# Security Policy

## Supported Versions

We always provide security updates for the [latest release](https://github.com/minio/minio/releases/latest).
Whenever there is a security update you just need to upgrade to the latest version.

## Reporting a Vulnerability

All security bugs in [minio/minio](https://github,com/minio/minio) (or other minio/* repositories)
should be reported by email to ******@****.***. Your email will be acknowledged within 48 hours,

apiVersion: v1
kind: Service
metadata:
  name: {{ template "minio.fullname" . }}-console
  labels:
    app: {{ template "minio.name" . }}
    chart: {{ template "minio.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
  {{- if .Values.consoleService.annotations }}
  annotations: {{- toYaml .Values.consoleService.annotations | nindent 4 }}
  {{- end }}
spec:
  type: {{ .Values.consoleService.type }}

     *
     * Currently, we only enable VCS trigger for `master`/`release`/`releaseNx` branches.
     */
    val enableVcsTriggers: Boolean = nightlyPromotionTriggerHour != null

    companion object {
        private
        const val MASTER_BRANCH = "master"

        private
        const val RELEASE_BRANCH = "release"

        private
        const val EXPERIMENTAL_BRANCH = "experimental"

      {{- if .Values.pilot.enabled }}
      discoveryAddress: {{ printf "istiod-remote.%s.svc" .Release.Namespace }}:15012
      {{- else }}
      discoveryAddress: {{ printf "istiod.%s.svc" .Release.Namespace }}:15012
      {{- end }}
      {{- else }}
      discoveryAddress: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{.Release.Namespace}}.svc:15012
      {{- end }}
{{- end }}

WORK_DIR="$PWD/.verify-$RANDOM"
MINIO_CONFIG_DIR="$WORK_DIR/.minio"
MINIO_OLD=("$PWD/minio.RELEASE.2020-10-28T08-16-50Z" --config-dir "$MINIO_CONFIG_DIR" server)
MINIO=("$PWD/minio" --config-dir "$MINIO_CONFIG_DIR" server)

if [ ! -x "$PWD/minio" ]; then
	echo "minio executable binary not found in current directory"
	exit 1
fi

function download_old_release() {
	if [ ! -f minio.RELEASE.2020-10-28T08-16-50Z ]; then

apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
{{- if eq .Release.Namespace "istio-system"}}
  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
{{- else }}
  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
{{- end }}
  labels:

        if (contributorSectionBeginIndex == 0) {
            throw IllegalStateException("Can't find the contributors section in the release notes $releaseNotes.")
        }

  name: {{ template "minio.fullname" . }}
  labels:
    app: {{ template "minio.name" . }}
    chart: {{ template "minio.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
spec:
  podSelector:
    matchLabels:
      app: {{ template "minio.name" . }}
      release: {{ .Release.Name }}
  ingress:
    - ports:
        - port: {{ .Values.minioAPIPort }}
        - port: {{ .Values.minioConsolePort }}

{{ $gateway := index .Values "gateways" "istio-ingressgateway" }}
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: {{ $gateway.name }}-sds
  namespace: {{ .Release.Namespace }}
  labels:
    release: {{ .Release.Name }}
    istio.io/rev: {{ .Values.revision | default "default" | quote }}
    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
    operator.istio.io/component: "IngressGateways"
rules:

## For the release team

At the start of a release development cycle, the contents of `next` should be deleted
and replaced with those of `initial`. From the repo root:

    > cd doc
    > rm -r next/*
    > cp -r initial/* next

Then edit `next/1-intro.md` to refer to the next version.

To prepare the release notes for a release, run `golang.org/x/build/cmd/relnote generate`.