minio · donatello · Mar 17, 2026 · Mar 16, 2026 · Mar 16, 2026 · Mar 16, 2026
diff --git a/Makefile b/Makefile
@@ -38,10 +38,15 @@ binary:
 
 operator: binary
 
-docker: operator
-	@docker buildx build --no-cache --load --platform linux/$(GOARCH) -t $(TAG) .
-
-build: regen-crd verify operator docker
+container-image: operator
+	-podman manifest rm $(TAG)
+	-podman rmi $(TAG)
+	@podman manifest create $(TAG)
+	@podman build --platform linux/amd64 --build-arg TAG=$(TAG) --manifest $(TAG) .
+	@podman build --platform linux/arm64 --build-arg TAG=$(TAG) --manifest $(TAG) .
+#	@podman manifest push $(TAG)
+
+build: regen-crd verify operator container-image
 
 install: all
 

diff --git a/api/consts.go b/api/consts.go
@@ -28,7 +28,7 @@ const (
 
 	// Image versions
 
-	KESImageVersion = "minio/kes:2024-06-17T15-47-05Z"
+	KESImageVersion = "minio/kes:2025-03-12T09-35-18Z"
 
 	// Constants for common configuration
 	MinioImage         = "OPERATOR_MINIO_IMAGE"

diff --git a/docs/policybinding_crd.adoc b/docs/policybinding_crd.adoc
@@ -4,8 +4,8 @@
 [id="{p}-api-reference"]
 == API Reference
 
-:minio-image: https://hub.docker.com/r/minio/minio/tags[minio/minio:RELEASE.2024-08-03T04-33-23Z]
-:kes-image: https://hub.docker.com/r/minio/kes/tags[minio/kes:2024-06-17T15-47-05Z]
+:minio-image: https://hub.docker.com/r/minio/minio/tags[minio/minio:RELEASE.2025-09-07T16-13-09Z]
+:kes-image: https://hub.docker.com/r/minio/kes/tags[minio/kes:2025-03-12T09-35-18Z]
 
 
 [id="{anchor_prefix}-sts-min-io-v1alpha1"]

diff --git a/docs/templates/asciidoctor/gv_list.tpl b/docs/templates/asciidoctor/gv_list.tpl
@@ -7,8 +7,8 @@
 [id="{p}-api-reference"]
 == API Reference
 
-:minio-image: https://hub.docker.com/r/minio/minio/tags[minio/minio:RELEASE.2024-08-03T04-33-23Z]
-:kes-image: https://hub.docker.com/r/minio/kes/tags[minio/kes:2024-06-17T15-47-05Z]
+:minio-image: https://hub.docker.com/r/minio/minio/tags[minio/minio:RELEASE.2025-09-07T16-13-09Z]
+:kes-image: https://hub.docker.com/r/minio/kes/tags[minio/kes:2025-03-12T09-35-18Z]
 
 {{ range $groupVersions }}
 {{ template "gvDetails" . }}

diff --git a/docs/tenant_crd.adoc b/docs/tenant_crd.adoc
@@ -4,8 +4,8 @@
 [id="{p}-api-reference"]
 == API Reference
 
-:minio-image: https://hub.docker.com/r/minio/minio/tags[minio/minio:RELEASE.2024-08-03T04-33-23Z]
-:kes-image: https://hub.docker.com/r/minio/kes/tags[minio/kes:2024-06-17T15-47-05Z]
+:minio-image: https://hub.docker.com/r/minio/minio/tags[minio/minio:RELEASE.2025-09-07T16-13-09Z]
+:kes-image: https://hub.docker.com/r/minio/kes/tags[minio/kes:2025-03-12T09-35-18Z]
 
 
 [id="{anchor_prefix}-minio-min-io-v2"]

diff --git a/examples/kustomization/base/tenant.yaml b/examples/kustomization/base/tenant.yaml
@@ -144,7 +144,7 @@ spec:
   ## https://github.com/minio/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret
   externalClientCertSecrets: [ ]
   ## Registry location and Tag to download MinIO Server image
-  image: quay.io/minio/minio:RELEASE.2024-08-03T04-33-23Z
+  image: quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z
   imagePullSecret: { }
   ## Mount path where PV will be mounted inside container(s).
   mountPath: /export
@@ -253,7 +253,7 @@ spec:
   ## Audit Logs will be deprecated soon, commenting out for now!.
   ## LogSearch API setup for MinIO Tenant.
   # log:
-  #   image: "" # defaults to minio/operator:v5.0.18
+  #   image: "" # defaults to quay.io/minio/operator:v5.0.19
   #   env: [ ]
   #   resources: { }
   #   nodeSelector: { }

diff --git a/examples/kustomization/tenant-certmanager-kes/tenant.yaml b/examples/kustomization/tenant-certmanager-kes/tenant.yaml
@@ -14,7 +14,7 @@ spec:
     externalCertSecret:
       name: tenant-certmanager-2-tls
       type: cert-manager.io/v1
-    image: minio/kes:2024-06-17T15-47-05Z
+    image: minio/kes:2025-03-12T09-35-18Z
     imagePullPolicy: IfNotPresent
     kesSecret:
       name: kes-configuration

diff --git a/examples/kustomization/tenant-kes-encryption/tenant.yaml b/examples/kustomization/tenant-kes-encryption/tenant.yaml
@@ -7,7 +7,7 @@ spec:
   ## Define configuration for KES (stateless and distributed key-management system)
   ## Refer https://github.com/minio/kes
   kes:
-    image: "" # minio/kes:2024-06-17T15-47-05Z
+    image: "" # minio/kes:2025-03-12T09-35-18Z
     env: [ ]
     replicas: 2
     kesSecret:

diff --git a/helm/operator/Chart.yaml b/helm/operator/Chart.yaml
@@ -1,8 +1,8 @@
 apiVersion: v2
 description: A Helm chart for MinIO Operator
 name: operator
-version: 5.0.18
-appVersion: v5.0.18
+version: 5.0.19
+appVersion: v5.0.19
 keywords:
   - storage
   - object-storage

diff --git a/helm/operator/templates/job.min.io_jobs.yaml b/helm/operator/templates/job.min.io_jobs.yaml
@@ -4,7 +4,7 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.17.2
-    operator.min.io/version: v5.0.18
+    operator.min.io/version: v5.0.19
   name: miniojobs.job.min.io
 spec:
   group: job.min.io

diff --git a/helm/operator/templates/minio.min.io_tenants.yaml b/helm/operator/templates/minio.min.io_tenants.yaml
@@ -4,7 +4,7 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.17.2
-    operator.min.io/version: v5.0.18
+    operator.min.io/version: v5.0.19
   name: tenants.minio.min.io
 spec:
   group: minio.min.io

diff --git a/helm/operator/templates/sts.min.io_policybindings.yaml b/helm/operator/templates/sts.min.io_policybindings.yaml
@@ -4,7 +4,7 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.17.2
-    operator.min.io/version: v5.0.18
+    operator.min.io/version: v5.0.19
   name: policybindings.sts.min.io
 spec:
   group: sts.min.io

diff --git a/helm/tenant/Chart.yaml b/helm/tenant/Chart.yaml
@@ -1,8 +1,8 @@
 apiVersion: v2
 description: A Helm chart for MinIO Operator
 name: tenant
-version: 5.0.18
-appVersion: v5.0.18
+version: 5.0.19
+appVersion: v5.0.19
 keywords:
   - storage
   - object-storage

diff --git a/helm/tenant/values.yaml b/helm/tenant/values.yaml
@@ -55,7 +55,7 @@ tenant:
   # 
   #    image:
   #       repository: quay.io/minio/minio
-  #       tag: RELEASE.2024-08-03T04-33-23Z
+  #       tag: RELEASE.2025-09-07T16-13-09Z
   #       pullPolicy: IfNotPresent
   #
   # The chart also supports specifying an image based on digest value:
@@ -70,7 +70,7 @@ tenant:
   #
   image:
     repository: quay.io/minio/minio
-    tag: RELEASE.2024-08-03T04-33-23Z
+    tag: RELEASE.2025-09-07T16-13-09Z
     pullPolicy: IfNotPresent
   ###
   #

diff --git a/pkg/apis/job.min.io/v1alpha1/types.go b/pkg/apis/job.min.io/v1alpha1/types.go
@@ -34,7 +34,7 @@ const (
 // +kubebuilder:resource:scope=Namespaced,shortName=miniojob,singular=miniojob
 // +kubebuilder:printcolumn:name="Tenant",type=string,JSONPath=`.spec.tenant.name`
 // +kubebuilder:printcolumn:name="Phase",type=string,JSONPath=`.spec.status.phase`
-// +kubebuilder:metadata:annotations=operator.min.io/version=v5.0.18
+// +kubebuilder:metadata:annotations=operator.min.io/version=v5.0.19
 
 // MinIOJob is a top-level type. A client is created for it
 type MinIOJob struct {

diff --git a/pkg/apis/minio.min.io/v2/constants.go b/pkg/apis/minio.min.io/v2/constants.go
@@ -97,7 +97,7 @@ const MinIOVolumeMountPath = "/export"
 const MinIOVolumeSubPath = ""
 
 // DefaultMinIOImage specifies the default MinIO Docker hub image
-const DefaultMinIOImage = "minio/minio:RELEASE.2024-08-03T04-33-23Z"
+const DefaultMinIOImage = "minio/minio:RELEASE.2025-09-07T16-13-09Z"
 
 // DefaultMinIOUpdateURL specifies the default MinIO URL where binaries are
 // pulled from during MinIO upgrades
@@ -135,7 +135,7 @@ const ConsoleAdminPolicyName = "consoleAdmin"
 // KES Related Constants
 
 // DefaultKESImage specifies the latest KES Docker hub image
-const DefaultKESImage = "minio/kes:2024-06-17T15-47-05Z"
+const DefaultKESImage = "minio/kes:2025-03-12T09-35-18Z"
 
 // KESInstanceLabel is applied to the KES pods of a Tenant cluster
 const KESInstanceLabel = "v1.min.io/kes"

diff --git a/pkg/apis/minio.min.io/v2/types.go b/pkg/apis/minio.min.io/v2/types.go
@@ -30,7 +30,7 @@ import (
 // +kubebuilder:resource:scope=Namespaced,shortName=tenant,singular=tenant
 // +kubebuilder:printcolumn:name="State",type="string",JSONPath=".status.currentState"
 // +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp"
-// +kubebuilder:metadata:annotations=operator.min.io/version=v5.0.18
+// +kubebuilder:metadata:annotations=operator.min.io/version=v5.0.19
 // +kubebuilder:storageversion
 type Tenant struct {
 	metav1.TypeMeta   `json:",inline"`

diff --git a/pkg/apis/sts.min.io/v1alpha1/types.go b/pkg/apis/sts.min.io/v1alpha1/types.go
@@ -25,7 +25,7 @@ import (
 // +kubebuilder:resource:scope=Namespaced,shortName=policybinding,singular=policybinding
 // +kubebuilder:printcolumn:name="State",type="string",JSONPath=".status.currentState"
 // +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp"
-// +kubebuilder:metadata:annotations=operator.min.io/version=v5.0.18
+// +kubebuilder:metadata:annotations=operator.min.io/version=v5.0.19
 // +kubebuilder:storageversion
 
 // PolicyBinding is a https://kubernetes.io/docs/concepts/overview/working-with-objects/kubernetes-objects/[Kubernetes object] describing a MinIO PolicyBinding.

diff --git a/pkg/controller/operator.go b/pkg/controller/operator.go
@@ -61,7 +61,7 @@ const (
 	// DefaultDeploymentName is the default name of the operator deployment
 	DefaultDeploymentName = "minio-operator"
 	// DefaultOperatorImage is the version fo the operator being used
-	DefaultOperatorImage = "minio/operator:v5.0.18"
+	DefaultOperatorImage = "quay.io/minio/operator:v5.0.19"
 	// DefaultOperatorImageEnv is the default image to minio instance
 	DefaultOperatorImageEnv = "MINIO_OPERATOR_IMAGE"
 )

diff --git a/resources/base/console-ui.yaml b/resources/base/console-ui.yaml
@@ -289,7 +289,7 @@ spec:
         - args:
             - ui
             - --certs-dir=/tmp/certs
-          image: minio/operator:v5.0.18
+          image: quay.io/minio/operator:v5.0.19
           imagePullPolicy: IfNotPresent
           name: console
           securityContext:

diff --git a/resources/base/crds/job.min.io_miniojobs.yaml b/resources/base/crds/job.min.io_miniojobs.yaml
@@ -4,7 +4,7 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.17.2
-    operator.min.io/version: v5.0.18
+    operator.min.io/version: v5.0.19
   name: miniojobs.job.min.io
 spec:
   group: job.min.io

diff --git a/resources/base/crds/minio.min.io_tenants.yaml b/resources/base/crds/minio.min.io_tenants.yaml
@@ -4,7 +4,7 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.17.2
-    operator.min.io/version: v5.0.18
+    operator.min.io/version: v5.0.19
   name: tenants.minio.min.io
 spec:
   group: minio.min.io

diff --git a/resources/base/crds/sts.min.io_policybindings.yaml b/resources/base/crds/sts.min.io_policybindings.yaml
@@ -4,7 +4,7 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.17.2
-    operator.min.io/version: v5.0.18
+    operator.min.io/version: v5.0.19
   name: policybindings.sts.min.io
 spec:
   group: sts.min.io

diff --git a/resources/base/deployment.yaml b/resources/base/deployment.yaml
@@ -23,7 +23,7 @@ spec:
       serviceAccountName: minio-operator
       containers:
         - name: minio-operator
-          image: minio/operator:v5.0.18
+          image: quay.io/minio/operator:v5.0.19
           imagePullPolicy: IfNotPresent
           args:
             - controller

diff --git a/resources/kustomization.yaml b/resources/kustomization.yaml
@@ -5,7 +5,7 @@ commonAnnotations:
   operator.min.io/authors: "MinIO, Inc."
   operator.min.io/license: "AGPLv3"
   operator.min.io/support: "https://subnet.min.io"
-  operator.min.io/version: v5.0.18
+  operator.min.io/version: v5.0.19
 commonLabels:
   app.kubernetes.io/name: operator
 resources:

diff --git a/testing/console-tenant+kes.sh b/testing/console-tenant+kes.sh
@@ -120,7 +120,7 @@ function test_kes_tenant() {
 	sed -i -e 's/ROLE_ID/'"$ROLE_ID"'/g' "${SCRIPT_DIR}/kes-config.yaml"
 	sed -i -e 's/SECRET_ID/'"$SECRET_ID"'/g' "${SCRIPT_DIR}/kes-config.yaml"
 	cp "${SCRIPT_DIR}/kes-config.yaml" "${SCRIPT_DIR}/../examples/kustomization/tenant-kes-encryption/kes-configuration-secret.yaml"
-	yq e -i '.spec.kes.image = "minio/kes:2024-06-17T15-47-05Z"' "${SCRIPT_DIR}/../examples/kustomization/tenant-kes-encryption/tenant.yaml"
+	yq e -i '.spec.kes.image = "minio/kes:2025-03-12T09-35-18Z"' "${SCRIPT_DIR}/../examples/kustomization/tenant-kes-encryption/tenant.yaml"
 	kubectl apply -k "${SCRIPT_DIR}/../examples/kustomization/tenant-kes-encryption"
 
     echo "Check Tenant Status in tenant-kms-encrypted namespace for myminio:"