encrypted. The encryption key has to be passed as environment variable.
- Run MinIO with KES (minio/kes) in combination with any supported KMS as
  secure key store. For example, you can run MinIO + KES + Hashicorp Vault.

> What about an exiting MinIO deployment? Can I just upgrade my cluster?

Yes, MinIO will try to transparently migrate any existing IAM data and either stores
it in plaintext (no KMS) or re-encrypts using the KMS.

package cmd

import (
	"context"
	"fmt"
	"runtime"
	"strconv"
	"time"

	"github.com/minio/madmin-go/v3"
	"github.com/minio/pkg/v2/env"
)

// healTask represents what to heal along with options
//
//	path: '/' =>  Heal disk formats along with metadata
//	path: 'bucket/' or '/bucket/' => Heal bucket
//	path: 'bucket/object' => Heal object
type healTask struct {
	bucket    string

		if netErr, ok := err.(*net.OpError); ok {
			return ErrPortAccess(netErr).Msg("Insufficient permissions to use specified port")
		}
	}

	// Failed to identify what type of error this, return a simple UI error
	return Err{msg: err.Error()}
}

// FmtError converts a fatal error message to a more clear error
// using some colors

				Object: fi.Name,
				Err:    fmt.Errorf("checksum type mismatch"),
			}
		}
	}

	var checksumCombined []byte

	// However, in case of encryption, the persisted part ETags don't match
	// what we have sent to the client during PutObjectPart. The reason is
	// that ETags are encrypted. Hence, the client will send a list of complete
	// part ETags of which non can match the ETag of any part. For example

### Data protection

Executing `xl-meta` will look for an `xl.meta` in the current folder and decode it to JSON. It is also possible to specify multiple files or wildcards, for example `xl-meta ./**/xl.meta` will output decoded metadata recursively. It is possible to view what inline data is stored inline in the metadata using `--data` parameter `xl-meta -data xl.json` will display an id -> data size. To export inline data to a file use the `--export` option.

### Remotely Inspecting backend data

title: ''
labels: community, triage
assignees: ''

---

**Is your feature request related to a problem? Please describe.**
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]

**Describe the solution you'd like**
A clear and concise description of what you want to happen.

**Describe alternatives you've considered**
A clear and concise description of any alternative solutions or features you've considered.

}

// xlMetaV2Version describes the journal entry, Type defines
// the current journal entry type other types might be nil based
// on what Type field carries, it is imperative for the caller
// to verify which journal type first before accessing rest of the fields.
type xlMetaV2Version struct {
	Type             VersionType           `json:"Type" msg:"Type"`

		// Fan-out requires no copying, and must be carried from original source
		// https://en.wikipedia.org/wiki/Copy_protection so the incoming stream
		// is always going to be in-memory as we cannot re-read from what we
		// wrote to disk - since that amounts to "copying" from a "copy"
		// instead of "copying" from source, we need the stream to be seekable
		// to ensure that we can make fan-out calls concurrently.

	timePartMinute         = "MINUTE"
	timePartSecond         = "SECOND"
	timePartTimezoneHour   = "TIMEZONE_HOUR"
	timePartTimezoneMinute = "TIMEZONE_MINUTE"
)

func extract(what string, t time.Time) (v *Value, err error) {
	switch what {
	case timePartYear:
		return FromInt(int64(t.Year())), nil
	case timePartMonth:
		return FromInt(int64(t.Month())), nil
	case timePartDay:
		return FromInt(int64(t.Day())), nil