tmpfile.Close()

			ekvs, err := minioEnvironFromFile(tmpfile.Name())
			if err != nil && !testCase.expectedErr {
				t.Error(err)
			}
			if err == nil && testCase.expectedErr {
				t.Error(errors.New("expected error, found success"))
			}

			if len(ekvs) != len(testCase.expectedEkvs) {
				t.Errorf("expected %v keys, got %v keys", len(testCase.expectedEkvs), len(ekvs))
			}

	}
	defer f.Close()
	var ekvs []envKV
	scanner := bufio.NewScanner(f)
	for scanner.Scan() {
		ekv, err := parsEnvEntry(scanner.Text())
		if err != nil {
			return nil, err
		}
		if ekv.Skip {
			// Skips empty lines
			continue
		}
		ekvs = append(ekvs, ekv)
	}
	if err = scanner.Err(); err != nil {
		return nil, err
	}
	return ekvs, nil
}

		config.BrowserSubSys:        browser.DefaultKVS,
	}
	maps.Copy(kvs, notify.DefaultNotificationKVS)
	maps.Copy(kvs, lambda.DefaultLambdaKVS)
	if globalIsErasure {
		kvs[config.StorageClassSubSys] = storageclass.DefaultKVS
		kvs[config.HealSubSys] = heal.DefaultKVS
	}
	config.RegisterDefaultKVS(kvs)

	// Captures help for each sub-system
	helpSubSys := config.HelpKVS{
		config.HelpKV{

	}

	srvCfg, err := readConfigWithoutMigrate(GlobalContext, objAPI)
	if err != nil {
		return err
	}

	bootstrapTraceMsg("lookup the configuration")

	// Override any values from ENVs.
	lookupConfigs(srvCfg, objAPI)

	// hold the mutex lock before a new config is assigned.
	globalServerConfigMu.Lock()
	globalServerConfig = srvCfg
	globalServerConfigMu.Unlock()

	return nil

	err = p.parseJSON(data)
	if err != nil {
		return err
	}

	m[policy] = p
	return nil
}

func (ies *IAMEtcdStore) getPolicyDocKV(ctx context.Context, kvs *mvccpb.KeyValue, m map[string]PolicyDoc) error {
	data, err := decryptData(kvs.Value, string(kvs.Key))
	if err != nil {
		if err == errConfigNotFound {
			return errNoSuchPolicy
		}
		return err
	}

	var p PolicyDoc
	err = p.parseJSON(data)

			cfg := config.New()
			cfg[config.LambdaWebhookSubSys] = map[string]config.KVS{
				functionID: {
					{Key: "endpoint", Value: lambdaServer.URL},
					{Key: "enable", Value: config.EnableOn},
				},
			}
			cfg[config.APISubSys] = map[string]config.KVS{
				"api": {
					{Key: "gzip", Value: config.EnableOff},
				},
			}

			var err error

			// This is a JSON object type (that preserves key order)
			kvs, ok := mv.Value.(jstream.KVS)
			if ok {
				for _, kv := range kvs {
					if sset.Contains(kv.Key) {
						// Reject duplicate conditions or expiration.
						return nil, fmt.Errorf("input policy has multiple %s, please fix your client code", kv.Key)
					}
					sset.Add(kv.Key)
				}
			}
			e.Encode(kvs)
		}
	}
	return &buf, d.Err()
}

```
export MINIO_ETCD_ENDPOINTS=http://localhost:2379
minio server /data
```

NOTE: If `etcd` is configured with `Client-to-server authentication with HTTPS client certificates` then you need to use additional envs such as `MINIO_ETCD_CLIENT_CERT` pointing to path to `etcd-client.crt` and `MINIO_ETCD_CLIENT_CERT_KEY` path to `etcd-client.key` .

### 4. Test with MinIO STS API

   └─ public.crt
```

You can provide a custom certs directory using `--certs-dir` command line option.

#### Credentials

On MinIO admin credentials or root credentials are only allowed to be changed using ENVs namely `MINIO_ROOT_USER` and `MINIO_ROOT_PASSWORD`.

```sh
export MINIO_ROOT_USER=minio
export MINIO_ROOT_PASSWORD=minio13
minio server /data
```

#### Site

```
KEY:

		if err == nil {
			return true
		}
	}
	if osIsNotExist(err) {
		// if none of the files are present we may be running inside
		// CRI-O, Containerd etc..
		// Fallback to our container specific ENVs if they are set.
		return env.IsSet("MINIO_ACCESS_KEY_FILE")
	}

	// Log error, as we will not propagate it to caller
	internalLogIf(GlobalContext, err)

	return err == nil
}