Skip to content

This is the multi-page printable view of this section. .

Return to the regular view of this page.

Troubleshooting

Overview

Report reproducible SILO problems to the SILO issue tracker. Include the Server and client versions, topology, relevant configuration with secrets removed, error messages, and a minimal reproduction. Report suspected vulnerabilities through the private security process.

SILO is independently maintained by PGSTY. MinIO SUBNET subscriptions and the former upstream Slack channel are not SILO support channels. Community assistance has no guaranteed response time or recovery SLA.

Tools

The maintained client is distributed as mcli; inherited references also use the compatible command name mc.

Inspect diagnostic files before sharing them. They may contain topology, configuration, metadata, or raw object content. See Encrypting Files.

Upgrades and Version Support

Use published releases and read the intervening release notes and security advisories. A source change or a planned release date does not establish public artifact availability.

Choosing an Upgrade

Prioritize fixes that affect your deployment and test the exact upgrade, workload, and recovery procedure before production. SILO does not promise the inherited upstream six-month support window. Follow the coordinated upgrade procedure; in-place mcli admin update and client mcli update are disabled for the maintained stack.

Version Alignment

The supported product combination is SILO Server, SILO Console, PGSTY mcli, and silo-pkg. KES is an optional, independently released service. Check the component matrix for the selected versions; do not infer compatibility solely from matching release dates. Compatibility with unmodified upstream MinIO/MC is best effort.

The retained MinIO Operator guides use the archived v7.1.1 snapshot. Validate that combination on your Kubernetes platform and pin the SILO image explicitly. Updating the Operator does not upgrade existing Tenant server images.

1 - Encrypting Files

Description

mcli support inspect downloads raw object data and metadata from the server’s underlying drives. PGSTY mcli saves diagnostic archives locally without requiring SUBNET registration or uploading anything automatically. Treat both the archive and its decryption key as sensitive material.

Encryption

Current SILO and mcli releases always encrypt support inspect output (there is no --encrypt flag on the command):

mcli support inspect 'mysilo/mybucket/myobject/xl.meta'

If no user-supplied support_public.pem is present in the client configuration directory, SILO generates a random one-time key and mcli prints the decryption key alongside the downloaded filename. Save that key immediately—it cannot be recovered later, and PGSTY does not embed any vendor decryption key.

If you provide support_public.pem, keep the matching private key safe. Quote paths containing wildcards so the shell passes the pattern directly to mcli. Because recursive inspection can pull object shards from multiple drives, collect only the specific files needed for troubleshooting.

Decryption

Build the inspect decryption utility from the maintained SILO source repository using the Go toolchain version required by that release:

git clone --branch RELEASE.2026-10-26T00-00-00Z --depth 1 https://github.com/pgsty/silo.git
cd silo/docs/debugging/inspect
go build -o inspect .

To decrypt an archive using the symmetric key printed during download:

./inspect -key=DECRYPTION_KEY /path/to/inspect.enc

If you omit -key and no private key file is specified, the utility prompts interactively for the decryption key.

To decrypt output encrypted with support_public.pem, pass the matching private key:

./inspect -private-key=/secure/path/support_private.pem /path/to/inspect.enc

With -key, the utility writes a decrypted ZIP archive next to the input file; with -private-key, it extracts the decrypted streams (including inspect.zip) into an output directory. Review the extracted files before sharing them, and note that unwrapping the inspect.enc diagnostic archive does not decrypt objects that are themselves stored with server-side encryption (SSE).