create topic and report topic

do create topic
implement create topic
2026-10-02 04:32:42 +00:00 · 2023-09-24 22:00:43 -07:00 · 2023-09-24 22:00:43 -07:00 · 2023-09-24 22:00:43 -07:00 · 2023-09-24 22:00:43 -07:00 · 2023-09-24 21:29:31 -07:00
264 changed files with 14367 additions and 7291 deletions
@@ -38,13 +38,13 @@ jobs:
    steps:

      - name: Check out code into the Go module directory
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v2
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v2

      - name: Set BUILD_TIME env
        run: echo BUILD_TIME=$(date -u +%Y%m%d-%H%M) >> ${GITHUB_ENV}

      - name: Go Release Binaries Large Disk
-        uses: wangyoucao577/go-release-action@0aa3e4818bacdeab4f9a97f768d3a54734a5852e # v1.22
+        uses: wangyoucao577/go-release-action@2ac3035fa4c4feed6a8272ce278b0577b93cf8e5 # v1.22
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          goos: ${{ matrix.goos }}
@@ -53,14 +53,14 @@ jobs:
          overwrite: true
          pre_command: export CGO_ENABLED=0 && export GODEBUG=http2client=0
          build_flags: -tags 5BytesOffset # optional, default is
-          ldflags: -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=${{github.sha}}
+          ldflags: -s -w -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=${{github.sha}}
          # Where to run `go build .`
          project_path: weed
          binary_name: weed-large-disk
          asset_name: "weed-large-disk-${{ env.BUILD_TIME }}-${{ matrix.goos }}-${{ matrix.goarch }}"

      - name: Go Release Binaries Normal Volume Size
-        uses: wangyoucao577/go-release-action@0aa3e4818bacdeab4f9a97f768d3a54734a5852e # v1.22
+        uses: wangyoucao577/go-release-action@2ac3035fa4c4feed6a8272ce278b0577b93cf8e5 # v1.22
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          goos: ${{ matrix.goos }}
@@ -68,7 +68,7 @@ jobs:
          release_tag: dev
          overwrite: true
          pre_command: export CGO_ENABLED=0 && export GODEBUG=http2client=0
-          ldflags: -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=${{github.sha}}
+          ldflags: -s -w -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=${{github.sha}}
          # Where to run `go build .`
          project_path: weed
          binary_name: weed-normal-disk
@@ -87,13 +87,13 @@ jobs:
    steps:

      - name: Check out code into the Go module directory
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v2
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v2

      - name: Set BUILD_TIME env
        run: echo BUILD_TIME=$(date -u +%Y%m%d-%H%M) >> ${GITHUB_ENV}

      - name: Go Release Binaries Large Disk
-        uses: wangyoucao577/go-release-action@0aa3e4818bacdeab4f9a97f768d3a54734a5852e # v1.22
+        uses: wangyoucao577/go-release-action@2ac3035fa4c4feed6a8272ce278b0577b93cf8e5 # v1.22
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          goos: ${{ matrix.goos }}
@@ -102,14 +102,14 @@ jobs:
          overwrite: true
          pre_command: export CGO_ENABLED=0 && export GODEBUG=http2client=0
          build_flags: -tags 5BytesOffset # optional, default is
-          ldflags: -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=${{github.sha}}
+          ldflags: -s -w -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=${{github.sha}}
          # Where to run `go build .`
          project_path: weed
          binary_name: weed-large-disk
          asset_name: "weed-large-disk-${{ env.BUILD_TIME }}-${{ matrix.goos }}-${{ matrix.goarch }}"

      - name: Go Release Binaries Normal Volume Size
-        uses: wangyoucao577/go-release-action@0aa3e4818bacdeab4f9a97f768d3a54734a5852e # v1.22
+        uses: wangyoucao577/go-release-action@2ac3035fa4c4feed6a8272ce278b0577b93cf8e5 # v1.22
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          goos: ${{ matrix.goos }}
@@ -117,7 +117,7 @@ jobs:
          release_tag: dev
          overwrite: true
          pre_command: export CGO_ENABLED=0 && export GODEBUG=http2client=0
-          ldflags: -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=${{github.sha}}
+          ldflags: -s -w -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=${{github.sha}}
          # Where to run `go build .`
          project_path: weed
          binary_name: weed-normal-disk
@@ -28,9 +28,9 @@ jobs:
    # Steps represent a sequence of tasks that will be executed as part of the job
    steps:
      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v2
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v2
      - name: Go Release Binaries Normal Volume Size
-        uses: wangyoucao577/go-release-action@0aa3e4818bacdeab4f9a97f768d3a54734a5852e # v1.22
+        uses: wangyoucao577/go-release-action@2ac3035fa4c4feed6a8272ce278b0577b93cf8e5 # v1.22
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          goos: ${{ matrix.goos }}
@@ -38,13 +38,13 @@ jobs:
          overwrite: true
          pre_command: export CGO_ENABLED=0 && export GODEBUG=http2client=0
          # build_flags: -tags 5BytesOffset # optional, default is
-          ldflags: -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=${{github.sha}}
+          ldflags: -s -w -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=${{github.sha}}
          # Where to run `go build .`
          project_path: weed
          binary_name: weed
          asset_name: "${{ matrix.goos }}_${{ matrix.goarch }}"
      - name: Go Release Large Disk Binaries
-        uses: wangyoucao577/go-release-action@0aa3e4818bacdeab4f9a97f768d3a54734a5852e # v1.22
+        uses: wangyoucao577/go-release-action@2ac3035fa4c4feed6a8272ce278b0577b93cf8e5 # v1.22
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          goos: ${{ matrix.goos }}
@@ -52,7 +52,7 @@ jobs:
          overwrite: true
          pre_command: export CGO_ENABLED=0 && export GODEBUG=http2client=0
          build_flags: -tags 5BytesOffset # optional, default is
-          ldflags: -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=${{github.sha}}
+          ldflags: -s -w -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=${{github.sha}}
          # Where to run `go build .`
          project_path: weed
          binary_name: weed
@@ -28,9 +28,9 @@ jobs:
    # Steps represent a sequence of tasks that will be executed as part of the job
    steps:
      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v2
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v2
      - name: Go Release Binaries Normal Volume Size
-        uses: wangyoucao577/go-release-action@0aa3e4818bacdeab4f9a97f768d3a54734a5852e # v1.22
+        uses: wangyoucao577/go-release-action@2ac3035fa4c4feed6a8272ce278b0577b93cf8e5 # v1.22
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          goos: ${{ matrix.goos }}
@@ -38,13 +38,13 @@ jobs:
          overwrite: true
          pre_command: export CGO_ENABLED=0 && export GODEBUG=http2client=0
          # build_flags: -tags 5BytesOffset # optional, default is
-          ldflags: -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=${{github.sha}}
+          ldflags: -s -w -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=${{github.sha}}
          # Where to run `go build .`
          project_path: weed
          binary_name: weed
          asset_name: "${{ matrix.goos }}_${{ matrix.goarch }}"
      - name: Go Release Large Disk Binaries
-        uses: wangyoucao577/go-release-action@0aa3e4818bacdeab4f9a97f768d3a54734a5852e # v1.22
+        uses: wangyoucao577/go-release-action@2ac3035fa4c4feed6a8272ce278b0577b93cf8e5 # v1.22
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          goos: ${{ matrix.goos }}
@@ -52,7 +52,7 @@ jobs:
          overwrite: true
          pre_command: export CGO_ENABLED=0 && export GODEBUG=http2client=0
          build_flags: -tags 5BytesOffset # optional, default is
-          ldflags: -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=${{github.sha}}
+          ldflags: -s -w -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=${{github.sha}}
          # Where to run `go build .`
          project_path: weed
          binary_name: weed
@@ -28,9 +28,9 @@ jobs:
    # Steps represent a sequence of tasks that will be executed as part of the job
    steps:
      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v2
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v2
      - name: Go Release Binaries Normal Volume Size
-        uses: wangyoucao577/go-release-action@0aa3e4818bacdeab4f9a97f768d3a54734a5852e # v1.22
+        uses: wangyoucao577/go-release-action@2ac3035fa4c4feed6a8272ce278b0577b93cf8e5 # v1.22
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          goos: ${{ matrix.goos }}
@@ -38,13 +38,13 @@ jobs:
          overwrite: true
          pre_command: export CGO_ENABLED=0 && export GODEBUG=http2client=0
          # build_flags: -tags 5BytesOffset # optional, default is
-          ldflags: -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=${{github.sha}}
+          ldflags: -s -w -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=${{github.sha}}
          # Where to run `go build .`
          project_path: weed
          binary_name: weed
          asset_name: "${{ matrix.goos }}_${{ matrix.goarch }}"
      - name: Go Release Large Disk Binaries
-        uses: wangyoucao577/go-release-action@0aa3e4818bacdeab4f9a97f768d3a54734a5852e # v1.22
+        uses: wangyoucao577/go-release-action@2ac3035fa4c4feed6a8272ce278b0577b93cf8e5 # v1.22
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          goos: ${{ matrix.goos }}
@@ -52,7 +52,7 @@ jobs:
          overwrite: true
          pre_command: export CGO_ENABLED=0 && export GODEBUG=http2client=0
          build_flags: -tags 5BytesOffset # optional, default is
-          ldflags: -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=${{github.sha}}
+          ldflags: -s -w -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=${{github.sha}}
          # Where to run `go build .`
          project_path: weed
          binary_name: weed
@@ -28,9 +28,9 @@ jobs:
    # Steps represent a sequence of tasks that will be executed as part of the job
    steps:
      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v2
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v2
      - name: Go Release Binaries Normal Volume Size
-        uses: wangyoucao577/go-release-action@0aa3e4818bacdeab4f9a97f768d3a54734a5852e # v1.22
+        uses: wangyoucao577/go-release-action@2ac3035fa4c4feed6a8272ce278b0577b93cf8e5 # v1.22
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          goos: ${{ matrix.goos }}
@@ -38,13 +38,13 @@ jobs:
          overwrite: true
          pre_command: export CGO_ENABLED=0 && export GODEBUG=http2client=0
          # build_flags: -tags 5BytesOffset # optional, default is
-          ldflags: -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=${{github.sha}}
+          ldflags: -s -w -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=${{github.sha}}
          # Where to run `go build .`
          project_path: weed
          binary_name: weed
          asset_name: "${{ matrix.goos }}_${{ matrix.goarch }}"
      - name: Go Release Large Disk Binaries
-        uses: wangyoucao577/go-release-action@0aa3e4818bacdeab4f9a97f768d3a54734a5852e # v1.22
+        uses: wangyoucao577/go-release-action@2ac3035fa4c4feed6a8272ce278b0577b93cf8e5 # v1.22
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          goos: ${{ matrix.goos }}
@@ -52,7 +52,7 @@ jobs:
          overwrite: true
          pre_command: export CGO_ENABLED=0 && export GODEBUG=http2client=0
          build_flags: -tags 5BytesOffset # optional, default is
-          ldflags: -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=${{github.sha}}
+          ldflags: -s -w -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=${{github.sha}}
          # Where to run `go build .`
          project_path: weed
          binary_name: weed
@@ -28,9 +28,9 @@ jobs:
    # Steps represent a sequence of tasks that will be executed as part of the job
    steps:
      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v2
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v2
      - name: Go Release Binaries Normal Volume Size
-        uses: wangyoucao577/go-release-action@0aa3e4818bacdeab4f9a97f768d3a54734a5852e # v1.22
+        uses: wangyoucao577/go-release-action@2ac3035fa4c4feed6a8272ce278b0577b93cf8e5 # v1.22
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          goos: ${{ matrix.goos }}
@@ -39,13 +39,13 @@ jobs:
          build_flags: -tags elastic,ydb,gocdk,tikv
          pre_command: export CGO_ENABLED=0 && export GODEBUG=http2client=0
          # build_flags: -tags 5BytesOffset # optional, default is
-          ldflags: -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=${{github.sha}}
+          ldflags: -s -w -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=${{github.sha}}
          # Where to run `go build .`
          project_path: weed
          binary_name: weed
          asset_name: "${{ matrix.goos }}_${{ matrix.goarch }}_full"
      - name: Go Release Large Disk Binaries
-        uses: wangyoucao577/go-release-action@0aa3e4818bacdeab4f9a97f768d3a54734a5852e # v1.22
+        uses: wangyoucao577/go-release-action@2ac3035fa4c4feed6a8272ce278b0577b93cf8e5 # v1.22
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          goos: ${{ matrix.goos }}
@@ -53,7 +53,7 @@ jobs:
          overwrite: true
          pre_command: export CGO_ENABLED=0 && export GODEBUG=http2client=0
          build_flags: -tags 5BytesOffset,elastic,ydb,gocdk,tikv
-          ldflags: -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=${{github.sha}}
+          ldflags: -s -w -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=${{github.sha}}
          # Where to run `go build .`
          project_path: weed
          binary_name: weed
@@ -18,7 +18,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac

      # Initializes the CodeQL tools for scanning.
      - name: Initialize CodeQL
@@ -16,11 +16,11 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v2
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v2
      -
        name: Docker meta
        id: docker_meta
-        uses: docker/metadata-action@c4ee3adeed93b1fa6a762f209fb01608c1a22f1e # v3
+        uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v3
        with:
          images: |
            chrislusf/seaweedfs
@@ -33,30 +33,30 @@ jobs:
            org.opencontainers.image.vendor=Chris Lu
      -
        name: Set up QEMU
-        uses: docker/setup-qemu-action@e81a89b1732b9c48d79cd809d8d81d79c4647a18 # v1
+        uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v1
      -
        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4b4e9c3e2d4531116a6f8ba8e71fc6e2cb6e6c8c # v1
+        uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v1
        with:
          buildkitd-flags: "--debug"
      -
        name: Login to Docker Hub
        if: github.event_name != 'pull_request'
-        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v1
+        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v1
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      -
        name: Login to GHCR
        if: github.event_name != 'pull_request'
-        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v1
+        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v1
        with:
          registry: ghcr.io
          username: ${{ secrets.GHCR_USERNAME }}
          password: ${{ secrets.GHCR_TOKEN }}
      -
        name: Build
-        uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671 # v2
+        uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v2
        with:
          context: ./docker
          push: ${{ github.event_name != 'pull_request' }}
@@ -17,11 +17,11 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v2
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v2
      -
        name: Docker meta
        id: docker_meta
-        uses: docker/metadata-action@c4ee3adeed93b1fa6a762f209fb01608c1a22f1e # v3
+        uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v3
        with:
          images: |
            chrislusf/seaweedfs
@@ -34,30 +34,30 @@ jobs:
            org.opencontainers.image.vendor=Chris Lu
      -
        name: Set up QEMU
-        uses: docker/setup-qemu-action@e81a89b1732b9c48d79cd809d8d81d79c4647a18 # v1
+        uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v1
      -
        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4b4e9c3e2d4531116a6f8ba8e71fc6e2cb6e6c8c # v1
+        uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v1
        with:
          buildkitd-flags: "--debug"
      -
        name: Login to Docker Hub
        if: github.event_name != 'pull_request'
-        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v1
+        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v1
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      -
        name: Login to GHCR
        if: github.event_name != 'pull_request'
-        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v1
+        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v1
        with:
          registry: ghcr.io
          username: ${{ secrets.GHCR_USERNAME }}
          password: ${{ secrets.GHCR_TOKEN }}
      -
        name: Build
-        uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671 # v2
+        uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v2
        with:
          context: ./docker
          push: ${{ github.event_name != 'pull_request' }}
@@ -16,11 +16,11 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v2
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v2
      -
        name: Docker meta
        id: docker_meta
-        uses: docker/metadata-action@c4ee3adeed93b1fa6a762f209fb01608c1a22f1e # v3
+        uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v3
        with:
          images: |
            chrislusf/seaweedfs
@@ -34,20 +34,20 @@ jobs:
            org.opencontainers.image.vendor=Chris Lu
      -
        name: Set up QEMU
-        uses: docker/setup-qemu-action@e81a89b1732b9c48d79cd809d8d81d79c4647a18 # v1
+        uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v1
      -
        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4b4e9c3e2d4531116a6f8ba8e71fc6e2cb6e6c8c # v1
+        uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v1
      -
        name: Login to Docker Hub
        if: github.event_name != 'pull_request'
-        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v1
+        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v1
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      -
        name: Build
-        uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671 # v2
+        uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v2
        with:
          context: ./docker
          push: ${{ github.event_name != 'pull_request' }}
@@ -17,11 +17,11 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v2
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v2
      -
        name: Docker meta
        id: docker_meta
-        uses: docker/metadata-action@c4ee3adeed93b1fa6a762f209fb01608c1a22f1e # v3
+        uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v3
        with:
          images: |
            chrislusf/seaweedfs
@@ -35,20 +35,20 @@ jobs:
            org.opencontainers.image.vendor=Chris Lu
      -
        name: Set up QEMU
-        uses: docker/setup-qemu-action@e81a89b1732b9c48d79cd809d8d81d79c4647a18 # v1
+        uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v1
      -
        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4b4e9c3e2d4531116a6f8ba8e71fc6e2cb6e6c8c # v1
+        uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v1
      -
        name: Login to Docker Hub
        if: github.event_name != 'pull_request'
-        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v1
+        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v1
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      -
        name: Build
-        uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671 # v2
+        uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v2
        with:
          context: ./docker
          push: ${{ github.event_name != 'pull_request' }}
@@ -17,11 +17,11 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v2
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v2
      -
        name: Docker meta
        id: docker_meta
-        uses: docker/metadata-action@c4ee3adeed93b1fa6a762f209fb01608c1a22f1e # v3
+        uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v3
        with:
          images: |
            chrislusf/seaweedfs
@@ -35,20 +35,20 @@ jobs:
            org.opencontainers.image.vendor=Chris Lu
      -
        name: Set up QEMU
-        uses: docker/setup-qemu-action@e81a89b1732b9c48d79cd809d8d81d79c4647a18 # v1
+        uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v1
      -
        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4b4e9c3e2d4531116a6f8ba8e71fc6e2cb6e6c8c # v1
+        uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v1
      -
        name: Login to Docker Hub
        if: github.event_name != 'pull_request'
-        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v1
+        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v1
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      -
        name: Build
-        uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671 # v2
+        uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v2
        with:
          context: ./docker
          push: ${{ github.event_name != 'pull_request' }}
@@ -16,11 +16,11 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v2
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v2
      -
        name: Docker meta
        id: docker_meta
-        uses: docker/metadata-action@c4ee3adeed93b1fa6a762f209fb01608c1a22f1e # v3
+        uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v3
        with:
          images: |
            chrislusf/seaweedfs
@@ -34,20 +34,20 @@ jobs:
            org.opencontainers.image.vendor=Chris Lu
      -
        name: Set up QEMU
-        uses: docker/setup-qemu-action@e81a89b1732b9c48d79cd809d8d81d79c4647a18 # v1
+        uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v1
      -
        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4b4e9c3e2d4531116a6f8ba8e71fc6e2cb6e6c8c # v1
+        uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v1
      -
        name: Login to Docker Hub
        if: github.event_name != 'pull_request'
-        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v1
+        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v1
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      -
        name: Build
-        uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671 # v2
+        uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v2
        with:
          context: ./docker
          push: ${{ github.event_name != 'pull_request' }}
@@ -16,11 +16,11 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v2
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v2
      -
        name: Docker meta
        id: docker_meta
-        uses: docker/metadata-action@c4ee3adeed93b1fa6a762f209fb01608c1a22f1e # v3
+        uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v3
        with:
          images: |
            chrislusf/seaweedfs
@@ -34,20 +34,20 @@ jobs:
            org.opencontainers.image.vendor=Chris Lu
      -
        name: Set up QEMU
-        uses: docker/setup-qemu-action@e81a89b1732b9c48d79cd809d8d81d79c4647a18 # v1
+        uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v1
      -
        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4b4e9c3e2d4531116a6f8ba8e71fc6e2cb6e6c8c # v1
+        uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v1
      -
        name: Login to Docker Hub
        if: github.event_name != 'pull_request'
-        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v1
+        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v1
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      -
        name: Build
-        uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671 # v2
+        uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v2
        with:
          context: ./docker
          push: ${{ github.event_name != 'pull_request' }}
@@ -9,6 +9,6 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: 'Checkout Repository'
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
      - name: 'Dependency Review'
-        uses: actions/dependency-review-action@f46c48ed6d4f1227fb2d9ea62bf6bcbed315589e
+        uses: actions/dependency-review-action@6c5ccdad469c9f8a2996bfecaec55a631a347034
@@ -21,16 +21,16 @@ jobs:
  e2e:
    name: FUSE Mount
    runs-on: ubuntu-22.04
-    timeout-minutes: 15
+    timeout-minutes: 30
    steps:
    - name: Set up Go 1.x
-      uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v2
+      uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v2
      with:
        go-version: ^1.13
      id: go

    - name: Check out code into the Go module directory
-      uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v2
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v2

    - name: Install dependencies
      run: |
@@ -41,20 +41,20 @@ jobs:
      timeout-minutes: 5
      run: make build_e2e && docker compose -f ./compose/e2e-mount.yml up --wait

-    - name: Run FIO
+    - name: Run FIO 4k
      timeout-minutes: 15
      run: |
        echo "Starting FIO at: $(date)"
        # Concurrent r/w
        echo 'Run randrw with size=16M bs=4k'
-        docker compose -f ./compose/e2e-mount.yml exec mount timeout -k5 60 fio --name=fiotest --filename=/mnt/seaweedfs/fiotest --size=16M --rw=randrw --bs=4k --direct=1 --numjobs=8 --ioengine=libaio --iodepth=32 --group_reporting --runtime=30 --time_based=1
+        docker compose -f ./compose/e2e-mount.yml exec mount timeout -k5 60 fio --name=fiotest --filename=/mnt/seaweedfs/fiotest --size=16M --rw=randrw --bs=4k --direct=1 --numjobs=8 --ioengine=libaio --group_reporting --runtime=30 --time_based=1

        echo "Verify FIO at: $(date)"
        # Verified write
        echo 'Run randwrite with size=16M bs=4k'
        docker compose -f ./compose/e2e-mount.yml exec mount timeout -k5 60 fio --name=fiotest --filename=/mnt/seaweedfs/fiotest --size=16M --rw=randwrite --bs=4k --direct=1 --numjobs=8 --ioengine=libaio --iodepth=32 --group_reporting --runtime=30 --time_based=1 --do_verify=0 --verify=crc32c --verify_backlog=1

-    - name: Run FIO
+    - name: Run FIO 128k
      timeout-minutes: 15
      run: |
        echo "Starting FIO at: $(date)"
@@ -67,7 +67,7 @@ jobs:
        echo 'Run randwrite with size=16M bs=128k'
        docker compose -f ./compose/e2e-mount.yml exec mount timeout -k5 60 fio --name=fiotest --filename=/mnt/seaweedfs/fiotest --size=16M --rw=randwrite --bs=128k --direct=1 --numjobs=8 --ioengine=libaio --iodepth=32 --group_reporting --runtime=30 --time_based=1 --do_verify=0 --verify=crc32c --verify_backlog=1

-    - name: Run FIO
+    - name: Run FIO 1MB
      timeout-minutes: 15
      run: |
        echo "Starting FIO at: $(date)"
@@ -21,13 +21,13 @@ jobs:
    steps:

    - name: Set up Go 1.x
-      uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v2
+      uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v2
      with:
        go-version: ^1.13
      id: go

    - name: Check out code into the Go module directory
-      uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v2
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v2

    - name: Get dependencies
      run: |
@@ -12,7 +12,7 @@ jobs:
  release:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
      - name: Publish Helm charts
        uses: stefanprodan/helm-gh-pages@master
        with:          
@@ -16,7 +16,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
        with:
          fetch-depth: 0

@@ -45,7 +45,7 @@ jobs:
        run: ct lint --all --validate-maintainers=false --chart-dirs k8s/charts

      - name: Create kind cluster
-        uses: helm/kind-action@v1.5.0
+        uses: helm/kind-action@v1.8.0

      - name: Run chart-testing (install)
        run: ct install --all --chart-dirs k8s/charts
@@ -87,3 +87,4 @@ other/java/hdfs/dependency-reduced-pom.xml

 # binary file
 weed/weed
+weed/mq/client/cmd/weed_pub/weed_pub
@@ -121,7 +121,7 @@ SeaweedFS can transparently integrate with the cloud.
 With hot data on local cluster, and warm data on the cloud with O(1) access time, 
 SeaweedFS can achieve both fast local access time and elastic cloud storage capacity.
 What's more, the cloud storage access API cost is minimized. 
-Faster and Cheaper than direct cloud storage!
+Faster and cheaper than direct cloud storage!

 [Back to TOC](#table-of-contents)

@@ -132,7 +132,7 @@ Faster and Cheaper than direct cloud storage!
 * Automatic Gzip compression depending on file MIME type.
 * Automatic compaction to reclaim disk space after deletion or update.
 * [Automatic entry TTL expiration][VolumeServerTTL].
-* Any server with some disk spaces can add to the total storage space.
+* Any server with some disk space can add to the total storage space.
 * Adding/Removing servers does **not** cause any data re-balancing unless triggered by admin commands.
 * Optional picture resizing.
 * Support ETag, Accept-Range, Last-Modified, etc.
@@ -145,7 +145,7 @@ Faster and Cheaper than direct cloud storage!
 [Back to TOC](#table-of-contents)

 ## Filer Features ##
-* [Filer server][Filer] provides "normal" directories and files via http.
+* [Filer server][Filer] provides "normal" directories and files via HTTP.
 * [File TTL][FilerTTL] automatically expires file metadata and actual file data.
 * [Mount filer][Mount] reads and writes files directly as a local directory via FUSE.
 * [Filer Store Replication][FilerStoreReplication] enables HA for filer meta data stores.
@@ -8,6 +8,7 @@
 - [Evercam Camera Management Software](https://evercam.io/)
 - [Spherical Elephant GmbH](https://www.sphericalelephant.com)
 - [WizardTales GmbH](https://www.wizardtales.com)
+- [Nimbus Web Services](https://nimbusws.com)

 - <h2 align="center">Backers</h2>

@@ -3,7 +3,7 @@ FROM golang:1.20-buster as builder
 RUN apt-get update
 RUN apt-get install -y build-essential libsnappy-dev zlib1g-dev libbz2-dev libgflags-dev liblz4-dev libzstd-dev

-ENV ROCKSDB_VERSION v7.5.3
+ENV ROCKSDB_VERSION v8.1.1

 # build RocksDB
 RUN cd /tmp && \
@@ -3,7 +3,7 @@ FROM golang:1.20-buster as builder
 RUN apt-get update
 RUN apt-get install -y build-essential libsnappy-dev zlib1g-dev libbz2-dev libgflags-dev liblz4-dev libzstd-dev

-ENV ROCKSDB_VERSION v7.5.3
+ENV ROCKSDB_VERSION v8.1.1

 # build RocksDB
 RUN cd /tmp && \
@@ -8,7 +8,7 @@ cgo ?= 0
 binary:
 	export SWCOMMIT=$(shell git rev-parse --short HEAD)
 	export SWLDFLAGS="-X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=$(SWCOMMIT)"
-	cd ../weed && CGO_ENABLED=$(cgo) GOOS=linux go build $(options) -tags "$(tags)" -ldflags "-extldflags -static $(SWLDFLAGS)" && mv weed ../docker/
+	cd ../weed && CGO_ENABLED=$(cgo) GOOS=linux go build $(options) -tags "$(tags)" -ldflags "-s -w -extldflags -static $(SWLDFLAGS)" && mv weed ../docker/

 binary_race: options = -race
 binary_race: cgo = 1
@@ -29,7 +29,7 @@ go_build_large_disk:
 build_rocksdb_dev_env:
 	docker build --no-cache -t chrislusf/rocksdb_dev_env -f Dockerfile.rocksdb_dev_env .

-build_rocksdb_local:
+build_rocksdb_local: build_rocksdb_dev_env
 	cd .. ; docker build --no-cache -t chrislusf/seaweedfs:rocksdb_local -f docker/Dockerfile.rocksdb_large_local .

 build_rocksdb:
@@ -18,10 +18,10 @@ bucket prefix = yournamehere-{random}-

 [s3 main]
 # main display_name set in vstart.sh
-display_name = M. Tester
+display_name = s3_tests

 # main user_idname set in vstart.sh
-user_id = testid
+user_id = s3_tests

 # main email set in vstart.sh
 email = tester@ceph.com
@@ -3,13 +3,13 @@ module github.com/seaweedfs/seaweedfs
 go 1.20

 require (
-	cloud.google.com/go v0.110.0 // indirect
-	cloud.google.com/go/pubsub v1.30.0
-	cloud.google.com/go/storage v1.30.1
+	cloud.google.com/go v0.110.7 // indirect
+	cloud.google.com/go/pubsub v1.33.0
+	cloud.google.com/go/storage v1.32.0
 	github.com/Azure/azure-pipeline-go v0.2.3
 	github.com/Azure/azure-storage-blob-go v0.15.0
 	github.com/Shopify/sarama v1.38.1
-	github.com/aws/aws-sdk-go v1.44.258
+	github.com/aws/aws-sdk-go v1.44.314
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bwmarrin/snowflake v0.3.0
 	github.com/cenkalti/backoff/v4 v4.2.1
@@ -28,23 +28,23 @@ require (
 	github.com/facebookgo/stack v0.0.0-20160209184415-751773369052 // indirect
 	github.com/facebookgo/stats v0.0.0-20151006221625-1b76add642e4
 	github.com/facebookgo/subset v0.0.0-20200203212716-c811ad88dec4 // indirect
-	github.com/fclairamb/ftpserverlib v0.21.0
+	github.com/fclairamb/ftpserverlib v0.22.0
 	github.com/fsnotify/fsnotify v1.6.0 // indirect
 	github.com/go-errors/errors v1.1.1 // indirect
 	github.com/go-redis/redis/v8 v8.11.5
-	github.com/go-redsync/redsync/v4 v4.8.1
+	github.com/go-redsync/redsync/v4 v4.8.2
 	github.com/go-sql-driver/mysql v1.7.1
 	github.com/go-zookeeper/zk v1.0.3 // indirect
-	github.com/gocql/gocql v1.4.0
-	github.com/golang-jwt/jwt v3.2.2+incompatible
+	github.com/gocql/gocql v1.6.0
+	github.com/golang-jwt/jwt v3.2.2+incompatible // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.3
 	github.com/golang/snappy v0.0.4 // indirect
 	github.com/google/btree v1.1.2
 	github.com/google/go-cmp v0.5.9 // indirect
-	github.com/google/uuid v1.3.0
+	github.com/google/uuid v1.3.1
 	github.com/google/wire v0.5.0 // indirect
-	github.com/googleapis/gax-go/v2 v2.7.1 // indirect
+	github.com/googleapis/gax-go/v2 v2.12.0 // indirect
 	github.com/gorilla/mux v1.8.0
 	github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
@@ -53,19 +53,19 @@ require (
 	github.com/hashicorp/hcl v1.0.0 // indirect
 	github.com/jcmturner/gofork v1.7.6 // indirect
 	github.com/jcmturner/gokrb5/v8 v8.4.4 // indirect
-	github.com/jinzhu/copier v0.3.5
+	github.com/jinzhu/copier v0.4.0
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/json-iterator/go v1.1.12
 	github.com/karlseguin/ccache/v2 v2.0.8
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
-	github.com/klauspost/compress v1.16.0 // indirect
-	github.com/klauspost/reedsolomon v1.11.7
+	github.com/klauspost/compress v1.16.7 // indirect
+	github.com/klauspost/reedsolomon v1.11.8
 	github.com/kurin/blazer v0.5.3
 	github.com/lib/pq v1.10.9
-	github.com/linxGnu/grocksdb v1.7.16
+	github.com/linxGnu/grocksdb v1.8.0
 	github.com/magiconair/properties v1.8.7 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
-	github.com/mattn/go-ieproxy v0.0.9 // indirect
+	github.com/mattn/go-ieproxy v0.0.11 // indirect
 	github.com/mattn/go-isatty v0.0.17 // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
@@ -76,24 +76,24 @@ require (
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/posener/complete v1.2.3
-	github.com/pquerna/cachecontrol v0.1.0
-	github.com/prometheus/client_golang v1.15.0
+	github.com/pquerna/cachecontrol v0.2.0
+	github.com/prometheus/client_golang v1.16.0
 	github.com/prometheus/client_model v0.3.0 // indirect
 	github.com/prometheus/common v0.42.0 // indirect
-	github.com/prometheus/procfs v0.9.0
+	github.com/prometheus/procfs v0.11.1
 	github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/seaweedfs/goexif v1.0.3
 	github.com/seaweedfs/raft v1.1.3
 	github.com/sirupsen/logrus v1.9.0 // indirect
-	github.com/spf13/afero v1.9.3 // indirect
-	github.com/spf13/cast v1.5.0 // indirect
+	github.com/spf13/afero v1.9.5 // indirect
+	github.com/spf13/cast v1.5.1 // indirect
 	github.com/spf13/jwalterweatherman v1.1.0 // indirect
-	github.com/spf13/viper v1.15.0
-	github.com/stretchr/testify v1.8.2
+	github.com/spf13/viper v1.16.0
+	github.com/stretchr/testify v1.8.4
 	github.com/stvp/tempredis v0.0.0-20181119212430-b82af8480203
 	github.com/syndtr/goleveldb v1.0.1-0.20190318030020-c3a204f8e965
-	github.com/tidwall/gjson v1.14.4
+	github.com/tidwall/gjson v1.16.0
 	github.com/tidwall/match v1.1.1
 	github.com/tidwall/pretty v1.2.0 // indirect
 	github.com/tsuna/gohbase v0.0.0-20201125011725-348991136365
@@ -106,86 +106,97 @@ require (
 	github.com/xdg-go/scram v1.1.2 // indirect
 	github.com/xdg-go/stringprep v1.0.4 // indirect
 	github.com/youmark/pkcs8 v0.0.0-20201027041543-1326539a0a0a // indirect
-	go.etcd.io/etcd/client/v3 v3.5.8
-	go.mongodb.org/mongo-driver v1.11.4
+	go.etcd.io/etcd/client/v3 v3.5.9
+	go.mongodb.org/mongo-driver v1.12.1
 	go.opencensus.io v0.24.0 // indirect
-	gocloud.dev v0.29.0
-	gocloud.dev/pubsub/natspubsub v0.29.0
-	gocloud.dev/pubsub/rabbitpubsub v0.29.0
-	golang.org/x/crypto v0.7.0 // indirect
-	golang.org/x/exp v0.0.0-20230124195608-d38c7dcee874
-	golang.org/x/image v0.7.0
-	golang.org/x/net v0.9.0
-	golang.org/x/oauth2 v0.6.0 // indirect
-	golang.org/x/sys v0.7.0
-	golang.org/x/text v0.9.0 // indirect
-	golang.org/x/tools v0.8.0
+	gocloud.dev v0.34.0
+	gocloud.dev/pubsub/natspubsub v0.33.0
+	gocloud.dev/pubsub/rabbitpubsub v0.33.0
+	golang.org/x/crypto v0.13.0 // indirect
+	golang.org/x/exp v0.0.0-20230321023759-10a507213a29
+	golang.org/x/image v0.11.0
+	golang.org/x/net v0.15.0
+	golang.org/x/oauth2 v0.12.0 // indirect
+	golang.org/x/sys v0.12.0
+	golang.org/x/text v0.13.0 // indirect
+	golang.org/x/tools v0.11.0
 	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
-	google.golang.org/api v0.114.0
+	google.golang.org/api v0.141.0
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto v0.0.0-20230331144136-dcfb400f0633 // indirect
-	google.golang.org/grpc v1.55.0
-	google.golang.org/protobuf v1.30.0
+	google.golang.org/genproto v0.0.0-20230803162519-f966b187b2e5 // indirect
+	google.golang.org/grpc v1.58.0
+	google.golang.org/protobuf v1.31.0
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	modernc.org/b v1.0.0 // indirect
 	modernc.org/cc/v3 v3.40.0 // indirect
 	modernc.org/ccgo/v3 v3.16.13 // indirect
-	modernc.org/libc v1.22.5 // indirect
-	modernc.org/mathutil v1.5.0 // indirect
-	modernc.org/memory v1.5.0 // indirect
+	modernc.org/libc v1.24.1 // indirect
+	modernc.org/mathutil v1.6.0 // indirect
+	modernc.org/memory v1.6.0 // indirect
 	modernc.org/opt v0.1.3 // indirect
-	modernc.org/sqlite v1.22.1
+	modernc.org/sqlite v1.25.0
 	modernc.org/strutil v1.1.3
 	modernc.org/token v1.0.1 // indirect
 )

 require (
 	github.com/Jille/raft-grpc-transport v1.4.0
-	github.com/arangodb/go-driver v1.5.2
+	github.com/arangodb/go-driver v1.6.0
 	github.com/armon/go-metrics v0.4.1
+	github.com/aws/aws-sdk-go-v2 v1.21.0
+	github.com/aws/aws-sdk-go-v2/config v1.18.39
+	github.com/aws/aws-sdk-go-v2/credentials v1.13.37
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.38.5
 	github.com/fluent/fluent-logger-golang v1.9.0
+	github.com/golang-jwt/jwt/v5 v5.0.0
 	github.com/google/flatbuffers/go v0.0.0-20230108230133-3b8644d32c50
-	github.com/hanwen/go-fuse/v2 v2.3.0
+	github.com/hanwen/go-fuse/v2 v2.4.0
 	github.com/hashicorp/raft v1.5.0
 	github.com/hashicorp/raft-boltdb/v2 v2.2.2
-	github.com/rabbitmq/amqp091-go v1.8.0
-	github.com/rclone/rclone v1.62.2
+	github.com/orcaman/concurrent-map/v2 v2.0.1
+	github.com/puzpuzpuz/xsync/v2 v2.5.0
+	github.com/rabbitmq/amqp091-go v1.8.1
+	github.com/rclone/rclone v1.63.1
+	github.com/rdleal/intervalst v0.0.0-20221028215511-a098aa0d2cb8
 	github.com/schollz/progressbar/v3 v3.13.1
+	github.com/shirou/gopsutil/v3 v3.23.5
 	github.com/tikv/client-go/v2 v2.0.7
-	github.com/ydb-platform/ydb-go-sdk-auth-environ v0.1.2
-	github.com/ydb-platform/ydb-go-sdk/v3 v3.43.0
+	github.com/ydb-platform/ydb-go-sdk-auth-environ v0.2.0
+	github.com/ydb-platform/ydb-go-sdk/v3 v3.48.8
 	google.golang.org/grpc/security/advancedtls v0.0.0-20220622233350-5cdb09fa29c1
 )

 require (
-	cloud.google.com/go/compute v1.19.0 // indirect
+	cloud.google.com/go/compute v1.23.0 // indirect
 	cloud.google.com/go/compute/metadata v0.2.3 // indirect
-	cloud.google.com/go/iam v0.13.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.4.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.2.2 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/internal v1.2.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.0.0 // indirect
+	cloud.google.com/go/iam v1.1.1 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.7.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.3.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/internal v1.3.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.1.0 // indirect
 	github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
-	github.com/AzureAD/microsoft-authentication-library-for-go v0.9.0 // indirect
+	github.com/AzureAD/microsoft-authentication-library-for-go v1.0.0 // indirect
 	github.com/Max-Sum/base32768 v0.0.0-20230304063302-18e6ce5945fd // indirect
-	github.com/Microsoft/go-winio v0.5.2 // indirect
+	github.com/Microsoft/go-winio v0.6.0 // indirect
 	github.com/Unknwon/goconfig v1.0.0 // indirect
 	github.com/abbot/go-http-auth v0.4.0 // indirect
 	github.com/arangodb/go-velocypack v0.0.0-20200318135517-5af53c29c67e // indirect
-	github.com/aws/aws-sdk-go-v2 v1.17.4 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.18.12 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.13.12 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.22 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.28 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.22 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.29 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.22 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sns v1.20.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sqs v1.20.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.12.1 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.1 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.18.3 // indirect
-	github.com/aws/smithy-go v1.13.5 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.13 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.11 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.41 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.35 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.42 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.1.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.14 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.36 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.35 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.15.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sns v1.21.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sqs v1.24.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.13.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.15.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.21.5 // indirect
+	github.com/aws/smithy-go v1.14.2 // indirect
 	github.com/benbjohnson/clock v1.3.0 // indirect
 	github.com/boltdb/bolt v1.3.1 // indirect
 	github.com/buengese/sgzip v0.1.1 // indirect
@@ -196,7 +207,7 @@ require (
 	github.com/dgryski/go-farm v0.0.0-20190423205320-6a90982ecee2 // indirect
 	github.com/dropbox/dropbox-sdk-go-unofficial/v6 v6.0.5 // indirect
 	github.com/elastic/gosigar v0.14.2 // indirect
-	github.com/fatih/color v1.13.0 // indirect
+	github.com/fatih/color v1.14.1 // indirect
 	github.com/fclairamb/go-log v0.4.1 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.2 // indirect
 	github.com/geoffgarside/ber v1.1.0 // indirect
@@ -206,7 +217,8 @@ require (
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang-jwt/jwt/v4 v4.5.0 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.2.3 // indirect
+	github.com/google/s2a-go v0.1.7 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.2.5 // indirect
 	github.com/grpc-ecosystem/go-grpc-middleware v1.3.0 // indirect
 	github.com/hashicorp/go-hclog v1.5.0 // indirect
 	github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
@@ -218,8 +230,7 @@ require (
 	github.com/jcmturner/dnsutils/v2 v2.0.0 // indirect
 	github.com/jcmturner/goidentity/v6 v6.0.1 // indirect
 	github.com/jcmturner/rpc/v2 v2.0.3 // indirect
-	github.com/jlaffaye/ftp v0.1.1-0.20230214004652-d84bf4be2b6e // indirect
-	github.com/jonboulle/clockwork v0.2.2 // indirect
+	github.com/jonboulle/clockwork v0.3.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/jtolio/eventkit v0.0.0-20221004135224-074cf276595b // indirect
 	github.com/jzelinskie/whirlpool v0.0.0-20201016144138-0675e54bb004 // indirect
@@ -235,15 +246,15 @@ require (
 	github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/montanaflynn/stats v0.7.0 // indirect
-	github.com/nats-io/nats.go v1.23.0 // indirect
-	github.com/nats-io/nkeys v0.3.0 // indirect
+	github.com/nats-io/nats.go v1.28.0 // indirect
+	github.com/nats-io/nkeys v0.4.4 // indirect
 	github.com/nats-io/nuid v1.0.1 // indirect
 	github.com/ncw/go-acd v0.0.0-20201019170801-fe55f33415b1 // indirect
 	github.com/ncw/swift/v2 v2.0.1 // indirect
 	github.com/opentracing/opentracing-go v1.2.0 // indirect
-	github.com/oracle/oci-go-sdk/v65 v65.32.0 // indirect
+	github.com/oracle/oci-go-sdk/v65 v65.34.0 // indirect
 	github.com/patrickmn/go-cache v2.1.0+incompatible // indirect
-	github.com/pelletier/go-toml/v2 v2.0.6 // indirect
+	github.com/pelletier/go-toml/v2 v2.0.8 // indirect
 	github.com/pengsrc/go-shared v0.2.1-0.20190131101655-1999055a4a14 // indirect
 	github.com/philhofer/fwd v1.1.1 // indirect
 	github.com/pierrec/lz4/v4 v4.1.17 // indirect
@@ -256,10 +267,13 @@ require (
 	github.com/pkg/xattr v0.4.9 // indirect
 	github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
 	github.com/putdotio/go-putio/putio v0.0.0-20200123120452-16d982cac2b8 // indirect
+	github.com/rclone/ftp v0.0.0-20230327202000-dadc1f64e87d // indirect
+	github.com/rdleal/intervalst v0.0.0-20221028215511-a098aa0d2cb8 // indirect
 	github.com/rfjakob/eme v1.1.2 // indirect
 	github.com/rivo/uniseg v0.4.4 // indirect
-	github.com/shirou/gopsutil/v3 v3.23.2 // indirect
+	github.com/shoenig/go-m1cpu v0.1.6 // indirect
 	github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 // indirect
+	github.com/smartystreets/goconvey v1.8.1 // indirect
 	github.com/sony/gobreaker v0.5.0 // indirect
 	github.com/spacemonkeygo/monkit/v3 v3.0.19 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
@@ -274,23 +288,25 @@ require (
 	github.com/vivint/infectious v0.0.0-20200605153912-25a574ae18a3 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
 	github.com/yandex-cloud/go-genproto v0.0.0-20211115083454-9ca41db5ed9e // indirect
-	github.com/ydb-platform/ydb-go-genproto v0.0.0-20221215182650-986f9d10542f // indirect
-	github.com/ydb-platform/ydb-go-yc v0.8.3 // indirect
+	github.com/ydb-platform/ydb-go-genproto v0.0.0-20230528143953-42c825ace222 // indirect
+	github.com/ydb-platform/ydb-go-yc v0.10.2 // indirect
 	github.com/ydb-platform/ydb-go-yc-metadata v0.5.2 // indirect
 	github.com/yunify/qingstor-sdk-go/v3 v3.2.0 // indirect
-	github.com/yusufpapurcu/wmi v1.2.2 // indirect
+	github.com/yusufpapurcu/wmi v1.2.3 // indirect
 	github.com/zeebo/blake3 v0.2.3 // indirect
 	github.com/zeebo/errs v1.3.0 // indirect
 	go.etcd.io/bbolt v1.3.7 // indirect
-	go.etcd.io/etcd/api/v3 v3.5.8 // indirect
-	go.etcd.io/etcd/client/pkg/v3 v3.5.8 // indirect
-	go.uber.org/atomic v1.10.0 // indirect
-	go.uber.org/multierr v1.9.0 // indirect
+	go.etcd.io/etcd/api/v3 v3.5.9 // indirect
+	go.etcd.io/etcd/client/pkg/v3 v3.5.9 // indirect
+	go.uber.org/atomic v1.11.0 // indirect
+	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.24.0 // indirect
-	golang.org/x/mod v0.10.0 // indirect
-	golang.org/x/sync v0.1.0 // indirect
-	golang.org/x/term v0.7.0 // indirect
+	golang.org/x/mod v0.12.0 // indirect
+	golang.org/x/sync v0.3.0 // indirect
+	golang.org/x/term v0.12.0 // indirect
 	golang.org/x/time v0.3.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20230803162519-f966b187b2e5 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20230911183012-2d3300fd4832 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
@@ -1,5 +1,5 @@
 apiVersion: v1
 description: SeaweedFS
 name: seaweedfs
-appVersion: "3.49"
-version: "3.49"
+appVersion: "3.57"
+version: 3.57.0
@@ -182,4 +182,19 @@ Inject extra environment vars in the format key:value, if populated
 {{- else -}}
 {{- printf "false" -}}
 {{- end -}}
-{{- end -}}
+{{- end -}}
+
+{{/* Return the proper imagePullSecrets */}}
+{{- define "seaweedfs.imagePullSecrets" -}}
+{{- if .Values.global.imagePullSecrets }}
+{{- if kindIs "string" .Values.global.imagePullSecrets }}
+imagePullSecrets:
+  - name: {{ .Values.global.imagePullSecrets }}
+{{- else }}
+imagePullSecrets:
+{{- range .Values.global.imagePullSecrets }}
+  - name: {{ . }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end -}}
@@ -1,9 +1,14 @@
 {{- if .Values.global.enableSecurity }}
-apiVersion: certmanager.k8s.io/v1alpha1
+apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Certificate
 metadata:
  name: {{ template "seaweedfs.name" . }}-ca-cert
  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
 spec:
  secretName: {{ template "seaweedfs.name" . }}-ca-cert
  commonName: "{{ template "seaweedfs.name" . }}-root-ca"
@@ -0,0 +1,15 @@
+{{- if .Values.global.enableSecurity }}
+apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
+kind: Issuer
+metadata:
+  name: {{ template "seaweedfs.name" . }}-ca-issuer
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+spec:
+  ca:
+    secretName: {{ template "seaweedfs.name" . }}-ca-cert
+{{- end }}
@@ -1,8 +1,13 @@
 {{- if .Values.global.enableSecurity }}
-apiVersion: certmanager.k8s.io/v1alpha1
+apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: ClusterIssuer
 metadata:
  name: {{ template "seaweedfs.name" . }}-clusterissuer
+  labels:
+    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
 spec:
  selfSigned: {}
 {{- end }}
@@ -1,16 +1,22 @@
 {{- if .Values.global.enableSecurity }}
-apiVersion: certmanager.k8s.io/v1alpha1
+apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Certificate
 metadata:
  name: {{ template "seaweedfs.name" . }}-client-cert
  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
 spec:
  secretName: {{ template "seaweedfs.name" . }}-client-cert
  issuerRef:
-    name: {{ template "seaweedfs.name" . }}-clusterissuer
-    kind: ClusterIssuer
+    name: {{ template "seaweedfs.name" . }}-ca-issuer
+    kind: Issuer
  commonName: {{ .Values.certificates.commonName }}
-  organization:
+  subject:
+    organizations:
    - "SeaweedFS CA"
  dnsNames:
    - '*.{{ .Release.Namespace }}'
@@ -26,8 +32,9 @@ spec:
    - {{ . }}
    {{- end }}
 {{- end }}
-  keyAlgorithm: {{ .Values.certificates.keyAlgorithm }}
-  keySize: {{ .Values.certificates.keySize }}
+  privateKey:
+    algorithm: {{ .Values.certificates.keyAlgorithm }}
+    size: {{ .Values.certificates.keySize }}
  duration: {{ .Values.certificates.duration }}
  renewBefore: {{ .Values.certificates.renewBefore }}
 {{- end }}
@@ -1,16 +1,23 @@
 {{- if .Values.global.enableSecurity }}
-apiVersion: certmanager.k8s.io/v1alpha1
+apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Certificate
 metadata:
  name: {{ template "seaweedfs.name" . }}-filer-cert
  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: filer
 spec:
  secretName: {{ template "seaweedfs.name" . }}-filer-cert
  issuerRef:
-    name: {{ template "seaweedfs.name" . }}-clusterissuer
-    kind: ClusterIssuer
+    name: {{ template "seaweedfs.name" . }}-ca-issuer
+    kind: Issuer
  commonName: {{ .Values.certificates.commonName }}
-  organization:
+  subject:
+    organizations:
    - "SeaweedFS CA"
  dnsNames:
    - '*.{{ .Release.Namespace }}'
@@ -26,8 +33,9 @@ spec:
    - {{ . }}
    {{- end }}
 {{- end }}
-  keyAlgorithm: {{ .Values.certificates.keyAlgorithm }}
-  keySize: {{ .Values.certificates.keySize }}
+  privateKey:
+    algorithm: {{ .Values.certificates.keyAlgorithm }}
+    size: {{ .Values.certificates.keySize }}
  duration: {{ .Values.certificates.duration }}
  renewBefore: {{ .Values.certificates.renewBefore }}
 {{- end }}
@@ -4,8 +4,11 @@ metadata:
  name: {{ template "seaweedfs.name" . }}-filer-client
  namespace: {{ .Release.Namespace }}
  labels:
-    app: {{ template "seaweedfs.name" . }}
-    component: filer
+    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: filer
 {{- if .Values.filer.metricsPort }}
    monitoring: "true"
 {{- end }}
@@ -27,5 +30,5 @@ spec:
    protocol: TCP
 {{- end }}
  selector:
-    app: {{ template "seaweedfs.name" . }}
-    component: filer
+    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    app.kubernetes.io/component: filer
@@ -6,8 +6,11 @@ metadata:
  name: {{ template "seaweedfs.name" . }}-filer
  namespace: {{ .Release.Namespace }}
  labels:
-    app: {{ template "seaweedfs.name" . }}
-    component: filer
+    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: filer
 spec:
  clusterIP: None
  publishNotReadyAddresses: true
@@ -25,6 +28,12 @@ spec:
    port: {{ .Values.filer.s3.port }}
    targetPort: {{ .Values.filer.s3.port }}
    protocol: TCP
+  {{- if .Values.filer.s3.httpsPort }}
+  - name: "swfs-s3-tls"
+    port: {{ .Values.filer.s3.httpsPort }}
+    targetPort: {{ .Values.filer.s3.httpsPort }}
+    protocol: TCP
+  {{- end }}
  {{- end }}
  {{- if .Values.filer.metricsPort }}
  - name: "metrics"
@@ -33,5 +42,5 @@ spec:
    protocol: TCP
  {{- end }}
  selector:
-    app: {{ template "seaweedfs.name" . }}
-    component: filer
+    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    app.kubernetes.io/component: filer
@@ -6,8 +6,11 @@ metadata:
  name: {{ template "seaweedfs.name" . }}-filer
  namespace: {{ .Release.Namespace }}
  labels:
-    app: {{ template "seaweedfs.name" . }}
-    component: filer
+    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: filer
 spec:
  endpoints:
    - interval: 30s
@@ -15,7 +18,7 @@ spec:
      scrapeTimeout: 5s
  selector:
    matchLabels:
-      app: {{ template "seaweedfs.name" . }}
-      component: filer
+      app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+      app.kubernetes.io/component: filer
 {{- end }}
 {{- end }}
@@ -5,10 +5,11 @@ metadata:
  name: {{ template "seaweedfs.name" . }}-filer
  namespace: {{ .Release.Namespace }}
  labels:
-    app: {{ template "seaweedfs.name" . }}
-    chart: {{ template "seaweedfs.chart" . }}
-    heritage: {{ .Release.Service }}
-    release: {{ .Release.Name }}
+    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: filer
 spec:
  serviceName: {{ template "seaweedfs.name" . }}-filer
  podManagementPolicy: Parallel
@@ -21,17 +22,17 @@ spec:
  {{- end }}
  selector:
    matchLabels:
-      app: {{ template "seaweedfs.name" . }}
-      chart: {{ template "seaweedfs.chart" . }}
-      release: {{ .Release.Name }}
-      component: filer
+      app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+      helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      app.kubernetes.io/component: filer
  template:
    metadata:
      labels:
-        app: {{ template "seaweedfs.name" . }}
-        chart: {{ template "seaweedfs.chart" . }}
-        release: {{ .Release.Name }}
-        component: filer
+        app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+        helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        app.kubernetes.io/component: filer
    spec:
      restartPolicy: {{ default .Values.global.restartPolicy .Values.filer.restartPolicy }}
      {{- if .Values.filer.affinity }}
@@ -42,16 +43,18 @@ spec:
      tolerations:
        {{ tpl .Values.filer.tolerations . | nindent 8 | trim }}
      {{- end }}
-      {{- if .Values.global.imagePullSecrets }}
-      imagePullSecrets:
-        - name: {{ .Values.global.imagePullSecrets }}
-      {{- end }}
+      {{- include "seaweedfs.imagePullSecrets" . | nindent 6 }}
+      {{- if .Values.global.createClusterRole }}
      serviceAccountName: seaweedfs-rw-sa #hack for delete pod master after migration
+      {{- end }}
      terminationGracePeriodSeconds: 60
      {{- if .Values.filer.priorityClassName }}
      priorityClassName: {{ .Values.filer.priorityClassName | quote }}
      {{- end }}
      enableServiceLinks: false
+      {{- if .Values.filer.serviceAccountName }}
+      serviceAccountName: {{ .Values.filer.serviceAccountName | quote }}
+      {{- end }}
      {{- if .Values.filer.initContainers }}
      initContainers:
        {{ tpl .Values.filer.initContainers . | nindent 8 | trim }}
@@ -88,7 +91,12 @@ spec:
            {{- if .Values.filer.extraEnvironmentVars }}
            {{- range $key, $value := .Values.filer.extraEnvironmentVars }}
            - name: {{ $key }}
+            {{- if kindIs "string" $value }}
              value: {{ $value | quote }}
+            {{- else }}
+              valueFrom:
+                {{ toYaml $value | nindent 16 | trim }}
+            {{- end -}}
            {{- end }}
            {{- end }}
            {{- if .Values.global.extraEnvironmentVars }}
@@ -148,6 +156,9 @@ spec:
              -encryptVolumeData \
              {{- end }}
              -ip=${POD_IP} \
+              {{- if .Values.filer.filerGroup}}
+              -filerGroup={{ .Values.filer.filerGroup}} \
+              {{- end }}
              {{- if .Values.filer.s3.enabled }}
              -s3 \
              -s3.port={{ .Values.filer.s3.port }} \
@@ -155,6 +166,9 @@ spec:
              -s3.domainName={{ .Values.filer.s3.domainName }} \
              {{- end }}
              {{- if .Values.global.enableSecurity }}
+              {{- if .Values.filer.s3.httpsPort }}
+              -s3.port.https={{ .Values.filer.s3.httpsPort }} \
+              {{- end }}
              -s3.cert.file=/usr/local/share/ca-certificates/client/tls.crt \
              -s3.key.file=/usr/local/share/ca-certificates/client/tls.key \
              {{- end }}
@@ -170,8 +184,10 @@ spec:
              {{- end }}
              -master={{ range $index := until (.Values.master.replicas | int) }}${SEAWEEDFS_FULLNAME}-master-{{ $index }}.${SEAWEEDFS_FULLNAME}-master.{{ $.Release.Namespace }}:{{ $.Values.master.port }}{{ if lt $index (sub ($.Values.master.replicas | int) 1) }},{{ end }}{{ end }}
          volumeMounts:
+            {{- if eq .Values.filer.logs.type "hostPath" }}
            - name: seaweedfs-filer-log-volume
              mountPath: "/logs/"
+            {{- end }}
            - mountPath: /etc/sw
              name: config-users
              readOnly: true
@@ -208,26 +224,30 @@ spec:
              name: metrics
            - containerPort: {{ .Values.filer.grpcPort }}
              #name: swfs-filer-grpc
+          {{- if .Values.filer.readinessProbe.enabled }}
          readinessProbe:
            httpGet:
-              path: /
+              path: {{ .Values.filer.readinessProbe.httpGet.path }}
              port: {{ .Values.filer.port }}
-              scheme: HTTP
-            initialDelaySeconds: 10
-            periodSeconds: 15
-            successThreshold: 1
-            failureThreshold: 100
-            timeoutSeconds: 10
+              scheme: {{ .Values.filer.readinessProbe.scheme }}
+            initialDelaySeconds: {{ .Values.filer.readinessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.filer.readinessProbe.periodSeconds }}
+            successThreshold: {{ .Values.filer.readinessProbe.successThreshold }}
+            failureThreshold: {{ .Values.filer.readinessProbe.failureThreshold }}
+            timeoutSeconds: {{ .Values.filer.readinessProbe.timeoutSeconds }}
+          {{- end }}
+          {{- if .Values.filer.livenessProbe.enabled }}
          livenessProbe:
            httpGet:
-              path: /
+              path: {{ .Values.filer.livenessProbe.httpGet.path }}
              port: {{ .Values.filer.port }}
-              scheme: HTTP
-            initialDelaySeconds: 20
-            periodSeconds: 30
-            successThreshold: 1
-            failureThreshold: 5
-            timeoutSeconds: 10
+              scheme: {{ .Values.filer.livenessProbe.scheme }}
+            initialDelaySeconds: {{ .Values.filer.livenessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.filer.livenessProbe.periodSeconds }}
+            successThreshold: {{ .Values.filer.livenessProbe.successThreshold }}
+            failureThreshold: {{ .Values.filer.livenessProbe.failureThreshold }}
+            timeoutSeconds: {{ .Values.filer.livenessProbe.timeoutSeconds }}
+          {{- end }}
          {{- if .Values.filer.resources }}
          resources:
            {{ tpl .Values.filer.resources . | nindent 12 | trim }}
@@ -0,0 +1,46 @@
+{{- if .Values.filer.ingress.enabled }}
+{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion }}
+apiVersion: networking.k8s.io/v1
+{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion }}
+apiVersion: networking.k8s.io/v1beta1
+{{- else }}
+apiVersion: extensions/v1beta1
+{{- end }}
+kind: Ingress
+metadata:
+  name: ingress-{{ template "seaweedfs.name" . }}-filer
+  namespace: {{ .Release.Namespace }}
+  {{- if .Values.filer.ingress.annotations }}
+  annotations:
+    {{ tpl .Values.filer.ingress.annotations . | nindent 4 | trim }}
+  {{- end }}
+  labels:
+    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: filer
+spec:
+  ingressClassName: {{ .Values.filer.ingress.className | quote }}
+  tls:
+    {{ .Values.filer.ingress.tls | default list | toYaml | nindent 6}}
+  rules:
+  - http:
+      paths:
+      - path: /sw-filer/?(.*)
+        pathType: ImplementationSpecific
+        backend:
+{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion }}
+          service:
+            name: {{ template "seaweedfs.name" . }}-filer
+            port:
+              number: {{ .Values.filer.port }}
+              #name:
+{{- else }}
+          serviceName: {{ template "seaweedfs.name" . }}-filer
+          servicePort: {{ .Values.filer.port }}
+{{- end }}
+{{- if .Values.filer.ingress.host }}
+    host: {{ .Values.filer.ingress.host }}
+{{- end }}
+{{- end }}
@@ -1,67 +0,0 @@
-{{- if .Values.filer.ingress.enabled }}
-{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion }}
-apiVersion: networking.k8s.io/v1
-{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion }}
-apiVersion: networking.k8s.io/v1beta1
-{{- else }}
-apiVersion: extensions/v1beta1
-{{- end }}
-kind: Ingress
-metadata:
-  name: ingress-{{ template "seaweedfs.name" . }}-filer
-  namespace: {{ .Release.Namespace }}
-  annotations:
-    {{ omit .Values.filer.ingress.annotations "kubernetes.io/ingress.class" | toYaml | nindent 4 }}
-spec:
-  ingressClassName: {{ .Values.filer.ingress.className | quote }}
-  rules:
-  - http:
-      paths:
-      - path: /sw-filer/?(.*)
-        pathType: ImplementationSpecific
-        backend:
-{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion }}
-          service:
-            name: {{ template "seaweedfs.name" . }}-filer
-            port:
-              number: {{ .Values.filer.port }}
-              #name:
-{{- else }}
-          serviceName: {{ template "seaweedfs.name" . }}-filer
-          servicePort: {{ .Values.filer.port }}
-{{- end }}
-{{- end }}
---
-{{- if .Values.master.ingress.enabled }}
-{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion }}
-apiVersion: networking.k8s.io/v1
-{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion }}
-apiVersion: networking.k8s.io/v1beta1
-{{- else }}
-apiVersion: extensions/v1beta1
-{{- end }}
-kind: Ingress
-metadata:
-  name: ingress-{{ template "seaweedfs.name" . }}-master
-  namespace: {{ .Release.Namespace }}
-  annotations:
-    {{ omit .Values.master.ingress.annotations "kubernetes.io/ingress.class" | toYaml | nindent 4 }}
-spec:
-  ingressClassName: {{ .Values.master.ingress.className | quote }}
-  rules:
-  - http:
-      paths:
-      - path: /sw-master/?(.*)
-        pathType: ImplementationSpecific
-        backend:
-{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion }}
-          service:
-            name: {{ template "seaweedfs.name" . }}-master
-            port:
-              number: {{ .Values.master.port }}
-              #name:
-{{- else }}
-          serviceName: {{ template "seaweedfs.name" . }}-master
-          servicePort: {{ .Values.master.port }}
-{{- end }}
-{{- end }}
@@ -1,16 +1,23 @@
 {{- if .Values.global.enableSecurity }}
-apiVersion: certmanager.k8s.io/v1alpha1
+apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Certificate
 metadata:
  name: {{ template "seaweedfs.name" . }}-master-cert
  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: master
 spec:
  secretName: {{ template "seaweedfs.name" . }}-master-cert
  issuerRef:
-    name: {{ template "seaweedfs.name" . }}-clusterissuer
-    kind: ClusterIssuer
+    name: {{ template "seaweedfs.name" . }}-ca-issuer
+    kind: Issuer
  commonName: {{ .Values.certificates.commonName }}
-  organization:
+  subject:
+    organizations:
    - "SeaweedFS CA"
  dnsNames:
    - '*.{{ .Release.Namespace }}'
@@ -26,8 +33,9 @@ spec:
    - {{ . }}
    {{- end }}
 {{- end }}
-  keyAlgorithm: {{ .Values.certificates.keyAlgorithm }}
-  keySize: {{ .Values.certificates.keySize }}
+  privateKey:
+    algorithm: {{ .Values.certificates.keyAlgorithm }}
+    size: {{ .Values.certificates.keySize }}
  duration: {{ .Values.certificates.duration }}
  renewBefore: {{ .Values.certificates.renewBefore }}
 {{- end }}
@@ -0,0 +1,15 @@
+{{- if .Values.master.enabled }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ template "seaweedfs.name" . }}-master-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+data:
+  master.toml: |-
+    {{ .Values.master.config | nindent 4 }}
+{{- end }}
@@ -0,0 +1,44 @@
+{{- if .Values.master.ingress.enabled }}
+{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion }}
+apiVersion: networking.k8s.io/v1
+{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion }}
+apiVersion: networking.k8s.io/v1beta1
+{{- else }}
+apiVersion: extensions/v1beta1
+{{- end }}
+kind: Ingress
+metadata:
+  name: ingress-{{ template "seaweedfs.name" . }}-master
+  namespace: {{ .Release.Namespace }}
+  {{- if .Values.master.ingress.annotations }}
+  annotations:
+    {{ tpl .Values.master.ingress.annotations . | nindent 4 | trim }}
+  {{- end }}
+  labels:
+    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: master
+spec:
+  ingressClassName: {{ .Values.master.ingress.className | quote }}
+  rules:
+    - http:
+        paths:
+          - path: /sw-master/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion }}
+              service:
+                name: {{ template "seaweedfs.name" . }}-master
+                port:
+                  number: {{ .Values.master.port }}
+                  #name:
+{{- else }}
+              serviceName: {{ template "seaweedfs.name" . }}-master
+              servicePort: {{ .Values.master.port }}
+{{- end }}
+{{- if .Values.filer.ingress.host }}
+      host: {{ .Values.master.ingress.host }}
+{{- end }}
+{{- end }}
@@ -4,8 +4,10 @@ metadata:
  name: {{ template "seaweedfs.name" . }}-master
  namespace: {{ .Release.Namespace }}
  labels:
-    app: {{ template "seaweedfs.name" . }}
-    component: master
+    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    app.kubernetes.io/component: master
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
  annotations:
    service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"    
 spec:
@@ -27,5 +29,5 @@ spec:
    protocol: TCP
  {{- end }}
  selector:
-    app: {{ template "seaweedfs.name" . }}
-    component: master
+    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    app.kubernetes.io/component: master
@@ -6,8 +6,11 @@ metadata:
  name: {{ template "seaweedfs.name" . }}-master
  namespace: {{ .Release.Namespace }}
  labels:
-    app: {{ template "seaweedfs.name" . }}
-    component: master
+    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: master
 spec:
  endpoints:
    - interval: 30s
@@ -5,10 +5,10 @@ metadata:
  name: {{ template "seaweedfs.name" . }}-master
  namespace: {{ .Release.Namespace }}
  labels:
-    app: {{ template "seaweedfs.name" . }}
-    chart: {{ template "seaweedfs.chart" . }}
-    heritage: {{ .Release.Service }}
-    release: {{ .Release.Name }}
+    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
 spec:
  serviceName: {{ template "seaweedfs.name" . }}-master
  podManagementPolicy: Parallel
@@ -21,17 +21,17 @@ spec:
  {{- end }}
  selector:
    matchLabels:
-      app: {{ template "seaweedfs.name" . }}
-      chart: {{ template "seaweedfs.chart" . }}
-      release: {{ .Release.Name }}
-      component: master
+      app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+      helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      app.kubernetes.io/component: master
  template:
    metadata:
      labels:
-        app: {{ template "seaweedfs.name" . }}
-        chart: {{ template "seaweedfs.chart" . }}
-        release: {{ .Release.Name }}
-        component: master
+        app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+        helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        app.kubernetes.io/component: master
    spec:
      restartPolicy: {{ default .Values.global.restartPolicy .Values.master.restartPolicy }}
      {{- if .Values.master.affinity }}
@@ -42,15 +42,15 @@ spec:
      tolerations:
        {{ tpl .Values.master.tolerations . | nindent 8 | trim }}
      {{- end }}
-      {{- if .Values.global.imagePullSecrets }}
-      imagePullSecrets:
-        - name: {{ .Values.global.imagePullSecrets }}
-      {{- end }}
+      {{- include "seaweedfs.imagePullSecrets" . | nindent 6 }}
      terminationGracePeriodSeconds: 60
      {{- if .Values.master.priorityClassName }}
      priorityClassName: {{ .Values.master.priorityClassName | quote }}
      {{- end }}
      enableServiceLinks: false
+      {{- if .Values.master.serviceAccountName }}
+      serviceAccountName: {{ .Values.master.serviceAccountName | quote }}
+      {{- end }}
      {{- if .Values.master.initContainers }}
      initContainers:
        {{ tpl .Values.master.initContainers . | nindent 8 | trim }}
@@ -138,8 +138,14 @@ spec:
          volumeMounts:
            - name : data-{{ .Release.Namespace }}
              mountPath: /data
+            {{- if eq .Values.master.logs.type "hostPath" }}
            - name: seaweedfs-master-log-volume
              mountPath: "/logs/"
+            {{- end }}
+            - name: master-config
+              readOnly: true
+              mountPath: /etc/seaweedfs/master.toml
+              subPath: master.toml
            {{- if .Values.global.enableSecurity }}
            - name: security-config
              readOnly: true
@@ -171,26 +177,30 @@ spec:
            {{- end }}
            - containerPort: {{ .Values.master.grpcPort }}
              #name: swfs-master-grpc
+          {{- if .Values.master.readinessProbe.enabled }}
          readinessProbe:
            httpGet:
-              path: /cluster/status
+              path: {{ .Values.master.readinessProbe.httpGet.path }}
              port: {{ .Values.master.port }}
-              scheme: HTTP
-            initialDelaySeconds: 10
-            periodSeconds: 45
-            successThreshold: 2
-            failureThreshold: 100
-            timeoutSeconds: 10
+              scheme: {{ .Values.master.readinessProbe.scheme }}
+            initialDelaySeconds: {{ .Values.master.readinessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.master.readinessProbe.periodSeconds }}
+            successThreshold: {{ .Values.master.readinessProbe.successThreshold }}
+            failureThreshold: {{ .Values.master.readinessProbe.failureThreshold }}
+            timeoutSeconds: {{ .Values.master.readinessProbe.timeoutSeconds }}
+          {{- end }}
+          {{- if .Values.master.livenessProbe.enabled }}
          livenessProbe:
            httpGet:
-              path: /cluster/status
+              path: {{ .Values.master.livenessProbe.httpGet.path }}
              port: {{ .Values.master.port }}
-              scheme: HTTP
-            initialDelaySeconds: 20
-            periodSeconds: 30
-            successThreshold: 1
-            failureThreshold: 4
-            timeoutSeconds: 10
+              scheme: {{ .Values.master.livenessProbe.scheme }}
+            initialDelaySeconds: {{ .Values.master.livenessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.master.livenessProbe.periodSeconds }}
+            successThreshold: {{ .Values.master.livenessProbe.successThreshold }}
+            failureThreshold: {{ .Values.master.livenessProbe.failureThreshold }}
+            timeoutSeconds: {{ .Values.master.livenessProbe.timeoutSeconds }}
+          {{- end }}
          {{- if .Values.master.resources }}
          resources:
            {{ tpl .Values.master.resources . | nindent 12 | trim }}
@@ -210,6 +220,9 @@ spec:
            path: {{ .Values.master.data.hostPathPrefix }}/seaweed-master/
            type: DirectoryOrCreate
        {{- end }}
+        - name: master-config
+          configMap:
+            name: {{ template "seaweedfs.name" . }}-master-config
        {{- if .Values.global.enableSecurity }}
        - name: security-config
          configMap:
@@ -236,7 +249,7 @@ spec:
      nodeSelector:
        {{ tpl .Values.master.nodeSelector . | indent 8 | trim }}
      {{- end }}
-  {{- $pvc_exists := include "volume.pvc_exists" . -}}
+  {{- $pvc_exists := include "master.pvc_exists" . -}}
  {{- if $pvc_exists }}
  volumeClaimTemplates:
    {{- if eq .Values.master.data.type "persistentVolumeClaim"}}
@@ -5,40 +5,40 @@ metadata:
  name: {{ template "seaweedfs.name" . }}-s3
  namespace: {{ .Release.Namespace }}
  labels:
-    app: {{ template "seaweedfs.name" . }}
-    chart: {{ template "seaweedfs.chart" . }}
-    heritage: {{ .Release.Service }}
-    release: {{ .Release.Name }}
+    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
 spec:
  replicas: {{ .Values.s3.replicas }}
  selector:
    matchLabels:
-      app: {{ template "seaweedfs.name" . }}
-      chart: {{ template "seaweedfs.chart" . }}
-      release: {{ .Release.Name }}
-      component: s3
+      app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+      helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      app.kubernetes.io/component: s3
  template:
    metadata:
      labels:
-        app: {{ template "seaweedfs.name" . }}
-        chart: {{ template "seaweedfs.chart" . }}
-        release: {{ .Release.Name }}
-        component: s3
+        app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+        helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        app.kubernetes.io/component: s3
    spec:
      restartPolicy: {{ default .Values.global.restartPolicy .Values.s3.restartPolicy }}
      {{- if .Values.s3.tolerations }}
      tolerations:
        {{ tpl .Values.s3.tolerations . | nindent 8 | trim }}
      {{- end }}
-      {{- if .Values.global.imagePullSecrets }}
-      imagePullSecrets:
-        - name: {{ .Values.global.imagePullSecrets }}
-      {{- end }}
+      {{- include "seaweedfs.imagePullSecrets" . | nindent 6 }}
      terminationGracePeriodSeconds: 10
      {{- if .Values.s3.priorityClassName }}
      priorityClassName: {{ .Values.s3.priorityClassName | quote }}
      {{- end }}
      enableServiceLinks: false
+      {{- if .Values.s3.serviceAccountName }}
+      serviceAccountName: {{ .Values.s3.serviceAccountName | quote }}
+      {{- end }}
      {{- if .Values.s3.initContainers }}
      initContainers:
        {{ tpl .Values.s3.initContainers . | nindent 8 | trim }}
@@ -90,6 +90,9 @@ spec:
              -metricsPort {{ .Values.s3.metricsPort }} \
              {{- end }}
              {{- if .Values.global.enableSecurity }}
+              {{- if .Values.s3.httpsPort }}
+              -port.https={{ .Values.s3.httpsPort }} \
+              {{- end }}
              -cert.file=/usr/local/share/ca-certificates/client/tls.crt \
              -key.file=/usr/local/share/ca-certificates/client/tls.key \
              {{- end }}
@@ -107,8 +110,10 @@ spec:
              {{- end }}
              -filer={{ template "seaweedfs.name" . }}-filer-client.{{ .Release.Namespace }}:{{ .Values.filer.port }}
          volumeMounts:
+            {{- if eq .Values.s3.logs.type "hostPath" }}
            - name: logs
              mountPath: "/logs/"
+            {{- end }}
            - mountPath: /etc/sw
              name: config-users
              readOnly: true
@@ -141,26 +146,30 @@ spec:
            - containerPort: {{ .Values.s3.metricsPort }}
              name: "metrics"
            {{- end }}
+          {{- if .Values.s3.readinessProbe.enabled }}
          readinessProbe:
            httpGet:
-              path: /status
+              path: {{ .Values.s3.readinessProbe.httpGet.path }}
              port: {{ .Values.s3.port }}
-              scheme: HTTP
-            initialDelaySeconds: 15
-            periodSeconds: 15
-            successThreshold: 1
-            failureThreshold: 100
-            timeoutSeconds: 10
+              scheme: {{ .Values.s3.readinessProbe.scheme }}
+            initialDelaySeconds: {{ .Values.s3.readinessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.s3.readinessProbe.periodSeconds }}
+            successThreshold: {{ .Values.s3.readinessProbe.successThreshold }}
+            failureThreshold: {{ .Values.s3.readinessProbe.failureThreshold }}
+            timeoutSeconds: {{ .Values.s3.readinessProbe.timeoutSeconds }}
+          {{- end }}
+          {{- if .Values.s3.livenessProbe.enabled }}
          livenessProbe:
            httpGet:
-              path: /status
+              path: {{ .Values.s3.livenessProbe.httpGet.path }}
              port: {{ .Values.s3.port }}
-              scheme: HTTP
-            initialDelaySeconds: 20
-            periodSeconds: 60
-            successThreshold: 1
-            failureThreshold: 20
-            timeoutSeconds: 10
+              scheme: {{ .Values.s3.livenessProbe.scheme }}
+            initialDelaySeconds: {{ .Values.s3.livenessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.s3.livenessProbe.periodSeconds }}
+            successThreshold: {{ .Values.s3.livenessProbe.successThreshold }}
+            failureThreshold: {{ .Values.s3.livenessProbe.failureThreshold }}
+            timeoutSeconds: {{ .Values.s3.livenessProbe.timeoutSeconds }}
+          {{- end }}
          {{- if .Values.s3.resources }}
          resources:
            {{ tpl .Values.s3.resources . | nindent 12 | trim }}
@@ -4,14 +4,22 @@ metadata:
  name: {{ template "seaweedfs.name" . }}-s3
  namespace: {{ .Release.Namespace }}
  labels:
-    app: {{ template "seaweedfs.name" . }}
-    component: s3
+    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    app.kubernetes.io/component: s3
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
 spec:
  ports:
  - name: "swfs-s3"
    port: {{ if .Values.s3.enabled }}{{ .Values.s3.port }}{{ else }}{{ .Values.filer.s3.port }}{{ end }}
    targetPort: {{ if .Values.s3.enabled }}{{ .Values.s3.port }}{{ else }}{{ .Values.filer.s3.port }}{{ end }}
    protocol: TCP
+{{- if and .Values.s3.enabled .Values.s3.httpsPort }}
+  - name: "swfs-s3-tls"
+    port: {{ .Values.s3.httpsPort }}
+    targetPort: {{ .Values.s3.httpsPort }}
+    protocol: TCP
+{{- end }}
 {{- if and .Values.s3.enabled .Values.s3.metricsPort }}
  - name: "metrics"
    port: {{ .Values.s3.metricsPort }}
@@ -19,5 +27,5 @@ spec:
    protocol: TCP
 {{- end }}
  selector:
-    app: {{ template "seaweedfs.name" . }}
-    component: {{ if .Values.s3.enabled }}s3{{ else }}filer{{ end }}
+    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    app.kubernetes.io/component: {{ if .Values.s3.enabled }}s3{{ else }}filer{{ end }}
@@ -6,8 +6,11 @@ metadata:
  name: {{ template "seaweedfs.name" . }}-s3
  namespace: {{ .Release.Namespace }}
  labels:
-    app: {{ template "seaweedfs.name" . }}
-    component: s3
+    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: s3
 spec:
  endpoints:
    - interval: 30s
@@ -12,6 +12,12 @@ metadata:
  annotations:
    "helm.sh/resource-policy": keep
    "helm.sh/hook": "pre-install"
+  labels:
+    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: s3
 stringData:
  admin_access_key_id: {{ $access_key_admin }}
  admin_secret_access_key: {{ $secret_key_admin }}
@@ -7,6 +7,11 @@ metadata:
  annotations:
    "helm.sh/resource-policy": keep
    "helm.sh/hook": "pre-install"
+  labels:
+    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
 stringData:
  user: "YourSWUser"
  password: "HardCodedPassword"
@@ -5,10 +5,10 @@ metadata:
  name: {{ template "seaweedfs.name" . }}-security-config
  namespace: {{ .Release.Namespace }}
  labels:
-    app: {{ template "seaweedfs.name" . }}
-    chart: {{ template "seaweedfs.chart" . }}
-    heritage: {{ .Release.Service }}
-    release: {{ .Release.Name }}
+    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
 data:
  security.toml: |-
    # this file is read by master, volume server, and filer
@@ -1,9 +1,15 @@
+{{- if .Values.global.createClusterRole }}
 #hack for delete pod master after migration
 ---
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
  name: seaweedfs-rw-cr
+  labels:
+    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
 rules:
  - apiGroups: [""]
    resources: ["pods"]
@@ -14,11 +20,21 @@ kind: ServiceAccount
 metadata:
  name: seaweedfs-rw-sa
  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
 ---
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
  name: system:serviceaccount:seaweedfs-rw-sa:default
+  labels:
+    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
 subjects:
 - kind: ServiceAccount
  name: seaweedfs-rw-sa
@@ -27,3 +43,4 @@ roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: seaweedfs-rw-cr
+{{- end }}
@@ -1,16 +1,23 @@
 {{- if .Values.global.enableSecurity }}
-apiVersion: certmanager.k8s.io/v1alpha1
+apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Certificate
 metadata:
  name: {{ template "seaweedfs.name" . }}-volume-cert
  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: volume
 spec:
  secretName: {{ template "seaweedfs.name" . }}-volume-cert
  issuerRef:
-    name: {{ template "seaweedfs.name" . }}-clusterissuer
-    kind: ClusterIssuer
+    name: {{ template "seaweedfs.name" . }}-ca-issuer
+    kind: Issuer
  commonName: {{ .Values.certificates.commonName }}
-  organization:
+  subject:
+    organizations:
    - "SeaweedFS CA"
  dnsNames:
    - '*.{{ .Release.Namespace }}'
@@ -26,8 +33,9 @@ spec:
    - {{ . }}
    {{- end }}
 {{- end }}
-  keyAlgorithm: {{ .Values.certificates.keyAlgorithm }}
-  keySize: {{ .Values.certificates.keySize }}
+  privateKey:
+    algorithm: {{ .Values.certificates.keyAlgorithm }}
+    size: {{ .Values.certificates.keySize }}
  duration: {{ .Values.certificates.duration }}
  renewBefore: {{ .Values.certificates.renewBefore }}
 {{- end }}
@@ -4,8 +4,10 @@ metadata:
  name: {{ template "seaweedfs.name" . }}-volume
  namespace: {{ .Release.Namespace }}
  labels:
-    app: {{ template "seaweedfs.name" . }}
-    component: volume
+    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    app.kubernetes.io/component: volume
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
 spec:
  clusterIP: None
  ports:
@@ -24,5 +26,5 @@ spec:
    protocol: TCP
 {{- end }}
  selector:
-    app: {{ template "seaweedfs.name" . }}
-    component: volume
+    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    app.kubernetes.io/component: volume
@@ -6,8 +6,11 @@ metadata:
  name: {{ template "seaweedfs.name" . }}-volume
  namespace: {{ .Release.Namespace }}
  labels:
-    app: {{ template "seaweedfs.name" . }}
-    component: volume
+    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: volume
 spec:
  endpoints:
    - interval: 30s
@@ -15,7 +18,7 @@ spec:
      scrapeTimeout: 5s
  selector:
    matchLabels:
-      app: {{ template "seaweedfs.name" . }}
-      component: volume
+      app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+      app.kubernetes.io/component: volume
 {{- end }}
 {{- end }}
@@ -5,27 +5,27 @@ metadata:
  name: {{ template "seaweedfs.name" . }}-volume
  namespace: {{ .Release.Namespace }}
  labels:
-    app: {{ template "seaweedfs.name" . }}
-    chart: {{ template "seaweedfs.chart" . }}
-    heritage: {{ .Release.Service }}
-    release: {{ .Release.Name }}
+    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
 spec:
  serviceName: {{ template "seaweedfs.name" . }}-volume
  replicas: {{ .Values.volume.replicas }}
  podManagementPolicy: Parallel
  selector:
    matchLabels:
-      app: {{ template "seaweedfs.name" . }}
-      chart: {{ template "seaweedfs.chart" . }}
-      release: {{ .Release.Name }}
-      component: volume
+      app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+      helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      app.kubernetes.io/component: volume
  template:
    metadata:
      labels:
-        app: {{ template "seaweedfs.name" . }}
-        chart: {{ template "seaweedfs.chart" . }}
-        release: {{ .Release.Name }}
-        component: volume
+        app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+        helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        app.kubernetes.io/component: volume
    spec:
      {{- if .Values.volume.affinity }}
      affinity:
@@ -36,15 +36,15 @@ spec:
      tolerations:
        {{ tpl .Values.volume.tolerations . | nindent 8 | trim }}
      {{- end }}
-      {{- if .Values.global.imagePullSecrets }}
-      imagePullSecrets:
-        - name: {{ .Values.global.imagePullSecrets }}
-      {{- end }}
+      {{- include "seaweedfs.imagePullSecrets" . | nindent 6 }}
      terminationGracePeriodSeconds: 150
      {{- if .Values.volume.priorityClassName }}
      priorityClassName: {{ .Values.volume.priorityClassName | quote }}
      {{- end }}
      enableServiceLinks: false
+      {{- if .Values.volume.serviceAccountName }}
+      serviceAccountName: {{ .Values.volume.serviceAccountName | quote }}
+      {{- end }}
      {{- $initContainers_exists := include "volume.initContainers_exists" . -}}
      {{- if $initContainers_exists }}
      initContainers:
@@ -148,8 +148,10 @@ spec:
            - name: idx
              mountPath: "{{ .Values.volume.dir_idx }}/"
            {{- end }}
+            {{- if eq .Values.volume.logs.type "hostPath" }}
            - name: logs
              mountPath: "/logs/"
+            {{- end }}
            {{- if .Values.global.enableSecurity }}
            - name: security-config
              readOnly: true
@@ -181,26 +183,30 @@ spec:
            {{- end }}
            - containerPort: {{ .Values.volume.grpcPort }}
              name: swfs-vol-grpc
+          {{- if .Values.volume.readinessProbe.enabled }}
          readinessProbe:
            httpGet:
-              path: /status
+              path: {{ .Values.volume.readinessProbe.httpGet.path }}
              port: {{ .Values.volume.port }}
-              scheme: HTTP
-            initialDelaySeconds: 15
-            periodSeconds: 15
-            successThreshold: 1
-            failureThreshold: 100
-            timeoutSeconds: 30
+              scheme: {{ .Values.volume.readinessProbe.scheme }}
+            initialDelaySeconds: {{ .Values.volume.readinessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.volume.readinessProbe.periodSeconds }}
+            successThreshold: {{ .Values.volume.readinessProbe.successThreshold }}
+            failureThreshold: {{ .Values.volume.readinessProbe.failureThreshold }}
+            timeoutSeconds: {{ .Values.volume.readinessProbe.timeoutSeconds }}
+          {{- end }}
+          {{- if .Values.volume.livenessProbe.enabled }}
          livenessProbe:
            httpGet:
-              path: /status
+              path: {{ .Values.volume.livenessProbe.httpGet.path }}
              port: {{ .Values.volume.port }}
-              scheme: HTTP
-            initialDelaySeconds: 20
-            periodSeconds: 90
-            successThreshold: 1
-            failureThreshold: 4
-            timeoutSeconds: 30
+              scheme: {{ .Values.volume.livenessProbe.scheme }}
+            initialDelaySeconds: {{ .Values.volume.livenessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.volume.livenessProbe.periodSeconds }}
+            successThreshold: {{ .Values.volume.livenessProbe.successThreshold }}
+            failureThreshold: {{ .Values.volume.livenessProbe.failureThreshold }}
+            timeoutSeconds: {{ .Values.volume.livenessProbe.timeoutSeconds }}
+          {{- end }}
          {{- if .Values.volume.resources }}
          resources:
            {{ tpl .Values.volume.resources . | nindent 12 | trim }}
@@ -1,6 +1,7 @@
 # Available parameters and their default values for the SeaweedFS chart.

 global:
+  createClusterRole: true
  registry: ""
  repository: ""
  imageName: chrislusf/seaweedfs
@@ -9,6 +10,8 @@ global:
  restartPolicy: Always
  loggingLevel: 1
  enableSecurity: false
+  certificates:
+    alphacrds: false
  monitoring:
    enabled: false
    gatewayHost: null
@@ -59,6 +62,10 @@ master:
  # Disable http request, only gRpc operations are allowed
  disableHttp: false

+  config: |-
+    # Enter any extra configuration for master.toml here.
+    # It may be be a multi-line string.
+
  # can use ANY storage-class , example with local-path-provisioner
  #  data:
  #    type: "persistentVolumeClaim"
@@ -99,9 +106,9 @@ master:
      requiredDuringSchedulingIgnoredDuringExecution:
        - labelSelector:
            matchLabels:
-              app: {{ template "seaweedfs.name" . }}
-              release: "{{ .Release.Name }}"
-              component: master
+              app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+              app.kubernetes.io/instance: {{ .Release.Name }}
+              app.kubernetes.io/component: master
          topologyKey: kubernetes.io/hostname

  # Toleration Settings for master pods
@@ -121,10 +128,16 @@ master:
  # ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
  priorityClassName: ""

+  # used to assign a service account.
+  # ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
+  serviceAccountName: ""
+
  ingress:
    enabled: false
    className: "nginx"
-    annotations:
+    # host: false for "*" hostname
+    host: "master.seaweedfs.local"
+    annotations: |
      nginx.ingress.kubernetes.io/auth-type: "basic"
      nginx.ingress.kubernetes.io/auth-secret: "default/ingress-basic-auth-secret"
      nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required - SW-Master'
@@ -147,6 +160,32 @@ master:
    WEED_MASTER_VOLUME_GROWTH_COPY_3: 3
    WEED_MASTER_VOLUME_GROWTH_COPY_OTHER: 1

+  # used to configure livenessProbe on master-server containers
+  #
+  livenessProbe:
+    enabled: true
+    httpGet:
+      path: /cluster/status
+      scheme: HTTP
+    initialDelaySeconds: 20
+    periodSeconds: 30
+    successThreshold: 1
+    failureThreshold: 4
+    timeoutSeconds: 10
+
+  # used to configure readinessProbe on master-server containers
+  #
+  readinessProbe:
+    enabled: true
+    httpGet:
+      path: /cluster/status
+      scheme: HTTP
+    initialDelaySeconds: 10
+    periodSeconds: 45
+    successThreshold: 2
+    failureThreshold: 100
+    timeoutSeconds: 10
+
 volume:
  enabled: true
  repository: null
@@ -232,16 +271,16 @@ volume:
      requiredDuringSchedulingIgnoredDuringExecution:
        - labelSelector:
            matchLabels:
-              app: {{ template "seaweedfs.name" . }}
-              release: "{{ .Release.Name }}"
-              component: volume
+              app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+              app.kubernetes.io/instance: {{ .Release.Name }}
+              app.kubernetes.io/component: volume
          topologyKey: kubernetes.io/hostname

  # Resource requests, limits, etc. for the server cluster placement. This
  # should map directly to the value of the resources field for a PodSpec,
  # formatted as a multi-line string. By default no direct resource request
  # is made.
-  resources: {}
+  resources: null

  # Toleration Settings for server pods
  # This should be a multi-line string matching the Toleration array
@@ -260,6 +299,35 @@ volume:
  # ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
  priorityClassName: ""

+  # used to assign a service account.
+  # ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
+  serviceAccountName: ""
+
+  # used to configure livenessProbe on volume-server containers
+  #
+  livenessProbe:
+    enabled: true
+    httpGet:
+      path: /status
+      scheme: HTTP
+    initialDelaySeconds: 20
+    periodSeconds: 90
+    successThreshold: 1
+    failureThreshold: 4
+    timeoutSeconds: 30
+
+  # used to configure readinessProbe on volume-server containers
+  #
+  readinessProbe:
+    enabled: true
+    httpGet:
+      path: /status
+      scheme: HTTP
+    initialDelaySeconds: 15
+    periodSeconds: 15
+    successThreshold: 1
+    failureThreshold: 100
+    timeoutSeconds: 30

 filer:
  enabled: true
@@ -273,6 +341,7 @@ filer:
  grpcPort: 18888
  metricsPort: 9327
  loggingOverrideLevel: null
+  filerGroup: ""
  #  replication type is XYZ:
  # X number of replica in other data centers
  # Y number of replica in other racks in the same data center
@@ -335,9 +404,9 @@ filer:
      requiredDuringSchedulingIgnoredDuringExecution:
        - labelSelector:
            matchLabels:
-              app: {{ template "seaweedfs.name" . }}
-              release: "{{ .Release.Name }}"
-              component: filer
+              app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+              app.kubernetes.io/instance: {{ .Release.Name }}
+              app.kubernetes.io/component: filer
          topologyKey: kubernetes.io/hostname

  # updatePartition is used to control a careful rolling update of SeaweedFS
@@ -367,10 +436,17 @@ filer:
  # ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
  priorityClassName: ""

+  # used to assign a service account.
+  # ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
+  serviceAccountName: ""
+
  ingress:
    enabled: false
    className: "nginx"
-    annotations:
+    # host: false for "*" hostname
+    host: "seaweedfs.cluster.local"
+    annotations: |
+      nginx.ingress.kubernetes.io/backend-protocol: GRPC
      nginx.ingress.kubernetes.io/auth-type: "basic"
      nginx.ingress.kubernetes.io/auth-secret: "default/ingress-basic-auth-secret"
      nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required - SW-Filer'
@@ -407,6 +483,31 @@ filer:
    # directories under this folder will be automatically creating a separate bucket
    WEED_FILER_BUCKETS_FOLDER: "/buckets"

+  # used to configure livenessProbe on filer containers
+  #
+  livenessProbe:
+    enabled: true
+    httpGet:
+      path: /
+      scheme: HTTP
+    initialDelaySeconds: 20
+    periodSeconds: 30
+    successThreshold: 1
+    failureThreshold: 5
+    timeoutSeconds: 10
+
+  # used to configure readinessProbe on filer containers
+  #
+  readinessProbe:
+    enabled: true
+    httpGet:
+      path: /
+      scheme: HTTP
+    initialDelaySeconds: 10
+    periodSeconds: 15
+    successThreshold: 1
+    failureThreshold: 100
+    timeoutSeconds: 10

  # secret env variables
  secretExtraEnvironmentVars: []
@@ -422,6 +523,8 @@ filer:
  s3:
    enabled: true
    port: 8333
+    # add additional https port
+    httpsPort: 0
    # allow empty folders
    allowEmptyFolder: false
    # Suffix of the host name, {bucket}.{domainName}
@@ -440,6 +543,8 @@ s3:
  replicas: 1
  bindAddress: 0.0.0.0
  port: 8333
+  # add additional https port
+  httpsPort: 0
  metricsPort: 9327
  loggingOverrideLevel: null
  # allow empty folders
@@ -480,12 +585,42 @@ s3:
  # ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
  priorityClassName: ""

+  # used to assign a service account.
+  # ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
+  serviceAccountName: ""
+
  logs:
    type: "hostPath"
    size: ""
    storageClass: ""
    hostPathPrefix: /storage

+  # used to configure livenessProbe on s3 containers
+  #
+  livenessProbe:
+    enabled: true
+    httpGet:
+      path: /status
+      scheme: HTTP
+    initialDelaySeconds: 20
+    periodSeconds: 60
+    successThreshold: 1
+    failureThreshold: 20
+    timeoutSeconds: 10
+
+  # used to configure readinessProbe on s3 containers
+  #
+  readinessProbe:
+    enabled: true
+    httpGet:
+      path: /status
+      scheme: HTTP
+    initialDelaySeconds: 15
+    periodSeconds: 15
+    successThreshold: 1
+    failureThreshold: 100
+    timeoutSeconds: 10
+
 certificates:
  commonName: "SeaweedFS CA"
  ipAddresses: []
@@ -5,7 +5,7 @@

    <groupId>com.github.chrislusf</groupId>
    <artifactId>seaweedfs-client</artifactId>
-    <version>3.33</version>
+    <version>3.55</version>

    <parent>
        <groupId>org.sonatype.oss</groupId>
@@ -5,7 +5,7 @@

    <groupId>com.github.chrislusf</groupId>
    <artifactId>seaweedfs-client</artifactId>
-    <version>3.33</version>
+    <version>3.55</version>

    <parent>
        <groupId>org.sonatype.oss</groupId>
@@ -5,7 +5,7 @@

    <groupId>com.github.chrislusf</groupId>
    <artifactId>seaweedfs-client</artifactId>
-    <version>3.33</version>
+    <version>3.55</version>

    <parent>
        <groupId>org.sonatype.oss</groupId>
@@ -128,6 +128,7 @@ public class FileChunkManifest {

        FilerProto.FileChunk.Builder manifestChunk = SeaweedWrite.writeChunk(
                filerClient.getReplication(),
+                filerClient.getCollection(),
                filerClient,
                minOffset,
                data, 0, data.length, parentDirectory);
@@ -21,7 +21,7 @@ public class FilerSslContext {
        String home = System.getProperty("user.home");
        File f1 = new File("./"+securityFileName);
        File f2 = new File(home + "/.seaweedfs/"+securityFileName);
-        File f3 = new File(home + "/etc/seaweedfs/"+securityFileName);
+        File f3 = new File("/etc/seaweedfs/"+securityFileName);

        File securityFile = f1.exists()? f1 : f2.exists() ? f2 : f3.exists()? f3 : null;

@@ -33,6 +33,7 @@ public class SeaweedOutputStream extends OutputStream {
    private ByteBuffer buffer;
    private long outputIndex;
    private String replication = "";
+    private String collection = "";

    public SeaweedOutputStream(FilerClient filerClient, final String fullpath) {
        this(filerClient, fullpath, "");
@@ -53,7 +54,6 @@ public class SeaweedOutputStream extends OutputStream {
        this.lastFlushOffset = 0;
        this.bufferSize = bufferSize;
        this.buffer = ByteBufferPool.request(bufferSize);
-        this.outputIndex = 0;
        this.writeOperations = new ConcurrentLinkedDeque<>();

        this.maxConcurrentRequestCount = Runtime.getRuntime().availableProcessors();
@@ -83,6 +83,13 @@ public class SeaweedOutputStream extends OutputStream {

    }

+    public void setReplication(String replication) {
+        this.replication = replication;
+    }
+    public void setCollection(String collection) {
+        this.collection = collection;
+    }
+
    public static String getParentDirectory(String path) {
        int protoIndex = path.indexOf("://");
        if (protoIndex >= 0) {
@@ -144,13 +151,11 @@ public class SeaweedOutputStream extends OutputStream {

            if (numberOfBytesToWrite < writableBytes) {
                buffer.put(data, currentOffset, numberOfBytesToWrite);
-                outputIndex += numberOfBytesToWrite;
                break;
            }

            // System.out.println(path + "     [" + (outputIndex + currentOffset) + "," + ((outputIndex + currentOffset) + writableBytes) + ") " + buffer.capacity());
            buffer.put(data, currentOffset, writableBytes);
-            outputIndex += writableBytes;
            currentOffset += writableBytes;
            writeCurrentBufferToService();
            numberOfBytesToWrite = numberOfBytesToWrite - writableBytes;
@@ -194,7 +199,6 @@ public class SeaweedOutputStream extends OutputStream {
            lastError = new IOException("Stream is closed!");
            ByteBufferPool.release(buffer);
            buffer = null;
-            outputIndex = 0;
            closed = true;
            writeOperations.clear();
            if (!threadExecutor.isShutdown()) {
@@ -225,7 +229,7 @@ public class SeaweedOutputStream extends OutputStream {
        }
        final Future<Void> job = completionService.submit(() -> {
            // System.out.println(path + " is going to save [" + (writePosition) + "," + ((writePosition) + bytesLength) + ")");
-            SeaweedWrite.writeData(entry, replication, filerClient, writePosition, bufferToWrite.array(), bufferToWrite.position(), bufferToWrite.limit(), path);
+            SeaweedWrite.writeData(entry, replication, collection, filerClient, writePosition, bufferToWrite.array(), bufferToWrite.position(), bufferToWrite.limit(), path);
            // System.out.println(path + " saved [" + (writePosition) + "," + ((writePosition) + bytesLength) + ")");
            ByteBufferPool.release(bufferToWrite);
            return null;
@@ -26,6 +26,7 @@ public class SeaweedWrite {

    public static void writeData(FilerProto.Entry.Builder entry,
                                 final String replication,
+                                 String collection,
                                 final FilerClient filerClient,
                                 final long offset,
                                 final byte[] bytes,
@@ -36,7 +37,7 @@ public class SeaweedWrite {
        for (long waitTime = 1000L; waitTime < 10 * 1000; waitTime += waitTime / 2) {
            try {
                FilerProto.FileChunk.Builder chunkBuilder = writeChunk(
-                        replication, filerClient, offset, bytes, bytesOffset, bytesLength, path);
+                        replication, collection, filerClient, offset, bytes, bytesOffset, bytesLength, path);
                lastException = null;
                synchronized (entry) {
                    entry.addChunks(chunkBuilder);
@@ -59,6 +60,7 @@ public class SeaweedWrite {
    }

    public static FilerProto.FileChunk.Builder writeChunk(final String replication,
+                                                          final String collection,
                                                          final FilerClient filerClient,
                                                          final long offset,
                                                          final byte[] bytes,
@@ -67,7 +69,7 @@ public class SeaweedWrite {
                                                          final String path) throws IOException {
        FilerProto.AssignVolumeResponse response = filerClient.getBlockingStub().assignVolume(
                FilerProto.AssignVolumeRequest.newBuilder()
-                        .setCollection(filerClient.getCollection())
+                        .setCollection(Strings.isNullOrEmpty(collection) ? filerClient.getCollection() : collection)
                        .setReplication(Strings.isNullOrEmpty(replication) ? filerClient.getReplication() : replication)
                        .setDataCenter("")
                        .setTtlSec(0)
@@ -68,6 +68,16 @@ service SeaweedFiler {

    rpc CacheRemoteObjectToLocalCluster (CacheRemoteObjectToLocalClusterRequest) returns (CacheRemoteObjectToLocalClusterResponse) {
    }
+
+    rpc DistributedLock(LockRequest) returns (LockResponse) {
+    }
+    rpc DistributedUnlock(UnlockRequest) returns (UnlockResponse) {
+    }
+    rpc FindLockOwner(FindLockOwnerRequest) returns (FindLockOwnerResponse) {
+    }
+    // distributed lock management internal use only
+    rpc TransferLocks(TransferLocksRequest) returns (TransferLocksResponse) {
+    }
 }

 //////////////////////////////////////////////////
@@ -428,3 +438,46 @@ message CacheRemoteObjectToLocalClusterRequest {
 message CacheRemoteObjectToLocalClusterResponse {
    Entry entry = 1;
 }
+
+/////////////////////////
+// distributed lock management
+/////////////////////////
+message LockRequest {
+    string name = 1;
+    int64 seconds_to_lock = 2;
+    string renew_token = 3;
+    bool is_moved = 4;
+    string owner = 5;
+}
+message LockResponse {
+    string renew_token = 1;
+    string moved_to = 2;
+    string error = 3;
+}
+message UnlockRequest {
+    string name = 1;
+    string renew_token = 2;
+    bool is_moved = 3;
+}
+message UnlockResponse {
+    string error = 1;
+    string moved_to = 2;
+}
+message FindLockOwnerRequest {
+    string name = 1;
+    bool is_moved = 2;
+}
+message FindLockOwnerResponse {
+    string owner = 1;
+}
+message Lock {
+    string name = 1;
+    string renew_token = 2;
+    int64 expired_at_ns = 3;
+    string owner = 4;
+}
+message TransferLocksRequest {
+    repeated Lock locks = 1;
+}
+message TransferLocksResponse {
+}
@@ -11,19 +11,19 @@
        <dependency>
            <groupId>com.github.chrislusf</groupId>
            <artifactId>seaweedfs-client</artifactId>
-            <version>3.33</version>
+            <version>3.55</version>
            <scope>compile</scope>
        </dependency>
        <dependency>
            <groupId>com.github.chrislusf</groupId>
            <artifactId>seaweedfs-hadoop2-client</artifactId>
-            <version>3.33</version>
+            <version>3.55</version>
            <scope>compile</scope>
        </dependency>
        <dependency>
            <groupId>org.apache.hadoop</groupId>
            <artifactId>hadoop-common</artifactId>
-            <version>2.10.1</version>
+            <version>2.10.2</version>
            <scope>compile</scope>
        </dependency>
    </dependencies>
@@ -317,7 +317,7 @@
    </snapshotRepository>
  </distributionManagement>
  <properties>
-    <seaweedfs.client.version>3.33</seaweedfs.client.version>
+    <seaweedfs.client.version>3.55</seaweedfs.client.version>
    <hadoop.version>3.2.4</hadoop.version>
  </properties>
 </project>
@@ -5,7 +5,7 @@
    <modelVersion>4.0.0</modelVersion>

    <properties>
-        <seaweedfs.client.version>3.33</seaweedfs.client.version>
+        <seaweedfs.client.version>3.55</seaweedfs.client.version>
        <hadoop.version>3.2.4</hadoop.version>
    </properties>

@@ -317,7 +317,7 @@
    </snapshotRepository>
  </distributionManagement>
  <properties>
-    <seaweedfs.client.version>3.33</seaweedfs.client.version>
+    <seaweedfs.client.version>3.55</seaweedfs.client.version>
    <hadoop.version>3.2.4</hadoop.version>
  </properties>
 </project>
@@ -5,7 +5,7 @@
    <modelVersion>4.0.0</modelVersion>

    <properties>
-        <seaweedfs.client.version>3.33</seaweedfs.client.version>
+        <seaweedfs.client.version>3.55</seaweedfs.client.version>
        <hadoop.version>3.2.4</hadoop.version>
    </properties>

@@ -2452,7 +2452,27 @@
  "style": "dark",
  "tags": [],
  "templating": {
-    "list": []
+    "list": [
+      {
+        "current": {
+          "selected": true,
+          "text": "default",
+          "value": "default"
+        },
+        "hide": 0,
+        "includeAll": false,
+        "label": "Datasource",
+        "multi": false,
+        "name": "DS_PROMETHEUS",
+        "options": [],
+        "query": "prometheus",
+        "queryValue": "",
+        "refresh": 1,
+        "regex": "",
+        "skipUrlSync": false,
+        "type": "datasource"
+      }
+    ]
  },
  "time": {
    "from": "now-3h",
@@ -1895,7 +1895,27 @@
  "style": "dark",
  "tags": [],
  "templating": {
-    "list": []
+    "list": [
+      {
+        "current": {
+          "selected": true,
+          "text": "default",
+          "value": "default"
+        },
+        "hide": 0,
+        "includeAll": false,
+        "label": "Datasource",
+        "multi": false,
+        "name": "DS_PROMETHEUS",
+        "options": [],
+        "query": "prometheus",
+        "queryValue": "",
+        "refresh": 1,
+        "regex": "",
+        "skipUrlSync": false,
+        "type": "datasource"
+      }
+    ]
  },
  "time": {
    "from": "now-5m",
@@ -2179,8 +2179,8 @@
      {
        "current": {
          "selected": true,
-          "text": "clickhouse-prom",
-          "value": "clickhouse-prom"
+          "text": "default",
+          "value": "default"
        },
        "hide": 0,
        "includeAll": false,
@@ -8,7 +8,7 @@
    <version>1.0-SNAPSHOT</version>

    <properties>
-        <guava.version>30.0-jre</guava.version>
+        <guava.version>32.0.0-jre</guava.version>
    </properties>

    <dependencies>
@@ -0,0 +1,114 @@
+package main
+
+import (
+	"context"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/aws/retry"
+	"github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/credentials"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"time"
+)
+
+func main() {
+	cfg := MyConfig{
+		Key:    "any",
+		Secret: "any",
+		Region: "US",
+		Endpoint: MyEndpoint{
+			URL: "http://localhost:8333",
+		},
+		Bucket: MyBucketConfig{
+			Name:       "newbucket",
+			Versioning: false,
+		},
+		MaxBackoffDelay:  aws.Int(int(time.Second * 5)),
+		MaxRetryAttempts: aws.Int(1),
+	}
+
+	awsCfg, err := MyAwsConfig(cfg)
+	if err != nil {
+		panic(err)
+	}
+	svc := s3.NewFromConfig(*awsCfg, func(o *s3.Options) {
+		o.UsePathStyle = true
+	})
+
+	// Use the S3 client to interact with SeaweedFS
+	// ...
+	// Example: List all buckets
+	result, err := svc.ListBuckets(context.Background(), &s3.ListBucketsInput{})
+	// no errors - got list of buckets
+	if err != nil {
+		panic(err)
+	}
+
+	// Print the list of buckets
+	for _, bucket := range result.Buckets {
+		println(*bucket.Name)
+	}
+
+	bucket := "bucket1"
+	_, err = svc.HeadBucket(context.Background(), &s3.HeadBucketInput{Bucket: &bucket})
+	// ERROR HERE
+	if err != nil {
+		println(err)
+	}
+
+}
+
+// === helpers
+
+func MyAwsConfig(cfg MyConfig) (*aws.Config, error) {
+
+	cred := aws.NewCredentialsCache(credentials.NewStaticCredentialsProvider(cfg.Key, cfg.Secret, ""))
+	customResolver := aws.EndpointResolverWithOptionsFunc(
+		func(service, region string, options ...interface{}) (aws.Endpoint, error) {
+			return aws.Endpoint{
+				URL:           cfg.Endpoint.URL,
+				SigningRegion: cfg.Region,
+			}, nil
+		})
+
+	awsCfg, err := config.LoadDefaultConfig(context.TODO(),
+		config.WithRegion(cfg.Region),
+		config.WithCredentialsProvider(cred),
+		config.WithEndpointResolverWithOptions(customResolver),
+		config.WithRetryer(func() aws.Retryer {
+			r := retry.AddWithMaxAttempts(retry.NewStandard(), *cfg.MaxRetryAttempts)
+			return retry.AddWithMaxBackoffDelay(r, time.Duration(*cfg.MaxBackoffDelay*1000*1000))
+		}))
+	return &awsCfg, err
+}
+
+type MyConfig struct {
+	// Access key of S3 AWS.
+	Key string
+	// Access secret of S3 AWS.
+	Secret string
+	// Region.
+	Region string
+	// AWS endpoint.
+	Endpoint MyEndpoint
+	// Bucket configuration.
+	Bucket MyBucketConfig
+	// File access.
+	FileAccess MyFileAccessType
+	// Maximum backoff delay (ms, default: 20 sec).
+	MaxBackoffDelay *int
+	// Maximum attempts to retry operation on error (default: 5).
+	MaxRetryAttempts *int
+}
+
+type MyBucketConfig struct {
+	// Name of bucket
+	Name string
+	// Enable or not versioning
+	Versioning bool
+}
+
+type MyEndpoint struct {
+	URL string
+}
+
+type MyFileAccessType byte
@@ -2,9 +2,10 @@ package main

 import (
 	"flag"
-	"github.com/seaweedfs/seaweedfs/weed/util"
 	"time"

+	"github.com/seaweedfs/seaweedfs/weed/util"
+
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/storage"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
@@ -32,7 +33,7 @@ func (scanner *VolumeFileScanner4SeeDat) ReadNeedleBody() bool {

 func (scanner *VolumeFileScanner4SeeDat) VisitNeedle(n *needle.Needle, offset int64, needleHeader, needleBody []byte) error {
 	t := time.Unix(int64(n.AppendAtNs)/int64(time.Second), int64(n.AppendAtNs)%int64(time.Second))
-	glog.V(0).Infof("%d,%s%x offset %d size %d(%s) cookie %x appendedAt %v",
+	glog.V(0).Infof("%d,%s%08x offset %d size %d(%s) cookie %08x appendedAt %v",
 		*volumeId, n.Id, n.Cookie, offset, n.Size, util.BytesToHumanReadable(uint64(n.Size)), n.Cookie, t)
 	return nil
 }
@@ -7,7 +7,7 @@ all: install
 .PHONY : clean debug_mount

 install:
-	go install
+	go install -ldflags="-s -w"

 clean:
 	go clean $(SOURCE_DIR)
@@ -37,6 +37,10 @@ debug_s3:
 	go build -gcflags="all=-N -l"
 	dlv --listen=:2345 --headless=true --api-version=2 --accept-multiclient exec ./weed -- -v=4 s3

+debug_mq:
+	go build -gcflags="all=-N -l"
+	dlv --listen=:2345 --headless=true --api-version=2 --accept-multiclient exec ./weed -- -v=4 mq.broker
+
 debug_filer_copy:
 	go build -gcflags="all=-N -l"
 	dlv --listen=:2345 --headless=true --api-version=2 --accept-multiclient exec ./weed -- -v=4 filer.backup -filer=localhost:8888 -filerProxy -timeAgo=10h
@@ -3,7 +3,6 @@ package cluster
 import (
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
-	"math"
 	"sync"
 	"time"
 )
@@ -19,9 +18,6 @@ type FilerGroupName string
 type DataCenter string
 type Rack string

-type Leaders struct {
-	leaders [3]pb.ServerAddress
-}
 type ClusterNode struct {
 	Address    pb.ServerAddress
 	Version    string
@@ -30,10 +26,7 @@ type ClusterNode struct {
 	DataCenter DataCenter
 	Rack       Rack
 }
-type GroupMembers struct {
-	members map[pb.ServerAddress]*ClusterNode
-	leaders *Leaders
-}
+
 type ClusterNodeGroups struct {
 	groupMembers map[FilerGroupName]*GroupMembers
 	sync.RWMutex
@@ -51,50 +44,18 @@ func newClusterNodeGroups() *ClusterNodeGroups {
 func (g *ClusterNodeGroups) getGroupMembers(filerGroup FilerGroupName, createIfNotFound bool) *GroupMembers {
 	members, found := g.groupMembers[filerGroup]
 	if !found && createIfNotFound {
-		members = &GroupMembers{
-			members: make(map[pb.ServerAddress]*ClusterNode),
-			leaders: &Leaders{},
-		}
+		members = newGroupMembers()
 		g.groupMembers[filerGroup] = members
 	}
 	return members
 }

-func (m *GroupMembers) addMember(dataCenter DataCenter, rack Rack, address pb.ServerAddress, version string) *ClusterNode {
-	if existingNode, found := m.members[address]; found {
-		existingNode.counter++
-		return nil
-	}
-	t := &ClusterNode{
-		Address:    address,
-		Version:    version,
-		counter:    1,
-		CreatedTs:  time.Now(),
-		DataCenter: dataCenter,
-		Rack:       rack,
-	}
-	m.members[address] = t
-	return t
-}
-func (m *GroupMembers) removeMember(address pb.ServerAddress) bool {
-	if existingNode, found := m.members[address]; !found {
-		return false
-	} else {
-		existingNode.counter--
-		if existingNode.counter <= 0 {
-			delete(m.members, address)
-			return true
-		}
-	}
-	return false
-}
-
 func (g *ClusterNodeGroups) AddClusterNode(filerGroup FilerGroupName, nodeType string, dataCenter DataCenter, rack Rack, address pb.ServerAddress, version string) []*master_pb.KeepConnectedResponse {
 	g.Lock()
 	defer g.Unlock()
 	m := g.getGroupMembers(filerGroup, true)
 	if t := m.addMember(dataCenter, rack, address, version); t != nil {
-		return ensureGroupLeaders(m, true, filerGroup, nodeType, address)
+		return buildClusterNodeUpdateMessage(true, filerGroup, nodeType, address)
 	}
 	return nil
 }
@@ -106,7 +67,7 @@ func (g *ClusterNodeGroups) RemoveClusterNode(filerGroup FilerGroupName, nodeTyp
 		return nil
 	}
 	if m.removeMember(address) {
-		return ensureGroupLeaders(m, false, filerGroup, nodeType, address)
+		return buildClusterNodeUpdateMessage(false, filerGroup, nodeType, address)
 	}
 	return nil
 }
@@ -122,24 +83,6 @@ func (g *ClusterNodeGroups) ListClusterNode(filerGroup FilerGroupName) (nodes []
 	}
 	return
 }
-func (g *ClusterNodeGroups) IsOneLeader(filerGroup FilerGroupName, address pb.ServerAddress) bool {
-	g.Lock()
-	defer g.Unlock()
-	m := g.getGroupMembers(filerGroup, false)
-	if m == nil {
-		return false
-	}
-	return m.leaders.isOneLeader(address)
-}
-func (g *ClusterNodeGroups) ListClusterNodeLeaders(filerGroup FilerGroupName) (nodes []pb.ServerAddress) {
-	g.Lock()
-	defer g.Unlock()
-	m := g.getGroupMembers(filerGroup, false)
-	if m == nil {
-		return nil
-	}
-	return m.leaders.GetLeaders()
-}

 func NewCluster() *Cluster {
 	return &Cluster{
@@ -166,15 +109,7 @@ func (cluster *Cluster) AddClusterNode(ns, nodeType string, dataCenter DataCente
 	case BrokerType:
 		return cluster.brokerGroups.AddClusterNode(filerGroup, nodeType, dataCenter, rack, address, version)
 	case MasterType:
-		return []*master_pb.KeepConnectedResponse{
-			{
-				ClusterNodeUpdate: &master_pb.ClusterNodeUpdate{
-					NodeType: nodeType,
-					Address:  string(address),
-					IsAdd:    true,
-				},
-			},
-		}
+		return buildClusterNodeUpdateMessage(true, filerGroup, nodeType, address)
 	}
 	return nil
 }
@@ -187,15 +122,7 @@ func (cluster *Cluster) RemoveClusterNode(ns string, nodeType string, address pb
 	case BrokerType:
 		return cluster.brokerGroups.RemoveClusterNode(filerGroup, nodeType, address)
 	case MasterType:
-		return []*master_pb.KeepConnectedResponse{
-			{
-				ClusterNodeUpdate: &master_pb.ClusterNodeUpdate{
-					NodeType: nodeType,
-					Address:  string(address),
-					IsAdd:    false,
-				},
-			},
-		}
+		return buildClusterNodeUpdateMessage(false, filerGroup, nodeType, address)
 	}
 	return nil
 }
@@ -211,145 +138,14 @@ func (cluster *Cluster) ListClusterNode(filerGroup FilerGroupName, nodeType stri
 	return
 }

-func (cluster *Cluster) ListClusterNodeLeaders(filerGroup FilerGroupName, nodeType string) (nodes []pb.ServerAddress) {
-	switch nodeType {
-	case FilerType:
-		return cluster.filerGroups.ListClusterNodeLeaders(filerGroup)
-	case BrokerType:
-		return cluster.brokerGroups.ListClusterNodeLeaders(filerGroup)
-	case MasterType:
-	}
-	return
-}
-
-func (cluster *Cluster) IsOneLeader(filerGroup FilerGroupName, nodeType string, address pb.ServerAddress) bool {
-	switch nodeType {
-	case FilerType:
-		return cluster.filerGroups.IsOneLeader(filerGroup, address)
-	case BrokerType:
-		return cluster.brokerGroups.IsOneLeader(filerGroup, address)
-	case MasterType:
-	}
-	return false
-}
-
-func ensureGroupLeaders(m *GroupMembers, isAdd bool, filerGroup FilerGroupName, nodeType string, address pb.ServerAddress) (result []*master_pb.KeepConnectedResponse) {
-	if isAdd {
-		if m.leaders.addLeaderIfVacant(address) {
-			// has added the address as one leader
-			result = append(result, &master_pb.KeepConnectedResponse{
-				ClusterNodeUpdate: &master_pb.ClusterNodeUpdate{
-					FilerGroup: string(filerGroup),
-					NodeType:   nodeType,
-					Address:    string(address),
-					IsLeader:   true,
-					IsAdd:      true,
-				},
-			})
-		} else {
-			result = append(result, &master_pb.KeepConnectedResponse{
-				ClusterNodeUpdate: &master_pb.ClusterNodeUpdate{
-					FilerGroup: string(filerGroup),
-					NodeType:   nodeType,
-					Address:    string(address),
-					IsLeader:   false,
-					IsAdd:      true,
-				},
-			})
-		}
-	} else {
-		if m.leaders.removeLeaderIfExists(address) {
-
-			result = append(result, &master_pb.KeepConnectedResponse{
-				ClusterNodeUpdate: &master_pb.ClusterNodeUpdate{
-					FilerGroup: string(filerGroup),
-					NodeType:   nodeType,
-					Address:    string(address),
-					IsLeader:   true,
-					IsAdd:      false,
-				},
-			})
-
-			// pick the freshest one, since it is less likely to go away
-			var shortestDuration int64 = math.MaxInt64
-			now := time.Now()
-			var candidateAddress pb.ServerAddress
-			for _, node := range m.members {
-				if m.leaders.isOneLeader(node.Address) {
-					continue
-				}
-				duration := now.Sub(node.CreatedTs).Nanoseconds()
-				if duration < shortestDuration {
-					shortestDuration = duration
-					candidateAddress = node.Address
-				}
-			}
-			if candidateAddress != "" {
-				m.leaders.addLeaderIfVacant(candidateAddress)
-				// added a new leader
-				result = append(result, &master_pb.KeepConnectedResponse{
-					ClusterNodeUpdate: &master_pb.ClusterNodeUpdate{
-						NodeType: nodeType,
-						Address:  string(candidateAddress),
-						IsLeader: true,
-						IsAdd:    true,
-					},
-				})
-			}
-		} else {
-			result = append(result, &master_pb.KeepConnectedResponse{
-				ClusterNodeUpdate: &master_pb.ClusterNodeUpdate{
-					FilerGroup: string(filerGroup),
-					NodeType:   nodeType,
-					Address:    string(address),
-					IsLeader:   false,
-					IsAdd:      false,
-				},
-			})
-		}
-	}
-	return
-}
-
-func (leaders *Leaders) addLeaderIfVacant(address pb.ServerAddress) (hasChanged bool) {
-	if leaders.isOneLeader(address) {
-		return
-	}
-	for i := 0; i < len(leaders.leaders); i++ {
-		if leaders.leaders[i] == "" {
-			leaders.leaders[i] = address
-			hasChanged = true
-			return
-		}
-	}
-	return
-}
-func (leaders *Leaders) removeLeaderIfExists(address pb.ServerAddress) (hasChanged bool) {
-	if !leaders.isOneLeader(address) {
-		return
-	}
-	for i := 0; i < len(leaders.leaders); i++ {
-		if leaders.leaders[i] == address {
-			leaders.leaders[i] = ""
-			hasChanged = true
-			return
-		}
-	}
-	return
-}
-func (leaders *Leaders) isOneLeader(address pb.ServerAddress) bool {
-	for i := 0; i < len(leaders.leaders); i++ {
-		if leaders.leaders[i] == address {
-			return true
-		}
-	}
-	return false
-}
-func (leaders *Leaders) GetLeaders() (addresses []pb.ServerAddress) {
-	for i := 0; i < len(leaders.leaders); i++ {
-		if leaders.leaders[i] != "" {
-			addresses = append(addresses, leaders.leaders[i])
-		}
-	}
+func buildClusterNodeUpdateMessage(isAdd bool, filerGroup FilerGroupName, nodeType string, address pb.ServerAddress) (result []*master_pb.KeepConnectedResponse) {
+	result = append(result, &master_pb.KeepConnectedResponse{
+		ClusterNodeUpdate: &master_pb.ClusterNodeUpdate{
+			FilerGroup: string(filerGroup),
+			NodeType:   nodeType,
+			Address:    string(address),
+			IsAdd:      isAdd,
+		},
+	})
 	return
 }
@@ -2,52 +2,11 @@ package cluster

 import (
 	"github.com/seaweedfs/seaweedfs/weed/pb"
-	"github.com/stretchr/testify/assert"
 	"strconv"
 	"sync"
 	"testing"
 )

-func TestClusterAddRemoveNodes(t *testing.T) {
-	c := NewCluster()
-
-	c.AddClusterNode("", "filer", "", "", pb.ServerAddress("111:1"), "23.45")
-	c.AddClusterNode("", "filer", "", "", pb.ServerAddress("111:2"), "23.45")
-	assert.Equal(t, []pb.ServerAddress{
-		pb.ServerAddress("111:1"),
-		pb.ServerAddress("111:2"),
-	}, c.getGroupMembers("", "filer", true).leaders.GetLeaders())
-
-	c.AddClusterNode("", "filer", "", "", pb.ServerAddress("111:3"), "23.45")
-	c.AddClusterNode("", "filer", "", "", pb.ServerAddress("111:4"), "23.45")
-	assert.Equal(t, []pb.ServerAddress{
-		pb.ServerAddress("111:1"),
-		pb.ServerAddress("111:2"),
-		pb.ServerAddress("111:3"),
-	}, c.getGroupMembers("", "filer", true).leaders.GetLeaders())
-
-	c.AddClusterNode("", "filer", "", "", pb.ServerAddress("111:5"), "23.45")
-	c.AddClusterNode("", "filer", "", "", pb.ServerAddress("111:6"), "23.45")
-	c.RemoveClusterNode("", "filer", pb.ServerAddress("111:4"))
-	assert.Equal(t, []pb.ServerAddress{
-		pb.ServerAddress("111:1"),
-		pb.ServerAddress("111:2"),
-		pb.ServerAddress("111:3"),
-	}, c.getGroupMembers("", "filer", true).leaders.GetLeaders())
-
-	// remove oldest
-	c.RemoveClusterNode("", "filer", pb.ServerAddress("111:1"))
-	assert.Equal(t, []pb.ServerAddress{
-		pb.ServerAddress("111:6"),
-		pb.ServerAddress("111:2"),
-		pb.ServerAddress("111:3"),
-	}, c.getGroupMembers("", "filer", true).leaders.GetLeaders())
-
-	// remove oldest
-	c.RemoveClusterNode("", "filer", pb.ServerAddress("111:1"))
-
-}
-
 func TestConcurrentAddRemoveNodes(t *testing.T) {
 	c := NewCluster()
 	var wg sync.WaitGroup
@@ -0,0 +1,52 @@
+package cluster
+
+import (
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"time"
+)
+
+type GroupMembers struct {
+	members map[pb.ServerAddress]*ClusterNode
+}
+
+func newGroupMembers() *GroupMembers {
+	return &GroupMembers{
+		members: make(map[pb.ServerAddress]*ClusterNode),
+	}
+}
+
+func (m *GroupMembers) addMember(dataCenter DataCenter, rack Rack, address pb.ServerAddress, version string) *ClusterNode {
+	if existingNode, found := m.members[address]; found {
+		existingNode.counter++
+		return nil
+	}
+	t := &ClusterNode{
+		Address:    address,
+		Version:    version,
+		counter:    1,
+		CreatedTs:  time.Now(),
+		DataCenter: dataCenter,
+		Rack:       rack,
+	}
+	m.members[address] = t
+	return t
+}
+func (m *GroupMembers) removeMember(address pb.ServerAddress) bool {
+	if existingNode, found := m.members[address]; !found {
+		return false
+	} else {
+		existingNode.counter--
+		if existingNode.counter <= 0 {
+			delete(m.members, address)
+			return true
+		}
+	}
+	return false
+}
+
+func (m *GroupMembers) GetMembers() (addresses []pb.ServerAddress) {
+	for k := range m.members {
+		addresses = append(addresses, k)
+	}
+	return
+}
@@ -0,0 +1,210 @@
+package cluster
+
+import (
+	"context"
+	"fmt"
+	"github.com/seaweedfs/seaweedfs/weed/cluster/lock_manager"
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	"google.golang.org/grpc"
+	"time"
+)
+
+type LockClient struct {
+	grpcDialOption  grpc.DialOption
+	maxLockDuration time.Duration
+	sleepDuration   time.Duration
+	seedFiler       pb.ServerAddress
+}
+
+func NewLockClient(grpcDialOption grpc.DialOption, seedFiler pb.ServerAddress) *LockClient {
+	return &LockClient{
+		grpcDialOption:  grpcDialOption,
+		maxLockDuration: 5 * time.Second,
+		sleepDuration:   2473 * time.Millisecond,
+		seedFiler:       seedFiler,
+	}
+}
+
+type LiveLock struct {
+	key            string
+	renewToken     string
+	expireAtNs     int64
+	filer          pb.ServerAddress
+	cancelCh       chan struct{}
+	grpcDialOption grpc.DialOption
+	isLocked       bool
+	owner          string
+	lc             *LockClient
+}
+
+// NewLock creates a lock with a very long duration
+func (lc *LockClient) NewLock(key string, owner string) (lock *LiveLock) {
+	return lc.doNewLock(key, lock_manager.MaxDuration, owner)
+}
+
+// StartLock starts a goroutine to lock the key and returns immediately.
+func (lc *LockClient) StartLock(key string, owner string) (lock *LiveLock) {
+	lock = &LiveLock{
+		key:            key,
+		filer:          lc.seedFiler,
+		cancelCh:       make(chan struct{}),
+		expireAtNs:     time.Now().Add(lock_manager.MaxDuration).UnixNano(),
+		grpcDialOption: lc.grpcDialOption,
+		owner:          owner,
+		lc:             lc,
+	}
+	go func() {
+		util.RetryForever("create lock:"+key, func() error {
+			errorMessage, err := lock.doLock(lock_manager.MaxDuration)
+			if err != nil {
+				glog.Infof("create lock %s: %s", key, err)
+				time.Sleep(time.Second)
+				return err
+			}
+			if errorMessage != "" {
+				glog.Infof("create lock %s: %s", key, errorMessage)
+				time.Sleep(time.Second)
+				return fmt.Errorf("%v", errorMessage)
+			}
+			lock.isLocked = true
+			return nil
+		}, func(err error) (shouldContinue bool) {
+			if err != nil {
+				glog.Warningf("create lock %s: %s", key, err)
+				time.Sleep(time.Second)
+			}
+			return lock.renewToken == ""
+		})
+		lc.keepLock(lock)
+	}()
+	return
+}
+
+func (lc *LockClient) doNewLock(key string, lockDuration time.Duration, owner string) (lock *LiveLock) {
+	lock = &LiveLock{
+		key:            key,
+		filer:          lc.seedFiler,
+		cancelCh:       make(chan struct{}),
+		expireAtNs:     time.Now().Add(lockDuration).UnixNano(),
+		grpcDialOption: lc.grpcDialOption,
+		owner:          owner,
+		lc:             lc,
+	}
+	var needRenewal bool
+	if lockDuration > lc.maxLockDuration {
+		lockDuration = lc.maxLockDuration
+		needRenewal = true
+	}
+	util.RetryForever("create lock:"+key, func() error {
+		errorMessage, err := lock.doLock(lockDuration)
+		if err != nil {
+			time.Sleep(time.Second)
+			return err
+		}
+		if errorMessage != "" {
+			time.Sleep(time.Second)
+			return fmt.Errorf("%v", errorMessage)
+		}
+		lock.isLocked = true
+		return nil
+	}, func(err error) (shouldContinue bool) {
+		if err != nil {
+			glog.Warningf("create lock %s: %s", key, err)
+		}
+		return lock.renewToken == ""
+	})
+
+	if needRenewal {
+		go lc.keepLock(lock)
+	}
+
+	return
+}
+
+func (lock *LiveLock) IsLocked() bool {
+	return lock.isLocked
+}
+
+func (lock *LiveLock) StopLock() error {
+	close(lock.cancelCh)
+	if !lock.isLocked {
+		return nil
+	}
+	return pb.WithFilerClient(false, 0, lock.filer, lock.grpcDialOption, func(client filer_pb.SeaweedFilerClient) error {
+		_, err := client.DistributedUnlock(context.Background(), &filer_pb.UnlockRequest{
+			Name:       lock.key,
+			RenewToken: lock.renewToken,
+		})
+		return err
+	})
+}
+
+func (lc *LockClient) keepLock(lock *LiveLock) {
+	ticker := time.Tick(lc.sleepDuration)
+	for {
+		select {
+		case <-ticker:
+			// renew the lock if lock.expireAtNs is still greater than now
+			util.RetryForever("keep lock:"+lock.key, func() error {
+				lockDuration := time.Duration(lock.expireAtNs-time.Now().UnixNano()) * time.Nanosecond
+				if lockDuration > lc.maxLockDuration {
+					lockDuration = lc.maxLockDuration
+				}
+				if lockDuration <= 0 {
+					return nil
+				}
+
+				errorMessage, err := lock.doLock(lockDuration)
+				if err != nil {
+					lock.isLocked = false
+					time.Sleep(time.Second)
+					return err
+				}
+				if errorMessage != "" {
+					lock.isLocked = false
+					time.Sleep(time.Second)
+					return fmt.Errorf("%v", errorMessage)
+				}
+				return nil
+			}, func(err error) (shouldContinue bool) {
+				if err == nil {
+					return false
+				}
+				glog.Warningf("keep lock %s: %v", lock.key, err)
+				return true
+			})
+			if !lock.isLocked {
+				return
+			}
+		case <-lock.cancelCh:
+			return
+		}
+	}
+}
+
+func (lock *LiveLock) doLock(lockDuration time.Duration) (errorMessage string, err error) {
+	err = pb.WithFilerClient(false, 0, lock.filer, lock.grpcDialOption, func(client filer_pb.SeaweedFilerClient) error {
+		resp, err := client.DistributedLock(context.Background(), &filer_pb.LockRequest{
+			Name:          lock.key,
+			SecondsToLock: int64(lockDuration.Seconds()),
+			RenewToken:    lock.renewToken,
+			IsMoved:       false,
+			Owner:         lock.owner,
+		})
+		if err == nil {
+			lock.renewToken = resp.RenewToken
+		}
+		if resp != nil {
+			errorMessage = resp.Error
+			if resp.MovedTo != "" {
+				lock.filer = pb.ServerAddress(resp.MovedTo)
+				lock.lc.seedFiler = lock.filer
+			}
+		}
+		return err
+	})
+	return
+}
@@ -0,0 +1,99 @@
+package lock_manager
+
+import (
+	"fmt"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"time"
+)
+
+const MaxDuration = 1<<63 - 1
+
+var NoLockServerError = fmt.Errorf("no lock server found")
+
+type DistributedLockManager struct {
+	lockManager *LockManager
+	LockRing    *LockRing
+	Host        pb.ServerAddress
+}
+
+func NewDistributedLockManager(host pb.ServerAddress) *DistributedLockManager {
+	return &DistributedLockManager{
+		lockManager: NewLockManager(),
+		LockRing:    NewLockRing(time.Second * 5),
+		Host:        host,
+	}
+}
+
+func (dlm *DistributedLockManager) LockWithTimeout(key string, expiredAtNs int64, token string, owner string) (renewToken string, movedTo pb.ServerAddress, err error) {
+	movedTo, err = dlm.findLockOwningFiler(key)
+	if err != nil {
+		return
+	}
+	if movedTo != dlm.Host {
+		return
+	}
+	renewToken, err = dlm.lockManager.Lock(key, expiredAtNs, token, owner)
+	return
+}
+
+func (dlm *DistributedLockManager) findLockOwningFiler(key string) (movedTo pb.ServerAddress, err error) {
+	servers := dlm.LockRing.GetSnapshot()
+	if servers == nil {
+		err = NoLockServerError
+		return
+	}
+
+	movedTo = hashKeyToServer(key, servers)
+	return
+}
+
+func (dlm *DistributedLockManager) FindLockOwner(key string) (owner string, movedTo pb.ServerAddress, err error) {
+	movedTo, err = dlm.findLockOwningFiler(key)
+	if err != nil {
+		return
+	}
+	if movedTo != dlm.Host {
+		return
+	}
+	owner, err = dlm.lockManager.GetLockOwner(key)
+	return
+}
+
+func (dlm *DistributedLockManager) Unlock(key string, token string) (movedTo pb.ServerAddress, err error) {
+	servers := dlm.LockRing.GetSnapshot()
+	if servers == nil {
+		err = NoLockServerError
+		return
+	}
+
+	server := hashKeyToServer(key, servers)
+	if server != dlm.Host {
+		movedTo = server
+		return
+	}
+	_, err = dlm.lockManager.Unlock(key, token)
+	return
+}
+
+// InsertLock is used to insert a lock to a server unconditionally
+// It is used when a server is down and the lock is moved to another server
+func (dlm *DistributedLockManager) InsertLock(key string, expiredAtNs int64, token string, owner string) {
+	dlm.lockManager.InsertLock(key, expiredAtNs, token, owner)
+}
+func (dlm *DistributedLockManager) SelectNotOwnedLocks(servers []pb.ServerAddress) (locks []*Lock) {
+	return dlm.lockManager.SelectLocks(func(key string) bool {
+		server := hashKeyToServer(key, servers)
+		return server != dlm.Host
+	})
+}
+func (dlm *DistributedLockManager) CalculateTargetServer(key string, servers []pb.ServerAddress) pb.ServerAddress {
+	return hashKeyToServer(key, servers)
+}
+
+func (dlm *DistributedLockManager) IsLocal(key string) bool {
+	servers := dlm.LockRing.GetSnapshot()
+	if len(servers) <= 1 {
+		return true
+	}
+	return hashKeyToServer(key, servers) == dlm.Host
+}
@@ -0,0 +1,150 @@
+package lock_manager
+
+import (
+	"fmt"
+	"github.com/google/uuid"
+	"github.com/puzpuzpuz/xsync/v2"
+	"time"
+)
+
+var LockErrorNonEmptyTokenOnNewLock = fmt.Errorf("lock: non-empty token on a new lock")
+var LockErrorNonEmptyTokenOnExpiredLock = fmt.Errorf("lock: non-empty token on an expired lock")
+var LockErrorTokenMismatch = fmt.Errorf("lock: token mismatch")
+var UnlockErrorTokenMismatch = fmt.Errorf("unlock: token mismatch")
+
+// LockManager local lock manager, used by distributed lock manager
+type LockManager struct {
+	locks *xsync.MapOf[string, *Lock]
+}
+type Lock struct {
+	Token       string
+	ExpiredAtNs int64
+	Key         string // only used for moving locks
+	Owner       string
+}
+
+func NewLockManager() *LockManager {
+	t := &LockManager{
+		locks: xsync.NewMapOf[*Lock](),
+	}
+	go t.CleanUp()
+	return t
+}
+
+func (lm *LockManager) Lock(path string, expiredAtNs int64, token string, owner string) (renewToken string, err error) {
+	lm.locks.Compute(path, func(oldValue *Lock, loaded bool) (newValue *Lock, delete bool) {
+		if oldValue != nil {
+			if oldValue.ExpiredAtNs > 0 && oldValue.ExpiredAtNs < time.Now().UnixNano() {
+				// lock is expired, set to a new lock
+				if token != "" {
+					err = LockErrorNonEmptyTokenOnExpiredLock
+					return nil, false
+				} else {
+					// new lock
+					renewToken = uuid.New().String()
+					return &Lock{Token: renewToken, ExpiredAtNs: expiredAtNs, Owner: owner}, false
+				}
+			}
+			// not expired
+			if oldValue.Token == token {
+				// token matches, renew the lock
+				renewToken = uuid.New().String()
+				return &Lock{Token: renewToken, ExpiredAtNs: expiredAtNs, Owner: owner}, false
+			} else {
+				err = LockErrorTokenMismatch
+				return oldValue, false
+			}
+		} else {
+			if token == "" {
+				// new lock
+				renewToken = uuid.New().String()
+				return &Lock{Token: renewToken, ExpiredAtNs: expiredAtNs, Owner: owner}, false
+			} else {
+				err = LockErrorNonEmptyTokenOnNewLock
+				return nil, false
+			}
+		}
+	})
+	return
+}
+
+func (lm *LockManager) Unlock(path string, token string) (isUnlocked bool, err error) {
+	lm.locks.Compute(path, func(oldValue *Lock, loaded bool) (newValue *Lock, delete bool) {
+		if oldValue != nil {
+			now := time.Now()
+			if oldValue.ExpiredAtNs > 0 && oldValue.ExpiredAtNs < now.UnixNano() {
+				// lock is expired, delete it
+				isUnlocked = true
+				return nil, true
+			}
+			if oldValue.Token == token {
+				if oldValue.ExpiredAtNs <= now.UnixNano() {
+					isUnlocked = true
+					return nil, true
+				}
+				return oldValue, false
+			} else {
+				isUnlocked = false
+				err = UnlockErrorTokenMismatch
+				return oldValue, false
+			}
+		} else {
+			isUnlocked = true
+			return nil, true
+		}
+	})
+	return
+}
+
+func (lm *LockManager) CleanUp() {
+	for {
+		time.Sleep(1 * time.Minute)
+		now := time.Now().UnixNano()
+		lm.locks.Range(func(key string, value *Lock) bool {
+			if value == nil {
+				return true
+			}
+			if now > value.ExpiredAtNs {
+				lm.locks.Delete(key)
+				return true
+			}
+			return true
+		})
+	}
+}
+
+// SelectLocks takes out locks by key
+// if keyFn return true, the lock will be taken out
+func (lm *LockManager) SelectLocks(selectFn func(key string) bool) (locks []*Lock) {
+	now := time.Now().UnixNano()
+	lm.locks.Range(func(key string, lock *Lock) bool {
+		if now > lock.ExpiredAtNs {
+			lm.locks.Delete(key)
+			return true
+		}
+		if selectFn(key) {
+			lm.locks.Delete(key)
+			lock.Key = key
+			locks = append(locks, lock)
+		}
+		return true
+	})
+	return
+}
+
+// InsertLock inserts a lock unconditionally
+func (lm *LockManager) InsertLock(path string, expiredAtNs int64, token string, owner string) {
+	lm.locks.Store(path, &Lock{Token: token, ExpiredAtNs: expiredAtNs, Owner: owner})
+}
+
+func (lm *LockManager) GetLockOwner(key string) (owner string, err error) {
+	lm.locks.Range(func(k string, lock *Lock) bool {
+		if k == key && lock != nil {
+			owner = lock.Owner
+			return false
+		}
+		return true
+	})
+	return
+
+}
@@ -0,0 +1,174 @@
+package lock_manager
+
+import (
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	"sort"
+	"sync"
+	"time"
+)
+
+type LockRingSnapshot struct {
+	servers []pb.ServerAddress
+	ts      time.Time
+}
+
+type LockRing struct {
+	sync.RWMutex
+	snapshots        []*LockRingSnapshot
+	candidateServers map[pb.ServerAddress]struct{}
+	lastUpdateTime   time.Time
+	lastCompactTime  time.Time
+	snapshotInterval time.Duration
+	onTakeSnapshot   func(snapshot []pb.ServerAddress)
+}
+
+func NewLockRing(snapshotInterval time.Duration) *LockRing {
+	return &LockRing{
+		snapshotInterval: snapshotInterval,
+		candidateServers: make(map[pb.ServerAddress]struct{}),
+	}
+}
+
+func (r *LockRing) SetTakeSnapshotCallback(onTakeSnapshot func(snapshot []pb.ServerAddress)) {
+	r.Lock()
+	defer r.Unlock()
+	r.onTakeSnapshot = onTakeSnapshot
+}
+
+// AddServer adds a server to the ring
+// if the previous snapshot passed the snapshot interval, create a new snapshot
+func (r *LockRing) AddServer(server pb.ServerAddress) {
+	r.Lock()
+
+	if _, found := r.candidateServers[server]; found {
+		r.Unlock()
+		return
+	}
+	r.lastUpdateTime = time.Now()
+	r.candidateServers[server] = struct{}{}
+	r.Unlock()
+
+	r.takeSnapshotWithDelayedCompaction()
+}
+
+func (r *LockRing) RemoveServer(server pb.ServerAddress) {
+	r.Lock()
+
+	if _, found := r.candidateServers[server]; !found {
+		r.Unlock()
+		return
+	}
+	r.lastUpdateTime = time.Now()
+	delete(r.candidateServers, server)
+	r.Unlock()
+
+	r.takeSnapshotWithDelayedCompaction()
+}
+
+func (r *LockRing) SetSnapshot(servers []pb.ServerAddress) {
+
+	sort.Slice(servers, func(i, j int) bool {
+		return servers[i] < servers[j]
+	})
+
+	r.lastUpdateTime = time.Now()
+
+	r.addOneSnapshot(servers)
+
+	go func() {
+		<-time.After(r.snapshotInterval)
+		r.compactSnapshots()
+	}()
+}
+
+func (r *LockRing) takeSnapshotWithDelayedCompaction() {
+	r.doTakeSnapshot()
+
+	go func() {
+		<-time.After(r.snapshotInterval)
+		r.compactSnapshots()
+	}()
+}
+
+func (r *LockRing) doTakeSnapshot() {
+	servers := r.getSortedServers()
+
+	r.addOneSnapshot(servers)
+}
+
+func (r *LockRing) addOneSnapshot(servers []pb.ServerAddress) {
+	r.Lock()
+	defer r.Unlock()
+
+	ts := time.Now()
+	t := &LockRingSnapshot{
+		servers: servers,
+		ts:      ts,
+	}
+	r.snapshots = append(r.snapshots, t)
+	for i := len(r.snapshots) - 2; i >= 0; i-- {
+		r.snapshots[i+1] = r.snapshots[i]
+	}
+	r.snapshots[0] = t
+
+	if r.onTakeSnapshot != nil {
+		r.onTakeSnapshot(t.servers)
+	}
+}
+
+func (r *LockRing) compactSnapshots() {
+	r.Lock()
+	defer r.Unlock()
+
+	if r.lastCompactTime.After(r.lastUpdateTime) {
+		return
+	}
+
+	ts := time.Now()
+	// remove old snapshots
+	recentSnapshotIndex := 1
+	for ; recentSnapshotIndex < len(r.snapshots); recentSnapshotIndex++ {
+		if ts.Sub(r.snapshots[recentSnapshotIndex].ts) > r.snapshotInterval {
+			break
+		}
+	}
+	// keep the one that has been running for a while
+	if recentSnapshotIndex+1 <= len(r.snapshots) {
+		r.snapshots = r.snapshots[:recentSnapshotIndex+1]
+	}
+	r.lastCompactTime = ts
+}
+
+func (r *LockRing) getSortedServers() []pb.ServerAddress {
+	sortedServers := make([]pb.ServerAddress, 0, len(r.candidateServers))
+	for server := range r.candidateServers {
+		sortedServers = append(sortedServers, server)
+	}
+	sort.Slice(sortedServers, func(i, j int) bool {
+		return sortedServers[i] < sortedServers[j]
+	})
+	return sortedServers
+}
+
+func (r *LockRing) GetSnapshot() (servers []pb.ServerAddress) {
+	r.RLock()
+	defer r.RUnlock()
+
+	if len(r.snapshots) == 0 {
+		return
+	}
+	return r.snapshots[0].servers
+}
+
+func hashKeyToServer(key string, servers []pb.ServerAddress) pb.ServerAddress {
+	if len(servers) == 0 {
+		return ""
+	}
+	x := util.HashStringToLong(key)
+	if x < 0 {
+		x = -x
+	}
+	x = x % int64(len(servers))
+	return servers[x]
+}
@@ -0,0 +1,43 @@
+package lock_manager
+
+import (
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/stretchr/testify/assert"
+	"testing"
+	"time"
+)
+
+func TestAddServer(t *testing.T) {
+	r := NewLockRing(100 * time.Millisecond)
+	r.AddServer("localhost:8080")
+	assert.Equal(t, 1, len(r.snapshots))
+	r.AddServer("localhost:8081")
+	r.AddServer("localhost:8082")
+	r.AddServer("localhost:8083")
+	r.AddServer("localhost:8084")
+	r.RemoveServer("localhost:8084")
+	r.RemoveServer("localhost:8082")
+	r.RemoveServer("localhost:8080")
+
+	assert.Equal(t, 8, len(r.snapshots))
+
+	time.Sleep(110 * time.Millisecond)
+
+	assert.Equal(t, 2, len(r.snapshots))
+
+}
+
+func TestLockRing(t *testing.T) {
+	r := NewLockRing(100 * time.Millisecond)
+	r.SetSnapshot([]pb.ServerAddress{"localhost:8080", "localhost:8081"})
+	assert.Equal(t, 1, len(r.snapshots))
+	r.SetSnapshot([]pb.ServerAddress{"localhost:8080", "localhost:8081", "localhost:8082"})
+	assert.Equal(t, 2, len(r.snapshots))
+	time.Sleep(110 * time.Millisecond)
+	r.SetSnapshot([]pb.ServerAddress{"localhost:8080", "localhost:8081", "localhost:8082", "localhost:8083"})
+	assert.Equal(t, 3, len(r.snapshots))
+	time.Sleep(110 * time.Millisecond)
+	assert.Equal(t, 2, len(r.snapshots))
+	r.SetSnapshot([]pb.ServerAddress{"localhost:8080", "localhost:8081", "localhost:8082", "localhost:8083", "localhost:8084"})
+	assert.Equal(t, 3, len(r.snapshots))
+}
@@ -22,7 +22,6 @@ func ListExistingPeerUpdates(master pb.ServerAddress, grpcDialOption grpc.DialOp
 			existingNodes = append(existingNodes, &master_pb.ClusterNodeUpdate{
 				NodeType:    FilerType,
 				Address:     node.Address,
-				IsLeader:    node.IsLeader,
 				IsAdd:       true,
 				CreatedAtNs: node.CreatedAtNs,
 			})
@@ -137,7 +137,7 @@ func runBackup(cmd *Command, args []string) bool {

 	if datSize > stats.TailOffset {
 		// remove the old data
-		v.Destroy()
+		v.Destroy(false)
 		// recreate an empty volume
 		v, err = storage.NewVolume(util.ResolvePath(*s.dir), util.ResolvePath(*s.dir), *s.collection, vid, storage.NeedleMapInMemory, replication, ttl, 0, 0, 0)
 		if err != nil {
@@ -127,7 +127,7 @@ func runBenchmark(cmd *Command, args []string) bool {
 		defer pprof.StopCPUProfile()
 	}

-	b.masterClient = wdclient.NewMasterClient(b.grpcDialOption, "", "client", "", "", "", pb.ServerAddresses(*b.masters).ToAddressMap())
+	b.masterClient = wdclient.NewMasterClient(b.grpcDialOption, "", "client", "", "", "", *pb.ServerAddresses(*b.masters).ToServiceDiscovery())
 	go b.masterClient.KeepConnectedToMaster()
 	b.masterClient.WaitUntilConnected()

@@ -33,7 +33,7 @@ var (
 )

 type FilerOptions struct {
-	masters                 map[string]pb.ServerAddress
+	masters                 *pb.ServerDiscovery
 	mastersString           *string
 	ip                      *string
 	bindIp                  *string
@@ -65,7 +65,7 @@ type FilerOptions struct {

 func init() {
 	cmdFiler.Run = runFiler // break init cycle
-	f.mastersString = cmdFiler.Flag.String("master", "localhost:9333", "comma-separated master servers")
+	f.mastersString = cmdFiler.Flag.String("master", "localhost:9333", "comma-separated master servers or a single DNS SRV record of at least 1 master server, prepended with dnssrv+")
 	f.filerGroup = cmdFiler.Flag.String("filerGroup", "", "share metadata with other filers in the same filerGroup")
 	f.collection = cmdFiler.Flag.String("collection", "", "all data will be stored in this default collection")
 	f.ip = cmdFiler.Flag.String("ip", util.DetectedHostAddress(), "filer server http listen ip address")
@@ -95,6 +95,7 @@ func init() {
 	// start s3 on filer
 	filerStartS3 = cmdFiler.Flag.Bool("s3", false, "whether to start S3 gateway")
 	filerS3Options.port = cmdFiler.Flag.Int("s3.port", 8333, "s3 server http listen port")
+	filerS3Options.portHttps = cmdFiler.Flag.Int("s3.port.https", 0, "s3 server https listen port")
 	filerS3Options.portGrpc = cmdFiler.Flag.Int("s3.port.grpc", 0, "s3 server grpc listen port")
 	filerS3Options.domainName = cmdFiler.Flag.String("s3.domainName", "", "suffix of the host name in comma separated list, {bucket}.{domainName}")
 	filerS3Options.dataCenter = cmdFiler.Flag.String("s3.dataCenter", "", "prefer to read and write to volumes in this data center")
@@ -104,6 +105,7 @@ func init() {
 	filerS3Options.auditLogConfig = cmdFiler.Flag.String("s3.auditLogConfig", "", "path to the audit log config file")
 	filerS3Options.allowEmptyFolder = cmdFiler.Flag.Bool("s3.allowEmptyFolder", true, "allow empty folders")
 	filerS3Options.allowDeleteBucketNotEmpty = cmdFiler.Flag.Bool("s3.allowDeleteBucketNotEmpty", true, "allow recursive deleting all entries along with bucket")
+	filerS3Options.localSocket = cmdFiler.Flag.String("s3.localSocket", "", "default to /tmp/seaweedfs-s3-<port>.sock")

 	// start webdav on filer
 	filerStartWebDav = cmdFiler.Flag.Bool("webdav", false, "whether to start webdav gateway")
@@ -206,7 +208,7 @@ func runFiler(cmd *Command, args []string) bool {
 		}(startDelay)
 	}

-	f.masters = pb.ServerAddresses(*f.mastersString).ToAddressMap()
+	f.masters = pb.ServerAddresses(*f.mastersString).ToServiceDiscovery()

 	f.startFiler()

@@ -385,6 +385,9 @@ func extractBucketPath(bucketsDir, dir string) (util.FullPath, bool) {
 func (option *RemoteGatewayOptions) collectRemoteStorageConf() (err error) {

 	if mappings, err := filer.ReadMountMappings(option.grpcDialOption, pb.ServerAddress(*option.filerAddress)); err != nil {
+		if err == filer_pb.ErrNotFound {
+			return fmt.Errorf("remote storage is not configured in filer server")
+		}
 		return err
 	} else {
 		option.mappings = mappings
@@ -25,7 +25,8 @@ var cmdFix = &Command{
 	UsageLine: "fix [-volumeId=234] [-collection=bigData] /tmp",
 	Short:     "run weed tool fix on files or whole folders to recreate index file(s) if corrupted",
 	Long: `Fix runs the SeaweedFS fix command on dat files or whole folders to re-create the index .idx file.
-  `,
+  You Need to stop the volume server when running this command.
+`,
 }

 var (
@@ -42,8 +43,8 @@ type VolumeFileScanner4Fix struct {
 func (scanner *VolumeFileScanner4Fix) VisitSuperBlock(superBlock super_block.SuperBlock) error {
 	scanner.version = superBlock.Version
 	return nil
-
 }
+
 func (scanner *VolumeFileScanner4Fix) ReadNeedleBody() bool {
 	return false
 }
@@ -115,7 +116,6 @@ func runFix(cmd *Command, args []string) bool {
 }

 func doFixOneVolume(basepath string, baseFileName string, collection string, volumeId int64) {
-
 	indexFileName := path.Join(basepath, baseFileName+".idx")

 	nm := needle_map.NewMemDb()
@@ -146,13 +146,15 @@ func runFuse(cmd *Command, args []string) bool {
 				panic(fmt.Errorf("concurrentWriters: %s", err))
 			}
 		case "cacheDir":
-			mountOptions.cacheDir = &parameter.value
+			mountOptions.cacheDirForRead = &parameter.value
 		case "cacheCapacityMB":
 			if parsed, err := strconv.ParseInt(parameter.value, 0, 64); err == nil {
-				mountOptions.cacheSizeMB = &parsed
+				mountOptions.cacheSizeMBForRead = &parsed
 			} else {
 				panic(fmt.Errorf("cacheCapacityMB: %s", err))
 			}
+		case "cacheDirWrite":
+			mountOptions.cacheDirForWrite = &parameter.value
 		case "dataCenter":
 			mountOptions.dataCenter = &parameter.value
 		case "allowOthers":
@@ -17,8 +17,9 @@ type MountOptions struct {
 	ttlSec             *int
 	chunkSizeLimitMB   *int
 	concurrentWriters  *int
-	cacheDir           *string
-	cacheSizeMB        *int64
+	cacheDirForRead    *string
+	cacheDirForWrite   *string
+	cacheSizeMBForRead *int64
 	dataCenter         *string
 	allowOthers        *bool
 	umaskString        *string
@@ -54,8 +55,9 @@ func init() {
 	mountOptions.ttlSec = cmdMount.Flag.Int("ttl", 0, "file ttl in seconds")
 	mountOptions.chunkSizeLimitMB = cmdMount.Flag.Int("chunkSizeLimitMB", 2, "local write buffer size, also chunk large files")
 	mountOptions.concurrentWriters = cmdMount.Flag.Int("concurrentWriters", 32, "limit concurrent goroutine writers")
-	mountOptions.cacheDir = cmdMount.Flag.String("cacheDir", os.TempDir(), "local cache directory for file chunks and meta data")
-	mountOptions.cacheSizeMB = cmdMount.Flag.Int64("cacheCapacityMB", 0, "file chunk read cache capacity in MB")
+	mountOptions.cacheDirForRead = cmdMount.Flag.String("cacheDir", os.TempDir(), "local cache directory for file chunks and meta data")
+	mountOptions.cacheSizeMBForRead = cmdMount.Flag.Int64("cacheCapacityMB", 0, "file chunk read cache capacity in MB")
+	mountOptions.cacheDirForWrite = cmdMount.Flag.String("cacheDirWrite", os.TempDir(), "buffer writes mostly for large files")
 	mountOptions.dataCenter = cmdMount.Flag.String("dataCenter", "", "prefer to write to the data center")
 	mountOptions.allowOthers = cmdMount.Flag.Bool("allowOthers", true, "allows other users to access the file system")
 	mountOptions.umaskString = cmdMount.Flag.String("umask", "022", "octal umask, e.g., 022, 0111")
@@ -225,8 +225,9 @@ func RunMount(option *MountOptions, umask os.FileMode) bool {
 		DiskType:           types.ToDiskType(*option.diskType),
 		ChunkSizeLimit:     int64(chunkSizeLimitMB) * 1024 * 1024,
 		ConcurrentWriters:  *option.concurrentWriters,
-		CacheDir:           *option.cacheDir,
-		CacheSizeMB:        *option.cacheSizeMB,
+		CacheDirForRead:    *option.cacheDirForRead,
+		CacheSizeMBForRead: *option.cacheSizeMBForRead,
+		CacheDirForWrite:   *option.cacheDirForWrite,
 		DataCenter:         *option.dataCenter,
 		Quota:              int64(*option.collectionQuota) * 1024 * 1024,
 		MountUid:           uid,
@@ -241,6 +242,14 @@ func RunMount(option *MountOptions, umask os.FileMode) bool {
 		DisableXAttr:       *option.disableXAttr,
 	})

+	// create mount root
+	mountRootPath := util.FullPath(mountRoot)
+	mountRootParent, mountDir := mountRootPath.DirAndName()
+	if err = filer_pb.Mkdir(seaweedFileSystem, mountRootParent, mountDir, nil); err != nil {
+		fmt.Printf("failed to create dir %s on filer %s: %v\n", mountRoot, filerAddresses, err)
+		return false
+	}
+
 	server, err := fuse.NewServer(seaweedFileSystem, dir, fuseMountOptions)
 	if err != nil {
 		glog.Fatalf("Mount fail: %v", err)
@@ -2,12 +2,19 @@ package command

 import (
 	"context"
+	"crypto/tls"
 	"fmt"
-	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
-	"google.golang.org/grpc/reflection"
+	"net"
 	"net/http"
+	"os"
+	"runtime"
 	"time"

+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+	"google.golang.org/grpc/credentials/tls/certprovider"
+	"google.golang.org/grpc/credentials/tls/certprovider/pemfile"
+	"google.golang.org/grpc/reflection"
+
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/s3_pb"
@@ -29,6 +36,7 @@ type S3Options struct {
 	filer                     *string
 	bindIp                    *string
 	port                      *int
+	portHttps                 *int
 	portGrpc                  *int
 	config                    *string
 	domainName                *string
@@ -40,6 +48,8 @@ type S3Options struct {
 	auditLogConfig            *string
 	localFilerSocket          *string
 	dataCenter                *string
+	localSocket               *string
+	certProvider              certprovider.Provider
 }

 func init() {
@@ -47,6 +57,7 @@ func init() {
 	s3StandaloneOptions.filer = cmdS3.Flag.String("filer", "localhost:8888", "filer server address")
 	s3StandaloneOptions.bindIp = cmdS3.Flag.String("ip.bind", "", "ip address to bind to. Default to localhost.")
 	s3StandaloneOptions.port = cmdS3.Flag.Int("port", 8333, "s3 server http listen port")
+	s3StandaloneOptions.portHttps = cmdS3.Flag.Int("port.https", 0, "s3 server https listen port")
 	s3StandaloneOptions.portGrpc = cmdS3.Flag.Int("port.grpc", 0, "s3 server grpc listen port")
 	s3StandaloneOptions.domainName = cmdS3.Flag.String("domainName", "", "suffix of the host name in comma separated list, {bucket}.{domainName}")
 	s3StandaloneOptions.dataCenter = cmdS3.Flag.String("dataCenter", "", "prefer to read and write to volumes in this data center")
@@ -58,6 +69,7 @@ func init() {
 	s3StandaloneOptions.allowEmptyFolder = cmdS3.Flag.Bool("allowEmptyFolder", true, "allow empty folders")
 	s3StandaloneOptions.allowDeleteBucketNotEmpty = cmdS3.Flag.Bool("allowDeleteBucketNotEmpty", true, "allow recursive deleting all entries along with bucket")
 	s3StandaloneOptions.localFilerSocket = cmdS3.Flag.String("localFilerSocket", "", "local filer socket path")
+	s3StandaloneOptions.localSocket = cmdS3.Flag.String("localSocket", "", "default to /tmp/seaweedfs-s3-<port>.sock")
 }

 var cmdS3 = &Command{
@@ -150,11 +162,18 @@ func runS3(cmd *Command, args []string) bool {

 }

+// GetCertificateWithUpdate Auto refreshing TSL certificate
+func (S3opt *S3Options) GetCertificateWithUpdate(*tls.ClientHelloInfo) (*tls.Certificate, error) {
+	certs, err := S3opt.certProvider.KeyMaterial(context.Background())
+	return &certs.Certs[0], err
+}
+
 func (s3opt *S3Options) startS3Server() bool {

 	filerAddress := pb.ServerAddress(*s3opt.filer)

 	filerBucketsPath := "/buckets"
+	filerGroup := ""

 	grpcDialOption := security.LoadClientTLS(util.GetViper(), "grpc.client")

@@ -169,6 +188,7 @@ func (s3opt *S3Options) startS3Server() bool {
 				return fmt.Errorf("get filer %s configuration: %v", filerAddress, err)
 			}
 			filerBucketsPath = resp.DirBuckets
+			filerGroup = resp.FilerGroup
 			metricsAddress, metricsIntervalSec = resp.MetricsAddress, int(resp.MetricsIntervalSec)
 			glog.V(0).Infof("S3 read filer buckets dir: %s", filerBucketsPath)
 			return nil
@@ -200,6 +220,7 @@ func (s3opt *S3Options) startS3Server() bool {
 		AllowDeleteBucketNotEmpty: *s3opt.allowDeleteBucketNotEmpty,
 		LocalFilerSocket:          localFilerSocket,
 		DataCenter:                *s3opt.dataCenter,
+		FilerGroup:                filerGroup,
 	})
 	if s3ApiServer_err != nil {
 		glog.Fatalf("S3 API Server startup error: %v", s3ApiServer_err)
@@ -214,6 +235,24 @@ func (s3opt *S3Options) startS3Server() bool {
 		*s3opt.bindIp = "localhost"
 	}

+	if runtime.GOOS != "windows" {
+		localSocket := *s3opt.localSocket
+		if localSocket == "" {
+			localSocket = fmt.Sprintf("/tmp/seaweedfs-s3-%d.sock", *s3opt.port)
+		}
+		if err := os.Remove(localSocket); err != nil && !os.IsNotExist(err) {
+			glog.Fatalf("Failed to remove %s, error: %s", localSocket, err.Error())
+		}
+		go func() {
+			// start on local unix socket
+			s3SocketListener, err := net.Listen("unix", localSocket)
+			if err != nil {
+				glog.Fatalf("Failed to listen on %s: %v", localSocket, err)
+			}
+			httpS.Serve(s3SocketListener)
+		}()
+	}
+
 	listenAddress := fmt.Sprintf("%s:%d", *s3opt.bindIp, *s3opt.port)
 	s3ApiListener, s3ApiLocalListener, err := util.NewIpAndLocalListeners(*s3opt.bindIp, *s3opt.port, time.Duration(10)*time.Second)
 	if err != nil {
@@ -242,18 +281,46 @@ func (s3opt *S3Options) startS3Server() bool {
 	go grpcS.Serve(grpcL)

 	if *s3opt.tlsPrivateKey != "" {
-		glog.V(0).Infof("Start Seaweed S3 API Server %s at https port %d", util.Version(), *s3opt.port)
-		if s3ApiLocalListener != nil {
+		pemfileOptions := pemfile.Options{
+			CertFile:        *s3opt.tlsCertificate,
+			KeyFile:         *s3opt.tlsPrivateKey,
+			RefreshDuration: security.CredRefreshingInterval,
+		}
+		if s3opt.certProvider, err = pemfile.NewProvider(pemfileOptions); err != nil {
+			glog.Fatalf("pemfile.NewProvider(%v) failed: %v", pemfileOptions, err)
+		}
+		httpS.TLSConfig = &tls.Config{GetCertificate: s3opt.GetCertificateWithUpdate}
+		if *s3opt.portHttps == 0 {
+			glog.V(0).Infof("Start Seaweed S3 API Server %s at https port %d", util.Version(), *s3opt.port)
+			if s3ApiLocalListener != nil {
+				go func() {
+					if err = httpS.ServeTLS(s3ApiLocalListener, "", ""); err != nil {
+						glog.Fatalf("S3 API Server Fail to serve: %v", err)
+					}
+				}()
+			}
+			if err = httpS.ServeTLS(s3ApiListener, "", ""); err != nil {
+				glog.Fatalf("S3 API Server Fail to serve: %v", err)
+			}
+		} else {
+			glog.V(0).Infof("Start Seaweed S3 API Server %s at https port %d", util.Version(), *s3opt.portHttps)
+			s3ApiListenerHttps, s3ApiLocalListenerHttps, _ := util.NewIpAndLocalListeners(
+				*s3opt.bindIp, *s3opt.portHttps, time.Duration(10)*time.Second)
+			if s3ApiLocalListenerHttps != nil {
+				go func() {
+					if err = httpS.ServeTLS(s3ApiLocalListenerHttps, "", ""); err != nil {
+						glog.Fatalf("S3 API Server Fail to serve: %v", err)
+					}
+				}()
+			}
 			go func() {
-				if err = httpS.ServeTLS(s3ApiLocalListener, *s3opt.tlsCertificate, *s3opt.tlsPrivateKey); err != nil {
+				if err = httpS.ServeTLS(s3ApiListenerHttps, "", ""); err != nil {
 					glog.Fatalf("S3 API Server Fail to serve: %v", err)
 				}
 			}()
 		}
-		if err = httpS.ServeTLS(s3ApiListener, *s3opt.tlsCertificate, *s3opt.tlsPrivateKey); err != nil {
-			glog.Fatalf("S3 API Server Fail to serve: %v", err)
-		}
-	} else {
+	}
+	if *s3opt.tlsPrivateKey == "" || *s3opt.portHttps > 0 {
 		glog.V(0).Infof("Start Seaweed S3 API Server %s at http port %d", util.Version(), *s3opt.port)
 		if s3ApiLocalListener != nil {
 			go func() {
@@ -262,6 +262,9 @@ routeByLatency = false
 [etcd]
 enabled = false
 servers = "localhost:2379"
+username = ""
+password = ""
+key_prefix = "seaweedfs."
 timeout = "3s"

 [mongodb]
@@ -139,6 +139,7 @@ func init() {
 	serverOptions.v.readBufferSizeMB = cmdServer.Flag.Int("volume.readBufferSizeMB", 4, "<experimental> larger values can optimize query performance but will increase some memory usage,Use with hasSlowRead normally")

 	s3Options.port = cmdServer.Flag.Int("s3.port", 8333, "s3 server http listen port")
+	s3Options.portHttps = cmdServer.Flag.Int("s3.port.https", 0, "s3 server https listen port")
 	s3Options.portGrpc = cmdServer.Flag.Int("s3.port.grpc", 0, "s3 server grpc listen port")
 	s3Options.domainName = cmdServer.Flag.String("s3.domainName", "", "suffix of the host name in comma separated list, {bucket}.{domainName}")
 	s3Options.tlsPrivateKey = cmdServer.Flag.String("s3.key.file", "", "path to the TLS private key file")
@@ -147,6 +148,7 @@ func init() {
 	s3Options.auditLogConfig = cmdServer.Flag.String("s3.auditLogConfig", "", "path to the audit log config file")
 	s3Options.allowEmptyFolder = cmdServer.Flag.Bool("s3.allowEmptyFolder", true, "allow empty folders")
 	s3Options.allowDeleteBucketNotEmpty = cmdServer.Flag.Bool("s3.allowDeleteBucketNotEmpty", true, "allow recursive deleting all entries along with bucket")
+	s3Options.localSocket = cmdServer.Flag.String("s3.localSocket", "", "default to /tmp/seaweedfs-s3-<port>.sock")

 	iamOptions.port = cmdServer.Flag.Int("iam.port", 8111, "iam server http listen port")

@@ -201,7 +203,7 @@ func runServer(cmd *Command, args []string) bool {
 	// ip address
 	masterOptions.ip = serverIp
 	masterOptions.ipBind = serverBindIp
-	filerOptions.masters = pb.ServerAddresses(*masterOptions.peers).ToAddressMap()
+	filerOptions.masters = pb.ServerAddresses(*masterOptions.peers).ToServiceDiscovery()
 	filerOptions.ip = serverIp
 	filerOptions.bindIp = serverBindIp
 	s3Options.bindIp = serverBindIp
@@ -214,7 +216,7 @@ func runServer(cmd *Command, args []string) bool {
 	serverOptions.v.dataCenter = serverDataCenter
 	serverOptions.v.rack = serverRack
 	mqBrokerOptions.ip = serverIp
-	mqBrokerOptions.masters = filerOptions.masters
+	mqBrokerOptions.masters = filerOptions.masters.GetInstancesAsMap()
 	mqBrokerOptions.filerGroup = filerOptions.filerGroup

 	// serverOptions.v.pulseSeconds = pulseSeconds
--- a/Show More
+++ b/Show More