helm: apply placement values to the chart's hook Jobs (#11795)

* helm: honor placement values in the bucket creation hook

The post-install/post-upgrade bucket Job ignored nodeSelector,
tolerations and affinity, so it could land on nodes the operator
kept clear, or fail to schedule at all on a fully tainted cluster.

The hook now accepts nodeSelector, tolerations and affinity under
each createBucketsHook (filer.s3, s3, allInOne.s3), read from the
same values section that supplies createBuckets. Unset nodeSelector
and tolerations fall back to the workload the hook already borrows
its security context from; affinity is explicit-only since the
anti-affinity rules of a long-lived server do not suit a one-off
Job.

* helm: honor placement values in the volume resize hook

The pre-install/pre-upgrade resize Job inherited nothing from the
volume server, so on a cluster whose storage nodes are all tainted
the Job could not be scheduled and the upgrade timed out.

The hook now falls back to the volume server's nodeSelector and
tolerations, and accepts explicit nodeSelector, tolerations and
affinity under volume.resizeHook. Affinity stays explicit-only: the
default podAntiAffinity against component=volume would keep the Job
off every node already running a volume pod, which is most of them
during an upgrade. Placement strings are rendered through tpl with
$volumeName bound, same as the StatefulSet.

k8s/charts/seaweedfs/templates/shared/post-install-bucket-hook.yaml

@@ -18,9 +18,17 @@
 {{- $clusterFilerKey := printf "WEED_CLUSTER_%s_FILER" $clusterUpper }}
 {{- $podSecurityContext := .Values.filer.podSecurityContext }}
 {{- $containerSecurityContext := .Values.filer.containerSecurityContext }}
+{{- $nodeSelector := .Values.filer.nodeSelector }}
+{{- $tolerations := .Values.filer.tolerations }}
+{{- $createBucketsHook := .Values.filer.s3.createBucketsHook }}
 {{- if .Values.allInOne.enabled }}
   {{- $podSecurityContext = .Values.allInOne.podSecurityContext }}
   {{- $containerSecurityContext = .Values.allInOne.containerSecurityContext }}
+  {{- $nodeSelector = .Values.allInOne.nodeSelector }}
+  {{- $tolerations = .Values.allInOne.tolerations }}
+  {{- $createBucketsHook = .Values.allInOne.s3.createBucketsHook }}
+{{- else if .Values.s3.createBuckets }}
+  {{- $createBucketsHook = .Values.s3.createBucketsHook }}
 {{- end }}
 
 {{- /* Check allInOne mode first */}}
@@ -76,10 +84,18 @@ spec:
         app.kubernetes.io/instance: {{ .Release.Name | quote }}
         app.kubernetes.io/component: bucket-hook
     spec:
+      {{- with $createBucketsHook.affinity }}
+      affinity:
+        {{ tpl . $ | indent 8 | trim }}
+      {{- end }}
       restartPolicy: Never
       {{- if $podSecurityContext.enabled }}
       securityContext: {{- omit $podSecurityContext "enabled" | toYaml | nindent 8 }}
       {{- end }}
+      {{- with coalesce $createBucketsHook.tolerations $tolerations }}
+      tolerations:
+        {{ tpl . $ | indent 8 | trim }}
+      {{- end }}
       {{- include "seaweedfs.imagePullSecrets" $ | nindent 6 }}
       containers:
       - name: post-install-job
@@ -274,4 +290,8 @@ spec:
             secretName: {{ include "seaweedfs.fullname" . }}-client-cert
         {{- end }}
     {{- end }}
+      {{- with coalesce $createBucketsHook.nodeSelector $nodeSelector }}
+      nodeSelector:
+        {{ tpl . $ | indent 8 | trim }}
+      {{- end }}
 {{- end }}

k8s/charts/seaweedfs/templates/volume/volume-resize-hook.yaml

@@ -30,11 +30,19 @@ spec:
         app.kubernetes.io/instance: {{ .Release.Name | quote }}
         app.kubernetes.io/component: volume-resize-hook
     spec:
+      {{- with .Values.volume.resizeHook.affinity }}
+      affinity:
+        {{ tpl (printf "{{ $volumeName := \"volume\" }}%s" .) $ | indent 8 | trim }}
+      {{- end }}
       serviceAccountName: {{ $seaweedfsName }}-volume-resize-hook
       restartPolicy: Never
       {{- if .Values.volume.podSecurityContext.enabled }}
       securityContext: {{- omit .Values.volume.podSecurityContext "enabled" | toYaml | nindent 8 }}
       {{- end }}
+      {{- with coalesce .Values.volume.resizeHook.tolerations .Values.volume.tolerations }}
+      tolerations:
+        {{ tpl (printf "{{ $volumeName := \"volume\" }}%s" .) $ | indent 8 | trim }}
+      {{- end }}
       containers:
         - name: resize
           image: {{ .Values.volume.resizeHook.image }}
@@ -58,6 +66,10 @@ spec:
       volumes:
         {{- include "seaweedfs.tmpDirVolume" (list . .Values.volume.containerSecurityContext "" "" false) | nindent 8 }}
       {{- end }}
+      {{- with coalesce .Values.volume.resizeHook.nodeSelector .Values.volume.nodeSelector }}
+      nodeSelector:
+        {{ tpl (printf "{{ $volumeName := \"volume\" }}%s" .) $ | indent 8 | trim }}
+      {{- end }}
 ---
 apiVersion: v1
 kind: ServiceAccount

k8s/charts/seaweedfs/values.yaml

@@ -437,6 +437,10 @@ volume:
   resizeHook:
     enabled: true
     image: alpine/k8s:1.28.4
+    # nodeSelector and tolerations fall back to the volume server's when unset
+    nodeSelector: ""
+    tolerations: ""
+    affinity: ""
 
   # idx (the volume index) may use a separate PERSISTENT volume:
   #
@@ -1083,6 +1087,10 @@ filer:
     #     anonymousRead: false
     createBucketsHook:
       resources: {}
+      # nodeSelector and tolerations fall back to filer's when unset
+      nodeSelector: ""
+      tolerations: ""
+      affinity: ""
 
 s3:
   enabled: false
@@ -1305,6 +1313,10 @@ s3:
 
   createBucketsHook:
     resources: {}
+    # nodeSelector and tolerations fall back to filer's when unset
+    nodeSelector: ""
+    tolerations: ""
+    affinity: ""
 
   ingress:
     enabled: false
@@ -1927,6 +1939,10 @@ allInOne:
     #     anonymousRead: false
     createBucketsHook:
       resources: {}
+      # nodeSelector and tolerations fall back to allInOne's when unset
+      nodeSelector: ""
+      tolerations: ""
+      affinity: ""
 
   # SFTP server configuration
   # Note: Most parameters below default to null, which means they inherit from