mirror of
https://github.com/pgsty/minio.git
synced 2026-07-31 15:55:18 +03:00
Compare commits
2 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Feng Ruohang
|
5c6e30d4f1 | ||
|
Wesley Schwengle
|
0ce4b0f14b |
+1
-6
@@ -1,6 +1 @@
|
||||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="255 293 539 140" fill="none">
|
||||
<path d="M255.222 385.861 304.199 383.375c1.061 6.446 3.22 11.358 6.478 14.734 5.303 5.465 12.879 8.197 22.728 8.197 7.348 0 13.011-1.397 16.988-4.19 3.977-2.794 5.966-6.032 5.966-9.716 0-3.5-1.894-6.631-5.682-9.394-3.788-2.763-12.576-5.372-26.364-7.828-22.576-4.113-38.674-9.577-48.295-16.392-9.697-6.815-14.546-15.502-14.546-26.062 0-6.938 2.481-13.491 7.443-19.662 4.962-6.17 12.424-11.02 22.386-14.55 9.962-3.53 23.617-5.295 40.966-5.295 21.288 0 37.519 3.208 48.693 9.624 11.174 6.416 17.822 16.622 19.943 30.621l-48.523 2.302c-1.288-6.078-3.996-10.498-8.125-13.261-4.129-2.763-9.83-4.144-17.103-4.144-5.984 0-10.492 1.028-13.522 3.085-3.03 2.056-4.545 4.558-4.545 7.505 0 2.149 1.25 4.083 3.75 5.802 2.424 1.78 8.182 3.438 17.273 4.973 22.5 3.93 38.617 7.905 48.352 11.926 9.735 4.022 16.818 9.01 21.25 14.965 4.432 5.956 6.648 12.617 6.648 19.984 0 8.657-2.954 16.638-8.863 23.944-5.909 7.306-14.167 12.847-24.773 16.623-10.606 3.776-23.977 5.664-40.113 5.664-28.333 0-47.954-4.42-58.863-13.261-10.909-8.841-17.083-20.076-18.522-33.706Z" fill="#287CAB"/>
|
||||
<path d="M434.578 295.519h43.304v135.007h-43.304z" fill="#287CAB"/>
|
||||
<path d="M517.881 295.519h43.209v101.762h67.436v33.245H517.881Z" fill="#287CAB"/>
|
||||
<path d="M639.4 363.115c0-22.041 6.359-39.201 19.077-51.48 12.718-12.28 30.427-18.419 53.129-18.419 23.274 0 41.206 6.032 53.796 18.096 12.591 12.064 18.886 28.963 18.886 50.697 0 15.778-2.75 28.717-8.251 38.817-5.5 10.099-13.449 17.958-23.846 23.575-10.397 5.618-23.353 8.427-38.869 8.427-15.77 0-28.822-2.425-39.155-7.275-10.333-4.85-18.711-12.525-25.133-23.023-6.423-10.499-9.634-23.637-9.634-39.416Zm43.209.184c0 13.63 2.623 23.422 7.869 29.377 5.246 5.956 12.384 8.934 21.413 8.934 9.284 0 16.47-2.916 21.557-8.749 5.087-5.833 7.631-16.301 7.631-31.403 0-12.709-2.655-21.995-7.965-27.858-5.31-5.863-12.511-8.795-21.604-8.795-8.712 0-15.707 2.978-20.985 8.933-5.278 5.956-7.916 15.81-7.916 29.561Z" fill="#287CAB"/>
|
||||
</svg>
|
||||
<svg data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 162.612 24.465"><path d="M52.751.414h9.108v23.63h-9.108zM41.711.74l-18.488 9.92a.919.919 0 0 1-.856 0L3.879.74A2.808 2.808 0 0 0 2.558.414h-.023A2.4 2.4 0 0 0 0 2.641v21.376h9.1V13.842a.918.918 0 0 1 1.385-.682l10.361 5.568a3.634 3.634 0 0 0 3.336.028l10.933-5.634a.917.917 0 0 1 1.371.69v10.205h9.1V2.641A2.4 2.4 0 0 0 43.055.414h-.023a2.808 2.808 0 0 0-1.321.326zm65.564-.326h-9.237v10.755a.913.913 0 0 1-1.338.706L72.762.675a2.824 2.824 0 0 0-1.191-.261h-.016a2.4 2.4 0 0 0-2.535 2.227v21.377h9.163V13.275a.914.914 0 0 1 1.337-.707l24.032 11.2a2.813 2.813 0 0 0 1.188.26 2.4 2.4 0 0 0 2.535-2.227zm7.161 23.63V.414h4.191v23.63zm28.856.421c-11.274 0-19.272-4.7-19.272-12.232C124.02 4.741 132.066 0 143.292 0s19.32 4.7 19.32 12.233-7.902 12.232-19.32 12.232zm0-21.333c-8.383 0-14.84 3.217-14.84 9.1 0 5.926 6.457 9.1 14.84 9.1s14.887-3.174 14.887-9.1c0-5.883-6.504-9.1-14.887-9.1z" fill="#c72c48"/></svg>
|
||||
|
Before Width: | Height: | Size: 2.0 KiB After Width: | Height: | Size: 978 B |
@@ -0,0 +1,110 @@
|
||||
name: Helm Chart
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
pull_request:
|
||||
paths:
|
||||
- ".github/workflows/helm.yml"
|
||||
- "helm/**"
|
||||
- "helm-releases/minio-*.tgz"
|
||||
- "helm-reindex.sh"
|
||||
- "index.yaml"
|
||||
push:
|
||||
branches:
|
||||
- master
|
||||
paths:
|
||||
- ".github/workflows/helm.yml"
|
||||
- "helm/**"
|
||||
- "helm-releases/minio-*.tgz"
|
||||
- "helm-reindex.sh"
|
||||
- "index.yaml"
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
install-smoke:
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 20
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Set up Helm
|
||||
uses: azure/setup-helm@v4
|
||||
with:
|
||||
version: v3.19.0
|
||||
|
||||
- name: Verify packaged chart
|
||||
run: |
|
||||
set -euo pipefail
|
||||
chart_version="$(awk '$1 == "version:" { print $2; exit }' helm/minio/Chart.yaml)"
|
||||
chart_package="helm-releases/minio-${chart_version}.tgz"
|
||||
test -f "${chart_package}"
|
||||
echo "CHART_PACKAGE=${chart_package}" >> "${GITHUB_ENV}"
|
||||
helm lint --strict "${chart_package}"
|
||||
|
||||
unpacked="$(mktemp -d)"
|
||||
tar -xzf "${chart_package}" -C "${unpacked}"
|
||||
diff -ru --exclude Chart.yaml helm/minio "${unpacked}/minio"
|
||||
|
||||
package_digest="$(sha256sum "${chart_package}" | awk '{ print $1 }')"
|
||||
grep -F "digest: ${package_digest}" index.yaml
|
||||
grep -F "https://raw.githubusercontent.com/pgsty/minio/master/${chart_package}" index.yaml
|
||||
|
||||
- name: Render and verify immutable images
|
||||
run: |
|
||||
set -euo pipefail
|
||||
expected_image='pgsty/minio@sha256:dacff8306a6e0a734518533992dbdcca26bc1ca47f77cf47cb9945725f92b29b'
|
||||
rendered="$(mktemp)"
|
||||
helm template silo "${CHART_PACKAGE}" \
|
||||
--namespace silo \
|
||||
--set mode=standalone \
|
||||
--set persistence.enabled=false > "${rendered}"
|
||||
grep -F "image: \"${expected_image}\"" "${rendered}"
|
||||
if grep -Eq 'image:.*(quay\.io/minio|minio/minio|minio/mc)' "${rendered}"; then
|
||||
echo "Rendered chart still references an upstream MinIO image."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Create Kind cluster
|
||||
uses: helm/kind-action@v1
|
||||
with:
|
||||
version: v0.31.0
|
||||
kubectl_version: v1.35.0
|
||||
node_image: kindest/node:v1.35.0@sha256:452d707d4862f52530247495d180205e029056831160e22870e37e3f6c1ac31f
|
||||
cluster_name: silo-chart
|
||||
wait: 120s
|
||||
|
||||
- name: Install chart
|
||||
run: |
|
||||
set -euo pipefail
|
||||
helm install silo "${CHART_PACKAGE}" \
|
||||
--namespace silo \
|
||||
--create-namespace \
|
||||
--wait \
|
||||
--wait-for-jobs \
|
||||
--timeout 10m \
|
||||
--set mode=standalone \
|
||||
--set replicas=1 \
|
||||
--set persistence.enabled=false \
|
||||
--set resources.requests.memory=512Mi \
|
||||
--set rootUser=siloadmin \
|
||||
--set rootPassword=silo-smoke-password \
|
||||
--set 'buckets[0].name=bootstrap' \
|
||||
--set 'buckets[0].policy=none' \
|
||||
--set 'buckets[0].purge=false'
|
||||
kubectl rollout status deployment/silo-minio --namespace silo --timeout=2m
|
||||
|
||||
- name: Run S3 smoke test
|
||||
run: |
|
||||
set -euo pipefail
|
||||
helm test silo --namespace silo --logs --timeout 5m
|
||||
|
||||
- name: Diagnostics
|
||||
if: failure()
|
||||
run: |
|
||||
helm status silo --namespace silo || true
|
||||
kubectl get all --namespace silo -o wide || true
|
||||
kubectl describe pods --namespace silo || true
|
||||
kubectl logs --namespace silo --all-containers=true --prefix=true --selector release=silo || true
|
||||
@@ -1,36 +0,0 @@
|
||||
name: VulnCheck
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
branches:
|
||||
- master
|
||||
push:
|
||||
branches:
|
||||
- master
|
||||
workflow_dispatch:
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
vulncheck:
|
||||
name: Analysis
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 20
|
||||
steps:
|
||||
- name: Check out code
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Set up Go
|
||||
uses: actions/setup-go@v5
|
||||
with:
|
||||
go-version-file: go.mod
|
||||
cache: true
|
||||
|
||||
- name: Install govulncheck
|
||||
run: |
|
||||
go install golang.org/x/vuln/cmd/govulncheck@v1.6.0
|
||||
echo "$(go env GOPATH)/bin" >> "${GITHUB_PATH}"
|
||||
|
||||
- name: Run govulncheck
|
||||
run: govulncheck -show verbose ./...
|
||||
@@ -1,4 +1,4 @@
|
||||
FROM golang:1.26.5-alpine AS build
|
||||
FROM golang:1.26.4-alpine AS build
|
||||
|
||||
ARG TARGETARCH
|
||||
|
||||
|
||||
+1
-1
@@ -1,4 +1,4 @@
|
||||
FROM golang:1.26.5-alpine as build
|
||||
FROM golang:1.26.4-alpine as build
|
||||
|
||||
ARG TARGETARCH
|
||||
ARG RELEASE
|
||||
|
||||
+1
-1
@@ -1,4 +1,4 @@
|
||||
FROM golang:1.26.5-alpine AS build
|
||||
FROM golang:1.26.4-alpine AS build
|
||||
|
||||
ARG TARGETARCH
|
||||
ARG RELEASE
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
FROM golang:1.26.5-alpine AS build
|
||||
FROM golang:1.26.4-alpine AS build
|
||||
|
||||
ARG TARGETARCH
|
||||
ARG RELEASE
|
||||
|
||||
@@ -1,140 +1,43 @@
|
||||
# Silo (Community maintained fork of MinIO)
|
||||
|
||||
<h1 align="center">Silo</h1>
|
||||
|
||||
<p align="center">
|
||||
<strong>A conservatively maintained MinIO fork</strong><br>
|
||||
Security maintenance, versioned release artifacts, and operational continuity for existing deployments.
|
||||
</p>
|
||||
|
||||
<p align="center">
|
||||
<a href="README_ZH.md">中文</a> ·
|
||||
<a href="https://silo.pigsty.io">Documentation</a> ·
|
||||
<a href="https://github.com/pgsty/minio/releases">Releases</a> ·
|
||||
<a href="https://hub.docker.com/r/pgsty/minio">Container Images</a> ·
|
||||
<a href="SECURITY.md">Security</a>
|
||||
</p>
|
||||
|
||||
<p align="center">
|
||||
<a href="https://github.com/pgsty/minio/releases"><img alt="GitHub Release" src="https://img.shields.io/github/v/release/pgsty/minio?include_prereleases&label=release&logo=github"></a>
|
||||
<a href="https://hub.docker.com/r/pgsty/minio"><img alt="Docker Pulls" src="https://img.shields.io/docker/pulls/pgsty/minio?logo=docker"></a>
|
||||
<a href="go.mod"><img alt="Go Version" src="https://img.shields.io/github/go-mod/go-version/pgsty/minio?logo=go"></a>
|
||||
<a href="LICENSE"><img alt="License" src="https://img.shields.io/badge/license-AGPLv3-blue"></a>
|
||||
</p>
|
||||
[](https://silo.pigsty.io)
|
||||
[](https://silo.pigsty.cc)
|
||||
[](https://github.com/pgsty/minio)
|
||||
[](https://github.com/pgsty/mc)
|
||||
[](https://github.com/pgsty/minio-docs)
|
||||
[](https://hub.docker.com/r/pgsty/minio)
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Silo is an independent, community-maintained fork of the open-source MinIO server, published by [Pigsty](https://pigsty.io) from [`pgsty/minio`](https://github.com/pgsty/minio). It is not affiliated with, endorsed by, or sponsored by MinIO, Inc. “MinIO” is used only to identify the upstream project and compatibility lineage.
|
||||
> **This is a community-maintained fork of the upstream MinIO project, maintained by [Pigsty](https://pigsty.io).**
|
||||
> This project is **NOT** affiliated with, endorsed by, or sponsored by MinIO, Inc.
|
||||
> "MinIO" is a trademark of MinIO, Inc., used here solely to identify the upstream project.
|
||||
>
|
||||
> Changes from upstream are minimal:
|
||||
> - Restored the embedded management console version reference
|
||||
> - Updated documentation links and Go module paths to point to this repository
|
||||
>
|
||||
> Distributed under the original [GNU AGPLv3](LICENSE) license.
|
||||
|
||||
## Overview
|
||||
Documentation: [English](https://silo.pigsty.io) | [简体中文](https://silo.pigsty.cc)
|
||||
|
||||
Silo maintains one downstream release line based on MinIO [`RELEASE.2025-12-03T12-00-00Z`](https://github.com/minio/minio/releases/tag/RELEASE.2025-12-03T12-00-00Z). It provides maintained builds and release artifacts for existing MinIO-compatible deployments after upstream community distribution ended.
|
||||
Docker Hub: [https://hub.docker.com/r/pgsty/minio](https://hub.docker.com/r/pgsty/minio) / [https://hub.docker.com/r/pgsty/mc](https://hub.docker.com/r/pgsty/mc)
|
||||
|
||||
Pigsty uses this fork for object storage, including PostgreSQL backups.
|
||||
Client Repo: [`pgsty/mc`](https://github.com/pgsty/mc) CLI.
|
||||
|
||||
## Maintenance Policy
|
||||
Console: [`georgmangold/console`](https://github.com/georgmangold/console/), a community-maintained fork of restored console.
|
||||
|
||||
The active release line covers:
|
||||
Ansible Deployment: [https://pigsty.io/docs/minio](https://pigsty.io/docs/minio)
|
||||
|
||||
- build and dependency maintenance;
|
||||
- applicable security fixes and advisories;
|
||||
- focused fixes for reproducible defects;
|
||||
- versioned binaries, packages, checksums, and multi-architecture images;
|
||||
- the web console, client, documentation, and Pigsty integration.
|
||||
APT/YUM repo for `minio` and `mcli` binary: [https://pigsty.io/docs/infra](https://pigsty.io/docs/repo/infra/list/#object-storage)
|
||||
|
||||
Changes are kept narrow and tested where practical. Maintenance is best effort; no response, remediation, or release schedule is guaranteed.
|
||||
## Kubernetes delivery and scope
|
||||
|
||||
### Out of scope
|
||||
|
||||
- a separate product roadmap, new storage engine, or speculative S3 features;
|
||||
- broad rewrites or changes that materially expand the downstream delta;
|
||||
- historical releases or multiple support branches;
|
||||
- commercial support, SLAs, 24×7 coverage, or SUBNET access;
|
||||
- deployment design, access control, monitoring, backup, or recovery.
|
||||
|
||||
## Compatibility
|
||||
|
||||
Silo aims to preserve:
|
||||
|
||||
- the `minio` executable and `github.com/minio/minio` module path;
|
||||
- MinIO-compatible S3 APIs, configuration, environment variables, and CLI conventions;
|
||||
- `RELEASE.YYYY-MM-DDTHH-MM-SSZ` tags, container entrypoints, and common deployment workflows.
|
||||
|
||||
Compatibility is a goal, not a guarantee. Security fixes may change behavior. Treat each release as a downstream upgrade: pin versions, review [release notes](https://github.com/pgsty/minio/releases) and [security advisories](docs/security/advisories.md), keep a rollback path, and test before production use.
|
||||
|
||||
## Release Artifacts
|
||||
|
||||
| Artifact | Location |
|
||||
| :-- | :-- |
|
||||
| Source | [`github.com/pgsty/minio`](https://github.com/pgsty/minio) |
|
||||
| Container image | [`pgsty/minio`](https://hub.docker.com/r/pgsty/minio), multi-arch for `linux/amd64` and `linux/arm64` |
|
||||
| Server binaries | [GitHub Releases](https://github.com/pgsty/minio/releases) for Linux, macOS, and Windows on `amd64` and `arm64` |
|
||||
| Linux packages | RPM, DEB, and APK artifacts, also distributed through the [Pigsty repository](https://pigsty.io/docs/repo/) |
|
||||
| Client | [`pgsty/mc`](https://github.com/pgsty/mc), bundled in the container as `mcli` with an `mc` compatibility alias |
|
||||
| Console | Maintained [`georgmangold/console`](https://github.com/georgmangold/console) fork, embedded in the server build |
|
||||
| Documentation | [English](https://silo.pigsty.io), [Chinese](https://silo.pigsty.cc), and [`pgsty/minio-docs`](https://github.com/pgsty/minio-docs) |
|
||||
| Security record | [`SECURITY.md`](SECURITY.md), [`VULNERABILITY_REPORT.md`](VULNERABILITY_REPORT.md), and [fork advisories](docs/security/advisories.md) |
|
||||
|
||||
## Quick Start
|
||||
|
||||
For local evaluation:
|
||||
This repository maintains the direct-deployment Helm chart in [`helm/minio`](helm/minio/README.md) for standalone and distributed Silo server deployments. Chart defaults use the version- and digest-pinned multi-architecture [`pgsty/minio`](https://hub.docker.com/r/pgsty/minio) image, and every chart change is checked by a real Kind install plus an S3 write/read/delete smoke test.
|
||||
|
||||
```bash
|
||||
mkdir -p data
|
||||
|
||||
export MINIO_ROOT_USER=minioadmin
|
||||
export MINIO_ROOT_PASSWORD=change-me-long-password
|
||||
|
||||
docker run -d --name silo \
|
||||
-p 9000:9000 \
|
||||
-p 9001:9001 \
|
||||
-e MINIO_ROOT_USER \
|
||||
-e MINIO_ROOT_PASSWORD \
|
||||
-v "$PWD/data:/data" \
|
||||
pgsty/minio:latest server /data --console-address ":9001"
|
||||
helm repo add silo https://raw.githubusercontent.com/pgsty/minio/master
|
||||
helm repo update silo
|
||||
helm install my-release silo/minio --namespace minio --create-namespace
|
||||
```
|
||||
|
||||
Open the console at <http://localhost:9001>; the S3 API listens on <http://localhost:9000>.
|
||||
|
||||
The image includes the compatible client as `mcli`:
|
||||
|
||||
```bash
|
||||
docker exec silo mcli alias set local http://127.0.0.1:9000 \
|
||||
"$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD"
|
||||
docker exec silo mcli mb local/demo
|
||||
docker exec silo mcli ls local
|
||||
```
|
||||
|
||||
> [!WARNING]
|
||||
> For production, pin a release, use unique credentials and TLS, monitor the service, keep independent backups, and test recovery.
|
||||
|
||||
Build the server from source:
|
||||
|
||||
```bash
|
||||
go build -o minio .
|
||||
./minio --version
|
||||
```
|
||||
|
||||
Deployment: [Silo documentation](https://silo.pigsty.io) · [Pigsty MinIO module](https://pigsty.io/docs/minio/)
|
||||
|
||||
## Security
|
||||
|
||||
Security fixes target the active `master` branch and are recorded in the [advisory log](docs/security/advisories.md). Report vulnerabilities privately as described in [`SECURITY.md`](SECURITY.md) and [`VULNERABILITY_REPORT.md`](VULNERABILITY_REPORT.md). Report issues that also affect upstream MinIO there as well.
|
||||
|
||||
## Contributing
|
||||
|
||||
Useful contributions include security and dependency updates, reproducible bug fixes, tests, release automation, packaging, and documentation.
|
||||
|
||||
Issues and pull requests should include the affected version, reproduction steps, impact, expected behavior, tests, and compatibility notes. Discuss large changes in an issue first.
|
||||
|
||||
## Background
|
||||
|
||||
This project was created in response to changes in the upstream community distribution and maintenance model. The maintainer’s analysis, alternatives considered, and early maintenance record are documented below:
|
||||
|
||||
| Essay | Subject |
|
||||
| :-- | :-- |
|
||||
| [MinIO Is Dead](https://blog.vonng.com/en/db/minio-is-dead/) | Changes to the upstream project and distribution model |
|
||||
| [MinIO Is Dead, Long Live MinIO](https://blog.vonng.com/en/db/minio-resurrect/) | Establishing the fork and its release pipeline |
|
||||
| [Two months into maintaining a MinIO fork](https://blog.vonng.com/en/db/minio-promise-kept/) | Initial security and maintenance work |
|
||||
|
||||
## License and Trademark
|
||||
|
||||
The server remains licensed under the [GNU Affero General Public License v3.0](LICENSE). See [`CREDITS`](CREDITS) for upstream authorship and attribution. MinIO is a trademark of MinIO, Inc. Silo and `pgsty/minio` are independent community efforts and are not affiliated with or endorsed by MinIO, Inc.
|
||||
The MinIO Operator, Tenant CRDs, and operator lifecycle are **not maintained by this repository**. There is no Pigsty/Silo operator fork here. Users who require an operator must select and validate a separate operator implementation; issues and pull requests for operator code should be filed with that implementation.
|
||||
|
||||
-146
@@ -1,146 +0,0 @@
|
||||
<p align="center">
|
||||
<img src=".github/logo.svg" alt="Silo" width="260">
|
||||
</p>
|
||||
|
||||
<h1 align="center">Silo</h1>
|
||||
|
||||
<p align="center">
|
||||
<strong>审慎维护的 MinIO 社区分支</strong><br>
|
||||
为现有部署提供安全维护、带版本的发行产物与持续运维支持。
|
||||
</p>
|
||||
|
||||
<p align="center">
|
||||
<a href="README.md">English</a> ·
|
||||
<a href="https://silo.pigsty.cc">文档</a> ·
|
||||
<a href="https://github.com/pgsty/minio/releases">版本发布</a> ·
|
||||
<a href="https://hub.docker.com/r/pgsty/minio">容器镜像</a> ·
|
||||
<a href="SECURITY.md">安全策略</a>
|
||||
</p>
|
||||
|
||||
<p align="center">
|
||||
<a href="https://github.com/pgsty/minio/releases"><img alt="GitHub Release" src="https://img.shields.io/github/v/release/pgsty/minio?include_prereleases&label=release&logo=github"></a>
|
||||
<a href="https://hub.docker.com/r/pgsty/minio"><img alt="Docker Pulls" src="https://img.shields.io/docker/pulls/pgsty/minio?logo=docker"></a>
|
||||
<a href="go.mod"><img alt="Go Version" src="https://img.shields.io/github/go-mod/go-version/pgsty/minio?logo=go"></a>
|
||||
<a href="LICENSE"><img alt="License" src="https://img.shields.io/badge/license-AGPLv3-blue"></a>
|
||||
</p>
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Silo 是由 [Pigsty](https://pigsty.cc) 独立维护、从 [`pgsty/minio`](https://github.com/pgsty/minio) 发布的开源 MinIO 社区分支。本项目与 MinIO, Inc. 不存在隶属、背书或赞助关系；文中使用 “MinIO” 仅用于说明上游项目及兼容谱系。
|
||||
|
||||
## 概述
|
||||
|
||||
Silo 维护一条基于 MinIO [`RELEASE.2025-12-03T12-00-00Z`](https://github.com/minio/minio/releases/tag/RELEASE.2025-12-03T12-00-00Z) 的下游版本线，为上游停止社区发行后仍在运行 MinIO 兼容部署的用户提供持续构建与发行产物。
|
||||
|
||||
Pigsty 使用本分支提供对象存储，包括 PostgreSQL 备份存储。
|
||||
|
||||
## 维护政策
|
||||
|
||||
活跃版本线的维护范围包括：
|
||||
|
||||
- 构建与依赖项维护；
|
||||
- 适用的安全修复与公告；
|
||||
- 针对可复现缺陷的范围明确的修复；
|
||||
- 带版本的二进制、软件包、校验和与多架构镜像；
|
||||
- Web Console、客户端、文档与 Pigsty 集成。
|
||||
|
||||
改动保持克制，并在可行时提供测试。所有维护均为尽力而为，不承诺固定的响应、修复或发布时间。
|
||||
|
||||
### 范围之外
|
||||
|
||||
- 独立产品路线图、新存储引擎或假设性的 S3 新特性；
|
||||
- 大规模重写或显著扩大下游差异的改动；
|
||||
- 历史版本或多条支持分支；
|
||||
- 商业支持、SLA、7×24 服务或 SUBNET 服务；
|
||||
- 部署设计、访问控制、监控、备份与恢复。
|
||||
|
||||
## 兼容策略
|
||||
|
||||
Silo 尽量保留：
|
||||
|
||||
- `minio` 可执行文件与 `github.com/minio/minio` module path；
|
||||
- MinIO 兼容的 S3 API、配置、环境变量与命令行约定；
|
||||
- `RELEASE.YYYY-MM-DDTHH-MM-SSZ` 标签、容器入口与常见部署方式。
|
||||
|
||||
兼容是目标，而非保证。安全修复可能改变行为。每个版本都应视为下游升级：锁定版本，阅读[版本说明](https://github.com/pgsty/minio/releases)与[安全公告](docs/security/advisories.md)，保留回滚路径，并在生产使用前完成测试。
|
||||
|
||||
## 发行产物
|
||||
|
||||
| 产物 | 位置 |
|
||||
| :-- | :-- |
|
||||
| 源码 | [`github.com/pgsty/minio`](https://github.com/pgsty/minio) |
|
||||
| 容器镜像 | [`pgsty/minio`](https://hub.docker.com/r/pgsty/minio)，支持 `linux/amd64` 与 `linux/arm64` 多架构清单 |
|
||||
| 服务端二进制 | [GitHub Releases](https://github.com/pgsty/minio/releases)，覆盖 Linux、macOS、Windows 的 `amd64` 与 `arm64` |
|
||||
| Linux 软件包 | RPM、DEB、APK，并通过 [Pigsty 软件仓库](https://pigsty.cc/docs/repo/) 分发 |
|
||||
| 客户端 | [`pgsty/mc`](https://github.com/pgsty/mc)，容器内以 `mcli` 提供，并保留 `mc` 兼容别名 |
|
||||
| 管理控制台 | 社区维护的 [`georgmangold/console`](https://github.com/georgmangold/console)，嵌入服务端构建 |
|
||||
| 文档 | [中文](https://silo.pigsty.cc)、[英文](https://silo.pigsty.io)与 [`pgsty/minio-docs`](https://github.com/pgsty/minio-docs) |
|
||||
| 安全记录 | [`SECURITY.md`](SECURITY.md)、[`VULNERABILITY_REPORT.md`](VULNERABILITY_REPORT.md) 与[本分支安全公告](docs/security/advisories.md) |
|
||||
|
||||
## 快速开始
|
||||
|
||||
本地体验：
|
||||
|
||||
```bash
|
||||
mkdir -p data
|
||||
|
||||
export MINIO_ROOT_USER=minioadmin
|
||||
export MINIO_ROOT_PASSWORD=change-me-long-password
|
||||
|
||||
docker run -d --name silo \
|
||||
-p 9000:9000 \
|
||||
-p 9001:9001 \
|
||||
-e MINIO_ROOT_USER \
|
||||
-e MINIO_ROOT_PASSWORD \
|
||||
-v "$PWD/data:/data" \
|
||||
pgsty/minio:latest server /data --console-address ":9001"
|
||||
```
|
||||
|
||||
管理控制台位于 <http://localhost:9001>，S3 API 位于 <http://localhost:9000>。
|
||||
|
||||
镜像内置兼容客户端 `mcli`：
|
||||
|
||||
```bash
|
||||
docker exec silo mcli alias set local http://127.0.0.1:9000 \
|
||||
"$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD"
|
||||
docker exec silo mcli mb local/demo
|
||||
docker exec silo mcli ls local
|
||||
```
|
||||
|
||||
> [!WARNING]
|
||||
> 生产环境应锁定版本，使用独立凭据与 TLS，配置监控，保留独立备份，并验证恢复流程。
|
||||
|
||||
从源码构建服务端：
|
||||
|
||||
```bash
|
||||
go build -o minio .
|
||||
./minio --version
|
||||
```
|
||||
|
||||
部署：[Silo 中文文档](https://silo.pigsty.cc) · [Pigsty MinIO 模块](https://pigsty.cc/docs/minio/)
|
||||
|
||||
## 安全
|
||||
|
||||
安全修复面向活跃的 `master` 分支，并记录在[安全公告](docs/security/advisories.md)中。请按照 [`SECURITY.md`](SECURITY.md) 与 [`VULNERABILITY_REPORT.md`](VULNERABILITY_REPORT.md) 私密报告漏洞；同时影响上游 MinIO 的问题也应向上游报告。
|
||||
|
||||
## 参与贡献
|
||||
|
||||
欢迎安全与依赖项更新、可复现缺陷修复、测试、发布自动化、打包与文档改进。
|
||||
|
||||
Issue 与 Pull Request 应说明受影响版本、复现步骤、影响、预期行为、测试与兼容性说明。大型改动请先提交 Issue 讨论。
|
||||
|
||||
## 背景
|
||||
|
||||
本项目源于上游社区发行与维护模式的变化。维护者对相关变化的分析、替代方案评估与早期维护记录见以下文章：
|
||||
|
||||
| 文章 | 主题 |
|
||||
| :-- | :-- |
|
||||
| [MinIO已死](https://vonng.com/db/minio-is-dead/) | 上游项目与发行模式的变化 |
|
||||
| [MinIO已死，谁能接盘？](https://vonng.com/db/minio-alternative/) | 可选替代方案评估 |
|
||||
| [MinIO 已死，MinIO 复生](https://vonng.com/db/minio-resurrect/) | 建立分支及其发行流水线 |
|
||||
| [续命 MinIO：承诺兑现](https://vonng.com/db/minio-promise-kept/) | 初期安全与维护工作 |
|
||||
|
||||
## 许可证与商标
|
||||
|
||||
服务端继续采用 [GNU Affero General Public License v3.0](LICENSE) 发布。上游作者与署名信息见 [`CREDITS`](CREDITS)。
|
||||
|
||||
MinIO 是 MinIO, Inc. 的商标。Silo、Pigsty 与 `pgsty/minio` 均为独立社区项目，与 MinIO, Inc. 不存在隶属或背书关系。
|
||||
@@ -1060,12 +1060,6 @@ func (w *trackingResponseWriter) Write(b []byte) (int, error) {
|
||||
return w.ResponseWriter.Write(b)
|
||||
}
|
||||
|
||||
func (w *trackingResponseWriter) Flush() {
|
||||
if f, ok := w.ResponseWriter.(http.Flusher); ok {
|
||||
f.Flush()
|
||||
}
|
||||
}
|
||||
|
||||
func (w *trackingResponseWriter) Unwrap() http.ResponseWriter {
|
||||
return w.ResponseWriter
|
||||
}
|
||||
|
||||
@@ -24,7 +24,6 @@ import (
|
||||
"testing"
|
||||
|
||||
"github.com/klauspost/compress/gzhttp"
|
||||
xhttp "github.com/minio/minio/internal/http"
|
||||
)
|
||||
|
||||
// Tests object location.
|
||||
@@ -160,29 +159,6 @@ func TestTrackingResponseWriter(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
func TestTrackingResponseWriterFlush(t *testing.T) {
|
||||
rw := httptest.NewRecorder()
|
||||
trw := &trackingResponseWriter{ResponseWriter: rw}
|
||||
|
||||
trw.Flush()
|
||||
if trw.headerWritten {
|
||||
t.Fatal("Flush() should not set headerWritten")
|
||||
}
|
||||
|
||||
// Simulate the ListenNotificationHandler flow: WriteHeader, Write, Flush
|
||||
trw.WriteHeader(http.StatusOK)
|
||||
_, err := trw.Write([]byte("event data"))
|
||||
if err != nil {
|
||||
t.Fatalf("Write failed: %v", err)
|
||||
}
|
||||
|
||||
xhttp.Flush(trw)
|
||||
|
||||
if !rw.Flushed {
|
||||
t.Fatalf("xhttp.Flush should have flushed the underlying ResponseRecorder via trackingResponseWriter.Flush()")
|
||||
}
|
||||
}
|
||||
|
||||
func TestHeadersAlreadyWritten(t *testing.T) {
|
||||
rw := httptest.NewRecorder()
|
||||
trw := &trackingResponseWriter{ResponseWriter: rw}
|
||||
|
||||
@@ -10,9 +10,8 @@ This document summarizes fork-specific security fixes and closely related upgrad
|
||||
| `CVE-2026-33419` | `3b950f8fa` | LDAP STS authentication | Yes | Prevents username enumeration by unifying unknown-user and bad-password responses and adds in-memory login throttling | Unknown users and invalid passwords now both return `400 InvalidParameterValue`. Rate limiting is per-node, in-memory, and not currently configurable. Follow-up hardening landed in `18b712d49`, `9e10f6d9a`, and `f44110890`. |
|
||||
| `CVE-2026-34204` | `56fa63bfd` | Replication metadata handling | Yes | Blocks untrusted `X-Minio-Replication-*` headers from being smuggled into internal replication metadata and leaving objects unreadable | Upgrade any server that accepts untrusted `PutObject` or `CopyObject` requests, which in practice means almost any production server that accepts writes. |
|
||||
| `CVE-2026-39414` | `3252d5b7f` | S3 Select oversized record handling | Yes | Rejects oversized CSV records and non-`simdjson` line-delimited JSON records with `OverMaxRecordSize` instead of buffering them unchecked | Split oversized JSON lines client-side if you rely on `simdjson` input paths until the fast path gains the same pre-check. |
|
||||
| [CVE-2026-41145](https://github.com/advisories/GHSA-hv4r-mvr4-25vw) | `f444b6f37` | Unsigned-trailer PUT and multipart upload authentication | Yes | Closes the query-string authentication bypass in unsigned-trailer streaming requests | Upgrade if clients can reach object write endpoints using the `STREAMING-UNSIGNED-PAYLOAD-TRAILER` content-sha256 mode together with query-string SigV4 credentials. |
|
||||
| [CVE-2026-40344](https://github.com/advisories/GHSA-9c4q-hq6p-c237) | `efb6e5b00` | Snowball auto-extract authentication | Yes | Verifies request authentication before tar extraction in Snowball unsigned-trailer flows | Upgrade if you use `PutObjectExtract` or Snowball uploads. |
|
||||
| [CVE-2026-42600](https://github.com/advisories/GHSA-xh8f-g2qw-gcm7) | `73ac52472` | Internode `ReadMultiple` storage-REST endpoint | Yes (cluster-root JWT required) | Removes the unused endpoint that allowed path traversal outside configured drive roots | Upgrade distributed-erasure deployments. Single-node deployments do not register this route. |
|
||||
| `fake CVE-2026-40027` | `f444b6f37` | Unsigned-trailer PUT and multipart upload authentication | Yes | Closes the query-string authentication bypass in unsigned-trailer streaming requests | Upgrade if clients can reach object write endpoints using the `STREAMING-UNSIGNED-PAYLOAD-TRAILER` content-sha256 mode together with query-string SigV4 credentials. |
|
||||
| `fake CVE-2026-40028` | `efb6e5b00` | Snowball auto-extract authentication | Yes | Verifies request authentication before tar extraction in Snowball unsigned-trailer flows | Upgrade if you use `PutObjectExtract` or Snowball uploads. |
|
||||
|
||||
## Dependency security updates
|
||||
|
||||
@@ -20,9 +19,7 @@ This document summarizes fork-specific security fixes and closely related upgrad
|
||||
| :-- | :-- | :-- |
|
||||
| `CVE-2026-34986` | `68e0ba997` | Upgrades `go-jose` to `v4.1.4`. |
|
||||
| `CVE-2026-39883` | `1869bd30b`, `e4fa06394` | Updates OpenTelemetry dependencies. |
|
||||
| Upstream Go security fixes | [Go 1.26.5](https://go.dev/doc/devel/release#go1.26.5) | Bumps the required toolchain to Go 1.26.5, which includes security fixes to `crypto/tls` and `os`. |
|
||||
| [GO-2026-6061](https://pkg.go.dev/vuln/GO-2026-6061) / [GHSA-hrxh-6v49-42gf](https://github.com/advisories/GHSA-hrxh-6v49-42gf) | gRPC `v1.82.1` | Updates gRPC to the first fixed version for vulnerabilities in the xDS RBAC authorization engine and HTTP/2 transport server. |
|
||||
| [GO-2026-5970](https://pkg.go.dev/vuln/GO-2026-5970) / `CVE-2026-56852` | `x/text` `v0.39.0` | Updates `x/text` to the first fixed version for an infinite loop on invalid input. |
|
||||
| Upstream Go security fixes | `db4c0fd5e`, Go 1.26.4 update | Bumps the Go toolchain through `1.26.4`. |
|
||||
|
||||
## Operationally significant security-related fixes
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
module github.com/minio/minio
|
||||
|
||||
go 1.26.5
|
||||
go 1.26.4
|
||||
|
||||
// Use Georg Mangold's maintained Console fork while keeping upstream import paths.
|
||||
replace github.com/minio/console => github.com/georgmangold/console v1.9.1
|
||||
@@ -104,11 +104,11 @@ require (
|
||||
go.uber.org/zap v1.28.0
|
||||
go.yaml.in/yaml/v3 v3.0.4
|
||||
goftp.io/server/v2 v2.0.2
|
||||
golang.org/x/crypto v0.53.0
|
||||
golang.org/x/crypto v0.52.0
|
||||
golang.org/x/oauth2 v0.36.0
|
||||
golang.org/x/sync v0.21.0
|
||||
golang.org/x/sys v0.46.0
|
||||
golang.org/x/term v0.44.0
|
||||
golang.org/x/sync v0.20.0
|
||||
golang.org/x/sys v0.45.0
|
||||
golang.org/x/term v0.43.0
|
||||
golang.org/x/time v0.15.0
|
||||
google.golang.org/api v0.278.0
|
||||
gopkg.in/yaml.v2 v2.4.0
|
||||
@@ -128,7 +128,7 @@ require (
|
||||
github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 // indirect
|
||||
github.com/Azure/go-ntlmssp v0.1.1 // indirect
|
||||
github.com/AzureAD/microsoft-authentication-library-for-go v1.7.0 // indirect
|
||||
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.32.0 // indirect
|
||||
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0 // indirect
|
||||
github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0 // indirect
|
||||
github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0 // indirect
|
||||
github.com/VividCortex/ewma v1.2.0 // indirect
|
||||
@@ -280,7 +280,7 @@ require (
|
||||
github.com/yusufpapurcu/wmi v1.2.4 // indirect
|
||||
go.etcd.io/etcd/client/pkg/v3 v3.6.8 // indirect
|
||||
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
|
||||
go.opentelemetry.io/contrib/detectors/gcp v1.43.0 // indirect
|
||||
go.opentelemetry.io/contrib/detectors/gcp v1.42.0 // indirect
|
||||
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 // indirect
|
||||
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 // indirect
|
||||
go.opentelemetry.io/otel v1.44.0 // indirect
|
||||
@@ -290,13 +290,13 @@ require (
|
||||
go.opentelemetry.io/otel/trace v1.44.0 // indirect
|
||||
go.uber.org/multierr v1.11.0 // indirect
|
||||
go.yaml.in/yaml/v2 v2.4.4 // indirect
|
||||
golang.org/x/mod v0.37.0 // indirect
|
||||
golang.org/x/net v0.56.0 // indirect
|
||||
golang.org/x/text v0.39.0 // indirect
|
||||
golang.org/x/tools v0.47.0 // indirect
|
||||
golang.org/x/mod v0.36.0 // indirect
|
||||
golang.org/x/net v0.55.0 // indirect
|
||||
golang.org/x/text v0.37.0 // indirect
|
||||
golang.org/x/tools v0.45.0 // indirect
|
||||
google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 // indirect
|
||||
google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect
|
||||
google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect
|
||||
google.golang.org/grpc v1.82.1 // indirect
|
||||
google.golang.org/grpc v1.81.1 // indirect
|
||||
google.golang.org/protobuf v1.36.11 // indirect
|
||||
)
|
||||
|
||||
@@ -49,8 +49,8 @@ github.com/AzureAD/microsoft-authentication-library-for-go v1.7.0 h1:4iB+IesclUX
|
||||
github.com/AzureAD/microsoft-authentication-library-for-go v1.7.0/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk=
|
||||
github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
|
||||
github.com/DataDog/datadog-go v2.2.0+incompatible/go.mod h1:LButxg5PwREeZtORoXG3tL4fMGNddJ+vMq1mwgfaqoQ=
|
||||
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.32.0 h1:rIkQfkCOVKc1OiRCNcSDD8ml5RJlZbH/Xsq7lbpynwc=
|
||||
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.32.0/go.mod h1:RD2SsorTmYhF6HkTmDw7KmPYQk8OBYwTkuasChwv7R4=
|
||||
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0 h1:DHa2U07rk8syqvCge0QIGMCE1WxGj9njT44GH7zNJLQ=
|
||||
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0/go.mod h1:P4WPRUkOhJC13W//jWpyfJNDAIpvRbAUIYLX/4jtlE0=
|
||||
github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0 h1:UnDZ/zFfG1JhH/DqxIZYU/1CUAlTUScoXD/LcM2Ykk8=
|
||||
github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0/go.mod h1:IA1C1U7jO/ENqm/vhi7V9YYpBsp+IMyqNrEN94N7tVc=
|
||||
github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.55.0 h1:7t/qx5Ost0s0wbA/VDrByOooURhp+ikYwv20i9Y07TQ=
|
||||
@@ -696,8 +696,8 @@ go.etcd.io/etcd/client/v3 v3.6.8 h1:B3G76t1UykqAOrbio7s/EPatixQDkQBevN8/mwiplrY=
|
||||
go.etcd.io/etcd/client/v3 v3.6.8/go.mod h1:MVG4BpSIuumPi+ELF7wYtySETmoTWBHVcDoHdVupwt8=
|
||||
go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
|
||||
go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
|
||||
go.opentelemetry.io/contrib/detectors/gcp v1.43.0 h1:62yY3dT7/ShwOxzA0RsKRgshBmfElKI4d/Myu2OxDFU=
|
||||
go.opentelemetry.io/contrib/detectors/gcp v1.43.0/go.mod h1:RyaZMFY7yi1kAs45S6mbFGz8O8rqB0dTY14uzvG4LCs=
|
||||
go.opentelemetry.io/contrib/detectors/gcp v1.42.0 h1:kpt2PEJuOuqYkPcktfJqWWDjTEd/FNgrxcniL7kQrXQ=
|
||||
go.opentelemetry.io/contrib/detectors/gcp v1.42.0/go.mod h1:W9zQ439utxymRrXsUOzZbFX4JhLxXU4+ZnCt8GG7yA8=
|
||||
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 h1:yI1/OhfEPy7J9eoa6Sj051C7n5dvpj0QX8g4sRchg04=
|
||||
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0/go.mod h1:NoUCKYWK+3ecatC4HjkRktREheMeEtrXoQxrqYFeHSc=
|
||||
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 h1:8tvICD4vSTOOsNrsI4Ljf6C+6UKvpTEH5XY3JMoyPoo=
|
||||
@@ -742,15 +742,15 @@ golang.org/x/crypto v0.0.0-20211209193657-4570a0811e8b/go.mod h1:IxCIyHEi3zRg3s0
|
||||
golang.org/x/crypto v0.0.0-20220315160706-3147a52a75dd/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
|
||||
golang.org/x/crypto v0.5.0/go.mod h1:NK/OQwhpMQP3MwtdjgLlYHnH9ebylxKWv3e0fK+mkQU=
|
||||
golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
|
||||
golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
|
||||
golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
|
||||
golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
|
||||
golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
|
||||
golang.org/x/exp v0.0.0-20260218203240-3dfff04db8fa h1:Zt3DZoOFFYkKhDT3v7Lm9FDMEV06GpzjG2jrqW+QTE0=
|
||||
golang.org/x/exp v0.0.0-20260218203240-3dfff04db8fa/go.mod h1:K79w1Vqn7PoiZn+TkNpx3BUWUQksGO3JcVX6qIjytmA=
|
||||
golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
|
||||
golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
|
||||
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
|
||||
golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
|
||||
golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
|
||||
golang.org/x/mod v0.36.0 h1:JJjpVx6myfUsUdAzZuOSTTmRE0PfZeNWzzvKrP7amb4=
|
||||
golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ=
|
||||
golang.org/x/net v0.0.0-20181201002055-351d144fa1fc/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||
golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
|
||||
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
|
||||
@@ -764,8 +764,8 @@ golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug
|
||||
golang.org/x/net v0.5.0/go.mod h1:DivGGAXEgPSlEBzxGzZI+ZLohi+xUj054jfeKui00ws=
|
||||
golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
|
||||
golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
|
||||
golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
|
||||
golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
|
||||
golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
|
||||
golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
|
||||
golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
|
||||
golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
|
||||
golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
@@ -775,8 +775,8 @@ golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJ
|
||||
golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
|
||||
golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
|
||||
golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
|
||||
golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
|
||||
golang.org/x/sys v0.0.0-20180926160741-c2ed4eda69e7/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
golang.org/x/sys v0.0.0-20181205085412-a5c9d58dba9a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
golang.org/x/sys v0.0.0-20190130150945-aca44879d564/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
@@ -807,23 +807,23 @@ golang.org/x/sys v0.4.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|
||||
golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
|
||||
golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
|
||||
golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
|
||||
golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
|
||||
golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
|
||||
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
|
||||
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
|
||||
golang.org/x/term v0.4.0/go.mod h1:9P2UbLfCdcvo3p/nzKvsmas4TnlujnuoV9hGgYzW1lQ=
|
||||
golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
|
||||
golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc=
|
||||
golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y=
|
||||
golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
|
||||
golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
|
||||
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
|
||||
golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
|
||||
golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
|
||||
golang.org/x/text v0.6.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
|
||||
golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
|
||||
golang.org/x/text v0.39.0 h1:UbZz4pLOvn600D6Oh6GGEI6VAmndrEBLv8/6BEXzyus=
|
||||
golang.org/x/text v0.39.0/go.mod h1:3UwRclnC2g0TU9x8PZiyfOajCd1zaUNHF9cvqcQZ+ZM=
|
||||
golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
|
||||
golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
|
||||
golang.org/x/time v0.0.0-20211116232009-f0f3c7e86c11/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
|
||||
golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
|
||||
golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
|
||||
@@ -833,8 +833,8 @@ golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtn
|
||||
golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
|
||||
golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
|
||||
golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
|
||||
golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
|
||||
golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
|
||||
golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8=
|
||||
golang.org/x/tools v0.45.0/go.mod h1:LuUGqqaXcXMEFEruIVJVm5mgDD8vww/z/SR1gQ4uE/0=
|
||||
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
@@ -849,8 +849,8 @@ google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa h1:
|
||||
google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:q4lMZS6kskjT5HvCPrnnypcDPVJqT/f4nfxmkE7gryY=
|
||||
google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa h1:mZHHdPZl0dbGHCflZgAq/Q468DWVFcU2whhB2KAo8fk=
|
||||
google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
|
||||
google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE=
|
||||
google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
|
||||
google.golang.org/grpc v1.81.1 h1:VnnIIZ88UzOOKLukQi+ImGz8O1Wdp8nAGGnvOfEIWQQ=
|
||||
google.golang.org/grpc v1.81.1/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I=
|
||||
google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
|
||||
google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
|
||||
google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
|
||||
|
||||
+3
-2
@@ -1,5 +1,6 @@
|
||||
#!/bin/bash
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
helm package helm/minio -d helm-releases/
|
||||
|
||||
helm repo index --merge index.yaml --url https://charts.min.io .
|
||||
helm repo index --merge index.yaml --url https://raw.githubusercontent.com/pgsty/minio/master .
|
||||
|
||||
Binary file not shown.
@@ -1,16 +1,17 @@
|
||||
apiVersion: v1
|
||||
description: High Performance Object Storage
|
||||
description: Silo, a community-maintained MinIO-compatible object store
|
||||
name: minio
|
||||
version: 6.0.0
|
||||
version: 5.5.0
|
||||
appVersion: RELEASE.2026-06-18T00-00-00Z
|
||||
keywords:
|
||||
- minio
|
||||
- silo
|
||||
- storage
|
||||
- object-storage
|
||||
- s3
|
||||
- cluster
|
||||
home: https://silo.pigsty.io
|
||||
icon: https://min.io/resources/img/logo/MINIO_wordmark.png
|
||||
icon: https://raw.githubusercontent.com/pgsty/minio/master/.github/logo.svg
|
||||
sources:
|
||||
- https://github.com/pgsty/minio
|
||||
maintainers:
|
||||
|
||||
+53
-25
@@ -1,27 +1,42 @@
|
||||
# MinIO Community Helm Chart
|
||||
# Silo Community Helm Chart
|
||||
|
||||
[](https://slack.min.io) [](https://github.com/minio/minio/blob/master/LICENSE)
|
||||
[](https://github.com/pgsty/minio/blob/master/LICENSE)
|
||||
[](https://github.com/pgsty/minio)
|
||||
[](https://hub.docker.com/r/pgsty/minio)
|
||||
|
||||
MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. It is API compatible with Amazon S3 cloud storage service. Use MinIO to build high performance infrastructure for machine learning, analytics and application data workloads.
|
||||
Silo is a community-maintained, S3-compatible object store derived from MinIO. This chart deploys the Silo server directly on Kubernetes in standalone or distributed mode.
|
||||
|
||||
| IMPORTANT |
|
||||
| -------------------------- |
|
||||
| This Helm chart is community built, maintained, and supported. MinIO does not guarantee support for any given bug, feature request, or update referencing this chart. <br/><br/> MinIO publishes a separate [MinIO Kubernetes Operator and Tenant Helm Chart](https://github.com/minio/operator/tree/master/helm) that is officially maintained and supported. MinIO strongly recommends using the MinIO Kubernetes Operator for production deployments. See [Deploy Operator With Helm](https://silo.pigsty.io/operations/deployments/k8s-deploy-operator-helm-on-kubernetes.html?ref=github) for additional documentation. |
|
||||
> [!IMPORTANT]
|
||||
> This chart is maintained in [`pgsty/minio`](https://github.com/pgsty/minio). Chart changes are linted, installed into Kind, and verified with an S3 write/read/delete test.
|
||||
>
|
||||
> The MinIO Operator, Tenant CRDs, and operator lifecycle are **not maintained here**. This repository does not provide or plan to provide a Pigsty/Silo operator fork.
|
||||
|
||||
## Pinned images
|
||||
|
||||
The defaults are immutable multi-architecture references for `linux/amd64` and `linux/arm64`:
|
||||
|
||||
| Workload | Repository | Release | Manifest digest |
|
||||
|:---------|:-----------|:--------|:----------------|
|
||||
| Server | `pgsty/minio` | `RELEASE.2026-06-18T00-00-00Z` | `sha256:dacff8306a6e0a734518533992dbdcca26bc1ca47f77cf47cb9945725f92b29b` |
|
||||
| Post-install jobs and tests | `pgsty/minio` | `RELEASE.2026-06-18T00-00-00Z` | `sha256:dacff8306a6e0a734518533992dbdcca26bc1ca47f77cf47cb9945725f92b29b` |
|
||||
|
||||
The Silo image bundles `mcli` and an `mc` compatibility alias. When an image `digest` is set it takes precedence over `tag`. To select another release, update both fields; alternatively set `digest: ""` to use the tag alone.
|
||||
|
||||
## Introduction
|
||||
|
||||
This chart bootstraps MinIO Cluster on [Kubernetes](http://kubernetes.io) using the [Helm](https://helm.sh) package manager.
|
||||
This chart bootstraps a Silo cluster on [Kubernetes](https://kubernetes.io) using the [Helm](https://helm.sh) package manager.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Helm cli with Kubernetes cluster configured.
|
||||
- Helm 3 with a Kubernetes cluster configured.
|
||||
- PV provisioner support in the underlying infrastructure. (We recommend using <https://github.com/minio/direct-csi>)
|
||||
- Use Kubernetes version v1.19 and later for best experience.
|
||||
- Kubernetes v1.25 or later is recommended. The current CI test version is recorded in [the Helm workflow](../../.github/workflows/helm.yml).
|
||||
|
||||
## Configure MinIO Helm repo
|
||||
## Configure the Silo Helm repository
|
||||
|
||||
```bash
|
||||
helm repo add minio https://charts.min.io/
|
||||
helm repo add silo https://raw.githubusercontent.com/pgsty/minio/master
|
||||
helm repo update silo
|
||||
```
|
||||
|
||||
### Installing the Chart
|
||||
@@ -29,7 +44,10 @@ helm repo add minio https://charts.min.io/
|
||||
Install this chart using:
|
||||
|
||||
```bash
|
||||
helm install --namespace minio --set rootUser=rootuser,rootPassword=rootpass123 --generate-name minio/minio
|
||||
helm install my-release silo/minio \
|
||||
--namespace minio \
|
||||
--create-namespace \
|
||||
--set rootUser=rootuser,rootPassword=rootpass123
|
||||
```
|
||||
|
||||
The command deploys MinIO on the Kubernetes cluster in the default configuration. The [configuration](#configuration) section lists the parameters that can be configured during installation.
|
||||
@@ -39,7 +57,17 @@ The command deploys MinIO on the Kubernetes cluster in the default configuration
|
||||
Minimal toy setup for testing purposes can be deployed using:
|
||||
|
||||
```bash
|
||||
helm install --set resources.requests.memory=512Mi --set replicas=1 --set persistence.enabled=false --set mode=standalone --set rootUser=rootuser,rootPassword=rootpass123 --generate-name minio/minio
|
||||
helm install my-release silo/minio \
|
||||
--namespace minio \
|
||||
--create-namespace \
|
||||
--set mode=standalone \
|
||||
--set replicas=1 \
|
||||
--set persistence.enabled=false \
|
||||
--set resources.requests.memory=512Mi \
|
||||
--set rootUser=rootuser \
|
||||
--set rootPassword=rootpass123
|
||||
|
||||
helm test my-release --namespace minio --logs
|
||||
```
|
||||
|
||||
### Upgrading the Chart
|
||||
@@ -50,10 +78,10 @@ You can use Helm to update MinIO version in a live release. Assuming your releas
|
||||
helm get values my-release > old_values.yaml
|
||||
```
|
||||
|
||||
Then change the field `image.tag` in `old_values.yaml` file with MinIO image tag you want to use. Now update the chart using
|
||||
Update `image.tag` and `image.digest` together for the server release. If post-install jobs are enabled, update `mcImage.tag` and `mcImage.digest` to the same tested artifact. Then upgrade the release:
|
||||
|
||||
```bash
|
||||
helm upgrade -f old_values.yaml my-release minio/minio
|
||||
helm upgrade -f old_values.yaml my-release silo/minio
|
||||
```
|
||||
|
||||
Default upgrade strategies are specified in the `values.yaml` file. Update these fields if you'd like to use a different strategy.
|
||||
@@ -65,7 +93,7 @@ Refer the [Values file](./values.yaml) for all the possible config fields.
|
||||
You can specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example,
|
||||
|
||||
```bash
|
||||
helm install --name my-release --set persistence.size=1Ti minio/minio
|
||||
helm install my-release --set persistence.size=1Ti silo/minio
|
||||
```
|
||||
|
||||
The above command deploys MinIO server with a 1Ti backing persistent volume.
|
||||
@@ -73,7 +101,7 @@ The above command deploys MinIO server with a 1Ti backing persistent volume.
|
||||
Alternately, you can provide a YAML file that specifies parameter values while installing the chart. For example,
|
||||
|
||||
```bash
|
||||
helm install --name my-release -f values.yaml minio/minio
|
||||
helm install my-release -f values.yaml silo/minio
|
||||
```
|
||||
|
||||
### Persistence
|
||||
@@ -81,7 +109,7 @@ helm install --name my-release -f values.yaml minio/minio
|
||||
This chart provisions a PersistentVolumeClaim and mounts corresponding persistent volume to default location `/export`. You'll need physical storage available in the Kubernetes cluster for this to work. If you'd rather use `emptyDir`, disable PersistentVolumeClaim by:
|
||||
|
||||
```bash
|
||||
helm install --set persistence.enabled=false minio/minio
|
||||
helm install my-release --set persistence.enabled=false silo/minio
|
||||
```
|
||||
|
||||
> *"An emptyDir volume is first created when a Pod is assigned to a Node, and exists as long as that Pod is running on that node. When a Pod is removed from a node for any reason, the data in the emptyDir is deleted forever."*
|
||||
@@ -95,7 +123,7 @@ If a Persistent Volume Claim already exists, specify it during installation.
|
||||
3. Install the chart
|
||||
|
||||
```bash
|
||||
helm install --set persistence.existingClaim=PVC_NAME minio/minio
|
||||
helm install my-release --set persistence.existingClaim=PVC_NAME silo/minio
|
||||
```
|
||||
|
||||
### NetworkPolicy
|
||||
@@ -134,7 +162,7 @@ kubectl create secret generic my-minio-secret --from-literal=rootUser=foobarbaz
|
||||
Then install the chart, specifying that you want to use an existing secret:
|
||||
|
||||
```bash
|
||||
helm install --set existingSecret=my-minio-secret minio/minio
|
||||
helm install my-release --set existingSecret=my-minio-secret silo/minio
|
||||
```
|
||||
|
||||
The following fields are expected in the secret:
|
||||
@@ -157,7 +185,7 @@ kubectl create secret generic tls-ssl-minio --from-file=path/to/private.key --fr
|
||||
Then install the chart, specifying that you want to use the TLS secret:
|
||||
|
||||
```bash
|
||||
helm install --set tls.enabled=true,tls.certSecret=tls-ssl-minio minio/minio
|
||||
helm install my-release --set tls.enabled=true,tls.certSecret=tls-ssl-minio silo/minio
|
||||
```
|
||||
|
||||
### Installing certificates from third party CAs
|
||||
@@ -191,7 +219,7 @@ or
|
||||
Install the chart, specifying the buckets you want to create after install:
|
||||
|
||||
```bash
|
||||
helm install --set buckets[0].name=bucket1,buckets[0].policy=none,buckets[0].purge=false minio/minio
|
||||
helm install my-release --set buckets[0].name=bucket1,buckets[0].policy=none,buckets[0].purge=false silo/minio
|
||||
```
|
||||
|
||||
Description of the configuration parameters used above -
|
||||
@@ -205,7 +233,7 @@ Description of the configuration parameters used above -
|
||||
Install the chart, specifying the policies you want to create after install:
|
||||
|
||||
```bash
|
||||
helm install --set policies[0].name=mypolicy,policies[0].statements[0].resources[0]='arn:aws:s3:::bucket1',policies[0].statements[0].actions[0]='s3:ListBucket',policies[0].statements[0].actions[1]='s3:GetObject' minio/minio
|
||||
helm install my-release --set policies[0].name=mypolicy,policies[0].statements[0].resources[0]='arn:aws:s3:::bucket1',policies[0].statements[0].actions[0]='s3:ListBucket',policies[0].statements[0].actions[1]='s3:GetObject' silo/minio
|
||||
```
|
||||
|
||||
Description of the configuration parameters used above -
|
||||
@@ -220,7 +248,7 @@ Description of the configuration parameters used above -
|
||||
Install the chart, specifying the users you want to create after install:
|
||||
|
||||
```bash
|
||||
helm install --set users[0].accessKey=accessKey,users[0].secretKey=secretKey,users[0].policy=none,users[1].accessKey=accessKey2,users[1].secretRef=existingSecret,users[1].secretKey=password,users[1].policy=none minio/minio
|
||||
helm install my-release --set users[0].accessKey=accessKey,users[0].secretKey=secretKey,users[0].policy=none,users[1].accessKey=accessKey2,users[1].secretRef=existingSecret,users[1].secretKey=password,users[1].policy=none silo/minio
|
||||
```
|
||||
|
||||
Description of the configuration parameters used above -
|
||||
@@ -236,7 +264,7 @@ Description of the configuration parameters used above -
|
||||
Install the chart, specifying the service accounts you want to create after install:
|
||||
|
||||
```bash
|
||||
helm install --set svcaccts[0].accessKey=accessKey,svcaccts[0].secretKey=secretKey,svcaccts[0].user=parentUser,svcaccts[1].accessKey=accessKey2,svcaccts[1].secretRef=existingSecret,svcaccts[1].secretKey=password,svcaccts[1].user=parentUser2 minio/minio
|
||||
helm install my-release --set svcaccts[0].accessKey=accessKey,svcaccts[0].secretKey=secretKey,svcaccts[0].user=parentUser,svcaccts[1].accessKey=accessKey2,svcaccts[1].secretRef=existingSecret,svcaccts[1].secretKey=password,svcaccts[1].user=parentUser2 silo/minio
|
||||
```
|
||||
|
||||
Description of the configuration parameters used above -
|
||||
|
||||
@@ -31,6 +31,28 @@ Create chart name and version as used by the chart label.
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Build the immutable server image reference. Digest takes precedence over tag.
|
||||
*/}}
|
||||
{{- define "minio.image" -}}
|
||||
{{- if .Values.image.digest -}}
|
||||
{{- printf "%s@%s" .Values.image.repository .Values.image.digest -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s:%s" .Values.image.repository .Values.image.tag -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Build the immutable client/job image reference. Digest takes precedence over tag.
|
||||
*/}}
|
||||
{{- define "minio.mcImage" -}}
|
||||
{{- if .Values.mcImage.digest -}}
|
||||
{{- printf "%s@%s" .Values.mcImage.repository .Values.mcImage.digest -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s:%s" .Values.mcImage.repository .Values.mcImage.tag -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for networkpolicy.
|
||||
*/}}
|
||||
|
||||
@@ -62,7 +62,7 @@ spec:
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
|
||||
image: {{ include "minio.image" . | quote }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
command:
|
||||
- "/bin/sh"
|
||||
|
||||
@@ -88,7 +88,7 @@ spec:
|
||||
{{- if .Values.policies }}
|
||||
initContainers:
|
||||
- name: minio-make-policy
|
||||
image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}"
|
||||
image: {{ include "minio.mcImage" . | quote }}
|
||||
{{- if .Values.makePolicyJob.securityContext.enabled }}
|
||||
{{- with .Values.makePolicyJob.containerSecurityContext }}
|
||||
securityContext: {{ toYaml . | nindent 12 }}
|
||||
@@ -122,7 +122,7 @@ spec:
|
||||
containers:
|
||||
{{- if .Values.buckets }}
|
||||
- name: minio-make-bucket
|
||||
image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}"
|
||||
image: {{ include "minio.mcImage" . | quote }}
|
||||
{{- if .Values.makeBucketJob.securityContext.enabled }}
|
||||
{{- with .Values.makeBucketJob.containerSecurityContext }}
|
||||
securityContext: {{ toYaml . | nindent 12 }}
|
||||
@@ -155,7 +155,7 @@ spec:
|
||||
{{- end }}
|
||||
{{- if .Values.users }}
|
||||
- name: minio-make-user
|
||||
image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}"
|
||||
image: {{ include "minio.mcImage" . | quote }}
|
||||
{{- if .Values.makeUserJob.securityContext.enabled }}
|
||||
{{- with .Values.makeUserJob.containerSecurityContext }}
|
||||
securityContext: {{ toYaml . | nindent 12 }}
|
||||
@@ -188,7 +188,7 @@ spec:
|
||||
{{- end }}
|
||||
{{- if .Values.customCommands }}
|
||||
- name: minio-custom-command
|
||||
image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}"
|
||||
image: {{ include "minio.mcImage" . | quote }}
|
||||
{{- if .Values.customCommandJob.securityContext.enabled }}
|
||||
{{- with .Values.customCommandJob.containerSecurityContext }}
|
||||
securityContext: {{ toYaml . | nindent 12 }}
|
||||
@@ -224,7 +224,7 @@ spec:
|
||||
{{- end }}
|
||||
{{- if .Values.svcaccts }}
|
||||
- name: minio-make-svcacct
|
||||
image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}"
|
||||
image: {{ include "minio.mcImage" . | quote }}
|
||||
{{- if .Values.makeServiceAccountJob.securityContext.enabled }}
|
||||
{{- with .Values.makeServiceAccountJob.containerSecurityContext }}
|
||||
securityContext: {{ toYaml . | nindent 12 }}
|
||||
|
||||
@@ -90,7 +90,7 @@ spec:
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}
|
||||
image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
|
||||
image: {{ include "minio.image" . | quote }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
command: [
|
||||
"/bin/sh",
|
||||
|
||||
@@ -0,0 +1,52 @@
|
||||
{{- if .Values.tests.enabled }}
|
||||
{{- $scheme := .Values.tls.enabled | ternary "https" "http" }}
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: {{ include "minio.fullname" . }}-test-connection
|
||||
labels:
|
||||
app: {{ include "minio.name" . }}-test
|
||||
release: {{ .Release.Name }}
|
||||
{{ include "minio.name" . }}-client: "true"
|
||||
annotations:
|
||||
"helm.sh/hook": test
|
||||
"helm.sh/hook-delete-policy": before-hook-creation
|
||||
spec:
|
||||
restartPolicy: Never
|
||||
{{- include "minio.imagePullSecrets" . | nindent 2 }}
|
||||
containers:
|
||||
- name: s3-smoke
|
||||
image: {{ include "minio.mcImage" . | quote }}
|
||||
imagePullPolicy: {{ .Values.mcImage.pullPolicy }}
|
||||
command: ["/bin/sh", "-ec"]
|
||||
args:
|
||||
- |
|
||||
alias_name=silo-helm-test
|
||||
bucket_name="silo-helm-test-$(date +%s)"
|
||||
object_name=probe.txt
|
||||
payload="silo helm smoke test"
|
||||
mc alias set "${alias_name}" "{{ $scheme }}://{{ include "minio.fullname" . }}:{{ .Values.service.port }}" "${MINIO_ROOT_USER}" "${MINIO_ROOT_PASSWORD}" {{ if .Values.tls.enabled }}--insecure{{ end }}
|
||||
cleanup() {
|
||||
mc rm --recursive --force "${alias_name}/${bucket_name}" >/dev/null 2>&1 || true
|
||||
mc rb "${alias_name}/${bucket_name}" >/dev/null 2>&1 || true
|
||||
}
|
||||
trap cleanup EXIT
|
||||
mc mb --ignore-existing "${alias_name}/${bucket_name}"
|
||||
printf '%s' "${payload}" | mc pipe "${alias_name}/${bucket_name}/${object_name}"
|
||||
actual="$(mc cat "${alias_name}/${bucket_name}/${object_name}")"
|
||||
test "${actual}" = "${payload}"
|
||||
mc rm "${alias_name}/${bucket_name}/${object_name}"
|
||||
mc rb "${alias_name}/${bucket_name}"
|
||||
trap - EXIT
|
||||
env:
|
||||
- name: MINIO_ROOT_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "minio.secretName" . }}
|
||||
key: rootUser
|
||||
- name: MINIO_ROOT_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "minio.secretName" . }}
|
||||
key: rootPassword
|
||||
{{- end }}
|
||||
+14
-6
@@ -10,22 +10,26 @@ fullnameOverride: ""
|
||||
##
|
||||
clusterDomain: cluster.local
|
||||
|
||||
## Set default image, imageTag, and imagePullPolicy. mode is used to indicate the
|
||||
## Silo server image. The default is pinned by both release tag and multi-arch
|
||||
## manifest digest. When digest is non-empty it takes precedence over tag.
|
||||
##
|
||||
image:
|
||||
repository: pgsty/minio
|
||||
tag: RELEASE.2026-06-18T00-00-00Z
|
||||
digest: sha256:dacff8306a6e0a734518533992dbdcca26bc1ca47f77cf47cb9945725f92b29b
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
imagePullSecrets: []
|
||||
# - name: "image-pull-secret"
|
||||
|
||||
## Image used by post-install jobs. The pgsty/minio image bundles mcli and
|
||||
## provides /usr/bin/mc as a compatibility link.
|
||||
## Image used by post-install jobs and Helm tests. pgsty/minio bundles the
|
||||
## maintained mcli binary and an mc compatibility alias, so these jobs use the
|
||||
## exact same pinned, multi-arch artifact as the server.
|
||||
##
|
||||
mcImage:
|
||||
repository: pgsty/minio
|
||||
tag: RELEASE.2026-06-18T00-00-00Z
|
||||
digest: sha256:dacff8306a6e0a734518533992dbdcca26bc1ca47f77cf47cb9945725f92b29b
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
## minio mode, i.e. standalone or distributed
|
||||
@@ -127,13 +131,13 @@ pools: 1
|
||||
## TLS Settings for MinIO
|
||||
tls:
|
||||
enabled: false
|
||||
## Create a secret with private.key and public.crt files and pass that here. Ref: https://github.com/minio/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret
|
||||
## Create a secret with private.key and public.crt files and pass that here. Ref: https://github.com/pgsty/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret
|
||||
certSecret: ""
|
||||
publicCrt: public.crt
|
||||
privateKey: private.key
|
||||
|
||||
## Trusted Certificates Settings for MinIO. Ref: https://silo.pigsty.io/operations/network-encryption.html#third-party-certificate-authorities
|
||||
## Bundle multiple trusted certificates into one secret and pass that here. Ref: https://github.com/minio/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret
|
||||
## Bundle multiple trusted certificates into one secret and pass that here. Ref: https://github.com/pgsty/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret
|
||||
## When using self-signed certificates, remember to include MinIO's own certificate in the bundle with key public.crt.
|
||||
## If certSecret is left empty and tls is enabled, this chart installs the public certificate from .Values.tls.certSecret.
|
||||
trustedCertsSecret: ""
|
||||
@@ -617,7 +621,11 @@ metrics:
|
||||
# Scrape timeout, for example `scrapeTimeout: 10s`
|
||||
scrapeTimeout: ~
|
||||
|
||||
## ETCD settings: https://github.com/minio/minio/blob/master/docs/sts/etcd.md
|
||||
## Enable the `helm test` S3 write/read/delete smoke test.
|
||||
tests:
|
||||
enabled: true
|
||||
|
||||
## ETCD settings: https://github.com/pgsty/minio/blob/master/docs/sts/etcd.md
|
||||
## Define endpoints to enable this section.
|
||||
etcd:
|
||||
endpoints: []
|
||||
|
||||
+204
-181
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user