErrConfigGeneric:
 		apiErr = APIError{
 			Code:           "XMinioConfigError",
 			Description:    e.Error(),
@@ -124,6 +130,18 @@ func toAdminAPIErr(ctx context.Context, err error) APIError {
 				Description:    err.Error(),
 				HTTPStatusCode: http.StatusBadRequest,
 			}
 		case errors.Is(err, errDecommissionRebalanceAlreadyRunning):
 			apiErr = APIError{
 				Code:           "XMinioDecommissionNotAllowed",
 				Description:    err.Error(),
 				HTTPStatusCode: http.StatusBadRequest,
 			}
 		case errors.Is(err, errRebalanceDecommissionAlreadyRunning):
 			apiErr = APIError{
 				Code:           "XMinioRebalanceNotAllowed",
 				Description:    err.Error(),
 				HTTPStatusCode: http.StatusBadRequest,
 			}
 		case errors.Is(err, errConfigNotFound):
 			apiErr = APIError{
 				Code:           "XMinioConfigError",
@@ -136,15 +154,9 @@ func toAdminAPIErr(ctx context.Context, err error) APIError {
 				Description:    err.Error(),
 				HTTPStatusCode: http.StatusForbidden,
 			}
-		case errors.Is(err, errIAMServiceAccount):
+		case errors.Is(err, errIAMServiceAccountNotAllowed):
 			apiErr = APIError{
-				Code:           "XMinioIAMServiceAccount",
+				Code:           "XMinioIAMServiceAccountNotAllowed",
 				Description:    err.Error(),
 				HTTPStatusCode: http.StatusBadRequest,
 			}
 		case errors.Is(err, errIAMServiceAccountUsed):
 			apiErr = APIError{
 				Code:           "XMinioIAMServiceAccountUsed",
 				Description:    err.Error(),
 				HTTPStatusCode: http.StatusBadRequest,
 			}
@@ -156,10 +168,16 @@ func toAdminAPIErr(ctx context.Context, err error) APIError {
 			}
 		case errors.Is(err, errPolicyInUse):
 			apiErr = APIError{
-				Code:           "XMinioAdminPolicyInUse",
+				Code:           "XMinioIAMPolicyInUse",
 				Description:    "The policy cannot be removed, as it is in use",
 				HTTPStatusCode: http.StatusBadRequest,
 			}
 		case errors.Is(err, errSessionPolicyTooLarge):
 			apiErr = APIError{
 				Code:           "XMinioIAMServiceAccountSessionPolicyTooLarge",
 				Description:    err.Error(),
 				HTTPStatusCode: http.StatusBadRequest,
 			}
 		case errors.Is(err, kes.ErrKeyExists):
 			apiErr = APIError{
 				Code:           "XMinioKMSKeyExists",
@@ -192,24 +210,6 @@ func toAdminAPIErr(ctx context.Context, err error) APIError {
 				Description:    err.Error(),
 				HTTPStatusCode: http.StatusBadRequest,
 			}
 		case errors.Is(err, errTierBackendInUse):
 			apiErr = APIError{
 				Code:           "XMinioAdminTierBackendInUse",
 				Description:    err.Error(),
 				HTTPStatusCode: http.StatusBadRequest,
 			}
 		case errors.Is(err, errTierBackendNotEmpty):
 			apiErr = APIError{
 				Code:           "XMinioAdminTierBackendNotEmpty",
 				Description:    err.Error(),
 				HTTPStatusCode: http.StatusBadRequest,
 			}
 		case errors.Is(err, errTierInsufficientCreds):
 			apiErr = APIError{
 				Code:           "XMinioAdminTierInsufficientCreds",
 				Description:    err.Error(),
 				HTTPStatusCode: http.StatusBadRequest,
 			}
 		case errIsTierPermError(err):
 			apiErr = APIError{
 				Code:           "XMinioAdminTierInsufficientPermissions",
@@ -226,12 +226,10 @@ func toAdminAPIErr(ctx context.Context, err error) APIError {
 // toAdminAPIErrCode - converts errErasureWriteQuorum error to admin API
 // specific error.
 func toAdminAPIErrCode(ctx context.Context, err error) APIErrorCode {
-	switch err {
+	if errors.Is(err, errErasureWriteQuorum) {
 	case errErasureWriteQuorum:
 		return ErrAdminConfigNoQuorum
 	default:
 		return toAPIErrorCode(ctx, err)
 	}
 	return toAPIErrorCode(ctx, err)
 }
 // wraps export error for more context
@@ -1,4 +1,4 @@
-// Copyright (c) 2015-2021 MinIO, Inc.
+// Copyright (c) 2015-2023 MinIO, Inc.
 //
 // This file is part of MinIO Object Storage stack
 //
@@ -26,27 +26,25 @@ import (
 	"strconv"
 	"strings"
-	"github.com/gorilla/mux"
+	"github.com/minio/madmin-go/v3"
 	"github.com/minio/madmin-go"
 	"github.com/minio/minio/internal/config"
 	"github.com/minio/minio/internal/config/cache"
 	"github.com/minio/minio/internal/config/etcd"
 	xldap "github.com/minio/minio/internal/config/identity/ldap"
 	"github.com/minio/minio/internal/config/identity/openid"
 	idplugin "github.com/minio/minio/internal/config/identity/plugin"
 	polplugin "github.com/minio/minio/internal/config/policy/plugin"
 	"github.com/minio/minio/internal/config/storageclass"
 	"github.com/minio/minio/internal/config/subnet"
 	"github.com/minio/minio/internal/logger"
-	iampolicy "github.com/minio/pkg/iam/policy"
+	"github.com/minio/mux"
 	"github.com/minio/pkg/v2/policy"
 )
 // DelConfigKVHandler - DELETE /minio/admin/v3/del-config-kv
 func (a adminAPIHandlers) DelConfigKVHandler(w http.ResponseWriter, r *http.Request) {
-	ctx := newContext(r, w, "DeleteConfigKV")
+	ctx := r.Context()
-	defer logger.AuditLog(ctx, w, r, mustGetClaimsFromToken(r))
+	objectAPI, cred := validateAdminReq(ctx, w, r, policy.ConfigUpdateAdminAction)
 	objectAPI, cred := validateAdminReq(ctx, w, r, iampolicy.ConfigUpdateAdminAction)
 	if objectAPI == nil {
 		return
 	}
@@ -60,7 +58,7 @@ func (a adminAPIHandlers) DelConfigKVHandler(w http.ResponseWriter, r *http.Requ
 	password := cred.SecretKey
 	kvBytes, err := madmin.DecryptData(password, io.LimitReader(r.Body, r.ContentLength))
 	if err != nil {
-		logger.LogIf(ctx, err, logger.Application)
+		logger.LogIf(ctx, err, logger.ErrorKind)
 		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAdminConfigBadJSON), r.URL)
 		return
 	}
@@ -71,7 +69,7 @@ func (a adminAPIHandlers) DelConfigKVHandler(w http.ResponseWriter, r *http.Requ
 		return
 	}
-	cfg, err := readServerConfig(ctx, objectAPI)
+	cfg, err := readServerConfig(ctx, objectAPI, nil)
 	if err != nil {
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 		return
@@ -82,11 +80,15 @@ func (a adminAPIHandlers) DelConfigKVHandler(w http.ResponseWriter, r *http.Requ
 		return
 	}
-	if err = validateConfig(cfg, subSys); err != nil {
+	if err = validateConfig(ctx, cfg, subSys); err != nil {
 		writeCustomErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAdminConfigBadJSON), err.Error(), r.URL)
 		return
 	}
 	// Check if subnet proxy being deleted and if so the value of proxy of subnet
 	// target of logger webhook configuration also should be deleted
 	loggerWebhookProxyDeleted := setLoggerWebhookSubnetProxy(subSys, cfg)
 	if err = saveServerConfig(ctx, objectAPI, cfg); err != nil {
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 		return
@@ -101,6 +103,10 @@ func (a adminAPIHandlers) DelConfigKVHandler(w http.ResponseWriter, r *http.Requ
 	dynamic := config.SubSystemsDynamic.Contains(subSys)
 	if dynamic {
 		applyDynamic(ctx, objectAPI, cfg, subSys, r, w)
 		if subSys == config.SubnetSubSys && loggerWebhookProxyDeleted {
 			// Logger webhook proxy deleted, apply the dynamic changes
 			applyDynamic(ctx, objectAPI, cfg, config.LoggerWebhookSubSys, r, w)
 		}
 	}
 }
@@ -117,13 +123,32 @@ func applyDynamic(ctx context.Context, objectAPI ObjectLayer, cfg config.Config,
 	w.Header().Set(madmin.ConfigAppliedHeader, madmin.ConfigAppliedTrue)
 }
 type badConfigErr struct {
 	Err error
 }
 // Error - return the error message
 func (bce badConfigErr) Error() string {
 	return bce.Err.Error()
 }
 // Unwrap the error to its underlying error.
 func (bce badConfigErr) Unwrap() error {
 	return bce.Err
 }
 type setConfigResult struct {
 	Cfg                     config.Config
 	SubSys                  string
 	Dynamic                 bool
 	LoggerWebhookCfgUpdated bool
 }
 // SetConfigKVHandler - PUT /minio/admin/v3/set-config-kv
 func (a adminAPIHandlers) SetConfigKVHandler(w http.ResponseWriter, r *http.Request) {
-	ctx := newContext(r, w, "SetConfigKV")
+	ctx := r.Context()
-	defer logger.AuditLog(ctx, w, r, mustGetClaimsFromToken(r))
+	objectAPI, cred := validateAdminReq(ctx, w, r, policy.ConfigUpdateAdminAction)
 	objectAPI, cred := validateAdminReq(ctx, w, r, iampolicy.ConfigUpdateAdminAction)
 	if objectAPI == nil {
 		return
 	}
@@ -137,65 +162,86 @@ func (a adminAPIHandlers) SetConfigKVHandler(w http.ResponseWriter, r *http.Requ
 	password := cred.SecretKey
 	kvBytes, err := madmin.DecryptData(password, io.LimitReader(r.Body, r.ContentLength))
 	if err != nil {
-		logger.LogIf(ctx, err, logger.Application)
+		logger.LogIf(ctx, err, logger.ErrorKind)
 		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAdminConfigBadJSON), r.URL)
 		return
 	}
-	cfg, err := readServerConfig(ctx, objectAPI)
+	result, err := setConfigKV(ctx, objectAPI, kvBytes)
 	if err != nil {
-		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
+		switch err.(type) {
 		case badConfigErr:
 			writeCustomErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAdminConfigBadJSON), err.Error(), r.URL)
 		default:
 			writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 		}
 		return
 	}
-	dynamic, err := cfg.ReadConfig(bytes.NewReader(kvBytes))
+	if result.Dynamic {
-	if err != nil {
+		applyDynamic(ctx, objectAPI, result.Cfg, result.SubSys, r, w)
-		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
+		// If logger webhook config updated (proxy due to callhome), explicitly dynamically
-		return
+		// apply the config
-	}
+		if result.LoggerWebhookCfgUpdated {
-
+			applyDynamic(ctx, objectAPI, result.Cfg, config.LoggerWebhookSubSys, r, w)
-	subSys, _, _, err := config.GetSubSys(string(kvBytes))
+		}
 	if err != nil {
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 		return
 	}
 	if err = validateConfig(cfg, subSys); err != nil {
 		writeCustomErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAdminConfigBadJSON), err.Error(), r.URL)
 		return
 	}
 	// Update the actual server config on disk.
 	if err = saveServerConfig(ctx, objectAPI, cfg); err != nil {
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 		return
 	}
 	// Write to the config input KV to history.
 	if err = saveServerConfigHistory(ctx, objectAPI, kvBytes); err != nil {
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 		return
 	}
 	if dynamic {
 		applyDynamic(ctx, objectAPI, cfg, subSys, r, w)
 	}
 	writeSuccessResponseHeadersOnly(w)
 }
 func setConfigKV(ctx context.Context, objectAPI ObjectLayer, kvBytes []byte) (result setConfigResult, err error) {
 	result.Cfg, err = readServerConfig(ctx, objectAPI, nil)
 	if err != nil {
 		return
 	}
 	result.Dynamic, err = result.Cfg.ReadConfig(bytes.NewReader(kvBytes))
 	if err != nil {
 		return
 	}
 	result.SubSys, _, _, err = config.GetSubSys(string(kvBytes))
 	if err != nil {
 		return
 	}
 	tgts, err := config.ParseConfigTargetID(bytes.NewReader(kvBytes))
 	if err != nil {
 		return
 	}
 	ctx = context.WithValue(ctx, config.ContextKeyForTargetFromConfig, tgts)
 	if verr := validateConfig(ctx, result.Cfg, result.SubSys); verr != nil {
 		err = badConfigErr{Err: verr}
 		return
 	}
 	// Check if subnet proxy being set and if so set the same value to proxy of subnet
 	// target of logger webhook configuration
 	result.LoggerWebhookCfgUpdated = setLoggerWebhookSubnetProxy(result.SubSys, result.Cfg)
 	// Update the actual server config on disk.
 	if err = saveServerConfig(ctx, objectAPI, result.Cfg); err != nil {
 		return
 	}
 	// Write the config input KV to history.
 	err = saveServerConfigHistory(ctx, objectAPI, kvBytes)
 	return
 }
 // GetConfigKVHandler - GET /minio/admin/v3/get-config-kv?key={key}
 //
 // `key` can be one of three forms:
 // 1. `subsys:target` -> request for config of a single subsystem and target pair.
 // 2. `subsys:` -> request for config of a single subsystem and the default target.
 // 3. `subsys` -> request for config of all targets for the given subsystem.
 //
 // This is a reporting API and config secrets are redacted in the response.
 func (a adminAPIHandlers) GetConfigKVHandler(w http.ResponseWriter, r *http.Request) {
-	ctx := newContext(r, w, "GetConfigKV")
+	ctx := r.Context()
-	defer logger.AuditLog(ctx, w, r, mustGetClaimsFromToken(r))
+	objectAPI, cred := validateAdminReq(ctx, w, r, policy.ConfigUpdateAdminAction)
 	objectAPI, cred := validateAdminReq(ctx, w, r, iampolicy.ConfigUpdateAdminAction)
 	if objectAPI == nil {
 		return
 	}
@@ -217,7 +263,7 @@ func (a adminAPIHandlers) GetConfigKVHandler(w http.ResponseWriter, r *http.Requ
 		}
 	}
-	subSysConfigs, err := cfg.GetSubsysInfo(subSys, target)
+	subSysConfigs, err := cfg.GetSubsysInfo(subSys, target, true)
 	if err != nil {
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 		return
@@ -225,7 +271,7 @@ func (a adminAPIHandlers) GetConfigKVHandler(w http.ResponseWriter, r *http.Requ
 	var s strings.Builder
 	for _, subSysConfig := range subSysConfigs {
-		subSysConfig.AddString(&s, false)
+		subSysConfig.WriteTo(&s, false)
 	}
 	password := cred.SecretKey
@@ -239,11 +285,9 @@ func (a adminAPIHandlers) GetConfigKVHandler(w http.ResponseWriter, r *http.Requ
 }
 func (a adminAPIHandlers) ClearConfigHistoryKVHandler(w http.ResponseWriter, r *http.Request) {
-	ctx := newContext(r, w, "ClearConfigHistoryKV")
+	ctx := r.Context()
-	defer logger.AuditLog(ctx, w, r, mustGetClaimsFromToken(r))
+	objectAPI, _ := validateAdminReq(ctx, w, r, policy.ConfigUpdateAdminAction)
 	objectAPI, _ := validateAdminReq(ctx, w, r, iampolicy.ConfigUpdateAdminAction)
 	if objectAPI == nil {
 		return
 	}
@@ -274,11 +318,9 @@ func (a adminAPIHandlers) ClearConfigHistoryKVHandler(w http.ResponseWriter, r *
 // RestoreConfigHistoryKVHandler - restores a config with KV settings for the given KV id.
 func (a adminAPIHandlers) RestoreConfigHistoryKVHandler(w http.ResponseWriter, r *http.Request) {
-	ctx := newContext(r, w, "RestoreConfigHistoryKV")
+	ctx := r.Context()
-	defer logger.AuditLog(ctx, w, r, mustGetClaimsFromToken(r))
+	objectAPI, _ := validateAdminReq(ctx, w, r, policy.ConfigUpdateAdminAction)
 	objectAPI, _ := validateAdminReq(ctx, w, r, iampolicy.ConfigUpdateAdminAction)
 	if objectAPI == nil {
 		return
 	}
@@ -296,7 +338,7 @@ func (a adminAPIHandlers) RestoreConfigHistoryKVHandler(w http.ResponseWriter, r
 		return
 	}
-	cfg, err := readServerConfig(ctx, objectAPI)
+	cfg, err := readServerConfig(ctx, objectAPI, nil)
 	if err != nil {
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 		return
@@ -307,7 +349,7 @@ func (a adminAPIHandlers) RestoreConfigHistoryKVHandler(w http.ResponseWriter, r
 		return
 	}
-	if err = validateConfig(cfg, ""); err != nil {
+	if err = validateConfig(ctx, cfg, ""); err != nil {
 		writeCustomErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAdminConfigBadJSON), err.Error(), r.URL)
 		return
 	}
@@ -322,11 +364,9 @@ func (a adminAPIHandlers) RestoreConfigHistoryKVHandler(w http.ResponseWriter, r
 // ListConfigHistoryKVHandler - lists all the KV ids.
 func (a adminAPIHandlers) ListConfigHistoryKVHandler(w http.ResponseWriter, r *http.Request) {
-	ctx := newContext(r, w, "ListConfigHistoryKV")
+	ctx := r.Context()
-	defer logger.AuditLog(ctx, w, r, mustGetClaimsFromToken(r))
+	objectAPI, cred := validateAdminReq(ctx, w, r, policy.ConfigUpdateAdminAction)
 	objectAPI, cred := validateAdminReq(ctx, w, r, iampolicy.ConfigUpdateAdminAction)
 	if objectAPI == nil {
 		return
 	}
@@ -362,11 +402,9 @@ func (a adminAPIHandlers) ListConfigHistoryKVHandler(w http.ResponseWriter, r *h
 // HelpConfigKVHandler - GET /minio/admin/v3/help-config-kv?subSys={subSys}&key={key}
 func (a adminAPIHandlers) HelpConfigKVHandler(w http.ResponseWriter, r *http.Request) {
-	ctx := newContext(r, w, "HelpConfigKV")
+	ctx := r.Context()
-	defer logger.AuditLog(ctx, w, r, mustGetClaimsFromToken(r))
+	objectAPI, _ := validateAdminReq(ctx, w, r, policy.ConfigUpdateAdminAction)
 	objectAPI, _ := validateAdminReq(ctx, w, r, iampolicy.ConfigUpdateAdminAction)
 	if objectAPI == nil {
 		return
 	}
@@ -389,11 +427,9 @@ func (a adminAPIHandlers) HelpConfigKVHandler(w http.ResponseWriter, r *http.Req
 // SetConfigHandler - PUT /minio/admin/v3/config
 func (a adminAPIHandlers) SetConfigHandler(w http.ResponseWriter, r *http.Request) {
-	ctx := newContext(r, w, "SetConfig")
+	ctx := r.Context()
-	defer logger.AuditLog(ctx, w, r, mustGetClaimsFromToken(r))
+	objectAPI, cred := validateAdminReq(ctx, w, r, policy.ConfigUpdateAdminAction)
 	objectAPI, cred := validateAdminReq(ctx, w, r, iampolicy.ConfigUpdateAdminAction)
 	if objectAPI == nil {
 		return
 	}
@@ -407,7 +443,7 @@ func (a adminAPIHandlers) SetConfigHandler(w http.ResponseWriter, r *http.Reques
 	password := cred.SecretKey
 	kvBytes, err := madmin.DecryptData(password, io.LimitReader(r.Body, r.ContentLength))
 	if err != nil {
-		logger.LogIf(ctx, err, logger.Application)
+		logger.LogIf(ctx, err, logger.ErrorKind)
 		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAdminConfigBadJSON), r.URL)
 		return
 	}
@@ -418,7 +454,7 @@ func (a adminAPIHandlers) SetConfigHandler(w http.ResponseWriter, r *http.Reques
 		return
 	}
-	if err = validateConfig(cfg, ""); err != nil {
+	if err = validateConfig(ctx, cfg, ""); err != nil {
 		writeCustomErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAdminConfigBadJSON), err.Error(), r.URL)
 		return
 	}
@@ -439,13 +475,13 @@ func (a adminAPIHandlers) SetConfigHandler(w http.ResponseWriter, r *http.Reques
 }
 // GetConfigHandler - GET /minio/admin/v3/config
-// Get config.json of this minio setup.
+//
 // This endpoint is mainly for exporting and backing up the configuration.
 // Secrets are not redacted.
 func (a adminAPIHandlers) GetConfigHandler(w http.ResponseWriter, r *http.Request) {
-	ctx := newContext(r, w, "GetConfig")
+	ctx := r.Context()
-	defer logger.AuditLog(ctx, w, r, mustGetClaimsFromToken(r))
+	objectAPI, cred := validateAdminReq(ctx, w, r, policy.ConfigUpdateAdminAction)
 	objectAPI, cred := validateAdminReq(ctx, w, r, iampolicy.ConfigUpdateAdminAction)
 	if objectAPI == nil {
 		return
 	}
@@ -454,21 +490,15 @@ func (a adminAPIHandlers) GetConfigHandler(w http.ResponseWriter, r *http.Reques
 	var s strings.Builder
 	hkvs := config.HelpSubSysMap[""]
 	var count int
 	for _, hkv := range hkvs {
 		count += len(cfg[hkv.Key])
 	}
 	for _, hkv := range hkvs {
 		// We ignore the error below, as we cannot get one.
-		cfgSubsysItems, _ := cfg.GetSubsysInfo(hkv.Key, "")
+		cfgSubsysItems, _ := cfg.GetSubsysInfo(hkv.Key, "", false)
 		for _, item := range cfgSubsysItems {
 			off := item.Config.Get(config.Enable) == config.EnableOff
 			switch hkv.Key {
 			case config.EtcdSubSys:
 				off = !etcd.Enabled(item.Config)
 			case config.CacheSubSys:
 				off = !cache.Enabled(item.Config)
 			case config.StorageClassSubSys:
 				off = !storageclass.Enabled(item.Config)
 			case config.PolicyPluginSubSys:
@@ -478,11 +508,11 @@ func (a adminAPIHandlers) GetConfigHandler(w http.ResponseWriter, r *http.Reques
 			case config.IdentityLDAPSubSys:
 				off = !xldap.Enabled(item.Config)
 			case config.IdentityTLSSubSys:
-				off = !globalSTSTLSConfig.Enabled
+				off = !globalIAMSys.STSTLSConfig.Enabled
 			case config.IdentityPluginSubSys:
 				off = !idplugin.Enabled(item.Config)
 			}
-			item.AddString(&s, off)
+			item.WriteTo(&s, off)
 		}
 	}
@@ -495,3 +525,18 @@ func (a adminAPIHandlers) GetConfigHandler(w http.ResponseWriter, r *http.Reques
 	writeSuccessResponseJSON(w, econfigData)
 }
 // setLoggerWebhookSubnetProxy - Sets the logger webhook's subnet proxy value to
 // one being set for subnet proxy
 func setLoggerWebhookSubnetProxy(subSys string, cfg config.Config) bool {
 	if subSys == config.SubnetSubSys || subSys == config.LoggerWebhookSubSys {
 		subnetWebhookCfg := cfg[config.LoggerWebhookSubSys][subnet.LoggerWebhookName]
 		loggerWebhookSubnetProxy := subnetWebhookCfg.Get(logger.Proxy)
 		subnetProxy := cfg[config.SubnetSubSys][config.Default].Get(logger.Proxy)
 		if loggerWebhookSubnetProxy != subnetProxy {
 			subnetWebhookCfg.Set(logger.Proxy, subnetProxy)
 			return true
 		}
 	}
 	return false
 }
@@ -26,24 +26,19 @@ import (
 	"net/http"
 	"strings"
-	"github.com/gorilla/mux"
+	"github.com/minio/madmin-go/v3"
-	"github.com/minio/madmin-go"
+	"github.com/minio/minio-go/v7/pkg/set"
 	"github.com/minio/minio/internal/config"
 	cfgldap "github.com/minio/minio/internal/config/identity/ldap"
 	"github.com/minio/minio/internal/config/identity/openid"
 	"github.com/minio/minio/internal/logger"
-	iampolicy "github.com/minio/pkg/iam/policy"
+	"github.com/minio/mux"
-	"github.com/minio/pkg/ldap"
+	"github.com/minio/pkg/v2/ldap"
 	"github.com/minio/pkg/v2/policy"
 )
-// SetIdentityProviderCfg:
+func addOrUpdateIDPHandler(ctx context.Context, w http.ResponseWriter, r *http.Request, isUpdate bool) {
-//
+	objectAPI, cred := validateAdminReq(ctx, w, r, policy.ConfigUpdateAdminAction)
 // PUT <admin-prefix>/id-cfg?type=openid&name=dex1
 func (a adminAPIHandlers) SetIdentityProviderCfg(w http.ResponseWriter, r *http.Request) {
 	ctx := newContext(r, w, "SetIdentityCfg")
 	defer logger.AuditLog(ctx, w, r, mustGetClaimsFromToken(r))
 	objectAPI, cred := validateAdminReq(ctx, w, r, iampolicy.ConfigUpdateAdminAction)
 	if objectAPI == nil {
 		return
 	}
@@ -54,10 +49,18 @@ func (a adminAPIHandlers) SetIdentityProviderCfg(w http.ResponseWriter, r *http.
 		return
 	}
 	// Ensure body content type is opaque to ensure that request body has not
 	// been interpreted as form data.
 	contentType := r.Header.Get("Content-Type")
 	if contentType != "application/octet-stream" {
 		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrBadRequest), r.URL)
 		return
 	}
 	password := cred.SecretKey
 	reqBytes, err := madmin.DecryptData(password, io.LimitReader(r.Body, r.ContentLength))
 	if err != nil {
-		logger.LogIf(ctx, err, logger.Application)
+		logger.LogIf(ctx, err, logger.ErrorKind)
 		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAdminConfigBadJSON), r.URL)
 		return
 	}
@@ -68,44 +71,43 @@ func (a adminAPIHandlers) SetIdentityProviderCfg(w http.ResponseWriter, r *http.
 		return
 	}
-	var cfgDataBuilder strings.Builder
+	var subSys string
 	switch idpCfgType {
 	case madmin.OpenidIDPCfg:
-		fmt.Fprintf(&cfgDataBuilder, "identity_openid")
+		subSys = madmin.IdentityOpenIDSubSys
 	case madmin.LDAPIDPCfg:
-		fmt.Fprintf(&cfgDataBuilder, "identity_ldap")
+		subSys = madmin.IdentityLDAPSubSys
 	}
 	// Ensure body content type is opaque.
 	contentType := r.Header.Get("Content-Type")
 	if contentType != "application/octet-stream" {
 		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrBadRequest), r.URL)
 		return
 	}
 	// Subsystem configuration name could be empty.
 	cfgName := mux.Vars(r)["name"]
 	cfgTarget := madmin.Default
 	if cfgName != "" {
-		if idpCfgType == madmin.LDAPIDPCfg {
+		cfgTarget = cfgName
-			// LDAP does not support multiple configurations. So this must be
+		if idpCfgType == madmin.LDAPIDPCfg && cfgName != madmin.Default {
-			// empty.
+			// LDAP does not support multiple configurations. So cfgName must be
-			writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrBadRequest), r.URL)
+			// empty or `madmin.Default`.
 			writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAdminConfigLDAPNonDefaultConfigName), r.URL)
 			return
 		}
 		fmt.Fprintf(&cfgDataBuilder, "%s%s", config.SubSystemSeparator, cfgName)
 	}
-	fmt.Fprintf(&cfgDataBuilder, "%s%s", config.KvSpaceSeparator, string(reqBytes))
+	// Check that this is a valid Create vs Update API call.
-
+	s := globalServerConfig.Clone()
-	cfgData := cfgDataBuilder.String()
+	if apiErrCode := handleCreateUpdateValidation(s, subSys, cfgTarget, isUpdate); apiErrCode != ErrNone {
-	subSys, _, _, err := config.GetSubSys(cfgData)
+		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(apiErrCode), r.URL)
 	if err != nil {
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 		return
 	}
-	cfg, err := readServerConfig(ctx, objectAPI)
+	cfgData := ""
 	{
 		tgtSuffix := ""
 		if cfgTarget != madmin.Default {
 			tgtSuffix = config.SubSystemSeparator + cfgTarget
 		}
 		cfgData = subSys + tgtSuffix + config.KvSpaceSeparator + string(reqBytes)
 	}
 	cfg, err := readServerConfig(ctx, objectAPI, nil)
 	if err != nil {
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 		return
@@ -119,11 +121,11 @@ func (a adminAPIHandlers) SetIdentityProviderCfg(w http.ResponseWriter, r *http.
 	// IDP config is not dynamic. Sanity check.
 	if dynamic {
-		writeCustomErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrInternalError), err.Error(), r.URL)
+		writeCustomErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrInternalError), "", r.URL)
 		return
 	}
-	if err = validateConfig(cfg, subSys); err != nil {
+	if err = validateConfig(ctx, cfg, subSys); err != nil {
 		var validationErr ldap.Validation
 		if errors.As(err, &validationErr) {
@@ -153,36 +155,135 @@ func (a adminAPIHandlers) SetIdentityProviderCfg(w http.ResponseWriter, r *http.
 	writeSuccessResponseHeadersOnly(w)
 }
-// GetIdentityProviderCfg:
+func handleCreateUpdateValidation(s config.Config, subSys, cfgTarget string, isUpdate bool) APIErrorCode {
-//
+	if cfgTarget != madmin.Default {
-// GET <admin-prefix>/id-cfg?type=openid&name=dex_test
+		// This cannot give an error at this point.
-//
+		subSysTargets, _ := s.GetAvailableTargets(subSys)
-// GetIdentityProviderCfg returns a list of configured IDPs on the server if
+		subSysTargetsSet := set.CreateStringSet(subSysTargets...)
-// name is empty. If name is non-empty, returns the configuration details for
+		if isUpdate && !subSysTargetsSet.Contains(cfgTarget) {
-// the IDP of the given type and configuration name. The configuration name for
+			return ErrAdminConfigIDPCfgNameDoesNotExist
-// the default ("un-named") configuration target is `_`.
+		}
-func (a adminAPIHandlers) GetIdentityProviderCfg(w http.ResponseWriter, r *http.Request) {
+		if !isUpdate && subSysTargetsSet.Contains(cfgTarget) {
-	ctx := newContext(r, w, "GetIdentityProviderCfg")
+			return ErrAdminConfigIDPCfgNameAlreadyExists
 		}
-	defer logger.AuditLog(ctx, w, r, mustGetClaimsFromToken(r))
+		return ErrNone
 	}
-	objectAPI, cred := validateAdminReq(ctx, w, r, iampolicy.ConfigUpdateAdminAction)
+	// For the default configuration name, since it will always be an available
 	// target, we need to check if a configuration value has been set previously
 	// to figure out if this is a valid create or update API call.
 	// This cannot really error (FIXME: improve the type for GetConfigInfo)
 	var cfgInfos []madmin.IDPCfgInfo
 	switch subSys {
 	case madmin.IdentityOpenIDSubSys:
 		cfgInfos, _ = globalIAMSys.OpenIDConfig.GetConfigInfo(s, cfgTarget)
 	case madmin.IdentityLDAPSubSys:
 		cfgInfos, _ = globalIAMSys.LDAPConfig.GetConfigInfo(s, cfgTarget)
 	}
 	if len(cfgInfos) > 0 && !isUpdate {
 		return ErrAdminConfigIDPCfgNameAlreadyExists
 	}
 	if len(cfgInfos) == 0 && isUpdate {
 		return ErrAdminConfigIDPCfgNameDoesNotExist
 	}
 	return ErrNone
 }
 // AddIdentityProviderCfg: adds a new IDP config for openid/ldap.
 //
 // PUT <admin-prefix>/idp-cfg/openid/dex1 -> create named config `dex1`
 //
 // PUT <admin-prefix>/idp-cfg/openid/_ -> create (default) named config `_`
 func (a adminAPIHandlers) AddIdentityProviderCfg(w http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	addOrUpdateIDPHandler(ctx, w, r, false)
 }
 // UpdateIdentityProviderCfg: updates an existing IDP config for openid/ldap.
 //
 // POST <admin-prefix>/idp-cfg/openid/dex1 -> update named config `dex1`
 //
 // POST <admin-prefix>/idp-cfg/openid/_ -> update (default) named config `_`
 func (a adminAPIHandlers) UpdateIdentityProviderCfg(w http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	addOrUpdateIDPHandler(ctx, w, r, true)
 }
 // ListIdentityProviderCfg:
 //
 // GET <admin-prefix>/idp-cfg/openid -> lists openid provider configs.
 func (a adminAPIHandlers) ListIdentityProviderCfg(w http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	objectAPI, cred := validateAdminReq(ctx, w, r, policy.ConfigUpdateAdminAction)
 	if objectAPI == nil {
 		return
 	}
 	idpCfgType := mux.Vars(r)["type"]
 	cfgName := r.Form.Get("name")
 	password := cred.SecretKey
 	idpCfgType := mux.Vars(r)["type"]
 	if !madmin.ValidIDPConfigTypes.Contains(idpCfgType) {
 		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAdminConfigInvalidIDPType), r.URL)
 		return
 	}
-	// If no cfgName is provided, we list.
+	var cfgList []madmin.IDPListItem
-	if cfgName == "" {
+	var err error
-		a.listIdentityProviders(ctx, w, r, idpCfgType, password)
+	switch idpCfgType {
 	case madmin.OpenidIDPCfg:
 		cfg := globalServerConfig.Clone()
 		cfgList, err = globalIAMSys.OpenIDConfig.GetConfigList(cfg)
 	case madmin.LDAPIDPCfg:
 		cfg := globalServerConfig.Clone()
 		cfgList, err = globalIAMSys.LDAPConfig.GetConfigList(cfg)
 	default:
 		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrNotImplemented), r.URL)
 		return
 	}
 	if err != nil {
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 		return
 	}
 	data, err := json.Marshal(cfgList)
 	if err != nil {
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 		return
 	}
 	econfigData, err := madmin.EncryptData(password, data)
 	if err != nil {
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 		return
 	}
 	writeSuccessResponseJSON(w, econfigData)
 }
 // GetIdentityProviderCfg:
 //
 // GET <admin-prefix>/idp-cfg/openid/dex_test
 func (a adminAPIHandlers) GetIdentityProviderCfg(w http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	objectAPI, cred := validateAdminReq(ctx, w, r, policy.ConfigUpdateAdminAction)
 	if objectAPI == nil {
 		return
 	}
 	idpCfgType := mux.Vars(r)["type"]
 	cfgName := mux.Vars(r)["name"]
 	password := cred.SecretKey
 	if !madmin.ValidIDPConfigTypes.Contains(idpCfgType) {
 		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAdminConfigInvalidIDPType), r.URL)
 		return
 	}
@@ -191,12 +292,12 @@ func (a adminAPIHandlers) GetIdentityProviderCfg(w http.ResponseWriter, r *http.
 	var err error
 	switch idpCfgType {
 	case madmin.OpenidIDPCfg:
-		cfgInfos, err = globalOpenIDConfig.GetConfigInfo(cfg, cfgName)
+		cfgInfos, err = globalIAMSys.OpenIDConfig.GetConfigInfo(cfg, cfgName)
 	case madmin.LDAPIDPCfg:
-		cfgInfos, err = globalLDAPConfig.GetConfigInfo(cfg, cfgName)
+		cfgInfos, err = globalIAMSys.LDAPConfig.GetConfigInfo(cfg, cfgName)
 	}
 	if err != nil {
-		if errors.Is(err, openid.ErrProviderConfigNotFound) {
+		if errors.Is(err, openid.ErrProviderConfigNotFound) || errors.Is(err, cfgldap.ErrProviderConfigNotFound) {
 			writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAdminNoSuchConfigTarget), r.URL)
 			return
 		}
@@ -225,51 +326,13 @@ func (a adminAPIHandlers) GetIdentityProviderCfg(w http.ResponseWriter, r *http.
 	writeSuccessResponseJSON(w, econfigData)
 }
 func (a adminAPIHandlers) listIdentityProviders(ctx context.Context, w http.ResponseWriter, r *http.Request, idpCfgType, password string) {
 	var cfgList []madmin.IDPListItem
 	var err error
 	switch idpCfgType {
 	case madmin.OpenidIDPCfg:
 		cfg := globalServerConfig.Clone()
 		cfgList, err = globalOpenIDConfig.GetConfigList(cfg)
 	case madmin.LDAPIDPCfg:
 		cfg := globalServerConfig.Clone()
 		cfgList, err = globalLDAPConfig.GetConfigList(cfg)
 	default:
 		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrNotImplemented), r.URL)
 		return
 	}
 	if err != nil {
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 		return
 	}
 	data, err := json.Marshal(cfgList)
 	if err != nil {
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 		return
 	}
 	econfigData, err := madmin.EncryptData(password, data)
 	if err != nil {
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 		return
 	}
 	writeSuccessResponseJSON(w, econfigData)
 }
 // DeleteIdentityProviderCfg:
 //
-// DELETE <admin-prefix>/id-cfg?type=openid&name=dex_test
+// DELETE <admin-prefix>/idp-cfg/openid/dex_test
 func (a adminAPIHandlers) DeleteIdentityProviderCfg(w http.ResponseWriter, r *http.Request) {
-	ctx := newContext(r, w, "DeleteIdentityProviderCfg")
+	ctx := r.Context()
-	defer logger.AuditLog(ctx, w, r, mustGetClaimsFromToken(r))
+	objectAPI, _ := validateAdminReq(ctx, w, r, policy.ConfigUpdateAdminAction)
 	objectAPI, _ := validateAdminReq(ctx, w, r, iampolicy.ConfigUpdateAdminAction)
 	if objectAPI == nil {
 		return
 	}
@@ -286,7 +349,7 @@ func (a adminAPIHandlers) DeleteIdentityProviderCfg(w http.ResponseWriter, r *ht
 	switch idpCfgType {
 	case madmin.OpenidIDPCfg:
 		subSys = config.IdentityOpenIDSubSys
-		cfgInfos, err := globalOpenIDConfig.GetConfigInfo(cfgCopy, cfgName)
+		cfgInfos, err := globalIAMSys.OpenIDConfig.GetConfigInfo(cfgCopy, cfgName)
 		if err != nil {
 			if errors.Is(err, openid.ErrProviderConfigNotFound) {
 				writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAdminNoSuchConfigTarget), r.URL)
@@ -311,7 +374,7 @@ func (a adminAPIHandlers) DeleteIdentityProviderCfg(w http.ResponseWriter, r *ht
 		}
 	case madmin.LDAPIDPCfg:
 		subSys = config.IdentityLDAPSubSys
-		cfgInfos, err := globalLDAPConfig.GetConfigInfo(cfgCopy, cfgName)
+		cfgInfos, err := globalIAMSys.LDAPConfig.GetConfigInfo(cfgCopy, cfgName)
 		if err != nil {
 			if errors.Is(err, openid.ErrProviderConfigNotFound) {
 				writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAdminNoSuchConfigTarget), r.URL)
@@ -339,7 +402,7 @@ func (a adminAPIHandlers) DeleteIdentityProviderCfg(w http.ResponseWriter, r *ht
 		return
 	}
-	cfg, err := readServerConfig(ctx, objectAPI)
+	cfg, err := readServerConfig(ctx, objectAPI, nil)
 	if err != nil {
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 		return
@@ -353,7 +416,17 @@ func (a adminAPIHandlers) DeleteIdentityProviderCfg(w http.ResponseWriter, r *ht
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 		return
 	}
-	if err = validateConfig(cfg, subSys); err != nil {
+	if err = validateConfig(ctx, cfg, subSys); err != nil {
 		var validationErr ldap.Validation
 		if errors.As(err, &validationErr) {
 			// If we got an LDAP validation error, we need to send appropriate
 			// error message back to client (likely mc).
 			writeCustomErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAdminConfigLDAPValidation),
 				validationErr.FormatError(), r.URL)
 			return
 		}
 		writeCustomErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAdminConfigBadJSON), err.Error(), r.URL)
 		return
 	}
@@ -0,0 +1,445 @@
 // Copyright (c) 2015-2022 MinIO, Inc.
 //
 // This file is part of MinIO Object Storage stack
 //
 // This program is free software: you can redistribute it and/or modify
 // it under the terms of the GNU Affero General Public License as published by
 // the Free Software Foundation, either version 3 of the License, or
 // (at your option) any later version.
 //
 // This program is distributed in the hope that it will be useful
 // but WITHOUT ANY WARRANTY; without even the implied warranty of
 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 // GNU Affero General Public License for more details.
 //
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 package cmd
 import (
 	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
 	"net/http"
 	"strings"
 	"github.com/minio/madmin-go/v3"
 	"github.com/minio/minio/internal/auth"
 	"github.com/minio/minio/internal/logger"
 	"github.com/minio/mux"
 	"github.com/minio/pkg/v2/policy"
 )
 // ListLDAPPolicyMappingEntities lists users/groups mapped to given/all policies.
 //
 // GET <admin-prefix>/idp/ldap/policy-entities?[query-params]
 //
 // Query params:
 //
 //	user=... -> repeatable query parameter, specifying users to query for
 //	policy mapping
 //
 //	group=... -> repeatable query parameter, specifying groups to query for
 //	policy mapping
 //
 //	policy=... -> repeatable query parameter, specifying policy to query for
 //	user/group mapping
 //
 // When all query parameters are omitted, returns mappings for all policies.
 func (a adminAPIHandlers) ListLDAPPolicyMappingEntities(w http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	// Check authorization.
 	objectAPI, cred := validateAdminReq(ctx, w, r,
 		policy.ListGroupsAdminAction, policy.ListUsersAdminAction, policy.ListUserPoliciesAdminAction)
 	if objectAPI == nil {
 		return
 	}
 	// Validate API arguments.
 	q := madmin.PolicyEntitiesQuery{
 		Users:  r.Form["user"],
 		Groups: r.Form["group"],
 		Policy: r.Form["policy"],
 	}
 	// Query IAM
 	res, err := globalIAMSys.QueryLDAPPolicyEntities(r.Context(), q)
 	if err != nil {
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 		return
 	}
 	// Encode result and send response.
 	data, err := json.Marshal(res)
 	if err != nil {
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 		return
 	}
 	password := cred.SecretKey
 	econfigData, err := madmin.EncryptData(password, data)
 	if err != nil {
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 		return
 	}
 	writeSuccessResponseJSON(w, econfigData)
 }
 // AttachDetachPolicyLDAP attaches or detaches policies from an LDAP entity
 // (user or group).
 //
 // POST <admin-prefix>/idp/ldap/policy/{operation}
 func (a adminAPIHandlers) AttachDetachPolicyLDAP(w http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	// Check authorization.
 	objectAPI, cred := validateAdminReq(ctx, w, r, policy.UpdatePolicyAssociationAction)
 	if objectAPI == nil {
 		return
 	}
 	if r.ContentLength > maxEConfigJSONSize || r.ContentLength == -1 {
 		// More than maxConfigSize bytes were available
 		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAdminConfigTooLarge), r.URL)
 		return
 	}
 	// Ensure body content type is opaque to ensure that request body has not
 	// been interpreted as form data.
 	contentType := r.Header.Get("Content-Type")
 	if contentType != "application/octet-stream" {
 		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrBadRequest), r.URL)
 		return
 	}
 	// Validate operation
 	operation := mux.Vars(r)["operation"]
 	if operation != "attach" && operation != "detach" {
 		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAdminInvalidArgument), r.URL)
 		return
 	}
 	isAttach := operation == "attach"
 	// Validate API arguments in body.
 	password := cred.SecretKey
 	reqBytes, err := madmin.DecryptData(password, io.LimitReader(r.Body, r.ContentLength))
 	if err != nil {
 		logger.LogIf(ctx, err, logger.ErrorKind)
 		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAdminConfigBadJSON), r.URL)
 		return
 	}
 	var par madmin.PolicyAssociationReq
 	err = json.Unmarshal(reqBytes, &par)
 	if err != nil {
 		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrInvalidRequest), r.URL)
 		return
 	}
 	if err := par.IsValid(); err != nil {
 		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAdminConfigBadJSON), r.URL)
 		return
 	}
 	// Call IAM subsystem
 	updatedAt, addedOrRemoved, _, err := globalIAMSys.PolicyDBUpdateLDAP(ctx, isAttach, par)
 	if err != nil {
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 		return
 	}
 	respBody := madmin.PolicyAssociationResp{
 		UpdatedAt: updatedAt,
 	}
 	if isAttach {
 		respBody.PoliciesAttached = addedOrRemoved
 	} else {
 		respBody.PoliciesDetached = addedOrRemoved
 	}
 	data, err := json.Marshal(respBody)
 	if err != nil {
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 		return
 	}
 	encryptedData, err := madmin.EncryptData(password, data)
 	if err != nil {
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 		return
 	}
 	writeSuccessResponseJSON(w, encryptedData)
 }
 // AddServiceAccountLDAP adds a new service account for provided LDAP username or DN
 //
 // PUT /minio/admin/v3/idp/ldap/add-service-account
 func (a adminAPIHandlers) AddServiceAccountLDAP(w http.ResponseWriter, r *http.Request) {
 	ctx, cred, opts, createReq, targetUser, APIError := commonAddServiceAccount(r)
 	if APIError.Code != "" {
 		writeErrorResponseJSON(ctx, w, APIError, r.URL)
 		return
 	}
 	// fail if ldap is not enabled
 	if !globalIAMSys.LDAPConfig.Enabled() {
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, errors.New("LDAP not enabled")), r.URL)
 	}
 	// Find the user for the request sender (as it may be sent via a service
 	// account or STS account):
 	requestorUser := cred.AccessKey
 	requestorParentUser := cred.AccessKey
 	requestorGroups := cred.Groups
 	requestorIsDerivedCredential := false
 	if cred.IsServiceAccount() || cred.IsTemp() {
 		requestorParentUser = cred.ParentUser
 		requestorIsDerivedCredential = true
 	}
 	// Check if we are creating svc account for request sender.
 	isSvcAccForRequestor := false
 	if targetUser == requestorUser || targetUser == requestorParentUser {
 		isSvcAccForRequestor = true
 	}
 	var (
 		targetGroups []string
 		err          error
 	)
 	// If we are creating svc account for request sender, ensure
 	// that targetUser is a real user (i.e. not derived
 	// credentials).
 	if isSvcAccForRequestor {
 		if requestorIsDerivedCredential {
 			if requestorParentUser == "" {
 				writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx,
 					errors.New("service accounts cannot be generated for temporary credentials without parent")), r.URL)
 				return
 			}
 			targetUser = requestorParentUser
 		}
 		targetGroups = requestorGroups
 		// Deny if the target user is not LDAP
 		isLDAP, err := globalIAMSys.LDAPConfig.DoesUsernameExist(targetUser)
 		if err != nil {
 			writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 			return
 		}
 		if isLDAP == "" {
 			err := errors.New("Specified user does not exist on LDAP server")
 			APIErr := errorCodes.ToAPIErrWithErr(ErrAdminNoSuchUser, err)
 			writeErrorResponseJSON(ctx, w, APIErr, r.URL)
 			return
 		}
 		// In case of LDAP/OIDC we need to set `opts.claims` to ensure
 		// it is associated with the LDAP/OIDC user properly.
 		for k, v := range cred.Claims {
 			if k == expClaim {
 				continue
 			}
 			opts.claims[k] = v
 		}
 	} else {
 		isDN := globalIAMSys.LDAPConfig.IsLDAPUserDN(targetUser)
 		opts.claims[ldapUserN] = targetUser // simple username
 		targetUser, targetGroups, err = globalIAMSys.LDAPConfig.LookupUserDN(targetUser)
 		if err != nil {
 			// if not found, check if DN
 			if strings.Contains(err.Error(), "not found") && isDN {
 				// warn user that DNs are not allowed
 				err = fmt.Errorf("Must use short username to add service account. %w", err)
 			}
 			writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 			return
 		}
 		opts.claims[ldapUser] = targetUser // DN
 	}
 	newCred, updatedAt, err := globalIAMSys.NewServiceAccount(ctx, targetUser, targetGroups, opts)
 	if err != nil {
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 		return
 	}
 	createResp := madmin.AddServiceAccountResp{
 		Credentials: madmin.Credentials{
 			AccessKey:  newCred.AccessKey,
 			SecretKey:  newCred.SecretKey,
 			Expiration: newCred.Expiration,
 		},
 	}
 	data, err := json.Marshal(createResp)
 	if err != nil {
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 		return
 	}
 	encryptedData, err := madmin.EncryptData(cred.SecretKey, data)
 	if err != nil {
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 		return
 	}
 	writeSuccessResponseJSON(w, encryptedData)
 	// Call hook for cluster-replication if the service account is not for a
 	// root user.
 	if newCred.ParentUser != globalActiveCred.AccessKey {
 		logger.LogIf(ctx, globalSiteReplicationSys.IAMChangeHook(ctx, madmin.SRIAMItem{
 			Type: madmin.SRIAMItemSvcAcc,
 			SvcAccChange: &madmin.SRSvcAccChange{
 				Create: &madmin.SRSvcAccCreate{
 					Parent:        newCred.ParentUser,
 					AccessKey:     newCred.AccessKey,
 					SecretKey:     newCred.SecretKey,
 					Groups:        newCred.Groups,
 					Name:          newCred.Name,
 					Description:   newCred.Description,
 					Claims:        opts.claims,
 					SessionPolicy: createReq.Policy,
 					Status:        auth.AccountOn,
 					Expiration:    createReq.Expiration,
 				},
 			},
 			UpdatedAt: updatedAt,
 		}))
 	}
 }
 // ListAccessKeysLDAP - GET /minio/admin/v3/idp/ldap/list-access-keys
 func (a adminAPIHandlers) ListAccessKeysLDAP(w http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	// Get current object layer instance.
 	objectAPI := newObjectLayerFn()
 	if objectAPI == nil || globalNotificationSys == nil {
 		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrServerNotInitialized), r.URL)
 		return
 	}
 	cred, owner, s3Err := validateAdminSignature(ctx, r, "")
 	if s3Err != ErrNone {
 		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(s3Err), r.URL)
 		return
 	}
 	userDN := r.Form.Get("userDN")
 	// If listing is requested for a specific user (who is not the request
 	// sender), check that the user has permissions.
 	if userDN != "" && userDN != cred.ParentUser {
 		if !globalIAMSys.IsAllowed(policy.Args{
 			AccountName:     cred.AccessKey,
 			Groups:          cred.Groups,
 			Action:          policy.ListServiceAccountsAdminAction,
 			ConditionValues: getConditionValues(r, "", cred),
 			IsOwner:         owner,
 			Claims:          cred.Claims,
 		}) {
 			writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAccessDenied), r.URL)
 			return
 		}
 	} else {
 		if !globalIAMSys.IsAllowed(policy.Args{
 			AccountName:     cred.AccessKey,
 			Groups:          cred.Groups,
 			Action:          policy.ListServiceAccountsAdminAction,
 			ConditionValues: getConditionValues(r, "", cred),
 			IsOwner:         owner,
 			Claims:          cred.Claims,
 			DenyOnly:        true,
 		}) {
 			writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAccessDenied), r.URL)
 			return
 		}
 		userDN = cred.AccessKey
 		if cred.ParentUser != "" {
 			userDN = cred.ParentUser
 		}
 	}
 	targetAccount, err := globalIAMSys.LDAPConfig.DoesUsernameExist(userDN)
 	if err != nil {
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 		return
 	} else if userDN == "" {
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, errNoSuchUser), r.URL)
 		return
 	}
 	listType := r.Form.Get("listType")
 	if listType != "sts-only" && listType != "svcacc-only" && listType != "" {
 		// default to both
 		listType = ""
 	}
 	var serviceAccounts []auth.Credentials
 	var stsKeys []auth.Credentials
 	if listType == "" || listType == "sts-only" {
 		stsKeys, err = globalIAMSys.ListSTSAccounts(ctx, targetAccount)
 		if err != nil {
 			writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 			return
 		}
 	}
 	if listType == "" || listType == "svcacc-only" {
 		serviceAccounts, err = globalIAMSys.ListServiceAccounts(ctx, targetAccount)
 		if err != nil {
 			writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 			return
 		}
 	}
 	var serviceAccountList []madmin.ServiceAccountInfo
 	var stsKeyList []madmin.ServiceAccountInfo
 	for _, svc := range serviceAccounts {
 		expiryTime := svc.Expiration
 		serviceAccountList = append(serviceAccountList, madmin.ServiceAccountInfo{
 			AccessKey:  svc.AccessKey,
 			Expiration: &expiryTime,
 		})
 	}
 	for _, sts := range stsKeys {
 		expiryTime := sts.Expiration
 		stsKeyList = append(stsKeyList, madmin.ServiceAccountInfo{
 			AccessKey:  sts.AccessKey,
 			Expiration: &expiryTime,
 		})
 	}
 	listResp := madmin.ListAccessKeysLDAPResp{
 		ServiceAccounts: serviceAccountList,
 		STSKeys:         stsKeyList,
 	}
 	data, err := json.Marshal(listResp)
 	if err != nil {
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 		return
 	}
 	encryptedData, err := madmin.EncryptData(cred.SecretKey, data)
 	if err != nil {
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 		return
 	}
 	writeSuccessResponseJSON(w, encryptedData)
 }
@@ -19,20 +19,26 @@ package cmd
 import (
 	"encoding/json"
 	"errors"
 	"fmt"
 	"net/http"
 	"strconv"
 	"strings"
 	"github.com/gorilla/mux"
 	"github.com/minio/minio/internal/logger"
-	iampolicy "github.com/minio/pkg/iam/policy"
+	"github.com/minio/mux"
 	"github.com/minio/pkg/v2/policy"
 )
 var (
 	errRebalanceDecommissionAlreadyRunning = errors.New("Rebalance cannot be started, decommission is already in progress")
 	errDecommissionRebalanceAlreadyRunning = errors.New("Decommission cannot be started, rebalance is already in progress")
 )
 func (a adminAPIHandlers) StartDecommission(w http.ResponseWriter, r *http.Request) {
-	ctx := newContext(r, w, "StartDecommission")
+	ctx := r.Context()
-	defer logger.AuditLog(ctx, w, r, mustGetClaimsFromToken(r))
+	objectAPI, _ := validateAdminReq(ctx, w, r, policy.DecommissionAdminAction)
 	objectAPI, _ := validateAdminReq(ctx, w, r, iampolicy.DecommissionAdminAction)
 	if objectAPI == nil {
 		return
 	}
@@ -43,23 +49,65 @@ func (a adminAPIHandlers) StartDecommission(w http.ResponseWriter, r *http.Reque
 		return
 	}
-	pools, ok := objectAPI.(*erasureServerPools)
+	z, ok := objectAPI.(*erasureServerPools)
-	if !ok {
+	if !ok || len(z.serverPools) == 1 {
 		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrNotImplemented), r.URL)
 		return
 	}
 	if z.IsDecommissionRunning() {
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, errDecommissionAlreadyRunning), r.URL)
 		return
 	}
 	if z.IsRebalanceStarted() {
 		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAdminRebalanceAlreadyStarted), r.URL)
 		return
 	}
 	vars := mux.Vars(r)
 	v := vars["pool"]
 	byID := vars["by-id"] == "true"
-	idx := globalEndpoints.GetPoolIdx(v)
+	pools := strings.Split(v, ",")
-	if idx == -1 {
+	poolIndices := make([]int, 0, len(pools))
-		// We didn't find any matching pools, invalid input
+
-		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, errInvalidArgument), r.URL)
+	for _, pool := range pools {
-		return
+		var idx int
 		if byID {
 			var err error
 			idx, err = strconv.Atoi(pool)
 			if err != nil {
 				// We didn't find any matching pools, invalid input
 				writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, errInvalidArgument), r.URL)
 				return
 			}
 		} else {
 			idx = globalEndpoints.GetPoolIdx(pool)
 			if idx == -1 {
 				// We didn't find any matching pools, invalid input
 				writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, errInvalidArgument), r.URL)
 				return
 			}
 		}
 		var pool *erasureSets
 		for pidx := range z.serverPools {
 			if pidx == idx {
 				pool = z.serverPools[idx]
 				break
 			}
 		}
 		if pool == nil {
 			// We didn't find any matching pools, invalid input
 			writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, errInvalidArgument), r.URL)
 			return
 		}
 		poolIndices = append(poolIndices, idx)
 	}
-	if ep := globalEndpoints[idx].Endpoints[0]; !ep.IsLocal {
+	if len(poolIndices) > 0 && !globalEndpoints[poolIndices[0]].Endpoints[0].IsLocal {
 		ep := globalEndpoints[poolIndices[0]].Endpoints[0]
 		for nodeIdx, proxyEp := range globalProxyEndpoints {
 			if proxyEp.Endpoint.Host == ep.Host {
 				if proxyRequestByNodeIndex(ctx, w, r, nodeIdx) {
@@ -69,18 +117,16 @@ func (a adminAPIHandlers) StartDecommission(w http.ResponseWriter, r *http.Reque
 		}
 	}
-	if err := pools.Decommission(r.Context(), idx); err != nil {
+	if err := z.Decommission(r.Context(), poolIndices...); err != nil {
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 		return
 	}
 }
 func (a adminAPIHandlers) CancelDecommission(w http.ResponseWriter, r *http.Request) {
-	ctx := newContext(r, w, "CancelDecommission")
+	ctx := r.Context()
-	defer logger.AuditLog(ctx, w, r, mustGetClaimsFromToken(r))
+	objectAPI, _ := validateAdminReq(ctx, w, r, policy.DecommissionAdminAction)
 	objectAPI, _ := validateAdminReq(ctx, w, r, iampolicy.DecommissionAdminAction)
 	if objectAPI == nil {
 		return
 	}
@@ -99,8 +145,17 @@ func (a adminAPIHandlers) CancelDecommission(w http.ResponseWriter, r *http.Requ
 	vars := mux.Vars(r)
 	v := vars["pool"]
 	byID := vars["by-id"] == "true"
 	idx := -1
 	if byID {
 		if i, err := strconv.Atoi(v); err == nil && i >= 0 && i < len(globalEndpoints) {
 			idx = i
 		}
 	} else {
 		idx = globalEndpoints.GetPoolIdx(v)
 	}
 	idx := globalEndpoints.GetPoolIdx(v)
 	if idx == -1 {
 		// We didn't find any matching pools, invalid input
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, errInvalidArgument), r.URL)
@@ -124,11 +179,9 @@ func (a adminAPIHandlers) CancelDecommission(w http.ResponseWriter, r *http.Requ
 }
 func (a adminAPIHandlers) StatusPool(w http.ResponseWriter, r *http.Request) {
-	ctx := newContext(r, w, "StatusPool")
+	ctx := r.Context()
-	defer logger.AuditLog(ctx, w, r, mustGetClaimsFromToken(r))
+	objectAPI, _ := validateAdminReq(ctx, w, r, policy.ServerInfoAdminAction, policy.DecommissionAdminAction)
 	objectAPI, _ := validateAdminReq(ctx, w, r, iampolicy.ServerInfoAdminAction, iampolicy.DecommissionAdminAction)
 	if objectAPI == nil {
 		return
 	}
@@ -147,8 +200,17 @@ func (a adminAPIHandlers) StatusPool(w http.ResponseWriter, r *http.Request) {
 	vars := mux.Vars(r)
 	v := vars["pool"]
 	byID := vars["by-id"] == "true"
 	idx := -1
 	if byID {
 		if i, err := strconv.Atoi(v); err == nil && i >= 0 && i < len(globalEndpoints) {
 			idx = i
 		}
 	} else {
 		idx = globalEndpoints.GetPoolIdx(v)
 	}
 	idx := globalEndpoints.GetPoolIdx(v)
 	if idx == -1 {
 		apiErr := toAdminAPIErr(ctx, errInvalidArgument)
 		apiErr.Description = fmt.Sprintf("specified pool '%s' not found, please specify a valid pool", v)
@@ -167,11 +229,9 @@ func (a adminAPIHandlers) StatusPool(w http.ResponseWriter, r *http.Request) {
 }
 func (a adminAPIHandlers) ListPools(w http.ResponseWriter, r *http.Request) {
-	ctx := newContext(r, w, "ListPools")
+	ctx := r.Context()
-	defer logger.AuditLog(ctx, w, r, mustGetClaimsFromToken(r))
+	objectAPI, _ := validateAdminReq(ctx, w, r, policy.ServerInfoAdminAction, policy.DecommissionAdminAction)
 	objectAPI, _ := validateAdminReq(ctx, w, r, iampolicy.ServerInfoAdminAction, iampolicy.DecommissionAdminAction)
 	if objectAPI == nil {
 		return
 	}
@@ -200,3 +260,134 @@ func (a adminAPIHandlers) ListPools(w http.ResponseWriter, r *http.Request) {
 	logger.LogIf(r.Context(), json.NewEncoder(w).Encode(poolsStatus))
 }
 func (a adminAPIHandlers) RebalanceStart(w http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	objectAPI, _ := validateAdminReq(ctx, w, r, policy.RebalanceAdminAction)
 	if objectAPI == nil {
 		return
 	}
 	// NB rebalance-start admin API is always coordinated from first pool's
 	// first node. The following is required to serialize (the effects of)
 	// concurrent rebalance-start commands.
 	if ep := globalEndpoints[0].Endpoints[0]; !ep.IsLocal {
 		for nodeIdx, proxyEp := range globalProxyEndpoints {
 			if proxyEp.Endpoint.Host == ep.Host {
 				if proxyRequestByNodeIndex(ctx, w, r, nodeIdx) {
 					return
 				}
 			}
 		}
 	}
 	pools, ok := objectAPI.(*erasureServerPools)
 	if !ok || len(pools.serverPools) == 1 {
 		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrNotImplemented), r.URL)
 		return
 	}
 	if pools.IsDecommissionRunning() {
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, errRebalanceDecommissionAlreadyRunning), r.URL)
 		return
 	}
 	if pools.IsRebalanceStarted() {
 		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAdminRebalanceAlreadyStarted), r.URL)
 		return
 	}
 	bucketInfos, err := objectAPI.ListBuckets(ctx, BucketOptions{})
 	if err != nil {
 		writeErrorResponseJSON(ctx, w, toAPIError(ctx, err), r.URL)
 		return
 	}
 	buckets := make([]string, 0, len(bucketInfos))
 	for _, bInfo := range bucketInfos {
 		buckets = append(buckets, bInfo.Name)
 	}
 	var id string
 	if id, err = pools.initRebalanceMeta(ctx, buckets); err != nil {
 		writeErrorResponseJSON(ctx, w, toAPIError(ctx, err), r.URL)
 		return
 	}
 	// Rebalance routine is run on the first node of any pool participating in rebalance.
 	pools.StartRebalance()
 	b, err := json.Marshal(struct {
 		ID string `json:"id"`
 	}{ID: id})
 	if err != nil {
 		writeErrorResponseJSON(ctx, w, toAPIError(ctx, err), r.URL)
 		return
 	}
 	writeSuccessResponseJSON(w, b)
 	// Notify peers to load rebalance.bin and start rebalance routine if they happen to be
 	// participating pool's leader node
 	globalNotificationSys.LoadRebalanceMeta(ctx, true)
 }
 func (a adminAPIHandlers) RebalanceStatus(w http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	objectAPI, _ := validateAdminReq(ctx, w, r, policy.RebalanceAdminAction)
 	if objectAPI == nil {
 		return
 	}
 	// Proxy rebalance-status to first pool first node, so that users see a
 	// consistent view of rebalance progress even though different rebalancing
 	// pools may temporarily have out of date info on the others.
 	if ep := globalEndpoints[0].Endpoints[0]; !ep.IsLocal {
 		for nodeIdx, proxyEp := range globalProxyEndpoints {
 			if proxyEp.Endpoint.Host == ep.Host {
 				if proxyRequestByNodeIndex(ctx, w, r, nodeIdx) {
 					return
 				}
 			}
 		}
 	}
 	pools, ok := objectAPI.(*erasureServerPools)
 	if !ok {
 		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrNotImplemented), r.URL)
 		return
 	}
 	rs, err := rebalanceStatus(ctx, pools)
 	if err != nil {
 		if errors.Is(err, errRebalanceNotStarted) || errors.Is(err, errConfigNotFound) {
 			writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAdminRebalanceNotStarted), r.URL)
 			return
 		}
 		logger.LogIf(ctx, fmt.Errorf("failed to fetch rebalance status: %w", err))
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 		return
 	}
 	logger.LogIf(r.Context(), json.NewEncoder(w).Encode(rs))
 }
 func (a adminAPIHandlers) RebalanceStop(w http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	objectAPI, _ := validateAdminReq(ctx, w, r, policy.RebalanceAdminAction)
 	if objectAPI == nil {
 		return
 	}
 	pools, ok := objectAPI.(*erasureServerPools)
 	if !ok {
 		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrNotImplemented), r.URL)
 		return
 	}
 	// Cancel any ongoing rebalance operation
 	globalNotificationSys.StopRebalance(r.Context())
 	writeSuccessResponseHeadersOnly(w)
 	logger.LogIf(ctx, pools.saveRebalanceStats(GlobalContext, 0, rebalSaveStoppedAt))
 }
@@ -20,27 +20,28 @@ package cmd
 import (
 	"bytes"
 	"context"
 	"encoding/gob"
 	"encoding/json"
 	"errors"
 	"io"
 	"net/http"
 	"strings"
 	"sync/atomic"
 	"time"
-	"github.com/gorilla/mux"
+	"github.com/dustin/go-humanize"
-	"github.com/minio/madmin-go"
+	"github.com/minio/madmin-go/v3"
-
+	xioutil "github.com/minio/minio/internal/ioutil"
 	"github.com/minio/minio/internal/logger"
-	"github.com/minio/pkg/bucket/policy"
+	"github.com/minio/mux"
-	iampolicy "github.com/minio/pkg/iam/policy"
+	"github.com/minio/pkg/v2/policy"
 )
 // SiteReplicationAdd - PUT /minio/admin/v3/site-replication/add
 func (a adminAPIHandlers) SiteReplicationAdd(w http.ResponseWriter, r *http.Request) {
-	ctx := newContext(r, w, "SiteReplicationAdd")
+	ctx := r.Context()
-	defer logger.AuditLog(ctx, w, r, mustGetClaimsFromToken(r))
+	objectAPI, cred := validateAdminReq(ctx, w, r, policy.SiteReplicationAddAction)
 	objectAPI, cred := validateAdminReq(ctx, w, r, iampolicy.SiteReplicationAddAction)
 	if objectAPI == nil {
 		return
 	}
@@ -51,7 +52,8 @@ func (a adminAPIHandlers) SiteReplicationAdd(w http.ResponseWriter, r *http.Requ
 		return
 	}
-	status, err := globalSiteReplicationSys.AddPeerClusters(ctx, sites)
+	opts := getSRAddOptions(r)
 	status, err := globalSiteReplicationSys.AddPeerClusters(ctx, sites, opts)
 	if err != nil {
 		logger.LogIf(ctx, err)
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
@@ -67,16 +69,19 @@ func (a adminAPIHandlers) SiteReplicationAdd(w http.ResponseWriter, r *http.Requ
 	writeSuccessResponseJSON(w, body)
 }
 func getSRAddOptions(r *http.Request) (opts madmin.SRAddOptions) {
 	opts.ReplicateILMExpiry = r.Form.Get("replicateILMExpiry") == "true"
 	return
 }
 // SRPeerJoin - PUT /minio/admin/v3/site-replication/join
 //
 // used internally to tell current cluster to enable SR with
 // the provided peer clusters and service account.
 func (a adminAPIHandlers) SRPeerJoin(w http.ResponseWriter, r *http.Request) {
-	ctx := newContext(r, w, "SRPeerJoin")
+	ctx := r.Context()
-	defer logger.AuditLog(ctx, w, r, mustGetClaimsFromToken(r))
+	objectAPI, cred := validateAdminReq(ctx, w, r, policy.SiteReplicationAddAction)
 	objectAPI, cred := validateAdminReq(ctx, w, r, iampolicy.SiteReplicationAddAction)
 	if objectAPI == nil {
 		return
 	}
@@ -96,11 +101,9 @@ func (a adminAPIHandlers) SRPeerJoin(w http.ResponseWriter, r *http.Request) {
 // SRPeerBucketOps - PUT /minio/admin/v3/site-replication/bucket-ops?bucket=x&operation=y
 func (a adminAPIHandlers) SRPeerBucketOps(w http.ResponseWriter, r *http.Request) {
-	ctx := newContext(r, w, "SRPeerBucketOps")
+	ctx := r.Context()
-	defer logger.AuditLog(ctx, w, r, mustGetClaimsFromToken(r))
+	objectAPI, _ := validateAdminReq(ctx, w, r, policy.SiteReplicationOperationAction)
 	objectAPI, _ := validateAdminReq(ctx, w, r, iampolicy.SiteReplicationOperationAction)
 	if objectAPI == nil {
 		return
 	}
@@ -114,37 +117,23 @@ func (a adminAPIHandlers) SRPeerBucketOps(w http.ResponseWriter, r *http.Request
 	default:
 		err = errSRInvalidRequest(errInvalidArgument)
 	case madmin.MakeWithVersioningBktOp:
-		_, isLockEnabled := r.Form["lockEnabled"]
+		createdAt, cerr := time.Parse(time.RFC3339Nano, strings.TrimSpace(r.Form.Get("createdAt")))
 		_, isVersioningEnabled := r.Form["versioningEnabled"]
 		_, isForceCreate := r.Form["forceCreate"]
 		createdAtStr := strings.TrimSpace(r.Form.Get("createdAt"))
 		createdAt, cerr := time.Parse(time.RFC3339Nano, createdAtStr)
 		if cerr != nil {
 			createdAt = timeSentinel
 		}
 		opts := MakeBucketOptions{
-			Location:          r.Form.Get("location"),
+			LockEnabled:       r.Form.Get("lockEnabled") == "true",
-			LockEnabled:       isLockEnabled,
+			VersioningEnabled: r.Form.Get("versioningEnabled") == "true",
-			VersioningEnabled: isVersioningEnabled,
+			ForceCreate:       r.Form.Get("forceCreate") == "true",
 			ForceCreate:       isForceCreate,
 			CreatedAt:         createdAt,
 		}
 		err = globalSiteReplicationSys.PeerBucketMakeWithVersioningHandler(ctx, bucket, opts)
 	case madmin.ConfigureReplBktOp:
 		err = globalSiteReplicationSys.PeerBucketConfigureReplHandler(ctx, bucket)
-	case madmin.DeleteBucketBktOp:
+	case madmin.DeleteBucketBktOp, madmin.ForceDeleteBucketBktOp:
 		_, noRecreate := r.Form["noRecreate"]
 		err = globalSiteReplicationSys.PeerBucketDeleteHandler(ctx, bucket, DeleteBucketOptions{
-			Force:      false,
+			Force:      operation == madmin.ForceDeleteBucketBktOp,
 			NoRecreate: noRecreate,
 			SRDeleteOp: getSRBucketDeleteOp(true),
 		})
 	case madmin.ForceDeleteBucketBktOp:
 		_, noRecreate := r.Form["noRecreate"]
 		err = globalSiteReplicationSys.PeerBucketDeleteHandler(ctx, bucket, DeleteBucketOptions{
 			Force:      true,
 			NoRecreate: noRecreate,
 			SRDeleteOp: getSRBucketDeleteOp(true),
 		})
 	case madmin.PurgeDeletedBucketOp:
@@ -159,11 +148,9 @@ func (a adminAPIHandlers) SRPeerBucketOps(w http.ResponseWriter, r *http.Request
 // SRPeerReplicateIAMItem - PUT /minio/admin/v3/site-replication/iam-item
 func (a adminAPIHandlers) SRPeerReplicateIAMItem(w http.ResponseWriter, r *http.Request) {
-	ctx := newContext(r, w, "SRPeerReplicateIAMItem")
+	ctx := r.Context()
-	defer logger.AuditLog(ctx, w, r, mustGetClaimsFromToken(r))
+	objectAPI, _ := validateAdminReq(ctx, w, r, policy.SiteReplicationOperationAction)
 	objectAPI, _ := validateAdminReq(ctx, w, r, iampolicy.SiteReplicationOperationAction)
 	if objectAPI == nil {
 		return
 	}
@@ -182,7 +169,7 @@ func (a adminAPIHandlers) SRPeerReplicateIAMItem(w http.ResponseWriter, r *http.
 		if item.Policy == nil {
 			err = globalSiteReplicationSys.PeerAddPolicyHandler(ctx, item.Name, nil, item.UpdatedAt)
 		} else {
-			policy, perr := iampolicy.ParseConfig(bytes.NewReader(item.Policy))
+			policy, perr := policy.ParseConfig(bytes.NewReader(item.Policy))
 			if perr != nil {
 				writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, perr), r.URL)
 				return
@@ -211,13 +198,11 @@ func (a adminAPIHandlers) SRPeerReplicateIAMItem(w http.ResponseWriter, r *http.
 	}
 }
-// SRPeerReplicateBucketItem - PUT /minio/admin/v3/site-replication/bucket-meta
+// SRPeerReplicateBucketItem - PUT /minio/admin/v3/site-replication/peer/bucket-meta
 func (a adminAPIHandlers) SRPeerReplicateBucketItem(w http.ResponseWriter, r *http.Request) {
-	ctx := newContext(r, w, "SRPeerReplicateBucketItem")
+	ctx := r.Context()
-	defer logger.AuditLog(ctx, w, r, mustGetClaimsFromToken(r))
+	objectAPI, _ := validateAdminReq(ctx, w, r, policy.SiteReplicationOperationAction)
 	objectAPI, _ := validateAdminReq(ctx, w, r, iampolicy.SiteReplicationOperationAction)
 	if objectAPI == nil {
 		return
 	}
@@ -228,15 +213,20 @@ func (a adminAPIHandlers) SRPeerReplicateBucketItem(w http.ResponseWriter, r *ht
 		return
 	}
 	if item.Bucket == "" {
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, errSRInvalidRequest(errInvalidArgument)), r.URL)
 		return
 	}
 	var err error
 	switch item.Type {
 	default:
-		err = errSRInvalidRequest(errInvalidArgument)
+		err = globalSiteReplicationSys.PeerBucketMetadataUpdateHandler(ctx, item)
 	case madmin.SRBucketMetaTypePolicy:
 		if item.Policy == nil {
 			err = globalSiteReplicationSys.PeerBucketPolicyHandler(ctx, item.Bucket, nil, item.UpdatedAt)
 		} else {
-			bktPolicy, berr := policy.ParseConfig(bytes.NewReader(item.Policy), item.Bucket)
+			bktPolicy, berr := policy.ParseBucketPolicyConfig(bytes.NewReader(item.Policy), item.Bucket)
 			if berr != nil {
 				writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, berr), r.URL)
 				return
@@ -257,7 +247,7 @@ func (a adminAPIHandlers) SRPeerReplicateBucketItem(w http.ResponseWriter, r *ht
 				return
 			}
 			if err = globalSiteReplicationSys.PeerBucketQuotaConfigHandler(ctx, item.Bucket, quotaConfig, item.UpdatedAt); err != nil {
-				writeErrorResponse(ctx, w, toAPIError(ctx, err), r.URL)
+				writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 				return
 			}
 		}
@@ -269,6 +259,8 @@ func (a adminAPIHandlers) SRPeerReplicateBucketItem(w http.ResponseWriter, r *ht
 		err = globalSiteReplicationSys.PeerBucketObjectLockConfigHandler(ctx, item.Bucket, item.ObjectLockConfig, item.UpdatedAt)
 	case madmin.SRBucketMetaTypeSSEConfig:
 		err = globalSiteReplicationSys.PeerBucketSSEConfigHandler(ctx, item.Bucket, item.SSEConfig, item.UpdatedAt)
 	case madmin.SRBucketMetaLCConfig:
 		err = globalSiteReplicationSys.PeerBucketLCConfigHandler(ctx, item.Bucket, item.ExpiryLCConfig, item.UpdatedAt)
 	}
 	if err != nil {
 		logger.LogIf(ctx, err)
@@ -279,11 +271,9 @@ func (a adminAPIHandlers) SRPeerReplicateBucketItem(w http.ResponseWriter, r *ht
 // SiteReplicationInfo - GET /minio/admin/v3/site-replication/info
 func (a adminAPIHandlers) SiteReplicationInfo(w http.ResponseWriter, r *http.Request) {
-	ctx := newContext(r, w, "SiteReplicationInfo")
+	ctx := r.Context()
-	defer logger.AuditLog(ctx, w, r, mustGetClaimsFromToken(r))
+	objectAPI, _ := validateAdminReq(ctx, w, r, policy.SiteReplicationInfoAction)
 	objectAPI, _ := validateAdminReq(ctx, w, r, iampolicy.SiteReplicationInfoAction)
 	if objectAPI == nil {
 		return
 	}
@@ -301,11 +291,9 @@ func (a adminAPIHandlers) SiteReplicationInfo(w http.ResponseWriter, r *http.Req
 }
 func (a adminAPIHandlers) SRPeerGetIDPSettings(w http.ResponseWriter, r *http.Request) {
-	ctx := newContext(r, w, "SiteReplicationGetIDPSettings")
+	ctx := r.Context()
-	defer logger.AuditLog(ctx, w, r, mustGetClaimsFromToken(r))
+	objectAPI, _ := validateAdminReq(ctx, w, r, policy.SiteReplicationAddAction)
 	objectAPI, _ := validateAdminReq(ctx, w, r, iampolicy.SiteReplicationAddAction)
 	if objectAPI == nil {
 		return
 	}
@@ -340,11 +328,9 @@ func parseJSONBody(ctx context.Context, body io.Reader, v interface{}, encryptio
 // SiteReplicationStatus - GET /minio/admin/v3/site-replication/status
 func (a adminAPIHandlers) SiteReplicationStatus(w http.ResponseWriter, r *http.Request) {
-	ctx := newContext(r, w, "SiteReplicationStatus")
+	ctx := r.Context()
-	defer logger.AuditLog(ctx, w, r, mustGetClaimsFromToken(r))
+	objectAPI, _ := validateAdminReq(ctx, w, r, policy.SiteReplicationInfoAction)
 	objectAPI, _ := validateAdminReq(ctx, w, r, iampolicy.SiteReplicationInfoAction)
 	if objectAPI == nil {
 		return
 	}
@@ -356,6 +342,7 @@ func (a adminAPIHandlers) SiteReplicationStatus(w http.ResponseWriter, r *http.R
 		opts.Users = true
 		opts.Policies = true
 		opts.Groups = true
 		opts.ILMExpiryRules = true
 	}
 	info, err := globalSiteReplicationSys.SiteReplicationStatus(ctx, objectAPI, opts)
 	if err != nil {
@@ -371,11 +358,9 @@ func (a adminAPIHandlers) SiteReplicationStatus(w http.ResponseWriter, r *http.R
 // SiteReplicationMetaInfo - GET /minio/admin/v3/site-replication/metainfo
 func (a adminAPIHandlers) SiteReplicationMetaInfo(w http.ResponseWriter, r *http.Request) {
-	ctx := newContext(r, w, "SiteReplicationMetaInfo")
+	ctx := r.Context()
-	defer logger.AuditLog(ctx, w, r, mustGetClaimsFromToken(r))
+	objectAPI, _ := validateAdminReq(ctx, w, r, policy.SiteReplicationInfoAction)
 	objectAPI, _ := validateAdminReq(ctx, w, r, iampolicy.SiteReplicationInfoAction)
 	if objectAPI == nil {
 		return
 	}
@@ -395,10 +380,9 @@ func (a adminAPIHandlers) SiteReplicationMetaInfo(w http.ResponseWriter, r *http
 // SiteReplicationEdit - PUT /minio/admin/v3/site-replication/edit
 func (a adminAPIHandlers) SiteReplicationEdit(w http.ResponseWriter, r *http.Request) {
-	ctx := newContext(r, w, "SiteReplicationEdit")
+	ctx := r.Context()
 	defer logger.AuditLog(ctx, w, r, mustGetClaimsFromToken(r))
-	objectAPI, cred := validateAdminReq(ctx, w, r, iampolicy.SiteReplicationAddAction)
+	objectAPI, cred := validateAdminReq(ctx, w, r, policy.SiteReplicationAddAction)
 	if objectAPI == nil {
 		return
 	}
@@ -408,7 +392,9 @@ func (a adminAPIHandlers) SiteReplicationEdit(w http.ResponseWriter, r *http.Req
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 		return
 	}
-	status, err := globalSiteReplicationSys.EditPeerCluster(ctx, site)
+
 	opts := getSREditOptions(r)
 	status, err := globalSiteReplicationSys.EditPeerCluster(ctx, site, opts)
 	if err != nil {
 		logger.LogIf(ctx, err)
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
@@ -423,14 +409,19 @@ func (a adminAPIHandlers) SiteReplicationEdit(w http.ResponseWriter, r *http.Req
 	writeSuccessResponseJSON(w, body)
 }
 func getSREditOptions(r *http.Request) (opts madmin.SREditOptions) {
 	opts.DisableILMExpiryReplication = r.Form.Get("disableILMExpiryReplication") == "true"
 	opts.EnableILMExpiryReplication = r.Form.Get("enableILMExpiryReplication") == "true"
 	return
 }
 // SRPeerEdit - PUT /minio/admin/v3/site-replication/peer/edit
 //
 // used internally to tell current cluster to update endpoint for peer
 func (a adminAPIHandlers) SRPeerEdit(w http.ResponseWriter, r *http.Request) {
-	ctx := newContext(r, w, "SRPeerEdit")
+	ctx := r.Context()
 	defer logger.AuditLog(ctx, w, r, mustGetClaimsFromToken(r))
-	objectAPI, _ := validateAdminReq(ctx, w, r, iampolicy.SiteReplicationAddAction)
+	objectAPI, _ := validateAdminReq(ctx, w, r, policy.SiteReplicationAddAction)
 	if objectAPI == nil {
 		return
 	}
@@ -448,25 +439,49 @@ func (a adminAPIHandlers) SRPeerEdit(w http.ResponseWriter, r *http.Request) {
 	}
 }
 // SRStateEdit - PUT /minio/admin/v3/site-replication/state/edit
 //
 // used internally to tell current cluster to update site replication state
 func (a adminAPIHandlers) SRStateEdit(w http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	objectAPI, _ := validateAdminReq(ctx, w, r, policy.SiteReplicationOperationAction)
 	if objectAPI == nil {
 		return
 	}
 	var state madmin.SRStateEditReq
 	if err := parseJSONBody(ctx, r.Body, &state, ""); err != nil {
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 		return
 	}
 	if err := globalSiteReplicationSys.PeerStateEditReq(ctx, state); err != nil {
 		logger.LogIf(ctx, err)
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 		return
 	}
 }
 func getSRStatusOptions(r *http.Request) (opts madmin.SRStatusOptions) {
 	q := r.Form
 	opts.Buckets = q.Get("buckets") == "true"
 	opts.Policies = q.Get("policies") == "true"
 	opts.Groups = q.Get("groups") == "true"
 	opts.Users = q.Get("users") == "true"
 	opts.ILMExpiryRules = q.Get("ilm-expiry-rules") == "true"
 	opts.PeerState = q.Get("peer-state") == "true"
 	opts.Entity = madmin.GetSREntityType(q.Get("entity"))
 	opts.EntityValue = q.Get("entityvalue")
 	opts.ShowDeleted = q.Get("showDeleted") == "true"
 	opts.Metrics = q.Get("metrics") == "true"
 	return
 }
 // SiteReplicationRemove - PUT /minio/admin/v3/site-replication/remove
 func (a adminAPIHandlers) SiteReplicationRemove(w http.ResponseWriter, r *http.Request) {
-	ctx := newContext(r, w, "SiteReplicationRemove")
+	ctx := r.Context()
-	defer logger.AuditLog(ctx, w, r, mustGetClaimsFromToken(r))
+	objectAPI, _ := validateAdminReq(ctx, w, r, policy.SiteReplicationRemoveAction)
 	objectAPI, _ := validateAdminReq(ctx, w, r, iampolicy.SiteReplicationRemoveAction)
 	if objectAPI == nil {
 		return
 	}
@@ -495,10 +510,9 @@ func (a adminAPIHandlers) SiteReplicationRemove(w http.ResponseWriter, r *http.R
 //
 // used internally to tell current cluster to update endpoint for peer
 func (a adminAPIHandlers) SRPeerRemove(w http.ResponseWriter, r *http.Request) {
-	ctx := newContext(r, w, "SRPeerRemove")
+	ctx := r.Context()
 	defer logger.AuditLog(ctx, w, r, mustGetClaimsFromToken(r))
-	objectAPI, _ := validateAdminReq(ctx, w, r, iampolicy.SiteReplicationRemoveAction)
+	objectAPI, _ := validateAdminReq(ctx, w, r, policy.SiteReplicationRemoveAction)
 	if objectAPI == nil {
 		return
 	}
@@ -515,3 +529,85 @@ func (a adminAPIHandlers) SRPeerRemove(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 }
 // SiteReplicationResyncOp - PUT /minio/admin/v3/site-replication/resync/op
 func (a adminAPIHandlers) SiteReplicationResyncOp(w http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	objectAPI, _ := validateAdminReq(ctx, w, r, policy.SiteReplicationResyncAction)
 	if objectAPI == nil {
 		return
 	}
 	var peerSite madmin.PeerInfo
 	if err := parseJSONBody(ctx, r.Body, &peerSite, ""); err != nil {
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 		return
 	}
 	vars := mux.Vars(r)
 	op := madmin.SiteResyncOp(vars["operation"])
 	var (
 		status madmin.SRResyncOpStatus
 		err    error
 	)
 	switch op {
 	case madmin.SiteResyncStart:
 		status, err = globalSiteReplicationSys.startResync(ctx, objectAPI, peerSite)
 	case madmin.SiteResyncCancel:
 		status, err = globalSiteReplicationSys.cancelResync(ctx, objectAPI, peerSite)
 	default:
 		err = errSRInvalidRequest(errInvalidArgument)
 	}
 	if err != nil {
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 		return
 	}
 	body, err := json.Marshal(status)
 	if err != nil {
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 		return
 	}
 	writeSuccessResponseJSON(w, body)
 }
 // SiteReplicationDevNull - everything goes to io.Discard
 // [POST] /minio/admin/v3/site-replication/devnull
 func (a adminAPIHandlers) SiteReplicationDevNull(w http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	globalSiteNetPerfRX.Connect()
 	defer globalSiteNetPerfRX.Disconnect()
 	connectTime := time.Now()
 	for {
 		n, err := io.CopyN(xioutil.Discard, r.Body, 128*humanize.KiByte)
 		atomic.AddUint64(&globalSiteNetPerfRX.RX, uint64(n))
 		if err != nil && err != io.EOF && err != io.ErrUnexpectedEOF {
 			// If there is a disconnection before globalNetPerfMinDuration (we give a margin of error of 1 sec)
 			// would mean the network is not stable. Logging here will help in debugging network issues.
 			if time.Since(connectTime) < (globalNetPerfMinDuration - time.Second) {
 				logger.LogIf(ctx, err)
 			}
 		}
 		if err != nil {
 			if errors.Is(err, io.EOF) {
 				w.WriteHeader(http.StatusNoContent)
 			} else {
 				w.WriteHeader(http.StatusBadRequest)
 			}
 			break
 		}
 	}
 }
 // SiteReplicationNetPerf - everything goes to io.Discard
 // [POST] /minio/admin/v3/site-replication/netperf
 func (a adminAPIHandlers) SiteReplicationNetPerf(w http.ResponseWriter, r *http.Request) {
 	durationStr := r.Form.Get(peerRESTDuration)
 	duration, _ := time.ParseDuration(durationStr)
 	if duration < globalNetPerfMinDuration {
 		duration = globalNetPerfMinDuration
 	}
 	result := siteNetperf(r.Context(), duration)
 	logger.LogIf(r.Context(), gob.NewEncoder(w).Encode(result))
 }
@@ -27,12 +27,12 @@ import (
 	"context"
 	"fmt"
 	"runtime"
 	"sync"
 	"testing"
 	"time"
-	"github.com/minio/madmin-go"
+	"github.com/minio/madmin-go/v3"
 	minio "github.com/minio/minio-go/v7"
 	"github.com/minio/pkg/v2/sync/errgroup"
 )
 func runAllIAMConcurrencyTests(suite *TestSuiteIAM, c *check) {
@@ -129,18 +129,21 @@ func (s *TestSuiteIAM) TestDeleteUserRace(c *check) {
 		secretKeys[i] = secretKey
 	}
-	wg := sync.WaitGroup{}
+	g := errgroup.Group{}
 	for i := 0; i < userCount; i++ {
-		wg.Add(1)
+		g.Go(func(i int) func() error {
-		go func(i int) {
+			return func() error {
-			defer wg.Done()
+				uClient := s.getUserClient(c, accessKeys[i], secretKeys[i], "")
-			uClient := s.getUserClient(c, accessKeys[i], secretKeys[i], "")
+				err := s.adm.RemoveUser(ctx, accessKeys[i])
-			err := s.adm.RemoveUser(ctx, accessKeys[i])
+				if err != nil {
-			if err != nil {
+					return err
-				c.Fatalf("unable to remove user: %v", err)
+				}
 				c.mustNotListObjects(ctx, uClient, bucket)
 				return nil
 			}
-			c.mustNotListObjects(ctx, uClient, bucket)
+		}(i), i)
-		}(i)
+	}
 	if errs := g.Wait(); len(errs) > 0 {
 		c.Fatalf("unable to remove users: %v", errs)
 	}
 	wg.Wait()
 }
@@ -27,20 +27,19 @@ import (
 	"io"
 	"net/http"
 	"net/url"
 	"os"
 	"runtime"
 	"strings"
 	"testing"
 	"time"
-	"github.com/minio/madmin-go"
+	"github.com/minio/madmin-go/v3"
 	"github.com/minio/minio-go/v7"
 	"github.com/minio/minio-go/v7/pkg/credentials"
 	cr "github.com/minio/minio-go/v7/pkg/credentials"
 	"github.com/minio/minio-go/v7/pkg/s3utils"
 	"github.com/minio/minio-go/v7/pkg/set"
 	"github.com/minio/minio-go/v7/pkg/signer"
 	"github.com/minio/minio/internal/auth"
 	"github.com/minio/pkg/v2/env"
 )
 const (
@@ -122,7 +121,7 @@ var iamTestSuites = func() []*TestSuiteIAM {
 }()
 const (
-	EnvTestEtcdBackend = "ETCD_SERVER"
+	EnvTestEtcdBackend = "_MINIO_ETCD_TEST_SERVER"
 )
 func (s *TestSuiteIAM) setUpEtcd(c *check, etcdServer string) {
@@ -145,7 +144,7 @@ func (s *TestSuiteIAM) setUpEtcd(c *check, etcdServer string) {
 func (s *TestSuiteIAM) SetUpSuite(c *check) {
 	// If etcd backend is specified and etcd server is not present, the test
 	// is skipped.
-	etcdServer := os.Getenv(EnvTestEtcdBackend)
+	etcdServer := env.Get(EnvTestEtcdBackend, "")
 	if s.withEtcdBackend && etcdServer == "" {
 		c.Skip("Skipping etcd backend IAM test as no etcd server is configured.")
 	}
@@ -207,7 +206,9 @@ func TestIAMInternalIDPServerSuite(t *testing.T) {
 				suite.TestCannedPolicies(c)
 				suite.TestGroupAddRemove(c)
 				suite.TestServiceAccountOpsByAdmin(c)
 				suite.TestServiceAccountPrivilegeEscalationBug(c)
 				suite.TestServiceAccountOpsByUser(c)
 				suite.TestServiceAccountDurationSecondsCondition(c)
 				suite.TestAddServiceAccountPerms(c)
 				suite.TearDownSuite(c)
 			},
@@ -825,7 +826,7 @@ func (s *TestSuiteIAM) TestGroupAddRemove(c *check) {
 	if set.CreateStringSet(groups...).Contains(group) {
 		c.Fatalf("created group still present!")
 	}
-	groupInfo, err = s.adm.GetGroupDescription(ctx, group)
+	_, err = s.adm.GetGroupDescription(ctx, group)
 	if err == nil {
 		c.Fatalf("group appears to exist")
 	}
@@ -877,7 +878,7 @@ func (s *TestSuiteIAM) TestServiceAccountOpsByUser(c *check) {
 	// Create an madmin client with user creds
 	userAdmClient, err := madmin.NewWithOptions(s.endpoint, &madmin.Options{
-		Creds:  cr.NewStaticV4(accessKey, secretKey, ""),
+		Creds:  credentials.NewStaticV4(accessKey, secretKey, ""),
 		Secure: s.secure,
 	})
 	if err != nil {
@@ -897,14 +898,6 @@ func (s *TestSuiteIAM) TestServiceAccountOpsByUser(c *check) {
 	// 3. Check S3 access
 	c.assertSvcAccS3Access(ctx, s, cr, bucket)
 	// 4. Check that svc account can restrict the policy, and that the
 	// session policy can be updated.
 	c.assertSvcAccSessionPolicyUpdate(ctx, s, userAdmClient, accessKey, bucket)
 	// 4. Check that service account's secret key and account status can be
 	// updated.
 	c.assertSvcAccSecretKeyAndStatusUpdate(ctx, s, userAdmClient, accessKey, bucket)
 	// 5. Check that service account can be deleted.
 	c.assertSvcAccDeletion(ctx, s, userAdmClient, accessKey, bucket)
@@ -912,6 +905,93 @@ func (s *TestSuiteIAM) TestServiceAccountOpsByUser(c *check) {
 	c.mustNotCreateSvcAccount(ctx, globalActiveCred.AccessKey, userAdmClient)
 }
 func (s *TestSuiteIAM) TestServiceAccountDurationSecondsCondition(c *check) {
 	ctx, cancel := context.WithTimeout(context.Background(), testDefaultTimeout)
 	defer cancel()
 	bucket := getRandomBucketName()
 	err := s.client.MakeBucket(ctx, bucket, minio.MakeBucketOptions{})
 	if err != nil {
 		c.Fatalf("bucket creat error: %v", err)
 	}
 	// Create policy, user and associate policy
 	policy := "mypolicy"
 	policyBytes := []byte(fmt.Sprintf(`{
 "Version": "2012-10-17",
 "Statement": [
  {
   "Effect": "Deny",
   "Action": [
     "admin:CreateServiceAccount",
     "admin:UpdateServiceAccount"
   ],
   "Condition": {"NumericGreaterThan": {"svc:DurationSeconds": "3600"}}
  },
  {
   "Effect": "Allow",
   "Action": [
    "s3:PutObject",
    "s3:GetObject",
    "s3:ListBucket"
   ],
   "Resource": [
    "arn:aws:s3:::%s/*"
   ]
  }
 ]
 }`, bucket))
 	err = s.adm.AddCannedPolicy(ctx, policy, policyBytes)
 	if err != nil {
 		c.Fatalf("policy add error: %v", err)
 	}
 	accessKey, secretKey := mustGenerateCredentials(c)
 	err = s.adm.SetUser(ctx, accessKey, secretKey, madmin.AccountEnabled)
 	if err != nil {
 		c.Fatalf("Unable to set user: %v", err)
 	}
 	err = s.adm.SetPolicy(ctx, policy, accessKey, false)
 	if err != nil {
 		c.Fatalf("Unable to set policy: %v", err)
 	}
 	// Create an madmin client with user creds
 	userAdmClient, err := madmin.NewWithOptions(s.endpoint, &madmin.Options{
 		Creds:  credentials.NewStaticV4(accessKey, secretKey, ""),
 		Secure: s.secure,
 	})
 	if err != nil {
 		c.Fatalf("Err creating user admin client: %v", err)
 	}
 	userAdmClient.SetCustomTransport(s.TestSuiteCommon.client.Transport)
 	distantExpiration := time.Now().Add(30 * time.Minute)
 	cr, err := userAdmClient.AddServiceAccount(ctx, madmin.AddServiceAccountReq{
 		TargetUser: accessKey,
 		AccessKey:  "svc-accesskey",
 		SecretKey:  "svc-secretkey",
 		Expiration: &distantExpiration,
 	})
 	if err != nil {
 		c.Fatalf("Unable to create svc acc: %v", err)
 	}
 	c.assertSvcAccS3Access(ctx, s, cr, bucket)
 	closeExpiration := time.Now().Add(2 * time.Hour)
 	_, err = userAdmClient.AddServiceAccount(ctx, madmin.AddServiceAccountReq{
 		TargetUser: accessKey,
 		AccessKey:  "svc-accesskey",
 		SecretKey:  "svc-secretkey",
 		Expiration: &closeExpiration,
 	})
 	if err == nil {
 		c.Fatalf("Creating a svc acc with distant expiration should fail")
 	}
 }
 func (s *TestSuiteIAM) TestServiceAccountOpsByAdmin(c *check) {
 	ctx, cancel := context.WithTimeout(context.Background(), testDefaultTimeout)
 	defer cancel()
@@ -980,13 +1060,102 @@ func (s *TestSuiteIAM) TestServiceAccountOpsByAdmin(c *check) {
 	c.assertSvcAccDeletion(ctx, s, s.adm, accessKey, bucket)
 }
 func (s *TestSuiteIAM) TestServiceAccountPrivilegeEscalationBug(c *check) {
 	ctx, cancel := context.WithTimeout(context.Background(), testDefaultTimeout)
 	defer cancel()
 	err := s.client.MakeBucket(ctx, "public", minio.MakeBucketOptions{})
 	if err != nil {
 		c.Fatalf("bucket creat error: %v", err)
 	}
 	err = s.client.MakeBucket(ctx, "private", minio.MakeBucketOptions{})
 	if err != nil {
 		c.Fatalf("bucket creat error: %v", err)
 	}
 	pubPolicyBytes := []byte(`{
 "Version": "2012-10-17",
 "Statement": [
  {
   "Effect": "Allow",
   "Action": [
    "s3:*"
   ],
   "Resource": [
    "arn:aws:s3:::public",
    "arn:aws:s3:::public/*"
   ]
  }
 ]
 }`)
 	fullS3PolicyBytes := []byte(`{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:*"
      ],
      "Resource": [
        "arn:aws:s3:::*"
      ]
    }
  ]
 }
 `)
 	// Create a service account for the root user.
 	cr, err := s.adm.AddServiceAccount(ctx, madmin.AddServiceAccountReq{
 		TargetUser: globalActiveCred.AccessKey,
 		Policy:     pubPolicyBytes,
 	})
 	if err != nil {
 		c.Fatalf("admin should be able to create service account for themselves %s", err)
 	}
 	svcClient := s.getUserClient(c, cr.AccessKey, cr.SecretKey, "")
 	// Check that the service account can access the public bucket.
 	buckets, err := svcClient.ListBuckets(ctx)
 	if err != nil {
 		c.Fatalf("err fetching buckets %s", err)
 	}
 	if len(buckets) != 1 || buckets[0].Name != "public" {
 		c.Fatalf("service account should only have access to public bucket")
 	}
 	// Create an madmin client with the service account creds.
 	svcAdmClient, err := madmin.NewWithOptions(s.endpoint, &madmin.Options{
 		Creds:  credentials.NewStaticV4(cr.AccessKey, cr.SecretKey, ""),
 		Secure: s.secure,
 	})
 	if err != nil {
 		c.Fatalf("Err creating svcacct admin client: %v", err)
 	}
 	svcAdmClient.SetCustomTransport(s.TestSuiteCommon.client.Transport)
 	// Attempt to update the policy on the service account.
 	err = svcAdmClient.UpdateServiceAccount(ctx, cr.AccessKey,
 		madmin.UpdateServiceAccountReq{
 			NewPolicy: fullS3PolicyBytes,
 		})
 	if err == nil {
 		c.Fatalf("service account should not be able to update policy on itself")
 	} else if !strings.Contains(err.Error(), "Access Denied") {
 		c.Fatalf("unexpected error: %v", err)
 	}
 }
 func (s *TestSuiteIAM) SetUpAccMgmtPlugin(c *check) {
 	ctx, cancel := context.WithTimeout(context.Background(), testDefaultTimeout)
 	defer cancel()
-	pluginEndpoint := os.Getenv("POLICY_PLUGIN_ENDPOINT")
+	pluginEndpoint := env.Get("_MINIO_POLICY_PLUGIN_ENDPOINT", "")
 	if pluginEndpoint == "" {
-		c.Skip("POLICY_PLUGIN_ENDPOINT not given - skipping.")
+		c.Skip("_MINIO_POLICY_PLUGIN_ENDPOINT not given - skipping.")
 	}
 	configCmds := []string{
@@ -1072,7 +1241,7 @@ func (s *TestSuiteIAM) TestAccMgmtPlugin(c *check) {
 	// Create an madmin client with user creds
 	userAdmClient, err := madmin.NewWithOptions(s.endpoint, &madmin.Options{
-		Creds:  cr.NewStaticV4(accessKey, secretKey, ""),
+		Creds:  credentials.NewStaticV4(accessKey, secretKey, ""),
 		Secure: s.secure,
 	})
 	if err != nil {
@@ -1136,7 +1305,7 @@ func (s *TestSuiteIAM) TestAccMgmtPlugin(c *check) {
 	c.assertSvcAccDeletion(ctx, s, userAdmClient, accessKey, bucket)
 	// 6. Check that service account **can** be created for some other user.
-	// This is possible because of the policy enforced in the plugin.
+	// This is possible because the policy enforced in the plugin.
 	c.mustCreateSvcAccount(ctx, globalActiveCred.AccessKey, userAdmClient)
 }
@@ -1261,6 +1430,52 @@ func (c *check) mustListBuckets(ctx context.Context, client *minio.Client) {
 	}
 }
 func (c *check) mustNotDelete(ctx context.Context, client *minio.Client, bucket string, vid string) {
 	c.Helper()
 	err := client.RemoveObject(ctx, bucket, "some-object", minio.RemoveObjectOptions{VersionID: vid})
 	if err == nil {
 		c.Fatalf("user must not be allowed to delete")
 	}
 	err = client.RemoveObject(ctx, bucket, "some-object", minio.RemoveObjectOptions{})
 	if err != nil {
 		c.Fatal("user must be able to create delete marker")
 	}
 }
 func (c *check) mustDownload(ctx context.Context, client *minio.Client, bucket string) {
 	c.Helper()
 	rd, err := client.GetObject(ctx, bucket, "some-object", minio.GetObjectOptions{})
 	if err != nil {
 		c.Fatalf("download did not succeed got %#v", err)
 	}
 	if _, err = io.Copy(io.Discard, rd); err != nil {
 		c.Fatalf("download did not succeed got %#v", err)
 	}
 }
 func (c *check) mustUploadReturnVersions(ctx context.Context, client *minio.Client, bucket string) []string {
 	c.Helper()
 	versions := []string{}
 	for i := 0; i < 5; i++ {
 		ui, err := client.PutObject(ctx, bucket, "some-object", bytes.NewBuffer([]byte("stuff")), 5, minio.PutObjectOptions{})
 		if err != nil {
 			c.Fatalf("upload did not succeed got %#v", err)
 		}
 		versions = append(versions, ui.VersionID)
 	}
 	return versions
 }
 func (c *check) mustUpload(ctx context.Context, client *minio.Client, bucket string) {
 	c.Helper()
 	_, err := client.PutObject(ctx, bucket, "some-object", bytes.NewBuffer([]byte("stuff")), 5, minio.PutObjectOptions{})
 	if err != nil {
 		c.Fatalf("upload did not succeed got %#v", err)
 	}
 }
 func (c *check) mustNotUpload(ctx context.Context, client *minio.Client, bucket string) {
 	c.Helper()
 	_, err := client.PutObject(ctx, bucket, "some-object", bytes.NewBuffer([]byte("stuff")), 5, minio.PutObjectOptions{})
@@ -1283,7 +1498,11 @@ func (c *check) assertSvcAccAppearsInListing(ctx context.Context, madmClient *ma
 	if err != nil {
 		c.Fatalf("unable to list svc accounts: %v", err)
 	}
-	if !set.CreateStringSet(listResp.Accounts...).Contains(svcAK) {
+	var accessKeys []string
 	for _, item := range listResp.Accounts {
 		accessKeys = append(accessKeys, item.AccessKey)
 	}
 	if !set.CreateStringSet(accessKeys...).Contains(svcAK) {
 		c.Fatalf("service account did not appear in listing!")
 	}
 }
@@ -21,17 +21,19 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
 	"fmt"
 	"io"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
 	"sort"
 	"sync"
 	"testing"
 	"time"
-	"github.com/gorilla/mux"
+	"github.com/minio/madmin-go/v3"
 	"github.com/minio/madmin-go"
 	"github.com/minio/minio/internal/auth"
 	"github.com/minio/mux"
 )
 // adminErasureTestBed - encapsulates subsystems that need to be setup for
@@ -71,7 +73,7 @@ func prepareAdminErasureTestBed(ctx context.Context) (*adminErasureTestBed, erro
 	// Initialize boot time
 	globalBootTime = UTCNow()
-	globalEndpoints = mustGetPoolEndpoints(erasureDirs...)
+	globalEndpoints = mustGetPoolEndpoints(0, erasureDirs...)
 	initAllSubsystems(ctx)
@@ -106,7 +108,7 @@ func initTestErasureObjLayer(ctx context.Context) (ObjectLayer, []string, error)
 	if err != nil {
 		return nil, nil, err
 	}
-	endpoints := mustGetPoolEndpoints(erasureDirs...)
+	endpoints := mustGetPoolEndpoints(0, erasureDirs...)
 	globalPolicySys = NewPolicySys()
 	objLayer, err := newErasureServerPools(ctx, endpoints)
 	if err != nil {
@@ -166,6 +168,7 @@ func testServiceSignalReceiver(cmd cmdType, t *testing.T) {
 func getServiceCmdRequest(cmd cmdType, cred auth.Credentials) (*http.Request, error) {
 	queryVal := url.Values{}
 	queryVal.Set("action", string(cmd.toServiceAction()))
 	queryVal.Set("type", "2")
 	resource := adminPathPrefix + adminAPIVersionPrefix + "/service?" + queryVal.Encode()
 	req, err := newTestRequest(http.MethodPost, resource, 0, nil)
 	if err != nil {
@@ -218,12 +221,18 @@ func testServicesCmdHandler(cmd cmdType, t *testing.T) {
 	rec := httptest.NewRecorder()
 	adminTestBed.router.ServeHTTP(rec, req)
 	resp, _ := io.ReadAll(rec.Body)
 	if rec.Code != http.StatusOK {
 		resp, _ := io.ReadAll(rec.Body)
 		t.Errorf("Expected to receive %d status code but received %d. Body (%s)",
 			http.StatusOK, rec.Code, string(resp))
 	}
 	result := &serviceResult{}
 	if err := json.Unmarshal(resp, result); err != nil {
 		t.Error(err)
 	}
 	_ = result
 	// Wait until testServiceSignalReceiver() called in a goroutine quits.
 	wg.Wait()
 }
@@ -339,7 +348,7 @@ func TestExtractHealInitParams(t *testing.T) {
 		}
 		return v
 	}
-	qParmsArr := []url.Values{
+	qParamsArr := []url.Values{
 		// Invalid cases
 		mkParams("", true, true),
 		mkParams("111", true, true),
@@ -364,9 +373,9 @@ func TestExtractHealInitParams(t *testing.T) {
 	body := `{"recursive": false, "dryRun": true, "remove": false, "scanMode": 0}`
 	// Test all combinations!
-	for pIdx, parms := range qParmsArr {
+	for pIdx, params := range qParamsArr {
 		for vIdx, vars := range varsArr {
-			_, err := extractHealInitParams(vars, parms, bytes.NewReader([]byte(body)))
+			_, err := extractHealInitParams(vars, params, bytes.NewReader([]byte(body)))
 			isErrCase := false
 			if pIdx < 4 || vIdx < 1 {
 				isErrCase = true
@@ -380,3 +389,146 @@ func TestExtractHealInitParams(t *testing.T) {
 		}
 	}
 }
 type byResourceUID struct{ madmin.LockEntries }
 func (b byResourceUID) Less(i, j int) bool {
 	toUniqLock := func(entry madmin.LockEntry) string {
 		return fmt.Sprintf("%s/%s", entry.Resource, entry.ID)
 	}
 	return toUniqLock(b.LockEntries[i]) < toUniqLock(b.LockEntries[j])
 }
 func TestTopLockEntries(t *testing.T) {
 	locksHeld := make(map[string][]lockRequesterInfo)
 	var owners []string
 	for i := 0; i < 4; i++ {
 		owners = append(owners, fmt.Sprintf("node-%d", i))
 	}
 	// Simulate DeleteObjects of 10 objects in a single request. i.e same lock
 	// request UID, but 10 different resource names associated with it.
 	var lris []lockRequesterInfo
 	uuid := mustGetUUID()
 	for i := 0; i < 10; i++ {
 		resource := fmt.Sprintf("bucket/delete-object-%d", i)
 		lri := lockRequesterInfo{
 			Name:   resource,
 			Writer: true,
 			UID:    uuid,
 			Owner:  owners[i%len(owners)],
 			Group:  true,
 			Quorum: 3,
 		}
 		lris = append(lris, lri)
 		locksHeld[resource] = []lockRequesterInfo{lri}
 	}
 	// Add a few concurrent read locks to the mix
 	for i := 0; i < 50; i++ {
 		resource := fmt.Sprintf("bucket/get-object-%d", i)
 		lri := lockRequesterInfo{
 			Name:   resource,
 			UID:    mustGetUUID(),
 			Owner:  owners[i%len(owners)],
 			Quorum: 2,
 		}
 		lris = append(lris, lri)
 		locksHeld[resource] = append(locksHeld[resource], lri)
 		// concurrent read lock, same resource different uid
 		lri.UID = mustGetUUID()
 		lris = append(lris, lri)
 		locksHeld[resource] = append(locksHeld[resource], lri)
 	}
 	var peerLocks []*PeerLocks
 	for _, owner := range owners {
 		peerLocks = append(peerLocks, &PeerLocks{
 			Addr:  owner,
 			Locks: locksHeld,
 		})
 	}
 	var exp madmin.LockEntries
 	for _, lri := range lris {
 		lockType := func(lri lockRequesterInfo) string {
 			if lri.Writer {
 				return "WRITE"
 			}
 			return "READ"
 		}
 		exp = append(exp, madmin.LockEntry{
 			Resource:   lri.Name,
 			Type:       lockType(lri),
 			ServerList: owners,
 			Owner:      lri.Owner,
 			ID:         lri.UID,
 			Quorum:     lri.Quorum,
 		})
 	}
 	testCases := []struct {
 		peerLocks []*PeerLocks
 		expected  madmin.LockEntries
 	}{
 		{
 			peerLocks: peerLocks,
 			expected:  exp,
 		},
 	}
 	// printEntries := func(entries madmin.LockEntries) {
 	// 	for i, entry := range entries {
 	// 		fmt.Printf("%d: %s %s %s %s %v %d\n", i, entry.Resource, entry.ID, entry.Owner, entry.Type, entry.ServerList, entry.Elapsed)
 	// 	}
 	// }
 	check := func(exp, got madmin.LockEntries) (int, bool) {
 		if len(exp) != len(got) {
 			return 0, false
 		}
 		sort.Slice(exp, byResourceUID{exp}.Less)
 		sort.Slice(got, byResourceUID{got}.Less)
 		// printEntries(exp)
 		// printEntries(got)
 		for i, e := range exp {
 			if !e.Timestamp.Equal(got[i].Timestamp) {
 				return i, false
 			}
 			// Skip checking elapsed since it's time sensitive.
 			// if e.Elapsed != got[i].Elapsed {
 			// 	return false
 			// }
 			if e.Resource != got[i].Resource {
 				return i, false
 			}
 			if e.Type != got[i].Type {
 				return i, false
 			}
 			if e.Source != got[i].Source {
 				return i, false
 			}
 			if e.Owner != got[i].Owner {
 				return i, false
 			}
 			if e.ID != got[i].ID {
 				return i, false
 			}
 			if len(e.ServerList) != len(got[i].ServerList) {
 				return i, false
 			}
 			for j := range e.ServerList {
 				if e.ServerList[j] != got[i].ServerList[j] {
 					return i, false
 				}
 			}
 		}
 		return 0, true
 	}
 	for i, tc := range testCases {
 		got := topLockEntries(tc.peerLocks, false)
 		if idx, ok := check(tc.expected, got); !ok {
 			t.Fatalf("%d: mismatch at %d \n expected %#v but got %#v", i, idx, tc.expected[idx], got[idx])
 		}
 	}
 }
@@ -27,7 +27,8 @@ import (
 	"sync"
 	"time"
-	"github.com/minio/madmin-go"
+	"github.com/minio/madmin-go/v3"
 	xioutil "github.com/minio/minio/internal/ioutil"
 	"github.com/minio/minio/internal/logger"
 )
@@ -132,7 +133,13 @@ func (ahs *allHealState) popHealLocalDisks(healLocalDisks ...Endpoint) {
 func (ahs *allHealState) updateHealStatus(tracker *healingTracker) {
 	ahs.Lock()
 	defer ahs.Unlock()
-	ahs.healStatus[tracker.ID] = *tracker
+
 	tracker.mu.RLock()
 	t := *tracker
 	t.QueuedBuckets = append(make([]string, 0, len(tracker.QueuedBuckets)), tracker.QueuedBuckets...)
 	t.HealedBuckets = append(make([]string, 0, len(tracker.HealedBuckets)), tracker.HealedBuckets...)
 	ahs.healStatus[tracker.ID] = t
 	tracker.mu.RUnlock()
 }
 // Sort by zone, set and disk index
@@ -176,11 +183,12 @@ func (ahs *allHealState) getHealLocalDiskEndpoints() Endpoints {
 	return endpoints
 }
-func (ahs *allHealState) markDiskForHealing(ep Endpoint) {
+// Set, in the memory, the state of the disk as currently healing or not
 func (ahs *allHealState) setDiskHealingStatus(ep Endpoint, healing bool) {
 	ahs.Lock()
 	defer ahs.Unlock()
-	ahs.healLocalDisks[ep] = true
+	ahs.healLocalDisks[ep] = healing
 }
 func (ahs *allHealState) pushHealLocalDisks(healLocalDisks ...Endpoint) {
@@ -222,8 +230,8 @@ func (ahs *allHealState) periodicHealSeqsClean(ctx context.Context) {
 // getHealSequenceByToken - Retrieve a heal sequence by token. The second
 // argument returns if a heal sequence actually exists.
 func (ahs *allHealState) getHealSequenceByToken(token string) (h *healSequence, exists bool) {
-	ahs.Lock()
+	ahs.RLock()
-	defer ahs.Unlock()
+	defer ahs.RUnlock()
 	for _, healSeq := range ahs.healSeqMap {
 		if healSeq.clientToken == token {
 			return healSeq, true
@@ -235,8 +243,8 @@ func (ahs *allHealState) getHealSequenceByToken(token string) (h *healSequence,
 // getHealSequence - Retrieve a heal sequence by path. The second
 // argument returns if a heal sequence actually exists.
 func (ahs *allHealState) getHealSequence(path string) (h *healSequence, exists bool) {
-	ahs.Lock()
+	ahs.RLock()
-	defer ahs.Unlock()
+	defer ahs.RUnlock()
 	h, exists = ahs.healSeqMap[path]
 	return h, exists
 }
@@ -252,7 +260,7 @@ func (ahs *allHealState) stopHealSequence(path string) ([]byte, APIError) {
 	} else {
 		clientToken := he.clientToken
 		if globalIsDistErasure {
-			clientToken = fmt.Sprintf("%s@%d", he.clientToken, GetProxyEndpointLocalIndex(globalProxyEndpoints))
+			clientToken = fmt.Sprintf("%s:%d", he.clientToken, GetProxyEndpointLocalIndex(globalProxyEndpoints))
 		}
 		hsp = madmin.HealStopSuccess{
@@ -326,7 +334,7 @@ func (ahs *allHealState) LaunchNewHealSequence(h *healSequence, objAPI ObjectLay
 	clientToken := h.clientToken
 	if globalIsDistErasure {
-		clientToken = fmt.Sprintf("%s@%d", h.clientToken, GetProxyEndpointLocalIndex(globalProxyEndpoints))
+		clientToken = fmt.Sprintf("%s:%d", h.clientToken, GetProxyEndpointLocalIndex(globalProxyEndpoints))
 	}
 	b, err := json.Marshal(madmin.HealStartSuccess{
@@ -396,6 +404,7 @@ type healSource struct {
 	bucket    string
 	object    string
 	versionID string
 	noWait    bool             // a non blocking call, if task queue is full return right away.
 	opts      *madmin.HealOpts // optional heal option overrides default setting
 }
@@ -405,9 +414,6 @@ type healSequence struct {
 	// bucket, and object on which heal seq. was initiated
 	bucket, object string
 	// A channel of entities with heal result
 	respCh chan healResult
 	// Report healing progress
 	reportProgress bool
@@ -470,7 +476,6 @@ func newHealSequence(ctx context.Context, bucket, objPrefix, clientAddr string,
 	clientToken := mustGetUUID()
 	return &healSequence{
 		respCh:         make(chan healResult),
 		bucket:         bucket,
 		object:         objPrefix,
 		reportProgress: true,
@@ -685,13 +690,6 @@ func (h *healSequence) healSequenceStart(objAPI ObjectLayer) {
 	}
 }
 func (h *healSequence) logHeal(healType madmin.HealItemType) {
 	h.mutex.Lock()
 	h.scannedItemsMap[healType]++
 	h.lastHealActivity = UTCNow()
 	h.mutex.Unlock()
 }
 func (h *healSequence) queueHealTask(source healSource, healType madmin.HealItemType) error {
 	// Send heal request
 	task := healTask{
@@ -699,7 +697,6 @@ func (h *healSequence) queueHealTask(source healSource, healType madmin.HealItem
 		object:    source.object,
 		versionID: source.versionID,
 		opts:      h.settings,
 		respCh:    h.respCh,
 	}
 	if source.opts != nil {
 		task.opts = *source.opts
@@ -712,17 +709,36 @@ func (h *healSequence) queueHealTask(source healSource, healType madmin.HealItem
 	h.lastHealActivity = UTCNow()
 	h.mutex.Unlock()
 	if source.noWait {
 		select {
 		case globalBackgroundHealRoutine.tasks <- task:
 			if serverDebugLog {
 				fmt.Printf("Task in the queue: %#v\n", task)
 			}
 		default:
 			// task queue is full, no more workers, we shall move on and heal later.
 			return nil
 		}
 		// Don't wait for result
 		return nil
 	}
 	// respCh must be set to wait for result.
 	// We make it size 1, so a result can always be written
 	// even if we aren't listening.
 	task.respCh = make(chan healResult, 1)
 	select {
 	case globalBackgroundHealRoutine.tasks <- task:
 		if serverDebugLog {
-			logger.Info("Task in the queue: %#v", task)
+			fmt.Printf("Task in the queue: %#v\n", task)
 		}
 	case <-h.ctx.Done():
 		return nil
 	}
 	// task queued, now wait for the response.
 	select {
-	case res := <-h.respCh:
+	case res := <-task.respCh:
 		if !h.reportProgress {
 			if errors.Is(res.err, errSkipFile) { // this is only sent usually by nopHeal
 				return nil
@@ -768,6 +784,11 @@ func (h *healSequence) healDiskMeta(objAPI ObjectLayer) error {
 }
 func (h *healSequence) healItems(objAPI ObjectLayer, bucketsOnly bool) error {
 	if h.clientToken == bgHealingUUID {
 		// For background heal do nothing.
 		return nil
 	}
 	if err := h.healDiskMeta(objAPI); err != nil {
 		return err
 	}
@@ -786,7 +807,7 @@ func (h *healSequence) healItems(objAPI ObjectLayer, bucketsOnly bool) error {
 func (h *healSequence) traverseAndHeal(objAPI ObjectLayer) {
 	bucketsOnly := false // Heals buckets and objects also.
 	h.traverseAndHealDoneCh <- h.healItems(objAPI, bucketsOnly)
-	close(h.traverseAndHealDoneCh)
+	xioutil.SafeClose(h.traverseAndHealDoneCh)
 }
 // healMinioSysMeta - heals all files under a given meta prefix, returns a function
@@ -796,7 +817,7 @@ func (h *healSequence) healMinioSysMeta(objAPI ObjectLayer, metaPrefix string) f
 		// NOTE: Healing on meta is run regardless
 		// of any bucket being selected, this is to ensure that
 		// meta are always upto date and correct.
-		return objAPI.HealObjects(h.ctx, minioMetaBucket, metaPrefix, h.settings, func(bucket, object, versionID string) error {
+		return objAPI.HealObjects(h.ctx, minioMetaBucket, metaPrefix, h.settings, func(bucket, object, versionID string, scanMode madmin.HealScanMode) error {
 			if h.isQuitting() {
 				return errHealStopSignalled
 			}
@@ -853,13 +874,8 @@ func (h *healSequence) healBucket(objAPI ObjectLayer, bucket string, bucketsOnly
 	if !h.settings.Recursive {
 		if h.object != "" {
-			// Check if an object named as the objPrefix exists,
+			if err := h.healObject(bucket, h.object, "", h.settings.ScanMode); err != nil {
-			// and if so heal it.
+				return err
 			oi, err := objAPI.GetObjectInfo(h.ctx, bucket, h.object, ObjectOptions{})
 			if err == nil {
 				if err = h.healObject(bucket, h.object, oi.VersionID); err != nil {
 					return err
 				}
 			}
 		}
@@ -873,7 +889,7 @@ func (h *healSequence) healBucket(objAPI ObjectLayer, bucket string, bucketsOnly
 }
 // healObject - heal the given object and record result
-func (h *healSequence) healObject(bucket, object, versionID string) error {
+func (h *healSequence) healObject(bucket, object, versionID string, scanMode madmin.HealScanMode) error {
 	if h.isQuitting() {
 		return errHealStopSignalled
 	}
@@ -20,19 +20,117 @@ package cmd
 import (
 	"net/http"
 	"github.com/gorilla/mux"
 	"github.com/klauspost/compress/gzhttp"
 	"github.com/klauspost/compress/gzip"
-	"github.com/minio/madmin-go"
+	"github.com/minio/madmin-go/v3"
 	"github.com/minio/minio/internal/logger"
 	"github.com/minio/mux"
 )
 const (
-	adminPathPrefix       = minioReservedBucketPath + "/admin"
+	adminPathPrefix                = minioReservedBucketPath + "/admin"
-	adminAPIVersion       = madmin.AdminAPIVersion
+	adminAPIVersion                = madmin.AdminAPIVersion
-	adminAPIVersionPrefix = SlashSeparator + adminAPIVersion
+	adminAPIVersionPrefix          = SlashSeparator + adminAPIVersion
 	adminAPISiteReplicationDevNull = "/site-replication/devnull"
 	adminAPISiteReplicationNetPerf = "/site-replication/netperf"
 	adminAPIClientDevNull          = "/speedtest/client/devnull"
 	adminAPIClientDevExtraTime     = "/speedtest/client/devnull/extratime"
 )
 var gzipHandler = func() func(http.Handler) http.HandlerFunc {
 	gz, err := gzhttp.NewWrapper(gzhttp.MinSize(1000), gzhttp.CompressionLevel(gzip.BestSpeed))
 	if err != nil {
 		// Static params, so this is very unlikely.
 		logger.Fatal(err, "Unable to initialize server")
 	}
 	return gz
 }()
 // Set of handler options as bit flags
 type hFlag uint8
 const (
 	// this flag disables gzip compression of responses
 	noGZFlag = 1 << iota
 	// this flag enables tracing body and headers instead of just headers
 	traceAllFlag
 	// pass this flag to skip checking if object layer is available
 	noObjLayerFlag
 )
 // Has checks if the the given flag is enabled in `h`.
 func (h hFlag) Has(flag hFlag) bool {
 	// Use bitwise-AND and check if the result is non-zero.
 	return h&flag != 0
 }
 // adminMiddleware performs some common admin handler functionality for all
 // handlers:
 //
 // - updates request context with `logger.ReqInfo` and api name based on the
 // name of the function handler passed (this handler must be a method of
 // `adminAPIHandlers`).
 //
 // - sets up call to send AuditLog
 //
 // While this is a middleware function (i.e. it takes a handler function and
 // returns one), due to flags being passed based on required conditions, it is
 // done per-"handler function registration" in the router.
 //
 // The passed in handler function must be a method of `adminAPIHandlers` for the
 // name displayed in logs and trace to be accurate. The name is extracted via
 // reflection.
 //
 // When no flags are passed, gzip compression, http tracing of headers and
 // checking of object layer availability are all enabled. Use flags to modify
 // this behavior.
 func adminMiddleware(f http.HandlerFunc, flags ...hFlag) http.HandlerFunc {
 	// Collect all flags with bitwise-OR and assign operator
 	var handlerFlags hFlag
 	for _, flag := range flags {
 		handlerFlags |= flag
 	}
 	// Get name of the handler using reflection.
 	handlerName := getHandlerName(f, "adminAPIHandlers")
 	var handler http.HandlerFunc = func(w http.ResponseWriter, r *http.Request) {
 		// Update request context with `logger.ReqInfo`.
 		r = r.WithContext(newContext(r, w, handlerName))
 		defer logger.AuditLog(r.Context(), w, r, mustGetClaimsFromToken(r))
 		// Check if object layer is available, if not return error early.
 		if !handlerFlags.Has(noObjLayerFlag) {
 			objectAPI := newObjectLayerFn()
 			if objectAPI == nil || globalNotificationSys == nil {
 				writeErrorResponseJSON(r.Context(), w, errorCodes.ToAPIErr(ErrServerNotInitialized), r.URL)
 				return
 			}
 		}
 		// Apply http tracing "middleware" based on presence of flag.
 		var f2 http.HandlerFunc
 		if handlerFlags.Has(traceAllFlag) {
 			f2 = httpTraceAll(f)
 		} else {
 			f2 = httpTraceHdrs(f)
 		}
 		// call the final handler
 		f2(w, r)
 	}
 	// Enable compression of responses based on presence of flag.
 	if !handlerFlags.Has(noGZFlag) {
 		handler = gzipHandler(handler)
 	}
 	return handler
 }
 // adminAPIHandlers provides HTTP handlers for MinIO admin API.
 type adminAPIHandlers struct{}
@@ -46,244 +144,278 @@ func registerAdminRouter(router *mux.Router, enableConfigOps bool) {
 		adminAPIVersionPrefix,
 	}
 	gz, err := gzhttp.NewWrapper(gzhttp.MinSize(1000), gzhttp.CompressionLevel(gzip.BestSpeed))
 	if err != nil {
 		// Static params, so this is very unlikely.
 		logger.Fatal(err, "Unable to initialize server")
 	}
 	for _, adminVersion := range adminVersions {
-		// Restart and stop MinIO service.
+		// Restart and stop MinIO service type=2
-		adminRouter.Methods(http.MethodPost).Path(adminVersion+"/service").HandlerFunc(gz(httpTraceAll(adminAPI.ServiceHandler))).Queries("action", "{action:.*}")
+		adminRouter.Methods(http.MethodPost).Path(adminVersion+"/service").HandlerFunc(adminMiddleware(adminAPI.ServiceV2Handler, traceAllFlag)).Queries("action", "{action:.*}", "type", "2")
-		// Update MinIO servers.
+
-		adminRouter.Methods(http.MethodPost).Path(adminVersion+"/update").HandlerFunc(gz(httpTraceAll(adminAPI.ServerUpdateHandler))).Queries("updateURL", "{updateURL:.*}")
+		// Deprecated: Restart and stop MinIO service.
 		adminRouter.Methods(http.MethodPost).Path(adminVersion+"/service").HandlerFunc(adminMiddleware(adminAPI.ServiceHandler, traceAllFlag)).Queries("action", "{action:.*}")
 		// Update all MinIO servers type=2
 		adminRouter.Methods(http.MethodPost).Path(adminVersion+"/update").HandlerFunc(adminMiddleware(adminAPI.ServerUpdateV2Handler, traceAllFlag)).Queries("updateURL", "{updateURL:.*}", "type", "2")
 		// Deprecated: Update MinIO servers.
 		adminRouter.Methods(http.MethodPost).Path(adminVersion+"/update").HandlerFunc(adminMiddleware(adminAPI.ServerUpdateHandler, traceAllFlag)).Queries("updateURL", "{updateURL:.*}")
 		// Info operations
-		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/info").HandlerFunc(gz(httpTraceAll(adminAPI.ServerInfoHandler)))
+		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/info").HandlerFunc(adminMiddleware(adminAPI.ServerInfoHandler, traceAllFlag, noObjLayerFlag))
-		adminRouter.Methods(http.MethodGet).Path(adminVersion+"/inspect-data").HandlerFunc(httpTraceHdrs(adminAPI.InspectDataHandler)).Queries("volume", "{volume:.*}", "file", "{file:.*}")
+		adminRouter.Methods(http.MethodGet, http.MethodPost).Path(adminVersion + "/inspect-data").HandlerFunc(adminMiddleware(adminAPI.InspectDataHandler, noGZFlag, traceAllFlag))
 		// StorageInfo operations
-		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/storageinfo").HandlerFunc(gz(httpTraceAll(adminAPI.StorageInfoHandler)))
+		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/storageinfo").HandlerFunc(adminMiddleware(adminAPI.StorageInfoHandler, traceAllFlag))
 		// DataUsageInfo operations
-		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/datausageinfo").HandlerFunc(gz(httpTraceAll(adminAPI.DataUsageInfoHandler)))
+		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/datausageinfo").HandlerFunc(adminMiddleware(adminAPI.DataUsageInfoHandler, traceAllFlag))
 		// Metrics operation
-		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/metrics").HandlerFunc(gz(httpTraceAll(adminAPI.MetricsHandler)))
+		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/metrics").HandlerFunc(adminMiddleware(adminAPI.MetricsHandler, traceAllFlag))
 		if globalIsDistErasure || globalIsErasure {
 			// Heal operations
 			// Heal processing endpoint.
-			adminRouter.Methods(http.MethodPost).Path(adminVersion + "/heal/").HandlerFunc(gz(httpTraceAll(adminAPI.HealHandler)))
+			adminRouter.Methods(http.MethodPost).Path(adminVersion + "/heal/").HandlerFunc(adminMiddleware(adminAPI.HealHandler, traceAllFlag))
-			adminRouter.Methods(http.MethodPost).Path(adminVersion + "/heal/{bucket}").HandlerFunc(gz(httpTraceAll(adminAPI.HealHandler)))
+			adminRouter.Methods(http.MethodPost).Path(adminVersion + "/heal/{bucket}").HandlerFunc(adminMiddleware(adminAPI.HealHandler, traceAllFlag))
-			adminRouter.Methods(http.MethodPost).Path(adminVersion + "/heal/{bucket}/{prefix:.*}").HandlerFunc(gz(httpTraceAll(adminAPI.HealHandler)))
+			adminRouter.Methods(http.MethodPost).Path(adminVersion + "/heal/{bucket}/{prefix:.*}").HandlerFunc(adminMiddleware(adminAPI.HealHandler, traceAllFlag))
-			adminRouter.Methods(http.MethodPost).Path(adminVersion + "/background-heal/status").HandlerFunc(gz(httpTraceAll(adminAPI.BackgroundHealStatusHandler)))
+			adminRouter.Methods(http.MethodPost).Path(adminVersion + "/background-heal/status").HandlerFunc(adminMiddleware(adminAPI.BackgroundHealStatusHandler, traceAllFlag))
 			// Pool operations
-			adminRouter.Methods(http.MethodGet).Path(adminVersion + "/pools/list").HandlerFunc(gz(httpTraceAll(adminAPI.ListPools)))
+			adminRouter.Methods(http.MethodGet).Path(adminVersion + "/pools/list").HandlerFunc(adminMiddleware(adminAPI.ListPools, traceAllFlag))
-			adminRouter.Methods(http.MethodGet).Path(adminVersion+"/pools/status").HandlerFunc(gz(httpTraceAll(adminAPI.StatusPool))).Queries("pool", "{pool:.*}")
+			adminRouter.Methods(http.MethodGet).Path(adminVersion+"/pools/status").HandlerFunc(adminMiddleware(adminAPI.StatusPool, traceAllFlag)).Queries("pool", "{pool:.*}")
-			adminRouter.Methods(http.MethodPost).Path(adminVersion+"/pools/decommission").HandlerFunc(gz(httpTraceAll(adminAPI.StartDecommission))).Queries("pool", "{pool:.*}")
+			adminRouter.Methods(http.MethodPost).Path(adminVersion+"/pools/decommission").HandlerFunc(adminMiddleware(adminAPI.StartDecommission, traceAllFlag)).Queries("pool", "{pool:.*}")
-			adminRouter.Methods(http.MethodPost).Path(adminVersion+"/pools/cancel").HandlerFunc(gz(httpTraceAll(adminAPI.CancelDecommission))).Queries("pool", "{pool:.*}")
+			adminRouter.Methods(http.MethodPost).Path(adminVersion+"/pools/cancel").HandlerFunc(adminMiddleware(adminAPI.CancelDecommission, traceAllFlag)).Queries("pool", "{pool:.*}")
 			// Rebalance operations
 			adminRouter.Methods(http.MethodPost).Path(adminVersion + "/rebalance/start").HandlerFunc(adminMiddleware(adminAPI.RebalanceStart, traceAllFlag))
 			adminRouter.Methods(http.MethodGet).Path(adminVersion + "/rebalance/status").HandlerFunc(adminMiddleware(adminAPI.RebalanceStatus, traceAllFlag))
 			adminRouter.Methods(http.MethodPost).Path(adminVersion + "/rebalance/stop").HandlerFunc(adminMiddleware(adminAPI.RebalanceStop, traceAllFlag))
 		}
 		// Profiling operations - deprecated API
-		adminRouter.Methods(http.MethodPost).Path(adminVersion+"/profiling/start").HandlerFunc(gz(httpTraceAll(adminAPI.StartProfilingHandler))).
+		adminRouter.Methods(http.MethodPost).Path(adminVersion+"/profiling/start").HandlerFunc(adminMiddleware(adminAPI.StartProfilingHandler, traceAllFlag, noObjLayerFlag)).
 			Queries("profilerType", "{profilerType:.*}")
-		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/profiling/download").HandlerFunc(gz(httpTraceAll(adminAPI.DownloadProfilingHandler)))
+		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/profiling/download").HandlerFunc(adminMiddleware(adminAPI.DownloadProfilingHandler, traceAllFlag, noObjLayerFlag))
 		// Profiling operations
-		adminRouter.Methods(http.MethodPost).Path(adminVersion + "/profile").HandlerFunc(gz(httpTraceAll(adminAPI.ProfileHandler)))
+		adminRouter.Methods(http.MethodPost).Path(adminVersion + "/profile").HandlerFunc(adminMiddleware(adminAPI.ProfileHandler, traceAllFlag, noObjLayerFlag))
 		// Config KV operations.
 		if enableConfigOps {
-			adminRouter.Methods(http.MethodGet).Path(adminVersion+"/get-config-kv").HandlerFunc(gz(httpTraceHdrs(adminAPI.GetConfigKVHandler))).Queries("key", "{key:.*}")
+			adminRouter.Methods(http.MethodGet).Path(adminVersion+"/get-config-kv").HandlerFunc(adminMiddleware(adminAPI.GetConfigKVHandler)).Queries("key", "{key:.*}")
-			adminRouter.Methods(http.MethodPut).Path(adminVersion + "/set-config-kv").HandlerFunc(gz(httpTraceHdrs(adminAPI.SetConfigKVHandler)))
+			adminRouter.Methods(http.MethodPut).Path(adminVersion + "/set-config-kv").HandlerFunc(adminMiddleware(adminAPI.SetConfigKVHandler))
-			adminRouter.Methods(http.MethodDelete).Path(adminVersion + "/del-config-kv").HandlerFunc(gz(httpTraceHdrs(adminAPI.DelConfigKVHandler)))
+			adminRouter.Methods(http.MethodDelete).Path(adminVersion + "/del-config-kv").HandlerFunc(adminMiddleware(adminAPI.DelConfigKVHandler))
 		}
 		// Enable config help in all modes.
-		adminRouter.Methods(http.MethodGet).Path(adminVersion+"/help-config-kv").HandlerFunc(gz(httpTraceAll(adminAPI.HelpConfigKVHandler))).Queries("subSys", "{subSys:.*}", "key", "{key:.*}")
+		adminRouter.Methods(http.MethodGet).Path(adminVersion+"/help-config-kv").HandlerFunc(adminMiddleware(adminAPI.HelpConfigKVHandler, traceAllFlag)).Queries("subSys", "{subSys:.*}", "key", "{key:.*}")
 		// Config KV history operations.
 		if enableConfigOps {
-			adminRouter.Methods(http.MethodGet).Path(adminVersion+"/list-config-history-kv").HandlerFunc(gz(httpTraceAll(adminAPI.ListConfigHistoryKVHandler))).Queries("count", "{count:[0-9]+}")
+			adminRouter.Methods(http.MethodGet).Path(adminVersion+"/list-config-history-kv").HandlerFunc(adminMiddleware(adminAPI.ListConfigHistoryKVHandler, traceAllFlag)).Queries("count", "{count:[0-9]+}")
-			adminRouter.Methods(http.MethodDelete).Path(adminVersion+"/clear-config-history-kv").HandlerFunc(gz(httpTraceHdrs(adminAPI.ClearConfigHistoryKVHandler))).Queries("restoreId", "{restoreId:.*}")
+			adminRouter.Methods(http.MethodDelete).Path(adminVersion+"/clear-config-history-kv").HandlerFunc(adminMiddleware(adminAPI.ClearConfigHistoryKVHandler)).Queries("restoreId", "{restoreId:.*}")
-			adminRouter.Methods(http.MethodPut).Path(adminVersion+"/restore-config-history-kv").HandlerFunc(gz(httpTraceHdrs(adminAPI.RestoreConfigHistoryKVHandler))).Queries("restoreId", "{restoreId:.*}")
+			adminRouter.Methods(http.MethodPut).Path(adminVersion+"/restore-config-history-kv").HandlerFunc(adminMiddleware(adminAPI.RestoreConfigHistoryKVHandler)).Queries("restoreId", "{restoreId:.*}")
 		}
 		// Config import/export bulk operations
 		if enableConfigOps {
 			// Get config
-			adminRouter.Methods(http.MethodGet).Path(adminVersion + "/config").HandlerFunc(gz(httpTraceHdrs(adminAPI.GetConfigHandler)))
+			adminRouter.Methods(http.MethodGet).Path(adminVersion + "/config").HandlerFunc(adminMiddleware(adminAPI.GetConfigHandler))
 			// Set config
-			adminRouter.Methods(http.MethodPut).Path(adminVersion + "/config").HandlerFunc(gz(httpTraceHdrs(adminAPI.SetConfigHandler)))
+			adminRouter.Methods(http.MethodPut).Path(adminVersion + "/config").HandlerFunc(adminMiddleware(adminAPI.SetConfigHandler))
 		}
 		// -- IAM APIs --
 		// Add policy IAM
-		adminRouter.Methods(http.MethodPut).Path(adminVersion+"/add-canned-policy").HandlerFunc(gz(httpTraceAll(adminAPI.AddCannedPolicy))).Queries("name", "{name:.*}")
+		adminRouter.Methods(http.MethodPut).Path(adminVersion+"/add-canned-policy").HandlerFunc(adminMiddleware(adminAPI.AddCannedPolicy, traceAllFlag)).Queries("name", "{name:.*}")
 		// Add user IAM
-		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/accountinfo").HandlerFunc(gz(httpTraceAll(adminAPI.AccountInfoHandler)))
+		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/accountinfo").HandlerFunc(adminMiddleware(adminAPI.AccountInfoHandler, traceAllFlag))
-		adminRouter.Methods(http.MethodPut).Path(adminVersion+"/add-user").HandlerFunc(gz(httpTraceHdrs(adminAPI.AddUser))).Queries("accessKey", "{accessKey:.*}")
+		adminRouter.Methods(http.MethodPut).Path(adminVersion+"/add-user").HandlerFunc(adminMiddleware(adminAPI.AddUser)).Queries("accessKey", "{accessKey:.*}")
-		adminRouter.Methods(http.MethodPut).Path(adminVersion+"/set-user-status").HandlerFunc(gz(httpTraceHdrs(adminAPI.SetUserStatus))).Queries("accessKey", "{accessKey:.*}").Queries("status", "{status:.*}")
+		adminRouter.Methods(http.MethodPut).Path(adminVersion+"/set-user-status").HandlerFunc(adminMiddleware(adminAPI.SetUserStatus)).Queries("accessKey", "{accessKey:.*}").Queries("status", "{status:.*}")
 		// Service accounts ops
-		adminRouter.Methods(http.MethodPut).Path(adminVersion + "/add-service-account").HandlerFunc(gz(httpTraceHdrs(adminAPI.AddServiceAccount)))
+		adminRouter.Methods(http.MethodPut).Path(adminVersion + "/add-service-account").HandlerFunc(adminMiddleware(adminAPI.AddServiceAccount))
-		adminRouter.Methods(http.MethodPost).Path(adminVersion+"/update-service-account").HandlerFunc(gz(httpTraceHdrs(adminAPI.UpdateServiceAccount))).Queries("accessKey", "{accessKey:.*}")
+		adminRouter.Methods(http.MethodPost).Path(adminVersion+"/update-service-account").HandlerFunc(adminMiddleware(adminAPI.UpdateServiceAccount)).Queries("accessKey", "{accessKey:.*}")
-		adminRouter.Methods(http.MethodGet).Path(adminVersion+"/info-service-account").HandlerFunc(gz(httpTraceHdrs(adminAPI.InfoServiceAccount))).Queries("accessKey", "{accessKey:.*}")
+		adminRouter.Methods(http.MethodGet).Path(adminVersion+"/info-service-account").HandlerFunc(adminMiddleware(adminAPI.InfoServiceAccount)).Queries("accessKey", "{accessKey:.*}")
-		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/list-service-accounts").HandlerFunc(gz(httpTraceHdrs(adminAPI.ListServiceAccounts)))
+		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/list-service-accounts").HandlerFunc(adminMiddleware(adminAPI.ListServiceAccounts))
-		adminRouter.Methods(http.MethodDelete).Path(adminVersion+"/delete-service-account").HandlerFunc(gz(httpTraceHdrs(adminAPI.DeleteServiceAccount))).Queries("accessKey", "{accessKey:.*}")
+		adminRouter.Methods(http.MethodDelete).Path(adminVersion+"/delete-service-account").HandlerFunc(adminMiddleware(adminAPI.DeleteServiceAccount)).Queries("accessKey", "{accessKey:.*}")
 		// STS accounts ops
 		adminRouter.Methods(http.MethodGet).Path(adminVersion+"/temporary-account-info").HandlerFunc(adminMiddleware(adminAPI.TemporaryAccountInfo)).Queries("accessKey", "{accessKey:.*}")
 		// Info policy IAM latest
-		adminRouter.Methods(http.MethodGet).Path(adminVersion+"/info-canned-policy").HandlerFunc(gz(httpTraceHdrs(adminAPI.InfoCannedPolicy))).Queries("name", "{name:.*}")
+		adminRouter.Methods(http.MethodGet).Path(adminVersion+"/info-canned-policy").HandlerFunc(adminMiddleware(adminAPI.InfoCannedPolicy)).Queries("name", "{name:.*}")
 		// List policies latest
-		adminRouter.Methods(http.MethodGet).Path(adminVersion+"/list-canned-policies").HandlerFunc(gz(httpTraceHdrs(adminAPI.ListBucketPolicies))).Queries("bucket", "{bucket:.*}")
+		adminRouter.Methods(http.MethodGet).Path(adminVersion+"/list-canned-policies").HandlerFunc(adminMiddleware(adminAPI.ListBucketPolicies)).Queries("bucket", "{bucket:.*}")
-		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/list-canned-policies").HandlerFunc(gz(httpTraceHdrs(adminAPI.ListCannedPolicies)))
+		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/list-canned-policies").HandlerFunc(adminMiddleware(adminAPI.ListCannedPolicies))
 		// Builtin IAM policy associations
 		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/idp/builtin/policy-entities").HandlerFunc(adminMiddleware(adminAPI.ListPolicyMappingEntities))
 		// Remove policy IAM
-		adminRouter.Methods(http.MethodDelete).Path(adminVersion+"/remove-canned-policy").HandlerFunc(gz(httpTraceHdrs(adminAPI.RemoveCannedPolicy))).Queries("name", "{name:.*}")
+		adminRouter.Methods(http.MethodDelete).Path(adminVersion+"/remove-canned-policy").HandlerFunc(adminMiddleware(adminAPI.RemoveCannedPolicy)).Queries("name", "{name:.*}")
 		// Set user or group policy
 		adminRouter.Methods(http.MethodPut).Path(adminVersion+"/set-user-or-group-policy").
-			HandlerFunc(gz(httpTraceHdrs(adminAPI.SetPolicyForUserOrGroup))).
+			HandlerFunc(adminMiddleware(adminAPI.SetPolicyForUserOrGroup)).
 			Queries("policyName", "{policyName:.*}", "userOrGroup", "{userOrGroup:.*}", "isGroup", "{isGroup:true|false}")
 		// Attach/Detach policies to/from user or group
 		adminRouter.Methods(http.MethodPost).Path(adminVersion + "/idp/builtin/policy/{operation}").HandlerFunc(adminMiddleware(adminAPI.AttachDetachPolicyBuiltin))
 		// Remove user IAM
-		adminRouter.Methods(http.MethodDelete).Path(adminVersion+"/remove-user").HandlerFunc(gz(httpTraceHdrs(adminAPI.RemoveUser))).Queries("accessKey", "{accessKey:.*}")
+		adminRouter.Methods(http.MethodDelete).Path(adminVersion+"/remove-user").HandlerFunc(adminMiddleware(adminAPI.RemoveUser)).Queries("accessKey", "{accessKey:.*}")
 		// List users
-		adminRouter.Methods(http.MethodGet).Path(adminVersion+"/list-users").HandlerFunc(gz(httpTraceHdrs(adminAPI.ListBucketUsers))).Queries("bucket", "{bucket:.*}")
+		adminRouter.Methods(http.MethodGet).Path(adminVersion+"/list-users").HandlerFunc(adminMiddleware(adminAPI.ListBucketUsers)).Queries("bucket", "{bucket:.*}")
-		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/list-users").HandlerFunc(gz(httpTraceHdrs(adminAPI.ListUsers)))
+		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/list-users").HandlerFunc(adminMiddleware(adminAPI.ListUsers))
 		// User info
-		adminRouter.Methods(http.MethodGet).Path(adminVersion+"/user-info").HandlerFunc(gz(httpTraceHdrs(adminAPI.GetUserInfo))).Queries("accessKey", "{accessKey:.*}")
+		adminRouter.Methods(http.MethodGet).Path(adminVersion+"/user-info").HandlerFunc(adminMiddleware(adminAPI.GetUserInfo)).Queries("accessKey", "{accessKey:.*}")
 		// Add/Remove members from group
-		adminRouter.Methods(http.MethodPut).Path(adminVersion + "/update-group-members").HandlerFunc(gz(httpTraceHdrs(adminAPI.UpdateGroupMembers)))
+		adminRouter.Methods(http.MethodPut).Path(adminVersion + "/update-group-members").HandlerFunc(adminMiddleware(adminAPI.UpdateGroupMembers))
 		// Get Group
-		adminRouter.Methods(http.MethodGet).Path(adminVersion+"/group").HandlerFunc(gz(httpTraceHdrs(adminAPI.GetGroup))).Queries("group", "{group:.*}")
+		adminRouter.Methods(http.MethodGet).Path(adminVersion+"/group").HandlerFunc(adminMiddleware(adminAPI.GetGroup)).Queries("group", "{group:.*}")
 		// List Groups
-		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/groups").HandlerFunc(gz(httpTraceHdrs(adminAPI.ListGroups)))
+		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/groups").HandlerFunc(adminMiddleware(adminAPI.ListGroups))
 		// Set Group Status
-		adminRouter.Methods(http.MethodPut).Path(adminVersion+"/set-group-status").HandlerFunc(gz(httpTraceHdrs(adminAPI.SetGroupStatus))).Queries("group", "{group:.*}").Queries("status", "{status:.*}")
+		adminRouter.Methods(http.MethodPut).Path(adminVersion+"/set-group-status").HandlerFunc(adminMiddleware(adminAPI.SetGroupStatus)).Queries("group", "{group:.*}").Queries("status", "{status:.*}")
 		// Export IAM info to zipped file
-		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/export-iam").HandlerFunc(httpTraceHdrs(adminAPI.ExportIAM))
+		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/export-iam").HandlerFunc(adminMiddleware(adminAPI.ExportIAM, noGZFlag))
 		// Import IAM info
-		adminRouter.Methods(http.MethodPut).Path(adminVersion + "/import-iam").HandlerFunc(httpTraceHdrs(adminAPI.ImportIAM))
+		adminRouter.Methods(http.MethodPut).Path(adminVersion + "/import-iam").HandlerFunc(adminMiddleware(adminAPI.ImportIAM, noGZFlag))
 		// IDentity Provider configuration APIs
-		adminRouter.Methods(http.MethodPut).Path(adminVersion+"/idp-config").HandlerFunc(gz(httpTraceHdrs(adminAPI.SetIdentityProviderCfg))).Queries("type", "{type:.*}").Queries("name", "{name:.*}")
+		adminRouter.Methods(http.MethodPut).Path(adminVersion + "/idp-config/{type}/{name}").HandlerFunc(adminMiddleware(adminAPI.AddIdentityProviderCfg))
-		adminRouter.Methods(http.MethodGet).Path(adminVersion+"/idp-config").HandlerFunc(gz(httpTraceHdrs(adminAPI.GetIdentityProviderCfg))).Queries("type", "{type:.*}")
+		adminRouter.Methods(http.MethodPost).Path(adminVersion + "/idp-config/{type}/{name}").HandlerFunc(adminMiddleware(adminAPI.UpdateIdentityProviderCfg))
-		adminRouter.Methods(http.MethodDelete).Path(adminVersion+"/idp-config").HandlerFunc(gz(httpTraceHdrs(adminAPI.DeleteIdentityProviderCfg))).Queries("type", "{type:.*}").Queries("name", "{name:.*}")
+		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/idp-config/{type}").HandlerFunc(adminMiddleware(adminAPI.ListIdentityProviderCfg))
 		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/idp-config/{type}/{name}").HandlerFunc(adminMiddleware(adminAPI.GetIdentityProviderCfg))
 		adminRouter.Methods(http.MethodDelete).Path(adminVersion + "/idp-config/{type}/{name}").HandlerFunc(adminMiddleware(adminAPI.DeleteIdentityProviderCfg))
 		// LDAP specific service accounts ops
 		adminRouter.Methods(http.MethodPut).Path(adminVersion + "/idp/ldap/add-service-account").HandlerFunc(adminMiddleware(adminAPI.AddServiceAccountLDAP))
 		adminRouter.Methods(http.MethodGet).Path(adminVersion+"/idp/ldap/list-access-keys").
 			HandlerFunc(adminMiddleware(adminAPI.ListAccessKeysLDAP)).
 			Queries("userDN", "{userDN:.*}", "listType", "{listType:.*}")
 		// LDAP IAM operations
 		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/idp/ldap/policy-entities").HandlerFunc(adminMiddleware(adminAPI.ListLDAPPolicyMappingEntities))
 		adminRouter.Methods(http.MethodPost).Path(adminVersion + "/idp/ldap/policy/{operation}").HandlerFunc(adminMiddleware(adminAPI.AttachDetachPolicyLDAP))
 		// -- END IAM APIs --
 		// GetBucketQuotaConfig
 		adminRouter.Methods(http.MethodGet).Path(adminVersion+"/get-bucket-quota").HandlerFunc(
-			gz(httpTraceHdrs(adminAPI.GetBucketQuotaConfigHandler))).Queries("bucket", "{bucket:.*}")
+			adminMiddleware(adminAPI.GetBucketQuotaConfigHandler)).Queries("bucket", "{bucket:.*}")
 		// PutBucketQuotaConfig
 		adminRouter.Methods(http.MethodPut).Path(adminVersion+"/set-bucket-quota").HandlerFunc(
-			gz(httpTraceHdrs(adminAPI.PutBucketQuotaConfigHandler))).Queries("bucket", "{bucket:.*}")
+			adminMiddleware(adminAPI.PutBucketQuotaConfigHandler)).Queries("bucket", "{bucket:.*}")
 		// Bucket replication operations
 		// GetBucketTargetHandler
 		adminRouter.Methods(http.MethodGet).Path(adminVersion+"/list-remote-targets").HandlerFunc(
-			gz(httpTraceHdrs(adminAPI.ListRemoteTargetsHandler))).Queries("bucket", "{bucket:.*}", "type", "{type:.*}")
+			adminMiddleware(adminAPI.ListRemoteTargetsHandler)).Queries("bucket", "{bucket:.*}", "type", "{type:.*}")
 		// SetRemoteTargetHandler
 		adminRouter.Methods(http.MethodPut).Path(adminVersion+"/set-remote-target").HandlerFunc(
-			gz(httpTraceHdrs(adminAPI.SetRemoteTargetHandler))).Queries("bucket", "{bucket:.*}")
+			adminMiddleware(adminAPI.SetRemoteTargetHandler)).Queries("bucket", "{bucket:.*}")
 		// RemoveRemoteTargetHandler
 		adminRouter.Methods(http.MethodDelete).Path(adminVersion+"/remove-remote-target").HandlerFunc(
-			gz(httpTraceHdrs(adminAPI.RemoveRemoteTargetHandler))).Queries("bucket", "{bucket:.*}", "arn", "{arn:.*}")
+			adminMiddleware(adminAPI.RemoveRemoteTargetHandler)).Queries("bucket", "{bucket:.*}", "arn", "{arn:.*}")
 		// ReplicationDiff - MinIO extension API
 		adminRouter.Methods(http.MethodPost).Path(adminVersion+"/replication/diff").HandlerFunc(
-			gz(httpTraceHdrs(adminAPI.ReplicationDiffHandler))).Queries("bucket", "{bucket:.*}")
+			adminMiddleware(adminAPI.ReplicationDiffHandler)).Queries("bucket", "{bucket:.*}")
 		// ReplicationMRFHandler - MinIO extension API
 		adminRouter.Methods(http.MethodGet).Path(adminVersion+"/replication/mrf").HandlerFunc(
 			adminMiddleware(adminAPI.ReplicationMRFHandler)).Queries("bucket", "{bucket:.*}")
 		// Batch job operations
 		adminRouter.Methods(http.MethodPost).Path(adminVersion + "/start-job").HandlerFunc(
-			gz(httpTraceHdrs(adminAPI.StartBatchJob)))
+			adminMiddleware(adminAPI.StartBatchJob))
 		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/list-jobs").HandlerFunc(
-			gz(httpTraceHdrs(adminAPI.ListBatchJobs)))
+			adminMiddleware(adminAPI.ListBatchJobs))
 		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/describe-job").HandlerFunc(
-			gz(httpTraceHdrs(adminAPI.DescribeBatchJob)))
+			adminMiddleware(adminAPI.DescribeBatchJob))
 		adminRouter.Methods(http.MethodDelete).Path(adminVersion + "/cancel-job").HandlerFunc(
 			adminMiddleware(adminAPI.CancelBatchJob))
 		// Bucket migration operations
 		// ExportBucketMetaHandler
 		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/export-bucket-metadata").HandlerFunc(
-			gz(httpTraceHdrs(adminAPI.ExportBucketMetadataHandler)))
+			adminMiddleware(adminAPI.ExportBucketMetadataHandler))
 		// ImportBucketMetaHandler
 		adminRouter.Methods(http.MethodPut).Path(adminVersion + "/import-bucket-metadata").HandlerFunc(
-			gz(httpTraceHdrs(adminAPI.ImportBucketMetadataHandler)))
+			adminMiddleware(adminAPI.ImportBucketMetadataHandler))
 		// Remote Tier management operations
-		adminRouter.Methods(http.MethodPut).Path(adminVersion + "/tier").HandlerFunc(gz(httpTraceHdrs(adminAPI.AddTierHandler)))
+		adminRouter.Methods(http.MethodPut).Path(adminVersion + "/tier").HandlerFunc(adminMiddleware(adminAPI.AddTierHandler))
-		adminRouter.Methods(http.MethodPost).Path(adminVersion + "/tier/{tier}").HandlerFunc(gz(httpTraceHdrs(adminAPI.EditTierHandler)))
+		adminRouter.Methods(http.MethodPost).Path(adminVersion + "/tier/{tier}").HandlerFunc(adminMiddleware(adminAPI.EditTierHandler))
-		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/tier").HandlerFunc(gz(httpTraceHdrs(adminAPI.ListTierHandler)))
+		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/tier").HandlerFunc(adminMiddleware(adminAPI.ListTierHandler))
-		adminRouter.Methods(http.MethodDelete).Path(adminVersion + "/tier/{tier}").HandlerFunc(gz(httpTraceHdrs(adminAPI.RemoveTierHandler)))
+		adminRouter.Methods(http.MethodDelete).Path(adminVersion + "/tier/{tier}").HandlerFunc(adminMiddleware(adminAPI.RemoveTierHandler))
-		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/tier/{tier}").HandlerFunc(gz(httpTraceHdrs(adminAPI.VerifyTierHandler)))
+		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/tier/{tier}").HandlerFunc(adminMiddleware(adminAPI.VerifyTierHandler))
 		// Tier stats
-		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/tier-stats").HandlerFunc(gz(httpTraceHdrs(adminAPI.TierStatsHandler)))
+		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/tier-stats").HandlerFunc(adminMiddleware(adminAPI.TierStatsHandler))
 		// Cluster Replication APIs
-		adminRouter.Methods(http.MethodPut).Path(adminVersion + "/site-replication/add").HandlerFunc(gz(httpTraceHdrs(adminAPI.SiteReplicationAdd)))
+		adminRouter.Methods(http.MethodPut).Path(adminVersion + "/site-replication/add").HandlerFunc(adminMiddleware(adminAPI.SiteReplicationAdd))
-		adminRouter.Methods(http.MethodPut).Path(adminVersion + "/site-replication/remove").HandlerFunc(gz(httpTraceHdrs(adminAPI.SiteReplicationRemove)))
+		adminRouter.Methods(http.MethodPut).Path(adminVersion + "/site-replication/remove").HandlerFunc(adminMiddleware(adminAPI.SiteReplicationRemove))
-		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/site-replication/info").HandlerFunc(gz(httpTraceHdrs(adminAPI.SiteReplicationInfo)))
+		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/site-replication/info").HandlerFunc(adminMiddleware(adminAPI.SiteReplicationInfo))
-		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/site-replication/metainfo").HandlerFunc(gz(httpTraceHdrs(adminAPI.SiteReplicationMetaInfo)))
+		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/site-replication/metainfo").HandlerFunc(adminMiddleware(adminAPI.SiteReplicationMetaInfo))
-		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/site-replication/status").HandlerFunc(gz(httpTraceHdrs(adminAPI.SiteReplicationStatus)))
+		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/site-replication/status").HandlerFunc(adminMiddleware(adminAPI.SiteReplicationStatus))
 		adminRouter.Methods(http.MethodPost).Path(adminVersion + adminAPISiteReplicationDevNull).HandlerFunc(adminMiddleware(adminAPI.SiteReplicationDevNull, noObjLayerFlag))
 		adminRouter.Methods(http.MethodPost).Path(adminVersion + adminAPISiteReplicationNetPerf).HandlerFunc(adminMiddleware(adminAPI.SiteReplicationNetPerf, noObjLayerFlag))
-		adminRouter.Methods(http.MethodPut).Path(adminVersion + "/site-replication/peer/join").HandlerFunc(gz(httpTraceHdrs(adminAPI.SRPeerJoin)))
+		adminRouter.Methods(http.MethodPut).Path(adminVersion + "/site-replication/peer/join").HandlerFunc(adminMiddleware(adminAPI.SRPeerJoin))
-		adminRouter.Methods(http.MethodPut).Path(adminVersion+"/site-replication/peer/bucket-ops").HandlerFunc(gz(httpTraceHdrs(adminAPI.SRPeerBucketOps))).Queries("bucket", "{bucket:.*}").Queries("operation", "{operation:.*}")
+		adminRouter.Methods(http.MethodPut).Path(adminVersion+"/site-replication/peer/bucket-ops").HandlerFunc(adminMiddleware(adminAPI.SRPeerBucketOps)).Queries("bucket", "{bucket:.*}").Queries("operation", "{operation:.*}")
-		adminRouter.Methods(http.MethodPut).Path(adminVersion + "/site-replication/peer/iam-item").HandlerFunc(gz(httpTraceHdrs(adminAPI.SRPeerReplicateIAMItem)))
+		adminRouter.Methods(http.MethodPut).Path(adminVersion + "/site-replication/peer/iam-item").HandlerFunc(adminMiddleware(adminAPI.SRPeerReplicateIAMItem))
-		adminRouter.Methods(http.MethodPut).Path(adminVersion + "/site-replication/peer/bucket-meta").HandlerFunc(gz(httpTraceHdrs(adminAPI.SRPeerReplicateBucketItem)))
+		adminRouter.Methods(http.MethodPut).Path(adminVersion + "/site-replication/peer/bucket-meta").HandlerFunc(adminMiddleware(adminAPI.SRPeerReplicateBucketItem))
-		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/site-replication/peer/idp-settings").HandlerFunc(gz(httpTraceHdrs(adminAPI.SRPeerGetIDPSettings)))
+		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/site-replication/peer/idp-settings").HandlerFunc(adminMiddleware(adminAPI.SRPeerGetIDPSettings))
-		adminRouter.Methods(http.MethodPut).Path(adminVersion + "/site-replication/edit").HandlerFunc(gz(httpTraceHdrs(adminAPI.SiteReplicationEdit)))
+		adminRouter.Methods(http.MethodPut).Path(adminVersion + "/site-replication/edit").HandlerFunc(adminMiddleware(adminAPI.SiteReplicationEdit))
-		adminRouter.Methods(http.MethodPut).Path(adminVersion + "/site-replication/peer/edit").HandlerFunc(gz(httpTraceHdrs(adminAPI.SRPeerEdit)))
+		adminRouter.Methods(http.MethodPut).Path(adminVersion + "/site-replication/peer/edit").HandlerFunc(adminMiddleware(adminAPI.SRPeerEdit))
-		adminRouter.Methods(http.MethodPut).Path(adminVersion + "/site-replication/peer/remove").HandlerFunc(gz(httpTraceHdrs(adminAPI.SRPeerRemove)))
+		adminRouter.Methods(http.MethodPut).Path(adminVersion + "/site-replication/peer/remove").HandlerFunc(adminMiddleware(adminAPI.SRPeerRemove))
 		adminRouter.Methods(http.MethodPut).Path(adminVersion+"/site-replication/resync/op").HandlerFunc(adminMiddleware(adminAPI.SiteReplicationResyncOp)).Queries("operation", "{operation:.*}")
 		adminRouter.Methods(http.MethodPut).Path(adminVersion + "/site-replication/state/edit").HandlerFunc(adminMiddleware(adminAPI.SRStateEdit))
 		if globalIsDistErasure {
 			// Top locks
-			adminRouter.Methods(http.MethodGet).Path(adminVersion + "/top/locks").HandlerFunc(gz(httpTraceHdrs(adminAPI.TopLocksHandler)))
+			adminRouter.Methods(http.MethodGet).Path(adminVersion + "/top/locks").HandlerFunc(adminMiddleware(adminAPI.TopLocksHandler))
 			// Force unlocks paths
 			adminRouter.Methods(http.MethodPost).Path(adminVersion+"/force-unlock").
-				Queries("paths", "{paths:.*}").HandlerFunc(gz(httpTraceHdrs(adminAPI.ForceUnlockHandler)))
+				Queries("paths", "{paths:.*}").HandlerFunc(adminMiddleware(adminAPI.ForceUnlockHandler))
 		}
-		adminRouter.Methods(http.MethodPost).Path(adminVersion + "/speedtest").HandlerFunc(httpTraceHdrs(adminAPI.SpeedTestHandler))
+		adminRouter.Methods(http.MethodPost).Path(adminVersion + "/speedtest").HandlerFunc(adminMiddleware(adminAPI.ObjectSpeedTestHandler, noGZFlag))
-		adminRouter.Methods(http.MethodPost).Path(adminVersion + "/speedtest/object").HandlerFunc(httpTraceHdrs(adminAPI.ObjectSpeedTestHandler))
+		adminRouter.Methods(http.MethodPost).Path(adminVersion + "/speedtest/object").HandlerFunc(adminMiddleware(adminAPI.ObjectSpeedTestHandler, noGZFlag))
-		adminRouter.Methods(http.MethodPost).Path(adminVersion + "/speedtest/drive").HandlerFunc(httpTraceHdrs(adminAPI.DriveSpeedtestHandler))
+		adminRouter.Methods(http.MethodPost).Path(adminVersion + "/speedtest/drive").HandlerFunc(adminMiddleware(adminAPI.DriveSpeedtestHandler, noGZFlag))
-		adminRouter.Methods(http.MethodPost).Path(adminVersion + "/speedtest/net").HandlerFunc(httpTraceHdrs(adminAPI.NetperfHandler))
+		adminRouter.Methods(http.MethodPost).Path(adminVersion + "/speedtest/net").HandlerFunc(adminMiddleware(adminAPI.NetperfHandler, noGZFlag))
 		adminRouter.Methods(http.MethodPost).Path(adminVersion + "/speedtest/site").HandlerFunc(adminMiddleware(adminAPI.SitePerfHandler, noGZFlag))
 		adminRouter.Methods(http.MethodPost).Path(adminVersion + adminAPIClientDevNull).HandlerFunc(adminMiddleware(adminAPI.ClientDevNull, noGZFlag))
 		adminRouter.Methods(http.MethodPost).Path(adminVersion + adminAPIClientDevExtraTime).HandlerFunc(adminMiddleware(adminAPI.ClientDevNullExtraTime, noGZFlag))
 		// HTTP Trace
-		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/trace").HandlerFunc(gz(http.HandlerFunc(adminAPI.TraceHandler)))
+		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/trace").HandlerFunc(adminMiddleware(adminAPI.TraceHandler, noObjLayerFlag))
 		// Console Logs
-		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/log").HandlerFunc(gz(httpTraceAll(adminAPI.ConsoleLogHandler)))
+		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/log").HandlerFunc(adminMiddleware(adminAPI.ConsoleLogHandler, traceAllFlag))
 		// -- KMS APIs --
 		//
-		adminRouter.Methods(http.MethodPost).Path(adminVersion + "/kms/status").HandlerFunc(gz(httpTraceAll(adminAPI.KMSStatusHandler)))
+		adminRouter.Methods(http.MethodPost).Path(adminVersion + "/kms/status").HandlerFunc(adminMiddleware(adminAPI.KMSStatusHandler, traceAllFlag))
-		adminRouter.Methods(http.MethodPost).Path(adminVersion+"/kms/key/create").HandlerFunc(gz(httpTraceAll(adminAPI.KMSCreateKeyHandler))).Queries("key-id", "{key-id:.*}")
+		adminRouter.Methods(http.MethodPost).Path(adminVersion+"/kms/key/create").HandlerFunc(adminMiddleware(adminAPI.KMSCreateKeyHandler, traceAllFlag)).Queries("key-id", "{key-id:.*}")
-		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/kms/key/status").HandlerFunc(gz(httpTraceAll(adminAPI.KMSKeyStatusHandler)))
+		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/kms/key/status").HandlerFunc(adminMiddleware(adminAPI.KMSKeyStatusHandler, traceAllFlag))
-		if !globalIsGateway {
+		// Keep obdinfo for backward compatibility with mc
-			// Keep obdinfo for backward compatibility with mc
+		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/obdinfo").
-			adminRouter.Methods(http.MethodGet).Path(adminVersion + "/obdinfo").
+			HandlerFunc(adminMiddleware(adminAPI.HealthInfoHandler))
-				HandlerFunc(gz(httpTraceHdrs(adminAPI.HealthInfoHandler)))
+		// -- Health API --
-			// -- Health API --
+		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/healthinfo").
-			adminRouter.Methods(http.MethodGet).Path(adminVersion + "/healthinfo").
+			HandlerFunc(adminMiddleware(adminAPI.HealthInfoHandler))
 				HandlerFunc(gz(httpTraceHdrs(adminAPI.HealthInfoHandler)))
 			adminRouter.Methods(http.MethodGet).Path(adminVersion + "/bandwidth").
 				HandlerFunc(gz(httpTraceHdrs(adminAPI.BandwidthMonitorHandler)))
 		}
 	}
 	// If none of the routes match add default error handler routes
@@ -26,15 +26,15 @@ import (
 	"strings"
 	"time"
-	"github.com/minio/madmin-go"
+	"github.com/minio/madmin-go/v3"
 	"github.com/minio/minio/internal/config"
 	"github.com/minio/minio/internal/kms"
 	"github.com/minio/minio/internal/logger"
 )
 // getLocalServerProperty - returns madmin.ServerProperties for only the
 // local endpoints from given list of endpoints
-func getLocalServerProperty(endpointServerPools EndpointServerPools, r *http.Request) madmin.ServerProperties {
+func getLocalServerProperty(endpointServerPools EndpointServerPools, r *http.Request, metrics bool) madmin.ServerProperties {
 	var localEndpoints Endpoints
 	addr := globalLocalNodeName
 	if r != nil {
 		addr = r.Host
@@ -52,7 +52,6 @@ func getLocalServerProperty(endpointServerPools EndpointServerPools, r *http.Req
 			if endpoint.IsLocal {
 				// Only proceed for local endpoints
 				network[nodeName] = string(madmin.ItemOnline)
 				localEndpoints = append(localEndpoints, endpoint)
 				continue
 			}
 			_, present := network[nodeName]
@@ -88,7 +87,6 @@ func getLocalServerProperty(endpointServerPools EndpointServerPools, r *http.Req
 	}
 	props := madmin.ServerProperties{
 		State:    string(madmin.ItemInitializing),
 		Endpoint: addr,
 		Uptime:   UTCNow().Unix() - globalBootTime.Unix(),
 		Version:  Version,
@@ -120,7 +118,7 @@ func getLocalServerProperty(endpointServerPools EndpointServerPools, r *http.Req
 		config.EnvRootUser:          {},
 		config.EnvRootPassword:      {},
 		config.EnvMinIOSubnetAPIKey: {},
-		config.EnvKMSSecretKey:      {},
+		kms.EnvKMSSecretKey:         {},
 	}
 	for _, v := range os.Environ() {
 		if !strings.HasPrefix(v, "MINIO") && !strings.HasPrefix(v, "_MINIO") {
@@ -142,11 +140,13 @@ func getLocalServerProperty(endpointServerPools EndpointServerPools, r *http.Req
 	}
 	objLayer := newObjectLayerFn()
-	if objLayer != nil && !globalIsGateway {
+	if objLayer != nil {
-		// only need Disks information in server mode.
+		storageInfo := objLayer.LocalStorageInfo(GlobalContext, metrics)
 		storageInfo, _ := objLayer.LocalStorageInfo(GlobalContext)
 		props.State = string(madmin.ItemOnline)
 		props.Disks = storageInfo.Disks
 	} else {
 		props.State = string(madmin.ItemInitializing)
 		props.Disks = getOfflineDisks("", globalEndpoints)
 	}
 	return props
@@ -1,4 +1,4 @@
-// Copyright (c) 2015-2021 MinIO, Inc.
+// Copyright (c) 2015-2023 MinIO, Inc.
 //
 // This file is part of MinIO Object Storage stack
 //
@@ -24,13 +24,15 @@ import (
 	"fmt"
 	"net/http"
 	"net/url"
 	"os"
 	"strconv"
 	"strings"
 	"github.com/Azure/azure-storage-blob-go/azblob"
 	"github.com/minio/minio/internal/ioutil"
 	"google.golang.org/api/googleapi"
-	"github.com/minio/madmin-go"
+	"github.com/minio/madmin-go/v3"
 	"github.com/minio/minio-go/v7"
 	"github.com/minio/minio-go/v7/pkg/tags"
 	"github.com/minio/minio/internal/auth"
@@ -38,13 +40,15 @@ import (
 	"github.com/minio/minio/internal/bucket/replication"
 	"github.com/minio/minio/internal/config/dns"
 	"github.com/minio/minio/internal/crypto"
 	"github.com/minio/minio/internal/kms"
 	"github.com/minio/minio/internal/logger"
 	objectlock "github.com/minio/minio/internal/bucket/object/lock"
 	"github.com/minio/minio/internal/bucket/versioning"
 	levent "github.com/minio/minio/internal/config/lambda/event"
 	"github.com/minio/minio/internal/event"
 	"github.com/minio/minio/internal/hash"
-	"github.com/minio/pkg/bucket/policy"
+	"github.com/minio/pkg/v2/policy"
 )
 // APIError structure
@@ -84,6 +88,7 @@ const (
 	ErrInternalError
 	ErrInvalidAccessKeyID
 	ErrAccessKeyDisabled
 	ErrInvalidArgument
 	ErrInvalidBucketName
 	ErrInvalidDigest
 	ErrInvalidRange
@@ -132,7 +137,10 @@ const (
 	ErrReplicationNeedsVersioningError
 	ErrReplicationBucketNeedsVersioningError
 	ErrReplicationDenyEditError
 	ErrRemoteTargetDenyAddError
 	ErrReplicationNoExistingObjects
 	ErrReplicationValidationError
 	ErrReplicationPermissionCheckError
 	ErrObjectRestoreAlreadyInProgress
 	ErrNoSuchKey
 	ErrNoSuchUpload
@@ -145,13 +153,14 @@ const (
 	ErrMethodNotAllowed
 	ErrInvalidPart
 	ErrInvalidPartOrder
 	ErrMissingPart
 	ErrAuthorizationHeaderMalformed
 	ErrMalformedPOSTRequest
 	ErrPOSTFileRequired
 	ErrSignatureVersionNotSupported
 	ErrBucketNotEmpty
 	ErrAllAccessDisabled
-	ErrMalformedPolicy
+	ErrPolicyInvalidVersion
 	ErrMissingFields
 	ErrMissingCredTag
 	ErrCredMalformed
@@ -164,7 +173,6 @@ const (
 	ErrMalformedDate
 	ErrMalformedPresignedDate
 	ErrMalformedCredentialDate
 	ErrMalformedCredentialRegion
 	ErrMalformedExpires
 	ErrNegativeExpires
 	ErrAuthHeaderEmpty
@@ -177,11 +185,13 @@ const (
 	ErrBucketAlreadyOwnedByYou
 	ErrInvalidDuration
 	ErrBucketAlreadyExists
 	ErrTooManyBuckets
 	ErrMetadataTooLarge
 	ErrUnsupportedMetadata
 	ErrUnsupportedHostHeader
 	ErrMaximumExpires
-	ErrSlowDown
+	ErrSlowDownRead
 	ErrSlowDownWrite
 	ErrMaxVersionsExceeded
 	ErrInvalidPrefixMarker
 	ErrBadRequest
 	ErrKeyTooLongError
@@ -196,6 +206,9 @@ const (
 	ErrBucketTaggingNotFound
 	ErrObjectLockInvalidHeaders
 	ErrInvalidTagDirective
 	ErrPolicyAlreadyAttached
 	ErrPolicyNotAttached
 	ErrExcessData
 	// Add new error codes here.
 	// SSE-S3/SSE-KMS related API errors
@@ -207,6 +220,8 @@ const (
 	ErrSSEMultipartEncrypted
 	ErrSSEEncryptedObject
 	ErrInvalidEncryptionParameters
 	ErrInvalidEncryptionParametersSSEC
 	ErrInvalidSSECustomerAlgorithm
 	ErrInvalidSSECustomerKey
 	ErrMissingSSECustomerKey
@@ -216,6 +231,7 @@ const (
 	ErrIncompatibleEncryptionMethod
 	ErrKMSNotConfigured
 	ErrKMSKeyNotFoundException
 	ErrKMSDefaultKeyAlreadyConfigured
 	ErrNoAccessKey
 	ErrInvalidToken
@@ -239,18 +255,17 @@ const (
 	// Add new extended error codes here.
 	// MinIO extended errors.
 	ErrReadQuorum
 	ErrWriteQuorum
 	ErrStorageFull
 	ErrRequestBodyParse
 	ErrObjectExistsAsDirectory
 	ErrInvalidObjectName
 	ErrInvalidObjectNamePrefixSlash
 	ErrInvalidResourceName
 	ErrInvalidLifecycleQueryParameter
 	ErrServerNotInitialized
-	ErrOperationTimedOut
+	ErrRequestTimedout
 	ErrClientDisconnected
-	ErrOperationMaxedOut
+	ErrTooManyRequests
 	ErrInvalidRequest
 	ErrTransitionStorageClassNotFoundError
 	// MinIO storage class error codes
@@ -262,10 +277,13 @@ const (
 	ErrMalformedJSON
 	ErrAdminNoSuchUser
 	ErrAdminNoSuchUserLDAPWarn
 	ErrAdminNoSuchGroup
 	ErrAdminGroupNotEmpty
 	ErrAdminGroupDisabled
 	ErrAdminNoSuchJob
 	ErrAdminNoSuchPolicy
 	ErrAdminPolicyChangeAlreadyApplied
 	ErrAdminInvalidArgument
 	ErrAdminInvalidAccessKey
 	ErrAdminInvalidSecretKey
@@ -276,8 +294,10 @@ const (
 	ErrAdminConfigEnvOverridden
 	ErrAdminConfigDuplicateKeys
 	ErrAdminConfigInvalidIDPType
 	ErrAdminConfigLDAPNonDefaultConfigName
 	ErrAdminConfigLDAPValidation
-	ErrAdminCredentialsMismatch
+	ErrAdminConfigIDPCfgNameAlreadyExists
 	ErrAdminConfigIDPCfgNameDoesNotExist
 	ErrInsecureClientRequest
 	ErrObjectTampered
@@ -290,6 +310,11 @@ const (
 	ErrSiteReplicationBucketMetaError
 	ErrSiteReplicationIAMError
 	ErrSiteReplicationConfigMissing
 	ErrSiteReplicationIAMConfigMismatch
 	// Pool rebalance errors
 	ErrAdminRebalanceAlreadyStarted
 	ErrAdminRebalanceNotStarted
 	// Bucket Quota error codes
 	ErrAdminBucketQuotaExceeded
@@ -365,7 +390,7 @@ const (
 	ErrParseExpectedIdentForGroupName
 	ErrParseExpectedIdentForAlias
 	ErrParseUnsupportedCallWithStar
-	ErrParseNonUnaryAgregateFunctionCall
+	ErrParseNonUnaryAggregateFunctionCall
 	ErrParseMalformedJoin
 	ErrParseExpectedIdentForAt
 	ErrParseAsteriskIsNotAloneInSelectList
@@ -400,6 +425,18 @@ const (
 	ErrPostPolicyConditionInvalidFormat
 	ErrInvalidChecksum
 	// Lambda functions
 	ErrLambdaARNInvalid
 	ErrLambdaARNNotFound
 	// New Codes for GetObjectAttributes and GetObjectVersionAttributes
 	ErrInvalidAttributeName
 	ErrAdminNoAccessKey
 	ErrAdminNoSecretKey
 	apiErrCodeEnd // This is used only for the testing code
 )
 type errorCodeMap map[APIErrorCode]APIError
@@ -413,8 +450,7 @@ func (e errorCodeMap) ToAPIErrWithErr(errCode APIErrorCode, err error) APIError
 		apiErr.Description = fmt.Sprintf("%s (%s)", apiErr.Description, err)
 	}
 	if globalSite.Region != "" {
-		switch errCode {
+		if errCode == ErrAuthorizationHeaderMalformed {
 		case ErrAuthorizationHeaderMalformed:
 			apiErr.Description = fmt.Sprintf("The authorization header is malformed; the region is wrong; expecting '%s'.", globalSite.Region)
 			return apiErr
 		}
@@ -509,6 +545,11 @@ var errorCodes = errorCodeMap{
 		Description:    "Your proposed upload exceeds the maximum allowed object size.",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrExcessData: {
 		Code:           "ExcessData",
 		Description:    "More data provided than indicated content length",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrPolicyTooLarge: {
 		Code:           "PolicyTooLarge",
 		Description:    "Policy exceeds the maximum allowed document size.",
@@ -534,6 +575,11 @@ var errorCodes = errorCodeMap{
 		Description:    "Your account is disabled; please contact your administrator.",
 		HTTPStatusCode: http.StatusForbidden,
 	},
 	ErrInvalidArgument: {
 		Code:           "InvalidArgument",
 		Description:    "Invalid argument",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrInvalidBucketName: {
 		Code:           "InvalidBucketName",
 		Description:    "The specified bucket is not valid.",
@@ -659,6 +705,11 @@ var errorCodes = errorCodeMap{
 		Description:    "One or more of the specified parts could not be found.  The part may not have been uploaded, or the specified entity tag may not match the part's entity tag.",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrMissingPart: {
 		Code:           "InvalidRequest",
 		Description:    "You must specify at least one part",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrInvalidPartOrder: {
 		Code:           "InvalidPartOrder",
 		Description:    "The list of parts was not in ascending order. The parts list must be specified in order by part number.",
@@ -689,11 +740,6 @@ var errorCodes = errorCodeMap{
 		Description:    "The authorization mechanism you have provided is not supported. Please use AWS4-HMAC-SHA256.",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrTooManyBuckets: {
 		Code:           "TooManyBuckets",
 		Description:    "You have attempted to create more buckets than allowed",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrBucketNotEmpty: {
 		Code:           "BucketNotEmpty",
 		Description:    "The bucket you tried to delete is not empty",
@@ -709,9 +755,9 @@ var errorCodes = errorCodeMap{
 		Description:    "All access to this resource has been disabled.",
 		HTTPStatusCode: http.StatusForbidden,
 	},
-	ErrMalformedPolicy: {
+	ErrPolicyInvalidVersion: {
 		Code:           "MalformedPolicy",
-		Description:    "Policy has invalid resource.",
+		Description:    "The policy must contain a valid version string",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrMissingFields: {
@@ -809,11 +855,21 @@ var errorCodes = errorCodeMap{
 		Description:    "Request is not valid yet",
 		HTTPStatusCode: http.StatusForbidden,
 	},
-	ErrSlowDown: {
+	ErrSlowDownRead: {
-		Code:           "SlowDown",
+		Code:           "SlowDownRead",
 		Description:    "Resource requested is unreadable, please reduce your request rate",
 		HTTPStatusCode: http.StatusServiceUnavailable,
 	},
 	ErrSlowDownWrite: {
 		Code:           "SlowDownWrite",
 		Description:    "Resource requested is unwritable, please reduce your request rate",
 		HTTPStatusCode: http.StatusServiceUnavailable,
 	},
 	ErrMaxVersionsExceeded: {
 		Code:           "MaxVersionsExceeded",
 		Description:    "You've exceeded the limit on the number of versions you can create on this object",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrInvalidPrefixMarker: {
 		Code:           "InvalidPrefixMarker",
 		Description:    "Invalid marker prefix combination",
@@ -906,7 +962,7 @@ var errorCodes = errorCodeMap{
 	},
 	ErrReplicationBandwidthLimitError: {
 		Code:           "XMinioAdminReplicationBandwidthLimitError",
-		Description:    "Bandwidth limit for remote target must be atleast 100MBps",
+		Description:    "Bandwidth limit for remote target must be at least 100MBps",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrReplicationNoExistingObjects: {
@@ -914,6 +970,11 @@ var errorCodes = errorCodeMap{
 		Description:    "No matching ExistingsObjects rule enabled",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrRemoteTargetDenyAddError: {
 		Code:           "XMinioAdminRemoteTargetDenyAdd",
 		Description:    "Cannot add remote target endpoint since this server is in a cluster replication setup",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrReplicationDenyEditError: {
 		Code:           "XMinioReplicationDenyEdit",
 		Description:    "Cannot alter local replication config since this server is in a cluster replication setup",
@@ -969,6 +1030,16 @@ var errorCodes = errorCodeMap{
 		Description:    "Versioning must be 'Enabled' on the bucket to add a replication target",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrReplicationValidationError: {
 		Code:           "InvalidRequest",
 		Description:    "Replication validation failed on target",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrReplicationPermissionCheckError: {
 		Code:           "ReplicationPermissionCheck",
 		Description:    "X-Minio-Source-Replication-Check cannot be specified in request. Request cannot be completed",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrNoSuchObjectLockConfiguration: {
 		Code:           "NoSuchObjectLockConfiguration",
 		Description:    "The specified object does not have a ObjectLock configuration",
@@ -1082,8 +1153,13 @@ var errorCodes = errorCodeMap{
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrInvalidEncryptionMethod: {
-		Code:           "InvalidRequest",
+		Code:           "InvalidArgument",
-		Description:    "The encryption method specified is not supported",
+		Description:    "Server Side Encryption with AWS KMS managed key requires HTTP header x-amz-server-side-encryption : aws:kms",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrIncompatibleEncryptionMethod: {
 		Code:           "InvalidArgument",
 		Description:    "Server Side Encryption with Customer provided key is incompatible with the encryption method specified",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrInvalidEncryptionKeyID: {
@@ -1111,6 +1187,11 @@ var errorCodes = errorCodeMap{
 		Description:    "The encryption parameters are not applicable to this object.",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrInvalidEncryptionParametersSSEC: {
 		Code:           "InvalidRequest",
 		Description:    "SSE-C encryption parameters are not supported on replicated bucket.",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrInvalidSSECustomerAlgorithm: {
 		Code:           "InvalidArgument",
 		Description:    "Requests specifying Server Side Encryption with Customer provided keys must provide a valid encryption algorithm.",
@@ -1141,11 +1222,6 @@ var errorCodes = errorCodeMap{
 		Description:    "The provided encryption parameters did not match the ones used originally.",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrIncompatibleEncryptionMethod: {
 		Code:           "InvalidArgument",
 		Description:    "Server side encryption specified with both SSE-C and SSE-S3 headers",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrKMSNotConfigured: {
 		Code:           "NotImplemented",
 		Description:    "Server side encryption specified but KMS is not configured",
@@ -1156,6 +1232,11 @@ var errorCodes = errorCodeMap{
 		Description:    "Invalid keyId",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrKMSDefaultKeyAlreadyConfigured: {
 		Code:           "KMS.DefaultKeyAlreadyConfiguredException",
 		Description:    "A default encryption already exists and cannot be changed on KMS",
 		HTTPStatusCode: http.StatusConflict,
 	},
 	ErrNoAccessKey: {
 		Code:           "AccessDenied",
 		Description:    "No AWSAccessKey was presented",
@@ -1220,11 +1301,21 @@ var errorCodes = errorCodeMap{
 		Description:    "The JSON you provided was not well-formed or did not validate against our published format.",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrInvalidLifecycleQueryParameter: {
 		Code:           "XMinioInvalidLifecycleParameter",
 		Description:    "The boolean value provided for withUpdatedAt query parameter was invalid.",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrAdminNoSuchUser: {
 		Code:           "XMinioAdminNoSuchUser",
 		Description:    "The specified user does not exist.",
 		HTTPStatusCode: http.StatusNotFound,
 	},
 	ErrAdminNoSuchUserLDAPWarn: {
 		Code:           "XMinioAdminNoSuchUser",
 		Description:    "The specified user does not exist. If you meant a user in LDAP, use `mc idp ldap`",
 		HTTPStatusCode: http.StatusNotFound,
 	},
 	ErrAdminNoSuchGroup: {
 		Code:           "XMinioAdminNoSuchGroup",
 		Description:    "The specified group does not exist.",
@@ -1240,11 +1331,22 @@ var errorCodes = errorCodeMap{
 		Description:    "The specified group is not empty - cannot remove it.",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrAdminGroupDisabled: {
 		Code:           "XMinioAdminGroupDisabled",
 		Description:    "The specified group is disabled.",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrAdminNoSuchPolicy: {
 		Code:           "XMinioAdminNoSuchPolicy",
 		Description:    "The canned policy does not exist.",
 		HTTPStatusCode: http.StatusNotFound,
 	},
 	ErrAdminPolicyChangeAlreadyApplied: {
 		Code:           "XMinioAdminPolicyChangeAlreadyApplied",
 		Description:    "The specified policy change is already in effect.",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrAdminInvalidArgument: {
 		Code:           "XMinioAdminInvalidArgument",
 		Description:    "Invalid arguments specified.",
@@ -1260,6 +1362,16 @@ var errorCodes = errorCodeMap{
 		Description:    "The secret key is invalid.",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrAdminNoAccessKey: {
 		Code:           "XMinioAdminNoAccessKey",
 		Description:    "No access key was provided.",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrAdminNoSecretKey: {
 		Code:           "XMinioAdminNoSecretKey",
 		Description:    "No secret key was provided.",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrAdminConfigNoQuorum: {
 		Code:           "XMinioAdminConfigNoQuorum",
 		Description:    "Configuration update failed because server quorum was not met",
@@ -1296,11 +1408,26 @@ var errorCodes = errorCodeMap{
 		Description:    fmt.Sprintf("Invalid IDP configuration type - must be one of %v", madmin.ValidIDPConfigTypes),
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrAdminConfigLDAPNonDefaultConfigName: {
 		Code:           "XMinioAdminConfigLDAPNonDefaultConfigName",
 		Description:    "Only a single LDAP configuration is supported - config name must be empty or `_`",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrAdminConfigLDAPValidation: {
 		Code:           "XMinioAdminConfigLDAPValidation",
 		Description:    "LDAP Configuration validation failed",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrAdminConfigIDPCfgNameAlreadyExists: {
 		Code:           "XMinioAdminConfigIDPCfgNameAlreadyExists",
 		Description:    "An IDP configuration with the given name already exists",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrAdminConfigIDPCfgNameDoesNotExist: {
 		Code:           "XMinioAdminConfigIDPCfgNameDoesNotExist",
 		Description:    "No such IDP configuration exists",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrAdminConfigNotificationTargetsFailed: {
 		Code:           "XMinioAdminNotificationTargetsTestFailed",
 		Description:    "Configuration update failed due an unsuccessful attempt to connect to one or more notification servers",
@@ -1311,11 +1438,6 @@ var errorCodes = errorCodeMap{
 		Description:    "Unable to perform the requested operation because profiling is not enabled",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrAdminCredentialsMismatch: {
 		Code:           "XMinioAdminCredentialsMismatch",
 		Description:    "Credentials in config mismatch with server environment variables",
 		HTTPStatusCode: http.StatusServiceUnavailable,
 	},
 	ErrAdminBucketQuotaExceeded: {
 		Code:           "XMinioAdminBucketQuotaExceeded",
 		Description:    "Bucket quota exceeded",
@@ -1331,7 +1453,7 @@ var errorCodes = errorCodeMap{
 		Description:    "Cannot respond to plain-text request from TLS-encrypted server",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
-	ErrOperationTimedOut: {
+	ErrRequestTimedout: {
 		Code:           "RequestTimeout",
 		Description:    "A timeout occurred while trying to lock a resource, please reduce your request rate",
 		HTTPStatusCode: http.StatusServiceUnavailable,
@@ -1341,9 +1463,9 @@ var errorCodes = errorCodeMap{
 		Description:    "Client disconnected before response was ready",
 		HTTPStatusCode: 499, // No official code, use nginx value.
 	},
-	ErrOperationMaxedOut: {
+	ErrTooManyRequests: {
-		Code:           "SlowDown",
+		Code:           "TooManyRequests",
-		Description:    "A timeout exceeded while waiting to proceed with the request, please reduce your request rate",
+		Description:    "Deadline exceeded while waiting in incoming queue, please reduce your request rate",
 		HTTPStatusCode: http.StatusServiceUnavailable,
 	},
 	ErrUnsupportedMetadata: {
@@ -1351,6 +1473,11 @@ var errorCodes = errorCodeMap{
 		Description:    "Your metadata headers are not supported.",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrUnsupportedHostHeader: {
 		Code:           "InvalidArgument",
 		Description:    "Your Host header is malformed.",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrObjectTampered: {
 		Code:           "XMinioObjectTampered",
 		Description:    errObjectTampered.Error(),
@@ -1365,7 +1492,7 @@ var errorCodes = errorCodeMap{
 	ErrSiteReplicationPeerResp: {
 		Code:           "XMinioSiteReplicationPeerResp",
 		Description:    "Error received when contacting a peer site",
-		HTTPStatusCode: http.StatusServiceUnavailable,
+		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrSiteReplicationBackendIssue: {
 		Code:           "XMinioSiteReplicationBackendIssue",
@@ -1397,6 +1524,21 @@ var errorCodes = errorCodeMap{
 		Description:    "Site not found in site replication configuration",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrSiteReplicationIAMConfigMismatch: {
 		Code:           "XMinioSiteReplicationIAMConfigMismatch",
 		Description:    "IAM configuration mismatch between sites",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrAdminRebalanceAlreadyStarted: {
 		Code:           "XMinioAdminRebalanceAlreadyStarted",
 		Description:    "Pool rebalance is already started",
 		HTTPStatusCode: http.StatusConflict,
 	},
 	ErrAdminRebalanceNotStarted: {
 		Code:           "XMinioAdminRebalanceNotStarted",
 		Description:    "Pool rebalance is not started",
 		HTTPStatusCode: http.StatusNotFound,
 	},
 	ErrMaximumExpires: {
 		Code:           "AuthorizationQueryParametersError",
 		Description:    "X-Amz-Expires must be less than a week (in seconds); that is, the given X-Amz-Expires must be less than 604800 seconds",
@@ -1473,7 +1615,7 @@ var errorCodes = errorCodeMap{
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrBusy: {
-		Code:           "Busy",
+		Code:           "ServerBusy",
 		Description:    "The service is unavailable. Please retry.",
 		HTTPStatusCode: http.StatusServiceUnavailable,
 	},
@@ -1757,8 +1899,8 @@ var errorCodes = errorCodeMap{
 		Description:    "Only COUNT with (*) as a parameter is supported in the SQL expression.",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
-	ErrParseNonUnaryAgregateFunctionCall: {
+	ErrParseNonUnaryAggregateFunctionCall: {
-		Code:           "ParseNonUnaryAgregateFunctionCall",
+		Code:           "ParseNonUnaryAggregateFunctionCall",
 		Description:    "Only one argument is supported for aggregate functions in the SQL expression.",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
@@ -1879,7 +2021,7 @@ var errorCodes = errorCodeMap{
 	},
 	ErrAddUserInvalidArgument: {
 		Code:           "XMinioInvalidIAMCredentials",
-		Description:    "User is not allowed to be same as admin access key",
+		Description:    "Credential is not allowed to be same as admin access key",
 		HTTPStatusCode: http.StatusForbidden,
 	},
 	ErrAdminResourceInvalidArgument: {
@@ -1912,6 +2054,31 @@ var errorCodes = errorCodeMap{
 		Description:    "Invalid checksum provided.",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrLambdaARNInvalid: {
 		Code:           "LambdaARNInvalid",
 		Description:    "The specified lambda ARN is invalid",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrLambdaARNNotFound: {
 		Code:           "LambdaARNNotFound",
 		Description:    "The specified lambda ARN does not exist",
 		HTTPStatusCode: http.StatusNotFound,
 	},
 	ErrPolicyAlreadyAttached: {
 		Code:           "XMinioPolicyAlreadyAttached",
 		Description:    "The specified policy is already attached.",
 		HTTPStatusCode: http.StatusConflict,
 	},
 	ErrPolicyNotAttached: {
 		Code:           "XMinioPolicyNotAttached",
 		Description:    "The specified policy is not found.",
 		HTTPStatusCode: http.StatusNotFound,
 	},
 	ErrInvalidAttributeName: {
 		Code:           "InvalidArgument",
 		Description:    "Invalid attribute name specified.",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	// Add your error structure here.
 }
@@ -1923,19 +2090,29 @@ func toAPIErrorCode(ctx context.Context, err error) (apiErr APIErrorCode) {
 		return ErrNone
 	}
-	// Only return ErrClientDisconnected if the provided context is actually canceled.
+	// Errors that are generated by net.Conn and any context errors must be handled here.
-	// This way downstream context.Canceled will still report ErrOperationTimedOut
+	if errors.Is(err, os.ErrDeadlineExceeded) || errors.Is(err, context.DeadlineExceeded) {
-	if contextCanceled(ctx) {
+		return ErrRequestTimedout
 		if ctx.Err() == context.Canceled {
 			return ErrClientDisconnected
 		}
 	}
 	// Only return ErrClientDisconnected if the provided context is actually canceled.
 	// This way downstream context.Canceled will still report ErrRequestTimedout
 	if contextCanceled(ctx) && errors.Is(ctx.Err(), context.Canceled) {
 		return ErrClientDisconnected
 	}
 	// Unwrap the error first
 	err = unwrapAll(err)
 	switch err {
 	case errInvalidArgument:
 		apiErr = ErrAdminInvalidArgument
 	case errNoSuchPolicy:
 		apiErr = ErrAdminNoSuchPolicy
 	case errNoSuchUser:
 		apiErr = ErrAdminNoSuchUser
 	case errNoSuchUserLDAPWarn:
 		apiErr = ErrAdminNoSuchUserLDAPWarn
 	case errNoSuchServiceAccount:
 		apiErr = ErrAdminServiceAccountNotFound
 	case errNoSuchGroup:
@@ -1944,8 +2121,8 @@ func toAPIErrorCode(ctx context.Context, err error) (apiErr APIErrorCode) {
 		apiErr = ErrAdminGroupNotEmpty
 	case errNoSuchJob:
 		apiErr = ErrAdminNoSuchJob
-	case errNoSuchPolicy:
+	case errNoPolicyToAttachOrDetach:
-		apiErr = ErrAdminNoSuchPolicy
+		apiErr = ErrAdminPolicyChangeAlreadyApplied
 	case errSignatureMismatch:
 		apiErr = ErrSignatureDoesNotMatch
 	case errInvalidRange:
@@ -1960,11 +2137,23 @@ func toAPIErrorCode(ctx context.Context, err error) (apiErr APIErrorCode) {
 		apiErr = ErrAdminInvalidAccessKey
 	case auth.ErrInvalidSecretKeyLength:
 		apiErr = ErrAdminInvalidSecretKey
 	case auth.ErrNoAccessKeyWithSecretKey:
 		apiErr = ErrAdminNoAccessKey
 	case auth.ErrNoSecretKeyWithAccessKey:
 		apiErr = ErrAdminNoSecretKey
 	case errInvalidStorageClass:
 		apiErr = ErrInvalidStorageClass
 	case errErasureReadQuorum:
 		apiErr = ErrSlowDownRead
 	case errErasureWriteQuorum:
 		apiErr = ErrSlowDownWrite
 	case errMaxVersionsExceeded:
 		apiErr = ErrMaxVersionsExceeded
 	// SSE errors
 	case errInvalidEncryptionParameters:
 		apiErr = ErrInvalidEncryptionParameters
 	case errInvalidEncryptionParametersSSEC:
 		apiErr = ErrInvalidEncryptionParametersSSEC
 	case crypto.ErrInvalidEncryptionMethod:
 		apiErr = ErrInvalidEncryptionMethod
 	case crypto.ErrInvalidEncryptionKeyID:
@@ -1991,11 +2180,12 @@ func toAPIErrorCode(ctx context.Context, err error) (apiErr APIErrorCode) {
 		apiErr = ErrKMSNotConfigured
 	case errKMSKeyNotFound:
 		apiErr = ErrKMSKeyNotFoundException
-
+	case errKMSDefaultKeyAlreadyConfigured:
-	case context.Canceled, context.DeadlineExceeded:
+		apiErr = ErrKMSDefaultKeyAlreadyConfigured
-		apiErr = ErrOperationTimedOut
+	case context.Canceled:
-	case errDiskNotFound:
+		apiErr = ErrClientDisconnected
-		apiErr = ErrSlowDown
+	case context.DeadlineExceeded:
 		apiErr = ErrRequestTimedout
 	case objectlock.ErrInvalidRetentionDate:
 		apiErr = ErrInvalidRetentionDate
 	case objectlock.ErrPastObjectLockRetainDate:
@@ -2006,11 +2196,14 @@ func toAPIErrorCode(ctx context.Context, err error) (apiErr APIErrorCode) {
 		apiErr = ErrObjectLockInvalidHeaders
 	case objectlock.ErrMalformedXML:
 		apiErr = ErrMalformedXML
 	case errInvalidMaxParts:
 		apiErr = ErrInvalidMaxParts
 	case ioutil.ErrOverread:
 		apiErr = ErrExcessData
 	}
 	// Compression errors
-	switch err {
+	if err == errInvalidDecompressedSize {
 	case errInvalidDecompressedSize:
 		apiErr = ErrInvalidDecompressedSize
 	}
@@ -2021,7 +2214,7 @@ func toAPIErrorCode(ctx context.Context, err error) (apiErr APIErrorCode) {
 	// etcd specific errors, a key is always a bucket for us return
 	// ErrNoSuchBucket in such a case.
-	if err == dns.ErrNoEntriesFound {
+	if errors.Is(err, dns.ErrNoEntriesFound) {
 		return ErrNoSuchBucket
 	}
@@ -2071,11 +2264,9 @@ func toAPIErrorCode(ctx context.Context, err error) (apiErr APIErrorCode) {
 	case InvalidPart:
 		apiErr = ErrInvalidPart
 	case InsufficientWriteQuorum:
-		apiErr = ErrSlowDown
+		apiErr = ErrSlowDownWrite
 	case InsufficientReadQuorum:
-		apiErr = ErrSlowDown
+		apiErr = ErrSlowDownRead
 	case InvalidMarkerPrefixCombination:
 		apiErr = ErrNotImplemented
 	case InvalidUploadIDKeyCombination:
 		apiErr = ErrNotImplemented
 	case MalformedUploadID:
@@ -2088,10 +2279,10 @@ func toAPIErrorCode(ctx context.Context, err error) (apiErr APIErrorCode) {
 		apiErr = ErrContentSHA256Mismatch
 	case hash.ChecksumMismatch:
 		apiErr = ErrContentChecksumMismatch
-	case ObjectTooLarge:
+	case hash.SizeTooSmall:
 		apiErr = ErrEntityTooLarge
 	case ObjectTooSmall:
 		apiErr = ErrEntityTooSmall
 	case hash.SizeTooLarge:
 		apiErr = ErrEntityTooLarge
 	case NotImplemented:
 		apiErr = ErrNotImplemented
 	case PartTooBig:
@@ -2136,7 +2327,8 @@ func toAPIErrorCode(ctx context.Context, err error) (apiErr APIErrorCode) {
 		apiErr = ErrTransitionStorageClassNotFoundError
 	case InvalidObjectState:
 		apiErr = ErrInvalidObjectState
-
+	case PreConditionFailed:
 		apiErr = ErrPreconditionFailed
 	case BucketQuotaExceeded:
 		apiErr = ErrAdminBucketQuotaExceeded
 	case *event.ErrInvalidEventName:
@@ -2145,6 +2337,10 @@ func toAPIErrorCode(ctx context.Context, err error) (apiErr APIErrorCode) {
 		apiErr = ErrARNNotification
 	case *event.ErrARNNotFound:
 		apiErr = ErrARNNotification
 	case *levent.ErrInvalidARN:
 		apiErr = ErrLambdaARNInvalid
 	case *levent.ErrARNNotFound:
 		apiErr = ErrLambdaARNNotFound
 	case *event.ErrUnknownRegion:
 		apiErr = ErrRegionNotification
 	case *event.ErrInvalidFilterName:
@@ -2162,7 +2358,7 @@ func toAPIErrorCode(ctx context.Context, err error) (apiErr APIErrorCode) {
 	case *event.ErrUnsupportedConfiguration:
 		apiErr = ErrUnsupportedNotification
 	case OperationTimedOut:
-		apiErr = ErrOperationTimedOut
+		apiErr = ErrRequestTimedout
 	case BackendDown:
 		apiErr = ErrBackendDown
 	case ObjectNameTooLong:
@@ -2172,25 +2368,10 @@ func toAPIErrorCode(ctx context.Context, err error) (apiErr APIErrorCode) {
 	case dns.ErrBucketConflict:
 		apiErr = ErrBucketAlreadyExists
 	default:
-		var ie, iw int
+		if strings.Contains(err.Error(), "request declared a Content-Length") {
 		// This work-around is to handle the issue golang/go#30648
 		//nolint:gocritic
 		if _, ferr := fmt.Fscanf(strings.NewReader(err.Error()),
 			"request declared a Content-Length of %d but only wrote %d bytes",
 			&ie, &iw); ferr != nil {
 			apiErr = ErrInternalError
 			// Make sure to log the errors which we cannot translate
 			// to a meaningful S3 API errors. This is added to aid in
 			// debugging unexpected/unhandled errors.
 			logger.LogIf(ctx, err)
 		} else if ie > iw {
 			apiErr = ErrIncompleteBody
 		} else {
 			apiErr = ErrInternalError
 			// Make sure to log the errors which we cannot translate
 			// to a meaningful S3 API errors. This is added to aid in
 			// debugging unexpected/unhandled errors.
 			logger.LogIf(ctx, err)
 		}
 	}
@@ -2208,45 +2389,29 @@ func toAPIError(ctx context.Context, err error) APIError {
 	}
 	apiErr := errorCodes.ToAPIErr(toAPIErrorCode(ctx, err))
-	e, ok := err.(dns.ErrInvalidBucketName)
+	switch apiErr.Code {
-	if ok {
+	case "NotImplemented":
-		code := toAPIErrorCode(ctx, e)
+		desc := fmt.Sprintf("%s (%v)", apiErr.Description, err)
-		apiErr = errorCodes.ToAPIErrWithErr(code, e)
+		apiErr = APIError{
-	}
+			Code:           apiErr.Code,
-
+			Description:    desc,
-	if apiErr.Code == "NotImplemented" {
+			HTTPStatusCode: apiErr.HTTPStatusCode,
 		switch e := err.(type) {
 		case NotImplemented:
 			desc := e.Error()
 			if desc == "" {
 				desc = apiErr.Description
 			}
 			apiErr = APIError{
 				Code:           apiErr.Code,
 				Description:    desc,
 				HTTPStatusCode: apiErr.HTTPStatusCode,
 			}
 			return apiErr
 		}
-	}
+	case "XMinioBackendDown":
 	if apiErr.Code == "XMinioBackendDown" {
 		apiErr.Description = fmt.Sprintf("%s (%v)", apiErr.Description, err)
-		return apiErr
+	case "InternalError":
 	}
 	if apiErr.Code == "InternalError" {
 		// If we see an internal error try to interpret
 		// any underlying errors if possible depending on
-		// their internal error types. This code is only
+		// their internal error types.
 		// useful with gateway implementations.
 		switch e := err.(type) {
-		case batchReplicationJobError:
+		case kms.Error:
 			apiErr = APIError{
-				Code:           e.Code,
+				Description:    e.Err.Error(),
-				Description:    e.Description,
+				Code:           e.APICode,
 				HTTPStatusCode: e.HTTPStatusCode,
 			}
 		case batchReplicationJobError:
 			apiErr = APIError(e)
 		case InvalidArgument:
 			apiErr = APIError{
 				Code:           "InvalidArgument",
@@ -2255,27 +2420,25 @@ func toAPIError(ctx context.Context, err error) APIError {
 			}
 		case *xml.SyntaxError:
 			apiErr = APIError{
-				Code: "MalformedXML",
+				Code:           "MalformedXML",
-				Description: fmt.Sprintf("%s (%s)", errorCodes[ErrMalformedXML].Description,
+				Description:    fmt.Sprintf("%s (%s)", errorCodes[ErrMalformedXML].Description, e),
 					e.Error()),
 				HTTPStatusCode: errorCodes[ErrMalformedXML].HTTPStatusCode,
 			}
 		case url.EscapeError:
 			apiErr = APIError{
-				Code: "XMinioInvalidObjectName",
+				Code:           "XMinioInvalidObjectName",
-				Description: fmt.Sprintf("%s (%s)", errorCodes[ErrInvalidObjectName].Description,
+				Description:    fmt.Sprintf("%s (%s)", errorCodes[ErrInvalidObjectName].Description, e),
 					e.Error()),
 				HTTPStatusCode: http.StatusBadRequest,
 			}
 		case versioning.Error:
 			apiErr = APIError{
 				Code:           "IllegalVersioningConfigurationException",
-				Description:    fmt.Sprintf("Versioning configuration specified in the request is invalid. (%s)", e.Error()),
+				Description:    fmt.Sprintf("Versioning configuration specified in the request is invalid. (%s)", e),
 				HTTPStatusCode: http.StatusBadRequest,
 			}
 		case lifecycle.Error:
 			apiErr = APIError{
-				Code:           "InvalidRequest",
+				Code:           "InvalidArgument",
 				Description:    e.Error(),
 				HTTPStatusCode: http.StatusBadRequest,
 			}
@@ -2309,7 +2472,7 @@ func toAPIError(ctx context.Context, err error) APIError {
 				Description:    e.Message,
 				HTTPStatusCode: e.StatusCode,
 			}
-			if globalIsGateway && strings.Contains(e.Message, "KMS is not configured") {
+			if strings.Contains(e.Message, "KMS is not configured") {
 				apiErr = APIError{
 					Code:           "NotImplemented",
 					Description:    e.Message,
@@ -2333,22 +2496,10 @@ func toAPIError(ctx context.Context, err error) APIError {
 				Description:    e.Error(),
 				HTTPStatusCode: e.Response().StatusCode,
 			}
-			// Add more Gateway SDKs here if any in future.
+			// Add more other SDK related errors here if any in future.
 		default:
 			//nolint:gocritic
-			if errors.Is(err, errMalformedEncoding) {
+			if errors.Is(err, errMalformedEncoding) || errors.Is(err, errChunkTooBig) || errors.Is(err, strconv.ErrRange) {
 				apiErr = APIError{
 					Code:           "BadRequest",
 					Description:    err.Error(),
 					HTTPStatusCode: http.StatusBadRequest,
 				}
 			} else if errors.Is(err, errChunkTooBig) {
 				apiErr = APIError{
 					Code:           "BadRequest",
 					Description:    err.Error(),
 					HTTPStatusCode: http.StatusBadRequest,
 				}
 			} else if errors.Is(err, strconv.ErrRange) {
 				apiErr = APIError{
 					Code:           "BadRequest",
 					Description:    err.Error(),
@@ -2364,6 +2515,13 @@ func toAPIError(ctx context.Context, err error) APIError {
 		}
 	}
 	if apiErr.Code == "InternalError" {
 		// Make sure to log the errors which we cannot translate
 		// to a meaningful S3 API errors. This is added to aid in
 		// debugging unexpected/unhandled errors.
 		logger.LogIf(ctx, err)
 	}
 	return apiErr
 }
@@ -20,8 +20,6 @@ package cmd
 import (
 	"context"
 	"errors"
 	"os"
 	"path/filepath"
 	"testing"
 	"github.com/minio/minio/internal/crypto"
@@ -42,9 +40,8 @@ var toAPIErrorTests = []struct {
 	{err: ObjectNameInvalid{}, errCode: ErrInvalidObjectName},
 	{err: InvalidUploadID{}, errCode: ErrNoSuchUpload},
 	{err: InvalidPart{}, errCode: ErrInvalidPart},
-	{err: InsufficientReadQuorum{}, errCode: ErrSlowDown},
+	{err: InsufficientReadQuorum{}, errCode: ErrSlowDownRead},
-	{err: InsufficientWriteQuorum{}, errCode: ErrSlowDown},
+	{err: InsufficientWriteQuorum{}, errCode: ErrSlowDownWrite},
 	{err: InvalidMarkerPrefixCombination{}, errCode: ErrNotImplemented},
 	{err: InvalidUploadIDKeyCombination{}, errCode: ErrNotImplemented},
 	{err: MalformedUploadID{}, errCode: ErrNoSuchUpload},
 	{err: PartTooSmall{}, errCode: ErrEntityTooSmall},
@@ -67,11 +64,6 @@ var toAPIErrorTests = []struct {
 }
 func TestAPIErrCode(t *testing.T) {
 	disk := filepath.Join(globalTestTmpDir, "minio-"+nextSuffix())
 	defer os.RemoveAll(disk)
 	initFSObjects(disk, t)
 	ctx := context.Background()
 	for i, testCase := range toAPIErrorTests {
 		errCode := toAPIErrorCode(ctx, testCase.err)
@@ -80,3 +72,19 @@ func TestAPIErrCode(t *testing.T) {
 		}
 	}
 }
 // Check if an API error is properly defined
 func TestAPIErrCodeDefinition(t *testing.T) {
 	for errAPI := ErrNone + 1; errAPI < apiErrCodeEnd; errAPI++ {
 		errCode, ok := errorCodes[errAPI]
 		if !ok {
 			t.Fatal(errAPI, "error code is not defined in the API error code table")
 		}
 		if errCode.Code == "" {
 			t.Fatal(errAPI, "error code has an empty XML code")
 		}
 		if errCode.HTTPStatusCode == 0 {
 			t.Fatal(errAPI, "error code has a zero HTTP status code")
 		}
 	}
 }
@@ -20,13 +20,14 @@ package cmd
 import (
 	"bytes"
 	"encoding/json"
 	"encoding/xml"
 	"fmt"
 	"net/http"
 	"net/url"
 	"strconv"
 	"strings"
 	"time"
 	"github.com/minio/minio-go/v7/pkg/tags"
 	"github.com/minio/minio/internal/crypto"
 	xhttp "github.com/minio/minio/internal/http"
 	"github.com/minio/minio/internal/logger"
@@ -64,15 +65,31 @@ func setCommonHeaders(w http.ResponseWriter) {
 // Encodes the response headers into XML format.
 func encodeResponse(response interface{}) []byte {
-	var bytesBuffer bytes.Buffer
+	var buf bytes.Buffer
-	bytesBuffer.WriteString(xxml.Header)
+	buf.WriteString(xml.Header)
-	buf, err := xxml.Marshal(response)
+	if err := xml.NewEncoder(&buf).Encode(response); err != nil {
 	if err != nil {
 		logger.LogIf(GlobalContext, err)
 		return nil
 	}
-	bytesBuffer.Write(buf)
+	return buf.Bytes()
-	return bytesBuffer.Bytes()
+}
 // Use this encodeResponseList() to support control characters
 // this function must be used by only ListObjects() for objects
 // with control characters, this is a specialized extension
 // to support AWS S3 compatible behavior.
 //
 // Do not use this function for anything other than ListObjects()
 // variants, please open a github discussion if you wish to use
 // this in other places.
 func encodeResponseList(response interface{}) []byte {
 	var buf bytes.Buffer
 	buf.WriteString(xxml.Header)
 	if err := xxml.NewEncoder(&buf).Encode(response); err != nil {
 		logger.LogIf(GlobalContext, err)
 		return nil
 	}
 	return buf.Bytes()
 }
 // Encodes the response headers into JSON format.
@@ -116,16 +133,15 @@ func setObjectHeaders(w http.ResponseWriter, objInfo ObjectInfo, rs *HTTPRangeSp
 		w.Header().Set(xhttp.Expires, objInfo.Expires.UTC().Format(http.TimeFormat))
 	}
 	if globalCacheConfig.Enabled {
 		w.Header().Set(xhttp.XCache, objInfo.CacheStatus.String())
 		w.Header().Set(xhttp.XCacheLookup, objInfo.CacheLookupStatus.String())
 	}
 	// Set tag count if object has tags
 	if len(objInfo.UserTags) > 0 {
-		tags, _ := url.ParseQuery(objInfo.UserTags)
+		tags, _ := tags.ParseObjectTags(objInfo.UserTags)
-		if len(tags) > 0 {
+		if tags.Count() > 0 {
-			w.Header()[xhttp.AmzTagCount] = []string{strconv.Itoa(len(tags))}
+			w.Header()[xhttp.AmzTagCount] = []string{strconv.Itoa(tags.Count())}
 			if opts.Tagging {
 				// This is MinIO only extension to return back tags along with the count.
 				w.Header()[xhttp.AmzObjectTagging] = []string{objInfo.UserTags}
 			}
 		}
 	}
@@ -136,7 +152,7 @@ func setObjectHeaders(w http.ResponseWriter, objInfo ObjectInfo, rs *HTTPRangeSp
 			continue
 		}
-		if strings.HasPrefix(strings.ToLower(k), ReservedMetadataPrefixLower) {
+		if stringsHasPrefixFold(k, ReservedMetadataPrefixLower) {
 			// Do not need to send any internal metadata
 			// values to client.
 			continue
@@ -149,7 +165,7 @@ func setObjectHeaders(w http.ResponseWriter, objInfo ObjectInfo, rs *HTTPRangeSp
 		var isSet bool
 		for _, userMetadataPrefix := range userMetadataKeyPrefixes {
-			if !strings.HasPrefix(strings.ToLower(k), strings.ToLower(userMetadataPrefix)) {
+			if !stringsHasPrefixFold(k, userMetadataPrefix) {
 				continue
 			}
 			w.Header()[strings.ToLower(k)] = []string{v}
@@ -186,7 +202,7 @@ func setObjectHeaders(w http.ResponseWriter, objInfo ObjectInfo, rs *HTTPRangeSp
 	}
 	// Set the relevant version ID as part of the response header.
-	if objInfo.VersionID != "" {
+	if objInfo.VersionID != "" && objInfo.VersionID != nullVersionID {
 		w.Header()[xhttp.AmzVersionID] = []string{objInfo.VersionID}
 	}
@@ -37,8 +37,8 @@ func getListObjectsV1Args(values url.Values) (prefix, marker, delimiter string,
 		maxkeys = maxObjectList
 	}
-	prefix = trimLeadingSlash(values.Get("prefix"))
+	prefix = values.Get("prefix")
-	marker = trimLeadingSlash(values.Get("marker"))
+	marker = values.Get("marker")
 	delimiter = values.Get("delimiter")
 	encodingType = values.Get("encoding-type")
 	return
@@ -57,8 +57,8 @@ func getListBucketObjectVersionsArgs(values url.Values) (prefix, marker, delimit
 		maxkeys = maxObjectList
 	}
-	prefix = trimLeadingSlash(values.Get("prefix"))
+	prefix = values.Get("prefix")
-	marker = trimLeadingSlash(values.Get("key-marker"))
+	marker = values.Get("key-marker")
 	delimiter = values.Get("delimiter")
 	encodingType = values.Get("encoding-type")
 	versionIDMarker = values.Get("version-id-marker")
@@ -87,8 +87,8 @@ func getListObjectsV2Args(values url.Values) (prefix, token, startAfter, delimit
 		maxkeys = maxObjectList
 	}
-	prefix = trimLeadingSlash(values.Get("prefix"))
+	prefix = values.Get("prefix")
-	startAfter = trimLeadingSlash(values.Get("start-after"))
+	startAfter = values.Get("start-after")
 	delimiter = values.Get("delimiter")
 	fetchOwner = values.Get("fetch-owner") == "true"
 	encodingType = values.Get("encoding-type")
@@ -118,8 +118,8 @@ func getBucketMultipartResources(values url.Values) (prefix, keyMarker, uploadID
 		maxUploads = maxUploadsList
 	}
-	prefix = trimLeadingSlash(values.Get("prefix"))
+	prefix = values.Get("prefix")
-	keyMarker = trimLeadingSlash(values.Get("key-marker"))
+	keyMarker = values.Get("key-marker")
 	uploadIDMarker = values.Get("upload-id-marker")
 	delimiter = values.Get("delimiter")
 	encodingType = values.Get("encoding-type")
@@ -29,21 +29,21 @@ import (
 	"strings"
 	"time"
 	"github.com/minio/minio/internal/amztime"
 	"github.com/minio/minio/internal/crypto"
 	"github.com/minio/minio/internal/handlers"
 	"github.com/minio/minio/internal/hash"
 	xhttp "github.com/minio/minio/internal/http"
 	"github.com/minio/minio/internal/logger"
 	"github.com/minio/pkg/v2/policy"
 	xxml "github.com/minio/xxml"
 )
 const (
-	// RFC3339 a subset of the ISO8601 timestamp format. e.g 2014-04-29T18:30:38Z
+	maxObjectList  = 1000  // Limit number of objects in a listObjectsResponse/listObjectsVersionsResponse.
-	iso8601TimeFormat = "2006-01-02T15:04:05.000Z" // Reply date format with nanosecond precision.
+	maxDeleteList  = 1000  // Limit number of objects deleted in a delete call.
-	maxObjectList     = 1000                       // Limit number of objects in a listObjectsResponse/listObjectsVersionsResponse.
+	maxUploadsList = 10000 // Limit number of uploads in a listUploadsResponse.
-	maxDeleteList     = 1000                       // Limit number of objects deleted in a delete call.
+	maxPartsList   = 10000 // Limit number of parts in a listPartsResponse.
 	maxUploadsList    = 10000                      // Limit number of uploads in a listUploadsResponse.
 	maxPartsList      = 10000                      // Limit number of parts in a listPartsResponse.
 )
 // LocationResponse - format for location response.
@@ -85,7 +85,7 @@ type ListVersionsResponse struct {
 	VersionIDMarker string `xml:"VersionIdMarker"`
 	MaxKeys   int
-	Delimiter string
+	Delimiter string `xml:"Delimiter,omitempty"`
 	// A flag that indicates whether or not ListObjects returned all of the results
 	// that satisfied the search criteria.
 	IsTruncated bool
@@ -115,7 +115,7 @@ type ListObjectsResponse struct {
 	NextMarker string `xml:"NextMarker,omitempty"`
 	MaxKeys   int
-	Delimiter string
+	Delimiter string `xml:"Delimiter,omitempty"`
 	// A flag that indicates whether or not ListObjects returned all of the results
 	// that satisfied the search criteria.
 	IsTruncated bool
@@ -146,7 +146,7 @@ type ListObjectsV2Response struct {
 	KeyCount  int
 	MaxKeys   int
-	Delimiter string
+	Delimiter string `xml:"Delimiter,omitempty"`
 	// A flag that indicates whether or not ListObjects returned all of the results
 	// that satisfied the search criteria.
 	IsTruncated bool
@@ -205,7 +205,7 @@ type ListMultipartUploadsResponse struct {
 	UploadIDMarker     string `xml:"UploadIdMarker"`
 	NextKeyMarker      string
 	NextUploadIDMarker string `xml:"NextUploadIdMarker"`
-	Delimiter          string
+	Delimiter          string `xml:"Delimiter,omitempty"`
 	Prefix             string
 	EncodingType       string `xml:"EncodingType,omitempty"`
 	MaxUploads         int
@@ -315,12 +315,12 @@ func (s *Metadata) Set(k, v string) {
 }
 type xmlKeyEntry struct {
-	XMLName xml.Name
+	XMLName xxml.Name
 	Value   string `xml:",chardata"`
 }
 // MarshalXML - StringMap marshals into XML.
-func (s *Metadata) MarshalXML(e *xml.Encoder, start xml.StartElement) error {
+func (s *Metadata) MarshalXML(e *xxml.Encoder, start xxml.StartElement) error {
 	if s == nil {
 		return nil
 	}
@@ -335,7 +335,7 @@ func (s *Metadata) MarshalXML(e *xml.Encoder, start xml.StartElement) error {
 	for _, item := range s.Items {
 		if err := e.Encode(xmlKeyEntry{
-			XMLName: xml.Name{Local: item.Key},
+			XMLName: xxml.Name{Local: item.Key},
 			Value:   item.Value,
 		}); err != nil {
 			return err
@@ -345,6 +345,13 @@ func (s *Metadata) MarshalXML(e *xml.Encoder, start xml.StartElement) error {
 	return e.EncodeToken(start.End())
 }
 // ObjectInternalInfo contains some internal information about a given
 // object, it will printed in listing calls with enabled metadata.
 type ObjectInternalInfo struct {
 	K int // Data blocks
 	M int // Parity blocks
 }
 // Object container for object metadata
 type Object struct {
 	Key          string
@@ -353,13 +360,16 @@ type Object struct {
 	Size         int64
 	// Owner of the object.
-	Owner Owner
+	Owner *Owner `xml:"Owner,omitempty"`
 	// The class of storage used to store the object.
 	StorageClass string
 	// UserMetadata user-defined metadata
 	UserMetadata *Metadata `xml:"UserMetadata,omitempty"`
 	UserTags     string    `xml:"UserTags,omitempty"`
 	Internal *ObjectInternalInfo `xml:"Internal,omitempty"`
 }
 // CopyObjectResponse container returns ETag and LastModified of the successfully copied object
@@ -482,7 +492,7 @@ func generateListBucketsResponse(buckets []BucketInfo) ListBucketsResponse {
 	for _, bucket := range buckets {
 		listbuckets = append(listbuckets, Bucket{
 			Name:         bucket.Name,
-			CreationDate: bucket.Created.UTC().Format(iso8601TimeFormat),
+			CreationDate: amztime.ISO8601Format(bucket.Created.UTC()),
 		})
 	}
@@ -492,23 +502,72 @@ func generateListBucketsResponse(buckets []BucketInfo) ListBucketsResponse {
 	return data
 }
 func cleanReservedKeys(metadata map[string]string) map[string]string {
 	m := cloneMSS(metadata)
 	switch kind, _ := crypto.IsEncrypted(metadata); kind {
 	case crypto.S3:
 		m[xhttp.AmzServerSideEncryption] = xhttp.AmzEncryptionAES
 	case crypto.S3KMS:
 		m[xhttp.AmzServerSideEncryption] = xhttp.AmzEncryptionKMS
 		m[xhttp.AmzServerSideEncryptionKmsID] = kmsKeyIDFromMetadata(metadata)
 		if kmsCtx, ok := metadata[crypto.MetaContext]; ok {
 			m[xhttp.AmzServerSideEncryptionKmsContext] = kmsCtx
 		}
 	case crypto.SSEC:
 		m[xhttp.AmzServerSideEncryptionCustomerAlgorithm] = xhttp.AmzEncryptionAES
 	}
 	var toRemove []string
 	for k := range cleanMinioInternalMetadataKeys(m) {
 		if stringsHasPrefixFold(k, ReservedMetadataPrefixLower) {
 			// Do not need to send any internal metadata
 			// values to client.
 			toRemove = append(toRemove, k)
 			continue
 		}
 		// https://github.com/google/security-research/security/advisories/GHSA-76wf-9vgp-pj7w
 		if equals(k, xhttp.AmzMetaUnencryptedContentLength, xhttp.AmzMetaUnencryptedContentMD5) {
 			toRemove = append(toRemove, k)
 			continue
 		}
 	}
 	for _, k := range toRemove {
 		delete(m, k)
 		delete(m, strings.ToLower(k))
 	}
 	return m
 }
 // generates an ListBucketVersions response for the said bucket with other enumerated options.
-func generateListVersionsResponse(bucket, prefix, marker, versionIDMarker, delimiter, encodingType string, maxKeys int, resp ListObjectVersionsInfo) ListVersionsResponse {
+func generateListVersionsResponse(bucket, prefix, marker, versionIDMarker, delimiter, encodingType string, maxKeys int, resp ListObjectVersionsInfo, metadata metaCheckFn) ListVersionsResponse {
 	versions := make([]ObjectVersion, 0, len(resp.Objects))
-	owner := Owner{
+	owner := &Owner{
 		ID:          globalMinioDefaultOwnerID,
 		DisplayName: "minio",
 	}
 	data := ListVersionsResponse{}
 	var lastObjMetaName string
 	var tagErr, metaErr APIErrorCode = -1, -1
 	for _, object := range resp.Objects {
 		if object.Name == "" {
 			continue
 		}
 		// Cache checks for the same object
 		if metadata != nil && lastObjMetaName != object.Name {
 			tagErr = metadata(object.Name, policy.GetObjectTaggingAction)
 			metaErr = metadata(object.Name, policy.GetObjectAction)
 			lastObjMetaName = object.Name
 		}
 		content := ObjectVersion{}
 		content.Key = s3EncodeName(object.Name, encodingType)
-		content.LastModified = object.ModTime.UTC().Format(iso8601TimeFormat)
+		content.LastModified = amztime.ISO8601Format(object.ModTime.UTC())
 		if object.ETag != "" {
 			content.ETag = "\"" + object.ETag + "\""
 		}
@@ -518,6 +577,29 @@ func generateListVersionsResponse(bucket, prefix, marker, versionIDMarker, delim
 		} else {
 			content.StorageClass = globalMinioDefaultStorageClass
 		}
 		if tagErr == ErrNone {
 			content.UserTags = object.UserTags
 		}
 		if metaErr == ErrNone {
 			content.UserMetadata = &Metadata{}
 			switch kind, _ := crypto.IsEncrypted(object.UserDefined); kind {
 			case crypto.S3:
 				content.UserMetadata.Set(xhttp.AmzServerSideEncryption, xhttp.AmzEncryptionAES)
 			case crypto.S3KMS:
 				content.UserMetadata.Set(xhttp.AmzServerSideEncryption, xhttp.AmzEncryptionKMS)
 			case crypto.SSEC:
 				content.UserMetadata.Set(xhttp.AmzServerSideEncryptionCustomerAlgorithm, xhttp.AmzEncryptionAES)
 			}
 			for k, v := range cleanReservedKeys(object.UserDefined) {
 				content.UserMetadata.Set(k, v)
 			}
 			content.UserMetadata.Set("expires", object.Expires.Format(http.TimeFormat))
 			content.Internal = &ObjectInternalInfo{
 				K: object.DataBlocks,
 				M: object.ParityBlocks,
 			}
 		}
 		content.Owner = owner
 		content.VersionID = object.VersionID
 		if content.VersionID == "" {
@@ -554,7 +636,7 @@ func generateListVersionsResponse(bucket, prefix, marker, versionIDMarker, delim
 // generates an ListObjectsV1 response for the said bucket with other enumerated options.
 func generateListObjectsV1Response(bucket, prefix, marker, delimiter, encodingType string, maxKeys int, resp ListObjectsInfo) ListObjectsResponse {
 	contents := make([]Object, 0, len(resp.Objects))
-	owner := Owner{
+	owner := &Owner{
 		ID:          globalMinioDefaultOwnerID,
 		DisplayName: "minio",
 	}
@@ -566,7 +648,7 @@ func generateListObjectsV1Response(bucket, prefix, marker, delimiter, encodingTy
 			continue
 		}
 		content.Key = s3EncodeName(object.Name, encodingType)
-		content.LastModified = object.ModTime.UTC().Format(iso8601TimeFormat)
+		content.LastModified = amztime.ISO8601Format(object.ModTime.UTC())
 		if object.ETag != "" {
 			content.ETag = "\"" + object.ETag + "\""
 		}
@@ -601,12 +683,16 @@ func generateListObjectsV1Response(bucket, prefix, marker, delimiter, encodingTy
 }
 // generates an ListObjectsV2 response for the said bucket with other enumerated options.
-func generateListObjectsV2Response(bucket, prefix, token, nextToken, startAfter, delimiter, encodingType string, fetchOwner, isTruncated bool, maxKeys int, objects []ObjectInfo, prefixes []string, metadata bool) ListObjectsV2Response {
+func generateListObjectsV2Response(bucket, prefix, token, nextToken, startAfter, delimiter, encodingType string, fetchOwner, isTruncated bool, maxKeys int, objects []ObjectInfo, prefixes []string, metadata metaCheckFn) ListObjectsV2Response {
 	contents := make([]Object, 0, len(objects))
-	owner := Owner{
+	var owner *Owner
-		ID:          globalMinioDefaultOwnerID,
+	if fetchOwner {
-		DisplayName: "minio",
+		owner = &Owner{
 			ID:          globalMinioDefaultOwnerID,
 			DisplayName: "minio",
 		}
 	}
 	data := ListObjectsV2Response{}
 	for _, object := range objects {
@@ -615,7 +701,7 @@ func generateListObjectsV2Response(bucket, prefix, token, nextToken, startAfter,
 			continue
 		}
 		content.Key = s3EncodeName(object.Name, encodingType)
-		content.LastModified = object.ModTime.UTC().Format(iso8601TimeFormat)
+		content.LastModified = amztime.ISO8601Format(object.ModTime.UTC())
 		if object.ETag != "" {
 			content.ETag = "\"" + object.ETag + "\""
 		}
@@ -626,27 +712,28 @@ func generateListObjectsV2Response(bucket, prefix, token, nextToken, startAfter,
 			content.StorageClass = globalMinioDefaultStorageClass
 		}
 		content.Owner = owner
-		if metadata {
+		if metadata != nil {
-			content.UserMetadata = &Metadata{}
+			if metadata(object.Name, policy.GetObjectTaggingAction) == ErrNone {
-			switch kind, _ := crypto.IsEncrypted(object.UserDefined); kind {
+				content.UserTags = object.UserTags
 			case crypto.S3:
 				content.UserMetadata.Set(xhttp.AmzServerSideEncryption, xhttp.AmzEncryptionAES)
 			case crypto.S3KMS:
 				content.UserMetadata.Set(xhttp.AmzServerSideEncryption, xhttp.AmzEncryptionKMS)
 			case crypto.SSEC:
 				content.UserMetadata.Set(xhttp.AmzServerSideEncryptionCustomerAlgorithm, xhttp.AmzEncryptionAES)
 			}
-			for k, v := range CleanMinioInternalMetadataKeys(object.UserDefined) {
+			if metadata(object.Name, policy.GetObjectAction) == ErrNone {
-				if strings.HasPrefix(strings.ToLower(k), ReservedMetadataPrefixLower) {
+				content.UserMetadata = &Metadata{}
-					// Do not need to send any internal metadata
+				switch kind, _ := crypto.IsEncrypted(object.UserDefined); kind {
-					// values to client.
+				case crypto.S3:
-					continue
+					content.UserMetadata.Set(xhttp.AmzServerSideEncryption, xhttp.AmzEncryptionAES)
 				case crypto.S3KMS:
 					content.UserMetadata.Set(xhttp.AmzServerSideEncryption, xhttp.AmzEncryptionKMS)
 				case crypto.SSEC:
 					content.UserMetadata.Set(xhttp.AmzServerSideEncryptionCustomerAlgorithm, xhttp.AmzEncryptionAES)
 				}
-				// https://github.com/google/security-research/security/advisories/GHSA-76wf-9vgp-pj7w
+				for k, v := range cleanReservedKeys(object.UserDefined) {
-				if equals(k, xhttp.AmzMetaUnencryptedContentLength, xhttp.AmzMetaUnencryptedContentMD5) {
+					content.UserMetadata.Set(k, v)
-					continue
+				}
 				content.UserMetadata.Set("expires", object.Expires.Format(http.TimeFormat))
 				content.Internal = &ObjectInternalInfo{
 					K: object.DataBlocks,
 					M: object.ParityBlocks,
 				}
 				content.UserMetadata.Set(k, v)
 			}
 		}
 		contents = append(contents, content)
@@ -674,11 +761,13 @@ func generateListObjectsV2Response(bucket, prefix, token, nextToken, startAfter,
 	return data
 }
 type metaCheckFn = func(name string, action policy.Action) (s3Err APIErrorCode)
 // generates CopyObjectResponse from etag and lastModified time.
 func generateCopyObjectResponse(etag string, lastModified time.Time) CopyObjectResponse {
 	return CopyObjectResponse{
 		ETag:         "\"" + etag + "\"",
-		LastModified: lastModified.UTC().Format(iso8601TimeFormat),
+		LastModified: amztime.ISO8601Format(lastModified.UTC()),
 	}
 }
@@ -686,7 +775,7 @@ func generateCopyObjectResponse(etag string, lastModified time.Time) CopyObjectR
 func generateCopyObjectPartResponse(etag string, lastModified time.Time) CopyObjectPartResponse {
 	return CopyObjectPartResponse{
 		ETag:         "\"" + etag + "\"",
-		LastModified: lastModified.UTC().Format(iso8601TimeFormat),
+		LastModified: amztime.ISO8601Format(lastModified.UTC()),
 	}
 }
@@ -701,7 +790,7 @@ func generateInitiateMultipartUploadResponse(bucket, key, uploadID string) Initi
 // generates CompleteMultipartUploadResponse for given bucket, key, location and ETag.
 func generateCompleteMultpartUploadResponse(bucket, key, location string, oi ObjectInfo) CompleteMultipartUploadResponse {
-	cs := oi.decryptChecksums()
+	cs := oi.decryptChecksums(0)
 	c := CompleteMultipartUploadResponse{
 		Location: location,
 		Bucket:   bucket,
@@ -746,7 +835,7 @@ func generateListPartsResponse(partsInfo ListPartsInfo, encodingType string) Lis
 		newPart.PartNumber = part.PartNumber
 		newPart.ETag = "\"" + part.ETag + "\""
 		newPart.Size = part.Size
-		newPart.LastModified = part.LastModified.UTC().Format(iso8601TimeFormat)
+		newPart.LastModified = amztime.ISO8601Format(part.LastModified.UTC())
 		newPart.ChecksumCRC32 = part.ChecksumCRC32
 		newPart.ChecksumCRC32C = part.ChecksumCRC32C
 		newPart.ChecksumSHA1 = part.ChecksumSHA1
@@ -780,7 +869,7 @@ func generateListMultipartUploadsResponse(bucket string, multipartsInfo ListMult
 		newUpload := Upload{}
 		newUpload.UploadID = upload.UploadID
 		newUpload.Key = s3EncodeName(upload.Object, encodingType)
-		newUpload.Initiated = upload.Initiated.UTC().Format(iso8601TimeFormat)
+		newUpload.Initiated = amztime.ISO8601Format(upload.Initiated.UTC())
 		listMultipartUploadsResponse.Uploads[index] = newUpload
 	}
 	return listMultipartUploadsResponse
@@ -802,7 +891,7 @@ func writeResponse(w http.ResponseWriter, statusCode int, response []byte, mType
 	}
 	// Similar check to http.checkWriteHeaderCode
 	if statusCode < 100 || statusCode > 999 {
-		logger.Error(fmt.Sprintf("invalid WriteHeader code %v", statusCode))
+		logger.LogIf(context.Background(), fmt.Errorf("invalid WriteHeader code %v", statusCode))
 		statusCode = http.StatusInternalServerError
 	}
 	setCommonHeaders(w)
@@ -855,13 +944,15 @@ func writeSuccessResponseHeadersOnly(w http.ResponseWriter) {
 	writeResponse(w, http.StatusOK, nil, mimeNone)
 }
-// writeErrorRespone writes error headers
+// writeErrorResponse writes error headers
 func writeErrorResponse(ctx context.Context, w http.ResponseWriter, err APIError, reqURL *url.URL) {
-	switch err.Code {
+	if err.HTTPStatusCode == http.StatusServiceUnavailable {
 	case "SlowDown", "XMinioServerNotInitialized", "XMinioReadQuorum", "XMinioWriteQuorum":
 		// Set retry-after header to indicate user-agents to retry request after 120secs.
 		// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Retry-After
 		w.Header().Set(xhttp.RetryAfter, "120")
 	}
 	switch err.Code {
 	case "InvalidRegion":
 		err.Description = fmt.Sprintf("Region does not match; expecting '%s'.", globalSite.Region)
 	case "AuthorizationHeaderMalformed":
@@ -870,18 +961,20 @@ func writeErrorResponse(ctx context.Context, w http.ResponseWriter, err APIError
 	// Similar check to http.checkWriteHeaderCode
 	if err.HTTPStatusCode < 100 || err.HTTPStatusCode > 999 {
-		logger.Error(fmt.Sprintf("invalid WriteHeader code %v from %v", err.HTTPStatusCode, err.Code))
+		logger.LogIf(ctx, fmt.Errorf("invalid WriteHeader code %v from %v", err.HTTPStatusCode, err.Code))
 		err.HTTPStatusCode = http.StatusInternalServerError
 	}
 	// Generate error response.
 	errorResponse := getAPIErrorResponse(ctx, err, reqURL.Path,
-		w.Header().Get(xhttp.AmzRequestID), globalDeploymentID)
+		w.Header().Get(xhttp.AmzRequestID), w.Header().Get(xhttp.AmzRequestHostID))
 	encodedErrorResponse := encodeResponse(errorResponse)
 	writeResponse(w, err.HTTPStatusCode, encodedErrorResponse, mimeXML)
 }
 func writeErrorResponseHeadersOnly(w http.ResponseWriter, err APIError) {
 	w.Header().Set(xMinIOErrCodeHeader, err.Code)
 	w.Header().Set(xMinIOErrDescHeader, "\""+err.Description+"\"")
 	writeResponse(w, err.HTTPStatusCode, nil, mimeNone)
 }
@@ -894,7 +987,7 @@ func writeErrorResponseString(ctx context.Context, w http.ResponseWriter, err AP
 // useful for admin APIs.
 func writeErrorResponseJSON(ctx context.Context, w http.ResponseWriter, err APIError, reqURL *url.URL) {
 	// Generate error response.
-	errorResponse := getAPIErrorResponse(ctx, err, reqURL.Path, w.Header().Get(xhttp.AmzRequestID), globalDeploymentID)
+	errorResponse := getAPIErrorResponse(ctx, err, reqURL.Path, w.Header().Get(xhttp.AmzRequestID), w.Header().Get(xhttp.AmzRequestHostID))
 	encodedErrorResponse := encodeResponseJSON(errorResponse)
 	writeResponse(w, err.HTTPStatusCode, encodedErrorResponse, mimeJSON)
 }
@@ -913,7 +1006,7 @@ func writeCustomErrorResponseJSON(ctx context.Context, w http.ResponseWriter, er
 		BucketName: reqInfo.BucketName,
 		Key:        reqInfo.ObjectName,
 		RequestID:  w.Header().Get(xhttp.AmzRequestID),
-		HostID:     globalDeploymentID,
+		HostID:     globalDeploymentID(),
 	}
 	encodedErrorResponse := encodeResponseJSON(errorResponse)
 	writeResponse(w, err.HTTPStatusCode, encodedErrorResponse, mimeJSON)
@@ -18,16 +18,13 @@
 package cmd
 import (
 	"compress/gzip"
 	"net"
 	"net/http"
-	"github.com/gorilla/mux"
+	consoleapi "github.com/minio/console/api"
 	"github.com/klauspost/compress/gzhttp"
 	"github.com/minio/console/restapi"
 	xhttp "github.com/minio/minio/internal/http"
-	"github.com/minio/minio/internal/logger"
+	"github.com/minio/mux"
-	"github.com/minio/pkg/wildcard"
+	"github.com/minio/pkg/v2/wildcard"
 	"github.com/rs/cors"
 )
@@ -43,13 +40,13 @@ func setHTTPServer(h *xhttp.Server) {
 	globalObjLayerMutex.Unlock()
 }
-func newConsoleServerFn() *restapi.Server {
+func newConsoleServerFn() *consoleapi.Server {
 	globalObjLayerMutex.RLock()
 	defer globalObjLayerMutex.RUnlock()
 	return globalConsoleSrv
 }
-func setConsoleSrv(srv *restapi.Server) {
+func setConsoleSrv(srv *consoleapi.Server) {
 	globalObjLayerMutex.Lock()
 	globalConsoleSrv = srv
 	globalObjLayerMutex.Unlock()
@@ -61,18 +58,6 @@ func newObjectLayerFn() ObjectLayer {
 	return globalObjectAPI
 }
 func newCachedObjectLayerFn() CacheObjectLayer {
 	globalObjLayerMutex.RLock()
 	defer globalObjLayerMutex.RUnlock()
 	return globalCacheObjectAPI
 }
 func setCacheObjectLayer(c CacheObjectLayer) {
 	globalObjLayerMutex.Lock()
 	globalCacheObjectAPI = c
 	globalObjLayerMutex.Unlock()
 }
 func setObjectLayer(o ObjectLayer) {
 	globalObjLayerMutex.Lock()
 	globalObjectAPI = o
@@ -82,7 +67,6 @@ func setObjectLayer(o ObjectLayer) {
 // objectAPIHandler implements and provides http handlers for S3 API.
 type objectAPIHandlers struct {
 	ObjectAPI func() ObjectLayer
 	CacheAPI  func() CacheObjectLayer
 }
 // getHost tries its best to return the request host.
@@ -184,12 +168,92 @@ var rejectedBucketAPIs = []rejectedAPI{
 	},
 }
 // Set of s3 handler options as bit flags.
 type s3HFlag uint8
 const (
 	// when provided, disables Gzip compression.
 	noGZS3HFlag = 1 << iota
 	// when provided, enables only tracing of headers. Otherwise, both headers
 	// and body are traced.
 	traceHdrsS3HFlag
 	// when provided, disables throttling via the `maxClients` middleware.
 	noThrottleS3HFlag
 )
 func (h s3HFlag) has(flag s3HFlag) bool {
 	// Use bitwise-AND and check if the result is non-zero.
 	return h&flag != 0
 }
 // s3APIMiddleware - performs some common handler functionality for S3 API
 // handlers.
 //
 // It is set per-"handler function registration" in the router to allow for
 // behavior modification via flags.
 //
 // This middleware always calls `collectAPIStats` to collect API stats.
 //
 // The passed in handler function must be a method of `objectAPIHandlers` for
 // the name displayed in logs and trace to be accurate. The name is extracted
 // via reflection.
 //
 // When **no** flags are passed, the behavior is to trace both headers and body,
 // gzip the response and throttle the handler via `maxClients`. Each of these
 // can be disabled via the corresponding `s3HFlag`.
 //
 // CAUTION: for requests involving large req/resp bodies ensure to pass the
 // `traceHdrsS3HFlag`, otherwise both headers and body will be traced, causing
 // high memory usage!
 func s3APIMiddleware(f http.HandlerFunc, flags ...s3HFlag) http.HandlerFunc {
 	// Collect all flags with bitwise-OR and assign operator
 	var handlerFlags s3HFlag
 	for _, flag := range flags {
 		handlerFlags |= flag
 	}
 	// Get name of the handler using reflection.
 	handlerName := getHandlerName(f, "objectAPIHandlers")
 	var handler http.HandlerFunc = func(w http.ResponseWriter, r *http.Request) {
 		// Wrap the actual handler with the appropriate tracing middleware.
 		var tracedHandler http.HandlerFunc
 		if handlerFlags.has(traceHdrsS3HFlag) {
 			tracedHandler = httpTraceHdrs(f)
 		} else {
 			tracedHandler = httpTraceAll(f)
 		}
 		// Skip wrapping with the gzip middleware if specified.
 		var gzippedHandler http.HandlerFunc = tracedHandler
 		if !handlerFlags.has(noGZS3HFlag) {
 			gzippedHandler = gzipHandler(gzippedHandler)
 		}
 		// Skip wrapping with throttling middleware if specified.
 		var throttledHandler http.HandlerFunc = gzippedHandler
 		if !handlerFlags.has(noThrottleS3HFlag) {
 			throttledHandler = maxClients(throttledHandler)
 		}
 		// Collect API stats using the API name got from reflection in
 		// `getHandlerName`.
 		statsCollectedHandler := collectAPIStats(handlerName, throttledHandler)
 		// Call the final handler.
 		statsCollectedHandler(w, r)
 	}
 	return handler
 }
 // registerAPIRouter - registers S3 compatible APIs.
 func registerAPIRouter(router *mux.Router) {
 	// Initialize API.
 	api := objectAPIHandlers{
 		ObjectAPI: newObjectLayerFn,
 		CacheAPI:  newCachedObjectLayerFn,
 	}
 	// API Router
@@ -222,12 +286,6 @@ func registerAPIRouter(router *mux.Router) {
 	}
 	routers = append(routers, apiRouter.PathPrefix("/{bucket}").Subrouter())
 	gz, err := gzhttp.NewWrapper(gzhttp.MinSize(1000), gzhttp.CompressionLevel(gzip.BestSpeed))
 	if err != nil {
 		// Static params, so this is very unlikely.
 		logger.Fatal(err, "Unable to initialize server")
 	}
 	for _, router := range routers {
 		// Register all rejected object APIs
 		for _, r := range rejectedObjAPIs {
@@ -239,224 +297,307 @@ func registerAPIRouter(router *mux.Router) {
 		// Object operations
 		// HeadObject
-		router.Methods(http.MethodHead).Path("/{object:.+}").HandlerFunc(
+		router.Methods(http.MethodHead).Path("/{object:.+}").
-			collectAPIStats("headobject", maxClients(gz(httpTraceAll(api.HeadObjectHandler)))))
+			HandlerFunc(s3APIMiddleware(api.HeadObjectHandler))
 		// GetObjectAttributes
 		router.Methods(http.MethodGet).Path("/{object:.+}").
 			HandlerFunc(s3APIMiddleware(api.GetObjectAttributesHandler, traceHdrsS3HFlag)).
 			Queries("attributes", "")
 		// CopyObjectPart
 		router.Methods(http.MethodPut).Path("/{object:.+}").
 			HeadersRegexp(xhttp.AmzCopySource, ".*?(\\/|%2F).*?").
-			HandlerFunc(collectAPIStats("copyobjectpart", maxClients(gz(httpTraceAll(api.CopyObjectPartHandler))))).
+			HandlerFunc(s3APIMiddleware(api.CopyObjectPartHandler)).
-			Queries("partNumber", "{partNumber:[0-9]+}", "uploadId", "{uploadId:.*}")
+			Queries("partNumber", "{partNumber:.*}", "uploadId", "{uploadId:.*}")
 		// PutObjectPart
-		router.Methods(http.MethodPut).Path("/{object:.+}").HandlerFunc(
+		router.Methods(http.MethodPut).Path("/{object:.+}").
-			collectAPIStats("putobjectpart", maxClients(gz(httpTraceHdrs(api.PutObjectPartHandler))))).Queries("partNumber", "{partNumber:[0-9]+}", "uploadId", "{uploadId:.*}")
+			HandlerFunc(s3APIMiddleware(api.PutObjectPartHandler, traceHdrsS3HFlag)).
 			Queries("partNumber", "{partNumber:.*}", "uploadId", "{uploadId:.*}")
 		// ListObjectParts
-		router.Methods(http.MethodGet).Path("/{object:.+}").HandlerFunc(
+		router.Methods(http.MethodGet).Path("/{object:.+}").
-			collectAPIStats("listobjectparts", maxClients(gz(httpTraceAll(api.ListObjectPartsHandler))))).Queries("uploadId", "{uploadId:.*}")
+			HandlerFunc(s3APIMiddleware(api.ListObjectPartsHandler)).
 			Queries("uploadId", "{uploadId:.*}")
 		// CompleteMultipartUpload
-		router.Methods(http.MethodPost).Path("/{object:.+}").HandlerFunc(
+		router.Methods(http.MethodPost).Path("/{object:.+}").
-			collectAPIStats("completemultipartupload", maxClients(gz(httpTraceAll(api.CompleteMultipartUploadHandler))))).Queries("uploadId", "{uploadId:.*}")
+			HandlerFunc(s3APIMiddleware(api.CompleteMultipartUploadHandler)).
 			Queries("uploadId", "{uploadId:.*}")
 		// NewMultipartUpload
-		router.Methods(http.MethodPost).Path("/{object:.+}").HandlerFunc(
+		router.Methods(http.MethodPost).Path("/{object:.+}").
-			collectAPIStats("newmultipartupload", maxClients(gz(httpTraceAll(api.NewMultipartUploadHandler))))).Queries("uploads", "")
+			HandlerFunc(s3APIMiddleware(api.NewMultipartUploadHandler)).
 			Queries("uploads", "")
 		// AbortMultipartUpload
-		router.Methods(http.MethodDelete).Path("/{object:.+}").HandlerFunc(
+		router.Methods(http.MethodDelete).Path("/{object:.+}").
-			collectAPIStats("abortmultipartupload", maxClients(gz(httpTraceAll(api.AbortMultipartUploadHandler))))).Queries("uploadId", "{uploadId:.*}")
+			HandlerFunc(s3APIMiddleware(api.AbortMultipartUploadHandler)).
 			Queries("uploadId", "{uploadId:.*}")
 		// GetObjectACL - this is a dummy call.
-		router.Methods(http.MethodGet).Path("/{object:.+}").HandlerFunc(
+		router.Methods(http.MethodGet).Path("/{object:.+}").
-			collectAPIStats("getobjectacl", maxClients(gz(httpTraceHdrs(api.GetObjectACLHandler))))).Queries("acl", "")
+			HandlerFunc(s3APIMiddleware(api.GetObjectACLHandler, traceHdrsS3HFlag)).
 			Queries("acl", "")
 		// PutObjectACL - this is a dummy call.
-		router.Methods(http.MethodPut).Path("/{object:.+}").HandlerFunc(
+		router.Methods(http.MethodPut).Path("/{object:.+}").
-			collectAPIStats("putobjectacl", maxClients(gz(httpTraceHdrs(api.PutObjectACLHandler))))).Queries("acl", "")
+			HandlerFunc(s3APIMiddleware(api.PutObjectACLHandler, traceHdrsS3HFlag)).
 			Queries("acl", "")
 		// GetObjectTagging
-		router.Methods(http.MethodGet).Path("/{object:.+}").HandlerFunc(
+		router.Methods(http.MethodGet).Path("/{object:.+}").
-			collectAPIStats("getobjecttagging", maxClients(gz(httpTraceHdrs(api.GetObjectTaggingHandler))))).Queries("tagging", "")
+			HandlerFunc(s3APIMiddleware(api.GetObjectTaggingHandler, traceHdrsS3HFlag)).
 			Queries("tagging", "")
 		// PutObjectTagging
-		router.Methods(http.MethodPut).Path("/{object:.+}").HandlerFunc(
+		router.Methods(http.MethodPut).Path("/{object:.+}").
-			collectAPIStats("putobjecttagging", maxClients(gz(httpTraceHdrs(api.PutObjectTaggingHandler))))).Queries("tagging", "")
+			HandlerFunc(s3APIMiddleware(api.PutObjectTaggingHandler, traceHdrsS3HFlag)).
 			Queries("tagging", "")
 		// DeleteObjectTagging
-		router.Methods(http.MethodDelete).Path("/{object:.+}").HandlerFunc(
+		router.Methods(http.MethodDelete).Path("/{object:.+}").
-			collectAPIStats("deleteobjecttagging", maxClients(gz(httpTraceHdrs(api.DeleteObjectTaggingHandler))))).Queries("tagging", "")
+			HandlerFunc(s3APIMiddleware(api.DeleteObjectTaggingHandler, traceHdrsS3HFlag)).
 			Queries("tagging", "")
 		// SelectObjectContent
-		router.Methods(http.MethodPost).Path("/{object:.+}").HandlerFunc(
+		router.Methods(http.MethodPost).Path("/{object:.+}").
-			collectAPIStats("selectobjectcontent", maxClients(gz(httpTraceHdrs(api.SelectObjectContentHandler))))).Queries("select", "").Queries("select-type", "2")
+			HandlerFunc(s3APIMiddleware(api.SelectObjectContentHandler, traceHdrsS3HFlag)).
 			Queries("select", "").Queries("select-type", "2")
 		// GetObjectRetention
-		router.Methods(http.MethodGet).Path("/{object:.+}").HandlerFunc(
+		router.Methods(http.MethodGet).Path("/{object:.+}").
-			collectAPIStats("getobjectretention", maxClients(gz(httpTraceAll(api.GetObjectRetentionHandler))))).Queries("retention", "")
+			HandlerFunc(s3APIMiddleware(api.GetObjectRetentionHandler)).
 			Queries("retention", "")
 		// GetObjectLegalHold
-		router.Methods(http.MethodGet).Path("/{object:.+}").HandlerFunc(
+		router.Methods(http.MethodGet).Path("/{object:.+}").
-			collectAPIStats("getobjectlegalhold", maxClients(gz(httpTraceAll(api.GetObjectLegalHoldHandler))))).Queries("legal-hold", "")
+			HandlerFunc(s3APIMiddleware(api.GetObjectLegalHoldHandler)).
-		// GetObject - note gzip compression is *not* added due to Range requests.
+			Queries("legal-hold", "")
-		router.Methods(http.MethodGet).Path("/{object:.+}").HandlerFunc(
+		// GetObject with lambda ARNs
-			collectAPIStats("getobject", maxClients(gz(httpTraceHdrs(api.GetObjectHandler)))))
+		router.Methods(http.MethodGet).Path("/{object:.+}").
 			HandlerFunc(s3APIMiddleware(api.GetObjectLambdaHandler, traceHdrsS3HFlag)).
 			Queries("lambdaArn", "{lambdaArn:.*}")
 		// GetObject
 		router.Methods(http.MethodGet).Path("/{object:.+}").
 			HandlerFunc(s3APIMiddleware(api.GetObjectHandler, traceHdrsS3HFlag))
 		// CopyObject
-		router.Methods(http.MethodPut).Path("/{object:.+}").HeadersRegexp(xhttp.AmzCopySource, ".*?(\\/|%2F).*?").HandlerFunc(
+		router.Methods(http.MethodPut).Path("/{object:.+}").
-			collectAPIStats("copyobject", maxClients(gz(httpTraceAll(api.CopyObjectHandler)))))
+			HeadersRegexp(xhttp.AmzCopySource, ".*?(\\/|%2F).*?").
 			HandlerFunc(s3APIMiddleware(api.CopyObjectHandler))
 		// PutObjectRetention
-		router.Methods(http.MethodPut).Path("/{object:.+}").HandlerFunc(
+		router.Methods(http.MethodPut).Path("/{object:.+}").
-			collectAPIStats("putobjectretention", maxClients(gz(httpTraceAll(api.PutObjectRetentionHandler))))).Queries("retention", "")
+			HandlerFunc(s3APIMiddleware(api.PutObjectRetentionHandler)).
 			Queries("retention", "")
 		// PutObjectLegalHold
-		router.Methods(http.MethodPut).Path("/{object:.+}").HandlerFunc(
+		router.Methods(http.MethodPut).Path("/{object:.+}").
-			collectAPIStats("putobjectlegalhold", maxClients(gz(httpTraceAll(api.PutObjectLegalHoldHandler))))).Queries("legal-hold", "")
+			HandlerFunc(s3APIMiddleware(api.PutObjectLegalHoldHandler)).
 			Queries("legal-hold", "")
 		// PutObject with auto-extract support for zip
-		router.Methods(http.MethodPut).Path("/{object:.+}").HeadersRegexp(xhttp.AmzSnowballExtract, "true").HandlerFunc(
+		router.Methods(http.MethodPut).Path("/{object:.+}").
-			collectAPIStats("putobject", maxClients(gz(httpTraceHdrs(api.PutObjectExtractHandler)))))
+			HeadersRegexp(xhttp.AmzSnowballExtract, "true").
 			HandlerFunc(s3APIMiddleware(api.PutObjectExtractHandler, traceHdrsS3HFlag))
 		// PutObject
-		router.Methods(http.MethodPut).Path("/{object:.+}").HandlerFunc(
+		router.Methods(http.MethodPut).Path("/{object:.+}").
-			collectAPIStats("putobject", maxClients(gz(httpTraceHdrs(api.PutObjectHandler)))))
+			HandlerFunc(s3APIMiddleware(api.PutObjectHandler, traceHdrsS3HFlag))
 		// DeleteObject
-		router.Methods(http.MethodDelete).Path("/{object:.+}").HandlerFunc(
+		router.Methods(http.MethodDelete).Path("/{object:.+}").
-			collectAPIStats("deleteobject", maxClients(gz(httpTraceAll(api.DeleteObjectHandler)))))
+			HandlerFunc(s3APIMiddleware(api.DeleteObjectHandler))
 		// PostRestoreObject
-		router.Methods(http.MethodPost).Path("/{object:.+}").HandlerFunc(
+		router.Methods(http.MethodPost).Path("/{object:.+}").
-			collectAPIStats("restoreobject", maxClients(gz(httpTraceAll(api.PostRestoreObjectHandler))))).Queries("restore", "")
+			HandlerFunc(s3APIMiddleware(api.PostRestoreObjectHandler)).
 			Queries("restore", "")
 		// Bucket operations
 		// GetBucketLocation
-		router.Methods(http.MethodGet).HandlerFunc(
+		router.Methods(http.MethodGet).
-			collectAPIStats("getbucketlocation", maxClients(gz(httpTraceAll(api.GetBucketLocationHandler))))).Queries("location", "")
+			HandlerFunc(s3APIMiddleware(api.GetBucketLocationHandler)).
 			Queries("location", "")
 		// GetBucketPolicy
-		router.Methods(http.MethodGet).HandlerFunc(
+		router.Methods(http.MethodGet).
-			collectAPIStats("getbucketpolicy", maxClients(gz(httpTraceAll(api.GetBucketPolicyHandler))))).Queries("policy", "")
+			HandlerFunc(s3APIMiddleware(api.GetBucketPolicyHandler)).
 			Queries("policy", "")
 		// GetBucketLifecycle
-		router.Methods(http.MethodGet).HandlerFunc(
+		router.Methods(http.MethodGet).
-			collectAPIStats("getbucketlifecycle", maxClients(gz(httpTraceAll(api.GetBucketLifecycleHandler))))).Queries("lifecycle", "")
+			HandlerFunc(s3APIMiddleware(api.GetBucketLifecycleHandler)).
 			Queries("lifecycle", "")
 		// GetBucketEncryption
-		router.Methods(http.MethodGet).HandlerFunc(
+		router.Methods(http.MethodGet).
-			collectAPIStats("getbucketencryption", maxClients(gz(httpTraceAll(api.GetBucketEncryptionHandler))))).Queries("encryption", "")
+			HandlerFunc(s3APIMiddleware(api.GetBucketEncryptionHandler)).
 			Queries("encryption", "")
 		// GetBucketObjectLockConfig
-		router.Methods(http.MethodGet).HandlerFunc(
+		router.Methods(http.MethodGet).
-			collectAPIStats("getbucketobjectlockconfiguration", maxClients(gz(httpTraceAll(api.GetBucketObjectLockConfigHandler))))).Queries("object-lock", "")
+			HandlerFunc(s3APIMiddleware(api.GetBucketObjectLockConfigHandler)).
 			Queries("object-lock", "")
 		// GetBucketReplicationConfig
-		router.Methods(http.MethodGet).HandlerFunc(
+		router.Methods(http.MethodGet).
-			collectAPIStats("getbucketreplicationconfiguration", maxClients(gz(httpTraceAll(api.GetBucketReplicationConfigHandler))))).Queries("replication", "")
+			HandlerFunc(s3APIMiddleware(api.GetBucketReplicationConfigHandler)).
 			Queries("replication", "")
 		// GetBucketVersioning
-		router.Methods(http.MethodGet).HandlerFunc(
+		router.Methods(http.MethodGet).
-			collectAPIStats("getbucketversioning", maxClients(gz(httpTraceAll(api.GetBucketVersioningHandler))))).Queries("versioning", "")
+			HandlerFunc(s3APIMiddleware(api.GetBucketVersioningHandler)).
 			Queries("versioning", "")
 		// GetBucketNotification
-		router.Methods(http.MethodGet).HandlerFunc(
+		router.Methods(http.MethodGet).
-			collectAPIStats("getbucketnotification", maxClients(gz(httpTraceAll(api.GetBucketNotificationHandler))))).Queries("notification", "")
+			HandlerFunc(s3APIMiddleware(api.GetBucketNotificationHandler)).
 			Queries("notification", "")
 		// ListenNotification
-		router.Methods(http.MethodGet).HandlerFunc(
+		router.Methods(http.MethodGet).
-			collectAPIStats("listennotification", gz(httpTraceAll(api.ListenNotificationHandler)))).Queries("events", "{events:.*}")
+			HandlerFunc(s3APIMiddleware(api.ListenNotificationHandler, noThrottleS3HFlag)).
 			Queries("events", "{events:.*}")
 		// ResetBucketReplicationStatus - MinIO extension API
-		router.Methods(http.MethodGet).HandlerFunc(
+		router.Methods(http.MethodGet).
-			collectAPIStats("resetbucketreplicationstatus", maxClients(gz(httpTraceAll(api.ResetBucketReplicationStatusHandler))))).Queries("replication-reset-status", "")
+			HandlerFunc(s3APIMiddleware(api.ResetBucketReplicationStatusHandler)).
 			Queries("replication-reset-status", "")
 		// Dummy Bucket Calls
 		// GetBucketACL -- this is a dummy call.
-		router.Methods(http.MethodGet).HandlerFunc(
+		router.Methods(http.MethodGet).
-			collectAPIStats("getbucketacl", maxClients(gz(httpTraceAll(api.GetBucketACLHandler))))).Queries("acl", "")
+			HandlerFunc(s3APIMiddleware(api.GetBucketACLHandler)).
 			Queries("acl", "")
 		// PutBucketACL -- this is a dummy call.
-		router.Methods(http.MethodPut).HandlerFunc(
+		router.Methods(http.MethodPut).
-			collectAPIStats("putbucketacl", maxClients(gz(httpTraceAll(api.PutBucketACLHandler))))).Queries("acl", "")
+			HandlerFunc(s3APIMiddleware(api.PutBucketACLHandler)).
 			Queries("acl", "")
 		// GetBucketCors - this is a dummy call.
-		router.Methods(http.MethodGet).HandlerFunc(
+		router.Methods(http.MethodGet).
-			collectAPIStats("getbucketcors", maxClients(gz(httpTraceAll(api.GetBucketCorsHandler))))).Queries("cors", "")
+			HandlerFunc(s3APIMiddleware(api.GetBucketCorsHandler)).
 			Queries("cors", "")
 		// GetBucketWebsiteHandler - this is a dummy call.
-		router.Methods(http.MethodGet).HandlerFunc(
+		router.Methods(http.MethodGet).
-			collectAPIStats("getbucketwebsite", maxClients(gz(httpTraceAll(api.GetBucketWebsiteHandler))))).Queries("website", "")
+			HandlerFunc(s3APIMiddleware(api.GetBucketWebsiteHandler)).
 			Queries("website", "")
 		// GetBucketAccelerateHandler - this is a dummy call.
-		router.Methods(http.MethodGet).HandlerFunc(
+		router.Methods(http.MethodGet).
-			collectAPIStats("getbucketaccelerate", maxClients(gz(httpTraceAll(api.GetBucketAccelerateHandler))))).Queries("accelerate", "")
+			HandlerFunc(s3APIMiddleware(api.GetBucketAccelerateHandler)).
 			Queries("accelerate", "")
 		// GetBucketRequestPaymentHandler - this is a dummy call.
-		router.Methods(http.MethodGet).HandlerFunc(
+		router.Methods(http.MethodGet).
-			collectAPIStats("getbucketrequestpayment", maxClients(gz(httpTraceAll(api.GetBucketRequestPaymentHandler))))).Queries("requestPayment", "")
+			HandlerFunc(s3APIMiddleware(api.GetBucketRequestPaymentHandler)).
 			Queries("requestPayment", "")
 		// GetBucketLoggingHandler - this is a dummy call.
-		router.Methods(http.MethodGet).HandlerFunc(
+		router.Methods(http.MethodGet).
-			collectAPIStats("getbucketlogging", maxClients(gz(httpTraceAll(api.GetBucketLoggingHandler))))).Queries("logging", "")
+			HandlerFunc(s3APIMiddleware(api.GetBucketLoggingHandler)).
 			Queries("logging", "")
 		// GetBucketTaggingHandler
-		router.Methods(http.MethodGet).HandlerFunc(
+		router.Methods(http.MethodGet).
-			collectAPIStats("getbuckettagging", maxClients(gz(httpTraceAll(api.GetBucketTaggingHandler))))).Queries("tagging", "")
+			HandlerFunc(s3APIMiddleware(api.GetBucketTaggingHandler)).
 			Queries("tagging", "")
 		// DeleteBucketWebsiteHandler
-		router.Methods(http.MethodDelete).HandlerFunc(
+		router.Methods(http.MethodDelete).
-			collectAPIStats("deletebucketwebsite", maxClients(gz(httpTraceAll(api.DeleteBucketWebsiteHandler))))).Queries("website", "")
+			HandlerFunc(s3APIMiddleware(api.DeleteBucketWebsiteHandler)).
 			Queries("website", "")
 		// DeleteBucketTaggingHandler
-		router.Methods(http.MethodDelete).HandlerFunc(
+		router.Methods(http.MethodDelete).
-			collectAPIStats("deletebuckettagging", maxClients(gz(httpTraceAll(api.DeleteBucketTaggingHandler))))).Queries("tagging", "")
+			HandlerFunc(s3APIMiddleware(api.DeleteBucketTaggingHandler)).
 			Queries("tagging", "")
 		// ListMultipartUploads
-		router.Methods(http.MethodGet).HandlerFunc(
+		router.Methods(http.MethodGet).
-			collectAPIStats("listmultipartuploads", maxClients(gz(httpTraceAll(api.ListMultipartUploadsHandler))))).Queries("uploads", "")
+			HandlerFunc(s3APIMiddleware(api.ListMultipartUploadsHandler)).
 			Queries("uploads", "")
 		// ListObjectsV2M
-		router.Methods(http.MethodGet).HandlerFunc(
+		router.Methods(http.MethodGet).
-			collectAPIStats("listobjectsv2M", maxClients(gz(httpTraceAll(api.ListObjectsV2MHandler))))).Queries("list-type", "2", "metadata", "true")
+			HandlerFunc(s3APIMiddleware(api.ListObjectsV2MHandler)).
 			Queries("list-type", "2", "metadata", "true")
 		// ListObjectsV2
-		router.Methods(http.MethodGet).HandlerFunc(
+		router.Methods(http.MethodGet).
-			collectAPIStats("listobjectsv2", maxClients(gz(httpTraceAll(api.ListObjectsV2Handler))))).Queries("list-type", "2")
+			HandlerFunc(s3APIMiddleware(api.ListObjectsV2Handler)).
 			Queries("list-type", "2")
 		// ListObjectVersions
-		router.Methods(http.MethodGet).HandlerFunc(
+		router.Methods(http.MethodGet).
-			collectAPIStats("listobjectversions", maxClients(gz(httpTraceAll(api.ListObjectVersionsHandler))))).Queries("versions", "")
+			HandlerFunc(s3APIMiddleware(api.ListObjectVersionsMHandler)).
 			Queries("versions", "", "metadata", "true")
 		// ListObjectVersions
 		router.Methods(http.MethodGet).
 			HandlerFunc(s3APIMiddleware(api.ListObjectVersionsHandler)).
 			Queries("versions", "")
 		// GetBucketPolicyStatus
-		router.Methods(http.MethodGet).HandlerFunc(
+		router.Methods(http.MethodGet).
-			collectAPIStats("getpolicystatus", maxClients(gz(httpTraceAll(api.GetBucketPolicyStatusHandler))))).Queries("policyStatus", "")
+			HandlerFunc(s3APIMiddleware(api.GetBucketPolicyStatusHandler)).
 			Queries("policyStatus", "")
 		// PutBucketLifecycle
-		router.Methods(http.MethodPut).HandlerFunc(
+		router.Methods(http.MethodPut).
-			collectAPIStats("putbucketlifecycle", maxClients(gz(httpTraceAll(api.PutBucketLifecycleHandler))))).Queries("lifecycle", "")
+			HandlerFunc(s3APIMiddleware(api.PutBucketLifecycleHandler)).
 			Queries("lifecycle", "")
 		// PutBucketReplicationConfig
-		router.Methods(http.MethodPut).HandlerFunc(
+		router.Methods(http.MethodPut).
-			collectAPIStats("putbucketreplicationconfiguration", maxClients(gz(httpTraceAll(api.PutBucketReplicationConfigHandler))))).Queries("replication", "")
+			HandlerFunc(s3APIMiddleware(api.PutBucketReplicationConfigHandler)).
 			Queries("replication", "")
 		// PutBucketEncryption
-		router.Methods(http.MethodPut).HandlerFunc(
+		router.Methods(http.MethodPut).
-			collectAPIStats("putbucketencryption", maxClients(gz(httpTraceAll(api.PutBucketEncryptionHandler))))).Queries("encryption", "")
+			HandlerFunc(s3APIMiddleware(api.PutBucketEncryptionHandler)).
 			Queries("encryption", "")
 		// PutBucketPolicy
-		router.Methods(http.MethodPut).HandlerFunc(
+		router.Methods(http.MethodPut).
-			collectAPIStats("putbucketpolicy", maxClients(gz(httpTraceAll(api.PutBucketPolicyHandler))))).Queries("policy", "")
+			HandlerFunc(s3APIMiddleware(api.PutBucketPolicyHandler)).
 			Queries("policy", "")
 		// PutBucketObjectLockConfig
-		router.Methods(http.MethodPut).HandlerFunc(
+		router.Methods(http.MethodPut).
-			collectAPIStats("putbucketobjectlockconfig", maxClients(gz(httpTraceAll(api.PutBucketObjectLockConfigHandler))))).Queries("object-lock", "")
+			HandlerFunc(s3APIMiddleware(api.PutBucketObjectLockConfigHandler)).
 			Queries("object-lock", "")
 		// PutBucketTaggingHandler
-		router.Methods(http.MethodPut).HandlerFunc(
+		router.Methods(http.MethodPut).
-			collectAPIStats("putbuckettagging", maxClients(gz(httpTraceAll(api.PutBucketTaggingHandler))))).Queries("tagging", "")
+			HandlerFunc(s3APIMiddleware(api.PutBucketTaggingHandler)).
 			Queries("tagging", "")
 		// PutBucketVersioning
-		router.Methods(http.MethodPut).HandlerFunc(
+		router.Methods(http.MethodPut).
-			collectAPIStats("putbucketversioning", maxClients(gz(httpTraceAll(api.PutBucketVersioningHandler))))).Queries("versioning", "")
+			HandlerFunc(s3APIMiddleware(api.PutBucketVersioningHandler)).
 			Queries("versioning", "")
 		// PutBucketNotification
-		router.Methods(http.MethodPut).HandlerFunc(
+		router.Methods(http.MethodPut).
-			collectAPIStats("putbucketnotification", maxClients(gz(httpTraceAll(api.PutBucketNotificationHandler))))).Queries("notification", "")
+			HandlerFunc(s3APIMiddleware(api.PutBucketNotificationHandler)).
 			Queries("notification", "")
 		// ResetBucketReplicationStart - MinIO extension API
-		router.Methods(http.MethodPut).HandlerFunc(
+		router.Methods(http.MethodPut).
-			collectAPIStats("resetbucketreplicationstart", maxClients(gz(httpTraceAll(api.ResetBucketReplicationStartHandler))))).Queries("replication-reset", "")
+			HandlerFunc(s3APIMiddleware(api.ResetBucketReplicationStartHandler)).
 			Queries("replication-reset", "")
 		// PutBucket
-		router.Methods(http.MethodPut).HandlerFunc(
+		router.Methods(http.MethodPut).
-			collectAPIStats("putbucket", maxClients(gz(httpTraceAll(api.PutBucketHandler)))))
+			HandlerFunc(s3APIMiddleware(api.PutBucketHandler))
 		// HeadBucket
-		router.Methods(http.MethodHead).HandlerFunc(
+		router.Methods(http.MethodHead).
-			collectAPIStats("headbucket", maxClients(gz(httpTraceAll(api.HeadBucketHandler)))))
+			HandlerFunc(s3APIMiddleware(api.HeadBucketHandler))
 		// PostPolicy
-		router.Methods(http.MethodPost).HeadersRegexp(xhttp.ContentType, "multipart/form-data*").HandlerFunc(
+		router.Methods(http.MethodPost).
-			collectAPIStats("postpolicybucket", maxClients(gz(httpTraceHdrs(api.PostPolicyBucketHandler)))))
+			MatcherFunc(func(r *http.Request, _ *mux.RouteMatch) bool {
 				return isRequestPostPolicySignatureV4(r)
 			}).
 			HandlerFunc(s3APIMiddleware(api.PostPolicyBucketHandler, traceHdrsS3HFlag))
 		// DeleteMultipleObjects
-		router.Methods(http.MethodPost).HandlerFunc(
+		router.Methods(http.MethodPost).
-			collectAPIStats("deletemultipleobjects", maxClients(gz(httpTraceAll(api.DeleteMultipleObjectsHandler))))).Queries("delete", "")
+			HandlerFunc(s3APIMiddleware(api.DeleteMultipleObjectsHandler)).
 			Queries("delete", "")
 		// DeleteBucketPolicy
-		router.Methods(http.MethodDelete).HandlerFunc(
+		router.Methods(http.MethodDelete).
-			collectAPIStats("deletebucketpolicy", maxClients(gz(httpTraceAll(api.DeleteBucketPolicyHandler))))).Queries("policy", "")
+			HandlerFunc(s3APIMiddleware(api.DeleteBucketPolicyHandler)).
 			Queries("policy", "")
 		// DeleteBucketReplication
-		router.Methods(http.MethodDelete).HandlerFunc(
+		router.Methods(http.MethodDelete).
-			collectAPIStats("deletebucketreplicationconfiguration", maxClients(gz(httpTraceAll(api.DeleteBucketReplicationConfigHandler))))).Queries("replication", "")
+			HandlerFunc(s3APIMiddleware(api.DeleteBucketReplicationConfigHandler)).
 			Queries("replication", "")
 		// DeleteBucketLifecycle
-		router.Methods(http.MethodDelete).HandlerFunc(
+		router.Methods(http.MethodDelete).
-			collectAPIStats("deletebucketlifecycle", maxClients(gz(httpTraceAll(api.DeleteBucketLifecycleHandler))))).Queries("lifecycle", "")
+			HandlerFunc(s3APIMiddleware(api.DeleteBucketLifecycleHandler)).
 			Queries("lifecycle", "")
 		// DeleteBucketEncryption
-		router.Methods(http.MethodDelete).HandlerFunc(
+		router.Methods(http.MethodDelete).
-			collectAPIStats("deletebucketencryption", maxClients(gz(httpTraceAll(api.DeleteBucketEncryptionHandler))))).Queries("encryption", "")
+			HandlerFunc(s3APIMiddleware(api.DeleteBucketEncryptionHandler)).
 			Queries("encryption", "")
 		// DeleteBucket
-		router.Methods(http.MethodDelete).HandlerFunc(
+		router.Methods(http.MethodDelete).
-			collectAPIStats("deletebucket", maxClients(gz(httpTraceAll(api.DeleteBucketHandler)))))
+			HandlerFunc(s3APIMiddleware(api.DeleteBucketHandler))
 		// MinIO extension API for replication.
 		//
-		// GetBucketReplicationMetrics
+		router.Methods(http.MethodGet).
-		router.Methods(http.MethodGet).HandlerFunc(
+			HandlerFunc(s3APIMiddleware(api.GetBucketReplicationMetricsV2Handler)).
-			collectAPIStats("getbucketreplicationmetrics", maxClients(gz(httpTraceAll(api.GetBucketReplicationMetricsHandler))))).Queries("replication-metrics", "")
+			Queries("replication-metrics", "2")
 		// deprecated handler
 		router.Methods(http.MethodGet).
 			HandlerFunc(s3APIMiddleware(api.GetBucketReplicationMetricsHandler)).
 			Queries("replication-metrics", "")
 		// ValidateBucketReplicationCreds
 		router.Methods(http.MethodGet).
 			HandlerFunc(s3APIMiddleware(api.ValidateBucketReplicationCredsHandler)).
 			Queries("replication-check", "")
 		// Register rejected bucket APIs
 		for _, r := range rejectedBucketAPIs {
@@ -466,24 +607,25 @@ func registerAPIRouter(router *mux.Router) {
 		}
 		// S3 ListObjectsV1 (Legacy)
-		router.Methods(http.MethodGet).HandlerFunc(
+		router.Methods(http.MethodGet).
-			collectAPIStats("listobjectsv1", maxClients(gz(httpTraceAll(api.ListObjectsV1Handler)))))
+			HandlerFunc(s3APIMiddleware(api.ListObjectsV1Handler))
 	}
 	// Root operation
 	// ListenNotification
-	apiRouter.Methods(http.MethodGet).Path(SlashSeparator).HandlerFunc(
+	apiRouter.Methods(http.MethodGet).Path(SlashSeparator).
-		collectAPIStats("listennotification", gz(httpTraceAll(api.ListenNotificationHandler)))).Queries("events", "{events:.*}")
+		HandlerFunc(s3APIMiddleware(api.ListenNotificationHandler, noThrottleS3HFlag)).
 		Queries("events", "{events:.*}")
 	// ListBuckets
-	apiRouter.Methods(http.MethodGet).Path(SlashSeparator).HandlerFunc(
+	apiRouter.Methods(http.MethodGet).Path(SlashSeparator).
-		collectAPIStats("listbuckets", maxClients(gz(httpTraceAll(api.ListBucketsHandler)))))
+		HandlerFunc(s3APIMiddleware(api.ListBucketsHandler))
 	// S3 browser with signature v4 adds '//' for ListBuckets request, so rather
 	// than failing with UnknownAPIRequest we simply handle it for now.
-	apiRouter.Methods(http.MethodGet).Path(SlashSeparator + SlashSeparator).HandlerFunc(
+	apiRouter.Methods(http.MethodGet).Path(SlashSeparator + SlashSeparator).
-		collectAPIStats("listbuckets", maxClients(gz(httpTraceAll(api.ListBucketsHandler)))))
+		HandlerFunc(s3APIMiddleware(api.ListBucketsHandler))
 	// If none of the routes match add default error handler routes
 	apiRouter.NotFoundHandler = collectAPIStats("notfound", httpTraceAll(errorResponseHandler))
@@ -513,8 +655,7 @@ func corsHandler(handler http.Handler) http.Handler {
 		"x-amz*",
 		"*",
 	}
-
+	opts := cors.Options{
 	return cors.New(cors.Options{
 		AllowOriginFunc: func(origin string) bool {
 			for _, allowedOrigin := range globalAPIConfig.getCorsAllowOrigins() {
 				if wildcard.MatchSimple(allowedOrigin, origin) {
@@ -535,5 +676,6 @@ func corsHandler(handler http.Handler) http.Handler {
 		AllowedHeaders:   commonS3Headers,
 		ExposedHeaders:   commonS3Headers,
 		AllowCredentials: true,
-	}).Handler(handler)
+	}
 	return cors.New(opts).Handler(handler)
 }
@@ -18,6 +18,10 @@
 package cmd
 import (
 	"fmt"
 	"net/http"
 	"reflect"
 	"runtime"
 	"strings"
 )
@@ -94,15 +98,22 @@ func s3URLEncode(s string) string {
 }
 // s3EncodeName encodes string in response when encodingType is specified in AWS S3 requests.
-func s3EncodeName(name string, encodingType string) (result string) {
+func s3EncodeName(name, encodingType string) string {
-	// Quick path to exit
+	if strings.ToLower(encodingType) == "url" {
 	if encodingType == "" {
 		return name
 	}
 	encodingType = strings.ToLower(encodingType)
 	switch encodingType {
 	case "url":
 		return s3URLEncode(name)
 	}
 	return name
 }
 // getHandlerName returns the name of the handler function. It takes the type
 // name as a string to clean up the name retrieved via reflection. This function
 // only works correctly when the type is present in the cmd package.
 func getHandlerName(f http.HandlerFunc, cmdType string) string {
 	name := runtime.FuncForPC(reflect.ValueOf(f).Pointer()).Name()
 	packageName := fmt.Sprintf("github.com/minio/minio/cmd.%s.", cmdType)
 	name = strings.TrimPrefix(name, packageName)
 	name = strings.TrimSuffix(name, "Handler-fm")
 	name = strings.TrimSuffix(name, "-fm")
 	return name
 }
@@ -25,6 +25,7 @@ import (
 	"encoding/hex"
 	"errors"
 	"io"
 	"mime"
 	"net/http"
 	"net/url"
 	"strconv"
@@ -39,8 +40,8 @@ import (
 	xhttp "github.com/minio/minio/internal/http"
 	xjwt "github.com/minio/minio/internal/jwt"
 	"github.com/minio/minio/internal/logger"
-	"github.com/minio/pkg/bucket/policy"
+	"github.com/minio/minio/internal/mcontext"
-	iampolicy "github.com/minio/pkg/iam/policy"
+	"github.com/minio/pkg/v2/policy"
 )
 // Verify if request has JWT.
@@ -73,8 +74,11 @@ func isRequestPresignedSignatureV2(r *http.Request) bool {
 // Verify if request has AWS Post policy Signature Version '4'.
 func isRequestPostPolicySignatureV4(r *http.Request) bool {
-	return strings.Contains(r.Header.Get(xhttp.ContentType), "multipart/form-data") &&
+	mediaType, _, err := mime.ParseMediaType(r.Header.Get(xhttp.ContentType))
-		r.Method == http.MethodPost
+	if err != nil {
 		return false
 	}
 	return mediaType == "multipart/form-data" && r.Method == http.MethodPost
 }
 // Verify if the request has AWS Streaming Signature Version '4'. This is only valid for 'PUT' operation.
@@ -83,6 +87,18 @@ func isRequestSignStreamingV4(r *http.Request) bool {
 		r.Method == http.MethodPut
 }
 // Verify if the request has AWS Streaming Signature Version '4'. This is only valid for 'PUT' operation.
 func isRequestSignStreamingTrailerV4(r *http.Request) bool {
 	return r.Header.Get(xhttp.AmzContentSha256) == streamingContentSHA256Trailer &&
 		r.Method == http.MethodPut
 }
 // Verify if the request has AWS Streaming Signature Version '4', with unsigned content and trailer.
 func isRequestUnsignedTrailerV4(r *http.Request) bool {
 	return r.Header.Get(xhttp.AmzContentSha256) == unsignedPayloadTrailer &&
 		r.Method == http.MethodPut && strings.Contains(r.Header.Get(xhttp.ContentEncoding), streamingContentEncoding)
 }
 // Authorization type.
 //
 //go:generate stringer -type=authType -trimprefix=authType $GOFILE
@@ -100,10 +116,12 @@ const (
 	authTypeSignedV2
 	authTypeJWT
 	authTypeSTS
 	authTypeStreamingSignedTrailer
 	authTypeStreamingUnsignedTrailer
 )
 // Get request authentication type.
-func getRequestAuthType(r *http.Request) authType {
+func getRequestAuthType(r *http.Request) (at authType) {
 	if r.URL != nil {
 		var err error
 		r.Form, err = url.ParseQuery(r.URL.RawQuery)
@@ -118,6 +136,10 @@ func getRequestAuthType(r *http.Request) authType {
 		return authTypePresignedV2
 	} else if isRequestSignStreamingV4(r) {
 		return authTypeStreamingSigned
 	} else if isRequestSignStreamingTrailerV4(r) {
 		return authTypeStreamingSignedTrailer
 	} else if isRequestUnsignedTrailerV4(r) {
 		return authTypeStreamingUnsignedTrailer
 	} else if isRequestSignatureV4(r) {
 		return authTypeSigned
 	} else if isRequestPresignedSignatureV4(r) {
@@ -134,46 +156,48 @@ func getRequestAuthType(r *http.Request) authType {
 	return authTypeUnknown
 }
-func validateAdminSignature(ctx context.Context, r *http.Request, region string) (auth.Credentials, map[string]interface{}, bool, APIErrorCode) {
+func validateAdminSignature(ctx context.Context, r *http.Request, region string) (auth.Credentials, bool, APIErrorCode) {
 	var cred auth.Credentials
 	var owner bool
 	s3Err := ErrAccessDenied
 	if _, ok := r.Header[xhttp.AmzContentSha256]; ok &&
 		getRequestAuthType(r) == authTypeSigned {
-		// We only support admin credentials to access admin APIs.
+
 		// Get credential information from the request.
 		cred, owner, s3Err = getReqAccessKeyV4(r, region, serviceS3)
 		if s3Err != ErrNone {
-			return cred, nil, owner, s3Err
+			return cred, owner, s3Err
 		}
 		// we only support V4 (no presign) with auth body
 		s3Err = isReqAuthenticated(ctx, r, region, serviceS3)
 	}
 	if s3Err != ErrNone {
-		reqInfo := (&logger.ReqInfo{}).AppendTags("requestHeaders", dumpRequest(r))
+		return cred, owner, s3Err
 		ctx := logger.SetReqInfo(ctx, reqInfo)
 		logger.LogIf(ctx, errors.New(getAPIError(s3Err).Description), logger.Application)
 		return cred, nil, owner, s3Err
 	}
-	return cred, cred.Claims, owner, ErrNone
+	logger.GetReqInfo(ctx).Cred = cred
 	logger.GetReqInfo(ctx).Owner = owner
 	logger.GetReqInfo(ctx).Region = globalSite.Region
 	return cred, owner, ErrNone
 }
 // checkAdminRequestAuth checks for authentication and authorization for the incoming
 // request. It only accepts V2 and V4 requests. Presigned, JWT and anonymous requests
 // are automatically rejected.
-func checkAdminRequestAuth(ctx context.Context, r *http.Request, action iampolicy.AdminAction, region string) (auth.Credentials, APIErrorCode) {
+func checkAdminRequestAuth(ctx context.Context, r *http.Request, action policy.AdminAction, region string) (auth.Credentials, APIErrorCode) {
-	cred, claims, owner, s3Err := validateAdminSignature(ctx, r, region)
+	cred, owner, s3Err := validateAdminSignature(ctx, r, region)
 	if s3Err != ErrNone {
 		return cred, s3Err
 	}
-	if globalIAMSys.IsAllowed(iampolicy.Args{
+	if globalIAMSys.IsAllowed(policy.Args{
 		AccountName:     cred.AccessKey,
 		Groups:          cred.Groups,
-		Action:          iampolicy.Action(action),
+		Action:          policy.Action(action),
-		ConditionValues: getConditionValues(r, "", cred.AccessKey, claims),
+		ConditionValues: getConditionValues(r, "", cred),
 		IsOwner:         owner,
-		Claims:          claims,
+		Claims:          cred.Claims,
 	}) {
 		// Request is allowed return the appropriate access key.
 		return cred, ErrNone
@@ -205,7 +229,7 @@ func getClaimsFromTokenWithSecret(token, secret string) (map[string]interface{},
 	// that clients cannot decode the token using the temp
 	// secret keys and generate an entirely new claim by essentially
 	// hijacking the policies. We need to make sure that this is
-	// based an admin credential such that token cannot be decoded
+	// based on admin credential such that token cannot be decoded
 	// on the client side and is treated like an opaque value.
 	claims, err := auth.ExtractClaims(token, secret)
 	if err != nil {
@@ -224,7 +248,7 @@ func getClaimsFromTokenWithSecret(token, secret string) (map[string]interface{},
 	}
 	// Check if a session policy is set. If so, decode it here.
-	sp, spok := claims.Lookup(iampolicy.SessionPolicyName)
+	sp, spok := claims.Lookup(policy.SessionPolicyName)
 	if spok {
 		// Looks like subpolicy is set and is a string, if set then its
 		// base64 encoded, decode it. Decoding fails reject such
@@ -233,7 +257,7 @@ func getClaimsFromTokenWithSecret(token, secret string) (map[string]interface{},
 		if err != nil {
 			// Base64 decoding fails, we should log to indicate
 			// something is malforming the request sent by client.
-			logger.LogIf(GlobalContext, err, logger.Application)
+			logger.LogIf(GlobalContext, err, logger.ErrorKind)
 			return nil, errAuthentication
 		}
 		claims.MapClaims[sessionPolicyNameExtracted] = string(spBytes)
@@ -255,7 +279,7 @@ func checkClaimsFromToken(r *http.Request, cred auth.Credentials) (map[string]in
 		return nil, ErrNoAccessKey
 	}
-	if token == "" && cred.IsTemp() {
+	if token == "" && cred.IsTemp() && !cred.IsServiceAccount() {
 		// Temporary credentials should always have x-amz-security-token
 		return nil, ErrInvalidToken
 	}
@@ -265,11 +289,16 @@ func checkClaimsFromToken(r *http.Request, cred auth.Credentials) (map[string]in
 		return nil, ErrInvalidToken
 	}
-	if cred.IsTemp() && subtle.ConstantTimeCompare([]byte(token), []byte(cred.SessionToken)) != 1 {
+	if !cred.IsServiceAccount() && cred.IsTemp() && subtle.ConstantTimeCompare([]byte(token), []byte(cred.SessionToken)) != 1 {
 		// validate token for temporary credentials only.
 		return nil, ErrInvalidToken
 	}
 	// Expired credentials must return error right away.
 	if cred.IsTemp() && cred.IsExpired() {
 		return nil, toAPIErrorCode(r.Context(), errInvalidAccessKeyID)
 	}
 	secret := globalActiveCred.SecretKey
 	if cred.IsServiceAccount() {
 		token = cred.SessionToken
@@ -277,6 +306,13 @@ func checkClaimsFromToken(r *http.Request, cred auth.Credentials) (map[string]in
 	}
 	if token != "" {
 		var err error
 		if globalSiteReplicationSys.isEnabled() && cred.AccessKey != siteReplicatorSvcAcc {
 			secret, err = getTokenSigningKey()
 			if err != nil {
 				return nil, toAPIErrorCode(r.Context(), err)
 			}
 		}
 		claims, err := getClaimsFromTokenWithSecret(token, secret)
 		if err != nil {
 			return nil, toAPIErrorCode(r.Context(), err)
@@ -302,9 +338,20 @@ func checkRequestAuthType(ctx context.Context, r *http.Request, action policy.Ac
 	return s3Err
 }
 // checkRequestAuthTypeWithVID is similar to checkRequestAuthType
 // passes versionID additionally.
 func checkRequestAuthTypeWithVID(ctx context.Context, r *http.Request, action policy.Action, bucketName, objectName, versionID string) (s3Err APIErrorCode) {
 	logger.GetReqInfo(ctx).BucketName = bucketName
 	logger.GetReqInfo(ctx).ObjectName = objectName
 	logger.GetReqInfo(ctx).VersionID = versionID
 	_, _, s3Err = checkRequestAuthTypeCredential(ctx, r, action)
 	return s3Err
 }
 func authenticateRequest(ctx context.Context, r *http.Request, action policy.Action) (s3Err APIErrorCode) {
 	if logger.GetReqInfo(ctx) == nil {
-		logger.LogIf(ctx, errors.New("unexpected context.Context does not have a logger.ReqInfo"), logger.Minio)
+		logger.LogIf(ctx, errors.New("unexpected context.Context does not have a logger.ReqInfo"), logger.ErrorKind)
 		return ErrAccessDenied
 	}
@@ -335,6 +382,7 @@ func authenticateRequest(ctx context.Context, r *http.Request, action policy.Act
 	logger.GetReqInfo(ctx).Cred = cred
 	logger.GetReqInfo(ctx).Owner = owner
 	logger.GetReqInfo(ctx).Region = globalSite.Region
 	// region is valid only for CreateBucketAction.
 	var region string
@@ -342,7 +390,7 @@ func authenticateRequest(ctx context.Context, r *http.Request, action policy.Act
 		// To extract region from XML in request body, get copy of request body.
 		payload, err := io.ReadAll(io.LimitReader(r.Body, maxLocationConstraintSize))
 		if err != nil {
-			logger.LogIf(ctx, err, logger.Application)
+			logger.LogIf(ctx, err, logger.ErrorKind)
 			return ErrMalformedXML
 		}
@@ -373,14 +421,16 @@ func authorizeRequest(ctx context.Context, r *http.Request, action policy.Action
 	region := reqInfo.Region
 	bucket := reqInfo.BucketName
 	object := reqInfo.ObjectName
 	versionID := reqInfo.VersionID
 	if action != policy.ListAllMyBucketsAction && cred.AccessKey == "" {
 		// Anonymous checks are not meant for ListAllBuckets action
-		if globalPolicySys.IsAllowed(policy.Args{
+		if globalPolicySys.IsAllowed(policy.BucketPolicyArgs{
 			AccountName:     cred.AccessKey,
 			Groups:          cred.Groups,
 			Action:          action,
 			BucketName:      bucket,
-			ConditionValues: getConditionValues(r, region, "", nil),
+			ConditionValues: getConditionValues(r, region, auth.AnonymousCredentials),
 			IsOwner:         false,
 			ObjectName:      object,
 		}) {
@@ -391,11 +441,12 @@ func authorizeRequest(ctx context.Context, r *http.Request, action policy.Action
 		if action == policy.ListBucketVersionsAction {
 			// In AWS S3 s3:ListBucket permission is same as s3:ListBucketVersions permission
 			// verify as a fallback.
-			if globalPolicySys.IsAllowed(policy.Args{
+			if globalPolicySys.IsAllowed(policy.BucketPolicyArgs{
 				AccountName:     cred.AccessKey,
 				Groups:          cred.Groups,
 				Action:          policy.ListBucketAction,
 				BucketName:      bucket,
-				ConditionValues: getConditionValues(r, region, "", nil),
+				ConditionValues: getConditionValues(r, region, auth.AnonymousCredentials),
 				IsOwner:         false,
 				ObjectName:      object,
 			}) {
@@ -406,13 +457,27 @@ func authorizeRequest(ctx context.Context, r *http.Request, action policy.Action
 		return ErrAccessDenied
 	}
-
+	if action == policy.DeleteObjectAction && versionID != "" {
-	if globalIAMSys.IsAllowed(iampolicy.Args{
+		if !globalIAMSys.IsAllowed(policy.Args{
 			AccountName:     cred.AccessKey,
 			Groups:          cred.Groups,
 			Action:          policy.Action(policy.DeleteObjectVersionAction),
 			BucketName:      bucket,
 			ConditionValues: getConditionValues(r, "", cred),
 			ObjectName:      object,
 			IsOwner:         owner,
 			Claims:          cred.Claims,
 			DenyOnly:        true,
 		}) { // Request is not allowed if Deny action on DeleteObjectVersionAction
 			return ErrAccessDenied
 		}
 	}
 	if globalIAMSys.IsAllowed(policy.Args{
 		AccountName:     cred.AccessKey,
 		Groups:          cred.Groups,
-		Action:          iampolicy.Action(action),
+		Action:          action,
 		BucketName:      bucket,
-		ConditionValues: getConditionValues(r, "", cred.AccessKey, cred.Claims),
+		ConditionValues: getConditionValues(r, "", cred),
 		ObjectName:      object,
 		IsOwner:         owner,
 		Claims:          cred.Claims,
@@ -424,12 +489,12 @@ func authorizeRequest(ctx context.Context, r *http.Request, action policy.Action
 	if action == policy.ListBucketVersionsAction {
 		// In AWS S3 s3:ListBucket permission is same as s3:ListBucketVersions permission
 		// verify as a fallback.
-		if globalIAMSys.IsAllowed(iampolicy.Args{
+		if globalIAMSys.IsAllowed(policy.Args{
 			AccountName:     cred.AccessKey,
 			Groups:          cred.Groups,
-			Action:          iampolicy.ListBucketAction,
+			Action:          policy.ListBucketAction,
 			BucketName:      bucket,
-			ConditionValues: getConditionValues(r, "", cred.AccessKey, cred.Claims),
+			ConditionValues: getConditionValues(r, "", cred),
 			ObjectName:      object,
 			IsOwner:         owner,
 			Claims:          cred.Claims,
@@ -515,7 +580,7 @@ func isReqAuthenticated(ctx context.Context, r *http.Request, region string, sty
 	// Verify 'Content-Md5' and/or 'X-Amz-Content-Sha256' if present.
 	// The verification happens implicit during reading.
-	reader, err := hash.NewReader(r.Body, -1, clientETag.String(), hex.EncodeToString(contentSHA256), -1)
+	reader, err := hash.NewReader(ctx, r.Body, -1, clientETag.String(), hex.EncodeToString(contentSHA256), -1)
 	if err != nil {
 		return toAPIErrorCode(ctx, err)
 	}
@@ -525,13 +590,15 @@ func isReqAuthenticated(ctx context.Context, r *http.Request, region string, sty
 // List of all support S3 auth types.
 var supportedS3AuthTypes = map[authType]struct{}{
-	authTypeAnonymous:       {},
+	authTypeAnonymous:                {},
-	authTypePresigned:       {},
+	authTypePresigned:                {},
-	authTypePresignedV2:     {},
+	authTypePresignedV2:              {},
-	authTypeSigned:          {},
+	authTypeSigned:                   {},
-	authTypeSignedV2:        {},
+	authTypeSignedV2:                 {},
-	authTypePostPolicy:      {},
+	authTypePostPolicy:               {},
-	authTypeStreamingSigned: {},
+	authTypeStreamingSigned:          {},
 	authTypeStreamingSignedTrailer:   {},
 	authTypeStreamingUnsignedTrailer: {},
 }
 // Validate if the authType is valid and supported.
@@ -540,25 +607,27 @@ func isSupportedS3AuthType(aType authType) bool {
 	return ok
 }
-// setAuthHandler to validate authorization header for the incoming request.
+// setAuthMiddleware to validate authorization header for the incoming request.
-func setAuthHandler(h http.Handler) http.Handler {
+func setAuthMiddleware(h http.Handler) http.Handler {
 	// handler for validating incoming authorization headers.
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		tc, ok := r.Context().Value(contextTraceReqKey).(*traceCtxt)
+		tc, ok := r.Context().Value(mcontext.ContextTraceKey).(*mcontext.TraceCtxt)
 		aType := getRequestAuthType(r)
-		if aType == authTypeSigned || aType == authTypeSignedV2 || aType == authTypeStreamingSigned {
+		switch aType {
 		case authTypeSigned, authTypeSignedV2, authTypeStreamingSigned, authTypeStreamingSignedTrailer:
 			// Verify if date headers are set, if not reject the request
 			amzDate, errCode := parseAmzDateHeader(r)
 			if errCode != ErrNone {
 				if ok {
-					tc.funcName = "handler.Auth"
+					tc.FuncName = "handler.Auth"
-					tc.responseRecorder.LogErrBody = true
+					tc.ResponseRecorder.LogErrBody = true
 				}
 				// All our internal APIs are sensitive towards Date
 				// header, for all requests where Date header is not
 				// present we will reject such clients.
 				defer logger.AuditLog(r.Context(), w, r, mustGetClaimsFromToken(r))
 				writeErrorResponse(r.Context(), w, errorCodes.ToAPIErr(errCode), r.URL)
 				atomic.AddUint64(&globalHTTPStats.rejectedRequestsTime, 1)
 				return
@@ -568,25 +637,33 @@ func setAuthHandler(h http.Handler) http.Handler {
 			curTime := UTCNow()
 			if curTime.Sub(amzDate) > globalMaxSkewTime || amzDate.Sub(curTime) > globalMaxSkewTime {
 				if ok {
-					tc.funcName = "handler.Auth"
+					tc.FuncName = "handler.Auth"
-					tc.responseRecorder.LogErrBody = true
+					tc.ResponseRecorder.LogErrBody = true
 				}
 				defer logger.AuditLog(r.Context(), w, r, mustGetClaimsFromToken(r))
 				writeErrorResponse(r.Context(), w, errorCodes.ToAPIErr(ErrRequestTimeTooSkewed), r.URL)
 				atomic.AddUint64(&globalHTTPStats.rejectedRequestsTime, 1)
 				return
 			}
 		}
 		if isSupportedS3AuthType(aType) || aType == authTypeJWT || aType == authTypeSTS {
 			h.ServeHTTP(w, r)
 			return
 		case authTypeJWT, authTypeSTS:
 			h.ServeHTTP(w, r)
 			return
 		default:
 			if isSupportedS3AuthType(aType) {
 				h.ServeHTTP(w, r)
 				return
 			}
 		}
 		if ok {
-			tc.funcName = "handler.Auth"
+			tc.FuncName = "handler.Auth"
-			tc.responseRecorder.LogErrBody = true
+			tc.ResponseRecorder.LogErrBody = true
 		}
 		defer logger.AuditLog(r.Context(), w, r, mustGetClaimsFromToken(r))
 		writeErrorResponse(r.Context(), w, errorCodes.ToAPIErr(ErrSignatureVersionNotSupported), r.URL)
 		atomic.AddUint64(&globalHTTPStats.rejectedRequestsAuth, 1)
 	})
@@ -624,17 +701,17 @@ func isPutRetentionAllowed(bucketName, objectName string, retDays int, retDate t
 		return ErrAccessDenied
 	}
-	conditions := getConditionValues(r, "", cred.AccessKey, cred.Claims)
+	conditions := getConditionValues(r, "", cred)
 	conditions["object-lock-mode"] = []string{string(retMode)}
-	conditions["object-lock-retain-until-date"] = []string{retDate.Format(time.RFC3339)}
+	conditions["object-lock-retain-until-date"] = []string{retDate.UTC().Format(time.RFC3339)}
 	if retDays > 0 {
 		conditions["object-lock-remaining-retention-days"] = []string{strconv.Itoa(retDays)}
 	}
 	if retMode == objectlock.RetGovernance && byPassSet {
-		byPassSet = globalIAMSys.IsAllowed(iampolicy.Args{
+		byPassSet = globalIAMSys.IsAllowed(policy.Args{
 			AccountName:     cred.AccessKey,
 			Groups:          cred.Groups,
-			Action:          iampolicy.BypassGovernanceRetentionAction,
+			Action:          policy.BypassGovernanceRetentionAction,
 			BucketName:      bucketName,
 			ObjectName:      objectName,
 			ConditionValues: conditions,
@@ -642,10 +719,10 @@ func isPutRetentionAllowed(bucketName, objectName string, retDays int, retDate t
 			Claims:          cred.Claims,
 		})
 	}
-	if globalIAMSys.IsAllowed(iampolicy.Args{
+	if globalIAMSys.IsAllowed(policy.Args{
 		AccountName:     cred.AccessKey,
 		Groups:          cred.Groups,
-		Action:          iampolicy.PutObjectRetentionAction,
+		Action:          policy.PutObjectRetentionAction,
 		BucketName:      bucketName,
 		ConditionValues: conditions,
 		ObjectName:      objectName,
@@ -663,7 +740,7 @@ func isPutRetentionAllowed(bucketName, objectName string, retDays int, retDate t
 // isPutActionAllowed - check if PUT operation is allowed on the resource, this
 // call verifies bucket policies and IAM policies, supports multi user
 // checks etc.
-func isPutActionAllowed(ctx context.Context, atype authType, bucketName, objectName string, r *http.Request, action iampolicy.Action) (s3Err APIErrorCode) {
+func isPutActionAllowed(ctx context.Context, atype authType, bucketName, objectName string, r *http.Request, action policy.Action) (s3Err APIErrorCode) {
 	var cred auth.Credentials
 	var owner bool
 	region := globalSite.Region
@@ -672,7 +749,7 @@ func isPutActionAllowed(ctx context.Context, atype authType, bucketName, objectN
 		return ErrSignatureVersionNotSupported
 	case authTypeSignedV2, authTypePresignedV2:
 		cred, owner, s3Err = getReqAccessKeyV2(r)
-	case authTypeStreamingSigned, authTypePresigned, authTypeSigned:
+	case authTypeStreamingSigned, authTypePresigned, authTypeSigned, authTypeStreamingSignedTrailer, authTypeStreamingUnsignedTrailer:
 		cred, owner, s3Err = getReqAccessKeyV4(r, region, serviceS3)
 	}
 	if s3Err != ErrNone {
@@ -686,19 +763,19 @@ func isPutActionAllowed(ctx context.Context, atype authType, bucketName, objectN
 	// Do not check for PutObjectRetentionAction permission,
 	// if mode and retain until date are not set.
 	// Can happen when bucket has default lock config set
-	if action == iampolicy.PutObjectRetentionAction &&
+	if action == policy.PutObjectRetentionAction &&
 		r.Header.Get(xhttp.AmzObjectLockMode) == "" &&
 		r.Header.Get(xhttp.AmzObjectLockRetainUntilDate) == "" {
 		return ErrNone
 	}
 	if cred.AccessKey == "" {
-		if globalPolicySys.IsAllowed(policy.Args{
+		if globalPolicySys.IsAllowed(policy.BucketPolicyArgs{
 			AccountName:     cred.AccessKey,
 			Groups:          cred.Groups,
-			Action:          policy.Action(action),
+			Action:          action,
 			BucketName:      bucketName,
-			ConditionValues: getConditionValues(r, "", "", nil),
+			ConditionValues: getConditionValues(r, "", auth.AnonymousCredentials),
 			IsOwner:         false,
 			ObjectName:      objectName,
 		}) {
@@ -707,12 +784,12 @@ func isPutActionAllowed(ctx context.Context, atype authType, bucketName, objectN
 		return ErrAccessDenied
 	}
-	if globalIAMSys.IsAllowed(iampolicy.Args{
+	if globalIAMSys.IsAllowed(policy.Args{
 		AccountName:     cred.AccessKey,
 		Groups:          cred.Groups,
 		Action:          action,
 		BucketName:      bucketName,
-		ConditionValues: getConditionValues(r, "", cred.AccessKey, cred.Claims),
+		ConditionValues: getConditionValues(r, "", cred),
 		ObjectName:      objectName,
 		IsOwner:         owner,
 		Claims:          cred.Claims,
@@ -28,7 +28,7 @@ import (
 	"time"
 	"github.com/minio/minio/internal/auth"
-	iampolicy "github.com/minio/pkg/iam/policy"
+	"github.com/minio/pkg/v2/policy"
 )
 type nullReader struct{}
@@ -237,7 +237,7 @@ func TestIsRequestPresignedSignatureV2(t *testing.T) {
 	}
 }
-// TestIsRequestPresignedSignatureV4 - Test validates the logic for presign signature verision v4 detection.
+// TestIsRequestPresignedSignatureV4 - Test validates the logic for presign signature version v4 detection.
 func TestIsRequestPresignedSignatureV4(t *testing.T) {
 	testCases := []struct {
 		inputQueryKey   string
@@ -287,7 +287,7 @@ func mustNewSignedRequest(method string, urlStr string, contentLength int64, bod
 	req := mustNewRequest(method, urlStr, contentLength, body, t)
 	cred := globalActiveCred
 	if err := signRequestV4(req, cred.AccessKey, cred.SecretKey); err != nil {
-		t.Fatalf("Unable to inititalized new signed http request %s", err)
+		t.Fatalf("Unable to initialized new signed http request %s", err)
 	}
 	return req
 }
@@ -298,7 +298,7 @@ func mustNewSignedV2Request(method string, urlStr string, contentLength int64, b
 	req := mustNewRequest(method, urlStr, contentLength, body, t)
 	cred := globalActiveCred
 	if err := signRequestV2(req, cred.AccessKey, cred.SecretKey); err != nil {
-		t.Fatalf("Unable to inititalized new signed http request %s", err)
+		t.Fatalf("Unable to initialized new signed http request %s", err)
 	}
 	return req
 }
@@ -309,7 +309,7 @@ func mustNewPresignedV2Request(method string, urlStr string, contentLength int64
 	req := mustNewRequest(method, urlStr, contentLength, body, t)
 	cred := globalActiveCred
 	if err := preSignV2(req, cred.AccessKey, cred.SecretKey, time.Now().Add(10*time.Minute).Unix()); err != nil {
-		t.Fatalf("Unable to inititalized new signed http request %s", err)
+		t.Fatalf("Unable to initialized new signed http request %s", err)
 	}
 	return req
 }
@@ -320,7 +320,7 @@ func mustNewPresignedRequest(method string, urlStr string, contentLength int64,
 	req := mustNewRequest(method, urlStr, contentLength, body, t)
 	cred := globalActiveCred
 	if err := preSignV4(req, cred.AccessKey, cred.SecretKey, time.Now().Add(10*time.Minute).Unix()); err != nil {
-		t.Fatalf("Unable to inititalized new signed http request %s", err)
+		t.Fatalf("Unable to initialized new signed http request %s", err)
 	}
 	return req
 }
@@ -375,8 +375,6 @@ func TestIsReqAuthenticated(t *testing.T) {
 	initConfigSubsystem(ctx, objLayer)
 	globalIAMSys.Init(ctx, objLayer, globalEtcdClient, 2*time.Second)
 	creds, err := auth.CreateCredentials("myuser", "mypassword")
 	if err != nil {
 		t.Fatalf("unable create credential, %s", err)
@@ -384,6 +382,8 @@ func TestIsReqAuthenticated(t *testing.T) {
 	globalActiveCred = creds
 	globalIAMSys.Init(ctx, objLayer, globalEtcdClient, 2*time.Second)
 	// List of test cases for validating http request authentication.
 	testCases := []struct {
 		req     *http.Request
@@ -443,7 +443,7 @@ func TestCheckAdminRequestAuthType(t *testing.T) {
 		{Request: mustNewPresignedRequest(http.MethodGet, "http://127.0.0.1:9000", 0, nil, t), ErrCode: ErrAccessDenied},
 	}
 	for i, testCase := range testCases {
-		if _, s3Error := checkAdminRequestAuth(ctx, testCase.Request, iampolicy.AllAdminActions, globalSite.Region); s3Error != testCase.ErrCode {
+		if _, s3Error := checkAdminRequestAuth(ctx, testCase.Request, policy.AllAdminActions, globalSite.Region); s3Error != testCase.ErrCode {
 			t.Errorf("Test %d: Unexpected s3error returned wanted %d, got %d", i, testCase.ErrCode, s3Error)
 		}
 	}
@@ -464,9 +464,8 @@ func TestValidateAdminSignature(t *testing.T) {
 	}
 	initAllSubsystems(ctx)
 	initConfigSubsystem(ctx, objLayer)
-	globalIAMSys.Init(ctx, objLayer, globalEtcdClient, 2*time.Second)
+	initConfigSubsystem(ctx, objLayer)
 	creds, err := auth.CreateCredentials("admin", "mypassword")
 	if err != nil {
@@ -474,6 +473,8 @@ func TestValidateAdminSignature(t *testing.T) {
 	}
 	globalActiveCred = creds
 	globalIAMSys.Init(ctx, objLayer, globalEtcdClient, 2*time.Second)
 	testCases := []struct {
 		AccessKey string
 		SecretKey string
@@ -490,9 +491,9 @@ func TestValidateAdminSignature(t *testing.T) {
 	for i, testCase := range testCases {
 		req := mustNewRequest(http.MethodGet, "http://localhost:9000/", 0, nil, t)
 		if err := signRequestV4(req, testCase.AccessKey, testCase.SecretKey); err != nil {
-			t.Fatalf("Unable to inititalized new signed http request %s", err)
+			t.Fatalf("Unable to initialized new signed http request %s", err)
 		}
-		_, _, _, s3Error := validateAdminSignature(ctx, req, globalMinioDefaultRegion)
+		_, _, s3Error := validateAdminSignature(ctx, req, globalMinioDefaultRegion)
 		if s3Error != testCase.ErrCode {
 			t.Errorf("Test %d: Unexpected s3error returned wanted %d, got %d", i+1, testCase.ErrCode, s3Error)
 		}
@@ -18,11 +18,13 @@ func _() {
 	_ = x[authTypeSignedV2-7]
 	_ = x[authTypeJWT-8]
 	_ = x[authTypeSTS-9]
 	_ = x[authTypeStreamingSignedTrailer-10]
 	_ = x[authTypeStreamingUnsignedTrailer-11]
 }
-const _authType_name = "UnknownAnonymousPresignedPresignedV2PostPolicyStreamingSignedSignedSignedV2JWTSTS"
+const _authType_name = "UnknownAnonymousPresignedPresignedV2PostPolicyStreamingSignedSignedSignedV2JWTSTSStreamingSignedTrailerStreamingUnsignedTrailer"
-var _authType_index = [...]uint8{0, 7, 16, 25, 36, 46, 61, 67, 75, 78, 81}
+var _authType_index = [...]uint8{0, 7, 16, 25, 36, 46, 61, 67, 75, 78, 81, 103, 127}
 func (i authType) String() string {
 	if i < 0 || i >= authType(len(_authType_index)-1) {
@@ -19,10 +19,14 @@ package cmd
 import (
 	"context"
 	"fmt"
 	"runtime"
 	"strconv"
 	"time"
-	"github.com/minio/madmin-go"
+	"github.com/minio/madmin-go/v3"
-	"github.com/minio/minio/internal/pubsub"
+	"github.com/minio/minio/internal/logger"
 	"github.com/minio/pkg/v2/env"
 )
 // healTask represents what to heal along with options
@@ -54,21 +58,50 @@ type healRoutine struct {
 func activeListeners() int {
 	// Bucket notification and http trace are not costly, it is okay to ignore them
 	// while counting the number of concurrent connections
-	return int(globalHTTPListen.NumSubscribers(pubsub.MaskAll)) + int(globalTrace.NumSubscribers(pubsub.MaskAll))
+	return int(globalHTTPListen.Subscribers()) + int(globalTrace.Subscribers())
 }
 func waitForLowIO(maxIO int, maxWait time.Duration, currentIO func() int) {
 	// No need to wait run at full speed.
 	if maxIO <= 0 {
 		return
 	}
 	const waitTick = 100 * time.Millisecond
 	tmpMaxWait := maxWait
 	for currentIO() >= maxIO {
 		if tmpMaxWait > 0 {
 			if tmpMaxWait < waitTick {
 				time.Sleep(tmpMaxWait)
 				return
 			}
 			time.Sleep(waitTick)
 			tmpMaxWait -= waitTick
 		}
 		if tmpMaxWait <= 0 {
 			return
 		}
 	}
 }
 func currentHTTPIO() int {
 	httpServer := newHTTPServerFn()
 	if httpServer == nil {
 		return 0
 	}
 	return httpServer.GetRequestCount() - activeListeners()
 }
 func waitForLowHTTPReq() {
-	var currentIO func() int
+	maxIO, maxWait, _ := globalHealConfig.Clone()
-	if httpServer := newHTTPServerFn(); httpServer != nil {
+	waitForLowIO(maxIO, maxWait, currentHTTPIO)
 		currentIO = httpServer.GetRequestCount
 	}
 	globalHealConfig.Wait(currentIO, activeListeners)
 }
 func initBackgroundHealing(ctx context.Context, objAPI ObjectLayer) {
 	// Run the background healer
 	globalBackgroundHealRoutine = newHealRoutine()
 	for i := 0; i < globalBackgroundHealRoutine.workers; i++ {
 		go globalBackgroundHealRoutine.AddWorker(ctx, objAPI)
 	}
@@ -89,8 +122,7 @@ func (h *healRoutine) AddWorker(ctx context.Context, objAPI ObjectLayer) {
 			var err error
 			switch task.bucket {
 			case nopHeal:
-				task.respCh <- healResult{err: errSkipFile}
+				err = errSkipFile
 				continue
 			case SlashSeparator:
 				res, err = healDiskFormat(ctx, objAPI, task.opts)
 			default:
@@ -101,7 +133,10 @@ func (h *healRoutine) AddWorker(ctx context.Context, objAPI ObjectLayer) {
 				}
 			}
-			task.respCh <- healResult{result: res, err: err}
+			if task.respCh != nil {
 				task.respCh <- healResult{result: res, err: err}
 			}
 		case <-ctx.Done():
 			return
 		}
@@ -110,9 +145,19 @@ func (h *healRoutine) AddWorker(ctx context.Context, objAPI ObjectLayer) {
 func newHealRoutine() *healRoutine {
 	workers := runtime.GOMAXPROCS(0) / 2
 	if envHealWorkers := env.Get("_MINIO_HEAL_WORKERS", ""); envHealWorkers != "" {
 		if numHealers, err := strconv.Atoi(envHealWorkers); err != nil {
 			logger.LogIf(context.Background(), fmt.Errorf("invalid _MINIO_HEAL_WORKERS value: %w", err))
 		} else {
 			workers = numHealers
 		}
 	}
 	if workers == 0 {
 		workers = 4
 	}
 	return &healRoutine{
 		tasks:   make(chan healTask),
 		workers: workers,
@@ -26,12 +26,15 @@ import (
 	"os"
 	"sort"
 	"strings"
 	"sync"
 	"time"
 	"github.com/dustin/go-humanize"
-	"github.com/minio/madmin-go"
+	"github.com/minio/madmin-go/v3"
 	"github.com/minio/minio-go/v7/pkg/set"
 	"github.com/minio/minio/internal/config"
 	"github.com/minio/minio/internal/logger"
 	"github.com/minio/pkg/v2/env"
 )
 const (
@@ -43,7 +46,8 @@ const (
 // healingTracker is used to persist healing information during a heal.
 type healingTracker struct {
-	disk StorageAPI `msg:"-"`
+	disk StorageAPI    `msg:"-"`
 	mu   *sync.RWMutex `msg:"-"`
 	ID         string
 	PoolIndex  int
@@ -79,6 +83,12 @@ type healingTracker struct {
 	// Filled during heal.
 	HealedBuckets []string
 	// ID of the current healing operation
 	HealID string
 	ItemsSkipped uint64
 	BytesSkipped uint64
 	// Add future tracking capabilities
 	// Be sure that they are included in toHealingDisk
 }
@@ -108,21 +118,80 @@ func loadHealingTracker(ctx context.Context, disk StorageAPI) (*healingTracker,
 	}
 	h.disk = disk
 	h.ID = diskID
 	h.mu = &sync.RWMutex{}
 	return &h, nil
 }
 // newHealingTracker will create a new healing tracker for the disk.
-func newHealingTracker(disk StorageAPI) *healingTracker {
+func newHealingTracker() *healingTracker {
-	diskID, _ := disk.GetDiskID()
+	return &healingTracker{
-	h := healingTracker{
+		mu: &sync.RWMutex{},
 		disk:     disk,
 		ID:       diskID,
 		Path:     disk.String(),
 		Endpoint: disk.Endpoint().String(),
 		Started:  time.Now().UTC(),
 	}
 }
 func initHealingTracker(disk StorageAPI, healID string) *healingTracker {
 	h := newHealingTracker()
 	diskID, _ := disk.GetDiskID()
 	h.disk = disk
 	h.ID = diskID
 	h.HealID = healID
 	h.Path = disk.String()
 	h.Endpoint = disk.Endpoint().String()
 	h.Started = time.Now().UTC()
 	h.PoolIndex, h.SetIndex, h.DiskIndex = disk.GetDiskLoc()
-	return &h
+	return h
 }
 func (h healingTracker) getLastUpdate() time.Time {
 	h.mu.RLock()
 	defer h.mu.RUnlock()
 	return h.LastUpdate
 }
 func (h healingTracker) getBucket() string {
 	h.mu.RLock()
 	defer h.mu.RUnlock()
 	return h.Bucket
 }
 func (h *healingTracker) setBucket(bucket string) {
 	h.mu.Lock()
 	defer h.mu.Unlock()
 	h.Bucket = bucket
 }
 func (h healingTracker) getObject() string {
 	h.mu.RLock()
 	defer h.mu.RUnlock()
 	return h.Object
 }
 func (h *healingTracker) setObject(object string) {
 	h.mu.Lock()
 	defer h.mu.Unlock()
 	h.Object = object
 }
 func (h *healingTracker) updateProgress(success, skipped bool, bytes uint64) {
 	h.mu.Lock()
 	defer h.mu.Unlock()
 	switch {
 	case success:
 		h.ItemsHealed++
 		h.BytesDone += bytes
 	case skipped:
 		h.ItemsSkipped++
 		h.BytesSkipped += bytes
 	default:
 		h.ItemsFailed++
 		h.BytesFailed += bytes
 	}
 }
 // update will update the tracker on the disk.
@@ -131,15 +200,18 @@ func (h *healingTracker) update(ctx context.Context) error {
 	if h.disk.Healing() == nil {
 		return fmt.Errorf("healingTracker: drive %q is not marked as healing", h.ID)
 	}
 	h.mu.Lock()
 	if h.ID == "" || h.PoolIndex < 0 || h.SetIndex < 0 || h.DiskIndex < 0 {
 		h.ID, _ = h.disk.GetDiskID()
 		h.PoolIndex, h.SetIndex, h.DiskIndex = h.disk.GetDiskLoc()
 	}
 	h.mu.Unlock()
 	return h.save(ctx)
 }
 // save will unconditionally save the tracker and will be created if not existing.
 func (h *healingTracker) save(ctx context.Context) error {
 	h.mu.Lock()
 	if h.PoolIndex < 0 || h.SetIndex < 0 || h.DiskIndex < 0 {
 		// Attempt to get location.
 		if api := newObjectLayerFn(); api != nil {
@@ -150,6 +222,7 @@ func (h *healingTracker) save(ctx context.Context) error {
 	}
 	h.LastUpdate = time.Now().UTC()
 	htrackerBytes, err := h.MarshalMsg(nil)
 	h.mu.Unlock()
 	if err != nil {
 		return err
 	}
@@ -165,12 +238,14 @@ func (h *healingTracker) delete(ctx context.Context) error {
 		pathJoin(bucketMetaPrefix, healingTrackerFilename),
 		DeleteOptions{
 			Recursive: false,
-			Force:     false,
+			Immediate: false,
 		},
 	)
 }
 func (h *healingTracker) isHealed(bucket string) bool {
 	h.mu.RLock()
 	defer h.mu.RUnlock()
 	for _, v := range h.HealedBuckets {
 		if v == bucket {
 			return true
@@ -181,6 +256,9 @@ func (h *healingTracker) isHealed(bucket string) bool {
 // resume will reset progress to the numbers at the start of the bucket.
 func (h *healingTracker) resume() {
 	h.mu.Lock()
 	defer h.mu.Unlock()
 	h.ItemsHealed = h.ResumeItemsHealed
 	h.ItemsFailed = h.ResumeItemsFailed
 	h.BytesDone = h.ResumeBytesDone
@@ -190,6 +268,9 @@ func (h *healingTracker) resume() {
 // bucketDone should be called when a bucket is done healing.
 // Adds the bucket to the list of healed buckets and updates resume numbers.
 func (h *healingTracker) bucketDone(bucket string) {
 	h.mu.Lock()
 	defer h.mu.Unlock()
 	h.ResumeItemsHealed = h.ItemsHealed
 	h.ResumeItemsFailed = h.ItemsFailed
 	h.ResumeBytesDone = h.BytesDone
@@ -206,6 +287,9 @@ func (h *healingTracker) bucketDone(bucket string) {
 // setQueuedBuckets will add buckets, but exclude any that is already in h.HealedBuckets.
 // Order is preserved.
 func (h *healingTracker) setQueuedBuckets(buckets []BucketInfo) {
 	h.mu.Lock()
 	defer h.mu.Unlock()
 	s := set.CreateStringSet(h.HealedBuckets...)
 	h.QueuedBuckets = make([]string, 0, len(buckets))
 	for _, b := range buckets {
@@ -216,17 +300,25 @@ func (h *healingTracker) setQueuedBuckets(buckets []BucketInfo) {
 }
 func (h *healingTracker) printTo(writer io.Writer) {
 	h.mu.RLock()
 	defer h.mu.RUnlock()
 	b, err := json.MarshalIndent(h, "", "  ")
 	if err != nil {
 		writer.Write([]byte(err.Error()))
 		return
 	}
 	writer.Write(b)
 }
 // toHealingDisk converts the information to madmin.HealingDisk
 func (h *healingTracker) toHealingDisk() madmin.HealingDisk {
 	h.mu.RLock()
 	defer h.mu.RUnlock()
 	return madmin.HealingDisk{
 		ID:                h.ID,
 		HealID:            h.HealID,
 		Endpoint:          h.Endpoint,
 		PoolIndex:         h.PoolIndex,
 		SetIndex:          h.SetIndex,
@@ -237,8 +329,10 @@ func (h *healingTracker) toHealingDisk() madmin.HealingDisk {
 		ObjectsTotalCount: h.ObjectsTotalCount,
 		ObjectsTotalSize:  h.ObjectsTotalSize,
 		ItemsHealed:       h.ItemsHealed,
 		ItemsSkipped:      h.ItemsSkipped,
 		ItemsFailed:       h.ItemsFailed,
 		BytesDone:         h.BytesDone,
 		BytesSkipped:      h.BytesSkipped,
 		BytesFailed:       h.BytesFailed,
 		Bucket:            h.Bucket,
 		Object:            h.Object,
@@ -259,13 +353,17 @@ func initAutoHeal(ctx context.Context, objAPI ObjectLayer) {
 	initBackgroundHealing(ctx, objAPI) // start quick background healing
-	globalBackgroundHealState.pushHealLocalDisks(getLocalDisksToHeal()...)
+	if env.Get("_MINIO_AUTO_DRIVE_HEALING", config.EnableOn) == config.EnableOn || env.Get("_MINIO_AUTO_DISK_HEALING", config.EnableOn) == config.EnableOn {
-
+		globalBackgroundHealState.pushHealLocalDisks(getLocalDisksToHeal()...)
-	go monitorLocalDisksAndHeal(ctx, z)
+		go monitorLocalDisksAndHeal(ctx, z)
 	}
 }
 func getLocalDisksToHeal() (disksToHeal Endpoints) {
-	for _, disk := range globalLocalDrives {
+	globalLocalDrivesMu.RLock()
 	localDrives := cloneDrives(globalLocalDrives)
 	globalLocalDrivesMu.RUnlock()
 	for _, disk := range localDrives {
 		_, err := disk.GetDiskID()
 		if errors.Is(err, errUnformattedDisk) {
 			disksToHeal = append(disksToHeal, disk.Endpoint())
@@ -286,40 +384,39 @@ func getLocalDisksToHeal() (disksToHeal Endpoints) {
 var newDiskHealingTimeout = newDynamicTimeout(30*time.Second, 10*time.Second)
 func healFreshDisk(ctx context.Context, z *erasureServerPools, endpoint Endpoint) error {
-	logger.Info(fmt.Sprintf("Proceeding to heal '%s' - 'mc admin heal alias/ --verbose' to check the status.", endpoint))
+	poolIdx, setIdx := endpoint.PoolIdx, endpoint.SetIdx
-
+	disk := getStorageViaEndpoint(endpoint)
-	disk, format, err := connectEndpoint(endpoint)
+	if disk == nil {
-	if err != nil {
+		return fmt.Errorf("Unexpected error disk must be initialized by now after formatting: %s", endpoint)
 		return fmt.Errorf("Error: %w, %s", err, endpoint)
 	}
 	poolIdx := globalEndpoints.GetLocalPoolIdx(disk.Endpoint())
 	if poolIdx < 0 {
 		return fmt.Errorf("unexpected pool index (%d) found in %s", poolIdx, disk.Endpoint())
 	}
 	// Calculate the set index where the current endpoint belongs
 	z.serverPools[poolIdx].erasureDisksMu.RLock()
 	setIdx, _, err := findDiskIndex(z.serverPools[poolIdx].format, format)
 	z.serverPools[poolIdx].erasureDisksMu.RUnlock()
 	if err != nil {
 		return err
 	}
 	if setIdx < 0 {
 		return fmt.Errorf("unexpected set index (%d) found in %s", setIdx, disk.Endpoint())
 	}
 	// Prevent parallel erasure set healing
-	locker := z.NewNSLock(minioMetaBucket, fmt.Sprintf("new-drive-healing/%s/%d/%d", endpoint, poolIdx, setIdx))
+	locker := z.NewNSLock(minioMetaBucket, fmt.Sprintf("new-drive-healing/%d/%d", poolIdx, setIdx))
 	lkctx, err := locker.GetLock(ctx, newDiskHealingTimeout)
 	if err != nil {
-		return err
+		return fmt.Errorf("Healing of drive '%v' on %s pool, belonging to %s erasure set already in progress: %w",
 			disk, humanize.Ordinal(poolIdx+1), humanize.Ordinal(setIdx+1), err)
 	}
 	ctx = lkctx.Context()
-	defer locker.Unlock(lkctx.Cancel)
+	defer locker.Unlock(lkctx)
 	// Load healing tracker in this disk
 	tracker, err := loadHealingTracker(ctx, disk)
 	if err != nil {
 		// A healing tracker may be deleted if another disk in the
 		// same erasure set with same healing-id successfully finished
 		// healing.
 		if errors.Is(err, errFileNotFound) {
 			return nil
 		}
 		logger.LogIf(ctx, fmt.Errorf("Unable to load healing tracker on '%s': %w, re-initializing..", disk, err))
 		tracker = initHealingTracker(disk, mustGetUUID())
 	}
 	logger.Event(ctx, "Healing drive '%s' - 'mc admin heal alias/ --verbose' to check the current status.", endpoint)
 	buckets, _ := z.ListBuckets(ctx, BucketOptions{})
-	// Buckets data are dispersed in multiple zones/sets, make
+	// Buckets data are dispersed in multiple pools/sets, make
 	// sure to heal all bucket metadata configuration.
 	buckets = append(buckets, BucketInfo{
 		Name: pathJoin(minioMetaBucket, minioConfigPrefix),
@@ -336,19 +433,6 @@ func healFreshDisk(ctx context.Context, z *erasureServerPools, endpoint Endpoint
 		return buckets[i].Created.After(buckets[j].Created)
 	})
 	if serverDebugLog {
 		logger.Info("Healing drive '%v' on %s pool", disk, humanize.Ordinal(poolIdx+1))
 	}
 	// Load healing tracker in this disk
 	tracker, err := loadHealingTracker(ctx, disk)
 	if err != nil {
 		// So someone changed the drives underneath, healing tracker missing.
 		logger.LogIf(ctx, fmt.Errorf("Healing tracker missing on '%s', drive was swapped again on %s pool: %w",
 			disk, humanize.Ordinal(poolIdx+1), err))
 		tracker = newHealingTracker(disk)
 	}
 	// Load bucket totals
 	cache := dataUsageCache{}
 	if err := cache.load(ctx, z.serverPools[poolIdx].sets[setIdx], dataUsageCacheName); err == nil {
@@ -368,18 +452,44 @@ func healFreshDisk(ctx context.Context, z *erasureServerPools, endpoint Endpoint
 		return err
 	}
-	if tracker.ItemsFailed > 0 {
+	logger.Event(ctx, "Healing of drive '%s' is finished (healed: %d, skipped: %d, failed: %d).", disk, tracker.ItemsHealed, tracker.ItemsSkipped, tracker.ItemsFailed)
-		logger.Info("Healing drive '%s' failed (healed: %d, failed: %d).", disk, tracker.ItemsHealed, tracker.ItemsFailed)
+
-	} else {
+	if len(tracker.QueuedBuckets) > 0 {
-		logger.Info("Healing drive '%s' complete (healed: %d, failed: %d).", disk, tracker.ItemsHealed, tracker.ItemsFailed)
+		return fmt.Errorf("not all buckets were healed: %v", tracker.QueuedBuckets)
 	}
 	if serverDebugLog {
 		tracker.printTo(os.Stdout)
-		logger.Info("\n")
+		fmt.Printf("\n")
 	}
-	logger.LogIf(ctx, tracker.delete(ctx))
+	if tracker.HealID == "" { // HealID was empty only before Feb 2023
 		logger.LogIf(ctx, tracker.delete(ctx))
 		return nil
 	}
 	// Remove .healing.bin from all disks with similar heal-id
 	disks, err := z.GetDisks(poolIdx, setIdx)
 	if err != nil {
 		return err
 	}
 	for _, disk := range disks {
 		if disk == nil {
 			continue
 		}
 		t, err := loadHealingTracker(ctx, disk)
 		if err != nil {
 			if !errors.Is(err, errFileNotFound) {
 				logger.LogIf(ctx, err)
 			}
 			continue
 		}
 		if t.HealID == tracker.HealID {
 			t.delete(ctx)
 		}
 	}
 	return nil
 }
@@ -415,10 +525,13 @@ func monitorLocalDisksAndHeal(ctx context.Context, z *erasureServerPools) {
 			for _, disk := range healDisks {
 				go func(disk Endpoint) {
-					globalBackgroundHealState.markDiskForHealing(disk)
+					globalBackgroundHealState.setDiskHealingStatus(disk, true)
-					err := healFreshDisk(ctx, z, disk)
+					if err := healFreshDisk(ctx, z, disk); err != nil {
-					if err != nil {
+						globalBackgroundHealState.setDiskHealingStatus(disk, false)
-						printEndpointError(disk, err, false)
+						timedout := OperationTimedOut{}
 						if !errors.Is(err, context.Canceled) && !errors.As(err, &timedout) {
 							printEndpointError(disk, err, false)
 						}
 						return
 					}
 					// Only upon success pop the healed disk.
@@ -182,6 +182,24 @@ func (z *healingTracker) DecodeMsg(dc *msgp.Reader) (err error) {
 					return
 				}
 			}
 		case "HealID":
 			z.HealID, err = dc.ReadString()
 			if err != nil {
 				err = msgp.WrapError(err, "HealID")
 				return
 			}
 		case "ItemsSkipped":
 			z.ItemsSkipped, err = dc.ReadUint64()
 			if err != nil {
 				err = msgp.WrapError(err, "ItemsSkipped")
 				return
 			}
 		case "BytesSkipped":
 			z.BytesSkipped, err = dc.ReadUint64()
 			if err != nil {
 				err = msgp.WrapError(err, "BytesSkipped")
 				return
 			}
 		default:
 			err = dc.Skip()
 			if err != nil {
@@ -195,9 +213,9 @@ func (z *healingTracker) DecodeMsg(dc *msgp.Reader) (err error) {
 // EncodeMsg implements msgp.Encodable
 func (z *healingTracker) EncodeMsg(en *msgp.Writer) (err error) {
-	// map header, size 22
+	// map header, size 25
 	// write "ID"
-	err = en.Append(0xde, 0x0, 0x16, 0xa2, 0x49, 0x44)
+	err = en.Append(0xde, 0x0, 0x19, 0xa2, 0x49, 0x44)
 	if err != nil {
 		return
 	}
@@ -430,15 +448,45 @@ func (z *healingTracker) EncodeMsg(en *msgp.Writer) (err error) {
 			return
 		}
 	}
 	// write "HealID"
 	err = en.Append(0xa6, 0x48, 0x65, 0x61, 0x6c, 0x49, 0x44)
 	if err != nil {
 		return
 	}
 	err = en.WriteString(z.HealID)
 	if err != nil {
 		err = msgp.WrapError(err, "HealID")
 		return
 	}
 	// write "ItemsSkipped"
 	err = en.Append(0xac, 0x49, 0x74, 0x65, 0x6d, 0x73, 0x53, 0x6b, 0x69, 0x70, 0x70, 0x65, 0x64)
 	if err != nil {
 		return
 	}
 	err = en.WriteUint64(z.ItemsSkipped)
 	if err != nil {
 		err = msgp.WrapError(err, "ItemsSkipped")
 		return
 	}
 	// write "BytesSkipped"
 	err = en.Append(0xac, 0x42, 0x79, 0x74, 0x65, 0x73, 0x53, 0x6b, 0x69, 0x70, 0x70, 0x65, 0x64)
 	if err != nil {
 		return
 	}
 	err = en.WriteUint64(z.BytesSkipped)
 	if err != nil {
 		err = msgp.WrapError(err, "BytesSkipped")
 		return
 	}
 	return
 }
 // MarshalMsg implements msgp.Marshaler
 func (z *healingTracker) MarshalMsg(b []byte) (o []byte, err error) {
 	o = msgp.Require(b, z.Msgsize())
-	// map header, size 22
+	// map header, size 25
 	// string "ID"
-	o = append(o, 0xde, 0x0, 0x16, 0xa2, 0x49, 0x44)
+	o = append(o, 0xde, 0x0, 0x19, 0xa2, 0x49, 0x44)
 	o = msgp.AppendString(o, z.ID)
 	// string "PoolIndex"
 	o = append(o, 0xa9, 0x50, 0x6f, 0x6f, 0x6c, 0x49, 0x6e, 0x64, 0x65, 0x78)
@@ -509,6 +557,15 @@ func (z *healingTracker) MarshalMsg(b []byte) (o []byte, err error) {
 	for za0002 := range z.HealedBuckets {
 		o = msgp.AppendString(o, z.HealedBuckets[za0002])
 	}
 	// string "HealID"
 	o = append(o, 0xa6, 0x48, 0x65, 0x61, 0x6c, 0x49, 0x44)
 	o = msgp.AppendString(o, z.HealID)
 	// string "ItemsSkipped"
 	o = append(o, 0xac, 0x49, 0x74, 0x65, 0x6d, 0x73, 0x53, 0x6b, 0x69, 0x70, 0x70, 0x65, 0x64)
 	o = msgp.AppendUint64(o, z.ItemsSkipped)
 	// string "BytesSkipped"
 	o = append(o, 0xac, 0x42, 0x79, 0x74, 0x65, 0x73, 0x53, 0x6b, 0x69, 0x70, 0x70, 0x65, 0x64)
 	o = msgp.AppendUint64(o, z.BytesSkipped)
 	return
 }
@@ -688,6 +745,24 @@ func (z *healingTracker) UnmarshalMsg(bts []byte) (o []byte, err error) {
 					return
 				}
 			}
 		case "HealID":
 			z.HealID, bts, err = msgp.ReadStringBytes(bts)
 			if err != nil {
 				err = msgp.WrapError(err, "HealID")
 				return
 			}
 		case "ItemsSkipped":
 			z.ItemsSkipped, bts, err = msgp.ReadUint64Bytes(bts)
 			if err != nil {
 				err = msgp.WrapError(err, "ItemsSkipped")
 				return
 			}
 		case "BytesSkipped":
 			z.BytesSkipped, bts, err = msgp.ReadUint64Bytes(bts)
 			if err != nil {
 				err = msgp.WrapError(err, "BytesSkipped")
 				return
 			}
 		default:
 			bts, err = msgp.Skip(bts)
 			if err != nil {
@@ -710,5 +785,6 @@ func (z *healingTracker) Msgsize() (s int) {
 	for za0002 := range z.HealedBuckets {
 		s += msgp.StringPrefixSize + len(z.HealedBuckets[za0002])
 	}
 	s += 7 + msgp.StringPrefixSize + len(z.HealID) + 13 + msgp.Uint64Size + 13 + msgp.Uint64Size
 	return
 }
@@ -0,0 +1,751 @@
 // Copyright (c) 2015-2023 MinIO, Inc.
 //
 // This file is part of MinIO Object Storage stack
 //
 // This program is free software: you can redistribute it and/or modify
 // it under the terms of the GNU Affero General Public License as published by
 // the Free Software Foundation, either version 3 of the License, or
 // (at your option) any later version.
 //
 // This program is distributed in the hope that it will be useful
 // but WITHOUT ANY WARRANTY; without even the implied warranty of
 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 // GNU Affero General Public License for more details.
 //
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 package cmd
 import (
 	"bytes"
 	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
 	"net/http"
 	"runtime"
 	"strconv"
 	"time"
 	"github.com/minio/minio-go/v7/pkg/tags"
 	"github.com/minio/minio/internal/bucket/versioning"
 	xhttp "github.com/minio/minio/internal/http"
 	xioutil "github.com/minio/minio/internal/ioutil"
 	"github.com/minio/minio/internal/logger"
 	"github.com/minio/pkg/v2/env"
 	"github.com/minio/pkg/v2/wildcard"
 	"github.com/minio/pkg/v2/workers"
 	"gopkg.in/yaml.v3"
 )
 // expire: # Expire objects that match a condition
 //   apiVersion: v1
 //   bucket: mybucket # Bucket where this batch job will expire matching objects from
 //   prefix: myprefix # (Optional) Prefix under which this job will expire objects matching the rules below.
 //   rules:
 //     - type: object  # regular objects with zero or more older versions
 //       name: NAME # match object names that satisfy the wildcard expression.
 //       olderThan: 70h # match objects older than this value
 //       createdBefore: "2006-01-02T15:04:05.00Z" # match objects created before "date"
 //       tags:
 //         - key: name
 //           value: pick* # match objects with tag 'name', all values starting with 'pick'
 //       metadata:
 //         - key: content-type
 //           value: image/* # match objects with 'content-type', all values starting with 'image/'
 //       size:
 //         lessThan: "10MiB" # match objects with size less than this value (e.g. 10MiB)
 //         greaterThan: 1MiB # match objects with size greater than this value (e.g. 1MiB)
 //       purge:
 //           # retainVersions: 0 # (default) delete all versions of the object. This option is the fastest.
 //           # retainVersions: 5 # keep the latest 5 versions of the object.
 //
 //     - type: deleted # objects with delete marker as their latest version
 //       name: NAME # match object names that satisfy the wildcard expression.
 //       olderThan: 10h # match objects older than this value (e.g. 7d10h31s)
 //       createdBefore: "2006-01-02T15:04:05.00Z" # match objects created before "date"
 //       purge:
 //           # retainVersions: 0 # (default) delete all versions of the object. This option is the fastest.
 //           # retainVersions: 5 # keep the latest 5 versions of the object including delete markers.
 //
 //   notify:
 //     endpoint: https://notify.endpoint # notification endpoint to receive job completion status
 //     token: Bearer xxxxx # optional authentication token for the notification endpoint
 //
 //   retry:
 //     attempts: 10 # number of retries for the job before giving up
 //     delay: 500ms # least amount of delay between each retry
 //go:generate msgp -file $GOFILE
 // BatchJobExpirePurge type accepts non-negative versions to be retained
 type BatchJobExpirePurge struct {
 	line, col      int
 	RetainVersions int `yaml:"retainVersions" json:"retainVersions"`
 }
 var _ yaml.Unmarshaler = &BatchJobExpirePurge{}
 // UnmarshalYAML - BatchJobExpirePurge extends unmarshal to extract line, col
 func (p *BatchJobExpirePurge) UnmarshalYAML(val *yaml.Node) error {
 	type purge BatchJobExpirePurge
 	var tmp purge
 	err := val.Decode(&tmp)
 	if err != nil {
 		return err
 	}
 	*p = BatchJobExpirePurge(tmp)
 	p.line, p.col = val.Line, val.Column
 	return nil
 }
 // Validate returns nil if value is valid, ie > 0.
 func (p BatchJobExpirePurge) Validate() error {
 	if p.RetainVersions < 0 {
 		return BatchJobYamlErr{
 			line: p.line,
 			col:  p.col,
 			msg:  "retainVersions must be >= 0",
 		}
 	}
 	return nil
 }
 // BatchJobExpireFilter holds all the filters currently supported for batch replication
 type BatchJobExpireFilter struct {
 	line, col     int
 	OlderThan     time.Duration       `yaml:"olderThan,omitempty" json:"olderThan"`
 	CreatedBefore *time.Time          `yaml:"createdBefore,omitempty" json:"createdBefore"`
 	Tags          []BatchJobKV        `yaml:"tags,omitempty" json:"tags"`
 	Metadata      []BatchJobKV        `yaml:"metadata,omitempty" json:"metadata"`
 	Size          BatchJobSizeFilter  `yaml:"size" json:"size"`
 	Type          string              `yaml:"type" json:"type"`
 	Name          string              `yaml:"name" json:"name"`
 	Purge         BatchJobExpirePurge `yaml:"purge" json:"purge"`
 }
 var _ yaml.Unmarshaler = &BatchJobExpireFilter{}
 // UnmarshalYAML - BatchJobExpireFilter extends unmarshal to extract line, col
 // information
 func (ef *BatchJobExpireFilter) UnmarshalYAML(value *yaml.Node) error {
 	type expFilter BatchJobExpireFilter
 	var tmp expFilter
 	err := value.Decode(&tmp)
 	if err != nil {
 		return err
 	}
 	*ef = BatchJobExpireFilter(tmp)
 	ef.line, ef.col = value.Line, value.Column
 	return err
 }
 // Matches returns true if obj matches the filter conditions specified in ef.
 func (ef BatchJobExpireFilter) Matches(obj ObjectInfo, now time.Time) bool {
 	switch ef.Type {
 	case BatchJobExpireObject:
 		if obj.DeleteMarker {
 			return false
 		}
 	case BatchJobExpireDeleted:
 		if !obj.DeleteMarker {
 			return false
 		}
 	default:
 		// we should never come here, Validate should have caught this.
 		logger.LogOnceIf(context.Background(), fmt.Errorf("invalid filter type: %s", ef.Type), ef.Type)
 		return false
 	}
 	if len(ef.Name) > 0 && !wildcard.Match(ef.Name, obj.Name) {
 		return false
 	}
 	if ef.OlderThan > 0 && now.Sub(obj.ModTime) <= ef.OlderThan {
 		return false
 	}
 	if ef.CreatedBefore != nil && !obj.ModTime.Before(*ef.CreatedBefore) {
 		return false
 	}
 	if len(ef.Tags) > 0 && !obj.DeleteMarker {
 		// Only parse object tags if tags filter is specified.
 		var tagMap map[string]string
 		if len(obj.UserTags) != 0 {
 			t, err := tags.ParseObjectTags(obj.UserTags)
 			if err != nil {
 				return false
 			}
 			tagMap = t.ToMap()
 		}
 		for _, kv := range ef.Tags {
 			// Object (version) must match all tags specified in
 			// the filter
 			var match bool
 			for t, v := range tagMap {
 				if kv.Match(BatchJobKV{Key: t, Value: v}) {
 					match = true
 				}
 			}
 			if !match {
 				return false
 			}
 		}
 	}
 	if len(ef.Metadata) > 0 && !obj.DeleteMarker {
 		for _, kv := range ef.Metadata {
 			// Object (version) must match all x-amz-meta and
 			// standard metadata headers
 			// specified in the filter
 			var match bool
 			for k, v := range obj.UserDefined {
 				if !stringsHasPrefixFold(k, "x-amz-meta-") && !isStandardHeader(k) {
 					continue
 				}
 				// We only need to match x-amz-meta or standardHeaders
 				if kv.Match(BatchJobKV{Key: k, Value: v}) {
 					match = true
 				}
 			}
 			if !match {
 				return false
 			}
 		}
 	}
 	return ef.Size.InRange(obj.Size)
 }
 const (
 	// BatchJobExpireObject - object type
 	BatchJobExpireObject string = "object"
 	// BatchJobExpireDeleted - delete marker type
 	BatchJobExpireDeleted string = "deleted"
 )
 // Validate returns nil if ef has valid fields, validation error otherwise.
 func (ef BatchJobExpireFilter) Validate() error {
 	switch ef.Type {
 	case BatchJobExpireObject:
 	case BatchJobExpireDeleted:
 		if len(ef.Tags) > 0 || len(ef.Metadata) > 0 {
 			return BatchJobYamlErr{
 				line: ef.line,
 				col:  ef.col,
 				msg:  "delete type filter can't have tags or metadata",
 			}
 		}
 	default:
 		return BatchJobYamlErr{
 			line: ef.line,
 			col:  ef.col,
 			msg:  "invalid batch-expire type",
 		}
 	}
 	for _, tag := range ef.Tags {
 		if err := tag.Validate(); err != nil {
 			return err
 		}
 	}
 	for _, meta := range ef.Metadata {
 		if err := meta.Validate(); err != nil {
 			return err
 		}
 	}
 	if err := ef.Purge.Validate(); err != nil {
 		return err
 	}
 	if err := ef.Size.Validate(); err != nil {
 		return err
 	}
 	if ef.CreatedBefore != nil && !ef.CreatedBefore.Before(time.Now()) {
 		return BatchJobYamlErr{
 			line: ef.line,
 			col:  ef.col,
 			msg:  "CreatedBefore is in the future",
 		}
 	}
 	return nil
 }
 // BatchJobExpire represents configuration parameters for a batch expiration
 // job typically supplied in yaml form
 type BatchJobExpire struct {
 	line, col       int
 	APIVersion      string                 `yaml:"apiVersion" json:"apiVersion"`
 	Bucket          string                 `yaml:"bucket" json:"bucket"`
 	Prefix          string                 `yaml:"prefix" json:"prefix"`
 	NotificationCfg BatchJobNotification   `yaml:"notify" json:"notify"`
 	Retry           BatchJobRetry          `yaml:"retry" json:"retry"`
 	Rules           []BatchJobExpireFilter `yaml:"rules" json:"rules"`
 }
 var _ yaml.Unmarshaler = &BatchJobExpire{}
 // UnmarshalYAML - BatchJobExpire extends default unmarshal to extract line, col information.
 func (r *BatchJobExpire) UnmarshalYAML(val *yaml.Node) error {
 	type expireJob BatchJobExpire
 	var tmp expireJob
 	err := val.Decode(&tmp)
 	if err != nil {
 		return err
 	}
 	*r = BatchJobExpire(tmp)
 	r.line, r.col = val.Line, val.Column
 	return nil
 }
 // Notify notifies notification endpoint if configured regarding job failure or success.
 func (r BatchJobExpire) Notify(ctx context.Context, body io.Reader) error {
 	if r.NotificationCfg.Endpoint == "" {
 		return nil
 	}
 	ctx, cancel := context.WithTimeout(ctx, 10*time.Second)
 	defer cancel()
 	req, err := http.NewRequestWithContext(ctx, http.MethodPost, r.NotificationCfg.Endpoint, body)
 	if err != nil {
 		return err
 	}
 	if r.NotificationCfg.Token != "" {
 		req.Header.Set("Authorization", r.NotificationCfg.Token)
 	}
 	clnt := http.Client{Transport: getRemoteInstanceTransport}
 	resp, err := clnt.Do(req)
 	if err != nil {
 		return err
 	}
 	xhttp.DrainBody(resp.Body)
 	if resp.StatusCode != http.StatusOK {
 		return errors.New(resp.Status)
 	}
 	return nil
 }
 // Expire expires object versions which have already matched supplied filter conditions
 func (r *BatchJobExpire) Expire(ctx context.Context, api ObjectLayer, vc *versioning.Versioning, objsToDel []ObjectToDelete) []error {
 	opts := ObjectOptions{
 		PrefixEnabledFn:  vc.PrefixEnabled,
 		VersionSuspended: vc.Suspended(),
 	}
 	_, errs := api.DeleteObjects(ctx, r.Bucket, objsToDel, opts)
 	return errs
 }
 const (
 	batchExpireName                 = "batch-expire.bin"
 	batchExpireFormat               = 1
 	batchExpireVersionV1            = 1
 	batchExpireVersion              = batchExpireVersionV1
 	batchExpireAPIVersion           = "v1"
 	batchExpireJobDefaultRetries    = 3
 	batchExpireJobDefaultRetryDelay = 250 * time.Millisecond
 )
 type objInfoCache map[string]*ObjectInfo
 func newObjInfoCache() objInfoCache {
 	return objInfoCache(make(map[string]*ObjectInfo))
 }
 func (oiCache objInfoCache) Add(toDel ObjectToDelete, oi *ObjectInfo) {
 	oiCache[fmt.Sprintf("%s-%s", toDel.ObjectName, toDel.VersionID)] = oi
 }
 func (oiCache objInfoCache) Get(toDel ObjectToDelete) (*ObjectInfo, bool) {
 	oi, ok := oiCache[fmt.Sprintf("%s-%s", toDel.ObjectName, toDel.VersionID)]
 	return oi, ok
 }
 func batchObjsForDelete(ctx context.Context, r *BatchJobExpire, ri *batchJobInfo, job BatchJobRequest, api ObjectLayer, wk *workers.Workers, expireCh <-chan []expireObjInfo) {
 	vc, _ := globalBucketVersioningSys.Get(r.Bucket)
 	retryAttempts := r.Retry.Attempts
 	delay := job.Expire.Retry.Delay
 	if delay == 0 {
 		delay = batchExpireJobDefaultRetryDelay
 	}
 	var i int
 	for toExpire := range expireCh {
 		select {
 		case <-ctx.Done():
 			return
 		default:
 		}
 		if i > 0 {
 			if wait := globalBatchConfig.ExpirationWait(); wait > 0 {
 				time.Sleep(wait)
 			}
 		}
 		i++
 		wk.Take()
 		go func(toExpire []expireObjInfo) {
 			defer wk.Give()
 			toExpireAll := make([]ObjectInfo, 0, len(toExpire))
 			toDel := make([]ObjectToDelete, 0, len(toExpire))
 			oiCache := newObjInfoCache()
 			for _, exp := range toExpire {
 				if exp.ExpireAll {
 					toExpireAll = append(toExpireAll, exp.ObjectInfo)
 					continue
 				}
 				// Cache ObjectInfo value via pointers for
 				// subsequent use to track objects which
 				// couldn't be deleted.
 				od := ObjectToDelete{
 					ObjectV: ObjectV{
 						ObjectName: exp.Name,
 						VersionID:  exp.VersionID,
 					},
 				}
 				toDel = append(toDel, od)
 				oiCache.Add(od, &exp.ObjectInfo)
 			}
 			var done bool
 			// DeleteObject(deletePrefix: true) to expire all versions of an object
 			for _, exp := range toExpireAll {
 				var success bool
 				for attempts := 1; attempts <= retryAttempts; attempts++ {
 					select {
 					case <-ctx.Done():
 						done = true
 					default:
 					}
 					stopFn := globalBatchJobsMetrics.trace(batchJobMetricExpire, ri.JobID, attempts)
 					_, err := api.DeleteObject(ctx, exp.Bucket, exp.Name, ObjectOptions{
 						DeletePrefix: true,
 					})
 					if err != nil {
 						stopFn(exp, err)
 						logger.LogIf(ctx, fmt.Errorf("Failed to expire %s/%s versionID=%s due to %v (attempts=%d)", toExpire[i].Bucket, toExpire[i].Name, toExpire[i].VersionID, err, attempts))
 					} else {
 						stopFn(exp, err)
 						success = true
 						break
 					}
 				}
 				ri.trackMultipleObjectVersions(r.Bucket, exp, success)
 				if done {
 					break
 				}
 			}
 			if done {
 				return
 			}
 			// DeleteMultiple objects
 			toDelCopy := make([]ObjectToDelete, len(toDel))
 			for attempts := 1; attempts <= retryAttempts; attempts++ {
 				select {
 				case <-ctx.Done():
 					return
 				default:
 				}
 				stopFn := globalBatchJobsMetrics.trace(batchJobMetricExpire, ri.JobID, attempts)
 				// Copying toDel to select from objects whose
 				// deletion failed
 				copy(toDelCopy, toDel)
 				var failed int
 				errs := r.Expire(ctx, api, vc, toDel)
 				// reslice toDel in preparation for next retry
 				// attempt
 				toDel = toDel[:0]
 				for i, err := range errs {
 					if err != nil {
 						stopFn(toDelCopy[i], err)
 						logger.LogIf(ctx, fmt.Errorf("Failed to expire %s/%s versionID=%s due to %v (attempts=%d)", ri.Bucket, toDelCopy[i].ObjectName, toDelCopy[i].VersionID, err, attempts))
 						failed++
 						if attempts == retryAttempts { // all retry attempts failed, record failure
 							if oi, ok := oiCache.Get(toDelCopy[i]); ok {
 								ri.trackCurrentBucketObject(r.Bucket, *oi, false)
 							}
 						} else {
 							toDel = append(toDel, toDelCopy[i])
 						}
 					} else {
 						stopFn(toDelCopy[i], nil)
 						if oi, ok := oiCache.Get(toDelCopy[i]); ok {
 							ri.trackCurrentBucketObject(r.Bucket, *oi, true)
 						}
 					}
 				}
 				globalBatchJobsMetrics.save(ri.JobID, ri)
 				if failed == 0 {
 					break
 				}
 				// Add a delay between retry attempts
 				if attempts < retryAttempts {
 					time.Sleep(delay)
 				}
 			}
 		}(toExpire)
 	}
 }
 type expireObjInfo struct {
 	ObjectInfo
 	ExpireAll bool
 }
 // Start the batch expiration job, resumes if there was a pending job via "job.ID"
 func (r *BatchJobExpire) Start(ctx context.Context, api ObjectLayer, job BatchJobRequest) error {
 	ri := &batchJobInfo{
 		JobID:     job.ID,
 		JobType:   string(job.Type()),
 		StartTime: job.Started,
 	}
 	if err := ri.load(ctx, api, job); err != nil {
 		return err
 	}
 	globalBatchJobsMetrics.save(job.ID, ri)
 	lastObject := ri.Object
 	now := time.Now().UTC()
 	workerSize, err := strconv.Atoi(env.Get("_MINIO_BATCH_EXPIRATION_WORKERS", strconv.Itoa(runtime.GOMAXPROCS(0)/2)))
 	if err != nil {
 		return err
 	}
 	wk, err := workers.New(workerSize)
 	if err != nil {
 		// invalid worker size.
 		return err
 	}
 	ctx, cancel := context.WithCancel(ctx)
 	defer cancel()
 	results := make(chan ObjectInfo, workerSize)
 	if err := api.Walk(ctx, r.Bucket, r.Prefix, results, WalkOptions{
 		Marker:       lastObject,
 		LatestOnly:   false, // we need to visit all versions of the object to implement purge: retainVersions
 		VersionsSort: WalkVersionsSortDesc,
 	}); err != nil {
 		// Do not need to retry if we can't list objects on source.
 		return err
 	}
 	// Goroutine to periodically save batch-expire job's in-memory state
 	saverQuitCh := make(chan struct{})
 	go func() {
 		saveTicker := time.NewTicker(10 * time.Second)
 		defer saveTicker.Stop()
 		for {
 			select {
 			case <-saveTicker.C:
 				// persist in-memory state to disk after every 10secs.
 				logger.LogIf(ctx, ri.updateAfter(ctx, api, 10*time.Second, job))
 			case <-ctx.Done():
 				// persist in-memory state immediately before exiting due to context cancellation.
 				logger.LogIf(ctx, ri.updateAfter(ctx, api, 0, job))
 				return
 			case <-saverQuitCh:
 				// persist in-memory state immediately to disk.
 				logger.LogIf(ctx, ri.updateAfter(ctx, api, 0, job))
 				return
 			}
 		}
 	}()
 	expireCh := make(chan []expireObjInfo, workerSize)
 	expireDoneCh := make(chan struct{})
 	go func() {
 		defer close(expireDoneCh)
 		batchObjsForDelete(ctx, r, ri, job, api, wk, expireCh)
 	}()
 	var (
 		prevObj       ObjectInfo
 		matchedFilter BatchJobExpireFilter
 		versionsCount int
 		toDel         []expireObjInfo
 	)
 	for result := range results {
 		// Apply filter to find the matching rule to apply expiry
 		// actions accordingly.
 		// nolint:gocritic
 		if result.IsLatest {
 			// send down filtered entries to be deleted using
 			// DeleteObjects method
 			if len(toDel) > 10 { // batch up to 10 objects/versions to be expired simultaneously.
 				xfer := make([]expireObjInfo, len(toDel))
 				copy(xfer, toDel)
 				var done bool
 				select {
 				case <-ctx.Done():
 					done = true
 				case expireCh <- xfer:
 					toDel = toDel[:0] // resetting toDel
 				}
 				if done {
 					break
 				}
 			}
 			var match BatchJobExpireFilter
 			var found bool
 			for _, rule := range r.Rules {
 				if rule.Matches(result, now) {
 					match = rule
 					found = true
 					break
 				}
 			}
 			if !found {
 				continue
 			}
 			prevObj = result
 			matchedFilter = match
 			versionsCount = 1
 			// Include the latest version
 			if matchedFilter.Purge.RetainVersions == 0 {
 				toDel = append(toDel, expireObjInfo{
 					ObjectInfo: result,
 					ExpireAll:  true,
 				})
 				continue
 			}
 		} else if prevObj.Name == result.Name {
 			if matchedFilter.Purge.RetainVersions == 0 {
 				continue // including latest version in toDel suffices, skipping other versions
 			}
 			versionsCount++
 		} else {
 			continue
 		}
 		if versionsCount <= matchedFilter.Purge.RetainVersions {
 			continue // retain versions
 		}
 		toDel = append(toDel, expireObjInfo{
 			ObjectInfo: result,
 		})
 	}
 	// Send any remaining objects downstream
 	if len(toDel) > 0 {
 		select {
 		case <-ctx.Done():
 		case expireCh <- toDel:
 		}
 	}
 	xioutil.SafeClose(expireCh)
 	<-expireDoneCh // waits for the expire goroutine to complete
 	wk.Wait()      // waits for all expire workers to retire
 	ri.Complete = ri.ObjectsFailed == 0
 	ri.Failed = ri.ObjectsFailed > 0
 	globalBatchJobsMetrics.save(job.ID, ri)
 	// Close the saverQuitCh - this also triggers saving in-memory state
 	// immediately one last time before we exit this method.
 	xioutil.SafeClose(saverQuitCh)
 	// Notify expire jobs final status to the configured endpoint
 	buf, _ := json.Marshal(ri)
 	if err := r.Notify(context.Background(), bytes.NewReader(buf)); err != nil {
 		logger.LogIf(context.Background(), fmt.Errorf("unable to notify %v", err))
 	}
 	return nil
 }
 //msgp:ignore batchExpireJobError
 type batchExpireJobError struct {
 	Code           string
 	Description    string
 	HTTPStatusCode int
 }
 func (e batchExpireJobError) Error() string {
 	return e.Description
 }
 // maxBatchRules maximum number of rules a batch-expiry job supports
 const maxBatchRules = 50
 // Validate validates the job definition input
 func (r *BatchJobExpire) Validate(ctx context.Context, job BatchJobRequest, o ObjectLayer) error {
 	if r == nil {
 		return nil
 	}
 	if r.APIVersion != batchExpireAPIVersion {
 		return batchExpireJobError{
 			Code:           "InvalidArgument",
 			Description:    "Unsupported batch expire API version",
 			HTTPStatusCode: http.StatusBadRequest,
 		}
 	}
 	if r.Bucket == "" {
 		return batchExpireJobError{
 			Code:           "InvalidArgument",
 			Description:    "Bucket argument missing",
 			HTTPStatusCode: http.StatusBadRequest,
 		}
 	}
 	if _, err := o.GetBucketInfo(ctx, r.Bucket, BucketOptions{}); err != nil {
 		if isErrBucketNotFound(err) {
 			return batchExpireJobError{
 				Code:           "NoSuchSourceBucket",
 				Description:    "The specified source bucket does not exist",
 				HTTPStatusCode: http.StatusNotFound,
 			}
 		}
 		return err
 	}
 	if len(r.Rules) > maxBatchRules {
 		return batchExpireJobError{
 			Code:           "InvalidArgument",
 			Description:    "Too many rules. Batch expire job can't have more than 100 rules",
 			HTTPStatusCode: http.StatusBadRequest,
 		}
 	}
 	for _, rule := range r.Rules {
 		if err := rule.Validate(); err != nil {
 			return batchExpireJobError{
 				Code:           "InvalidArgument",
 				Description:    fmt.Sprintf("Invalid batch expire rule: %s", err),
 				HTTPStatusCode: http.StatusBadRequest,
 			}
 		}
 	}
 	if err := r.Retry.Validate(); err != nil {
 		return batchExpireJobError{
 			Code:           "InvalidArgument",
 			Description:    fmt.Sprintf("Invalid batch expire retry configuration: %s", err),
 			HTTPStatusCode: http.StatusBadRequest,
 		}
 	}
 	return nil
 }
@@ -0,0 +1,856 @@
 package cmd
 // Code generated by github.com/tinylib/msgp DO NOT EDIT.
 import (
 	"time"
 	"github.com/tinylib/msgp/msgp"
 )
 // DecodeMsg implements msgp.Decodable
 func (z *BatchJobExpire) DecodeMsg(dc *msgp.Reader) (err error) {
 	var field []byte
 	_ = field
 	var zb0001 uint32
 	zb0001, err = dc.ReadMapHeader()
 	if err != nil {
 		err = msgp.WrapError(err)
 		return
 	}
 	for zb0001 > 0 {
 		zb0001--
 		field, err = dc.ReadMapKeyPtr()
 		if err != nil {
 			err = msgp.WrapError(err)
 			return
 		}
 		switch msgp.UnsafeString(field) {
 		case "APIVersion":
 			z.APIVersion, err = dc.ReadString()
 			if err != nil {
 				err = msgp.WrapError(err, "APIVersion")
 				return
 			}
 		case "Bucket":
 			z.Bucket, err = dc.ReadString()
 			if err != nil {
 				err = msgp.WrapError(err, "Bucket")
 				return
 			}
 		case "Prefix":
 			z.Prefix, err = dc.ReadString()
 			if err != nil {
 				err = msgp.WrapError(err, "Prefix")
 				return
 			}
 		case "NotificationCfg":
 			err = z.NotificationCfg.DecodeMsg(dc)
 			if err != nil {
 				err = msgp.WrapError(err, "NotificationCfg")
 				return
 			}
 		case "Retry":
 			err = z.Retry.DecodeMsg(dc)
 			if err != nil {
 				err = msgp.WrapError(err, "Retry")
 				return
 			}
 		case "Rules":
 			var zb0002 uint32
 			zb0002, err = dc.ReadArrayHeader()
 			if err != nil {
 				err = msgp.WrapError(err, "Rules")
 				return
 			}
 			if cap(z.Rules) >= int(zb0002) {
 				z.Rules = (z.Rules)[:zb0002]
 			} else {
 				z.Rules = make([]BatchJobExpireFilter, zb0002)
 			}
 			for za0001 := range z.Rules {
 				err = z.Rules[za0001].DecodeMsg(dc)
 				if err != nil {
 					err = msgp.WrapError(err, "Rules", za0001)
 					return
 				}
 			}
 		default:
 			err = dc.Skip()
 			if err != nil {
 				err = msgp.WrapError(err)
 				return
 			}
 		}
 	}
 	return
 }
 // EncodeMsg implements msgp.Encodable
 func (z *BatchJobExpire) EncodeMsg(en *msgp.Writer) (err error) {
 	// map header, size 6
 	// write "APIVersion"
 	err = en.Append(0x86, 0xaa, 0x41, 0x50, 0x49, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e)
 	if err != nil {
 		return
 	}
 	err = en.WriteString(z.APIVersion)
 	if err != nil {
 		err = msgp.WrapError(err, "APIVersion")
 		return
 	}
 	// write "Bucket"
 	err = en.Append(0xa6, 0x42, 0x75, 0x63, 0x6b, 0x65, 0x74)
 	if err != nil {
 		return
 	}
 	err = en.WriteString(z.Bucket)
 	if err != nil {
 		err = msgp.WrapError(err, "Bucket")
 		return
 	}
 	// write "Prefix"
 	err = en.Append(0xa6, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78)
 	if err != nil {
 		return
 	}
 	err = en.WriteString(z.Prefix)
 	if err != nil {
 		err = msgp.WrapError(err, "Prefix")
 		return
 	}
 	// write "NotificationCfg"
 	err = en.Append(0xaf, 0x4e, 0x6f, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x43, 0x66, 0x67)
 	if err != nil {
 		return
 	}
 	err = z.NotificationCfg.EncodeMsg(en)
 	if err != nil {
 		err = msgp.WrapError(err, "NotificationCfg")
 		return
 	}
 	// write "Retry"
 	err = en.Append(0xa5, 0x52, 0x65, 0x74, 0x72, 0x79)
 	if err != nil {
 		return
 	}
 	err = z.Retry.EncodeMsg(en)
 	if err != nil {
 		err = msgp.WrapError(err, "Retry")
 		return
 	}
 	// write "Rules"
 	err = en.Append(0xa5, 0x52, 0x75, 0x6c, 0x65, 0x73)
 	if err != nil {
 		return
 	}
 	err = en.WriteArrayHeader(uint32(len(z.Rules)))
 	if err != nil {
 		err = msgp.WrapError(err, "Rules")
 		return
 	}
 	for za0001 := range z.Rules {
 		err = z.Rules[za0001].EncodeMsg(en)
 		if err != nil {
 			err = msgp.WrapError(err, "Rules", za0001)
 			return
 		}
 	}
 	return
 }
 // MarshalMsg implements msgp.Marshaler
 func (z *BatchJobExpire) MarshalMsg(b []byte) (o []byte, err error) {
 	o = msgp.Require(b, z.Msgsize())
 	// map header, size 6
 	// string "APIVersion"
 	o = append(o, 0x86, 0xaa, 0x41, 0x50, 0x49, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e)
 	o = msgp.AppendString(o, z.APIVersion)
 	// string "Bucket"
 	o = append(o, 0xa6, 0x42, 0x75, 0x63, 0x6b, 0x65, 0x74)
 	o = msgp.AppendString(o, z.Bucket)
 	// string "Prefix"
 	o = append(o, 0xa6, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78)
 	o = msgp.AppendString(o, z.Prefix)
 	// string "NotificationCfg"
 	o = append(o, 0xaf, 0x4e, 0x6f, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x43, 0x66, 0x67)
 	o, err = z.NotificationCfg.MarshalMsg(o)
 	if err != nil {
 		err = msgp.WrapError(err, "NotificationCfg")
 		return
 	}
 	// string "Retry"
 	o = append(o, 0xa5, 0x52, 0x65, 0x74, 0x72, 0x79)
 	o, err = z.Retry.MarshalMsg(o)
 	if err != nil {
 		err = msgp.WrapError(err, "Retry")
 		return
 	}
 	// string "Rules"
 	o = append(o, 0xa5, 0x52, 0x75, 0x6c, 0x65, 0x73)
 	o = msgp.AppendArrayHeader(o, uint32(len(z.Rules)))
 	for za0001 := range z.Rules {
 		o, err = z.Rules[za0001].MarshalMsg(o)
 		if err != nil {
 			err = msgp.WrapError(err, "Rules", za0001)
 			return
 		}
 	}
 	return
 }
 // UnmarshalMsg implements msgp.Unmarshaler
 func (z *BatchJobExpire) UnmarshalMsg(bts []byte) (o []byte, err error) {
 	var field []byte
 	_ = field
 	var zb0001 uint32
 	zb0001, bts, err = msgp.ReadMapHeaderBytes(bts)
 	if err != nil {
 		err = msgp.WrapError(err)
 		return
 	}
 	for zb0001 > 0 {
 		zb0001--
 		field, bts, err = msgp.ReadMapKeyZC(bts)
 		if err != nil {
 			err = msgp.WrapError(err)
 			return
 		}
 		switch msgp.UnsafeString(field) {
 		case "APIVersion":
 			z.APIVersion, bts, err = msgp.ReadStringBytes(bts)
 			if err != nil {
 				err = msgp.WrapError(err, "APIVersion")
 				return
 			}
 		case "Bucket":
 			z.Bucket, bts, err = msgp.ReadStringBytes(bts)
 			if err != nil {
 				err = msgp.WrapError(err, "Bucket")
 				return
 			}
 		case "Prefix":
 			z.Prefix, bts, err = msgp.ReadStringBytes(bts)
 			if err != nil {
 				err = msgp.WrapError(err, "Prefix")
 				return
 			}
 		case "NotificationCfg":
 			bts, err = z.NotificationCfg.UnmarshalMsg(bts)
 			if err != nil {
 				err = msgp.WrapError(err, "NotificationCfg")
 				return
 			}
 		case "Retry":
 			bts, err = z.Retry.UnmarshalMsg(bts)
 			if err != nil {
 				err = msgp.WrapError(err, "Retry")
 				return
 			}
 		case "Rules":
 			var zb0002 uint32
 			zb0002, bts, err = msgp.ReadArrayHeaderBytes(bts)
 			if err != nil {
 				err = msgp.WrapError(err, "Rules")
 				return
 			}
 			if cap(z.Rules) >= int(zb0002) {
 				z.Rules = (z.Rules)[:zb0002]
 			} else {
 				z.Rules = make([]BatchJobExpireFilter, zb0002)
 			}
 			for za0001 := range z.Rules {
 				bts, err = z.Rules[za0001].UnmarshalMsg(bts)
 				if err != nil {
 					err = msgp.WrapError(err, "Rules", za0001)
 					return
 				}
 			}
 		default:
 			bts, err = msgp.Skip(bts)
 			if err != nil {
 				err = msgp.WrapError(err)
 				return
 			}
 		}
 	}
 	o = bts
 	return
 }
 // Msgsize returns an upper bound estimate of the number of bytes occupied by the serialized message
 func (z *BatchJobExpire) Msgsize() (s int) {
 	s = 1 + 11 + msgp.StringPrefixSize + len(z.APIVersion) + 7 + msgp.StringPrefixSize + len(z.Bucket) + 7 + msgp.StringPrefixSize + len(z.Prefix) + 16 + z.NotificationCfg.Msgsize() + 6 + z.Retry.Msgsize() + 6 + msgp.ArrayHeaderSize
 	for za0001 := range z.Rules {
 		s += z.Rules[za0001].Msgsize()
 	}
 	return
 }
 // DecodeMsg implements msgp.Decodable
 func (z *BatchJobExpireFilter) DecodeMsg(dc *msgp.Reader) (err error) {
 	var field []byte
 	_ = field
 	var zb0001 uint32
 	zb0001, err = dc.ReadMapHeader()
 	if err != nil {
 		err = msgp.WrapError(err)
 		return
 	}
 	for zb0001 > 0 {
 		zb0001--
 		field, err = dc.ReadMapKeyPtr()
 		if err != nil {
 			err = msgp.WrapError(err)
 			return
 		}
 		switch msgp.UnsafeString(field) {
 		case "OlderThan":
 			z.OlderThan, err = dc.ReadDuration()
 			if err != nil {
 				err = msgp.WrapError(err, "OlderThan")
 				return
 			}
 		case "CreatedBefore":
 			if dc.IsNil() {
 				err = dc.ReadNil()
 				if err != nil {
 					err = msgp.WrapError(err, "CreatedBefore")
 					return
 				}
 				z.CreatedBefore = nil
 			} else {
 				if z.CreatedBefore == nil {
 					z.CreatedBefore = new(time.Time)
 				}
 				*z.CreatedBefore, err = dc.ReadTime()
 				if err != nil {
 					err = msgp.WrapError(err, "CreatedBefore")
 					return
 				}
 			}
 		case "Tags":
 			var zb0002 uint32
 			zb0002, err = dc.ReadArrayHeader()
 			if err != nil {
 				err = msgp.WrapError(err, "Tags")
 				return
 			}
 			if cap(z.Tags) >= int(zb0002) {
 				z.Tags = (z.Tags)[:zb0002]
 			} else {
 				z.Tags = make([]BatchJobKV, zb0002)
 			}
 			for za0001 := range z.Tags {
 				err = z.Tags[za0001].DecodeMsg(dc)
 				if err != nil {
 					err = msgp.WrapError(err, "Tags", za0001)
 					return
 				}
 			}
 		case "Metadata":
 			var zb0003 uint32
 			zb0003, err = dc.ReadArrayHeader()
 			if err != nil {
 				err = msgp.WrapError(err, "Metadata")
 				return
 			}
 			if cap(z.Metadata) >= int(zb0003) {
 				z.Metadata = (z.Metadata)[:zb0003]
 			} else {
 				z.Metadata = make([]BatchJobKV, zb0003)
 			}
 			for za0002 := range z.Metadata {
 				err = z.Metadata[za0002].DecodeMsg(dc)
 				if err != nil {
 					err = msgp.WrapError(err, "Metadata", za0002)
 					return
 				}
 			}
 		case "Size":
 			err = z.Size.DecodeMsg(dc)
 			if err != nil {
 				err = msgp.WrapError(err, "Size")
 				return
 			}
 		case "Type":
 			z.Type, err = dc.ReadString()
 			if err != nil {
 				err = msgp.WrapError(err, "Type")
 				return
 			}
 		case "Name":
 			z.Name, err = dc.ReadString()
 			if err != nil {
 				err = msgp.WrapError(err, "Name")
 				return
 			}
 		case "Purge":
 			var zb0004 uint32
 			zb0004, err = dc.ReadMapHeader()
 			if err != nil {
 				err = msgp.WrapError(err, "Purge")
 				return
 			}
 			for zb0004 > 0 {
 				zb0004--
 				field, err = dc.ReadMapKeyPtr()
 				if err != nil {
 					err = msgp.WrapError(err, "Purge")
 					return
 				}
 				switch msgp.UnsafeString(field) {
 				case "RetainVersions":
 					z.Purge.RetainVersions, err = dc.ReadInt()
 					if err != nil {
 						err = msgp.WrapError(err, "Purge", "RetainVersions")
 						return
 					}
 				default:
 					err = dc.Skip()
 					if err != nil {
 						err = msgp.WrapError(err, "Purge")
 						return
 					}
 				}
 			}
 		default:
 			err = dc.Skip()
 			if err != nil {
 				err = msgp.WrapError(err)
 				return
 			}
 		}
 	}
 	return
 }
 // EncodeMsg implements msgp.Encodable
 func (z *BatchJobExpireFilter) EncodeMsg(en *msgp.Writer) (err error) {
 	// map header, size 8
 	// write "OlderThan"
 	err = en.Append(0x88, 0xa9, 0x4f, 0x6c, 0x64, 0x65, 0x72, 0x54, 0x68, 0x61, 0x6e)
 	if err != nil {
 		return
 	}
 	err = en.WriteDuration(z.OlderThan)
 	if err != nil {
 		err = msgp.WrapError(err, "OlderThan")
 		return
 	}
 	// write "CreatedBefore"
 	err = en.Append(0xad, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x42, 0x65, 0x66, 0x6f, 0x72, 0x65)
 	if err != nil {
 		return
 	}
 	if z.CreatedBefore == nil {
 		err = en.WriteNil()
 		if err != nil {
 			return
 		}
 	} else {
 		err = en.WriteTime(*z.CreatedBefore)
 		if err != nil {
 			err = msgp.WrapError(err, "CreatedBefore")
 			return
 		}
 	}
 	// write "Tags"
 	err = en.Append(0xa4, 0x54, 0x61, 0x67, 0x73)
 	if err != nil {
 		return
 	}
 	err = en.WriteArrayHeader(uint32(len(z.Tags)))
 	if err != nil {
 		err = msgp.WrapError(err, "Tags")
 		return
 	}
 	for za0001 := range z.Tags {
 		err = z.Tags[za0001].EncodeMsg(en)
 		if err != nil {
 			err = msgp.WrapError(err, "Tags", za0001)
 			return
 		}
 	}
 	// write "Metadata"
 	err = en.Append(0xa8, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61)
 	if err != nil {
 		return
 	}
 	err = en.WriteArrayHeader(uint32(len(z.Metadata)))
 	if err != nil {
 		err = msgp.WrapError(err, "Metadata")
 		return
 	}
 	for za0002 := range z.Metadata {
 		err = z.Metadata[za0002].EncodeMsg(en)
 		if err != nil {
 			err = msgp.WrapError(err, "Metadata", za0002)
 			return
 		}
 	}
 	// write "Size"
 	err = en.Append(0xa4, 0x53, 0x69, 0x7a, 0x65)
 	if err != nil {
 		return
 	}
 	err = z.Size.EncodeMsg(en)
 	if err != nil {
 		err = msgp.WrapError(err, "Size")
 		return
 	}
 	// write "Type"
 	err = en.Append(0xa4, 0x54, 0x79, 0x70, 0x65)
 	if err != nil {
 		return
 	}
 	err = en.WriteString(z.Type)
 	if err != nil {
 		err = msgp.WrapError(err, "Type")
 		return
 	}
 	// write "Name"
 	err = en.Append(0xa4, 0x4e, 0x61, 0x6d, 0x65)
 	if err != nil {
 		return
 	}
 	err = en.WriteString(z.Name)
 	if err != nil {
 		err = msgp.WrapError(err, "Name")
 		return
 	}
 	// write "Purge"
 	err = en.Append(0xa5, 0x50, 0x75, 0x72, 0x67, 0x65)
 	if err != nil {
 		return
 	}
 	// map header, size 1
 	// write "RetainVersions"
 	err = en.Append(0x81, 0xae, 0x52, 0x65, 0x74, 0x61, 0x69, 0x6e, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x73)
 	if err != nil {
 		return
 	}
 	err = en.WriteInt(z.Purge.RetainVersions)
 	if err != nil {
 		err = msgp.WrapError(err, "Purge", "RetainVersions")
 		return
 	}
 	return
 }
 // MarshalMsg implements msgp.Marshaler
 func (z *BatchJobExpireFilter) MarshalMsg(b []byte) (o []byte, err error) {
 	o = msgp.Require(b, z.Msgsize())
 	// map header, size 8
 	// string "OlderThan"
 	o = append(o, 0x88, 0xa9, 0x4f, 0x6c, 0x64, 0x65, 0x72, 0x54, 0x68, 0x61, 0x6e)
 	o = msgp.AppendDuration(o, z.OlderThan)
 	// string "CreatedBefore"
 	o = append(o, 0xad, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x42, 0x65, 0x66, 0x6f, 0x72, 0x65)
 	if z.CreatedBefore == nil {
 		o = msgp.AppendNil(o)
 	} else {
 		o = msgp.AppendTime(o, *z.CreatedBefore)
 	}
 	// string "Tags"
 	o = append(o, 0xa4, 0x54, 0x61, 0x67, 0x73)
 	o = msgp.AppendArrayHeader(o, uint32(len(z.Tags)))
 	for za0001 := range z.Tags {
 		o, err = z.Tags[za0001].MarshalMsg(o)
 		if err != nil {
 			err = msgp.WrapError(err, "Tags", za0001)
 			return
 		}
 	}
 	// string "Metadata"
 	o = append(o, 0xa8, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61)
 	o = msgp.AppendArrayHeader(o, uint32(len(z.Metadata)))
 	for za0002 := range z.Metadata {
 		o, err = z.Metadata[za0002].MarshalMsg(o)
 		if err != nil {
 			err = msgp.WrapError(err, "Metadata", za0002)
 			return
 		}
 	}
 	// string "Size"
 	o = append(o, 0xa4, 0x53, 0x69, 0x7a, 0x65)
 	o, err = z.Size.MarshalMsg(o)
 	if err != nil {
 		err = msgp.WrapError(err, "Size")
 		return
 	}
 	// string "Type"
 	o = append(o, 0xa4, 0x54, 0x79, 0x70, 0x65)
 	o = msgp.AppendString(o, z.Type)
 	// string "Name"
 	o = append(o, 0xa4, 0x4e, 0x61, 0x6d, 0x65)
 	o = msgp.AppendString(o, z.Name)
 	// string "Purge"
 	o = append(o, 0xa5, 0x50, 0x75, 0x72, 0x67, 0x65)
 	// map header, size 1
 	// string "RetainVersions"
 	o = append(o, 0x81, 0xae, 0x52, 0x65, 0x74, 0x61, 0x69, 0x6e, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x73)
 	o = msgp.AppendInt(o, z.Purge.RetainVersions)
 	return
 }
 // UnmarshalMsg implements msgp.Unmarshaler
 func (z *BatchJobExpireFilter) UnmarshalMsg(bts []byte) (o []byte, err error) {
 	var field []byte
 	_ = field
 	var zb0001 uint32
 	zb0001, bts, err = msgp.ReadMapHeaderBytes(bts)
 	if err != nil {
 		err = msgp.WrapError(err)
 		return
 	}
 	for zb0001 > 0 {
 		zb0001--
 		field, bts, err = msgp.ReadMapKeyZC(bts)
 		if err != nil {
 			err = msgp.WrapError(err)
 			return
 		}
 		switch msgp.UnsafeString(field) {
 		case "OlderThan":
 			z.OlderThan, bts, err = msgp.ReadDurationBytes(bts)
 			if err != nil {
 				err = msgp.WrapError(err, "OlderThan")
 				return
 			}
 		case "CreatedBefore":
 			if msgp.IsNil(bts) {
 				bts, err = msgp.ReadNilBytes(bts)
 				if err != nil {
 					return
 				}
 				z.CreatedBefore = nil
 			} else {
 				if z.CreatedBefore == nil {
 					z.CreatedBefore = new(time.Time)
 				}
 				*z.CreatedBefore, bts, err = msgp.ReadTimeBytes(bts)
 				if err != nil {
 					err = msgp.WrapError(err, "CreatedBefore")
 					return
 				}
 			}
 		case "Tags":
 			var zb0002 uint32
 			zb0002, bts, err = msgp.ReadArrayHeaderBytes(bts)
 			if err != nil {
 				err = msgp.WrapError(err, "Tags")
 				return
 			}
 			if cap(z.Tags) >= int(zb0002) {
 				z.Tags = (z.Tags)[:zb0002]
 			} else {
 				z.Tags = make([]BatchJobKV, zb0002)
 			}
 			for za0001 := range z.Tags {
 				bts, err = z.Tags[za0001].UnmarshalMsg(bts)
 				if err != nil {
 					err = msgp.WrapError(err, "Tags", za0001)
 					return
 				}
 			}
 		case "Metadata":
 			var zb0003 uint32
 			zb0003, bts, err = msgp.ReadArrayHeaderBytes(bts)
 			if err != nil {
 				err = msgp.WrapError(err, "Metadata")
 				return
 			}
 			if cap(z.Metadata) >= int(zb0003) {
 				z.Metadata = (z.Metadata)[:zb0003]
 			} else {
 				z.Metadata = make([]BatchJobKV, zb0003)
 			}
 			for za0002 := range z.Metadata {
 				bts, err = z.Metadata[za0002].UnmarshalMsg(bts)
 				if err != nil {
 					err = msgp.WrapError(err, "Metadata", za0002)
 					return
 				}
 			}
 		case "Size":
 			bts, err = z.Size.UnmarshalMsg(bts)
 			if err != nil {
 				err = msgp.WrapError(err, "Size")
 				return
 			}
 		case "Type":
 			z.Type, bts, err = msgp.ReadStringBytes(bts)
 			if err != nil {
 				err = msgp.WrapError(err, "Type")
 				return
 			}
 		case "Name":
 			z.Name, bts, err = msgp.ReadStringBytes(bts)
 			if err != nil {
 				err = msgp.WrapError(err, "Name")
 				return
 			}
 		case "Purge":
 			var zb0004 uint32
 			zb0004, bts, err = msgp.ReadMapHeaderBytes(bts)
 			if err != nil {
 				err = msgp.WrapError(err, "Purge")
 				return
 			}
 			for zb0004 > 0 {
 				zb0004--
 				field, bts, err = msgp.ReadMapKeyZC(bts)
 				if err != nil {
 					err = msgp.WrapError(err, "Purge")
 					return
 				}
 				switch msgp.UnsafeString(field) {
 				case "RetainVersions":
 					z.Purge.RetainVersions, bts, err = msgp.ReadIntBytes(bts)
 					if err != nil {
 						err = msgp.WrapError(err, "Purge", "RetainVersions")
 						return
 					}
 				default:
 					bts, err = msgp.Skip(bts)
 					if err != nil {
 						err = msgp.WrapError(err, "Purge")
 						return
 					}
 				}
 			}
 		default:
 			bts, err = msgp.Skip(bts)
 			if err != nil {
 				err = msgp.WrapError(err)
 				return
 			}
 		}
 	}
 	o = bts
 	return
 }
 // Msgsize returns an upper bound estimate of the number of bytes occupied by the serialized message
 func (z *BatchJobExpireFilter) Msgsize() (s int) {
 	s = 1 + 10 + msgp.DurationSize + 14
 	if z.CreatedBefore == nil {
 		s += msgp.NilSize
 	} else {
 		s += msgp.TimeSize
 	}
 	s += 5 + msgp.ArrayHeaderSize
 	for za0001 := range z.Tags {
 		s += z.Tags[za0001].Msgsize()
 	}
 	s += 9 + msgp.ArrayHeaderSize
 	for za0002 := range z.Metadata {
 		s += z.Metadata[za0002].Msgsize()
 	}
 	s += 5 + z.Size.Msgsize() + 5 + msgp.StringPrefixSize + len(z.Type) + 5 + msgp.StringPrefixSize + len(z.Name) + 6 + 1 + 15 + msgp.IntSize
 	return
 }
 // DecodeMsg implements msgp.Decodable
 func (z *BatchJobExpirePurge) DecodeMsg(dc *msgp.Reader) (err error) {
 	var field []byte
 	_ = field
 	var zb0001 uint32
 	zb0001, err = dc.ReadMapHeader()
 	if err != nil {
 		err = msgp.WrapError(err)
 		return
 	}
 	for zb0001 > 0 {
 		zb0001--
 		field, err = dc.ReadMapKeyPtr()
 		if err != nil {
 			err = msgp.WrapError(err)
 			return
 		}
 		switch msgp.UnsafeString(field) {
 		case "RetainVersions":
 			z.RetainVersions, err = dc.ReadInt()
 			if err != nil {
 				err = msgp.WrapError(err, "RetainVersions")
 				return
 			}
 		default:
 			err = dc.Skip()
 			if err != nil {
 				err = msgp.WrapError(err)
 				return
 			}
 		}
 	}
 	return
 }
 // EncodeMsg implements msgp.Encodable
 func (z BatchJobExpirePurge) EncodeMsg(en *msgp.Writer) (err error) {
 	// map header, size 1
 	// write "RetainVersions"
 	err = en.Append(0x81, 0xae, 0x52, 0x65, 0x74, 0x61, 0x69, 0x6e, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x73)
 	if err != nil {
 		return
 	}
 	err = en.WriteInt(z.RetainVersions)
 	if err != nil {
 		err = msgp.WrapError(err, "RetainVersions")
 		return
 	}
 	return
 }
 // MarshalMsg implements msgp.Marshaler
 func (z BatchJobExpirePurge) MarshalMsg(b []byte) (o []byte, err error) {
 	o = msgp.Require(b, z.Msgsize())
 	// map header, size 1
 	// string "RetainVersions"
 	o = append(o, 0x81, 0xae, 0x52, 0x65, 0x74, 0x61, 0x69, 0x6e, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x73)
 	o = msgp.AppendInt(o, z.RetainVersions)
 	return
 }
 // UnmarshalMsg implements msgp.Unmarshaler
 func (z *BatchJobExpirePurge) UnmarshalMsg(bts []byte) (o []byte, err error) {
 	var field []byte
 	_ = field
 	var zb0001 uint32
 	zb0001, bts, err = msgp.ReadMapHeaderBytes(bts)
 	if err != nil {
 		err = msgp.WrapError(err)
 		return
 	}
 	for zb0001 > 0 {
 		zb0001--
 		field, bts, err = msgp.ReadMapKeyZC(bts)
 		if err != nil {
 			err = msgp.WrapError(err)
 			return
 		}
 		switch msgp.UnsafeString(field) {
 		case "RetainVersions":
 			z.RetainVersions, bts, err = msgp.ReadIntBytes(bts)
 			if err != nil {
 				err = msgp.WrapError(err, "RetainVersions")
 				return
 			}
 		default:
 			bts, err = msgp.Skip(bts)
 			if err != nil {
 				err = msgp.WrapError(err)
 				return
 			}
 		}
 	}
 	o = bts
 	return
 }
 // Msgsize returns an upper bound estimate of the number of bytes occupied by the serialized message
 func (z BatchJobExpirePurge) Msgsize() (s int) {
 	s = 1 + 15 + msgp.IntSize
 	return
 }
@@ -0,0 +1,349 @@
 package cmd
 // Code generated by github.com/tinylib/msgp DO NOT EDIT.
 import (
 	"bytes"
 	"testing"
 	"github.com/tinylib/msgp/msgp"
 )
 func TestMarshalUnmarshalBatchJobExpire(t *testing.T) {
 	v := BatchJobExpire{}
 	bts, err := v.MarshalMsg(nil)
 	if err != nil {
 		t.Fatal(err)
 	}
 	left, err := v.UnmarshalMsg(bts)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if len(left) > 0 {
 		t.Errorf("%d bytes left over after UnmarshalMsg(): %q", len(left), left)
 	}
 	left, err = msgp.Skip(bts)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if len(left) > 0 {
 		t.Errorf("%d bytes left over after Skip(): %q", len(left), left)
 	}
 }
 func BenchmarkMarshalMsgBatchJobExpire(b *testing.B) {
 	v := BatchJobExpire{}
 	b.ReportAllocs()
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		v.MarshalMsg(nil)
 	}
 }
 func BenchmarkAppendMsgBatchJobExpire(b *testing.B) {
 	v := BatchJobExpire{}
 	bts := make([]byte, 0, v.Msgsize())
 	bts, _ = v.MarshalMsg(bts[0:0])
 	b.SetBytes(int64(len(bts)))
 	b.ReportAllocs()
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		bts, _ = v.MarshalMsg(bts[0:0])
 	}
 }
 func BenchmarkUnmarshalBatchJobExpire(b *testing.B) {
 	v := BatchJobExpire{}
 	bts, _ := v.MarshalMsg(nil)
 	b.ReportAllocs()
 	b.SetBytes(int64(len(bts)))
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		_, err := v.UnmarshalMsg(bts)
 		if err != nil {
 			b.Fatal(err)
 		}
 	}
 }
 func TestEncodeDecodeBatchJobExpire(t *testing.T) {
 	v := BatchJobExpire{}
 	var buf bytes.Buffer
 	msgp.Encode(&buf, &v)
 	m := v.Msgsize()
 	if buf.Len() > m {
 		t.Log("WARNING: TestEncodeDecodeBatchJobExpire Msgsize() is inaccurate")
 	}
 	vn := BatchJobExpire{}
 	err := msgp.Decode(&buf, &vn)
 	if err != nil {
 		t.Error(err)
 	}
 	buf.Reset()
 	msgp.Encode(&buf, &v)
 	err = msgp.NewReader(&buf).Skip()
 	if err != nil {
 		t.Error(err)
 	}
 }
 func BenchmarkEncodeBatchJobExpire(b *testing.B) {
 	v := BatchJobExpire{}
 	var buf bytes.Buffer
 	msgp.Encode(&buf, &v)
 	b.SetBytes(int64(buf.Len()))
 	en := msgp.NewWriter(msgp.Nowhere)
 	b.ReportAllocs()
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		v.EncodeMsg(en)
 	}
 	en.Flush()
 }
 func BenchmarkDecodeBatchJobExpire(b *testing.B) {
 	v := BatchJobExpire{}
 	var buf bytes.Buffer
 	msgp.Encode(&buf, &v)
 	b.SetBytes(int64(buf.Len()))
 	rd := msgp.NewEndlessReader(buf.Bytes(), b)
 	dc := msgp.NewReader(rd)
 	b.ReportAllocs()
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		err := v.DecodeMsg(dc)
 		if err != nil {
 			b.Fatal(err)
 		}
 	}
 }
 func TestMarshalUnmarshalBatchJobExpireFilter(t *testing.T) {
 	v := BatchJobExpireFilter{}
 	bts, err := v.MarshalMsg(nil)
 	if err != nil {
 		t.Fatal(err)
 	}
 	left, err := v.UnmarshalMsg(bts)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if len(left) > 0 {
 		t.Errorf("%d bytes left over after UnmarshalMsg(): %q", len(left), left)
 	}
 	left, err = msgp.Skip(bts)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if len(left) > 0 {
 		t.Errorf("%d bytes left over after Skip(): %q", len(left), left)
 	}
 }
 func BenchmarkMarshalMsgBatchJobExpireFilter(b *testing.B) {
 	v := BatchJobExpireFilter{}
 	b.ReportAllocs()
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		v.MarshalMsg(nil)
 	}
 }
 func BenchmarkAppendMsgBatchJobExpireFilter(b *testing.B) {
 	v := BatchJobExpireFilter{}
 	bts := make([]byte, 0, v.Msgsize())
 	bts, _ = v.MarshalMsg(bts[0:0])
 	b.SetBytes(int64(len(bts)))
 	b.ReportAllocs()
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		bts, _ = v.MarshalMsg(bts[0:0])
 	}
 }
 func BenchmarkUnmarshalBatchJobExpireFilter(b *testing.B) {
 	v := BatchJobExpireFilter{}
 	bts, _ := v.MarshalMsg(nil)
 	b.ReportAllocs()
 	b.SetBytes(int64(len(bts)))
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		_, err := v.UnmarshalMsg(bts)
 		if err != nil {
 			b.Fatal(err)
 		}
 	}
 }
 func TestEncodeDecodeBatchJobExpireFilter(t *testing.T) {
 	v := BatchJobExpireFilter{}
 	var buf bytes.Buffer
 	msgp.Encode(&buf, &v)
 	m := v.Msgsize()
 	if buf.Len() > m {
 		t.Log("WARNING: TestEncodeDecodeBatchJobExpireFilter Msgsize() is inaccurate")
 	}
 	vn := BatchJobExpireFilter{}
 	err := msgp.Decode(&buf, &vn)
 	if err != nil {
 		t.Error(err)
 	}
 	buf.Reset()
 	msgp.Encode(&buf, &v)
 	err = msgp.NewReader(&buf).Skip()
 	if err != nil {
 		t.Error(err)
 	}
 }
 func BenchmarkEncodeBatchJobExpireFilter(b *testing.B) {
 	v := BatchJobExpireFilter{}
 	var buf bytes.Buffer
 	msgp.Encode(&buf, &v)
 	b.SetBytes(int64(buf.Len()))
 	en := msgp.NewWriter(msgp.Nowhere)
 	b.ReportAllocs()
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		v.EncodeMsg(en)
 	}
 	en.Flush()
 }
 func BenchmarkDecodeBatchJobExpireFilter(b *testing.B) {
 	v := BatchJobExpireFilter{}
 	var buf bytes.Buffer
 	msgp.Encode(&buf, &v)
 	b.SetBytes(int64(buf.Len()))
 	rd := msgp.NewEndlessReader(buf.Bytes(), b)
 	dc := msgp.NewReader(rd)
 	b.ReportAllocs()
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		err := v.DecodeMsg(dc)
 		if err != nil {
 			b.Fatal(err)
 		}
 	}
 }
 func TestMarshalUnmarshalBatchJobExpirePurge(t *testing.T) {
 	v := BatchJobExpirePurge{}
 	bts, err := v.MarshalMsg(nil)
 	if err != nil {
 		t.Fatal(err)
 	}
 	left, err := v.UnmarshalMsg(bts)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if len(left) > 0 {
 		t.Errorf("%d bytes left over after UnmarshalMsg(): %q", len(left), left)
 	}
 	left, err = msgp.Skip(bts)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if len(left) > 0 {
 		t.Errorf("%d bytes left over after Skip(): %q", len(left), left)
 	}
 }
 func BenchmarkMarshalMsgBatchJobExpirePurge(b *testing.B) {
 	v := BatchJobExpirePurge{}
 	b.ReportAllocs()
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		v.MarshalMsg(nil)
 	}
 }
 func BenchmarkAppendMsgBatchJobExpirePurge(b *testing.B) {
 	v := BatchJobExpirePurge{}
 	bts := make([]byte, 0, v.Msgsize())
 	bts, _ = v.MarshalMsg(bts[0:0])
 	b.SetBytes(int64(len(bts)))
 	b.ReportAllocs()
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		bts, _ = v.MarshalMsg(bts[0:0])
 	}
 }
 func BenchmarkUnmarshalBatchJobExpirePurge(b *testing.B) {
 	v := BatchJobExpirePurge{}
 	bts, _ := v.MarshalMsg(nil)
 	b.ReportAllocs()
 	b.SetBytes(int64(len(bts)))
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		_, err := v.UnmarshalMsg(bts)
 		if err != nil {
 			b.Fatal(err)
 		}
 	}
 }
 func TestEncodeDecodeBatchJobExpirePurge(t *testing.T) {
 	v := BatchJobExpirePurge{}
 	var buf bytes.Buffer
 	msgp.Encode(&buf, &v)
 	m := v.Msgsize()
 	if buf.Len() > m {
 		t.Log("WARNING: TestEncodeDecodeBatchJobExpirePurge Msgsize() is inaccurate")
 	}
 	vn := BatchJobExpirePurge{}
 	err := msgp.Decode(&buf, &vn)
 	if err != nil {
 		t.Error(err)
 	}
 	buf.Reset()
 	msgp.Encode(&buf, &v)
 	err = msgp.NewReader(&buf).Skip()
 	if err != nil {
 		t.Error(err)
 	}
 }
 func BenchmarkEncodeBatchJobExpirePurge(b *testing.B) {
 	v := BatchJobExpirePurge{}
 	var buf bytes.Buffer
 	msgp.Encode(&buf, &v)
 	b.SetBytes(int64(buf.Len()))
 	en := msgp.NewWriter(msgp.Nowhere)
 	b.ReportAllocs()
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		v.EncodeMsg(en)
 	}
 	en.Flush()
 }
 func BenchmarkDecodeBatchJobExpirePurge(b *testing.B) {
 	v := BatchJobExpirePurge{}
 	var buf bytes.Buffer
 	msgp.Encode(&buf, &v)
 	b.SetBytes(int64(buf.Len()))
 	rd := msgp.NewEndlessReader(buf.Bytes(), b)
 	dc := msgp.NewReader(rd)
 	b.ReportAllocs()
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		err := v.DecodeMsg(dc)
 		if err != nil {
 			b.Fatal(err)
 		}
 	}
 }
@@ -0,0 +1,71 @@
 // Copyright (c) 2015-2023 MinIO, Inc.
 //
 // This file is part of MinIO Object Storage stack
 //
 // This program is free software: you can redistribute it and/or modify
 // it under the terms of the GNU Affero General Public License as published by
 // the Free Software Foundation, either version 3 of the License, or
 // (at your option) any later version.
 //
 // This program is distributed in the hope that it will be useful
 // but WITHOUT ANY WARRANTY; without even the implied warranty of
 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 // GNU Affero General Public License for more details.
 //
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 package cmd
 import (
 	"testing"
 	"gopkg.in/yaml.v2"
 )
 func TestParseBatchJobExpire(t *testing.T) {
 	expireYaml := `
 expire: # Expire objects that match a condition
  apiVersion: v1
  bucket: mybucket # Bucket where this batch job will expire matching objects from
  prefix: myprefix # (Optional) Prefix under which this job will expire objects matching the rules below.
  rules:
    - type: object  # regular objects with zero or more older versions
      name: NAME # match object names that satisfy the wildcard expression.
      olderThan: 70h # match objects older than this value
      createdBefore: "2006-01-02T15:04:05.00Z" # match objects created before "date"
      tags:
        - key: name
          value: pick* # match objects with tag 'name', all values starting with 'pick'
      metadata:
        - key: content-type
          value: image/* # match objects with 'content-type', all values starting with 'image/'
      size:
        lessThan: "10MiB" # match objects with size less than this value (e.g. 10MiB)
        greaterThan: 1MiB # match objects with size greater than this value (e.g. 1MiB)
      purge:
          # retainVersions: 0 # (default) delete all versions of the object. This option is the fastest.
          # retainVersions: 5 # keep the latest 5 versions of the object.
    - type: deleted # objects with delete marker as their latest version
      name: NAME # match object names that satisfy the wildcard expression.
      olderThan: 10h # match objects older than this value (e.g. 7d10h31s)
      createdBefore: "2006-01-02T15:04:05.00Z" # match objects created before "date"
      purge:
          # retainVersions: 0 # (default) delete all versions of the object. This option is the fastest.
          # retainVersions: 5 # keep the latest 5 versions of the object including delete markers.
  notify:
    endpoint: https://notify.endpoint # notification endpoint to receive job completion status
    token: Bearer xxxxx # optional authentication token for the notification endpoint
  retry:
    attempts: 10 # number of retries for the job before giving up
    delay: 500ms # least amount of delay between each retry
 `
 	var job BatchJobRequest
 	err := yaml.UnmarshalStrict([]byte(expireYaml), &job)
 	if err != nil {
 		t.Fatal("Failed to parse batch-job-expire yaml", err)
 	}
 }
@@ -0,0 +1,290 @@
 // Copyright (c) 2015-2023 MinIO, Inc.
 //
 // This file is part of MinIO Object Storage stack
 //
 // This program is free software: you can redistribute it and/or modify
 // it under the terms of the GNU Affero General Public License as published by
 // the Free Software Foundation, either version 3 of the License, or
 // (at your option) any later version.
 //
 // This program is distributed in the hope that it will be useful
 // but WITHOUT ANY WARRANTY; without even the implied warranty of
 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 // GNU Affero General Public License for more details.
 //
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 package cmd
 import (
 	"fmt"
 	"strings"
 	"time"
 	"github.com/dustin/go-humanize"
 	"github.com/minio/pkg/v2/wildcard"
 	"gopkg.in/yaml.v3"
 )
 //go:generate msgp -file $GOFILE
 //msgp:ignore BatchJobYamlErr
 // BatchJobYamlErr can be used to return yaml validation errors with line,
 // column information guiding user to fix syntax errors
 type BatchJobYamlErr struct {
 	line, col int
 	msg       string
 }
 // message returns the error message excluding line, col information.
 // Intended to be used in unit tests.
 func (b BatchJobYamlErr) message() string {
 	return b.msg
 }
 // Error implements Error interface
 func (b BatchJobYamlErr) Error() string {
 	return fmt.Sprintf("%s\n Hint: error near line: %d, col: %d", b.msg, b.line, b.col)
 }
 // BatchJobKV is a key-value data type which supports wildcard matching
 type BatchJobKV struct {
 	line, col int
 	Key       string `yaml:"key" json:"key"`
 	Value     string `yaml:"value" json:"value"`
 }
 var _ yaml.Unmarshaler = &BatchJobKV{}
 // UnmarshalYAML - BatchJobKV extends default unmarshal to extract line, col information.
 func (kv *BatchJobKV) UnmarshalYAML(val *yaml.Node) error {
 	type jobKV BatchJobKV
 	var tmp jobKV
 	err := val.Decode(&tmp)
 	if err != nil {
 		return err
 	}
 	*kv = BatchJobKV(tmp)
 	kv.line, kv.col = val.Line, val.Column
 	return nil
 }
 // Validate returns an error if key is empty
 func (kv BatchJobKV) Validate() error {
 	if kv.Key == "" {
 		return BatchJobYamlErr{
 			line: kv.line,
 			col:  kv.col,
 			msg:  "key can't be empty",
 		}
 	}
 	return nil
 }
 // Empty indicates if kv is not set
 func (kv BatchJobKV) Empty() bool {
 	return kv.Key == "" && kv.Value == ""
 }
 // Match matches input kv with kv, value will be wildcard matched depending on the user input
 func (kv BatchJobKV) Match(ikv BatchJobKV) bool {
 	if kv.Empty() {
 		return true
 	}
 	if strings.EqualFold(kv.Key, ikv.Key) {
 		return wildcard.Match(kv.Value, ikv.Value)
 	}
 	return false
 }
 // BatchJobNotification stores notification endpoint and token information.
 // Used by batch jobs to notify of their status.
 type BatchJobNotification struct {
 	line, col int
 	Endpoint  string `yaml:"endpoint" json:"endpoint"`
 	Token     string `yaml:"token" json:"token"`
 }
 var _ yaml.Unmarshaler = &BatchJobNotification{}
 // UnmarshalYAML - BatchJobNotification extends unmarshal to extract line, column information
 func (b *BatchJobNotification) UnmarshalYAML(val *yaml.Node) error {
 	type notification BatchJobNotification
 	var tmp notification
 	err := val.Decode(&tmp)
 	if err != nil {
 		return err
 	}
 	*b = BatchJobNotification(tmp)
 	b.line, b.col = val.Line, val.Column
 	return nil
 }
 // BatchJobRetry stores retry configuration used in the event of failures.
 type BatchJobRetry struct {
 	line, col int
 	Attempts  int           `yaml:"attempts" json:"attempts"` // number of retry attempts
 	Delay     time.Duration `yaml:"delay" json:"delay"`       // delay between each retries
 }
 var _ yaml.Unmarshaler = &BatchJobRetry{}
 // UnmarshalYAML - BatchJobRetry extends unmarshal to extract line, column information
 func (r *BatchJobRetry) UnmarshalYAML(val *yaml.Node) error {
 	type retry BatchJobRetry
 	var tmp retry
 	err := val.Decode(&tmp)
 	if err != nil {
 		return err
 	}
 	*r = BatchJobRetry(tmp)
 	r.line, r.col = val.Line, val.Column
 	return nil
 }
 // Validate validates input replicate retries.
 func (r BatchJobRetry) Validate() error {
 	if r.Attempts < 0 {
 		return BatchJobYamlErr{
 			line: r.line,
 			col:  r.col,
 			msg:  "Invalid arguments specified",
 		}
 	}
 	if r.Delay < 0 {
 		return BatchJobYamlErr{
 			line: r.line,
 			col:  r.col,
 			msg:  "Invalid arguments specified",
 		}
 	}
 	return nil
 }
 //   # snowball based archive transfer is by default enabled when source
 //   # is local and target is remote which is also minio.
 //   snowball:
 //     disable: false # optionally turn-off snowball archive transfer
 //     batch: 100 # upto this many objects per archive
 //     inmemory: true # indicates if the archive must be staged locally or in-memory
 //     compress: true # S2/Snappy compressed archive
 //     smallerThan: 5MiB # create archive for all objects smaller than 5MiB
 //     skipErrs: false # skips any source side read() errors
 // BatchJobSnowball describes the snowball feature when replicating objects from a local source to a remote target
 type BatchJobSnowball struct {
 	line, col   int
 	Disable     *bool   `yaml:"disable" json:"disable"`
 	Batch       *int    `yaml:"batch" json:"batch"`
 	InMemory    *bool   `yaml:"inmemory" json:"inmemory"`
 	Compress    *bool   `yaml:"compress" json:"compress"`
 	SmallerThan *string `yaml:"smallerThan" json:"smallerThan"`
 	SkipErrs    *bool   `yaml:"skipErrs" json:"skipErrs"`
 }
 var _ yaml.Unmarshaler = &BatchJobSnowball{}
 // UnmarshalYAML - BatchJobSnowball extends unmarshal to extract line, column information
 func (b *BatchJobSnowball) UnmarshalYAML(val *yaml.Node) error {
 	type snowball BatchJobSnowball
 	var tmp snowball
 	err := val.Decode(&tmp)
 	if err != nil {
 		return err
 	}
 	*b = BatchJobSnowball(tmp)
 	b.line, b.col = val.Line, val.Column
 	return nil
 }
 // Validate the snowball parameters in the job description
 func (b BatchJobSnowball) Validate() error {
 	if *b.Batch <= 0 {
 		return BatchJobYamlErr{
 			line: b.line,
 			col:  b.col,
 			msg:  "batch number should be non positive zero",
 		}
 	}
 	_, err := humanize.ParseBytes(*b.SmallerThan)
 	if err != nil {
 		return BatchJobYamlErr{
 			line: b.line,
 			col:  b.col,
 			msg:  err.Error(),
 		}
 	}
 	return nil
 }
 // BatchJobSizeFilter supports size based filters - LesserThan and GreaterThan
 type BatchJobSizeFilter struct {
 	line, col  int
 	UpperBound BatchJobSize `yaml:"lessThan" json:"lessThan"`
 	LowerBound BatchJobSize `yaml:"greaterThan" json:"greaterThan"`
 }
 // UnmarshalYAML - BatchJobSizeFilter extends unmarshal to extract line, column information
 func (sf *BatchJobSizeFilter) UnmarshalYAML(val *yaml.Node) error {
 	type sizeFilter BatchJobSizeFilter
 	var tmp sizeFilter
 	err := val.Decode(&tmp)
 	if err != nil {
 		return err
 	}
 	*sf = BatchJobSizeFilter(tmp)
 	sf.line, sf.col = val.Line, val.Column
 	return nil
 }
 // InRange returns true in the following cases and false otherwise,
 // - sf.LowerBound < sz, when sf.LowerBound alone is specified
 // - sz < sf.UpperBound, when sf.UpperBound alone is specified
 // - sf.LowerBound < sz < sf.UpperBound when both are specified,
 func (sf BatchJobSizeFilter) InRange(sz int64) bool {
 	if sf.UpperBound > 0 && sz > int64(sf.UpperBound) {
 		return false
 	}
 	if sf.LowerBound > 0 && sz < int64(sf.LowerBound) {
 		return false
 	}
 	return true
 }
 // Validate checks if sf is a valid batch-job size filter
 func (sf BatchJobSizeFilter) Validate() error {
 	if sf.LowerBound > 0 && sf.UpperBound > 0 && sf.LowerBound >= sf.UpperBound {
 		return BatchJobYamlErr{
 			line: sf.line,
 			col:  sf.col,
 			msg:  "invalid batch-job size filter",
 		}
 	}
 	return nil
 }
 // BatchJobSize supports humanized byte values in yaml files type BatchJobSize uint64
 type BatchJobSize int64
 // UnmarshalYAML to parse humanized byte values
 func (s *BatchJobSize) UnmarshalYAML(unmarshal func(interface{}) error) error {
 	var batchExpireSz string
 	err := unmarshal(&batchExpireSz)
 	if err != nil {
 		return err
 	}
 	sz, err := humanize.ParseBytes(batchExpireSz)
 	if err != nil {
 		return err
 	}
 	*s = BatchJobSize(sz)
 	return nil
 }
@@ -0,0 +1,575 @@
 package cmd
 // Code generated by github.com/tinylib/msgp DO NOT EDIT.
 import (
 	"bytes"
 	"testing"
 	"github.com/tinylib/msgp/msgp"
 )
 func TestMarshalUnmarshalBatchJobKV(t *testing.T) {
 	v := BatchJobKV{}
 	bts, err := v.MarshalMsg(nil)
 	if err != nil {
 		t.Fatal(err)
 	}
 	left, err := v.UnmarshalMsg(bts)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if len(left) > 0 {
 		t.Errorf("%d bytes left over after UnmarshalMsg(): %q", len(left), left)
 	}
 	left, err = msgp.Skip(bts)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if len(left) > 0 {
 		t.Errorf("%d bytes left over after Skip(): %q", len(left), left)
 	}
 }
 func BenchmarkMarshalMsgBatchJobKV(b *testing.B) {
 	v := BatchJobKV{}
 	b.ReportAllocs()
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		v.MarshalMsg(nil)
 	}
 }
 func BenchmarkAppendMsgBatchJobKV(b *testing.B) {
 	v := BatchJobKV{}
 	bts := make([]byte, 0, v.Msgsize())
 	bts, _ = v.MarshalMsg(bts[0:0])
 	b.SetBytes(int64(len(bts)))
 	b.ReportAllocs()
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		bts, _ = v.MarshalMsg(bts[0:0])
 	}
 }
 func BenchmarkUnmarshalBatchJobKV(b *testing.B) {
 	v := BatchJobKV{}
 	bts, _ := v.MarshalMsg(nil)
 	b.ReportAllocs()
 	b.SetBytes(int64(len(bts)))
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		_, err := v.UnmarshalMsg(bts)
 		if err != nil {
 			b.Fatal(err)
 		}
 	}
 }
 func TestEncodeDecodeBatchJobKV(t *testing.T) {
 	v := BatchJobKV{}
 	var buf bytes.Buffer
 	msgp.Encode(&buf, &v)
 	m := v.Msgsize()
 	if buf.Len() > m {
 		t.Log("WARNING: TestEncodeDecodeBatchJobKV Msgsize() is inaccurate")
 	}
 	vn := BatchJobKV{}
 	err := msgp.Decode(&buf, &vn)
 	if err != nil {
 		t.Error(err)
 	}
 	buf.Reset()
 	msgp.Encode(&buf, &v)
 	err = msgp.NewReader(&buf).Skip()
 	if err != nil {
 		t.Error(err)
 	}
 }
 func BenchmarkEncodeBatchJobKV(b *testing.B) {
 	v := BatchJobKV{}
 	var buf bytes.Buffer
 	msgp.Encode(&buf, &v)
 	b.SetBytes(int64(buf.Len()))
 	en := msgp.NewWriter(msgp.Nowhere)
 	b.ReportAllocs()
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		v.EncodeMsg(en)
 	}
 	en.Flush()
 }
 func BenchmarkDecodeBatchJobKV(b *testing.B) {
 	v := BatchJobKV{}
 	var buf bytes.Buffer
 	msgp.Encode(&buf, &v)
 	b.SetBytes(int64(buf.Len()))
 	rd := msgp.NewEndlessReader(buf.Bytes(), b)
 	dc := msgp.NewReader(rd)
 	b.ReportAllocs()
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		err := v.DecodeMsg(dc)
 		if err != nil {
 			b.Fatal(err)
 		}
 	}
 }
 func TestMarshalUnmarshalBatchJobNotification(t *testing.T) {
 	v := BatchJobNotification{}
 	bts, err := v.MarshalMsg(nil)
 	if err != nil {
 		t.Fatal(err)
 	}
 	left, err := v.UnmarshalMsg(bts)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if len(left) > 0 {
 		t.Errorf("%d bytes left over after UnmarshalMsg(): %q", len(left), left)
 	}
 	left, err = msgp.Skip(bts)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if len(left) > 0 {
 		t.Errorf("%d bytes left over after Skip(): %q", len(left), left)
 	}
 }
 func BenchmarkMarshalMsgBatchJobNotification(b *testing.B) {
 	v := BatchJobNotification{}
 	b.ReportAllocs()
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		v.MarshalMsg(nil)
 	}
 }
 func BenchmarkAppendMsgBatchJobNotification(b *testing.B) {
 	v := BatchJobNotification{}
 	bts := make([]byte, 0, v.Msgsize())
 	bts, _ = v.MarshalMsg(bts[0:0])
 	b.SetBytes(int64(len(bts)))
 	b.ReportAllocs()
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		bts, _ = v.MarshalMsg(bts[0:0])
 	}
 }
 func BenchmarkUnmarshalBatchJobNotification(b *testing.B) {
 	v := BatchJobNotification{}
 	bts, _ := v.MarshalMsg(nil)
 	b.ReportAllocs()
 	b.SetBytes(int64(len(bts)))
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		_, err := v.UnmarshalMsg(bts)
 		if err != nil {
 			b.Fatal(err)
 		}
 	}
 }
 func TestEncodeDecodeBatchJobNotification(t *testing.T) {
 	v := BatchJobNotification{}
 	var buf bytes.Buffer
 	msgp.Encode(&buf, &v)
 	m := v.Msgsize()
 	if buf.Len() > m {
 		t.Log("WARNING: TestEncodeDecodeBatchJobNotification Msgsize() is inaccurate")
 	}
 	vn := BatchJobNotification{}
 	err := msgp.Decode(&buf, &vn)
 	if err != nil {
 		t.Error(err)
 	}
 	buf.Reset()
 	msgp.Encode(&buf, &v)
 	err = msgp.NewReader(&buf).Skip()
 	if err != nil {
 		t.Error(err)
 	}
 }
 func BenchmarkEncodeBatchJobNotification(b *testing.B) {
 	v := BatchJobNotification{}
 	var buf bytes.Buffer
 	msgp.Encode(&buf, &v)
 	b.SetBytes(int64(buf.Len()))
 	en := msgp.NewWriter(msgp.Nowhere)
 	b.ReportAllocs()
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		v.EncodeMsg(en)
 	}
 	en.Flush()
 }
 func BenchmarkDecodeBatchJobNotification(b *testing.B) {
 	v := BatchJobNotification{}
 	var buf bytes.Buffer
 	msgp.Encode(&buf, &v)
 	b.SetBytes(int64(buf.Len()))
 	rd := msgp.NewEndlessReader(buf.Bytes(), b)
 	dc := msgp.NewReader(rd)
 	b.ReportAllocs()
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		err := v.DecodeMsg(dc)
 		if err != nil {
 			b.Fatal(err)
 		}
 	}
 }
 func TestMarshalUnmarshalBatchJobRetry(t *testing.T) {
 	v := BatchJobRetry{}
 	bts, err := v.MarshalMsg(nil)
 	if err != nil {
 		t.Fatal(err)
 	}
 	left, err := v.UnmarshalMsg(bts)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if len(left) > 0 {
 		t.Errorf("%d bytes left over after UnmarshalMsg(): %q", len(left), left)
 	}
 	left, err = msgp.Skip(bts)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if len(left) > 0 {
 		t.Errorf("%d bytes left over after Skip(): %q", len(left), left)
 	}
 }
 func BenchmarkMarshalMsgBatchJobRetry(b *testing.B) {
 	v := BatchJobRetry{}
 	b.ReportAllocs()
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		v.MarshalMsg(nil)
 	}
 }
 func BenchmarkAppendMsgBatchJobRetry(b *testing.B) {
 	v := BatchJobRetry{}
 	bts := make([]byte, 0, v.Msgsize())
 	bts, _ = v.MarshalMsg(bts[0:0])
 	b.SetBytes(int64(len(bts)))
 	b.ReportAllocs()
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		bts, _ = v.MarshalMsg(bts[0:0])
 	}
 }
 func BenchmarkUnmarshalBatchJobRetry(b *testing.B) {
 	v := BatchJobRetry{}
 	bts, _ := v.MarshalMsg(nil)
 	b.ReportAllocs()
 	b.SetBytes(int64(len(bts)))
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		_, err := v.UnmarshalMsg(bts)
 		if err != nil {
 			b.Fatal(err)
 		}
 	}
 }
 func TestEncodeDecodeBatchJobRetry(t *testing.T) {
 	v := BatchJobRetry{}
 	var buf bytes.Buffer
 	msgp.Encode(&buf, &v)
 	m := v.Msgsize()
 	if buf.Len() > m {
 		t.Log("WARNING: TestEncodeDecodeBatchJobRetry Msgsize() is inaccurate")
 	}
 	vn := BatchJobRetry{}
 	err := msgp.Decode(&buf, &vn)
 	if err != nil {
 		t.Error(err)
 	}
 	buf.Reset()
 	msgp.Encode(&buf, &v)
 	err = msgp.NewReader(&buf).Skip()
 	if err != nil {
 		t.Error(err)
 	}
 }
 func BenchmarkEncodeBatchJobRetry(b *testing.B) {
 	v := BatchJobRetry{}
 	var buf bytes.Buffer
 	msgp.Encode(&buf, &v)
 	b.SetBytes(int64(buf.Len()))
 	en := msgp.NewWriter(msgp.Nowhere)
 	b.ReportAllocs()
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		v.EncodeMsg(en)
 	}
 	en.Flush()
 }
 func BenchmarkDecodeBatchJobRetry(b *testing.B) {
 	v := BatchJobRetry{}
 	var buf bytes.Buffer
 	msgp.Encode(&buf, &v)
 	b.SetBytes(int64(buf.Len()))
 	rd := msgp.NewEndlessReader(buf.Bytes(), b)
 	dc := msgp.NewReader(rd)
 	b.ReportAllocs()
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		err := v.DecodeMsg(dc)
 		if err != nil {
 			b.Fatal(err)
 		}
 	}
 }
 func TestMarshalUnmarshalBatchJobSizeFilter(t *testing.T) {
 	v := BatchJobSizeFilter{}
 	bts, err := v.MarshalMsg(nil)
 	if err != nil {
 		t.Fatal(err)
 	}
 	left, err := v.UnmarshalMsg(bts)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if len(left) > 0 {
 		t.Errorf("%d bytes left over after UnmarshalMsg(): %q", len(left), left)
 	}
 	left, err = msgp.Skip(bts)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if len(left) > 0 {
 		t.Errorf("%d bytes left over after Skip(): %q", len(left), left)
 	}
 }
 func BenchmarkMarshalMsgBatchJobSizeFilter(b *testing.B) {
 	v := BatchJobSizeFilter{}
 	b.ReportAllocs()
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		v.MarshalMsg(nil)
 	}
 }
 func BenchmarkAppendMsgBatchJobSizeFilter(b *testing.B) {
 	v := BatchJobSizeFilter{}
 	bts := make([]byte, 0, v.Msgsize())
 	bts, _ = v.MarshalMsg(bts[0:0])
 	b.SetBytes(int64(len(bts)))
 	b.ReportAllocs()
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		bts, _ = v.MarshalMsg(bts[0:0])
 	}
 }
 func BenchmarkUnmarshalBatchJobSizeFilter(b *testing.B) {
 	v := BatchJobSizeFilter{}
 	bts, _ := v.MarshalMsg(nil)
 	b.ReportAllocs()
 	b.SetBytes(int64(len(bts)))
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		_, err := v.UnmarshalMsg(bts)
 		if err != nil {
 			b.Fatal(err)
 		}
 	}
 }
 func TestEncodeDecodeBatchJobSizeFilter(t *testing.T) {
 	v := BatchJobSizeFilter{}
 	var buf bytes.Buffer
 	msgp.Encode(&buf, &v)
 	m := v.Msgsize()
 	if buf.Len() > m {
 		t.Log("WARNING: TestEncodeDecodeBatchJobSizeFilter Msgsize() is inaccurate")
 	}
 	vn := BatchJobSizeFilter{}
 	err := msgp.Decode(&buf, &vn)
 	if err != nil {
 		t.Error(err)
 	}
 	buf.Reset()
 	msgp.Encode(&buf, &v)
 	err = msgp.NewReader(&buf).Skip()
 	if err != nil {
 		t.Error(err)
 	}
 }
 func BenchmarkEncodeBatchJobSizeFilter(b *testing.B) {
 	v := BatchJobSizeFilter{}
 	var buf bytes.Buffer
 	msgp.Encode(&buf, &v)
 	b.SetBytes(int64(buf.Len()))
 	en := msgp.NewWriter(msgp.Nowhere)
 	b.ReportAllocs()
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		v.EncodeMsg(en)
 	}
 	en.Flush()
 }
 func BenchmarkDecodeBatchJobSizeFilter(b *testing.B) {
 	v := BatchJobSizeFilter{}
 	var buf bytes.Buffer
 	msgp.Encode(&buf, &v)
 	b.SetBytes(int64(buf.Len()))
 	rd := msgp.NewEndlessReader(buf.Bytes(), b)
 	dc := msgp.NewReader(rd)
 	b.ReportAllocs()
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		err := v.DecodeMsg(dc)
 		if err != nil {
 			b.Fatal(err)
 		}
 	}
 }
 func TestMarshalUnmarshalBatchJobSnowball(t *testing.T) {
 	v := BatchJobSnowball{}
 	bts, err := v.MarshalMsg(nil)
 	if err != nil {
 		t.Fatal(err)
 	}
 	left, err := v.UnmarshalMsg(bts)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if len(left) > 0 {
 		t.Errorf("%d bytes left over after UnmarshalMsg(): %q", len(left), left)
 	}
 	left, err = msgp.Skip(bts)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if len(left) > 0 {
 		t.Errorf("%d bytes left over after Skip(): %q", len(left), left)
 	}
 }
 func BenchmarkMarshalMsgBatchJobSnowball(b *testing.B) {
 	v := BatchJobSnowball{}
 	b.ReportAllocs()
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		v.MarshalMsg(nil)
 	}
 }
 func BenchmarkAppendMsgBatchJobSnowball(b *testing.B) {
 	v := BatchJobSnowball{}
 	bts := make([]byte, 0, v.Msgsize())
 	bts, _ = v.MarshalMsg(bts[0:0])
 	b.SetBytes(int64(len(bts)))
 	b.ReportAllocs()
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		bts, _ = v.MarshalMsg(bts[0:0])
 	}
 }
 func BenchmarkUnmarshalBatchJobSnowball(b *testing.B) {
 	v := BatchJobSnowball{}
 	bts, _ := v.MarshalMsg(nil)
 	b.ReportAllocs()
 	b.SetBytes(int64(len(bts)))
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		_, err := v.UnmarshalMsg(bts)
 		if err != nil {
 			b.Fatal(err)
 		}
 	}
 }
 func TestEncodeDecodeBatchJobSnowball(t *testing.T) {
 	v := BatchJobSnowball{}
 	var buf bytes.Buffer
 	msgp.Encode(&buf, &v)
 	m := v.Msgsize()
 	if buf.Len() > m {
 		t.Log("WARNING: TestEncodeDecodeBatchJobSnowball Msgsize() is inaccurate")
 	}
 	vn := BatchJobSnowball{}
 	err := msgp.Decode(&buf, &vn)
 	if err != nil {
 		t.Error(err)
 	}
 	buf.Reset()
 	msgp.Encode(&buf, &v)
 	err = msgp.NewReader(&buf).Skip()
 	if err != nil {
 		t.Error(err)
 	}
 }
 func BenchmarkEncodeBatchJobSnowball(b *testing.B) {
 	v := BatchJobSnowball{}
 	var buf bytes.Buffer
 	msgp.Encode(&buf, &v)
 	b.SetBytes(int64(buf.Len()))
 	en := msgp.NewWriter(msgp.Nowhere)
 	b.ReportAllocs()
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		v.EncodeMsg(en)
 	}
 	en.Flush()
 }
 func BenchmarkDecodeBatchJobSnowball(b *testing.B) {
 	v := BatchJobSnowball{}
 	var buf bytes.Buffer
 	msgp.Encode(&buf, &v)
 	b.SetBytes(int64(buf.Len()))
 	rd := msgp.NewEndlessReader(buf.Bytes(), b)
 	dc := msgp.NewReader(rd)
 	b.ReportAllocs()
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		err := v.DecodeMsg(dc)
 		if err != nil {
 			b.Fatal(err)
 		}
 	}
 }
@@ -0,0 +1,148 @@
 // Copyright (c) 2015-2023 MinIO, Inc.
 //
 // This file is part of MinIO Object Storage stack
 //
 // This program is free software: you can redistribute it and/or modify
 // it under the terms of the GNU Affero General Public License as published by
 // the Free Software Foundation, either version 3 of the License, or
 // (at your option) any later version.
 //
 // This program is distributed in the hope that it will be useful
 // but WITHOUT ANY WARRANTY; without even the implied warranty of
 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 // GNU Affero General Public License for more details.
 //
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 package cmd
 import (
 	"fmt"
 	"testing"
 )
 func TestBatchJobSizeInRange(t *testing.T) {
 	tests := []struct {
 		objSize    int64
 		sizeFilter BatchJobSizeFilter
 		want       bool
 	}{
 		{
 			// 1Mib < 2Mib < 10MiB -> in range
 			objSize: 2 << 20,
 			sizeFilter: BatchJobSizeFilter{
 				UpperBound: 10 << 20,
 				LowerBound: 1 << 20,
 			},
 			want: true,
 		},
 		{
 			// 2KiB < 1 MiB -> out of range from left
 			objSize: 2 << 10,
 			sizeFilter: BatchJobSizeFilter{
 				UpperBound: 10 << 20,
 				LowerBound: 1 << 20,
 			},
 			want: false,
 		},
 		{
 			// 11MiB > 10 MiB -> out of range from right
 			objSize: 11 << 20,
 			sizeFilter: BatchJobSizeFilter{
 				UpperBound: 10 << 20,
 				LowerBound: 1 << 20,
 			},
 			want: false,
 		},
 		{
 			//  2MiB < 10MiB -> in range
 			objSize: 2 << 20,
 			sizeFilter: BatchJobSizeFilter{
 				UpperBound: 10 << 20,
 			},
 			want: true,
 		},
 		{
 			//  2MiB > 1MiB -> in range
 			objSize: 2 << 20,
 			sizeFilter: BatchJobSizeFilter{
 				LowerBound: 1 << 20,
 			},
 			want: true,
 		},
 	}
 	for i, test := range tests {
 		t.Run(fmt.Sprintf("test-%d", i+1), func(t *testing.T) {
 			if got := test.sizeFilter.InRange(test.objSize); got != test.want {
 				t.Fatalf("Expected %v but got %v", test.want, got)
 			}
 		})
 	}
 }
 func TestBatchJobSizeValidate(t *testing.T) {
 	errInvalidBatchJobSizeFilter := BatchJobYamlErr{
 		msg: "invalid batch-job size filter",
 	}
 	tests := []struct {
 		sizeFilter BatchJobSizeFilter
 		err        error
 	}{
 		{
 			// Unspecified size filter is a valid filter
 			sizeFilter: BatchJobSizeFilter{
 				UpperBound: 0,
 				LowerBound: 0,
 			},
 			err: nil,
 		},
 		{
 			sizeFilter: BatchJobSizeFilter{
 				UpperBound: 0,
 				LowerBound: 1 << 20,
 			},
 			err: nil,
 		},
 		{
 			sizeFilter: BatchJobSizeFilter{
 				UpperBound: 10 << 20,
 				LowerBound: 0,
 			},
 			err: nil,
 		},
 		{
 			// LowerBound > UpperBound -> empty range
 			sizeFilter: BatchJobSizeFilter{
 				UpperBound: 1 << 20,
 				LowerBound: 10 << 20,
 			},
 			err: errInvalidBatchJobSizeFilter,
 		},
 		{
 			// LowerBound == UpperBound -> empty range
 			sizeFilter: BatchJobSizeFilter{
 				UpperBound: 1 << 20,
 				LowerBound: 1 << 20,
 			},
 			err: errInvalidBatchJobSizeFilter,
 		},
 	}
 	for i, test := range tests {
 		t.Run(fmt.Sprintf("test-%d", i+1), func(t *testing.T) {
 			err := test.sizeFilter.Validate()
 			if err != nil {
 				gotErr := err.(BatchJobYamlErr)
 				testErr := test.err.(BatchJobYamlErr)
 				if gotErr.message() != testErr.message() {
 					t.Fatalf("Expected %v but got %v", test.err, err)
 				}
 			}
 			if err == nil && test.err != nil {
 				t.Fatalf("Expected %v but got nil", test.err)
 			}
 		})
 	}
 }
@@ -0,0 +1,184 @@
 // Copyright (c) 2015-2023 MinIO, Inc.
 //
 // This file is part of MinIO Object Storage stack
 //
 // This program is free software: you can redistribute it and/or modify
 // it under the terms of the GNU Affero General Public License as published by
 // the Free Software Foundation, either version 3 of the License, or
 // (at your option) any later version.
 //
 // This program is distributed in the hope that it will be useful
 // but WITHOUT ANY WARRANTY; without even the implied warranty of
 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 // GNU Affero General Public License for more details.
 //
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 package cmd
 import (
 	"time"
 	miniogo "github.com/minio/minio-go/v7"
 	"github.com/minio/minio/internal/auth"
 )
 //go:generate msgp -file $GOFILE
 // replicate:
 //   # source of the objects to be replicated
 //   source:
 //     type: "minio"
 //     bucket: "testbucket"
 //     prefix: "spark/"
 //
 //   # optional flags based filtering criteria
 //   # for source objects
 //   flags:
 //     filter:
 //       newerThan: "7d"
 //       olderThan: "7d"
 //       createdAfter: "date"
 //       createdBefore: "date"
 //       tags:
 //         - key: "name"
 //           value: "value*"
 //       metadata:
 //         - key: "content-type"
 //           value: "image/*"
 //     notify:
 //       endpoint: "https://splunk-hec.dev.com"
 //       token: "Splunk ..." # e.g. "Bearer token"
 //
 //   # target where the objects must be replicated
 //   target:
 //     type: "minio"
 //     bucket: "testbucket1"
 //     endpoint: "https://play.min.io"
 //     path: "on"
 //     credentials:
 //       accessKey: "minioadmin"
 //       secretKey: "minioadmin"
 //       sessionToken: ""
 // BatchReplicateFilter holds all the filters currently supported for batch replication
 type BatchReplicateFilter struct {
 	NewerThan     time.Duration `yaml:"newerThan,omitempty" json:"newerThan"`
 	OlderThan     time.Duration `yaml:"olderThan,omitempty" json:"olderThan"`
 	CreatedAfter  time.Time     `yaml:"createdAfter,omitempty" json:"createdAfter"`
 	CreatedBefore time.Time     `yaml:"createdBefore,omitempty" json:"createdBefore"`
 	Tags          []BatchJobKV  `yaml:"tags,omitempty" json:"tags"`
 	Metadata      []BatchJobKV  `yaml:"metadata,omitempty" json:"metadata"`
 }
 // BatchJobReplicateFlags various configurations for replication job definition currently includes
 // - filter
 // - notify
 // - retry
 type BatchJobReplicateFlags struct {
 	Filter BatchReplicateFilter `yaml:"filter" json:"filter"`
 	Notify BatchJobNotification `yaml:"notify" json:"notify"`
 	Retry  BatchJobRetry        `yaml:"retry" json:"retry"`
 }
 // BatchJobReplicateResourceType defines the type of batch jobs
 type BatchJobReplicateResourceType string
 // Validate validates if the replicate resource type is recognized and supported
 func (t BatchJobReplicateResourceType) Validate() error {
 	switch t {
 	case BatchJobReplicateResourceMinIO:
 	case BatchJobReplicateResourceS3:
 	default:
 		return errInvalidArgument
 	}
 	return nil
 }
 func (t BatchJobReplicateResourceType) isMinio() bool {
 	return t == BatchJobReplicateResourceMinIO
 }
 // Different types of batch jobs..
 const (
 	BatchJobReplicateResourceMinIO BatchJobReplicateResourceType = "minio"
 	BatchJobReplicateResourceS3    BatchJobReplicateResourceType = "s3"
 	// add future targets
 )
 // BatchJobReplicateCredentials access credentials for batch replication it may
 // be either for target or source.
 type BatchJobReplicateCredentials struct {
 	AccessKey    string `xml:"AccessKeyId" json:"accessKey,omitempty" yaml:"accessKey"`
 	SecretKey    string `xml:"SecretAccessKey" json:"secretKey,omitempty" yaml:"secretKey"`
 	SessionToken string `xml:"SessionToken" json:"sessionToken,omitempty" yaml:"sessionToken"`
 }
 // Empty indicates if credentials are not set
 func (c BatchJobReplicateCredentials) Empty() bool {
 	return c.AccessKey == "" && c.SecretKey == "" && c.SessionToken == ""
 }
 // Validate validates if credentials are valid
 func (c BatchJobReplicateCredentials) Validate() error {
 	if !auth.IsAccessKeyValid(c.AccessKey) || !auth.IsSecretKeyValid(c.SecretKey) {
 		return errInvalidArgument
 	}
 	return nil
 }
 // BatchJobReplicateTarget describes target element of the replication job that receives
 // the filtered data from source
 type BatchJobReplicateTarget struct {
 	Type     BatchJobReplicateResourceType `yaml:"type" json:"type"`
 	Bucket   string                        `yaml:"bucket" json:"bucket"`
 	Prefix   string                        `yaml:"prefix" json:"prefix"`
 	Endpoint string                        `yaml:"endpoint" json:"endpoint"`
 	Path     string                        `yaml:"path" json:"path"`
 	Creds    BatchJobReplicateCredentials  `yaml:"credentials" json:"credentials"`
 }
 // ValidPath returns true if path is valid
 func (t BatchJobReplicateTarget) ValidPath() bool {
 	return t.Path == "on" || t.Path == "off" || t.Path == "auto" || t.Path == ""
 }
 // BatchJobReplicateSource describes source element of the replication job that is
 // the source of the data for the target
 type BatchJobReplicateSource struct {
 	Type     BatchJobReplicateResourceType `yaml:"type" json:"type"`
 	Bucket   string                        `yaml:"bucket" json:"bucket"`
 	Prefix   string                        `yaml:"prefix" json:"prefix"`
 	Endpoint string                        `yaml:"endpoint" json:"endpoint"`
 	Path     string                        `yaml:"path" json:"path"`
 	Creds    BatchJobReplicateCredentials  `yaml:"credentials" json:"credentials"`
 	Snowball BatchJobSnowball              `yaml:"snowball" json:"snowball"`
 }
 // ValidPath returns true if path is valid
 func (s BatchJobReplicateSource) ValidPath() bool {
 	switch s.Path {
 	case "on", "off", "auto", "":
 		return true
 	default:
 		return false
 	}
 }
 // BatchJobReplicateV1 v1 of batch job replication
 type BatchJobReplicateV1 struct {
 	APIVersion string                  `yaml:"apiVersion" json:"apiVersion"`
 	Flags      BatchJobReplicateFlags  `yaml:"flags" json:"flags"`
 	Target     BatchJobReplicateTarget `yaml:"target" json:"target"`
 	Source     BatchJobReplicateSource `yaml:"source" json:"source"`
 	clnt *miniogo.Core `msg:"-"`
 }
 // RemoteToLocal returns true if source is remote and target is local
 func (r BatchJobReplicateV1) RemoteToLocal() bool {
 	return !r.Source.Creds.Empty()
 }
--- a/Show More
+++ b/Show More