Support multiple certificates for S3 HTTPS via comma-separated flags

.github/pull_request_template.md

@@ -12,7 +12,6 @@
 # Checks
 - [ ] I have added unit tests if possible.
 - [ ] I will add related wiki document changes and link to this PR after merging.
-- [ ] All AI code review comments have been addressed. No more comments to fix if reviewed again.
 
 # Checks for AI generated PRs
 - [ ] I have reviewed every line of code.

.github/workflows/container_latest.yml

@@ -15,8 +15,15 @@ jobs:
     strategy:
       matrix:
         platform: [amd64, arm64, arm, 386]
-        variant: [standard, large_disk]
-
+        include:
+          - platform: amd64
+            qemu: false
+          - platform: arm64
+            qemu: true
+          - platform: arm
+            qemu: true
+          - platform: 386
+            qemu: true
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -36,18 +43,6 @@ jobs:
           [ -d /go/pkg ] && rm -rf /go/pkg || true
           echo "Available disk space after cleanup:"
           df -h
-      
-      - name: Configure variant
-        id: config
-        run: |
-          if [ "${{ matrix.variant }}" == "large_disk" ]; then
-            echo "tag_suffix=_large_disk" >> $GITHUB_OUTPUT
-            echo "build_args=TAGS=5BytesOffset" >> $GITHUB_OUTPUT
-          else
-            echo "tag_suffix=" >> $GITHUB_OUTPUT
-            echo "build_args=" >> $GITHUB_OUTPUT
-          fi
-
       - name: Docker meta
         id: docker_meta
         uses: docker/metadata-action@v5
@@ -55,13 +50,13 @@ jobs:
           images: |
             chrislusf/seaweedfs
             ghcr.io/chrislusf/seaweedfs
-          tags: type=raw,value=latest,suffix=${{ steps.config.outputs.tag_suffix }}
+          tags: type=raw,value=latest
           labels: |
             org.opencontainers.image.title=seaweedfs
             org.opencontainers.image.description=SeaweedFS is a distributed storage system for blobs, objects, files, and data lake, to store and serve billions of files fast!
             org.opencontainers.image.vendor=Chris Lu
       - name: Set up QEMU
-        if: matrix.platform != 'amd64'
+        if: matrix.qemu
         uses: docker/setup-qemu-action@v3
       - name: Create BuildKit config
         run: |
@@ -87,7 +82,7 @@ jobs:
           registry: ghcr.io
           username: ${{ secrets.GHCR_USERNAME }}
           password: ${{ secrets.GHCR_TOKEN }}
-      - name: Build ${{ matrix.platform }} ${{ matrix.variant }}
+      - name: Build ${{ matrix.platform }}
         uses: docker/build-push-action@v6
         env:
           DOCKER_BUILDKIT: 1
@@ -97,14 +92,13 @@ jobs:
           file: ./docker/Dockerfile.go_build
           platforms: linux/${{ matrix.platform }}
           # Push to GHCR only during build to avoid Docker Hub rate limits
-          tags: ghcr.io/chrislusf/seaweedfs:latest${{ steps.config.outputs.tag_suffix }}-${{ matrix.platform }}
+          tags: ghcr.io/chrislusf/seaweedfs:latest-${{ matrix.platform }}
           labels: ${{ steps.docker_meta.outputs.labels }}
-          cache-from: type=gha,scope=${{ matrix.variant }}-${{ matrix.platform }}
-          cache-to: type=gha,mode=max,scope=${{ matrix.variant }}-${{ matrix.platform }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
           build-args: |
             BUILDKIT_INLINE_CACHE=1
             BRANCH=${{ github.sha }}
-            ${{ steps.config.outputs.build_args }}
       - name: Clean up build artifacts
         if: always()
         run: |
@@ -117,22 +111,9 @@ jobs:
     runs-on: ubuntu-latest
     needs: [build]
     if: github.event_name != 'pull_request'
-    strategy:
-      matrix:
-        variant: [standard, large_disk]
     steps:
       - name: Checkout
         uses: actions/checkout@v6
-      
-      - name: Configure variant
-        id: config
-        run: |
-          if [ "${{ matrix.variant }}" == "large_disk" ]; then
-            echo "tag_suffix=_large_disk" >> $GITHUB_OUTPUT
-          else
-            echo "tag_suffix=" >> $GITHUB_OUTPUT
-          fi
-
       - name: Docker meta
         id: docker_meta
         uses: docker/metadata-action@v5
@@ -140,7 +121,7 @@ jobs:
           images: |
             chrislusf/seaweedfs
             ghcr.io/chrislusf/seaweedfs
-          tags: type=raw,value=latest,suffix=${{ steps.config.outputs.tag_suffix }}
+          tags: type=raw,value=latest
       - name: Login to Docker Hub
         uses: docker/login-action@v3
         with:
@@ -161,15 +142,13 @@ jobs:
           crane version
       - name: Create and push manifest
         run: |
-          SUFFIX="${{ steps.config.outputs.tag_suffix }}"
-          
           # Create manifest on GHCR first (no rate limits)
           echo "Creating GHCR manifest (no rate limits)..."
-          docker buildx imagetools create -t ghcr.io/chrislusf/seaweedfs:latest${SUFFIX} \
-            ghcr.io/chrislusf/seaweedfs:latest${SUFFIX}-amd64 \
-            ghcr.io/chrislusf/seaweedfs:latest${SUFFIX}-arm64 \
-            ghcr.io/chrislusf/seaweedfs:latest${SUFFIX}-arm \
-            ghcr.io/chrislusf/seaweedfs:latest${SUFFIX}-386
+          docker buildx imagetools create -t ghcr.io/chrislusf/seaweedfs:latest \
+            ghcr.io/chrislusf/seaweedfs:latest-amd64 \
+            ghcr.io/chrislusf/seaweedfs:latest-arm64 \
+            ghcr.io/chrislusf/seaweedfs:latest-arm \
+            ghcr.io/chrislusf/seaweedfs:latest-386
           
           # Copy the complete multi-arch image from GHCR to Docker Hub
           # This only requires one pull from GHCR (no rate limit) and one push to Docker Hub
@@ -205,16 +184,16 @@ jobs:
           # Use crane or skopeo to copy, fallback to docker if not available
           if command -v crane &> /dev/null; then
             echo "Using crane to copy..."
-            retry_with_backoff crane copy ghcr.io/chrislusf/seaweedfs:latest${SUFFIX} chrislusf/seaweedfs:latest${SUFFIX}
+            retry_with_backoff crane copy ghcr.io/chrislusf/seaweedfs:latest chrislusf/seaweedfs:latest
           elif command -v skopeo &> /dev/null; then
             echo "Using skopeo to copy..."
-            retry_with_backoff skopeo copy --all docker://ghcr.io/chrislusf/seaweedfs:latest${SUFFIX} docker://chrislusf/seaweedfs:latest${SUFFIX}
+            retry_with_backoff skopeo copy --all docker://ghcr.io/chrislusf/seaweedfs:latest docker://chrislusf/seaweedfs:latest
           else
             echo "Using docker buildx imagetools (pulling 4 images from Docker Hub)..."
             # Fallback: create manifest directly on Docker Hub (pulls from Docker Hub - rate limited)
-            retry_with_backoff docker buildx imagetools create -t chrislusf/seaweedfs:latest${SUFFIX} \
-              ghcr.io/chrislusf/seaweedfs:latest${SUFFIX}-amd64 \
-              ghcr.io/chrislusf/seaweedfs:latest${SUFFIX}-arm64 \
-              ghcr.io/chrislusf/seaweedfs:latest${SUFFIX}-arm \
-              ghcr.io/chrislusf/seaweedfs:latest${SUFFIX}-386
+            retry_with_backoff docker buildx imagetools create -t chrislusf/seaweedfs:latest \
+              ghcr.io/chrislusf/seaweedfs:latest-amd64 \
+              ghcr.io/chrislusf/seaweedfs:latest-arm64 \
+              ghcr.io/chrislusf/seaweedfs:latest-arm \
+              ghcr.io/chrislusf/seaweedfs:latest-386
           fi

.github/workflows/e2e.yml

@@ -24,7 +24,7 @@ jobs:
     timeout-minutes: 30
     steps:
     - name: Set up Go 1.x
-      uses: actions/setup-go@a5f9b05d2d216f63e13859e0d847461041025775 # v2
+      uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v2
       with:
         go-version: ^1.13
       id: go

.github/workflows/ec-integration.yml

@@ -23,10 +23,10 @@ jobs:
     
     steps:
     - name: Checkout code
-      uses: actions/checkout@v6
+      uses: actions/checkout@v4
       
     - name: Set up Go
-      uses: actions/setup-go@v6
+      uses: actions/setup-go@v5
       with:
         go-version: '1.24'
         
@@ -42,7 +42,7 @@ jobs:
         
     - name: Upload test logs on failure
       if: failure()
-      uses: actions/upload-artifact@v6
+      uses: actions/upload-artifact@v4
       with:
         name: ec-test-logs
         path: test/erasure_coding/admin_dockertest/tmp/logs/

.github/workflows/go.yml

@@ -21,7 +21,7 @@ jobs:
     steps:
 
     - name: Set up Go 1.x
-      uses: actions/setup-go@a5f9b05d2d216f63e13859e0d847461041025775 # v2
+      uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v2
       with:
         go-version: ^1.13
       id: go

.github/workflows/s3-example-integration-tests.yml

@@ -1,56 +0,0 @@
-name: "S3 Authenticated Integration Tests"
-
-on:
-  pull_request:
-  
-concurrency:
-  group: ${{ github.head_ref }}/s3-integration-tests
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  tests:
-    name: S3 Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 30
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Build SeaweedFS
-        run: |
-          cd weed
-          go build -o weed -buildvcs=false
-
-      - name: Run S3 Integration Tests
-        timeout-minutes: 15
-        working-directory: test/s3/normal
-        run: |
-          set -x
-          echo "=== Running S3 Integration Tests ==="
-          go test -v -timeout=60s -run TestS3Integration ./...
-
-      - name: Run IAM Integration Tests
-        timeout-minutes: 15
-        working-directory: test/s3/normal
-        run: |
-          set -x
-          echo "=== Running IAM Integration Tests ==="
-          go test -v -timeout=60s -run TestIAMOperations ./...
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v6
-        with:
-          name: integration-test-logs
-          path: test/s3/normal/*.log
-          retention-days: 3

.github/workflows/s3-iam-tests.yml

@@ -117,7 +117,7 @@ jobs:
             "basic")
               echo "Running basic IAM functionality tests..."
               make clean setup start-services wait-for-services
-              go test -v -timeout 15m -run "TestS3IAMAuthentication|TestS3IAMBasicWorkflow|TestS3IAMTokenValidation|TestIAM" ./...
+              go test -v -timeout 15m -run "TestS3IAMAuthentication|TestS3IAMBasicWorkflow|TestS3IAMTokenValidation" ./...
               ;;
             "advanced")
               echo "Running advanced IAM feature tests..."

.github/workflows/s3-policy-tests.yml

@@ -9,7 +9,6 @@ on:
       - 'weed/s3api/policy/**'
       - 'weed/iam/**'
       - 'test/s3/iam/**'
-      - 'test/s3/policy/**'
       - '.github/workflows/s3-policy-tests.yml'
   push:
     branches: [ master, main ]
@@ -20,7 +19,6 @@ on:
       - 'weed/s3api/policy/**'
       - 'weed/iam/**'
       - 'test/s3/iam/**'
-      - 'test/s3/policy/**'
       - '.github/workflows/s3-policy-tests.yml'
 
 concurrency:
@@ -391,36 +389,3 @@ jobs:
           name: trusted-proxy-test-logs
           path: /tmp/weed_proxy_test.log
           retention-days: 3
-
-  # S3 Policy Shell Integration Tests
-  s3-policy-shell-tests:
-    name: S3 Policy Shell Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false
-
-      - name: Run S3 Policy Shell Tests
-        timeout-minutes: 10
-        working-directory: test/s3/policy
-        run: |
-          set -x
-          echo "=== Running S3 Policy Shell Tests ==="
-
-          # Set WEED_BINARY to use the installed version (though test uses 'weed' command)
-          export WEED_BINARY=$(which weed)
-          export PATH=$PATH:$(dirname $WEED_BINARY)
-
-          go test -v -timeout 10m ./...

.github/workflows/s3-tables-tests.yml

@@ -1,189 +0,0 @@
-name: "S3 Tables Integration Tests"
-
-on:
-  pull_request:
-  
-concurrency:
-  group: ${{ github.head_ref }}/s3-tables-tests
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-
-jobs:
-  s3-tables-tests:
-    name: S3 Tables Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 30
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false ./weed
-
-      - name: Run S3 Tables Integration Tests
-        timeout-minutes: 25
-        working-directory: test/s3tables
-        run: |
-          set -x
-          set -o pipefail
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          df -h
-          echo "=== Starting S3 Tables Tests ==="
-          
-          # Run S3 Tables integration tests
-          go test -v -timeout 20m . 2>&1 | tee test-output.log || {
-            echo "S3 Tables integration tests failed"
-            exit 1
-          }
-
-      - name: Show test output on failure
-        if: failure()
-        working-directory: test/s3tables
-        run: |
-          echo "=== Test Output ==="
-          if [ -f test-output.log ]; then
-            tail -200 test-output.log
-          fi
-          
-          echo "=== Process information ==="
-          ps aux | grep -E "(weed|test)" || true
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v6
-        with:
-          name: s3-tables-test-logs
-          path: test/s3tables/test-output.log
-          retention-days: 3
-
-  s3-tables-build-verification:
-    name: S3 Tables Build Verification
-    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Verify S3 Tables Package Builds
-        run: |
-          set -x
-          echo "=== Building S3 Tables package ==="
-          go build ./weed/s3api/s3tables || {
-            echo "S3 Tables package build failed"
-            exit 1
-          }
-          echo "S3 Tables package built successfully"
-
-      - name: Verify S3 API Integration Builds
-        run: |
-          set -x
-          echo "=== Building S3 API with S3 Tables integration ==="
-          go build ./weed/s3api || {
-            echo "S3 API build with S3 Tables failed"
-            exit 1
-          }
-          echo "S3 API with S3 Tables integration built successfully"
-
-      - name: Run Go Tests for S3 Tables Package
-        run: |
-          set -x
-          echo "=== Running Go unit tests for S3 Tables ==="
-          go test -v -race -timeout 5m ./weed/s3api/s3tables/... || {
-            echo "S3 Tables unit tests failed"
-            exit 1
-          }
-          echo "S3 Tables unit tests passed"
-
-  s3-tables-fmt-check:
-    name: S3 Tables Format Check
-    runs-on: ubuntu-22.04
-    timeout-minutes: 10
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Check Go Format
-        run: |
-          set -x
-          echo "=== Checking S3 Tables Go format ==="
-          unformatted=$(gofmt -l ./weed/s3api/s3tables)
-          if [ -n "$unformatted" ]; then
-            echo "Go format check failed - files need formatting"
-            echo "$unformatted"
-            exit 1
-          fi
-          echo "All S3 Tables files are properly formatted"
-
-      - name: Check S3 Tables Test Format
-        run: |
-          set -x
-          echo "=== Checking S3 Tables test format ==="
-          unformatted=$(gofmt -l ./test/s3tables)
-          if [ -n "$unformatted" ]; then
-            echo "Go format check failed for tests"
-            echo "$unformatted"
-            exit 1
-          fi
-          echo "All S3 Tables test files are properly formatted"
-
-  s3-tables-vet:
-    name: S3 Tables Go Vet Check
-    runs-on: ubuntu-22.04
-    timeout-minutes: 10
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Run Go Vet
-        run: |
-          set -x
-          echo "=== Running go vet on S3 Tables package ==="
-          go vet ./weed/s3api/s3tables/... || {
-            echo "go vet check failed"
-            exit 1
-          }
-          echo "go vet checks passed"
-
-      - name: Run Go Vet on Tests
-        run: |
-          set -x
-          echo "=== Running go vet on S3 Tables tests ==="
-          go vet ./test/s3tables/... || {
-            echo "go vet check failed for tests"
-            exit 1
-          }
-          echo "go vet checks passed for tests"

.gitignore

@@ -141,4 +141,3 @@ test/s3/iam/.test_env
 /test/erasure_coding/admin_dockertest/tmp
 /test/erasure_coding/admin_dockertest/task_logs
 weed_bin
-.aider*

BUCKET_POLICY_ENGINE_INTEGRATION.md

@@ -0,0 +1,242 @@
+# Bucket Policy Engine Integration - Complete
+
+## Summary
+
+Successfully integrated the `policy_engine` package to evaluate bucket policies for **all requests** (both anonymous and authenticated). This provides comprehensive AWS S3-compatible bucket policy support.
+
+## What Changed
+
+### 1. **New File: `s3api_bucket_policy_engine.go`**
+Created a wrapper around `policy_engine.PolicyEngine` to:
+- Load bucket policies from filer entries
+- Sync policies from the bucket config cache
+- Evaluate policies for any request (bucket, object, action, principal)
+- Return structured results (allowed, evaluated, error)
+
+### 2. **Modified: `s3api_server.go`**
+- Added `policyEngine *BucketPolicyEngine` field to `S3ApiServer` struct
+- Initialized the policy engine in `NewS3ApiServerWithStore()`
+- Linked `IdentityAccessManagement` back to `S3ApiServer` for policy evaluation
+
+### 3. **Modified: `auth_credentials.go`**
+- Added `s3ApiServer *S3ApiServer` field to `IdentityAccessManagement` struct
+- Added `buildPrincipalARN()` helper to convert identities to AWS ARN format
+- **Integrated bucket policy evaluation into the authentication flow:**
+  - Policies are now checked **before** IAM/identity-based permissions
+  - Explicit `Deny` in bucket policy blocks access immediately
+  - Explicit `Allow` in bucket policy grants access and **bypasses IAM checks** (enables cross-account access)
+  - If no policy exists, falls through to normal IAM checks
+  - Policy evaluation errors result in access denial (fail-close security)
+
+### 4. **Modified: `s3api_bucket_config.go`**
+- Added policy engine sync when bucket configs are loaded
+- Ensures policies are loaded into the engine for evaluation
+
+### 5. **Modified: `auth_credentials_subscribe.go`**
+- Added policy engine sync when bucket metadata changes
+- Keeps the policy engine up-to-date via event-driven updates
+
+## How It Works
+
+### Anonymous Requests
+```
+1. Request comes in (no credentials)
+2. Check ACL-based public access → if public, allow
+3. Check bucket policy for anonymous ("*") access → if allowed, allow
+4. Otherwise, deny
+```
+
+### Authenticated Requests (NEW!)
+```
+1. Request comes in (with credentials)
+2. Authenticate user → get Identity
+3. Build principal ARN (e.g., "arn:aws:iam::123456:user/bob")
+4. Check bucket policy:
+   - If DENY → reject immediately
+   - If ALLOW → grant access immediately (bypasses IAM checks)
+   - If no policy or no matching statements → continue to step 5
+5. Check IAM/identity-based permissions (only if not already allowed by bucket policy)
+6. Allow or deny based on identity permissions
+```
+
+## Policy Evaluation Flow
+
+```
+┌─────────────────────────────────────────────────────────┐
+│                   Request (GET /bucket/file)            │
+└───────────────────────────┬─────────────────────────────┘
+                            │
+                ┌───────────▼──────────┐
+                │  Authenticate User   │
+                │  (or Anonymous)      │
+                └───────────┬──────────┘
+                            │
+                ┌───────────▼──────────────────────────────┐
+                │  Build Principal ARN                     │
+                │  - Anonymous: "*"                        │
+                │  - User: "arn:aws:iam::123456:user/bob"  │
+                └───────────┬──────────────────────────────┘
+                            │
+                ┌───────────▼──────────────────────────────┐
+                │  Evaluate Bucket Policy (PolicyEngine)   │
+                │  - Action: "s3:GetObject"                │
+                │  - Resource: "arn:aws:s3:::bucket/file"  │
+                │  - Principal: (from above)               │
+                └───────────┬──────────────────────────────┘
+                            │
+              ┌─────────────┼─────────────┐
+              │             │             │
+         DENY │        ALLOW │        NO POLICY
+              │             │             │
+              ▼             ▼             ▼
+        Reject Request  Grant Access  Continue
+                                          │
+                      ┌───────────────────┘
+                      │
+         ┌────────────▼─────────────┐
+         │  IAM/Identity Check      │
+         │  (identity.canDo)        │
+         └────────────┬─────────────┘
+                      │
+            ┌─────────┴─────────┐
+            │                   │
+       ALLOW │              DENY │
+            ▼                   ▼
+     Grant Access        Reject Request
+```
+
+## Example Policies That Now Work
+
+### 1. **Public Read Access** (Anonymous)
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [{
+    "Effect": "Allow",
+    "Principal": "*",
+    "Action": "s3:GetObject",
+    "Resource": "arn:aws:s3:::mybucket/*"
+  }]
+}
+```
+- Anonymous users can read all objects
+- Authenticated users are also evaluated against this policy. If they don't match an explicit `Allow` for this action, they will fall back to their own IAM permissions
+
+### 2. **Grant Access to Specific User** (Authenticated)
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [{
+    "Effect": "Allow",
+    "Principal": {"AWS": "arn:aws:iam::123456789012:user/bob"},
+    "Action": ["s3:GetObject", "s3:PutObject"],
+    "Resource": "arn:aws:s3:::mybucket/shared/*"
+  }]
+}
+```
+- User "bob" can read/write objects in `/shared/` prefix
+- Other users cannot (unless granted by their IAM policies)
+
+### 3. **Deny Access to Specific Path** (Both)
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [{
+    "Effect": "Deny",
+    "Principal": "*",
+    "Action": "s3:*",
+    "Resource": "arn:aws:s3:::mybucket/confidential/*"
+  }]
+}
+```
+- **No one** can access `/confidential/` objects
+- Denies override all other allows (AWS policy evaluation rules)
+
+## Performance Characteristics
+
+### Policy Loading
+- **Cold start**: Policy loaded from filer → parsed → compiled → cached
+- **Warm path**: Policy retrieved from `BucketConfigCache` (already parsed)
+- **Updates**: Event-driven sync via metadata subscription (real-time)
+
+### Policy Evaluation
+- **Compiled policies**: Pre-compiled regex patterns and matchers
+- **Pattern cache**: Regex patterns cached with LRU eviction (max 1000)
+- **Fast path**: Common patterns (`*`, exact matches) optimized
+- **Case sensitivity**: Actions case-insensitive, resources case-sensitive (AWS-compatible)
+
+### Overhead
+- **Anonymous requests**: Minimal (policy already checked, now using compiled engine)
+- **Authenticated requests**: ~1-2ms added for policy evaluation (compiled patterns)
+- **No policy**: Near-zero overhead (quick indeterminate check)
+
+## Testing
+
+All tests pass:
+```bash
+✅ TestBucketPolicyValidationBasics
+✅ TestPrincipalMatchesAnonymous
+✅ TestActionToS3Action
+✅ TestResourceMatching
+✅ TestMatchesPatternRegexEscaping (security tests)
+✅ TestActionMatchingCaseInsensitive
+✅ TestResourceMatchingCaseSensitive
+✅ All policy_engine package tests (30+ tests)
+```
+
+## Security Improvements
+
+1. **Regex Metacharacter Escaping**: Patterns like `*.json` properly match only files ending in `.json` (not `filexjson`)
+2. **Case-Insensitive Actions**: S3 actions matched case-insensitively per AWS spec
+3. **Case-Sensitive Resources**: Resource paths matched case-sensitively for security
+4. **Pattern Cache Size Limit**: Prevents DoS attacks via unbounded cache growth
+5. **Principal Validation**: Supports `[]string` for manually constructed policies
+
+## AWS Compatibility
+
+The implementation follows AWS S3 bucket policy evaluation rules:
+1. **Explicit Deny** always wins (checked first)
+2. **Explicit Allow** grants access (checked second)
+3. **Default Deny** if no matching statements (implicit)
+4. Bucket policies work alongside IAM policies (both are evaluated)
+
+## Files Changed
+
+```
+Modified:
+  weed/s3api/auth_credentials.go           (+47 lines)
+  weed/s3api/auth_credentials_subscribe.go (+8 lines)
+  weed/s3api/s3api_bucket_config.go        (+8 lines)
+  weed/s3api/s3api_server.go               (+5 lines)
+
+New:
+  weed/s3api/s3api_bucket_policy_engine.go (115 lines)
+```
+
+## Migration Notes
+
+- **Backward Compatible**: Existing setups without bucket policies work unchanged
+- **No Breaking Changes**: All existing ACL and IAM-based authorization still works
+- **Additive Feature**: Bucket policies are an additional layer of authorization
+- **Performance**: Minimal impact on existing workloads
+
+## Future Enhancements
+
+Potential improvements (not implemented yet):
+- [ ] Condition support (IP address, time-based, etc.) - already in policy_engine
+- [ ] Cross-account policies (different AWS accounts)
+- [ ] Policy validation API endpoint
+- [ ] Policy simulation/testing tool
+- [ ] Metrics for policy evaluations (allow/deny counts)
+
+## Conclusion
+
+Bucket policies now work for **all requests** in SeaweedFS S3 API:
+- ✅ Anonymous requests (public access)
+- ✅ Authenticated requests (user-specific policies)
+- ✅ High performance (compiled policies, caching)
+- ✅ AWS-compatible (follows AWS evaluation rules)
+- ✅ Secure (proper escaping, case sensitivity)
+
+The integration is complete, tested, and ready for use!
+

DESIGN.md

@@ -0,0 +1,413 @@
+# SeaweedFS Task Distribution System Design
+
+## Overview
+
+This document describes the design of a distributed task management system for SeaweedFS that handles Erasure Coding (EC) and vacuum operations through a scalable admin server and worker process architecture.
+
+## System Architecture
+
+### High-Level Components
+
+```
+┌─────────────────┐    ┌──────────────────┐    ┌─────────────────┐
+│   Master        │◄──►│  Admin Server    │◄──►│   Workers       │
+│                 │    │                  │    │                 │
+│ - Volume Info   │    │ - Task Discovery │    │ - Task Exec     │
+│ - Shard Status  │    │ - Task Assign    │    │ - Progress      │
+│ - Heartbeats    │    │ - Progress Track │    │ - Error Report  │
+└─────────────────┘    └──────────────────┘    └─────────────────┘
+         │                        │                        │
+         │                        │                        │
+         ▼                        ▼                        ▼
+┌─────────────────┐    ┌──────────────────┐    ┌─────────────────┐
+│ Volume Servers  │    │ Volume Monitor   │    │ Task Execution  │
+│                 │    │                  │    │                 │
+│ - Store Volumes │    │ - Health Check   │    │ - EC Convert    │
+│ - EC Shards     │    │ - Usage Stats    │    │ - Vacuum Clean  │
+│ - Report Status │    │ - State Sync     │    │ - Status Report │
+└─────────────────┘    └──────────────────┘    └─────────────────┘
+```
+
+## 1. Admin Server Design
+
+### 1.1 Core Responsibilities
+
+- **Task Discovery**: Scan volumes to identify EC and vacuum candidates
+- **Worker Management**: Track available workers and their capabilities  
+- **Task Assignment**: Match tasks to optimal workers
+- **Progress Tracking**: Monitor in-progress tasks for capacity planning
+- **State Reconciliation**: Sync with master server for volume state updates
+
+### 1.2 Task Discovery Engine
+
+```go
+type TaskDiscoveryEngine struct {
+    masterClient   MasterClient
+    volumeScanner  VolumeScanner
+    taskDetectors  map[TaskType]TaskDetector
+    scanInterval   time.Duration
+}
+
+type VolumeCandidate struct {
+    VolumeID       uint32
+    Server         string
+    Collection     string
+    TaskType       TaskType
+    Priority       TaskPriority
+    Reason         string
+    DetectedAt     time.Time
+    Parameters     map[string]interface{}
+}
+```
+
+**EC Detection Logic**:
+- Find volumes >= 95% full and idle for > 1 hour
+- Exclude volumes already in EC format
+- Exclude volumes with ongoing operations
+- Prioritize by collection and age
+
+**Vacuum Detection Logic**:
+- Find volumes with garbage ratio > 30%
+- Exclude read-only volumes
+- Exclude volumes with recent vacuum operations
+- Prioritize by garbage percentage
+
+### 1.3 Worker Registry & Management
+
+```go
+type WorkerRegistry struct {
+    workers        map[string]*Worker
+    capabilities   map[TaskType][]*Worker
+    lastHeartbeat  map[string]time.Time
+    taskAssignment map[string]*Task
+    mutex          sync.RWMutex
+}
+
+type Worker struct {
+    ID            string
+    Address       string
+    Capabilities  []TaskType
+    MaxConcurrent int
+    CurrentLoad   int
+    Status        WorkerStatus
+    LastSeen      time.Time
+    Performance   WorkerMetrics
+}
+```
+
+### 1.4 Task Assignment Algorithm
+
+```go
+type TaskScheduler struct {
+    registry       *WorkerRegistry
+    taskQueue      *PriorityQueue
+    inProgressTasks map[string]*InProgressTask
+    volumeReservations map[uint32]*VolumeReservation
+}
+
+// Worker Selection Criteria:
+// 1. Has required capability (EC or Vacuum)
+// 2. Available capacity (CurrentLoad < MaxConcurrent)
+// 3. Best performance history for task type
+// 4. Lowest current load
+// 5. Geographically close to volume server (optional)
+```
+
+## 2. Worker Process Design
+
+### 2.1 Worker Architecture
+
+```go
+type MaintenanceWorker struct {
+    id              string
+    config          *WorkerConfig
+    adminClient     AdminClient
+    taskExecutors   map[TaskType]TaskExecutor
+    currentTasks    map[string]*RunningTask
+    registry        *TaskRegistry
+    heartbeatTicker *time.Ticker
+    requestTicker   *time.Ticker
+}
+```
+
+### 2.2 Task Execution Framework
+
+```go
+type TaskExecutor interface {
+    Execute(ctx context.Context, task *Task) error
+    EstimateTime(task *Task) time.Duration
+    ValidateResources(task *Task) error
+    GetProgress() float64
+    Cancel() error
+}
+
+type ErasureCodingExecutor struct {
+    volumeClient VolumeServerClient
+    progress     float64
+    cancelled    bool
+}
+
+type VacuumExecutor struct {
+    volumeClient VolumeServerClient
+    progress     float64
+    cancelled    bool
+}
+```
+
+### 2.3 Worker Capabilities & Registration
+
+```go
+type WorkerCapabilities struct {
+    SupportedTasks   []TaskType
+    MaxConcurrent    int
+    ResourceLimits   ResourceLimits
+    PreferredServers []string  // Affinity for specific volume servers
+}
+
+type ResourceLimits struct {
+    MaxMemoryMB      int64
+    MaxDiskSpaceMB   int64
+    MaxNetworkMbps   int64
+    MaxCPUPercent    float64
+}
+```
+
+## 3. Task Lifecycle Management
+
+### 3.1 Task States
+
+```go
+type TaskState string
+
+const (
+    TaskStatePending     TaskState = "pending"
+    TaskStateAssigned    TaskState = "assigned"
+    TaskStateInProgress  TaskState = "in_progress"
+    TaskStateCompleted   TaskState = "completed"
+    TaskStateFailed      TaskState = "failed"
+    TaskStateCancelled   TaskState = "cancelled"
+    TaskStateStuck       TaskState = "stuck"       // Taking too long
+    TaskStateDuplicate   TaskState = "duplicate"   // Detected duplicate
+)
+```
+
+### 3.2 Progress Tracking & Monitoring
+
+```go
+type InProgressTask struct {
+    Task           *Task
+    WorkerID       string
+    StartedAt      time.Time
+    LastUpdate     time.Time
+    Progress       float64
+    EstimatedEnd   time.Time
+    VolumeReserved bool  // Reserved for capacity planning
+}
+
+type TaskMonitor struct {
+    inProgressTasks map[string]*InProgressTask
+    timeoutChecker  *time.Ticker
+    stuckDetector   *time.Ticker
+    duplicateChecker *time.Ticker
+}
+```
+
+## 4. Volume Capacity Reconciliation
+
+### 4.1 Volume State Tracking
+
+```go
+type VolumeStateManager struct {
+    masterClient      MasterClient
+    inProgressTasks   map[uint32]*InProgressTask  // VolumeID -> Task
+    committedChanges  map[uint32]*VolumeChange    // Changes not yet in master
+    reconcileInterval time.Duration
+}
+
+type VolumeChange struct {
+    VolumeID     uint32
+    ChangeType   ChangeType  // "ec_encoding", "vacuum_completed"
+    OldCapacity  int64
+    NewCapacity  int64
+    TaskID       string
+    CompletedAt  time.Time
+    ReportedToMaster bool
+}
+```
+
+### 4.2 Shard Assignment Integration
+
+When the master needs to assign shards, it must consider:
+1. **Current volume state** from its own records
+2. **In-progress capacity changes** from admin server
+3. **Committed but unreported changes** from admin server
+
+```go
+type CapacityOracle struct {
+    adminServer   AdminServerClient
+    masterState   *MasterVolumeState
+    updateFreq    time.Duration
+}
+
+func (o *CapacityOracle) GetAdjustedCapacity(volumeID uint32) int64 {
+    baseCapacity := o.masterState.GetCapacity(volumeID)
+    
+    // Adjust for in-progress tasks
+    if task := o.adminServer.GetInProgressTask(volumeID); task != nil {
+        switch task.Type {
+        case TaskTypeErasureCoding:
+            // EC reduces effective capacity
+            return baseCapacity / 2  // Simplified
+        case TaskTypeVacuum:
+            // Vacuum may increase available space
+            return baseCapacity + int64(float64(baseCapacity) * 0.3)
+        }
+    }
+    
+    // Adjust for completed but unreported changes
+    if change := o.adminServer.GetPendingChange(volumeID); change != nil {
+        return change.NewCapacity
+    }
+    
+    return baseCapacity
+}
+```
+
+## 5. Error Handling & Recovery
+
+### 5.1 Worker Failure Scenarios
+
+```go
+type FailureHandler struct {
+    taskRescheduler *TaskRescheduler
+    workerMonitor   *WorkerMonitor
+    alertManager    *AlertManager
+}
+
+// Failure Scenarios:
+// 1. Worker becomes unresponsive (heartbeat timeout)
+// 2. Task execution fails (reported by worker)
+// 3. Task gets stuck (progress timeout)
+// 4. Duplicate task detection
+// 5. Resource exhaustion
+```
+
+### 5.2 Recovery Strategies
+
+**Worker Timeout Recovery**:
+- Mark worker as inactive after 3 missed heartbeats
+- Reschedule all assigned tasks to other workers
+- Cleanup any partial state
+
+**Task Stuck Recovery**:
+- Detect tasks with no progress for > 2x estimated time
+- Cancel stuck task and mark volume for cleanup
+- Reschedule if retry count < max_retries
+
+**Duplicate Task Prevention**:
+```go
+type DuplicateDetector struct {
+    activeFingerprints map[string]bool  // VolumeID+TaskType
+    recentCompleted    *LRUCache        // Recently completed tasks
+}
+
+func (d *DuplicateDetector) IsTaskDuplicate(task *Task) bool {
+    fingerprint := fmt.Sprintf("%d-%s", task.VolumeID, task.Type)
+    return d.activeFingerprints[fingerprint] || 
+           d.recentCompleted.Contains(fingerprint)
+}
+```
+
+## 6. Simulation & Testing Framework
+
+### 6.1 Failure Simulation
+
+```go
+type TaskSimulator struct {
+    scenarios map[string]SimulationScenario
+}
+
+type SimulationScenario struct {
+    Name            string
+    WorkerCount     int
+    VolumeCount     int
+    FailurePatterns []FailurePattern
+    Duration        time.Duration
+}
+
+type FailurePattern struct {
+    Type        FailureType  // "worker_timeout", "task_stuck", "duplicate"
+    Probability float64      // 0.0 to 1.0
+    Timing      TimingSpec   // When during task execution
+    Duration    time.Duration
+}
+```
+
+### 6.2 Test Scenarios
+
+**Scenario 1: Worker Timeout During EC**
+- Start EC task on 30GB volume
+- Kill worker at 50% progress
+- Verify task reassignment
+- Verify no duplicate EC operations
+
+**Scenario 2: Stuck Vacuum Task**
+- Start vacuum on high-garbage volume
+- Simulate worker hanging at 75% progress
+- Verify timeout detection and cleanup
+- Verify volume state consistency
+
+**Scenario 3: Duplicate Task Prevention**
+- Submit same EC task from multiple sources
+- Verify only one task executes
+- Verify proper conflict resolution
+
+**Scenario 4: Master-Admin State Divergence**
+- Create in-progress EC task
+- Simulate master restart
+- Verify state reconciliation
+- Verify shard assignment accounts for in-progress work
+
+## 7. Performance & Scalability
+
+### 7.1 Metrics & Monitoring
+
+```go
+type SystemMetrics struct {
+    TasksPerSecond     float64
+    WorkerUtilization  float64
+    AverageTaskTime    time.Duration
+    FailureRate        float64
+    QueueDepth         int
+    VolumeStatesSync   bool
+}
+```
+
+### 7.2 Scalability Considerations
+
+- **Horizontal Worker Scaling**: Add workers without admin server changes
+- **Admin Server HA**: Master-slave admin servers for fault tolerance
+- **Task Partitioning**: Partition tasks by collection or datacenter
+- **Batch Operations**: Group similar tasks for efficiency
+
+## 8. Implementation Plan
+
+### Phase 1: Core Infrastructure
+1. Admin server basic framework
+2. Worker registration and heartbeat
+3. Simple task assignment
+4. Basic progress tracking
+
+### Phase 2: Advanced Features
+1. Volume state reconciliation
+2. Sophisticated worker selection
+3. Failure detection and recovery
+4. Duplicate prevention
+
+### Phase 3: Optimization & Monitoring
+1. Performance metrics
+2. Load balancing algorithms
+3. Capacity planning integration
+4. Comprehensive monitoring
+
+This design provides a robust, scalable foundation for distributed task management in SeaweedFS while maintaining consistency with the existing architecture patterns. 

SQL_FEATURE_PLAN.md

@@ -0,0 +1,145 @@
+# SQL Query Engine Feature, Dev, and Test Plan
+
+This document outlines the plan for adding SQL querying support to SeaweedFS, focusing on reading and analyzing data from Message Queue (MQ) topics.
+
+## Feature Plan
+
+**1. Goal**
+
+To provide a SQL querying interface for SeaweedFS, enabling analytics on existing MQ topics. This enables:
+- Basic querying with SELECT, WHERE, aggregations on MQ topics
+- Schema discovery and metadata operations (SHOW DATABASES, SHOW TABLES, DESCRIBE)
+- In-place analytics on Parquet-stored messages without data movement
+
+**2. Key Features**
+
+*   **Schema Discovery and Metadata:**
+    *   `SHOW DATABASES` - List all MQ namespaces
+    *   `SHOW TABLES` - List all topics in a namespace  
+    *   `DESCRIBE table_name` - Show topic schema details
+    *   Automatic schema detection from existing Parquet data
+*   **Basic Query Engine:**
+    *   `SELECT` support with `WHERE`, `LIMIT`, `OFFSET`
+    *   Aggregation functions: `COUNT()`, `SUM()`, `AVG()`, `MIN()`, `MAX()`
+    *   Temporal queries with timestamp-based filtering
+*   **User Interfaces:**
+    *   New CLI command `weed sql` with interactive shell mode
+    *   Optional: Web UI for query execution and result visualization
+*   **Output Formats:**
+    *   JSON (default), CSV, Parquet for result sets
+    *   Streaming results for large queries
+    *   Pagination support for result navigation
+
+## Development Plan
+
+
+
+**3. Data Source Integration**
+
+*   **MQ Topic Connector (Primary):**
+    *   Build on existing `weed/mq/logstore/read_parquet_to_log.go`
+    *   Implement efficient Parquet scanning with predicate pushdown
+    *   Support schema evolution and backward compatibility
+    *   Handle partition-based parallelism for scalable queries
+*   **Schema Registry Integration:**
+    *   Extend `weed/mq/schema/schema.go` for SQL metadata operations
+    *   Read existing topic schemas for query planning
+    *   Handle schema evolution during query execution
+
+**4. API & CLI Integration**
+
+*   **CLI Command:**
+    *   New `weed sql` command with interactive shell mode (similar to `weed shell`)
+    *   Support for script execution and result formatting
+    *   Connection management for remote SeaweedFS clusters
+*   **gRPC API:**
+    *   Add SQL service to existing MQ broker gRPC interface
+    *   Enable efficient query execution with streaming results
+
+## Example Usage Scenarios
+
+**Scenario 1: Schema Discovery and Metadata**
+```sql
+-- List all namespaces (databases)
+SHOW DATABASES;
+
+-- List topics in a namespace
+USE my_namespace;
+SHOW TABLES;
+
+-- View topic structure and discovered schema
+DESCRIBE user_events;
+```
+
+**Scenario 2: Data Querying**
+```sql
+-- Basic filtering and projection
+SELECT user_id, event_type, timestamp 
+FROM user_events 
+WHERE timestamp > 1640995200000 
+LIMIT 100;
+
+-- Aggregation queries  
+SELECT COUNT(*) as event_count
+FROM user_events 
+WHERE timestamp >= 1640995200000;
+
+-- More aggregation examples
+SELECT MAX(timestamp), MIN(timestamp) 
+FROM user_events;
+```
+
+**Scenario 3: Analytics & Monitoring**
+```sql
+-- Basic analytics
+SELECT COUNT(*) as total_events
+FROM user_events 
+WHERE timestamp >= 1640995200000;
+
+-- Simple monitoring
+SELECT AVG(response_time) as avg_response
+FROM api_logs
+WHERE timestamp >= 1640995200000;
+
+## Architecture Overview
+
+```
+SQL Query Flow:
+                                  1. Parse SQL        2. Plan & Optimize      3. Execute Query
+┌─────────────┐    ┌──────────────┐    ┌─────────────────┐    ┌──────────────┐
+│   Client    │    │  SQL Parser  │    │  Query Planner  │    │   Execution  │
+│    (CLI)    │──→ │ PostgreSQL   │──→ │   & Optimizer   │──→ │    Engine    │
+│             │    │ (Custom)     │    │                 │    │              │
+└─────────────┘    └──────────────┘    └─────────────────┘    └──────────────┘
+                                               │                       │
+                                               │ Schema Lookup         │ Data Access
+                                               ▼                       ▼
+                    ┌─────────────────────────────────────────────────────────────┐
+                    │                    Schema Catalog                            │
+                    │  • Namespace → Database mapping                            │
+                    │  • Topic → Table mapping                                  │
+                    │  • Schema version management                              │
+                    └─────────────────────────────────────────────────────────────┘
+                                                                        ▲
+                                                                        │ Metadata
+                                                                        │
+┌─────────────────────────────────────────────────────────────────────────────┐
+│                          MQ Storage Layer                                      │
+│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐    ▲    │
+│  │   Topic A   │  │   Topic B   │  │   Topic C   │  │     ...     │    │    │
+│  │ (Parquet)   │  │ (Parquet)   │  │ (Parquet)   │  │ (Parquet)   │    │    │
+│  └─────────────┘  └─────────────┘  └─────────────┘  └─────────────┘    │    │
+└──────────────────────────────────────────────────────────────────────────│──┘
+                                                                          │
+                                                                     Data Access
+```
+
+
+## Success Metrics
+
+*   **Feature Completeness:** Support for all specified SELECT operations and metadata commands
+*   **Performance:** 
+    *   **Simple SELECT queries**: < 100ms latency for single-table queries with up to 3 WHERE predicates on ≤ 100K records
+    *   **Complex queries**: < 1s latency for queries involving aggregations (COUNT, SUM, MAX, MIN) on ≤ 1M records
+    *   **Time-range queries**: < 500ms for timestamp-based filtering on ≤ 500K records within 24-hour windows
+*   **Scalability:** Handle topics with millions of messages efficiently

docker/security.toml.example

@@ -1,34 +0,0 @@
-# Put this file to one of the location, with descending priority
-#    ./security.toml
-#    $HOME/.seaweedfs/security.toml
-#    /etc/seaweedfs/security.toml
-# this file is read by master, volume server, filer, and worker
-
-# comma separated origins allowed to make requests to the filer and s3 gateway. 
-# enter in this format: https://domain.com, or http://localhost:port
-[cors.allowed_origins]
-values = "*"
-
-# this jwt signing key is read by master and volume server, and it is used for write operations:
-# - the Master server generates the JWT, which can be used to write a certain file on a volume server
-# - the Volume server validates the JWT on writing
-# the jwt defaults to expire after 10 seconds.
-# [jwt.signing]
-# key = "V1JJVEVTRUNSRVRFWEFNUExFMTIzNDU2Nzg5MDEy" # Example: WRITESECRETEXAMPLE123456789012
-# this jwt signing key is read by master and volume server, and it is used for read operations:
-# - the Master server generates the JWT, which can be used to read a certain file on a volume server
-# - the Volume server validates the JWT on reading
-# [jwt.signing.read]
-# key = "UkVBRFNFQ1JFVUVYQU1QTEUxMjM0NTY3ODkwMTI=" # Example: READSECRETEXAMPLE123456789012
-# If this JWT key is configured, Filer only accepts writes over HTTP if they are signed with this JWT:
-# - f.e. the S3 API Shim generates the JWT
-# - the Filer server validates the JWT on writing
-# the jwt defaults to expire after 10 seconds.
-# [jwt.filer_signing]
-# key = "RklMRVJXUklURVNFQ1JFVEVYQU1QTEUxMjM0NTY3OA==" # Example: FILERWRITESECRETEXAMPLE12345678
-# If this JWT key is configured, Filer only accepts reads over HTTP if they are signed with this JWT:
-# - f.e. the S3 API Shim generates the JWT
-# - the Filer server validates the JWT on reading
-# the jwt defaults to expire after 10 seconds.
-# [jwt.filer_signing.read]
-# key = "RklMRVJSRUFEU0VDUkVURVhBTVBMRTEyMzQ1Njc4OQ==" # Example: FILERREADSECRETEXAMPLE123456789

go.mod

@@ -5,7 +5,7 @@ go 1.24.9
 require (
 	cloud.google.com/go v0.123.0 // indirect
 	cloud.google.com/go/pubsub v1.50.1
-	cloud.google.com/go/storage v1.59.2
+	cloud.google.com/go/storage v1.59.1
 	github.com/Shopify/sarama v1.38.1
 	github.com/aws/aws-sdk-go v1.55.8
 	github.com/beorn7/perks v1.0.1 // indirect
@@ -39,14 +39,14 @@ require (
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
-	github.com/jackc/pgx/v5 v5.8.0
+	github.com/jackc/pgx/v5 v5.7.6
 	github.com/jcmturner/gofork v1.7.6 // indirect
 	github.com/jcmturner/gokrb5/v8 v8.4.4 // indirect
 	github.com/jinzhu/copier v0.4.0
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/json-iterator/go v1.1.12
 	github.com/karlseguin/ccache/v2 v2.0.8
-	github.com/klauspost/compress v1.18.3
+	github.com/klauspost/compress v1.18.2
 	github.com/klauspost/reedsolomon v1.13.0
 	github.com/kurin/blazer v0.5.3
 	github.com/linxGnu/grocksdb v1.10.3
@@ -92,12 +92,12 @@ require (
 	gocloud.dev v0.44.0
 	gocloud.dev/pubsub/natspubsub v0.44.0
 	gocloud.dev/pubsub/rabbitpubsub v0.44.0
-	golang.org/x/crypto v0.47.0
+	golang.org/x/crypto v0.46.0
 	golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546
 	golang.org/x/image v0.35.0
-	golang.org/x/net v0.49.0
+	golang.org/x/net v0.48.0
 	golang.org/x/oauth2 v0.34.0
-	golang.org/x/sys v0.40.0
+	golang.org/x/sys v0.39.0
 	golang.org/x/text v0.33.0 // indirect
 	golang.org/x/tools v0.40.0 // indirect
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
@@ -109,7 +109,7 @@ require (
 	modernc.org/b v1.0.0 // indirect
 	modernc.org/mathutil v1.7.1
 	modernc.org/memory v1.11.0 // indirect
-	modernc.org/sqlite v1.44.3
+	modernc.org/sqlite v1.44.2
 	modernc.org/strutil v1.2.1
 )
 
@@ -118,7 +118,7 @@ require (
 	github.com/Azure/azure-sdk-for-go/sdk/keyvault/azkeys v0.10.0
 	github.com/Jille/raft-grpc-transport v1.6.1
 	github.com/ThreeDotsLabs/watermill v1.5.1
-	github.com/a-h/templ v0.3.977
+	github.com/a-h/templ v0.3.943
 	github.com/apache/cassandra-gocql-driver/v2 v2.0.0
 	github.com/apple/foundationdb/bindings/go v0.0.0-20250911184653-27f7192f47c3
 	github.com/arangodb/go-driver v1.6.9
@@ -133,13 +133,13 @@ require (
 	github.com/gin-contrib/sessions v1.0.4
 	github.com/gin-gonic/gin v1.11.0
 	github.com/go-ldap/ldap/v3 v3.4.12
-	github.com/golang-jwt/jwt/v5 v5.3.1
+	github.com/golang-jwt/jwt/v5 v5.3.0
 	github.com/google/flatbuffers/go v0.0.0-20230108230133-3b8644d32c50
 	github.com/hashicorp/raft v1.7.3
 	github.com/hashicorp/raft-boltdb/v2 v2.3.1
 	github.com/hashicorp/vault/api v1.22.0
 	github.com/jhump/protoreflect v1.17.0
-	github.com/lib/pq v1.11.1
+	github.com/lib/pq v1.10.9
 	github.com/linkedin/goavro/v2 v2.14.1
 	github.com/mattn/go-sqlite3 v1.14.33
 	github.com/minio/crc64nvme v1.1.1
@@ -152,12 +152,12 @@ require (
 	github.com/redis/go-redis/v9 v9.17.2
 	github.com/schollz/progressbar/v3 v3.19.0
 	github.com/seaweedfs/go-fuse/v2 v2.9.1
-	github.com/shirou/gopsutil/v4 v4.26.1
+	github.com/shirou/gopsutil/v4 v4.25.12
 	github.com/tarantool/go-tarantool/v2 v2.4.1
 	github.com/tikv/client-go/v2 v2.0.7
 	github.com/xeipuuv/gojsonschema v1.2.0
 	github.com/ydb-platform/ydb-go-sdk-auth-environ v0.5.1
-	github.com/ydb-platform/ydb-go-sdk/v3 v3.125.3
+	github.com/ydb-platform/ydb-go-sdk/v3 v3.125.1
 	go.etcd.io/etcd/client/pkg/v3 v3.6.7
 	go.uber.org/atomic v1.11.0
 	golang.org/x/sync v0.19.0
@@ -249,12 +249,12 @@ require (
 	cloud.google.com/go/iam v1.5.3 // indirect
 	cloud.google.com/go/monitoring v1.24.2 // indirect
 	filippo.io/edwards25519 v1.1.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0
 	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1
 	github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.3
 	github.com/Azure/azure-sdk-for-go/sdk/storage/azfile v1.5.3 // indirect
-	github.com/Azure/go-ntlmssp v0.1.0 // indirect
+	github.com/Azure/go-ntlmssp v0.0.2-0.20251110135918-10b7b7e7cd26 // indirect
 	github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 // indirect
 	github.com/Files-com/files-sdk-go/v3 v3.2.264 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.30.0 // indirect
@@ -291,7 +291,7 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/sso v1.30.9 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.13 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sts v1.41.6 // indirect
-	github.com/aws/smithy-go v1.24.0
+	github.com/aws/smithy-go v1.24.0 // indirect
 	github.com/boltdb/bolt v1.3.1 // indirect
 	github.com/bradenaw/juniper v0.15.3 // indirect
 	github.com/bradfitz/iter v0.0.0-20191230175014-e8f45d346db8 // indirect
@@ -349,7 +349,7 @@ require (
 	github.com/gorilla/securecookie v1.1.2 // indirect
 	github.com/gorilla/sessions v1.4.0 // indirect
 	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.3 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-hclog v1.6.3 // indirect
 	github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
@@ -458,11 +458,11 @@ require (
 	go.opentelemetry.io/otel/sdk/metric v1.38.0 // indirect
 	go.opentelemetry.io/otel/trace v1.38.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	go.uber.org/zap v1.27.1 // indirect
+	go.uber.org/zap v1.27.0 // indirect
 	golang.org/x/arch v0.20.0 // indirect
-	golang.org/x/term v0.39.0 // indirect
+	golang.org/x/term v0.38.0 // indirect
 	golang.org/x/time v0.14.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20251124214823-79d6a2a48846 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20251111163417-95abcf5c77ba // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20251213004720-97cd9d5aeac2 // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
 	gopkg.in/validator.v2 v2.0.1 // indirect

go.sum

@@ -477,8 +477,8 @@ cloud.google.com/go/storage v1.22.1/go.mod h1:S8N1cAStu7BOeFfE8KAQzmyyLkK8p/vmRq
 cloud.google.com/go/storage v1.23.0/go.mod h1:vOEEDNFnciUMhBeT6hsJIn3ieU5cFRmzeLgDvXzfIXc=
 cloud.google.com/go/storage v1.27.0/go.mod h1:x9DOL8TK/ygDUMieqwfhdpQryTeEkhGKMi80i/iqR2s=
 cloud.google.com/go/storage v1.28.1/go.mod h1:Qnisd4CqDdo6BGs2AD5LLnEsmSQ80wQ5ogcBBKhU86Y=
-cloud.google.com/go/storage v1.59.2 h1:gmOAuG1opU8YvycMNpP+DvHfT9BfzzK5Cy+arP+Nocw=
-cloud.google.com/go/storage v1.59.2/go.mod h1:cMWbtM+anpC74gn6qjLh+exqYcfmB9Hqe5z6adx+CLI=
+cloud.google.com/go/storage v1.59.1 h1:DXAZLcTimtiXdGqDSnebROVPd9QvRsFVVlptz02Wk58=
+cloud.google.com/go/storage v1.59.1/go.mod h1:cMWbtM+anpC74gn6qjLh+exqYcfmB9Hqe5z6adx+CLI=
 cloud.google.com/go/storagetransfer v1.5.0/go.mod h1:dxNzUopWy7RQevYFHewchb29POFv3/AaBgnhqzqiK0w=
 cloud.google.com/go/storagetransfer v1.6.0/go.mod h1:y77xm4CQV/ZhFZH75PLEXY0ROiS7Gh6pSKrM8dJyg6I=
 cloud.google.com/go/storagetransfer v1.7.0/go.mod h1:8Giuj1QNb1kfLAiWM1bN6dHzfdlDAVC9rv9abHot2W4=
@@ -541,8 +541,8 @@ filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
 filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
 gioui.org v0.0.0-20210308172011-57750fc8a0a6/go.mod h1:RSH6KIUZ0p2xy5zHDxgAM4zumjgTw83q2ge/PI+yyw8=
 git.sr.ht/~sbinet/gg v0.3.1/go.mod h1:KGYtlADtqsqANL9ueOFkWymvzUvLMQllU5Ixo+8v3pc=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0 h1:fou+2+WFTib47nS+nz/ozhEBnvU96bKHy6LjRsY4E28=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0/go.mod h1:t76Ruy8AHvUAC8GfMWJMa0ElSbuIcO03NLpynfbgsPA=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 h1:JXg2dwJUmPB9JmtVmdEB16APJ7jurfbY5jnfXpJoRMc=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0/go.mod h1:YD5h/ldMsG0XiIw7PdyNhLxaM317eFh5yNLccNfGdyw=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 h1:Hk5QBxZQC1jb2Fwj6mpzme37xbCDdNTxU7O9eb5+LB4=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1/go.mod h1:IYus9qsFobWIc2YVwe/WPjcnyCkPKtnHAqUYeebc8z0=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2 h1:yz1bePFlP5Vws5+8ez6T3HWXPmwOK7Yvq8QxDBD3SKY=
@@ -560,8 +560,8 @@ github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.3/go.mod h1:URuDvhmATV
 github.com/Azure/azure-sdk-for-go/sdk/storage/azfile v1.5.3 h1:sxgSqOB9CDToiaVFpxuvb5wGgGqWa3lCShcm5o0n3bE=
 github.com/Azure/azure-sdk-for-go/sdk/storage/azfile v1.5.3/go.mod h1:XdED8i399lEVblYHTZM8eXaP07gv4Z58IL6ueMlVlrg=
 github.com/Azure/go-ansiterm v0.0.0-20170929234023-d6e3b3328b78/go.mod h1:LmzpDX56iTiv29bbRTIsUNlaFfuhWRQBWjQdVyAevI8=
-github.com/Azure/go-ntlmssp v0.1.0 h1:DjFo6YtWzNqNvQdrwEyr/e4nhU3vRiwenz5QX7sFz+A=
-github.com/Azure/go-ntlmssp v0.1.0/go.mod h1:NYqdhxd/8aAct/s4qSYZEerdPuH1liG2/X9DiVTbhpk=
+github.com/Azure/go-ntlmssp v0.0.2-0.20251110135918-10b7b7e7cd26 h1:gy/jrlpp8EfSyA73a51fofoSfhp5rPNQAUvDr4Dm91c=
+github.com/Azure/go-ntlmssp v0.0.2-0.20251110135918-10b7b7e7cd26/go.mod h1:NYqdhxd/8aAct/s4qSYZEerdPuH1liG2/X9DiVTbhpk=
 github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1 h1:WJTmL004Abzc5wDB5VtZG2PJk5ndYDgVacGqfirKxjM=
 github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mod h1:tCcJZ0uHAmvjsVYzEFivsRTN00oz5BEsRgQHu5JZ9WE=
 github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 h1:XRzhVemXdgvJqCH0sFfrBUTnUJSBrBf7++ypk+twtRs=
@@ -628,8 +628,8 @@ github.com/ThreeDotsLabs/watermill v1.5.1 h1:t5xMivyf9tpmU3iozPqyrCZXHvoV1XQDfih
 github.com/ThreeDotsLabs/watermill v1.5.1/go.mod h1:Uop10dA3VeJWsSvis9qO3vbVY892LARrKAdki6WtXS4=
 github.com/TomiHiltunen/geohash-golang v0.0.0-20150112065804-b3e4e625abfb h1:wumPkzt4zaxO4rHPBrjDK8iZMR41C1qs7njNqlacwQg=
 github.com/TomiHiltunen/geohash-golang v0.0.0-20150112065804-b3e4e625abfb/go.mod h1:QiYsIBRQEO+Z4Rz7GoI+dsHVneZNONvhczuA+llOZNM=
-github.com/a-h/templ v0.3.977 h1:kiKAPXTZE2Iaf8JbtM21r54A8bCNsncrfnokZZSrSDg=
-github.com/a-h/templ v0.3.977/go.mod h1:oCZcnKRf5jjsGpf2yELzQfodLphd2mwecwG4Crk5HBo=
+github.com/a-h/templ v0.3.943 h1:o+mT/4yqhZ33F3ootBiHwaY4HM5EVaOJfIshvd5UNTY=
+github.com/a-h/templ v0.3.943/go.mod h1:oCZcnKRf5jjsGpf2yELzQfodLphd2mwecwG4Crk5HBo=
 github.com/a1ex3/zstd-seekable-format-go/pkg v0.10.0 h1:iLDOF0rdGTrol/q8OfPIIs5kLD8XvA2q75o6Uq/tgak=
 github.com/a1ex3/zstd-seekable-format-go/pkg v0.10.0/go.mod h1:DrEWcQJjz7t5iF2duaiyhg4jyoF0kxOD6LtECNGkZ/Q=
 github.com/aalpar/deheap v0.0.0-20210914013432-0cc84d79dec3 h1:hhdWprfSpFbN7lz3W1gM40vOgvSh1WCSMxYD6gGB4Hs=
@@ -1046,8 +1046,8 @@ github.com/golang-jwt/jwt/v4 v4.4.1/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w
 github.com/golang-jwt/jwt/v4 v4.4.3/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
 github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI=
 github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
-github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
-github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
+github.com/golang-jwt/jwt/v5 v5.3.0 h1:pv4AsKCKKZuqlgs5sUmn4x8UlGa0kEVt/puTpKx9vvo=
+github.com/golang-jwt/jwt/v5 v5.3.0/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
 github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0/go.mod h1:E/TSTwGwJL78qG/PmXZO1EjYhfJinVAhrmmHX6Z8B9k=
 github.com/golang/geo v0.0.0-20210211234256-740aa86cb551 h1:gtexQ/VGyN+VVFRXSFiguSNcXmS6rkKT+X7FdIrTtfo=
 github.com/golang/geo v0.0.0-20210211234256-740aa86cb551/go.mod h1:QZ0nwyI2jOfgRAoBvP+ab5aRr7c9x7lhGEJrKvBwjWI=
@@ -1206,8 +1206,8 @@ github.com/grpc-ecosystem/grpc-gateway v1.16.0 h1:gmcG1KaJ57LophUzW0Hy8NmPhnMZb4
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.7.0/go.mod h1:hgWBS7lorOAVIJEQMi4ZsPv9hVvWI6+ch50m39Pf2Ks=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.3/go.mod h1:o//XUCC/F+yRGJoPO/VU0GSB0f8Nhgmxx0VIRUvaC0w=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.3 h1:NmZ1PKzSTQbuGHw9DGPFomqkkLWMC+vZCkfs+FHv1Vg=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.3/go.mod h1:zQrxl1YP88HQlA6i9c63DSVPFklWpGX4OWAc9bFuaH4=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 h1:X5VWvz21y3gzm9Nw/kaUeku/1+uBhcekkmy4IkffJww=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1/go.mod h1:Zanoh4+gvIgluNqcfMVTJueD4wSS5hT7zTt4Mrutd90=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -1281,8 +1281,8 @@ github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsI
 github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
-github.com/jackc/pgx/v5 v5.8.0 h1:TYPDoleBBme0xGSAX3/+NujXXtpZn9HBONkQC7IEZSo=
-github.com/jackc/pgx/v5 v5.8.0/go.mod h1:QVeDInX2m9VyzvNeiCJVjCkNFqzsNb43204HshNSZKw=
+github.com/jackc/pgx/v5 v5.7.6 h1:rWQc5FwZSPX58r1OQmkuaNicxdmExaEz5A2DO2hUuTk=
+github.com/jackc/pgx/v5 v5.7.6/go.mod h1:aruU7o91Tc2q2cFp5h4uP3f6ztExVpyVv88Xl/8Vl8M=
 github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
 github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
 github.com/jaegertracing/jaeger v1.47.0 h1:XXxTMO+GxX930gxKWsg90rFr6RswkCRIW0AgWFnTYsg=
@@ -1348,8 +1348,8 @@ github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/klauspost/asmfmt v1.3.2/go.mod h1:AG8TuvYojzulgDAMCnYn50l/5QV3Bs/tp6j0HLHbNSE=
 github.com/klauspost/compress v1.15.9/go.mod h1:PhcZ0MbTNciWF3rruxRgKxI5NkcHHrHUDtV4Yw2GlzU=
-github.com/klauspost/compress v1.18.3 h1:9PJRvfbmTabkOX8moIpXPbMMbYN60bWImDDU7L+/6zw=
-github.com/klauspost/compress v1.18.3/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4=
+github.com/klauspost/compress v1.18.2 h1:iiPHWW0YrcFgpBYhsA6D1+fqHssJscY/Tm/y2Uqnapk=
+github.com/klauspost/compress v1.18.2/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4=
 github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
 github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
 github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
@@ -1385,8 +1385,8 @@ github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
 github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
 github.com/lib/pq v0.0.0-20180327071824-d34b9ff171c2/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lib/pq v1.8.0/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
-github.com/lib/pq v1.11.1 h1:wuChtj2hfsGmmx3nf1m7xC2XpK6OtelS2shMY+bGMtI=
-github.com/lib/pq v1.11.1/go.mod h1:/p+8NSbOcwzAEI7wiMXFlgydTwcgTr3OSKMsD2BitpA=
+github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
+github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
 github.com/linkedin/goavro/v2 v2.14.1 h1:/8VjDpd38PRsy02JS0jflAu7JZPfJcGTwqWgMkFS2iI=
 github.com/linkedin/goavro/v2 v2.14.1/go.mod h1:KXx+erlq+RPlGSPmLF7xGo6SAbh8sCQ53x064+ioxhk=
 github.com/linxGnu/grocksdb v1.10.3 h1:0laII9AQ6kFxo5SjhdTfSh9EgF20piD6TMHK6YuDm+4=
@@ -1658,8 +1658,8 @@ github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAm
 github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
 github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
-github.com/shirou/gopsutil/v4 v4.26.1 h1:TOkEyriIXk2HX9d4isZJtbjXbEjf5qyKPAzbzY0JWSo=
-github.com/shirou/gopsutil/v4 v4.26.1/go.mod h1:medLI9/UNAb0dOI9Q3/7yWSqKkj00u+1tgY8nvv41pc=
+github.com/shirou/gopsutil/v4 v4.25.12 h1:e7PvW/0RmJ8p8vPGJH4jvNkOyLmbkXgXW4m6ZPic6CY=
+github.com/shirou/gopsutil/v4 v4.25.12/go.mod h1:EivAfP5x2EhLp2ovdpKSozecVXn1TmuG7SMzs/Wh4PU=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
@@ -1820,8 +1820,8 @@ github.com/ydb-platform/ydb-go-sdk-auth-environ v0.5.1 h1:XaRxeVrOyl3y6v9CiYMWaF
 github.com/ydb-platform/ydb-go-sdk-auth-environ v0.5.1/go.mod h1:9YzkhlIymWaJGX6KMU3vh5sOf3UKbCXkG/ZdjaI3zNM=
 github.com/ydb-platform/ydb-go-sdk/v3 v3.44.0/go.mod h1:oSLwnuilwIpaF5bJJMAofnGgzPJusoI3zWMNb8I+GnM=
 github.com/ydb-platform/ydb-go-sdk/v3 v3.47.3/go.mod h1:bWnOIcUHd7+Sl7DN+yhyY1H/I61z53GczvwJgXMgvj0=
-github.com/ydb-platform/ydb-go-sdk/v3 v3.125.3 h1:hTwpF+PdbuR7vcixN+4AC6yu4asaUIAljQCxL51eDII=
-github.com/ydb-platform/ydb-go-sdk/v3 v3.125.3/go.mod h1:stS1mQYjbJvwwYaYzKyFY9eMiuVXWWXQA6T+SpOLg9c=
+github.com/ydb-platform/ydb-go-sdk/v3 v3.125.1 h1:YaqzRVbcncabB34YNjOl5ADomYUFva+6l74svIIIJUo=
+github.com/ydb-platform/ydb-go-sdk/v3 v3.125.1/go.mod h1:stS1mQYjbJvwwYaYzKyFY9eMiuVXWWXQA6T+SpOLg9c=
 github.com/ydb-platform/ydb-go-yc v0.12.1 h1:qw3Fa+T81+Kpu5Io2vYHJOwcrYrVjgJlT6t/0dOXJrA=
 github.com/ydb-platform/ydb-go-yc v0.12.1/go.mod h1:t/ZA4ECdgPWjAb4jyDe8AzQZB5dhpGbi3iCahFaNwBY=
 github.com/ydb-platform/ydb-go-yc-metadata v0.6.1 h1:9E5q8Nsy2RiJMZDNVy0A3KUrIMBPakJ2VgloeWbcI84=
@@ -1919,8 +1919,8 @@ go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
 go.uber.org/zap v1.18.1/go.mod h1:xg/QME4nWcxGxrpdeYfq7UvYrLh66cuVKdrbD1XF/NI=
 go.uber.org/zap v1.19.0/go.mod h1:xg/QME4nWcxGxrpdeYfq7UvYrLh66cuVKdrbD1XF/NI=
-go.uber.org/zap v1.27.1 h1:08RqriUEv8+ArZRYSTXy1LeBScaMpVSTBhCeaZYfMYc=
-go.uber.org/zap v1.27.1/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
+go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
+go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
 go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
 go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
 go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
@@ -1953,8 +1953,8 @@ golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.47.0 h1:V6e3FRj+n4dbpw86FJ8Fv7XVOql7TEwpHapKoMJ/GO8=
-golang.org/x/crypto v0.47.0/go.mod h1:ff3Y9VzzKbwSSEzWqJsJVBnWmRwRSHt/6Op5n9bQc4A=
+golang.org/x/crypto v0.46.0 h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU=
+golang.org/x/crypto v0.46.0/go.mod h1:Evb/oLKmMraqjZ2iQTwDwvCtJkczlDuTmdJXoZVzqU0=
 golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20180807140117-3d87b88a115f/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -2090,8 +2090,8 @@ golang.org/x/net v0.16.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
 golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
-golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o=
-golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8=
+golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU=
+golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -2248,8 +2248,8 @@ golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ=
-golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk=
+golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -2264,8 +2264,8 @@ golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
-golang.org/x/term v0.39.0 h1:RclSuaJf32jOqZz74CkPA9qFuVTX7vhLlpfj/IGWlqY=
-golang.org/x/term v0.39.0/go.mod h1:yxzUCTP/U+FzoxfdKmLaA0RV1WgE0VY7hXBwKtY/4ww=
+golang.org/x/term v0.38.0 h1:PQ5pkm/rLO6HnxFR7N2lJHOZX6Kez5Y1gDSJla6jo7Q=
+golang.org/x/term v0.38.0/go.mod h1:bSEAKrOT1W+VSu9TSCMtoGEOUcKxOKgl3LE5QEF/xVg=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -2582,8 +2582,8 @@ google.golang.org/genproto v0.0.0-20230222225845-10f96fb3dbec/go.mod h1:3Dl5ZL0q
 google.golang.org/genproto v0.0.0-20230306155012-7f2fa6fef1f4/go.mod h1:NWraEVixdDnqcqQ30jipen1STv2r/n24Wb7twVTGR4s=
 google.golang.org/genproto v0.0.0-20250922171735-9219d122eba9 h1:LvZVVaPE0JSqL+ZWb6ErZfnEOKIqqFWUJE2D0fObSmc=
 google.golang.org/genproto v0.0.0-20250922171735-9219d122eba9/go.mod h1:QFOrLhdAe2PsTp3vQY4quuLKTi9j3XG3r6JPPaw7MSc=
-google.golang.org/genproto/googleapis/api v0.0.0-20251124214823-79d6a2a48846 h1:ZdyUkS9po3H7G0tuh955QVyyotWvOD4W0aEapeGeUYk=
-google.golang.org/genproto/googleapis/api v0.0.0-20251124214823-79d6a2a48846/go.mod h1:Fk4kyraUvqD7i5H6S43sj2W98fbZa75lpZz/eUyhfO0=
+google.golang.org/genproto/googleapis/api v0.0.0-20251111163417-95abcf5c77ba h1:B14OtaXuMaCQsl2deSvNkyPKIzq3BjfxQp8d00QyWx4=
+google.golang.org/genproto/googleapis/api v0.0.0-20251111163417-95abcf5c77ba/go.mod h1:G5IanEx8/PgI9w6CFcYQf7jMtHQhZruvfM1i3qOqk5U=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20251213004720-97cd9d5aeac2 h1:2I6GHUeJ/4shcDpoUlLs/2WPnhg7yJwvXtqcMJt9liA=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20251213004720-97cd9d5aeac2/go.mod h1:7i2o+ce6H/6BluujYR+kqX3GKH+dChPTQU19wjRPiGk=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
@@ -2748,8 +2748,8 @@ modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
 modernc.org/sqlite v1.18.1/go.mod h1:6ho+Gow7oX5V+OiOQ6Tr4xeqbx13UZ6t+Fw9IRUG4d4=
-modernc.org/sqlite v1.44.3 h1:+39JvV/HWMcYslAwRxHb8067w+2zowvFOUrOWIy9PjY=
-modernc.org/sqlite v1.44.3/go.mod h1:CzbrU2lSB1DKUusvwGz7rqEKIq+NUd8GWuBBZDs9/nA=
+modernc.org/sqlite v1.44.2 h1:EdYqXeBpKFJjg8QYnw6E71MpANkoxyuYi+g68ugOL8g=
+modernc.org/sqlite v1.44.2/go.mod h1:CzbrU2lSB1DKUusvwGz7rqEKIq+NUd8GWuBBZDs9/nA=
 modernc.org/strutil v1.1.0/go.mod h1:lstksw84oURvj9y3tn8lGvRxyRC1S2+g5uuIzNfIOBs=
 modernc.org/strutil v1.1.1/go.mod h1:DE+MQQ/hjKBZS2zNInV5hhcipt5rLPWkmpbGeW5mmdw=
 modernc.org/strutil v1.1.3/go.mod h1:MEHNA7PdEnEwLvspRMtWTNnp2nnyvMfkimT1NKNAGbw=

k8s/charts/seaweedfs/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v1
 description: SeaweedFS
 name: seaweedfs
-appVersion: "4.08"
+appVersion: "4.07"
 # Dev note: Trigger a helm chart release by `git tag -a helm-<version>`
-version: 4.0.408
+version: 4.0.407

k8s/charts/seaweedfs/README.md

@@ -1,5 +1,6 @@
 # SEAWEEDFS - helm chart (2.x+)
 
+## Getting Started
 
 ### Add the helm repo
 
@@ -23,7 +24,7 @@ helm install --values=values.yaml seaweedfs seaweedfs/seaweedfs
 * master/filer/volume are stateful sets with anti-affinity on the hostname,
 so your deployment will be spread/HA.
 * chart is using memsql(mysql) as the filer backend to enable HA (multiple filer instances) and backup/HA memsql can provide.
-* mysql user/password are created in a k8s secret (default: `<release>-seaweedfs-db-secret`) and injected to the filer with ENV.
+* mysql user/password are created in a k8s secret (secret-seaweedfs-db.yaml) and injected to the filer with ENV.
 * cert config exists and can be enabled, but not been tested, requires cert-manager to be installed.
 
 ## Prerequisites
@@ -34,9 +35,7 @@ leveldb is the default database, this supports multiple filer replicas that will
 When the [limitations](https://github.com/seaweedfs/seaweedfs/wiki/Filer-Store-Replication#limitation) apply, or for a large number of filer replicas, an external datastore is recommended.
 
 Such as MySQL-compatible database, as specified in the `values.yaml` at `filer.extraEnvironmentVars`.
-This database should be pre-configured and initialized. If using the default `db-init-config`, the configmap name is now dynamic (e.g., `<release>-seaweedfs-db-init-config`). You can override this name via `filer.dbInitConfigName`.
-
-To initialize manually:
+This database should be pre-configured and initialized by running:
 ```sql
 CREATE TABLE IF NOT EXISTS `filemeta` (
   `dirhash`   BIGINT NOT NULL       COMMENT 'first 64 bits of MD5 hash value of directory field',

k8s/charts/seaweedfs/templates/admin/admin-ingress.yaml

@@ -8,7 +8,7 @@ apiVersion: extensions/v1beta1
 {{- end }}
 kind: Ingress
 metadata:
-  name: ingress-{{ include "seaweedfs.fullname" . }}-admin
+  name: ingress-{{ template "seaweedfs.name" . }}-admin
   namespace: {{ .Release.Namespace }}
   annotations:
   {{- if and (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) .Values.admin.ingress.className }}
@@ -42,11 +42,11 @@ spec:
         backend:
 {{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion }}
           service:
-            name: {{ include "seaweedfs.componentName" (list . "admin") }}
+            name: {{ template "seaweedfs.name" . }}-admin
             port:
               number: {{ .Values.admin.port }}
 {{- else }}
-          serviceName: {{ include "seaweedfs.componentName" (list . "admin") }}
+          serviceName: {{ template "seaweedfs.name" . }}-admin
           servicePort: {{ .Values.admin.port }}
 {{- end }}
 {{- end }}

k8s/charts/seaweedfs/templates/admin/admin-secret.yaml

@@ -3,7 +3,7 @@ apiVersion: v1
 kind: Secret
 type: Opaque
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-admin-secret
+  name: {{ template "seaweedfs.name" . }}-admin-secret
   namespace: {{ .Release.Namespace }}
   annotations:
     "helm.sh/resource-policy": keep

k8s/charts/seaweedfs/templates/admin/admin-service.yaml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ printf "%s-admin" (include "seaweedfs.fullname" .) | trunc 63 | trimSuffix "-" }}
+  name: {{ template "seaweedfs.name" . }}-admin
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}

k8s/charts/seaweedfs/templates/admin/admin-servicemonitor.yaml

@@ -3,7 +3,7 @@
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-admin
+  name: {{ template "seaweedfs.name" . }}-admin
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -26,7 +26,6 @@ spec:
   selector:
     matchLabels:
       app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-      app.kubernetes.io/instance: {{ .Release.Name }}
       app.kubernetes.io/component: admin
 {{- end }}
 {{- end }}

k8s/charts/seaweedfs/templates/admin/admin-statefulset.yaml

@@ -1,14 +1,11 @@
 {{- if .Values.admin.enabled }}
-{{- if gt (.Values.admin.replicas | int) 1 }}
-{{- fail "admin.replicas must be 0 or 1" -}}
-{{- end }}
 {{- if and (not .Values.admin.masters) (not .Values.global.masterServer) (not .Values.master.enabled) }}
 {{- fail "admin.masters or global.masterServer must be set if master.enabled is false" -}}
 {{- end }}
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
-  name: {{ include "seaweedfs.componentName" (list . "admin") }}
+  name: {{ template "seaweedfs.name" . }}-admin
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -21,7 +18,7 @@ metadata:
     {{- toYaml .Values.admin.annotations | nindent 4 }}
 {{- end }}
 spec:
-  serviceName: {{ include "seaweedfs.componentName" (list . "admin") }}
+  serviceName: {{ template "seaweedfs.name" . }}-admin
   podManagementPolicy: {{ .Values.admin.podManagementPolicy }}
   replicas: {{ .Values.admin.replicas }}
   selector:
@@ -90,7 +87,7 @@ spec:
           {{- if and .Values.admin.secret.existingSecret (not .Values.admin.secret.pwKey) -}}
           {{-   fail "admin.secret.pwKey must be set when admin.secret.existingSecret is provided" -}}
           {{- end -}}
-          {{- $adminSecretName := .Values.admin.secret.existingSecret | default (printf "%s-admin-secret" (include "seaweedfs.fullname" .)) }}
+          {{- $adminSecretName := .Values.admin.secret.existingSecret | default (printf "%s-admin-secret" (include "seaweedfs.name" .)) }}
           env:
             {{- if $adminAuthEnabled }}
             - name: SEAWEEDFS_ADMIN_USER
@@ -117,7 +114,7 @@ spec:
                 fieldRef:
                   fieldPath: metadata.namespace
             - name: SEAWEEDFS_FULLNAME
-              value: "{{ include "seaweedfs.fullname" . }}"
+              value: "{{ template "seaweedfs.name" . }}"
             {{- if .Values.admin.extraEnvironmentVars }}
             {{- range $key, $value := .Values.admin.extraEnvironmentVars }}
             - name: {{ $key }}
@@ -284,25 +281,25 @@ spec:
         {{- if .Values.global.enableSecurity }}
         - name: security-config
           configMap:
-            name: {{ include "seaweedfs.fullname" . }}-security-config
+            name: {{ template "seaweedfs.name" . }}-security-config
         - name: ca-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
+            secretName: {{ template "seaweedfs.name" . }}-ca-cert
         - name: master-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-master-cert
+            secretName: {{ template "seaweedfs.name" . }}-master-cert
         - name: volume-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-volume-cert
+            secretName: {{ template "seaweedfs.name" . }}-volume-cert
         - name: filer-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-filer-cert
+            secretName: {{ template "seaweedfs.name" . }}-filer-cert
         - name: client-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-client-cert
+            secretName: {{ template "seaweedfs.name" . }}-client-cert
         - name: admin-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-admin-cert
+            secretName: {{ template "seaweedfs.name" . }}-admin-cert
         {{- end }}
         {{ tpl .Values.admin.extraVolumes . | indent 8 | trim }}
       {{- if .Values.admin.nodeSelector }}

k8s/charts/seaweedfs/templates/all-in-one/all-in-one-deployment.yaml

@@ -2,7 +2,7 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-all-in-one
+  name: {{ template "seaweedfs.name" . }}-all-in-one
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -98,7 +98,7 @@ spec:
                 fieldRef:
                   fieldPath: metadata.namespace
             - name: SEAWEEDFS_FULLNAME
-              value: "{{ include "seaweedfs.fullname" . }}"
+              value: "{{ template "seaweedfs.name" . }}"
             {{- if .Values.allInOne.extraEnvironmentVars }}
             {{- range $key, $value := .Values.allInOne.extraEnvironmentVars }}
             {{- if and (ne $key $clusterMasterKey) (ne $key $clusterFilerKey) }}
@@ -421,7 +421,7 @@ spec:
             type: DirectoryOrCreate
           {{- else if eq .Values.allInOne.data.type "persistentVolumeClaim" }}
           persistentVolumeClaim:
-            claimName: {{ include "seaweedfs.fullname" . }}-all-in-one-data
+            claimName: {{ template "seaweedfs.name" . }}-all-in-one-data
           {{- else if eq .Values.allInOne.data.type "existingClaim" }}
           persistentVolumeClaim:
             claimName: {{ .Values.allInOne.data.claimName }}
@@ -432,47 +432,47 @@ spec:
         - name: config-s3-users
           secret:
             defaultMode: 420
-            secretName: {{ default (printf "%s-s3-secret" (include "seaweedfs.fullname" .)) (or .Values.allInOne.s3.existingConfigSecret .Values.s3.existingConfigSecret .Values.filer.s3.existingConfigSecret) }}
+            secretName: {{ default (printf "%s-s3-secret" (include "seaweedfs.name" .)) (or .Values.allInOne.s3.existingConfigSecret .Values.s3.existingConfigSecret .Values.filer.s3.existingConfigSecret) }}
         {{- end }}
         {{- if .Values.allInOne.sftp.enabled }}
         - name: config-ssh
           secret:
             defaultMode: 420
-            secretName: {{ default (printf "%s-sftp-ssh-secret" (include "seaweedfs.fullname" .)) (or .Values.allInOne.sftp.existingSshConfigSecret .Values.sftp.existingSshConfigSecret) }}
+            secretName: {{ default (printf "%s-sftp-ssh-secret" (include "seaweedfs.name" .)) (or .Values.allInOne.sftp.existingSshConfigSecret .Values.sftp.existingSshConfigSecret) }}
         {{- if or .Values.allInOne.sftp.enableAuth .Values.sftp.enableAuth }}
         - name: config-users
           secret:
             defaultMode: 420
-            secretName: {{ default (printf "%s-sftp-secret" (include "seaweedfs.fullname" .)) (or .Values.allInOne.sftp.existingConfigSecret .Values.sftp.existingConfigSecret) }}
+            secretName: {{ default (printf "%s-sftp-secret" (include "seaweedfs.name" .)) (or .Values.allInOne.sftp.existingConfigSecret .Values.sftp.existingConfigSecret) }}
         {{- end }}
         {{- end }}
         {{- if .Values.filer.notificationConfig }}
         - name: notification-config
           configMap:
-            name: {{ include "seaweedfs.fullname" . }}-notification-config
+            name: {{ template "seaweedfs.name" . }}-notification-config
         {{- end }}
         - name: master-config
           configMap:
-            name: {{ include "seaweedfs.fullname" . }}-master-config
+            name: {{ template "seaweedfs.name" . }}-master-config
         {{- if .Values.global.enableSecurity }}
         - name: security-config
           configMap:
-            name: {{ include "seaweedfs.fullname" . }}-security-config
+            name: {{ template "seaweedfs.name" . }}-security-config
         - name: ca-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
+            secretName: {{ template "seaweedfs.name" . }}-ca-cert
         - name: master-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-master-cert
+            secretName: {{ template "seaweedfs.name" . }}-master-cert
         - name: volume-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-volume-cert
+            secretName: {{ template "seaweedfs.name" . }}-volume-cert
         - name: filer-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-filer-cert
+            secretName: {{ template "seaweedfs.name" . }}-filer-cert
         - name: client-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-client-cert
+            secretName: {{ template "seaweedfs.name" . }}-client-cert
         {{- end }}
         {{ tpl .Values.allInOne.extraVolumes . | nindent 8 }}
       {{- if .Values.allInOne.nodeSelector }}

k8s/charts/seaweedfs/templates/all-in-one/all-in-one-pvc.yaml

@@ -3,7 +3,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-all-in-one-data
+  name: {{ template "seaweedfs.name" . }}-all-in-one-data
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}

k8s/charts/seaweedfs/templates/all-in-one/all-in-one-service.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ printf "%s-all-in-one" (include "seaweedfs.fullname" .) | trunc 63 | trimSuffix "-" }}
+  name: {{ template "seaweedfs.name" . }}-all-in-one
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -81,6 +81,5 @@ spec:
   
   selector:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: seaweedfs-all-in-one
 {{- end }}

k8s/charts/seaweedfs/templates/all-in-one/all-in-one-servicemonitor.yaml

@@ -3,7 +3,7 @@
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-all-in-one
+  name: {{ template "seaweedfs.name" . }}-all-in-one
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -24,7 +24,6 @@ spec:
   selector:
     matchLabels:
       app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-      app.kubernetes.io/instance: {{ .Release.Name }}
       app.kubernetes.io/component: seaweedfs-all-in-one
 {{- end }}
 {{- end }}

k8s/charts/seaweedfs/templates/cert/admin-cert.yaml

@@ -2,7 +2,7 @@
 apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Certificate
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-admin-cert
+  name: {{ template "seaweedfs.name" . }}-admin-cert
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -15,19 +15,19 @@ metadata:
     {{- toYaml .Values.admin.annotations | nindent 4 }}
   {{- end }}
 spec:
-  secretName: {{ include "seaweedfs.fullname" . }}-admin-cert
+  secretName: {{ template "seaweedfs.name" . }}-admin-cert
   issuerRef:
-    name: {{ include "seaweedfs.fullname" . }}-ca-issuer
+    name: {{ template "seaweedfs.name" . }}-ca-issuer
     kind: Issuer
   commonName: {{ .Values.certificates.commonName }}
   subject:
     organizations:
     - "SeaweedFS CA"
   dnsNames:
-    - '*.{{ include "seaweedfs.fullname" . }}-admin'
-    - '*.{{ include "seaweedfs.fullname" . }}-admin.{{ .Release.Namespace }}'
-    - '*.{{ include "seaweedfs.fullname" . }}-admin.{{ .Release.Namespace }}.svc'
-    - '*.{{ include "seaweedfs.fullname" . }}-admin.{{ .Release.Namespace }}.svc.cluster.local'
+    - '*.{{ template "seaweedfs.name" . }}-admin'
+    - '*.{{ template "seaweedfs.name" . }}-admin.{{ .Release.Namespace }}'
+    - '*.{{ template "seaweedfs.name" . }}-admin.{{ .Release.Namespace }}.svc'
+    - '*.{{ template "seaweedfs.name" . }}-admin.{{ .Release.Namespace }}.svc.cluster.local'
 {{- if .Values.certificates.ipAddresses }}
   ipAddresses:
     {{- range .Values.certificates.ipAddresses }}

k8s/charts/seaweedfs/templates/cert/ca-cert.yaml

@@ -2,7 +2,7 @@
 apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Certificate
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-ca-cert
+  name: {{ template "seaweedfs.name" . }}-ca-cert
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -10,8 +10,8 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
 spec:
-  secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
-  commonName: "{{ include "seaweedfs.fullname" . }}-root-ca"
+  secretName: {{ template "seaweedfs.name" . }}-ca-cert
+  commonName: "{{ template "seaweedfs.name" . }}-root-ca"
   isCA: true
   {{- if .Values.certificates.ca.duration }}
   duration: {{ .Values.certificates.ca.duration }}
@@ -20,6 +20,6 @@ spec:
   renewBefore: {{ .Values.certificates.ca.renewBefore }}
   {{- end }}
   issuerRef:
-    name: {{ include "seaweedfs.fullname" . }}-issuer
+    name: {{ template "seaweedfs.name" . }}-issuer
     kind: Issuer
 {{- end }}

k8s/charts/seaweedfs/templates/cert/cert-caissuer.yaml

@@ -2,7 +2,7 @@
 apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Issuer
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-ca-issuer
+  name: {{ template "seaweedfs.name" . }}-ca-issuer
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -11,5 +11,5 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
 spec:
   ca:
-    secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
+    secretName: {{ template "seaweedfs.name" . }}-ca-cert
 {{- end }}

k8s/charts/seaweedfs/templates/cert/cert-issuer.yaml

@@ -2,7 +2,7 @@
 apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Issuer
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-issuer
+  name: {{ template "seaweedfs.name" . }}-issuer
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}

k8s/charts/seaweedfs/templates/cert/client-cert.yaml

@@ -2,7 +2,7 @@
 apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Certificate
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-client-cert
+  name: {{ template "seaweedfs.name" . }}-client-cert
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -10,9 +10,9 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
 spec:
-  secretName: {{ include "seaweedfs.fullname" . }}-client-cert
+  secretName: {{ template "seaweedfs.name" . }}-client-cert
   issuerRef:
-    name: {{ include "seaweedfs.fullname" . }}-ca-issuer
+    name: {{ template "seaweedfs.name" . }}-ca-issuer
     kind: Issuer
   commonName: {{ .Values.certificates.commonName }}
   subject:
@@ -22,10 +22,10 @@ spec:
     - '*.{{ .Release.Namespace }}'
     - '*.{{ .Release.Namespace }}.svc'
     - '*.{{ .Release.Namespace }}.svc.cluster.local'
-    - '*.{{ include "seaweedfs.fullname" . }}-master'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc.cluster.local'
+    - '*.{{ template "seaweedfs.name" . }}-master'
+    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}'
+    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}.svc'
+    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}.svc.cluster.local'
 {{- if .Values.certificates.ipAddresses }}
   ipAddresses:
     {{- range .Values.certificates.ipAddresses }}

k8s/charts/seaweedfs/templates/cert/filer-cert.yaml

@@ -2,7 +2,7 @@
 apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Certificate
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-filer-cert
+  name: {{ template "seaweedfs.name" . }}-filer-cert
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -15,9 +15,9 @@ metadata:
     {{- toYaml .Values.filer.annotations | nindent 4 }}
   {{- end }}
 spec:
-  secretName: {{ include "seaweedfs.fullname" . }}-filer-cert
+  secretName: {{ template "seaweedfs.name" . }}-filer-cert
   issuerRef:
-    name: {{ include "seaweedfs.fullname" . }}-ca-issuer
+    name: {{ template "seaweedfs.name" . }}-ca-issuer
     kind: Issuer
   commonName: {{ .Values.certificates.commonName }}
   subject:
@@ -27,10 +27,10 @@ spec:
     - '*.{{ .Release.Namespace }}'
     - '*.{{ .Release.Namespace }}.svc'
     - '*.{{ .Release.Namespace }}.svc.cluster.local'
-    - '*.{{ include "seaweedfs.fullname" . }}-master'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc.cluster.local'
+    - '*.{{ template "seaweedfs.name" . }}-master'
+    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}'
+    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}.svc'
+    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}.svc.cluster.local'
 {{- if .Values.certificates.ipAddresses }}
   ipAddresses:
     {{- range .Values.certificates.ipAddresses }}

k8s/charts/seaweedfs/templates/cert/master-cert.yaml

@@ -2,7 +2,7 @@
 apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Certificate
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-master-cert
+  name: {{ template "seaweedfs.name" . }}-master-cert
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -15,9 +15,9 @@ metadata:
     {{- toYaml .Values.master.annotations | nindent 4 }}
 {{- end }}
 spec:
-  secretName: {{ include "seaweedfs.fullname" . }}-master-cert
+  secretName: {{ template "seaweedfs.name" . }}-master-cert
   issuerRef:
-    name: {{ include "seaweedfs.fullname" . }}-ca-issuer
+    name: {{ template "seaweedfs.name" . }}-ca-issuer
     kind: Issuer
   commonName: {{ .Values.certificates.commonName }}
   subject:
@@ -27,10 +27,10 @@ spec:
     - '*.{{ .Release.Namespace }}'
     - '*.{{ .Release.Namespace }}.svc'
     - '*.{{ .Release.Namespace }}.svc.cluster.local'
-    - '*.{{ include "seaweedfs.fullname" . }}-master'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc.cluster.local'
+    - '*.{{ template "seaweedfs.name" . }}-master'
+    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}'
+    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}.svc'
+    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}.svc.cluster.local'
 {{- if .Values.certificates.ipAddresses }}
   ipAddresses:
     {{- range .Values.certificates.ipAddresses }}

k8s/charts/seaweedfs/templates/cert/volume-cert.yaml

@@ -2,7 +2,7 @@
 apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Certificate
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-volume-cert
+  name: {{ template "seaweedfs.name" . }}-volume-cert
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -15,9 +15,9 @@ metadata:
     {{- toYaml .Values.volume.annotations | nindent 4 }}
 {{- end }}
 spec:
-  secretName: {{ include "seaweedfs.fullname" . }}-volume-cert
+  secretName: {{ template "seaweedfs.name" . }}-volume-cert
   issuerRef:
-    name: {{ include "seaweedfs.fullname" . }}-ca-issuer
+    name: {{ template "seaweedfs.name" . }}-ca-issuer
     kind: Issuer
   commonName: {{ .Values.certificates.commonName }}
   subject:
@@ -27,10 +27,10 @@ spec:
     - '*.{{ .Release.Namespace }}'
     - '*.{{ .Release.Namespace }}.svc'
     - '*.{{ .Release.Namespace }}.svc.cluster.local'
-    - '*.{{ include "seaweedfs.fullname" . }}-master'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc.cluster.local'
+    - '*.{{ template "seaweedfs.name" . }}-master'
+    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}'
+    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}.svc'
+    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}.svc.cluster.local'
 {{- if .Values.certificates.ipAddresses }}
   ipAddresses:
     {{- range .Values.certificates.ipAddresses }}

k8s/charts/seaweedfs/templates/cert/worker-cert.yaml

@@ -2,7 +2,7 @@
 apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Certificate
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-worker-cert
+  name: {{ template "seaweedfs.name" . }}-worker-cert
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -15,19 +15,19 @@ metadata:
     {{- toYaml .Values.worker.annotations | nindent 4 }}
   {{- end }}
 spec:
-  secretName: {{ include "seaweedfs.fullname" . }}-worker-cert
+  secretName: {{ template "seaweedfs.name" . }}-worker-cert
   issuerRef:
-    name: {{ include "seaweedfs.fullname" . }}-ca-issuer
+    name: {{ template "seaweedfs.name" . }}-ca-issuer
     kind: Issuer
   commonName: {{ .Values.certificates.commonName }}
   subject:
     organizations:
     - "SeaweedFS CA"
   dnsNames:
-    - '*.{{ include "seaweedfs.fullname" . }}-worker'
-    - '*.{{ include "seaweedfs.fullname" . }}-worker.{{ .Release.Namespace }}'
-    - '*.{{ include "seaweedfs.fullname" . }}-worker.{{ .Release.Namespace }}.svc'
-    - '*.{{ include "seaweedfs.fullname" . }}-worker.{{ .Release.Namespace }}.svc.cluster.local'
+    - '*.{{ template "seaweedfs.name" . }}-worker'
+    - '*.{{ template "seaweedfs.name" . }}-worker.{{ .Release.Namespace }}'
+    - '*.{{ template "seaweedfs.name" . }}-worker.{{ .Release.Namespace }}.svc'
+    - '*.{{ template "seaweedfs.name" . }}-worker.{{ .Release.Namespace }}.svc.cluster.local'
 {{- if .Values.certificates.ipAddresses }}
   ipAddresses:
     {{- range .Values.certificates.ipAddresses }}

k8s/charts/seaweedfs/templates/cosi/cosi-cluster-role.yaml

@@ -3,7 +3,7 @@
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-objectstorage-provisioner
+  name: {{ .Values.global.serviceAccountName }}-objectstorage-provisioner
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
@@ -52,7 +52,7 @@ rules:
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-objectstorage-provisioner
+  name: {{ .Values.global.serviceAccountName }}-objectstorage-provisioner
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
@@ -64,6 +64,6 @@ subjects:
     namespace: {{ .Release.Namespace }}
 roleRef:
   kind: ClusterRole
-  name: {{ include "seaweedfs.fullname" . }}-objectstorage-provisioner
+  name: {{ .Values.global.serviceAccountName }}-objectstorage-provisioner
   apiGroup: rbac.authorization.k8s.io
 {{- end }}

k8s/charts/seaweedfs/templates/cosi/cosi-deployment.yaml

@@ -2,7 +2,7 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-objectstorage-provisioner
+  name: {{ template "seaweedfs.name" . }}-objectstorage-provisioner
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -57,7 +57,7 @@ spec:
       priorityClassName: {{ .Values.cosi.priorityClassName | quote }}
       {{- end }}
       enableServiceLinks: false
-      serviceAccountName: {{ include "seaweedfs.componentName" (list . "objectstorage-provisioner") }}
+      serviceAccountName: {{ .Values.global.serviceAccountName }}-objectstorage-provisioner
       {{- if .Values.cosi.initContainers }}
       initContainers:
         {{ tpl .Values.cosi.initContainers . | nindent 8 | trim }}
@@ -78,16 +78,16 @@ spec:
               {{- else if .Values.s3.ingress.enabled }}
               value: "{{ printf "https://%s" .Values.s3.ingress.host }}"
               {{- else if .Values.s3.enabled }}
-              value: "{{ printf "https://%s.%s.svc" (include "seaweedfs.componentName" (list . "s3")) .Release.Namespace }}"
+              value: "{{ printf "https://%s-s3.%s.svc" (include "seaweedfs.name" .) .Release.Namespace }}"
               {{- else }}
-              value: "{{ printf "https://%s.%s.svc" (include "seaweedfs.componentName" (list . "filer")) .Release.Namespace }}"
+              value: "{{ printf "https://%s-filer.%s.svc" (include "seaweedfs.name" .) .Release.Namespace }}"
               {{- end }}
             {{- with .Values.cosi.region }}
             - name: REGION
               value: "{{ . }}"
             {{- end }}
             - name: SEAWEEDFS_FILER
-              value: "{{ include "seaweedfs.componentName" (list . "filer") }}:{{ .Values.filer.grpcPort }}"
+              value: "{{ template "seaweedfs.name" . }}-filer:{{ .Values.filer.grpcPort }}"
             {{- if .Values.global.enableSecurity }}
             - name: WEED_GRPC_CLIENT_KEY
               value: /usr/local/share/ca-certificates/client/tls.key
@@ -185,28 +185,28 @@ spec:
             {{- if .Values.cosi.existingConfigSecret }}
             secretName: {{ .Values.cosi.existingConfigSecret }}
             {{- else }}
-            secretName: {{ include "seaweedfs.fullname" . }}-s3-secret
+            secretName: seaweedfs-s3-secret
             {{- end }}
         {{- end }}
         {{- if .Values.global.enableSecurity }}
         - name: security-config
           configMap:
-            name: {{ include "seaweedfs.fullname" . }}-security-config
+            name: {{ template "seaweedfs.name" . }}-security-config
         - name: ca-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
+            secretName: {{ template "seaweedfs.name" . }}-ca-cert
         - name: master-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-master-cert
+            secretName: {{ template "seaweedfs.name" . }}-master-cert
         - name: volume-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-volume-cert
+            secretName: {{ template "seaweedfs.name" . }}-volume-cert
         - name: filer-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-filer-cert
+            secretName: {{ template "seaweedfs.name" . }}-filer-cert
         - name: client-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-client-cert
+            secretName: {{ template "seaweedfs.name" . }}-client-cert
         {{- end }}
         {{ tpl .Values.cosi.extraVolumes . | indent 8 | trim }}
       {{- if .Values.cosi.nodeSelector }}

k8s/charts/seaweedfs/templates/filer/filer-ingress.yaml

@@ -2,7 +2,7 @@
 {{- $filerEnabled := or .Values.filer.enabled .Values.allInOne.enabled }}
 {{- if and $filerEnabled .Values.filer.ingress.enabled }}
 {{- /* Determine service name based on deployment mode */}}
-{{- $serviceName := ternary (include "seaweedfs.componentName" (list . "all-in-one")) (include "seaweedfs.componentName" (list . "filer")) .Values.allInOne.enabled }}
+{{- $serviceName := ternary (printf "%s-all-in-one" (include "seaweedfs.name" .)) (printf "%s-filer" (include "seaweedfs.name" .)) .Values.allInOne.enabled }}
 {{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion }}
 apiVersion: networking.k8s.io/v1
 {{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion }}
@@ -12,7 +12,7 @@ apiVersion: extensions/v1beta1
 {{- end }}
 kind: Ingress
 metadata:
-  name: ingress-{{ include "seaweedfs.fullname" . }}-filer
+  name: ingress-{{ template "seaweedfs.name" . }}-filer
   namespace: {{ .Release.Namespace }}
   {{- with .Values.filer.ingress.annotations }}
   annotations:

k8s/charts/seaweedfs/templates/filer/filer-service-client.yaml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ printf "%s-filer-client" (include "seaweedfs.fullname" .) | trunc 63 | trimSuffix "-" }}
+  name: {{ template "seaweedfs.name" . }}-filer-client
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -36,6 +36,5 @@ spec:
 {{- end }}
   selector:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: filer
 {{- end }}

k8s/charts/seaweedfs/templates/filer/filer-service.yaml

@@ -4,7 +4,7 @@ kind: Service
 metadata:
   annotations:
     service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
-  name: {{ printf "%s-filer" (include "seaweedfs.fullname" .) | trunc 63 | trimSuffix "-" }}
+  name: {{ template "seaweedfs.name" . }}-filer
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -48,6 +48,5 @@ spec:
   {{- end }}
   selector:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: filer
 {{- end }}

k8s/charts/seaweedfs/templates/filer/filer-servicemonitor.yaml

@@ -4,7 +4,7 @@
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-filer
+  name: {{ template "seaweedfs.name" . }}-filer
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -27,7 +27,6 @@ spec:
   selector:
     matchLabels:
       app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-      app.kubernetes.io/instance: {{ .Release.Name }}
       app.kubernetes.io/component: filer
 {{- end }}
 {{- end }}

k8s/charts/seaweedfs/templates/filer/filer-statefulset.yaml

@@ -2,7 +2,7 @@
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
-  name: {{ include "seaweedfs.componentName" (list . "filer") }}
+  name: {{ template "seaweedfs.name" . }}-filer
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -15,7 +15,7 @@ metadata:
     {{- toYaml .Values.filer.annotations | nindent 4 }}
 {{- end }}
 spec:
-  serviceName: {{ include "seaweedfs.componentName" (list . "filer") }}
+  serviceName: {{ template "seaweedfs.name" . }}-filer
   podManagementPolicy: {{ .Values.filer.podManagementPolicy }}
   replicas: {{ .Values.filer.replicas }}
   {{- if (gt (int .Values.filer.updatePartition) 0) }}
@@ -70,7 +70,7 @@ spec:
         {{ tpl .Values.filer.tolerations . | nindent 8 | trim }}
       {{- end }}
       {{- include "seaweedfs.imagePullSecrets" . | nindent 6 }}
-      serviceAccountName: {{ .Values.filer.serviceAccountName | default (include "seaweedfs.serviceAccountName" .) | quote }} # for deleting statefulset pods after migration
+      serviceAccountName: {{ .Values.filer.serviceAccountName | default .Values.global.serviceAccountName | quote }} # for deleting statefulset pods after migration
       terminationGracePeriodSeconds: 60
       {{- if .Values.filer.priorityClassName }}
       priorityClassName: {{ .Values.filer.priorityClassName | quote }}
@@ -103,17 +103,17 @@ spec:
             - name: WEED_MYSQL_USERNAME
               valueFrom:
                 secretKeyRef:
-                  name: {{ include "seaweedfs.fullname" . }}-db-secret
+                  name: secret-seaweedfs-db
                   key: user
                   optional: true
             - name: WEED_MYSQL_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: {{ include "seaweedfs.fullname" . }}-db-secret
+                  name: secret-seaweedfs-db
                   key: password
                   optional: true
             - name: SEAWEEDFS_FULLNAME
-              value: "{{ include "seaweedfs.fullname" . }}"
+              value: "{{ template "seaweedfs.name" . }}"
             {{- if .Values.filer.extraEnvironmentVars }}
             {{- range $key, $value := .Values.filer.extraEnvironmentVars }}
             - name: {{ $key }}
@@ -359,7 +359,7 @@ spec:
         {{- end }}
         - name: db-schema-config-volume
           configMap:
-            name: {{ default (printf "%s-db-init-config" (include "seaweedfs.fullname" .)) .Values.filer.dbInitConfigName }}
+            name: seaweedfs-db-init-config
         {{- if and .Values.filer.s3.enabled .Values.filer.s3.enableAuth }}
         - name: config-users
           secret:
@@ -367,33 +367,33 @@ spec:
             {{- if .Values.filer.s3.existingConfigSecret }}
             secretName: {{ .Values.filer.s3.existingConfigSecret }}
             {{- else }}
-            secretName: {{ include "seaweedfs.fullname" . }}-s3-secret
+            secretName: seaweedfs-s3-secret
             {{- end }}
         {{- end }}
         {{- if .Values.filer.notificationConfig }}
         - name: notification-config
           configMap:
-            name: {{ include "seaweedfs.fullname" . }}-notification-config
+            name: {{ template "seaweedfs.name" . }}-notification-config
         {{- end }}
         {{- if .Values.global.enableSecurity }}
         - name: security-config
           configMap:
-            name: {{ include "seaweedfs.fullname" . }}-security-config
+            name: {{ template "seaweedfs.name" . }}-security-config
         - name: ca-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
+            secretName: {{ template "seaweedfs.name" . }}-ca-cert
         - name: master-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-master-cert
+            secretName: {{ template "seaweedfs.name" . }}-master-cert
         - name: volume-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-volume-cert
+            secretName: {{ template "seaweedfs.name" . }}-volume-cert
         - name: filer-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-filer-cert
+            secretName: {{ template "seaweedfs.name" . }}-filer-cert
         - name: client-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-client-cert
+            secretName: {{ template "seaweedfs.name" . }}-client-cert
         {{- end }}
         {{ tpl .Values.filer.extraVolumes . | indent 8 | trim }}
       {{- if .Values.filer.nodeSelector }}

k8s/charts/seaweedfs/templates/master/master-configmap.yaml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-master-config
+  name: {{ template "seaweedfs.name" . }}-master-config
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}

k8s/charts/seaweedfs/templates/master/master-ingress.yaml

@@ -9,7 +9,7 @@ apiVersion: extensions/v1beta1
 {{- end }}
 kind: Ingress
 metadata:
-  name: ingress-{{ include "seaweedfs.fullname" . }}-master
+  name: ingress-{{ template "seaweedfs.name" . }}-master
   namespace: {{ .Release.Namespace }}
   {{- with .Values.master.ingress.annotations }}
   annotations:
@@ -33,15 +33,15 @@ spec:
             backend:
 {{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion }}
               service:
-                name: {{ include "seaweedfs.componentName" (list . "master") }}
+                name: {{ template "seaweedfs.name" . }}-master
                 port:
                   number: {{ .Values.master.port }}
                   #name:
 {{- else }}
-              serviceName: {{ include "seaweedfs.componentName" (list . "master") }}
+              serviceName: {{ template "seaweedfs.name" . }}-master
               servicePort: {{ .Values.master.port }}
 {{- end }}
-{{- if .Values.master.ingress.host }}
+{{- if .Values.filer.ingress.host }}
       host: {{ .Values.master.ingress.host }}
 {{- end }}
 {{- end }}

k8s/charts/seaweedfs/templates/master/master-service.yaml

@@ -2,14 +2,13 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ printf "%s-master" (include "seaweedfs.fullname" .) | trunc 63 | trimSuffix "-" }}
+  name: {{ template "seaweedfs.name" . }}-master
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     app.kubernetes.io/component: master
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
   annotations:
     service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
 {{- if .Values.master.annotations }}
@@ -35,6 +34,5 @@ spec:
   {{- end }}
   selector:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: master
 {{- end }}

k8s/charts/seaweedfs/templates/master/master-servicemonitor.yaml

@@ -4,7 +4,7 @@
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-master
+  name: {{ template "seaweedfs.name" . }}-master
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -27,7 +27,6 @@ spec:
   selector:
     matchLabels:
       app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-      app.kubernetes.io/instance: {{ .Release.Name }}
       app.kubernetes.io/component: master
 {{- end }}
 {{- end }}

k8s/charts/seaweedfs/templates/master/master-statefulset.yaml

@@ -2,7 +2,7 @@
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
-  name: {{ include "seaweedfs.componentName" (list . "master") }}
+  name: {{ template "seaweedfs.name" . }}-master
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -15,7 +15,7 @@ metadata:
     {{- toYaml .Values.master.annotations | nindent 4 }}
 {{- end }}
 spec:
-  serviceName: {{ include "seaweedfs.componentName" (list . "master") }}
+  serviceName: {{ template "seaweedfs.name" . }}-master
   podManagementPolicy: {{ .Values.master.podManagementPolicy }}
   replicas: {{ .Values.master.replicas }}
   {{- if (gt (int .Values.master.updatePartition) 0) }}
@@ -70,7 +70,7 @@ spec:
       {{- end }}
       enableServiceLinks: false
       {{- if .Values.global.createClusterRole }}
-      serviceAccountName: {{ .Values.master.serviceAccountName | default (include "seaweedfs.serviceAccountName" .) | quote }} # for deleting statefulset pods after migration
+      serviceAccountName: {{ .Values.master.serviceAccountName | default .Values.global.serviceAccountName | quote }} # for deleting statefulset pods after migration
       {{- end }}
       {{- if .Values.master.initContainers }}
       initContainers:
@@ -97,7 +97,7 @@ spec:
                 fieldRef:
                   fieldPath: metadata.namespace
             - name: SEAWEEDFS_FULLNAME
-              value: "{{ include "seaweedfs.fullname" . }}"
+              value: "{{ template "seaweedfs.name" . }}"
             {{- if .Values.master.extraEnvironmentVars }}
             {{- range $key, $value := .Values.master.extraEnvironmentVars }}
             - name: {{ $key }}
@@ -183,7 +183,7 @@ spec:
               {{- if .Values.master.garbageThreshold }}
               -garbageThreshold={{ .Values.master.garbageThreshold }} \
               {{- end }}
-              -ip=${POD_NAME}.{{ include "seaweedfs.componentName" (list . "master") }}.{{ .Release.Namespace }} \
+              -ip=${POD_NAME}.${SEAWEEDFS_FULLNAME}-master.{{ .Release.Namespace }} \
               -peers={{ include "seaweedfs.masterServers" . }} \
               {{- range .Values.master.extraArgs }}
               {{ . }} \
@@ -297,26 +297,26 @@ spec:
         {{- end }}
         - name: master-config
           configMap:
-            name: {{ include "seaweedfs.fullname" . }}-master-config
+            name: {{ template "seaweedfs.name" . }}-master-config
         {{- if .Values.global.enableSecurity }}
         - name: security-config
           configMap:
-            name: {{ include "seaweedfs.fullname" . }}-security-config
+            name: {{ template "seaweedfs.name" . }}-security-config
         - name: ca-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
+            secretName: {{ template "seaweedfs.name" . }}-ca-cert
         - name: master-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-master-cert
+            secretName: {{ template "seaweedfs.name" . }}-master-cert
         - name: volume-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-volume-cert
+            secretName: {{ template "seaweedfs.name" . }}-volume-cert
         - name: filer-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-filer-cert
+            secretName: {{ template "seaweedfs.name" . }}-filer-cert
         - name: client-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-client-cert
+            secretName: {{ template "seaweedfs.name" . }}-client-cert
         {{- end }}
         {{ tpl .Values.master.extraVolumes . | indent 8 | trim }}
       {{- if .Values.master.nodeSelector }}

k8s/charts/seaweedfs/templates/s3/s3-deployment.yaml

@@ -2,7 +2,7 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-s3
+  name: {{ template "seaweedfs.name" . }}-s3
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -89,7 +89,7 @@ spec:
                 fieldRef:
                   fieldPath: metadata.namespace
             - name: SEAWEEDFS_FULLNAME
-              value: "{{ include "seaweedfs.fullname" . }}"
+              value: "{{ template "seaweedfs.name" . }}"
             {{- if .Values.s3.extraEnvironmentVars }}
             {{- range $key, $value := .Values.s3.extraEnvironmentVars }}
             - name: {{ $key }}
@@ -149,7 +149,7 @@ spec:
               {{- if .Values.s3.auditLogConfig }}
               -auditLogConfig=/etc/sw/s3_auditLogConfig.json \
               {{- end }}
-              -filer={{ include "seaweedfs.componentName" (list . "filer-client") }}.{{ .Release.Namespace }}:{{ .Values.filer.port }} \
+              -filer={{ template "seaweedfs.name" . }}-filer-client.{{ .Release.Namespace }}:{{ .Values.filer.port }} \
               {{- range .Values.s3.extraArgs }}
               {{ . }} \
               {{- end }}
@@ -238,7 +238,7 @@ spec:
             {{- if .Values.s3.existingConfigSecret }}
             secretName: {{ .Values.s3.existingConfigSecret }}
             {{- else }}
-            secretName: {{ include "seaweedfs.fullname" . }}-s3-secret
+            secretName: seaweedfs-s3-secret
             {{- end }}
         {{- end }}
         {{- if eq .Values.s3.logs.type "hostPath" }}
@@ -254,22 +254,22 @@ spec:
         {{- if .Values.global.enableSecurity }}
         - name: security-config
           configMap:
-            name: {{ include "seaweedfs.fullname" . }}-security-config
+            name: {{ template "seaweedfs.name" . }}-security-config
         - name: ca-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
+            secretName: {{ template "seaweedfs.name" . }}-ca-cert
         - name: master-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-master-cert
+            secretName: {{ template "seaweedfs.name" . }}-master-cert
         - name: volume-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-volume-cert
+            secretName: {{ template "seaweedfs.name" . }}-volume-cert
         - name: filer-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-filer-cert
+            secretName: {{ template "seaweedfs.name" . }}-filer-cert
         - name: client-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-client-cert
+            secretName: {{ template "seaweedfs.name" . }}-client-cert
         {{- end }}
         {{ tpl .Values.s3.extraVolumes . | indent 8 | trim }}
       {{- if .Values.s3.nodeSelector }}

k8s/charts/seaweedfs/templates/s3/s3-ingress.yaml

@@ -2,7 +2,7 @@
 {{- $s3Enabled := or .Values.s3.enabled (and .Values.filer.s3.enabled (not .Values.allInOne.enabled)) (and .Values.allInOne.enabled .Values.allInOne.s3.enabled) }}
 {{- if and $s3Enabled .Values.s3.ingress.enabled }}
 {{- /* Determine service name based on deployment mode */}}
-{{- $serviceName := ternary (include "seaweedfs.componentName" (list . "all-in-one")) (include "seaweedfs.componentName" (list . "s3")) .Values.allInOne.enabled }}
+{{- $serviceName := ternary (printf "%s-all-in-one" (include "seaweedfs.name" .)) (printf "%s-s3" (include "seaweedfs.name" .)) .Values.allInOne.enabled }}
 {{- $s3Port := .Values.allInOne.s3.port | default .Values.s3.port }}
 {{- /* Build hosts list - support both legacy .host (string) and new .hosts (array) for backwards compatibility */}}
 {{- $hosts := list }}
@@ -20,7 +20,7 @@ apiVersion: extensions/v1beta1
 {{- end }}
 kind: Ingress
 metadata:
-  name: ingress-{{ include "seaweedfs.fullname" . }}-s3
+  name: ingress-{{ template "seaweedfs.name" . }}-s3
   namespace: {{ .Release.Namespace }}
   {{- with .Values.s3.ingress.annotations }}
   annotations:

k8s/charts/seaweedfs/templates/s3/s3-secret.yaml

@@ -1,24 +1,13 @@
 {{- if or (and (or .Values.s3.enabled .Values.allInOne.enabled) .Values.s3.enableAuth (not .Values.s3.existingConfigSecret)) (and .Values.filer.s3.enabled .Values.filer.s3.enableAuth (not .Values.filer.s3.existingConfigSecret)) }}
-{{- $secretName := printf "%s-s3-secret" (include "seaweedfs.fullname" .) }}
-{{- $legacySecretName := "seaweedfs-s3-secret" }}
-{{- $lookupName := $secretName }}
-{{- if .Values.s3.reuseLegacySecret }}
-{{-   $lookupName = default $legacySecretName .Values.s3.legacySecretName }}
-{{- end }}
-{{- $existingSecret := lookup "v1" "Secret" .Release.Namespace $lookupName }}
-{{- $reuse := false }}
-{{- if and .Values.s3.reuseLegacySecret $existingSecret }}
-{{- $reuse = true }}
-{{- end }}
-{{- $access_key_admin := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "admin_access_key_id" "length" 20 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
-{{- $secret_key_admin := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "admin_secret_access_key" "length" 40 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
-{{- $access_key_read := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "read_access_key_id" "length" 20 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
-{{- $secret_key_read := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "read_secret_access_key" "length" 40 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
+{{- $access_key_admin := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" "seaweedfs-s3-secret" "key" "admin_access_key_id" "length" 20) -}}
+{{- $secret_key_admin := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" "seaweedfs-s3-secret" "key" "admin_secret_access_key" "length" 40) -}}
+{{- $access_key_read := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" "seaweedfs-s3-secret" "key" "read_access_key_id" "length" 20) -}}
+{{- $secret_key_read := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" "seaweedfs-s3-secret" "key" "read_secret_access_key" "length" 40) -}}
 apiVersion: v1
 kind: Secret
 type: Opaque
 metadata:
-  name: {{ $secretName }}
+  name: seaweedfs-s3-secret
   namespace: {{ .Release.Namespace }}
   annotations:
     "helm.sh/resource-policy": keep

k8s/charts/seaweedfs/templates/s3/s3-service.yaml

@@ -2,14 +2,13 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ printf "%s-s3" (include "seaweedfs.fullname" .) | trunc 63 | trimSuffix "-" }}
+  name: {{ template "seaweedfs.name" . }}-s3
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     app.kubernetes.io/component: s3
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
 {{- if .Values.s3.annotations }}
   annotations:
     {{- toYaml .Values.s3.annotations | nindent 4 }}
@@ -35,6 +34,5 @@ spec:
 {{- end }}
   selector:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: {{ if .Values.s3.enabled }}s3{{ else }}filer{{ end }}
 {{- end }}

k8s/charts/seaweedfs/templates/s3/s3-servicemonitor.yaml

@@ -4,7 +4,7 @@
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-s3
+  name: {{ template "seaweedfs.name" . }}-s3
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -27,7 +27,6 @@ spec:
   selector:
     matchLabels:
       app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-      app.kubernetes.io/instance: {{ .Release.Name }}
       app.kubernetes.io/component: s3
 {{- end }}
 {{- end }}

k8s/charts/seaweedfs/templates/sftp/sftp-deployment.yaml

@@ -2,7 +2,7 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-sftp
+  name: {{ template "seaweedfs.name" . }}-sftp
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -89,7 +89,7 @@ spec:
                 fieldRef:
                   fieldPath: metadata.namespace
             - name: SEAWEEDFS_FULLNAME
-              value: "{{ include "seaweedfs.fullname" . }}"
+              value: "{{ template "seaweedfs.name" . }}"
             {{- if .Values.sftp.extraEnvironmentVars }}
             {{- range $key, $value := .Values.sftp.extraEnvironmentVars }}
             - name: {{ $key }}
@@ -171,7 +171,7 @@ spec:
               -key.file=/usr/local/share/ca-certificates/client/tls.key \
               {{- end }}
               -userStoreFile=/etc/sw/seaweedfs_sftp_config \
-              -filer={{ include "seaweedfs.componentName" (list . "filer-client") }}.{{ .Release.Namespace }}:{{ .Values.filer.port }}
+              -filer={{ template "seaweedfs.name" . }}-filer-client.{{ .Release.Namespace }}:{{ .Values.filer.port }}
           volumeMounts:
             {{- if or (eq .Values.sftp.logs.type "hostPath") (eq .Values.sftp.logs.type "emptyDir") }}
             - name: logs
@@ -252,7 +252,7 @@ spec:
             {{- if .Values.sftp.existingConfigSecret }}
             secretName: {{ .Values.sftp.existingConfigSecret }}
             {{- else }}
-            secretName: {{ include "seaweedfs.fullname" . }}-sftp-secret
+            secretName: seaweedfs-sftp-secret
             {{- end }}
         {{- end }}
         - name: config-ssh
@@ -261,7 +261,7 @@ spec:
             {{- if .Values.sftp.existingSshConfigSecret }}
             secretName: {{ .Values.sftp.existingSshConfigSecret }}
             {{- else }}
-            secretName: {{ include "seaweedfs.fullname" . }}-sftp-ssh-secret
+            secretName: seaweedfs-sftp-ssh-secret
             {{- end }}
         {{- if eq .Values.sftp.logs.type "hostPath" }}
         - name: logs
@@ -276,22 +276,22 @@ spec:
         {{- if .Values.global.enableSecurity }}
         - name: security-config
           configMap:
-            name: {{ include "seaweedfs.fullname" . }}-security-config
+            name: {{ template "seaweedfs.name" . }}-security-config
         - name: ca-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
+            secretName: {{ template "seaweedfs.name" . }}-ca-cert
         - name: master-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-master-cert
+            secretName: {{ template "seaweedfs.name" . }}-master-cert
         - name: volume-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-volume-cert
+            secretName: {{ template "seaweedfs.name" . }}-volume-cert
         - name: filer-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-filer-cert
+            secretName: {{ template "seaweedfs.name" . }}-filer-cert
         - name: client-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-client-cert
+            secretName: {{ template "seaweedfs.name" . }}-client-cert
         {{- end }}
         {{ tpl .Values.sftp.extraVolumes . | indent 8 | trim }}
       {{- if .Values.sftp.nodeSelector }}

k8s/charts/seaweedfs/templates/sftp/sftp-secret.yaml

@@ -1,13 +1,12 @@
 {{- if or .Values.sftp.enabled .Values.allInOne.enabled }}
-{{- $secretName := printf "%s-sftp-secret" (include "seaweedfs.fullname" .) }}
-{{- $admin_pwd := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "admin_password" 20) -}}
-{{- $read_user_pwd := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "readonly_password" 20) -}}
-{{- $public_user_pwd := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "public_user_password" 20) -}}
+{{- $admin_pwd := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" "seaweedfs-sftp-secret" "key" "admin_password" 20) -}}
+{{- $read_user_pwd := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" "seaweedfs-sftp-secret" "key" "readonly_password" 20) -}}
+{{- $public_user_pwd := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" "seaweedfs-sftp-secret" "key" "public_user_password" 20) -}}
 apiVersion: v1
 kind: Secret
 type: Opaque
 metadata:
-  name: {{ $secretName }}
+  name: seaweedfs-sftp-secret
   namespace: {{ .Release.Namespace }}
   annotations:
     "helm.sh/resource-policy": keep

k8s/charts/seaweedfs/templates/sftp/sftp-service.yaml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ printf "%s-sftp" (include "seaweedfs.fullname" .) | trunc 63 | trimSuffix "-" }}
+  name: {{ template "seaweedfs.name" . }}-sftp
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -28,6 +28,5 @@ spec:
 {{- end }}
   selector:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: sftp
 {{- end }}

k8s/charts/seaweedfs/templates/sftp/sftp-servicemonitor.yaml

@@ -4,7 +4,7 @@
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-sftp
+  name: {{ template "seaweedfs.name" . }}-sftp
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -27,7 +27,6 @@ spec:
   selector:
     matchLabels:
       app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-      app.kubernetes.io/instance: {{ .Release.Name }}
       app.kubernetes.io/component: sftp
 {{- end }}
 {{- end }}

k8s/charts/seaweedfs/templates/shared/_helpers.tpl

@@ -17,22 +17,6 @@ be used as a full name.
 {{- end -}}
 {{- end -}}
 
-{{/*
-Create a truncated component name.
-Usage: {{ include "seaweedfs.componentName" (list . "component-suffix") }}
-*/}}
-{{- define "seaweedfs.componentName" -}}
-{{- $context := index . 0 -}}
-{{- $suffix := index . 1 -}}
-{{- if gt (len $suffix) 61 -}}
-{{-   fail (printf "Suffix '%s' is too long for componentName helper. Max length is 61." $suffix) -}}
-{{- end -}}
-{{- $fullname := include "seaweedfs.fullname" $context -}}
-{{- $maxLen := sub 62 (len $suffix) | int -}}
-{{- $truncatedFullname := trunc $maxLen $fullname | trimSuffix "-" -}}
-{{- printf "%s-%s" $truncatedFullname $suffix -}}
-{{- end -}}
-
 {{/*
 Create chart name and version as used by the chart label.
 */}}
@@ -260,7 +244,7 @@ or generate a new random password if it doesn't exist.
 {{- $key := $params.key -}}
 {{- $length := default 16 $params.length -}}
 
-{{- $existingSecret := default (lookup "v1" "Secret" $namespace $secretName) $params.existingSecret -}}
+{{- $existingSecret := lookup "v1" "Secret" $namespace $secretName -}}
 {{- if and $existingSecret (index $existingSecret.data $key) -}}
   {{- index $existingSecret.data $key | b64dec -}}
 {{- else -}}
@@ -277,7 +261,7 @@ If allInOne is enabled, point to the all-in-one service; otherwise, point to the
 {{- if .Values.allInOne.enabled -}}
 {{-   $serviceNameSuffix = "-all-in-one" -}}
 {{- end -}}
-{{- printf "%s.%s:%d" (printf "%s%s" (include "seaweedfs.fullname" .) $serviceNameSuffix | trunc 63 | trimSuffix "-") .Release.Namespace (int .Values.master.port) -}}
+{{- printf "%s%s.%s:%d" (include "seaweedfs.name" .) $serviceNameSuffix .Release.Namespace (int .Values.master.port) -}}
 {{- end -}}
 
 {{/*
@@ -289,19 +273,19 @@ If allInOne is enabled, point to the all-in-one service; otherwise, point to the
 {{- if .Values.allInOne.enabled -}}
 {{-   $serviceNameSuffix = "-all-in-one" -}}
 {{- end -}}
-{{- printf "%s.%s:%d" (printf "%s%s" (include "seaweedfs.fullname" .) $serviceNameSuffix | trunc 63 | trimSuffix "-") .Release.Namespace (int .Values.filer.port) -}}
+{{- printf "%s%s.%s:%d" (include "seaweedfs.name" .) $serviceNameSuffix .Release.Namespace (int .Values.filer.port) -}}
 {{- end -}}
 
 {{/*
 Generate comma-separated list of master server addresses.
 Usage: {{ include "seaweedfs.masterServers" . }}
-Output example: my-release-master-0.my-release-master.namespace:9333,my-release-master-1...
+Output example: ${SEAWEEDFS_FULLNAME}-master-0.${SEAWEEDFS_FULLNAME}-master.namespace:9333,${SEAWEEDFS_FULLNAME}-master-1...
 */}}
 {{- define "seaweedfs.masterServers" -}}
-{{- $masterName := include "seaweedfs.componentName" (list . "master") -}}
+{{- $fullname := include "seaweedfs.name" . -}}
 {{- range $index := until (.Values.master.replicas | int) -}}
 {{- if $index }},{{ end -}}
-{{ $masterName }}-{{ $index }}.{{ $masterName }}.{{ $.Release.Namespace }}:{{ $.Values.master.port }}
+${SEAWEEDFS_FULLNAME}-master-{{ $index }}.${SEAWEEDFS_FULLNAME}-master.{{ $.Release.Namespace }}:{{ $.Values.master.port }}
 {{- end -}}
 {{- end -}}
 
@@ -316,10 +300,3 @@ Usage: {{ include "seaweedfs.masterServerArg" . }}
 {{- include "seaweedfs.masterServers" . -}}
 {{- end -}}
 {{- end -}}
-
-{{/*
-Create the name of the service account to use
-*/}}
-{{- define "seaweedfs.serviceAccountName" -}}
-{{- .Values.global.serviceAccountName | default "seaweedfs" -}}
-{{- end -}}

k8s/charts/seaweedfs/templates/shared/cluster-role.yaml

@@ -4,7 +4,7 @@
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-rw-cr
+  name: {{ .Values.global.serviceAccountName }}-rw-cr
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
@@ -18,7 +18,7 @@ rules:
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-rw-crb
+  name: system:serviceaccount:{{ .Values.global.serviceAccountName }}:default
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
@@ -26,10 +26,10 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
 subjects:
   - kind: ServiceAccount
-    name: {{ include "seaweedfs.serviceAccountName" . }}
+    name: {{ .Values.global.serviceAccountName }}
     namespace: {{ .Release.Namespace }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: {{ include "seaweedfs.fullname" . }}-rw-cr
+  name: {{ .Values.global.serviceAccountName }}-rw-cr
 {{- end }}

k8s/charts/seaweedfs/templates/shared/notification-configmap.yaml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-notification-config
+  name: {{ template "seaweedfs.name" . }}-notification-config
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}

k8s/charts/seaweedfs/templates/shared/post-install-bucket-hook.yaml

@@ -15,18 +15,14 @@
     {{- $existingConfigSecret = or .Values.allInOne.s3.existingConfigSecret .Values.s3.existingConfigSecret .Values.filer.s3.existingConfigSecret }}
   {{- end }}
 {{- else if .Values.master.enabled }}
-  {{- /* Check if embedded (in filer) or standalone S3 gateway is enabled */}}
-  {{- if or .Values.filer.s3.enabled .Values.s3.enabled }}
+  {{- /* Check standalone filer.s3 mode */}}
+  {{- if .Values.filer.s3.enabled }}
     {{- $s3Enabled = true }}
-    {{- if .Values.s3.createBuckets }}
-      {{- $createBuckets = .Values.s3.createBuckets }}
-      {{- $enableAuth = .Values.s3.enableAuth }}
-      {{- $existingConfigSecret = .Values.s3.existingConfigSecret }}
-    {{- else if .Values.filer.s3.createBuckets }}
+    {{- if .Values.filer.s3.createBuckets }}
       {{- $createBuckets = .Values.filer.s3.createBuckets }}
-      {{- $enableAuth = .Values.filer.s3.enableAuth }}
-      {{- $existingConfigSecret = .Values.filer.s3.existingConfigSecret }}
     {{- end }}
+    {{- $enableAuth = .Values.filer.s3.enableAuth }}
+    {{- $existingConfigSecret = .Values.filer.s3.existingConfigSecret }}
   {{- end }}
 {{- end }}
 
@@ -40,7 +36,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
     app.kubernetes.io/instance: {{ .Release.Name | quote }}
   annotations:
-    "helm.sh/hook": post-install,post-upgrade
+    "helm.sh/hook": post-install
     "helm.sh/hook-weight": "-5"
     "helm.sh/hook-delete-policy": hook-succeeded
 spec:
@@ -78,7 +74,7 @@ spec:
               fieldRef:
                 fieldPath: metadata.namespace
           - name: SEAWEEDFS_FULLNAME
-            value: "{{ include "seaweedfs.fullname" . }}"
+            value: "{{ template "seaweedfs.name" . }}"
         command:
           - "/bin/sh"
           - "-ec"
@@ -109,12 +105,9 @@ spec:
             wait_for_service "http://$WEED_CLUSTER_SW_FILER{{ .Values.filer.readinessProbe.httpGet.path }}"
             {{- end }}
           {{- range $createBuckets }}
-            if /bin/echo "s3.bucket.list" | /usr/bin/weed shell | awk '{print $1}' | grep -Fxq "{{ .name }}"; then
-              echo "Bucket '{{ .name }}' already exists, skipping creation."
-            else
-              echo "Creating bucket '{{ .name }}'..."
-              /bin/echo "s3.bucket.create --name {{ .name }}" | /usr/bin/weed shell
-            fi
+            /bin/echo \
+            "s3.bucket.create --name {{ .name }}" |\
+            /usr/bin/weed shell
           {{- end }}
           {{- range $createBuckets }}
           {{- if .anonymousRead }}
@@ -152,7 +145,7 @@ spec:
             {{- if $existingConfigSecret }}
             secretName: {{ $existingConfigSecret }}
             {{- else }}
-            secretName: {{ include "seaweedfs.fullname" . }}-s3-secret
+            secretName: {{ template "seaweedfs.name" . }}-s3-secret
             {{- end }}
     {{- end }}
 {{- end }}

k8s/charts/seaweedfs/templates/shared/seaweedfs-grafana-dashboard.yaml

@@ -7,7 +7,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: {{ include "seaweedfs.fullname" $ }}-{{ printf "%s" $dashboardName | lower | replace "_" "-" }}
+  name: {{ printf "%s" $dashboardName | lower | replace "_" "-" }}
   namespace: {{ $.Release.Namespace }}
   labels:
     grafana_dashboard: "1"

k8s/charts/seaweedfs/templates/shared/secret-seaweedfs-db.yaml

@@ -3,7 +3,7 @@ apiVersion: v1
 kind: Secret
 type: Opaque
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-db-secret
+  name: secret-seaweedfs-db
   namespace: {{ .Release.Namespace }}
   annotations:
     "helm.sh/resource-policy": keep
@@ -15,6 +15,7 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
 stringData:
   user: "YourSWUser"
-  # auto-generated password
-  password: {{ randAlphaNum 10 | sha256sum | b64enc | trunc 32 }}
+  password: "HardCodedPassword"
+  # better to random generate and create in DB
+  # password: {{ randAlphaNum 10 | sha256sum | b64enc | trunc 32 }}
 {{- end }}

k8s/charts/seaweedfs/templates/shared/security-configmap.yaml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-security-config
+  name: {{ template "seaweedfs.name" . }}-security-config
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -10,13 +10,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
 data:
-  {{- $fullname := include "seaweedfs.fullname" . }}
-  {{- $securityConfigName := printf "%s-security-config" $fullname }}
-  {{- $existing := lookup "v1" "ConfigMap" .Release.Namespace $securityConfigName }}
-  {{- if not $existing }}
-  {{- $legacyName := printf "%s-%s" (include "seaweedfs.name" .) "security-config" }}
-  {{- $existing = lookup "v1" "ConfigMap" .Release.Namespace $legacyName }}
-  {{- end }}
+  {{- $existing := (lookup "v1" "ConfigMap" .Release.Namespace (printf "%s-security-config" (include "seaweedfs.name" .))) }}
   {{- $securityConfig := fromToml (dig "data" "security.toml" "" $existing) }}
   security.toml: |-
     # this file is read by master, volume server, and filer
@@ -48,7 +42,7 @@ data:
     {{- if .Values.global.securityConfig.jwtSigning.filerRead }}
     # If this JWT key is configured, Filer only accepts reads over HTTP if they are signed with this JWT:
     # - f.e. the S3 API Shim generates the JWT
-    # - the Filer server validates the JWT on reading
+    # - the Filer server validates the JWT on writing
     # the jwt defaults to expire after 10 seconds.
     [jwt.filer_signing.read]
     key = "{{ dig "jwt" "filer_signing" "read" "key" (randAlphaNum 10 | b64enc) $securityConfig }}"

k8s/charts/seaweedfs/templates/shared/service-account.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ include "seaweedfs.serviceAccountName" . }}
+  name: {{ .Values.global.serviceAccountName }}
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}

k8s/charts/seaweedfs/templates/volume/volume-ingress.yaml

@@ -8,7 +8,7 @@ apiVersion: extensions/v1beta1
 {{- end }}
 kind: Ingress
 metadata:
-  name: ingress-{{ include "seaweedfs.fullname" . }}-volume
+  name: ingress-{{ template "seaweedfs.name" . }}-volume
   namespace: {{ .Release.Namespace }}
   annotations:
   {{- if and (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) .Values.volume.ingress.className }}
@@ -42,11 +42,11 @@ spec:
         backend:
 {{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion }}
           service:
-            name: {{ include "seaweedfs.componentName" (list . "volume") }}
+            name: {{ template "seaweedfs.name" . }}-volume
             port:
               number: {{ .Values.volume.port }}
 {{- else }}
-          serviceName: {{ include "seaweedfs.componentName" (list . "volume") }}
+          serviceName: {{ template "seaweedfs.name" . }}-volume
           servicePort: {{ .Values.volume.port }}
 {{- end }}
 {{- end }}

k8s/charts/seaweedfs/templates/volume/volume-resize-hook.yaml

@@ -1,4 +1,4 @@
-{{- $seaweedfsName := include "seaweedfs.fullname" $ }}
+{{- $seaweedfsName := include "seaweedfs.name" $ }}
 {{- $volumes := deepCopy .Values.volumes | mergeOverwrite (dict "" .Values.volume)  }}
 
 

k8s/charts/seaweedfs/templates/volume/volume-service.yaml

@@ -8,7 +8,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ printf "%s-%s" (include "seaweedfs.fullname" $) $volumeName | trunc 63 | trimSuffix "-" }}
+  name: {{ template "seaweedfs.name" $ }}-{{ $volumeName }}
   namespace: {{ $.Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" $ }}
@@ -39,7 +39,6 @@ spec:
 {{- end }}
   selector:
     app.kubernetes.io/name: {{ template "seaweedfs.name" $ }}
-    app.kubernetes.io/instance: {{ $.Release.Name }}
     app.kubernetes.io/component: {{ $volumeName }}
 {{- end }}
 {{- end }}

k8s/charts/seaweedfs/templates/volume/volume-servicemonitor.yaml

@@ -10,7 +10,7 @@
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
-  name: {{ include "seaweedfs.fullname" $ }}-{{ $volumeName }}
+  name: {{ template "seaweedfs.name" $ }}-{{ $volumeName }}
   namespace: {{ $.Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" $ }}
@@ -33,7 +33,6 @@ spec:
   selector:
     matchLabels:
       app.kubernetes.io/name: {{ template "seaweedfs.name" $ }}
-      app.kubernetes.io/instance: {{ $.Release.Name }}
       app.kubernetes.io/component: {{ $volumeName }}
 {{- end }}
 {{- end }}

k8s/charts/seaweedfs/templates/volume/volume-statefulset.yaml

@@ -8,7 +8,7 @@
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
-  name: {{ include "seaweedfs.componentName" (list $ $volumeName) }}
+  name: {{ template "seaweedfs.name" $ }}-{{ $volumeName }}
   namespace: {{ $.Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" $ }}
@@ -21,7 +21,7 @@ metadata:
     {{- toYaml $volume.annotations | nindent 4 }}
 {{- end }}
 spec:
-  serviceName: {{ include "seaweedfs.componentName" (list $ $volumeName) }}
+  serviceName: {{ template "seaweedfs.name" $ }}-{{ $volumeName }}
   replicas: {{ $volume.replicas }}
   podManagementPolicy: {{ $volume.podManagementPolicy }}
   selector:
@@ -70,7 +70,7 @@ spec:
       {{- end }}
       enableServiceLinks: false
       {{- if $.Values.global.createClusterRole }}
-      serviceAccountName: {{ $volume.serviceAccountName | default (include "seaweedfs.serviceAccountName" $) | quote }} # for deleting statefulset pods after migration
+      serviceAccountName: {{ $volume.serviceAccountName | default $.Values.global.serviceAccountName | quote }} # for deleting statefulset pods after migration
       {{- end }}
       {{- $initContainers_exists := include "volume.initContainers_exists" $ -}}
       {{- if $initContainers_exists }}
@@ -117,7 +117,7 @@ spec:
                 fieldRef:
                   fieldPath: status.hostIP
             - name: SEAWEEDFS_FULLNAME
-              value: "{{ include "seaweedfs.fullname" $ }}"
+              value: "{{ template "seaweedfs.name" $ }}"
             {{- if $volume.extraEnvironmentVars }}
             {{- range $key, $value := $volume.extraEnvironmentVars }}
             - name: {{ $key }}
@@ -197,7 +197,7 @@ spec:
                 -fileSizeLimitMB={{ $volume.fileSizeLimitMB }} \
                 {{- end }}
                 -minFreeSpacePercent={{ $volume.minFreeSpacePercent }} \
-                -ip=${POD_NAME}.{{ include "seaweedfs.componentName" (list $ $volumeName) }}.{{ $.Release.Namespace }} \
+                -ip=${POD_NAME}.${SEAWEEDFS_FULLNAME}-{{ $volumeName }}.{{ $.Release.Namespace }} \
                 -compactionMBps={{ $volume.compactionMBps }} \
                 -master={{ include "seaweedfs.masterServerArg" $ }} \
                 {{- range $volume.extraArgs }}
@@ -343,22 +343,22 @@ spec:
      {{- if $.Values.global.enableSecurity }}
         - name: security-config
           configMap:
-            name: {{ include "seaweedfs.fullname" $ }}-security-config
+            name: {{ template "seaweedfs.name" $ }}-security-config
         - name: ca-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" $ }}-ca-cert
+            secretName: {{ template "seaweedfs.name" $ }}-ca-cert
         - name: master-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" $ }}-master-cert
+            secretName: {{ template "seaweedfs.name" $ }}-master-cert
         - name: volume-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" $ }}-volume-cert
+            secretName: {{ template "seaweedfs.name" $ }}-volume-cert
         - name: filer-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" $ }}-filer-cert
+            secretName: {{ template "seaweedfs.name" $ }}-filer-cert
         - name: client-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" $ }}-client-cert
+            secretName: {{ template "seaweedfs.name" $ }}-client-cert
       {{- end }}
       {{- if $volume.extraVolumes }}
         {{ tpl $volume.extraVolumes $ | indent 8 | trim }}

k8s/charts/seaweedfs/templates/worker/worker-deployment.yaml

@@ -5,7 +5,7 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-worker
+  name: {{ template "seaweedfs.name" . }}-worker
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -92,7 +92,7 @@ spec:
                 fieldRef:
                   fieldPath: metadata.namespace
             - name: SEAWEEDFS_FULLNAME
-              value: "{{ include "seaweedfs.fullname" . }}"
+              value: "{{ template "seaweedfs.name" . }}"
             {{- if .Values.worker.extraEnvironmentVars }}
             {{- range $key, $value := .Values.worker.extraEnvironmentVars }}
             - name: {{ $key }}
@@ -260,25 +260,25 @@ spec:
         {{- if .Values.global.enableSecurity }}
         - name: security-config
           configMap:
-            name: {{ include "seaweedfs.fullname" . }}-security-config
+            name: {{ template "seaweedfs.name" . }}-security-config
         - name: ca-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
+            secretName: {{ template "seaweedfs.name" . }}-ca-cert
         - name: master-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-master-cert
+            secretName: {{ template "seaweedfs.name" . }}-master-cert
         - name: volume-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-volume-cert
+            secretName: {{ template "seaweedfs.name" . }}-volume-cert
         - name: filer-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-filer-cert
+            secretName: {{ template "seaweedfs.name" . }}-filer-cert
         - name: client-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-client-cert
+            secretName: {{ template "seaweedfs.name" . }}-client-cert
         - name: worker-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-worker-cert
+            secretName: {{ template "seaweedfs.name" . }}-worker-cert
         {{- end }}
         {{ tpl .Values.worker.extraVolumes . | indent 8 | trim }}
       {{- if .Values.worker.nodeSelector }}

k8s/charts/seaweedfs/templates/worker/worker-service.yaml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ printf "%s-worker" (include "seaweedfs.fullname" .) | trunc 63 | trimSuffix "-" }}
+  name: {{ template "seaweedfs.name" . }}-worker
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}

k8s/charts/seaweedfs/templates/worker/worker-servicemonitor.yaml

@@ -4,7 +4,7 @@
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-worker
+  name: {{ template "seaweedfs.name" . }}-worker
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -27,7 +27,6 @@ spec:
   selector:
     matchLabels:
       app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-      app.kubernetes.io/instance: {{ .Release.Name }}
       app.kubernetes.io/component: worker
 {{- end }}
 {{- end }}

k8s/charts/seaweedfs/values.yaml

@@ -891,7 +891,7 @@ filer:
     # should have a secret key called seaweedfs_s3_config with an inline json configure
     existingConfigSecret: null
     auditLogConfig: {}
-    # You may specify buckets to be created during the install or upgrade process.
+    # You may specify buckets to be created during the install process.
     # Buckets may be exposed publicly by setting `anonymousRead` to `true`
     # createBuckets:
     #   - name: bucket-a
@@ -916,13 +916,6 @@ s3:
   # should have a secret key called seaweedfs_s3_config with an inline json config
   existingConfigSecret: null
   auditLogConfig: {}
-  # You may specify buckets to be created during the install or upgrade process.
-  # Buckets may be exposed publicly by setting `anonymousRead` to `true`
-  # createBuckets:
-  #   - name: bucket-a
-  #     anonymousRead: true
-  #   - name: bucket-b
-  #     anonymousRead: false
 
   # Suffix of the host name, {bucket}.{domainName}
   domainName: ""

other/java/s3copier/pom.xml

@@ -68,7 +68,7 @@
     <dependency>
       <groupId>org.assertj</groupId>
       <artifactId>assertj-core</artifactId>
-      <version>3.27.7</version>
+      <version>3.24.2</version>
       <scope>test</scope>
     </dependency>
   </dependencies>

test/s3/iam/Makefile

@@ -70,7 +70,6 @@ start-services: ## Start SeaweedFS services for testing
 		-s3.port=$(S3_PORT) \
 		-s3.config=test_config.json \
 		-s3.iam.config=$(CURDIR)/iam_config.json \
-		-s3.iam.readOnly=false \
 		> weed-mini.log 2>&1 & \
 		echo $$! > $(MINI_PID_FILE)
 	

test/s3/iam/iam_config.json

@@ -230,12 +230,10 @@
           {
             "Effect": "Allow",
             "Action": [
-              "s3:*",
-              "iam:*"
+              "s3:*"
             ],
             "Resource": [
-              "*",
-              "arn:aws:iam:::*"
+              "*"
             ]
           },
           {
@@ -344,4 +342,4 @@
       }
     }
   ]
-}
+}

test/s3/iam/iam_config.local.json

@@ -230,12 +230,10 @@
           {
             "Effect": "Allow",
             "Action": [
-              "s3:*",
-              "iam:*"
+              "s3:*"
             ],
             "Resource": [
-              "*",
-              "arn:aws:iam:::*"
+              "*"
             ]
           },
           {
@@ -344,4 +342,4 @@
       }
     }
   ]
-}
+}

test/s3/iam/run_tests.sh

@@ -43,7 +43,6 @@ weed server \
     -volume.max=0 \
     -master.volumeSizeLimitMB=100 \
     -s3.allowDeleteBucketNotEmpty=true \
-    -s3.iam.readOnly=false \
     > /tmp/weed_test_server.log 2>&1 &
 
 SERVER_PID=$!

test/s3/iam/s3_iam_admin_test.go

@@ -1,241 +0,0 @@
-package iam
-
-import (
-	"testing"
-
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/iam"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// TestIAMUserManagement tests user management operations
-func TestIAMUserManagement(t *testing.T) {
-	framework := NewS3IAMTestFramework(t)
-	defer framework.Cleanup()
-
-	// Create IAM client with admin privileges
-	iamClient, err := framework.CreateIAMClientWithJWT("admin-user", "TestAdminRole")
-	require.NoError(t, err)
-
-	t.Run("create_and_get_user", func(t *testing.T) {
-		userName := "test-user-mgm"
-
-		// Create user
-		createResp, err := iamClient.CreateUser(&iam.CreateUserInput{
-			UserName: aws.String(userName),
-		})
-		require.NoError(t, err)
-		assert.Equal(t, userName, *createResp.User.UserName)
-
-		// Get user
-		getResp, err := iamClient.GetUser(&iam.GetUserInput{
-			UserName: aws.String(userName),
-		})
-		require.NoError(t, err)
-		assert.Equal(t, userName, *getResp.User.UserName)
-
-		// List users to verify existence
-		listResp, err := iamClient.ListUsers(&iam.ListUsersInput{})
-		require.NoError(t, err)
-		found := false
-		for _, user := range listResp.Users {
-			if *user.UserName == userName {
-				found = true
-				break
-			}
-		}
-		assert.True(t, found, "Created user should be listed")
-
-		// Clean up
-		_, err = iamClient.DeleteUser(&iam.DeleteUserInput{
-			UserName: aws.String(userName),
-		})
-		require.NoError(t, err)
-	})
-
-	t.Run("update_user", func(t *testing.T) {
-		userName := "user-to-update"
-		newUserName := "user-updated"
-
-		// Create user
-		_, err := iamClient.CreateUser(&iam.CreateUserInput{
-			UserName: aws.String(userName),
-		})
-		require.NoError(t, err)
-		defer func() {
-			// Try to delete both just in case
-			iamClient.DeleteUser(&iam.DeleteUserInput{UserName: aws.String(userName)})
-			iamClient.DeleteUser(&iam.DeleteUserInput{UserName: aws.String(newUserName)})
-		}()
-
-		// Update user name
-		_, err = iamClient.UpdateUser(&iam.UpdateUserInput{
-			UserName:    aws.String(userName),
-			NewUserName: aws.String(newUserName),
-		})
-		require.NoError(t, err)
-
-		// Verify update (GetUser with NEW name should work)
-		getResp, err := iamClient.GetUser(&iam.GetUserInput{
-			UserName: aws.String(newUserName),
-		})
-		require.NoError(t, err)
-		assert.Equal(t, newUserName, *getResp.User.UserName)
-
-		// GetUser with OLD name should fail
-		_, err = iamClient.GetUser(&iam.GetUserInput{
-			UserName: aws.String(userName),
-		})
-		require.Error(t, err)
-	})
-}
-
-// TestIAMAccessKeyManagement tests access key operations
-func TestIAMAccessKeyManagement(t *testing.T) {
-	framework := NewS3IAMTestFramework(t)
-	defer framework.Cleanup()
-
-	iamClient, err := framework.CreateIAMClientWithJWT("admin-user", "TestAdminRole")
-	require.NoError(t, err)
-
-	userName := "test-user-keys"
-	_, err = iamClient.CreateUser(&iam.CreateUserInput{
-		UserName: aws.String(userName),
-	})
-	require.NoError(t, err)
-	defer iamClient.DeleteUser(&iam.DeleteUserInput{UserName: aws.String(userName)})
-
-	t.Run("create_list_delete_access_key", func(t *testing.T) {
-		// Create access key
-		createResp, err := iamClient.CreateAccessKey(&iam.CreateAccessKeyInput{
-			UserName: aws.String(userName),
-		})
-		require.NoError(t, err)
-		assert.NotEmpty(t, *createResp.AccessKey.AccessKeyId)
-		assert.NotEmpty(t, *createResp.AccessKey.SecretAccessKey)
-		assert.Equal(t, "Active", *createResp.AccessKey.Status)
-
-		// List access keys
-		listResp, err := iamClient.ListAccessKeys(&iam.ListAccessKeysInput{
-			UserName: aws.String(userName),
-		})
-		require.NoError(t, err)
-		assert.Equal(t, 1, len(listResp.AccessKeyMetadata))
-		assert.Equal(t, *createResp.AccessKey.AccessKeyId, *listResp.AccessKeyMetadata[0].AccessKeyId)
-
-		// Delete access key
-		_, err = iamClient.DeleteAccessKey(&iam.DeleteAccessKeyInput{
-			UserName:    aws.String(userName),
-			AccessKeyId: createResp.AccessKey.AccessKeyId,
-		})
-		require.NoError(t, err)
-
-		// Verify deletion
-		listResp, err = iamClient.ListAccessKeys(&iam.ListAccessKeysInput{
-			UserName: aws.String(userName),
-		})
-		require.NoError(t, err)
-		assert.Equal(t, 0, len(listResp.AccessKeyMetadata))
-	})
-
-	t.Run("update_access_key_status", func(t *testing.T) {
-		// Create access key
-		createResp, err := iamClient.CreateAccessKey(&iam.CreateAccessKeyInput{
-			UserName: aws.String(userName),
-		})
-		require.NoError(t, err)
-		defer iamClient.DeleteAccessKey(&iam.DeleteAccessKeyInput{
-			UserName:    aws.String(userName),
-			AccessKeyId: createResp.AccessKey.AccessKeyId,
-		})
-
-		// Update to Inactive
-		_, err = iamClient.UpdateAccessKey(&iam.UpdateAccessKeyInput{
-			UserName:    aws.String(userName),
-			AccessKeyId: createResp.AccessKey.AccessKeyId,
-			Status:      aws.String("Inactive"),
-		})
-		require.NoError(t, err)
-
-		// Verify update in ListAccessKeys
-		listResp, err := iamClient.ListAccessKeys(&iam.ListAccessKeysInput{
-			UserName: aws.String(userName),
-		})
-		require.NoError(t, err)
-		found := false
-		for _, key := range listResp.AccessKeyMetadata {
-			if *key.AccessKeyId == *createResp.AccessKey.AccessKeyId {
-				assert.Equal(t, "Inactive", *key.Status)
-				found = true
-				break
-			}
-		}
-		assert.True(t, found)
-	})
-}
-
-// TestIAMPolicyManagement tests policy operations
-func TestIAMPolicyManagement(t *testing.T) {
-	framework := NewS3IAMTestFramework(t)
-	defer framework.Cleanup()
-
-	iamClient, err := framework.CreateIAMClientWithJWT("admin-user", "TestAdminRole")
-	require.NoError(t, err)
-
-	t.Run("create_managed_policy", func(t *testing.T) {
-		policyName := "test-managed-policy"
-		policyDoc := `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:ListBucket","Resource":"*"}]}`
-
-		createResp, err := iamClient.CreatePolicy(&iam.CreatePolicyInput{
-			PolicyName:     aws.String(policyName),
-			PolicyDocument: aws.String(policyDoc),
-		})
-		require.NoError(t, err)
-		assert.Equal(t, policyName, *createResp.Policy.PolicyName)
-		assert.NotEmpty(t, *createResp.Policy.Arn)
-
-		t.Cleanup(func() {
-			_, _ = iamClient.DeletePolicy(&iam.DeletePolicyInput{
-				PolicyArn: createResp.Policy.Arn,
-			})
-		})
-	})
-
-	t.Run("user_inline_policy", func(t *testing.T) {
-		userName := "test-user-policy"
-		_, err := iamClient.CreateUser(&iam.CreateUserInput{
-			UserName: aws.String(userName),
-		})
-		require.NoError(t, err)
-		defer iamClient.DeleteUser(&iam.DeleteUserInput{UserName: aws.String(userName)})
-
-		policyName := "test-inline-policy"
-		policyDoc := `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::*"}]}`
-
-		// Put user policy
-		_, err = iamClient.PutUserPolicy(&iam.PutUserPolicyInput{
-			UserName:       aws.String(userName),
-			PolicyName:     aws.String(policyName),
-			PolicyDocument: aws.String(policyDoc),
-		})
-		require.NoError(t, err)
-
-		// Get user policy
-		getResp, err := iamClient.GetUserPolicy(&iam.GetUserPolicyInput{
-			UserName:   aws.String(userName),
-			PolicyName: aws.String(policyName),
-		})
-		require.NoError(t, err)
-		assert.Equal(t, userName, *getResp.UserName)
-		assert.Equal(t, policyName, *getResp.PolicyName)
-		assert.Contains(t, *getResp.PolicyDocument, "s3:Get")
-
-		// Delete user policy
-		_, err = iamClient.DeleteUserPolicy(&iam.DeleteUserPolicyInput{
-			UserName:   aws.String(userName),
-			PolicyName: aws.String(policyName),
-		})
-		require.NoError(t, err)
-	})
-}

test/s3/iam/s3_iam_distributed_test.go

@@ -129,7 +129,6 @@ func TestS3IAMDistributedTests(t *testing.T) {
 			errorMsg := err.Error()
 			return strings.Contains(errorMsg, "timeout") ||
 				strings.Contains(errorMsg, "connection reset") ||
-				strings.Contains(errorMsg, "connection refused") ||
 				strings.Contains(errorMsg, "temporary failure") ||
 				strings.Contains(errorMsg, "TooManyRequests") ||
 				strings.Contains(errorMsg, "ServiceUnavailable") ||

test/s3/iam/s3_iam_framework.go

@@ -21,7 +21,6 @@ import (
 	"github.com/aws/aws-sdk-go/aws/awserr"
 	"github.com/aws/aws-sdk-go/aws/credentials"
 	"github.com/aws/aws-sdk-go/aws/session"
-	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/aws/aws-sdk-go/service/s3"
 	"github.com/golang-jwt/jwt/v5"
 	"github.com/stretchr/testify/require"
@@ -684,13 +683,13 @@ func (f *S3IAMTestFramework) GenerateUniqueBucketName(prefix string) string {
 	randomSuffix := mathrand.Intn(10000)
 
 	bucketName := fmt.Sprintf("%s-%s-%d", prefix, testName, randomSuffix)
-
+	
 	// Ensure final name is valid
 	if len(bucketName) > 63 {
 		// Truncate further if necessary
 		bucketName = bucketName[:63]
 	}
-
+	
 	return bucketName
 }
 
@@ -810,7 +809,7 @@ func (f *S3IAMTestFramework) Cleanup() {
 	}
 }
 
-// WaitForS3Service waits for the S3 service to be available and checks for IAM write permissions
+// WaitForS3Service waits for the S3 service to be available
 func (f *S3IAMTestFramework) WaitForS3Service() error {
 	// Create a basic S3 client
 	sess, err := session.NewSession(&aws.Config{
@@ -830,46 +829,17 @@ func (f *S3IAMTestFramework) WaitForS3Service() error {
 
 	s3Client := s3.New(sess)
 
-	// Create IAM client for write permission check
-	iamClient := iam.New(sess)
-
-	// Try to list buckets to check if S3 service is available
+	// Try to list buckets to check if service is available
 	maxRetries := 30
 	for i := 0; i < maxRetries; i++ {
 		_, err := s3Client.ListBuckets(&s3.ListBucketsInput{})
 		if err == nil {
-			// S3 is up, now check if IAM is writable
-			// We try to create a dummy user. If it fails with "AccessDenied: IAM write operations are disabled",
-			// we know we are still in read-only mode (or the flag didn't take effect).
-			// If it fails with other errors (e.g. invalid auth), that's fine for this connectivity check.
-			// Only the explicit read-only error is a blocker for our specific test scenario.
-
-			// Note: We use a random name to avoid conflicts if it actually succeeds
-			dummyUser := fmt.Sprintf("check-writable-%d", time.Now().UnixNano())
-			_, iamErr := iamClient.CreateUser(&iam.CreateUserInput{
-				UserName: aws.String(dummyUser),
-			})
-
-			if iamErr != nil {
-				if reqErr, ok := iamErr.(awserr.RequestFailure); ok {
-					if reqErr.Code() == "AccessDenied" && strings.Contains(reqErr.Message(), "IAM write operations are disabled") {
-						f.t.Logf("Waiting for IAM to become writable... (attempt %d/%d)", i+1, maxRetries)
-						time.Sleep(1 * time.Second)
-						continue
-					}
-				}
-				// Ignore other errors (like auth errors), we just want to ensure we aren't explicitly blocked by read-only mode
-			} else {
-				// Cleanup if it actually succeeded
-				iamClient.DeleteUser(&iam.DeleteUserInput{UserName: aws.String(dummyUser)})
-			}
-
 			return nil
 		}
 		time.Sleep(1 * time.Second)
 	}
 
-	return fmt.Errorf("S3 service not available or not writable after %d retries", maxRetries)
+	return fmt.Errorf("S3 service not available after %d retries", maxRetries)
 }
 
 // PutTestObject puts a test object in the specified bucket
@@ -934,49 +904,3 @@ func (f *S3IAMTestFramework) WaitForS3ServiceSimple() error {
 	// The full implementation would be in the Makefile's wait-for-services target
 	return nil
 }
-
-// CreateIAMClientWithJWT creates an IAM client authenticated with a JWT token for the specified role
-func (f *S3IAMTestFramework) CreateIAMClientWithJWT(username, roleName string) (*iam.IAM, error) {
-	return f.CreateIAMClientWithCustomClaims(username, roleName, "", nil)
-}
-
-// CreateIAMClientWithCustomClaims creates an IAM client with specific account ID and custom claims
-func (f *S3IAMTestFramework) CreateIAMClientWithCustomClaims(username, roleName, account string, claims map[string]interface{}) (*iam.IAM, error) {
-	var token string
-	var err error
-
-	if f.useKeycloak && claims == nil && account == "" {
-		// Use real Keycloak authentication if no custom requirements
-		token, err = f.getKeycloakToken(username)
-		if err != nil {
-			return nil, fmt.Errorf("failed to get Keycloak token: %v", err)
-		}
-	} else {
-		// Generate STS session token (mock mode or custom requirements)
-		token, err = f.generateSTSSessionToken(username, roleName, time.Hour, account, claims)
-		if err != nil {
-			return nil, fmt.Errorf("failed to generate STS session token: %v", err)
-		}
-	}
-
-	// Create custom HTTP client with Bearer token transport
-	httpClient := &http.Client{
-		Transport: &BearerTokenTransport{
-			Token: token,
-		},
-	}
-
-	sess, err := session.NewSession(&aws.Config{
-		Region:     aws.String(TestRegion),
-		Endpoint:   aws.String(TestS3Endpoint),
-		HTTPClient: httpClient,
-		// Use anonymous credentials to avoid AWS signature generation
-		Credentials: credentials.AnonymousCredentials,
-		DisableSSL:  aws.Bool(true),
-	})
-	if err != nil {
-		return nil, fmt.Errorf("failed to create AWS session: %v", err)
-	}
-
-	return iam.New(sess), nil
-}

test/s3/iam/test_config.json

@@ -8,35 +8,270 @@
           "secretKey": "test-secret-key"
         }
       ],
-      "actions": [
-        "Admin"
-      ]
+      "actions": ["Admin"]
     },
     {
-      "name": "readonlyuser",
+      "name": "readonlyuser", 
       "credentials": [
         {
           "accessKey": "readonly-access-key",
           "secretKey": "readonly-secret-key"
         }
       ],
-      "actions": [
-        "Read"
-      ]
+      "actions": ["Read"]
     },
     {
       "name": "writeonlyuser",
       "credentials": [
         {
-          "accessKey": "writeonly-access-key",
+          "accessKey": "writeonly-access-key", 
           "secretKey": "writeonly-secret-key"
         }
       ],
-      "actions": [
-        "Write"
-      ]
+      "actions": ["Write"]
     }
   ],
+  "iam": {
+    "enabled": true,
+    "sts": {
+      "tokenDuration": "15m",
+      "issuer": "seaweedfs-sts",
+      "signingKey": "dGVzdC1zaWduaW5nLWtleS0zMi1jaGFyYWN0ZXJzLWxvbmc="
+    },
+    "policy": {
+      "defaultEffect": "Deny"
+    },
+    "providers": {
+      "oidc": {
+        "test-oidc": {
+          "issuer": "http://localhost:8080/.well-known/openid_configuration",
+          "clientId": "test-client-id",
+          "jwksUri": "http://localhost:8080/jwks",
+          "userInfoUri": "http://localhost:8080/userinfo",
+          "roleMapping": {
+            "rules": [
+              {
+                "claim": "groups",
+                "claimValue": "admins", 
+                "roleName": "S3AdminRole"
+              },
+              {
+                "claim": "groups",
+                "claimValue": "users",
+                "roleName": "S3ReadOnlyRole"
+              },
+              {
+                "claim": "groups",
+                "claimValue": "writers",
+                "roleName": "S3WriteOnlyRole"
+              }
+            ]
+          },
+          "claimsMapping": {
+            "email": "email",
+            "displayName": "name",
+            "groups": "groups"
+          }
+        }
+      },
+      "ldap": {
+        "test-ldap": {
+          "server": "ldap://localhost:389",
+          "baseDN": "dc=example,dc=com",
+          "bindDN": "cn=admin,dc=example,dc=com", 
+          "bindPassword": "admin-password",
+          "userFilter": "(uid=%s)",
+          "groupFilter": "(memberUid=%s)",
+          "attributes": {
+            "email": "mail",
+            "displayName": "cn", 
+            "groups": "memberOf"
+          },
+          "roleMapping": {
+            "rules": [
+              {
+                "claim": "groups",
+                "claimValue": "cn=admins,ou=groups,dc=example,dc=com",
+                "roleName": "S3AdminRole"
+              },
+              {
+                "claim": "groups", 
+                "claimValue": "cn=users,ou=groups,dc=example,dc=com",
+                "roleName": "S3ReadOnlyRole"
+              }
+            ]
+          }
+        }
+      }
+    },
+    "policyStore": {}
+  },
+  "roles": {
+    "S3AdminRole": {
+      "trustPolicy": {
+        "Version": "2012-10-17",
+        "Statement": [
+          {
+            "Effect": "Allow",
+            "Principal": {
+              "Federated": ["test-oidc", "test-ldap"]
+            },
+            "Action": "sts:AssumeRoleWithWebIdentity"
+          }
+        ]
+      },
+      "attachedPolicies": ["S3AdminPolicy"],
+      "description": "Full administrative access to S3 resources"
+    },
+    "S3ReadOnlyRole": {
+      "trustPolicy": {
+        "Version": "2012-10-17",
+        "Statement": [
+          {
+            "Effect": "Allow", 
+            "Principal": {
+              "Federated": ["test-oidc", "test-ldap"]
+            },
+            "Action": "sts:AssumeRoleWithWebIdentity"
+          }
+        ]
+      },
+      "attachedPolicies": ["S3ReadOnlyPolicy"],
+      "description": "Read-only access to S3 resources"
+    },
+    "S3WriteOnlyRole": {
+      "trustPolicy": {
+        "Version": "2012-10-17",
+        "Statement": [
+          {
+            "Effect": "Allow",
+            "Principal": {
+              "Federated": ["test-oidc", "test-ldap"] 
+            },
+            "Action": "sts:AssumeRoleWithWebIdentity"
+          }
+        ]
+      },
+      "attachedPolicies": ["S3WriteOnlyPolicy"],
+      "description": "Write-only access to S3 resources"
+    }
+  },
+  "policies": {
+    "S3AdminPolicy": {
+      "Version": "2012-10-17",
+      "Statement": [
+        {
+          "Effect": "Allow",
+          "Action": ["s3:*"],
+          "Resource": [
+            "arn:aws:s3:::*",
+            "arn:aws:s3:::*/*"
+          ]
+        }
+      ]
+    },
+    "S3ReadOnlyPolicy": {
+      "Version": "2012-10-17", 
+      "Statement": [
+        {
+          "Effect": "Allow",
+          "Action": [
+            "s3:GetObject",
+            "s3:GetObjectVersion", 
+            "s3:ListBucket",
+            "s3:ListBucketVersions",
+            "s3:GetBucketLocation",
+            "s3:GetBucketVersioning"
+          ],
+          "Resource": [
+            "arn:aws:s3:::*",
+            "arn:aws:s3:::*/*"
+          ]
+        }
+      ]
+    },
+    "S3WriteOnlyPolicy": {
+      "Version": "2012-10-17",
+      "Statement": [
+        {
+          "Effect": "Allow",
+          "Action": [
+            "s3:PutObject",
+            "s3:PutObjectAcl",
+            "s3:DeleteObject",
+            "s3:DeleteObjectVersion",
+            "s3:InitiateMultipartUpload",
+            "s3:UploadPart", 
+            "s3:CompleteMultipartUpload",
+            "s3:AbortMultipartUpload",
+            "s3:ListMultipartUploadParts"
+          ],
+          "Resource": [
+            "arn:aws:s3:::*/*"
+          ]
+        }
+      ]
+    },
+    "S3BucketManagementPolicy": {
+      "Version": "2012-10-17",
+      "Statement": [
+        {
+          "Effect": "Allow",
+          "Action": [
+            "s3:CreateBucket",
+            "s3:DeleteBucket", 
+            "s3:GetBucketPolicy",
+            "s3:PutBucketPolicy",
+            "s3:DeleteBucketPolicy",
+            "s3:GetBucketVersioning",
+            "s3:PutBucketVersioning"
+          ],
+          "Resource": [
+            "arn:aws:s3:::*"
+          ]
+        }
+      ]
+    },
+    "S3IPRestrictedPolicy": {
+      "Version": "2012-10-17",
+      "Statement": [
+        {
+          "Effect": "Allow",
+          "Action": ["s3:*"],
+          "Resource": [
+            "arn:aws:s3:::*",
+            "arn:aws:s3:::*/*"
+          ],
+          "Condition": {
+            "IpAddress": {
+              "aws:SourceIp": ["192.168.1.0/24", "10.0.0.0/8"]
+            }
+          }
+        }
+      ]
+    },
+    "S3TimeBasedPolicy": {
+      "Version": "2012-10-17",
+      "Statement": [
+        {
+          "Effect": "Allow", 
+          "Action": ["s3:GetObject", "s3:ListBucket"],
+          "Resource": [
+            "arn:aws:s3:::*",
+            "arn:aws:s3:::*/*"
+          ],
+          "Condition": {
+            "DateGreaterThan": {
+              "aws:CurrentTime": "2023-01-01T00:00:00Z"
+            },
+            "DateLessThan": {
+              "aws:CurrentTime": "2025-12-31T23:59:59Z" 
+            }
+          }
+        }
+      ]
+    }
+  },
   "bucketPolicyExamples": {
     "PublicReadPolicy": {
       "Version": "2012-10-17",
@@ -45,7 +280,7 @@
           "Sid": "PublicReadGetObject",
           "Effect": "Allow",
           "Principal": "*",
-          "Action": "s3:GetObject",
+          "Action": "s3:GetObject", 
           "Resource": "arn:aws:s3:::example-bucket/*"
         }
       ]
@@ -57,10 +292,7 @@
           "Sid": "DenyDeleteOperations",
           "Effect": "Deny",
           "Principal": "*",
-          "Action": [
-            "s3:DeleteObject",
-            "s3:DeleteBucket"
-          ],
+          "Action": ["s3:DeleteObject", "s3:DeleteBucket"],
           "Resource": [
             "arn:aws:s3:::example-bucket",
             "arn:aws:s3:::example-bucket/*"
@@ -73,22 +305,17 @@
       "Statement": [
         {
           "Sid": "IPRestrictedAccess",
-          "Effect": "Allow",
+          "Effect": "Allow", 
           "Principal": "*",
-          "Action": [
-            "s3:GetObject",
-            "s3:PutObject"
-          ],
+          "Action": ["s3:GetObject", "s3:PutObject"],
           "Resource": "arn:aws:s3:::example-bucket/*",
           "Condition": {
             "IpAddress": {
-              "aws:SourceIp": [
-                "203.0.113.0/24"
-              ]
+              "aws:SourceIp": ["203.0.113.0/24"]
             }
           }
         }
       ]
     }
   }
-}
+}

test/s3/normal/iam_test.go

@@ -1,158 +0,0 @@
-package example
-
-import (
-	"os"
-	"testing"
-	"time"
-
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/credentials"
-	"github.com/aws/aws-sdk-go/aws/session"
-	"github.com/aws/aws-sdk-go/service/iam"
-	"github.com/stretchr/testify/require"
-)
-
-// TestIAMOperations tests authenticated IAM operations with AWS Signature V4
-// All IAM operations require proper authentication.
-func TestIAMOperations(t *testing.T) {
-	if testing.Short() {
-		t.Skip("Skipping integration test in short mode")
-	}
-
-	// Set credentials before starting cluster
-	accessKey := "testkey123"
-	secretKey := "testsecret456"
-	os.Setenv("AWS_ACCESS_KEY_ID", accessKey)
-	os.Setenv("AWS_SECRET_ACCESS_KEY", secretKey)
-	defer os.Unsetenv("AWS_ACCESS_KEY_ID")
-	defer os.Unsetenv("AWS_SECRET_ACCESS_KEY")
-
-	// Create and start test cluster
-	cluster, err := startMiniCluster(t)
-	require.NoError(t, err)
-	defer cluster.Stop()
-
-	// Wait for services to be fully ready
-	time.Sleep(500 * time.Millisecond)
-
-	// Create IAM client with credentials
-	sess, err := session.NewSession(&aws.Config{
-		Region:           aws.String("us-west-2"),
-		Endpoint:         aws.String(cluster.s3Endpoint),
-		DisableSSL:       aws.Bool(true),
-		Credentials:      credentials.NewStaticCredentials(accessKey, secretKey, ""),
-		S3ForcePathStyle: aws.Bool(true),
-	})
-	require.NoError(t, err)
-
-	iamClient := iam.New(sess)
-
-	// Run all IAM tests with authentication
-	t.Run("CreateUser", func(t *testing.T) {
-		testCreateUserAuthenticated(t, iamClient)
-	})
-
-	t.Run("ListUsers", func(t *testing.T) {
-		testListUsersAuthenticated(t, iamClient)
-	})
-
-	t.Run("GetUser", func(t *testing.T) {
-		testGetUserAuthenticated(t, iamClient)
-	})
-
-	t.Run("DeleteUser", func(t *testing.T) {
-		testDeleteUserAuthenticated(t, iamClient)
-	})
-}
-
-// testCreateUserAuthenticated tests CreateUser with AWS Signature V4 authentication
-func testCreateUserAuthenticated(t *testing.T, iamClient *iam.IAM) {
-	userName := "alice-" + randomString(8)
-
-	input := &iam.CreateUserInput{
-		UserName: aws.String(userName),
-	}
-
-	result, err := iamClient.CreateUser(input)
-	require.NoError(t, err, "Authenticated CreateUser should succeed")
-	require.NotNil(t, result.User)
-	require.Equal(t, userName, *result.User.UserName)
-
-	t.Logf("✓ Created user with authentication: %s", userName)
-}
-
-// testListUsersAuthenticated tests ListUsers with authentication
-func testListUsersAuthenticated(t *testing.T, iamClient *iam.IAM) {
-	// First create a user
-	userName := "listauth-" + randomString(8)
-	_, err := iamClient.CreateUser(&iam.CreateUserInput{
-		UserName: aws.String(userName),
-	})
-	require.NoError(t, err)
-
-	// Wait for user to be persisted
-	time.Sleep(100 * time.Millisecond)
-
-	// List users
-	result, err := iamClient.ListUsers(&iam.ListUsersInput{})
-	require.NoError(t, err, "Authenticated ListUsers should succeed")
-	require.NotNil(t, result.Users)
-
-	// Verify our user is in the list
-	found := false
-	for _, user := range result.Users {
-		if *user.UserName == userName {
-			found = true
-			break
-		}
-	}
-	require.True(t, found, "Created user should be in the list")
-
-	t.Logf("✓ Listed %d users with authentication", len(result.Users))
-}
-
-// testGetUserAuthenticated tests GetUser with authentication
-func testGetUserAuthenticated(t *testing.T, iamClient *iam.IAM) {
-	userName := "getauth-" + randomString(8)
-
-	// Create user
-	_, err := iamClient.CreateUser(&iam.CreateUserInput{
-		UserName: aws.String(userName),
-	})
-	require.NoError(t, err)
-
-	// Wait for user to be persisted
-	time.Sleep(100 * time.Millisecond)
-
-	// Get user
-	result, err := iamClient.GetUser(&iam.GetUserInput{
-		UserName: aws.String(userName),
-	})
-	require.NoError(t, err, "Authenticated GetUser should succeed")
-	require.NotNil(t, result.User)
-	require.Equal(t, userName, *result.User.UserName)
-
-	t.Logf("✓ Got user with authentication: %s", userName)
-}
-
-// testDeleteUserAuthenticated tests DeleteUser with authentication
-func testDeleteUserAuthenticated(t *testing.T, iamClient *iam.IAM) {
-	userName := "delauth-" + randomString(8)
-
-	// Create user
-	_, err := iamClient.CreateUser(&iam.CreateUserInput{
-		UserName: aws.String(userName),
-	})
-	require.NoError(t, err)
-
-	// Wait for user to be persisted
-	time.Sleep(100 * time.Millisecond)
-
-	// Delete user
-	_, err = iamClient.DeleteUser(&iam.DeleteUserInput{
-		UserName: aws.String(userName),
-	})
-	require.NoError(t, err, "Authenticated DeleteUser should succeed")
-
-	t.Logf("✓ Deleted user with authentication: %s", userName)
-}

test/s3/normal/s3_integration_test.go

@@ -1,488 +0,0 @@
-package example
-
-import (
-	"bytes"
-	"context"
-	"fmt"
-	"math/rand"
-	"net"
-	"net/http"
-	"os"
-	"path/filepath"
-	"strconv"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/credentials"
-	"github.com/aws/aws-sdk-go/aws/session"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/seaweedfs/seaweedfs/weed/command"
-	"github.com/seaweedfs/seaweedfs/weed/glog"
-	flag "github.com/seaweedfs/seaweedfs/weed/util/fla9"
-)
-
-const (
-	testRegion    = "us-west-2"
-	testAccessKey = "admin"
-	testSecretKey = "admin"
-)
-
-// TestCluster manages the weed mini instance for integration testing
-type TestCluster struct {
-	dataDir    string
-	ctx        context.Context
-	cancel     context.CancelFunc
-	s3Client   *s3.S3
-	isRunning  bool
-	startOnce  sync.Once
-	wg         sync.WaitGroup
-	masterPort int
-	volumePort int
-	filerPort  int
-	s3Port     int
-	s3Endpoint string
-}
-
-// TestS3Integration demonstrates basic S3 operations against a running weed mini instance
-func TestS3Integration(t *testing.T) {
-	if testing.Short() {
-		t.Skip("Skipping integration test in short mode")
-	}
-
-	// Create and start test cluster
-	cluster, err := startMiniCluster(t)
-	require.NoError(t, err)
-	defer cluster.Stop()
-
-	// Run test suite
-	t.Run("CreateBucket", func(t *testing.T) {
-		testCreateBucket(t, cluster)
-	})
-
-	t.Run("PutObject", func(t *testing.T) {
-		testPutObject(t, cluster)
-	})
-
-	t.Run("GetObject", func(t *testing.T) {
-		testGetObject(t, cluster)
-	})
-
-	t.Run("ListObjects", func(t *testing.T) {
-		testListObjects(t, cluster)
-	})
-
-	t.Run("DeleteObject", func(t *testing.T) {
-		testDeleteObject(t, cluster)
-	})
-
-	t.Run("DeleteBucket", func(t *testing.T) {
-		testDeleteBucket(t, cluster)
-	})
-}
-
-// findAvailablePort finds an available port by binding to port 0
-func findAvailablePort() (int, error) {
-	listener, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		return 0, err
-	}
-	defer listener.Close()
-
-	addr := listener.Addr().(*net.TCPAddr)
-	return addr.Port, nil
-}
-
-// startMiniCluster starts a weed mini instance directly without exec
-func startMiniCluster(t *testing.T) (*TestCluster, error) {
-	// Find available ports
-	masterPort, err := findAvailablePort()
-	if err != nil {
-		return nil, fmt.Errorf("failed to find master port: %v", err)
-	}
-	volumePort, err := findAvailablePort()
-	if err != nil {
-		return nil, fmt.Errorf("failed to find volume port: %v", err)
-	}
-	filerPort, err := findAvailablePort()
-	if err != nil {
-		return nil, fmt.Errorf("failed to find filer port: %v", err)
-	}
-	s3Port, err := findAvailablePort()
-	if err != nil {
-		return nil, fmt.Errorf("failed to find s3 port: %v", err)
-	}
-	// Create temporary directory for test data
-	testDir := t.TempDir()
-
-	// Ensure no configuration file from previous runs
-	configFile := filepath.Join(testDir, "mini.options")
-	_ = os.Remove(configFile)
-
-	// Create context with timeout
-	ctx, cancel := context.WithCancel(context.Background())
-
-	s3Endpoint := fmt.Sprintf("http://127.0.0.1:%d", s3Port)
-	cluster := &TestCluster{
-		dataDir:    testDir,
-		ctx:        ctx,
-		cancel:     cancel,
-		masterPort: masterPort,
-		volumePort: volumePort,
-		filerPort:  filerPort,
-		s3Port:     s3Port,
-		s3Endpoint: s3Endpoint,
-	}
-
-	// Create empty security.toml to disable JWT authentication in tests
-	securityToml := filepath.Join(testDir, "security.toml")
-	err = os.WriteFile(securityToml, []byte("# Empty security config for testing\n"), 0644)
-	if err != nil {
-		cancel()
-		return nil, fmt.Errorf("failed to create security.toml: %v", err)
-	}
-
-	// Start weed mini in a goroutine by calling the command directly
-	cluster.wg.Add(1)
-	go func() {
-		defer cluster.wg.Done()
-
-		// Save current directory and args
-		oldDir, _ := os.Getwd()
-		oldArgs := os.Args
-		defer func() {
-			os.Chdir(oldDir)
-			os.Args = oldArgs
-		}()
-
-		// Change to test directory so mini picks up security.toml
-		os.Chdir(testDir)
-
-		// Configure args for mini command
-		// Note: When running via 'go test', os.Args[0] is the test binary
-		// We need to make it look like we're running 'weed mini'
-		os.Args = []string{
-			"weed",
-			"-dir=" + testDir,
-			"-master.port=" + strconv.Itoa(masterPort),
-			"-volume.port=" + strconv.Itoa(volumePort),
-			"-filer.port=" + strconv.Itoa(filerPort),
-			"-s3.port=" + strconv.Itoa(s3Port),
-			"-webdav.port=0",               // Disable WebDAV
-			"-admin.ui=false",              // Disable admin UI
-			"-master.volumeSizeLimitMB=32", // Small volumes for testing
-			"-ip=127.0.0.1",
-			"-master.peers=none",     // Faster startup
-			"-s3.iam.readOnly=false", // Enable IAM write operations for tests
-		}
-
-		// Suppress most logging during tests
-		glog.MaxSize = 1024 * 1024
-
-		// Find and run the mini command
-		// We simulate how main.go executes commands
-		for _, cmd := range command.Commands {
-			if cmd.Name() == "mini" && cmd.Run != nil {
-				// Parse the flags for the mini command
-				// Don't include "weed" in the args
-				cmd.Flag.Parse(os.Args[1:])
-				args := cmd.Flag.Args()
-				cmd.Run(cmd, args)
-				return
-			}
-		}
-	}()
-
-	// Wait for S3 service to be ready
-	err = waitForS3Ready(cluster.s3Endpoint, 30*time.Second)
-	if err != nil {
-		cancel()
-		return nil, fmt.Errorf("S3 service failed to start: %v", err)
-	}
-
-	cluster.isRunning = true
-
-	// Create S3 client
-	sess, err := session.NewSession(&aws.Config{
-		Region:           aws.String(testRegion),
-		Endpoint:         aws.String(cluster.s3Endpoint),
-		DisableSSL:       aws.Bool(true),
-		S3ForcePathStyle: aws.Bool(true),
-		Credentials:      credentials.NewStaticCredentials(testAccessKey, testSecretKey, ""),
-	})
-	if err != nil {
-		cancel()
-		return nil, fmt.Errorf("failed to create AWS session: %v", err)
-	}
-
-	cluster.s3Client = s3.New(sess)
-
-	t.Logf("Test cluster started successfully at %s", cluster.s3Endpoint)
-	return cluster, nil
-}
-
-// Stop stops the test cluster
-func (c *TestCluster) Stop() {
-	if c.cancel != nil {
-		c.cancel()
-	}
-	// Give services time to shut down gracefully
-	if c.isRunning {
-		time.Sleep(500 * time.Millisecond)
-	}
-	// Wait for the mini goroutine to finish
-	done := make(chan struct{})
-	go func() {
-		c.wg.Wait()
-		close(done)
-	}()
-	select {
-	case <-done:
-		// Goroutine finished
-	case <-time.After(2 * time.Second):
-		// Timeout - goroutine doesn't respond to context cancel
-	}
-
-	// Reset the global cmdMini flags to prevent state leakage to other tests
-	for _, cmd := range command.Commands {
-		if cmd.Name() == "mini" {
-			// Reset flags to defaults
-			cmd.Flag.VisitAll(func(f *flag.Flag) {
-				// Reset to default value
-				f.Value.Set(f.DefValue)
-			})
-			break
-		}
-	}
-}
-
-// waitForS3Ready waits for the S3 service to be ready
-func waitForS3Ready(endpoint string, timeout time.Duration) error {
-	client := &http.Client{Timeout: 1 * time.Second}
-	deadline := time.Now().Add(timeout)
-
-	for time.Now().Before(deadline) {
-		resp, err := client.Get(endpoint)
-		if err == nil {
-			resp.Body.Close()
-			// Wait a bit more to ensure service is fully ready
-			time.Sleep(500 * time.Millisecond)
-			return nil
-		}
-		time.Sleep(200 * time.Millisecond)
-	}
-
-	return fmt.Errorf("timeout waiting for S3 service at %s", endpoint)
-}
-
-// Test functions
-
-func testCreateBucket(t *testing.T, cluster *TestCluster) {
-	bucketName := "test-bucket-" + randomString(8)
-
-	_, err := cluster.s3Client.CreateBucket(&s3.CreateBucketInput{
-		Bucket: aws.String(bucketName),
-	})
-	require.NoError(t, err, "Failed to create bucket")
-
-	// Wait a bit for bucket to be fully created
-	time.Sleep(100 * time.Millisecond)
-
-	// Verify bucket exists by trying to head it
-	// Note: ListBuckets may not immediately show new buckets in SeaweedFS
-	_, err = cluster.s3Client.HeadBucket(&s3.HeadBucketInput{
-		Bucket: aws.String(bucketName),
-	})
-	require.NoError(t, err, "Bucket should be accessible via HeadBucket")
-
-	t.Logf("✓ Created bucket: %s", bucketName)
-}
-
-func testPutObject(t *testing.T, cluster *TestCluster) {
-	bucketName := "test-put-" + randomString(8)
-	objectKey := "test-object.txt"
-	objectData := "Hello, SeaweedFS S3!"
-
-	// Create bucket
-	_, err := cluster.s3Client.CreateBucket(&s3.CreateBucketInput{
-		Bucket: aws.String(bucketName),
-	})
-	require.NoError(t, err)
-
-	// Wait a bit for bucket to be fully created
-	time.Sleep(100 * time.Millisecond)
-
-	// Put object
-	_, err = cluster.s3Client.PutObject(&s3.PutObjectInput{
-		Bucket: aws.String(bucketName),
-		Key:    aws.String(objectKey),
-		Body:   bytes.NewReader([]byte(objectData)),
-	})
-	require.NoError(t, err, "Failed to put object")
-
-	// Verify object exists
-	headResp, err := cluster.s3Client.HeadObject(&s3.HeadObjectInput{
-		Bucket: aws.String(bucketName),
-		Key:    aws.String(objectKey),
-	})
-	require.NoError(t, err)
-	assert.NotNil(t, headResp.ContentLength)
-	assert.Equal(t, int64(len(objectData)), aws.Int64Value(headResp.ContentLength))
-
-	t.Logf("✓ Put object: %s/%s (%d bytes)", bucketName, objectKey, len(objectData))
-}
-
-func testGetObject(t *testing.T, cluster *TestCluster) {
-	bucketName := "test-get-" + randomString(8)
-	objectKey := "test-data.txt"
-	objectData := "This is test data for GET operation"
-
-	// Create bucket and put object
-	_, err := cluster.s3Client.CreateBucket(&s3.CreateBucketInput{
-		Bucket: aws.String(bucketName),
-	})
-	require.NoError(t, err)
-
-	// Wait a bit for bucket to be fully created
-	time.Sleep(200 * time.Millisecond)
-
-	_, err = cluster.s3Client.PutObject(&s3.PutObjectInput{
-		Bucket: aws.String(bucketName),
-		Key:    aws.String(objectKey),
-		Body:   bytes.NewReader([]byte(objectData)),
-	})
-	require.NoError(t, err)
-
-	// Wait a bit for object to be fully written
-	time.Sleep(300 * time.Millisecond)
-
-	// Verify object metadata via HeadObject (more reliable than GetObject in mini mode)
-	headResp, err := cluster.s3Client.HeadObject(&s3.HeadObjectInput{
-		Bucket: aws.String(bucketName),
-		Key:    aws.String(objectKey),
-	})
-	require.NoError(t, err, "Failed to head object")
-	assert.NotNil(t, headResp.ContentLength)
-	assert.Equal(t, int64(len(objectData)), aws.Int64Value(headResp.ContentLength))
-
-	t.Logf("✓ Got object metadata: %s/%s (verified %d bytes via HEAD)", bucketName, objectKey, len(objectData))
-
-	// Note: GetObject can sometimes have volume location issues in mini mode during tests
-	// The object is correctly stored (as verified by HEAD), which demonstrates S3 functionality
-}
-
-func testListObjects(t *testing.T, cluster *TestCluster) {
-	bucketName := "test-list-" + randomString(8)
-
-	// Create bucket
-	_, err := cluster.s3Client.CreateBucket(&s3.CreateBucketInput{
-		Bucket: aws.String(bucketName),
-	})
-	require.NoError(t, err)
-
-	// Put multiple objects
-	objectKeys := []string{"file1.txt", "file2.txt", "file3.txt"}
-	for _, key := range objectKeys {
-		_, err = cluster.s3Client.PutObject(&s3.PutObjectInput{
-			Bucket: aws.String(bucketName),
-			Key:    aws.String(key),
-			Body:   bytes.NewReader([]byte("test data for " + key)),
-		})
-		require.NoError(t, err)
-	}
-
-	// List objects
-	listResp, err := cluster.s3Client.ListObjectsV2(&s3.ListObjectsV2Input{
-		Bucket: aws.String(bucketName),
-	})
-	require.NoError(t, err, "Failed to list objects")
-
-	// Verify all objects are listed
-	assert.Equal(t, len(objectKeys), len(listResp.Contents), "Should list all objects")
-
-	foundKeys := make(map[string]bool)
-	for _, obj := range listResp.Contents {
-		foundKeys[aws.StringValue(obj.Key)] = true
-	}
-
-	for _, key := range objectKeys {
-		assert.True(t, foundKeys[key], "Object %s should be in list", key)
-	}
-
-	t.Logf("✓ Listed %d objects in bucket: %s", len(listResp.Contents), bucketName)
-}
-
-func testDeleteObject(t *testing.T, cluster *TestCluster) {
-	bucketName := "test-delete-" + randomString(8)
-	objectKey := "to-be-deleted.txt"
-
-	// Create bucket and put object
-	_, err := cluster.s3Client.CreateBucket(&s3.CreateBucketInput{
-		Bucket: aws.String(bucketName),
-	})
-	require.NoError(t, err)
-
-	_, err = cluster.s3Client.PutObject(&s3.PutObjectInput{
-		Bucket: aws.String(bucketName),
-		Key:    aws.String(objectKey),
-		Body:   bytes.NewReader([]byte("This will be deleted")),
-	})
-	require.NoError(t, err)
-
-	// Delete object
-	_, err = cluster.s3Client.DeleteObject(&s3.DeleteObjectInput{
-		Bucket: aws.String(bucketName),
-		Key:    aws.String(objectKey),
-	})
-	require.NoError(t, err, "Failed to delete object")
-
-	// Verify object is gone
-	_, err = cluster.s3Client.HeadObject(&s3.HeadObjectInput{
-		Bucket: aws.String(bucketName),
-		Key:    aws.String(objectKey),
-	})
-	assert.Error(t, err, "Object should not exist after deletion")
-
-	t.Logf("✓ Deleted object: %s/%s", bucketName, objectKey)
-}
-
-func testDeleteBucket(t *testing.T, cluster *TestCluster) {
-	bucketName := "test-delete-bucket-" + randomString(8)
-
-	// Create bucket
-	_, err := cluster.s3Client.CreateBucket(&s3.CreateBucketInput{
-		Bucket: aws.String(bucketName),
-	})
-	require.NoError(t, err)
-
-	// Delete bucket
-	_, err = cluster.s3Client.DeleteBucket(&s3.DeleteBucketInput{
-		Bucket: aws.String(bucketName),
-	})
-	require.NoError(t, err, "Failed to delete bucket")
-
-	// Verify bucket is gone
-	resp, err := cluster.s3Client.ListBuckets(&s3.ListBucketsInput{})
-	require.NoError(t, err)
-
-	for _, bucket := range resp.Buckets {
-		assert.NotEqual(t, bucketName, aws.StringValue(bucket.Name), "Bucket should not exist after deletion")
-	}
-
-	t.Logf("✓ Deleted bucket: %s", bucketName)
-}
-
-// randomString generates a random string for unique naming
-func randomString(length int) string {
-	const charset = "abcdefghijklmnopqrstuvwxyz0123456789"
-	rng := rand.New(rand.NewSource(time.Now().UnixNano()))
-	b := make([]byte, length)
-	for i := range b {
-		b[i] = charset[rng.Intn(len(charset))]
-	}
-	return string(b)
-}

test/s3/policy/policy_test.go

@@ -1,296 +0,0 @@
-package policy
-
-import (
-	"context"
-	"fmt"
-	"net"
-	"net/http"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strconv"
-	"strings"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/seaweedfs/seaweedfs/weed/command"
-	"github.com/seaweedfs/seaweedfs/weed/glog"
-	flag "github.com/seaweedfs/seaweedfs/weed/util/fla9"
-	"github.com/stretchr/testify/require"
-)
-
-// TestCluster manages the weed mini instance for integration testing
-type TestCluster struct {
-	dataDir    string
-	ctx        context.Context
-	cancel     context.CancelFunc
-	isRunning  bool
-	wg         sync.WaitGroup
-	masterPort int
-	volumePort int
-	filerPort  int
-	s3Port     int
-	s3Endpoint string
-}
-
-func TestS3PolicyShellRevised(t *testing.T) {
-	if testing.Short() {
-		t.Skip("Skipping integration test in short mode")
-	}
-	cluster, err := startMiniCluster(t)
-	require.NoError(t, err)
-	defer cluster.Stop()
-
-	policyContent := `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"*","Resource":"*"}]}`
-	tmpPolicyFile, err := os.CreateTemp("", "test_policy_*.json")
-	if err != nil {
-		t.Fatalf("Failed to create temp policy file: %v", err)
-	}
-	defer os.Remove(tmpPolicyFile.Name())
-	_, err = tmpPolicyFile.WriteString(policyContent)
-	require.NoError(t, err)
-	require.NoError(t, tmpPolicyFile.Close())
-
-	weedCmd := "weed"
-	masterAddr := fmt.Sprintf("127.0.0.1:%d", cluster.masterPort)
-	filerAddr := fmt.Sprintf("127.0.0.1:%d", cluster.filerPort)
-
-	// Put
-	execShell(t, weedCmd, masterAddr, filerAddr, fmt.Sprintf("s3.policy -put -name=testpolicy -file=%s", tmpPolicyFile.Name()))
-
-	// List
-	out := execShell(t, weedCmd, masterAddr, filerAddr, "s3.policy -list")
-	if !contains(out, "Name: testpolicy") {
-		t.Errorf("List failed: %s", out)
-	}
-
-	// Get
-	out = execShell(t, weedCmd, masterAddr, filerAddr, "s3.policy -get -name=testpolicy")
-	if !contains(out, "Statement") {
-		t.Errorf("Get failed: %s", out)
-	}
-
-	// Delete
-	execShell(t, weedCmd, masterAddr, filerAddr, "s3.policy -delete -name=testpolicy")
-
-	// Verify
-	out = execShell(t, weedCmd, masterAddr, filerAddr, "s3.policy -list")
-	if contains(out, "Name: testpolicy") {
-		t.Errorf("delete failed, policy 'testpolicy' should not be in the list: %s", out)
-	}
-	// Verify s3.configure linking policies
-	execShell(t, weedCmd, masterAddr, filerAddr, "s3.configure -user=test -actions=Read -policies=testpolicy -apply")
-	out = execShell(t, weedCmd, masterAddr, filerAddr, "s3.configure")
-	if !contains(out, "\"policyNames\": [\n    \"testpolicy\"\n  ]") {
-		// relaxed check
-		if !contains(out, "\"testpolicy\"") || !contains(out, "policyNames") {
-			t.Errorf("s3.configure failed to link policy: %s", out)
-		}
-	}
-
-	// 1. Update User: Add Write action
-	execShell(t, weedCmd, masterAddr, filerAddr, "s3.configure -user=test -actions=Write -apply")
-	out = execShell(t, weedCmd, masterAddr, filerAddr, "s3.configure")
-	if !contains(out, "Write") {
-		t.Errorf("s3.configure failed to add Write action: %s", out)
-	}
-
-	// 2. Granular Delete: Delete Read action
-	execShell(t, weedCmd, masterAddr, filerAddr, "s3.configure -user=test -actions=Read -delete -apply")
-	out = execShell(t, weedCmd, masterAddr, filerAddr, "s3.configure")
-	if contains(out, "\"Read\"") { // Quote to avoid matching partial words if any
-		t.Errorf("s3.configure failed to delete Read action: %s", out)
-	}
-	if !contains(out, "Write") {
-		t.Errorf("s3.configure deleted Write action unnecessarily: %s", out)
-	}
-
-	// 3. Access Key Management
-	execShell(t, weedCmd, masterAddr, filerAddr, "s3.configure -user=test -access_key=testkey -secret_key=testsecret -apply")
-	out = execShell(t, weedCmd, masterAddr, filerAddr, "s3.configure")
-	if !contains(out, "testkey") {
-		t.Errorf("s3.configure failed to add access key: %s", out)
-	}
-
-	execShell(t, weedCmd, masterAddr, filerAddr, "s3.configure -user=test -access_key=testkey -delete -apply")
-	out = execShell(t, weedCmd, masterAddr, filerAddr, "s3.configure")
-	if contains(out, "testkey") {
-		t.Errorf("s3.configure failed to delete access key: %s", out)
-	}
-
-	// 4. Delete User
-	execShell(t, weedCmd, masterAddr, filerAddr, "s3.configure -user=test -delete -apply")
-	out = execShell(t, weedCmd, masterAddr, filerAddr, "s3.configure")
-	if contains(out, "\"Name\": \"test\"") {
-		t.Errorf("s3.configure failed to delete user: %s", out)
-	}
-}
-
-func execShell(t *testing.T, weedCmd, master, filer, shellCmd string) string {
-	// weed shell -master=... -filer=...
-	args := []string{"shell", "-master=" + master, "-filer=" + filer}
-	t.Logf("Running: %s %v <<< %s", weedCmd, args, shellCmd)
-
-	cmd := exec.Command(weedCmd, args...)
-	cmd.Stdin = strings.NewReader(shellCmd + "\n")
-
-	out, err := cmd.CombinedOutput()
-	if err != nil {
-		t.Fatalf("Failed to run %s: %v\nOutput: %s", shellCmd, err, string(out))
-	}
-	return string(out)
-}
-
-// --- Test setup helpers ---
-
-func findAvailablePort() (int, error) {
-	listener, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		return 0, err
-	}
-	defer listener.Close()
-	addr := listener.Addr().(*net.TCPAddr)
-	return addr.Port, nil
-}
-
-// findAvailablePortPair finds an available http port P such that P and P+10000 (grpc) are both available
-func findAvailablePortPair() (int, int, error) {
-	for i := 0; i < 100; i++ {
-		httpPort, err := findAvailablePort()
-		if err != nil {
-			return 0, 0, err
-		}
-		grpcPort := httpPort + 10000
-
-		// check if grpc port is available
-		listener, err := net.Listen("tcp", fmt.Sprintf("127.0.0.1:%d", grpcPort))
-		if err == nil {
-			listener.Close()
-			return httpPort, grpcPort, nil
-		}
-	}
-	return 0, 0, fmt.Errorf("failed to find available port pair")
-}
-
-func startMiniCluster(t *testing.T) (*TestCluster, error) {
-	masterPort, masterGrpcPort, err := findAvailablePortPair()
-	require.NoError(t, err)
-	volumePort, volumeGrpcPort, err := findAvailablePortPair()
-	require.NoError(t, err)
-	filerPort, filerGrpcPort, err := findAvailablePortPair()
-	require.NoError(t, err)
-	s3Port, s3GrpcPort, err := findAvailablePortPair()
-	require.NoError(t, err)
-
-	testDir := t.TempDir()
-
-	ctx, cancel := context.WithCancel(context.Background())
-	s3Endpoint := fmt.Sprintf("http://127.0.0.1:%d", s3Port)
-	cluster := &TestCluster{
-		dataDir:    testDir,
-		ctx:        ctx,
-		cancel:     cancel,
-		masterPort: masterPort,
-		volumePort: volumePort,
-		filerPort:  filerPort,
-		s3Port:     s3Port,
-		s3Endpoint: s3Endpoint,
-	}
-
-	// Disable authentication for tests
-	securityToml := filepath.Join(testDir, "security.toml")
-	err = os.WriteFile(securityToml, []byte("# Empty security config\n"), 0644)
-	require.NoError(t, err)
-
-	// Configure credential store for IAM tests
-	credentialToml := filepath.Join(testDir, "credential.toml")
-	credentialConfig := `
-[credential.memory]
-enabled = true
-`
-	err = os.WriteFile(credentialToml, []byte(credentialConfig), 0644)
-	require.NoError(t, err)
-
-	cluster.wg.Add(1)
-	go func() {
-		defer cluster.wg.Done()
-		oldDir, _ := os.Getwd()
-		oldArgs := os.Args
-		defer func() {
-			os.Chdir(oldDir)
-			os.Args = oldArgs
-		}()
-		os.Chdir(testDir)
-		os.Args = []string{
-			"weed",
-			"-dir=" + testDir,
-			"-master.port=" + strconv.Itoa(masterPort),
-			"-master.port.grpc=" + strconv.Itoa(masterGrpcPort),
-			"-volume.port=" + strconv.Itoa(volumePort),
-			"-volume.port.grpc=" + strconv.Itoa(volumeGrpcPort),
-			"-filer.port=" + strconv.Itoa(filerPort),
-			"-filer.port.grpc=" + strconv.Itoa(filerGrpcPort),
-			"-s3.port=" + strconv.Itoa(s3Port),
-			"-s3.port.grpc=" + strconv.Itoa(s3GrpcPort),
-			"-webdav.port=0",
-			"-admin.ui=false",
-			"-master.volumeSizeLimitMB=32",
-			"-ip=127.0.0.1",
-			"-master.peers=none",
-		}
-		glog.MaxSize = 1024 * 1024
-		for _, cmd := range command.Commands {
-			if cmd.Name() == "mini" && cmd.Run != nil {
-				cmd.Flag.Parse(os.Args[1:])
-				cmd.Run(cmd, cmd.Flag.Args())
-				return
-			}
-		}
-	}()
-
-	// Wait for S3
-	err = waitForS3Ready(cluster.s3Endpoint, 60*time.Second)
-	if err != nil {
-		cancel()
-		return nil, err
-	}
-	cluster.isRunning = true
-	return cluster, nil
-}
-
-func waitForS3Ready(endpoint string, timeout time.Duration) error {
-	client := &http.Client{Timeout: 1 * time.Second}
-	deadline := time.Now().Add(timeout)
-	for time.Now().Before(deadline) {
-		resp, err := client.Get(endpoint)
-		if err == nil {
-			resp.Body.Close()
-			return nil
-		}
-		time.Sleep(200 * time.Millisecond)
-	}
-	return fmt.Errorf("timeout waiting for S3")
-}
-
-func (c *TestCluster) Stop() {
-	if c.cancel != nil {
-		c.cancel()
-	}
-	if c.isRunning {
-		time.Sleep(500 * time.Millisecond)
-	}
-	// Simplified stop
-	for _, cmd := range command.Commands {
-		if cmd.Name() == "mini" {
-			cmd.Flag.VisitAll(func(f *flag.Flag) {
-				f.Value.Set(f.DefValue)
-			})
-			break
-		}
-	}
-}
-
-func contains(s, substr string) bool {
-	return strings.Contains(s, substr)
-}

test/s3tables/client.go

@@ -1,431 +0,0 @@
-package s3tables
-
-import (
-	"bytes"
-	"context"
-	"crypto/sha256"
-	"encoding/hex"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"net/url"
-	"strconv"
-	"time"
-
-	"github.com/aws/aws-sdk-go-v2/aws"
-	v4 "github.com/aws/aws-sdk-go-v2/aws/signer/v4"
-
-	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables"
-)
-
-func getFirstNamespace(namespace []string) (string, error) {
-	if len(namespace) == 0 {
-		return "", fmt.Errorf("namespace must not be empty")
-	}
-	return namespace[0], nil
-}
-
-func (c *S3TablesClient) doRestRequest(method, path string, body interface{}) (*http.Response, error) {
-	var bodyBytes []byte
-	var err error
-
-	if body != nil {
-		bodyBytes, err = json.Marshal(body)
-		if err != nil {
-			return nil, fmt.Errorf("failed to marshal request body: %w", err)
-		}
-	}
-
-	req, err := http.NewRequest(method, c.endpoint+path, bytes.NewReader(bodyBytes))
-	if err != nil {
-		return nil, fmt.Errorf("failed to create request: %w", err)
-	}
-
-	if body != nil {
-		req.Header.Set("Content-Type", "application/x-amz-json-1.1")
-	}
-
-	if err := c.signRequest(req, bodyBytes); err != nil {
-		return nil, err
-	}
-
-	return c.client.Do(req)
-}
-
-func (c *S3TablesClient) doTargetRequest(operation string, body interface{}) (*http.Response, error) {
-	var bodyBytes []byte
-	var err error
-
-	if body != nil {
-		bodyBytes, err = json.Marshal(body)
-		if err != nil {
-			return nil, fmt.Errorf("failed to marshal request body: %w", err)
-		}
-	}
-
-	req, err := http.NewRequest(http.MethodPost, c.endpoint+"/", bytes.NewReader(bodyBytes))
-	if err != nil {
-		return nil, fmt.Errorf("failed to create request: %w", err)
-	}
-
-	req.URL.RawPath = "/"
-	req.Header.Set("Content-Type", "application/x-amz-json-1.1")
-	req.Header.Set("X-Amz-Target", "S3Tables."+operation)
-
-	if err := c.signRequest(req, bodyBytes); err != nil {
-		return nil, err
-	}
-
-	return c.client.Do(req)
-}
-
-func (c *S3TablesClient) doTargetRequestAndDecode(operation string, reqBody interface{}, respBody interface{}) error {
-	resp, err := c.doTargetRequest(operation, reqBody)
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		bodyBytes, readErr := io.ReadAll(resp.Body)
-		if readErr != nil {
-			return fmt.Errorf("%s failed with status %d and could not read error response body: %v", operation, resp.StatusCode, readErr)
-		}
-		var errResp s3tables.S3TablesError
-		if err := json.Unmarshal(bodyBytes, &errResp); err != nil {
-			return fmt.Errorf("%s failed with status %d, could not decode error response: %v. Body: %s", operation, resp.StatusCode, err, string(bodyBytes))
-		}
-		return fmt.Errorf("%s failed: %s - %s", operation, errResp.Type, errResp.Message)
-	}
-
-	if respBody != nil {
-		if err := json.NewDecoder(resp.Body).Decode(respBody); err != nil {
-			return fmt.Errorf("failed to decode %s response: %w", operation, err)
-		}
-	}
-
-	return nil
-}
-
-func (c *S3TablesClient) signRequest(req *http.Request, body []byte) error {
-	creds := aws.Credentials{
-		AccessKeyID:     c.accessKey,
-		SecretAccessKey: c.secretKey,
-	}
-	if req.Host == "" {
-		req.Host = req.URL.Host
-	}
-	req.Header.Set("Host", req.URL.Host)
-	payloadHash := sha256.Sum256(body)
-	return v4.NewSigner().SignHTTP(context.Background(), creds, req, hex.EncodeToString(payloadHash[:]), "s3tables", c.region, time.Now())
-}
-
-func (c *S3TablesClient) doRestRequestAndDecode(operation, method, path string, reqBody interface{}, respBody interface{}) error {
-	resp, err := c.doRestRequest(method, path, reqBody)
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		bodyBytes, readErr := io.ReadAll(resp.Body)
-		if readErr != nil {
-			return fmt.Errorf("%s failed with status %d and could not read error response body: %v", operation, resp.StatusCode, readErr)
-		}
-		var errResp s3tables.S3TablesError
-		if err := json.Unmarshal(bodyBytes, &errResp); err != nil {
-			return fmt.Errorf("%s failed with status %d, could not decode error response: %v. Body: %s", operation, resp.StatusCode, err, string(bodyBytes))
-		}
-		return fmt.Errorf("%s failed: %s - %s", operation, errResp.Type, errResp.Message)
-	}
-
-	if respBody != nil {
-		if err := json.NewDecoder(resp.Body).Decode(respBody); err != nil {
-			return fmt.Errorf("failed to decode %s response: %w", operation, err)
-		}
-	}
-
-	return nil
-}
-
-// Table Bucket operations
-
-func (c *S3TablesClient) CreateTableBucket(name string, tags map[string]string) (*s3tables.CreateTableBucketResponse, error) {
-	req := &s3tables.CreateTableBucketRequest{
-		Name: name,
-		Tags: tags,
-	}
-	var result s3tables.CreateTableBucketResponse
-	if err := c.doRestRequestAndDecode("CreateTableBucket", http.MethodPut, "/buckets", req, &result); err != nil {
-		return nil, err
-	}
-	return &result, nil
-}
-
-func (c *S3TablesClient) GetTableBucket(arn string) (*s3tables.GetTableBucketResponse, error) {
-	path := "/buckets/" + url.PathEscape(arn)
-	var result s3tables.GetTableBucketResponse
-	if err := c.doRestRequestAndDecode("GetTableBucket", http.MethodGet, path, nil, &result); err != nil {
-		return nil, err
-	}
-	return &result, nil
-}
-
-func (c *S3TablesClient) ListTableBuckets(prefix, continuationToken string, maxBuckets int) (*s3tables.ListTableBucketsResponse, error) {
-	query := url.Values{}
-	if prefix != "" {
-		query.Set("prefix", prefix)
-	}
-	if continuationToken != "" {
-		query.Set("continuationToken", continuationToken)
-	}
-	if maxBuckets > 0 {
-		query.Set("maxBuckets", strconv.Itoa(maxBuckets))
-	}
-	path := "/buckets"
-	if encoded := query.Encode(); encoded != "" {
-		path = path + "?" + encoded
-	}
-	var result s3tables.ListTableBucketsResponse
-	if err := c.doRestRequestAndDecode("ListTableBuckets", http.MethodGet, path, nil, &result); err != nil {
-		return nil, err
-	}
-	return &result, nil
-}
-
-func (c *S3TablesClient) DeleteTableBucket(arn string) error {
-	path := "/buckets/" + url.PathEscape(arn)
-	return c.doRestRequestAndDecode("DeleteTableBucket", http.MethodDelete, path, nil, nil)
-}
-
-// Namespace operations
-
-func (c *S3TablesClient) CreateNamespace(bucketARN string, namespace []string) (*s3tables.CreateNamespaceResponse, error) {
-	if len(namespace) == 0 {
-		return nil, fmt.Errorf("CreateNamespace requires namespace")
-	}
-	req := &s3tables.CreateNamespaceRequest{
-		Namespace: namespace,
-	}
-	path := "/namespaces/" + url.PathEscape(bucketARN)
-	var result s3tables.CreateNamespaceResponse
-	if err := c.doRestRequestAndDecode("CreateNamespace", http.MethodPut, path, req, &result); err != nil {
-		return nil, err
-	}
-	return &result, nil
-}
-
-func (c *S3TablesClient) GetNamespace(bucketARN string, namespace []string) (*s3tables.GetNamespaceResponse, error) {
-	name, err := getFirstNamespace(namespace)
-	if err != nil {
-		return nil, fmt.Errorf("GetNamespace requires namespace: %w", err)
-	}
-	path := "/namespaces/" + url.PathEscape(bucketARN) + "/" + url.PathEscape(name)
-	var result s3tables.GetNamespaceResponse
-	if err := c.doRestRequestAndDecode("GetNamespace", http.MethodGet, path, nil, &result); err != nil {
-		return nil, err
-	}
-	return &result, nil
-}
-
-func (c *S3TablesClient) ListNamespaces(bucketARN, prefix, continuationToken string, maxNamespaces int) (*s3tables.ListNamespacesResponse, error) {
-	query := url.Values{}
-	if prefix != "" {
-		query.Set("prefix", prefix)
-	}
-	if continuationToken != "" {
-		query.Set("continuationToken", continuationToken)
-	}
-	if maxNamespaces > 0 {
-		query.Set("maxNamespaces", strconv.Itoa(maxNamespaces))
-	}
-	path := "/namespaces/" + url.PathEscape(bucketARN)
-	if encoded := query.Encode(); encoded != "" {
-		path = path + "?" + encoded
-	}
-	var result s3tables.ListNamespacesResponse
-	if err := c.doRestRequestAndDecode("ListNamespaces", http.MethodGet, path, nil, &result); err != nil {
-		return nil, err
-	}
-	return &result, nil
-}
-
-func (c *S3TablesClient) DeleteNamespace(bucketARN string, namespace []string) error {
-	name, err := getFirstNamespace(namespace)
-	if err != nil {
-		return fmt.Errorf("DeleteNamespace requires namespace: %w", err)
-	}
-	path := "/namespaces/" + url.PathEscape(bucketARN) + "/" + url.PathEscape(name)
-	return c.doRestRequestAndDecode("DeleteNamespace", http.MethodDelete, path, nil, nil)
-}
-
-// Table operations
-
-func (c *S3TablesClient) CreateTable(bucketARN string, namespace []string, name, format string, metadata *s3tables.TableMetadata, tags map[string]string) (*s3tables.CreateTableResponse, error) {
-	nameSpace, err := getFirstNamespace(namespace)
-	if err != nil {
-		return nil, fmt.Errorf("CreateTable requires namespace: %w", err)
-	}
-	req := &s3tables.CreateTableRequest{
-		Name:     name,
-		Format:   format,
-		Metadata: metadata,
-		Tags:     tags,
-	}
-	path := "/tables/" + url.PathEscape(bucketARN) + "/" + url.PathEscape(nameSpace)
-	var result s3tables.CreateTableResponse
-	if err := c.doRestRequestAndDecode("CreateTable", http.MethodPut, path, req, &result); err != nil {
-		return nil, err
-	}
-	return &result, nil
-}
-
-func (c *S3TablesClient) GetTable(bucketARN string, namespace []string, name string) (*s3tables.GetTableResponse, error) {
-	nameSpace, err := getFirstNamespace(namespace)
-	if err != nil {
-		return nil, fmt.Errorf("GetTable requires namespace: %w", err)
-	}
-	query := url.Values{}
-	query.Set("tableBucketARN", bucketARN)
-	query.Set("namespace", nameSpace)
-	query.Set("name", name)
-	path := "/get-table?" + query.Encode()
-	var result s3tables.GetTableResponse
-	if err := c.doRestRequestAndDecode("GetTable", http.MethodGet, path, nil, &result); err != nil {
-		return nil, err
-	}
-	return &result, nil
-}
-
-func (c *S3TablesClient) ListTables(bucketARN string, namespace []string, prefix, continuationToken string, maxTables int) (*s3tables.ListTablesResponse, error) {
-	query := url.Values{}
-	if len(namespace) > 0 {
-		nameSpace, err := getFirstNamespace(namespace)
-		if err != nil {
-			return nil, fmt.Errorf("ListTables requires namespace: %w", err)
-		}
-		query.Set("namespace", nameSpace)
-	}
-	if prefix != "" {
-		query.Set("prefix", prefix)
-	}
-	if continuationToken != "" {
-		query.Set("continuationToken", continuationToken)
-	}
-	if maxTables > 0 {
-		query.Set("maxTables", strconv.Itoa(maxTables))
-	}
-	path := "/tables/" + url.PathEscape(bucketARN)
-	if encoded := query.Encode(); encoded != "" {
-		path = path + "?" + encoded
-	}
-	var result s3tables.ListTablesResponse
-	if err := c.doRestRequestAndDecode("ListTables", http.MethodGet, path, nil, &result); err != nil {
-		return nil, err
-	}
-	return &result, nil
-}
-
-func (c *S3TablesClient) DeleteTable(bucketARN string, namespace []string, name string) error {
-	nameSpace, err := getFirstNamespace(namespace)
-	if err != nil {
-		return fmt.Errorf("DeleteTable requires namespace: %w", err)
-	}
-	path := "/tables/" + url.PathEscape(bucketARN) + "/" + url.PathEscape(nameSpace) + "/" + url.PathEscape(name)
-	return c.doRestRequestAndDecode("DeleteTable", http.MethodDelete, path, nil, nil)
-}
-
-// Policy operations
-
-func (c *S3TablesClient) PutTableBucketPolicy(bucketARN, policy string) error {
-	req := &s3tables.PutTableBucketPolicyRequest{
-		ResourcePolicy: policy,
-	}
-	path := "/buckets/" + url.PathEscape(bucketARN) + "/policy"
-	return c.doRestRequestAndDecode("PutTableBucketPolicy", http.MethodPut, path, req, nil)
-}
-
-func (c *S3TablesClient) GetTableBucketPolicy(bucketARN string) (*s3tables.GetTableBucketPolicyResponse, error) {
-	path := "/buckets/" + url.PathEscape(bucketARN) + "/policy"
-	var result s3tables.GetTableBucketPolicyResponse
-	if err := c.doRestRequestAndDecode("GetTableBucketPolicy", http.MethodGet, path, nil, &result); err != nil {
-		return nil, err
-	}
-	return &result, nil
-}
-
-func (c *S3TablesClient) DeleteTableBucketPolicy(bucketARN string) error {
-	path := "/buckets/" + url.PathEscape(bucketARN) + "/policy"
-	return c.doRestRequestAndDecode("DeleteTableBucketPolicy", http.MethodDelete, path, nil, nil)
-}
-
-// Table Policy operations
-
-func (c *S3TablesClient) PutTablePolicy(bucketARN string, namespace []string, name, policy string) error {
-	nameSpace, err := getFirstNamespace(namespace)
-	if err != nil {
-		return fmt.Errorf("PutTablePolicy requires namespace: %w", err)
-	}
-	req := &s3tables.PutTablePolicyRequest{
-		ResourcePolicy: policy,
-	}
-	path := "/tables/" + url.PathEscape(bucketARN) + "/" + url.PathEscape(nameSpace) + "/" + url.PathEscape(name) + "/policy"
-	return c.doRestRequestAndDecode("PutTablePolicy", http.MethodPut, path, req, nil)
-}
-
-func (c *S3TablesClient) GetTablePolicy(bucketARN string, namespace []string, name string) (*s3tables.GetTablePolicyResponse, error) {
-	nameSpace, err := getFirstNamespace(namespace)
-	if err != nil {
-		return nil, fmt.Errorf("GetTablePolicy requires namespace: %w", err)
-	}
-	path := "/tables/" + url.PathEscape(bucketARN) + "/" + url.PathEscape(nameSpace) + "/" + url.PathEscape(name) + "/policy"
-	var result s3tables.GetTablePolicyResponse
-	if err := c.doRestRequestAndDecode("GetTablePolicy", http.MethodGet, path, nil, &result); err != nil {
-		return nil, err
-	}
-	return &result, nil
-}
-
-func (c *S3TablesClient) DeleteTablePolicy(bucketARN string, namespace []string, name string) error {
-	nameSpace, err := getFirstNamespace(namespace)
-	if err != nil {
-		return fmt.Errorf("DeleteTablePolicy requires namespace: %w", err)
-	}
-	path := "/tables/" + url.PathEscape(bucketARN) + "/" + url.PathEscape(nameSpace) + "/" + url.PathEscape(name) + "/policy"
-	return c.doRestRequestAndDecode("DeleteTablePolicy", http.MethodDelete, path, nil, nil)
-}
-
-// Tagging operations
-
-func (c *S3TablesClient) TagResource(resourceARN string, tags map[string]string) error {
-	req := &s3tables.TagResourceRequest{
-		Tags: tags,
-	}
-	path := "/tag/" + url.PathEscape(resourceARN)
-	return c.doRestRequestAndDecode("TagResource", http.MethodPost, path, req, nil)
-}
-
-func (c *S3TablesClient) ListTagsForResource(resourceARN string) (*s3tables.ListTagsForResourceResponse, error) {
-	path := "/tag/" + url.PathEscape(resourceARN)
-	var result s3tables.ListTagsForResourceResponse
-	if err := c.doRestRequestAndDecode("ListTagsForResource", http.MethodGet, path, nil, &result); err != nil {
-		return nil, err
-	}
-	return &result, nil
-}
-
-func (c *S3TablesClient) UntagResource(resourceARN string, tagKeys []string) error {
-	if len(tagKeys) == 0 {
-		return fmt.Errorf("tagKeys cannot be empty")
-	}
-	query := url.Values{}
-	for _, key := range tagKeys {
-		query.Add("tagKeys", key)
-	}
-	path := "/tag/" + url.PathEscape(resourceARN)
-	if encoded := query.Encode(); encoded != "" {
-		path = path + "?" + encoded
-	}
-	return c.doRestRequestAndDecode("UntagResource", http.MethodDelete, path, nil, nil)
-}

test/s3tables/s3tables_integration_test.go

@@ -1,699 +0,0 @@
-package s3tables
-
-import (
-	"context"
-	"fmt"
-	"net"
-	"net/http"
-	"os"
-	"path/filepath"
-	"strconv"
-	"testing"
-	"time"
-
-	cryptorand "crypto/rand"
-	"sync"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/seaweedfs/seaweedfs/weed/command"
-	"github.com/seaweedfs/seaweedfs/weed/glog"
-	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables"
-	flag "github.com/seaweedfs/seaweedfs/weed/util/fla9"
-)
-
-var (
-	miniClusterMutex sync.Mutex
-)
-
-func TestS3TablesIntegration(t *testing.T) {
-	if testing.Short() {
-		t.Skip("Skipping integration test in short mode")
-	}
-
-	// Create and start test cluster
-	cluster, err := startMiniCluster(t)
-	require.NoError(t, err)
-	defer cluster.Stop()
-
-	// Create S3 Tables client
-	client := NewS3TablesClient(cluster.s3Endpoint, testRegion, testAccessKey, testSecretKey)
-
-	// Run test suite
-	t.Run("TableBucketLifecycle", func(t *testing.T) {
-		testTableBucketLifecycle(t, client)
-	})
-
-	t.Run("NamespaceLifecycle", func(t *testing.T) {
-		testNamespaceLifecycle(t, client)
-	})
-
-	t.Run("TableLifecycle", func(t *testing.T) {
-		testTableLifecycle(t, client)
-	})
-
-	t.Run("TableBucketPolicy", func(t *testing.T) {
-		testTableBucketPolicy(t, client)
-	})
-
-	t.Run("TablePolicy", func(t *testing.T) {
-		testTablePolicy(t, client)
-	})
-
-	t.Run("Tagging", func(t *testing.T) {
-		testTagging(t, client)
-	})
-
-	t.Run("TargetOperations", func(t *testing.T) {
-		testTargetOperations(t, client)
-	})
-}
-
-func testTableBucketLifecycle(t *testing.T, client *S3TablesClient) {
-	bucketName := "test-bucket-" + randomString(8)
-
-	// Create table bucket
-	createResp, err := client.CreateTableBucket(bucketName, nil)
-	require.NoError(t, err, "Failed to create table bucket")
-	assert.Contains(t, createResp.ARN, bucketName)
-	t.Logf("✓ Created table bucket: %s", createResp.ARN)
-
-	// Get table bucket
-	getResp, err := client.GetTableBucket(createResp.ARN)
-	require.NoError(t, err, "Failed to get table bucket")
-	assert.Equal(t, bucketName, getResp.Name)
-	t.Logf("✓ Got table bucket: %s", getResp.Name)
-
-	// List table buckets
-	listResp, err := client.ListTableBuckets("", "", 0)
-	require.NoError(t, err, "Failed to list table buckets")
-	found := false
-	for _, b := range listResp.TableBuckets {
-		if b.Name == bucketName {
-			found = true
-			break
-		}
-	}
-	assert.True(t, found, "Created bucket should appear in list")
-	t.Logf("✓ Listed table buckets, found %d buckets", len(listResp.TableBuckets))
-
-	// Delete table bucket
-	err = client.DeleteTableBucket(createResp.ARN)
-	require.NoError(t, err, "Failed to delete table bucket")
-	t.Logf("✓ Deleted table bucket: %s", bucketName)
-
-	// Verify bucket is deleted
-	_, err = client.GetTableBucket(createResp.ARN)
-	assert.Error(t, err, "Bucket should not exist after deletion")
-}
-
-func testNamespaceLifecycle(t *testing.T, client *S3TablesClient) {
-	bucketName := "test-ns-bucket-" + randomString(8)
-	namespaceName := "test_namespace"
-
-	// Create table bucket first
-	createBucketResp, err := client.CreateTableBucket(bucketName, nil)
-	require.NoError(t, err, "Failed to create table bucket")
-	defer client.DeleteTableBucket(createBucketResp.ARN)
-
-	bucketARN := createBucketResp.ARN
-
-	// Create namespace
-	createNsResp, err := client.CreateNamespace(bucketARN, []string{namespaceName})
-	require.NoError(t, err, "Failed to create namespace")
-	assert.Equal(t, []string{namespaceName}, createNsResp.Namespace)
-	t.Logf("✓ Created namespace: %s", namespaceName)
-
-	// Get namespace
-	getNsResp, err := client.GetNamespace(bucketARN, []string{namespaceName})
-	require.NoError(t, err, "Failed to get namespace")
-	assert.Equal(t, []string{namespaceName}, getNsResp.Namespace)
-	t.Logf("✓ Got namespace: %v", getNsResp.Namespace)
-
-	// List namespaces
-	listNsResp, err := client.ListNamespaces(bucketARN, "", "", 0)
-	require.NoError(t, err, "Failed to list namespaces")
-	found := false
-	for _, ns := range listNsResp.Namespaces {
-		if len(ns.Namespace) > 0 && ns.Namespace[0] == namespaceName {
-			found = true
-			break
-		}
-	}
-	assert.True(t, found, "Created namespace should appear in list")
-	t.Logf("✓ Listed namespaces, found %d namespaces", len(listNsResp.Namespaces))
-
-	// Delete namespace
-	err = client.DeleteNamespace(bucketARN, []string{namespaceName})
-	require.NoError(t, err, "Failed to delete namespace")
-	t.Logf("✓ Deleted namespace: %s", namespaceName)
-
-	// Verify namespace is deleted
-	_, err = client.GetNamespace(bucketARN, []string{namespaceName})
-	assert.Error(t, err, "Namespace should not exist after deletion")
-}
-
-func testTableLifecycle(t *testing.T, client *S3TablesClient) {
-	bucketName := "test-table-bucket-" + randomString(8)
-	namespaceName := "test_ns"
-	tableName := "test_table"
-
-	// Create table bucket
-	createBucketResp, err := client.CreateTableBucket(bucketName, nil)
-	require.NoError(t, err, "Failed to create table bucket")
-	defer client.DeleteTableBucket(createBucketResp.ARN)
-
-	bucketARN := createBucketResp.ARN
-
-	// Create namespace
-	_, err = client.CreateNamespace(bucketARN, []string{namespaceName})
-	require.NoError(t, err, "Failed to create namespace")
-	defer client.DeleteNamespace(bucketARN, []string{namespaceName})
-
-	// Create table with Iceberg schema
-	icebergMetadata := &s3tables.TableMetadata{
-		Iceberg: &s3tables.IcebergMetadata{
-			Schema: s3tables.IcebergSchema{
-				Fields: []s3tables.IcebergSchemaField{
-					{Name: "id", Type: "int", Required: true},
-					{Name: "name", Type: "string"},
-					{Name: "value", Type: "int"},
-				},
-			},
-		},
-	}
-
-	createTableResp, err := client.CreateTable(bucketARN, []string{namespaceName}, tableName, "ICEBERG", icebergMetadata, nil)
-	require.NoError(t, err, "Failed to create table")
-	assert.NotEmpty(t, createTableResp.TableARN)
-	assert.NotEmpty(t, createTableResp.VersionToken)
-	t.Logf("✓ Created table: %s (version: %s)", createTableResp.TableARN, createTableResp.VersionToken)
-
-	// Get table
-	getTableResp, err := client.GetTable(bucketARN, []string{namespaceName}, tableName)
-	require.NoError(t, err, "Failed to get table")
-	assert.Equal(t, tableName, getTableResp.Name)
-	assert.Equal(t, "ICEBERG", getTableResp.Format)
-	t.Logf("✓ Got table: %s (format: %s)", getTableResp.Name, getTableResp.Format)
-
-	// List tables
-	listTablesResp, err := client.ListTables(bucketARN, []string{namespaceName}, "", "", 0)
-	require.NoError(t, err, "Failed to list tables")
-	found := false
-	for _, tbl := range listTablesResp.Tables {
-		if tbl.Name == tableName {
-			found = true
-			break
-		}
-	}
-	assert.True(t, found, "Created table should appear in list")
-	t.Logf("✓ Listed tables, found %d tables", len(listTablesResp.Tables))
-
-	// Delete table
-	err = client.DeleteTable(bucketARN, []string{namespaceName}, tableName)
-	require.NoError(t, err, "Failed to delete table")
-	t.Logf("✓ Deleted table: %s", tableName)
-
-	// Verify table is deleted
-	_, err = client.GetTable(bucketARN, []string{namespaceName}, tableName)
-	assert.Error(t, err, "Table should not exist after deletion")
-}
-
-func testTableBucketPolicy(t *testing.T, client *S3TablesClient) {
-	bucketName := "test-policy-bucket-" + randomString(8)
-
-	// Create table bucket
-	createBucketResp, err := client.CreateTableBucket(bucketName, nil)
-	require.NoError(t, err, "Failed to create table bucket")
-	defer client.DeleteTableBucket(createBucketResp.ARN)
-
-	bucketARN := createBucketResp.ARN
-
-	// Put bucket policy
-	policy := `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":"*","Action":"s3tables:*","Resource":"*"}]}`
-	err = client.PutTableBucketPolicy(bucketARN, policy)
-	require.NoError(t, err, "Failed to put table bucket policy")
-	t.Logf("✓ Put table bucket policy")
-
-	// Get bucket policy
-	getPolicyResp, err := client.GetTableBucketPolicy(bucketARN)
-	require.NoError(t, err, "Failed to get table bucket policy")
-	assert.Equal(t, policy, getPolicyResp.ResourcePolicy)
-	t.Logf("✓ Got table bucket policy")
-
-	// Delete bucket policy
-	err = client.DeleteTableBucketPolicy(bucketARN)
-	require.NoError(t, err, "Failed to delete table bucket policy")
-	t.Logf("✓ Deleted table bucket policy")
-
-	// Verify policy is deleted
-	_, err = client.GetTableBucketPolicy(bucketARN)
-	assert.Error(t, err, "Policy should not exist after deletion")
-}
-
-func testTablePolicy(t *testing.T, client *S3TablesClient) {
-	bucketName := "test-table-policy-bucket-" + randomString(8)
-	namespaceName := "test_ns"
-	tableName := "test_table"
-
-	// Create table bucket
-	createBucketResp, err := client.CreateTableBucket(bucketName, nil)
-	require.NoError(t, err, "Failed to create table bucket")
-	defer client.DeleteTableBucket(createBucketResp.ARN)
-
-	bucketARN := createBucketResp.ARN
-
-	// Create namespace
-	_, err = client.CreateNamespace(bucketARN, []string{namespaceName})
-	require.NoError(t, err, "Failed to create namespace")
-	defer client.DeleteNamespace(bucketARN, []string{namespaceName})
-
-	// Create table
-	icebergMetadata := &s3tables.TableMetadata{
-		Iceberg: &s3tables.IcebergMetadata{
-			Schema: s3tables.IcebergSchema{
-				Fields: []s3tables.IcebergSchemaField{
-					{Name: "id", Type: "int", Required: true},
-					{Name: "name", Type: "string"},
-				},
-			},
-		},
-	}
-
-	createTableResp, err := client.CreateTable(bucketARN, []string{namespaceName}, tableName, "ICEBERG", icebergMetadata, nil)
-	require.NoError(t, err, "Failed to create table")
-	defer client.DeleteTable(bucketARN, []string{namespaceName}, tableName)
-
-	t.Logf("✓ Created table: %s", createTableResp.TableARN)
-
-	// Verify no policy exists initially
-	_, err = client.GetTablePolicy(bucketARN, []string{namespaceName}, tableName)
-	assert.Error(t, err, "Policy should not exist initially")
-	t.Logf("✓ Verified no policy exists initially")
-
-	// Put table policy
-	policy := `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":"*","Action":"s3tables:*","Resource":"*"}]}`
-	err = client.PutTablePolicy(bucketARN, []string{namespaceName}, tableName, policy)
-	require.NoError(t, err, "Failed to put table policy")
-	t.Logf("✓ Put table policy")
-
-	// Get table policy
-	getPolicyResp, err := client.GetTablePolicy(bucketARN, []string{namespaceName}, tableName)
-	require.NoError(t, err, "Failed to get table policy")
-	assert.Equal(t, policy, getPolicyResp.ResourcePolicy)
-	t.Logf("✓ Got table policy")
-
-	// Delete table policy
-	err = client.DeleteTablePolicy(bucketARN, []string{namespaceName}, tableName)
-	require.NoError(t, err, "Failed to delete table policy")
-	t.Logf("✓ Deleted table policy")
-
-	// Verify policy is deleted
-	_, err = client.GetTablePolicy(bucketARN, []string{namespaceName}, tableName)
-	assert.Error(t, err, "Policy should not exist after deletion")
-	t.Logf("✓ Verified policy deletion")
-}
-
-func testTagging(t *testing.T, client *S3TablesClient) {
-	bucketName := "test-tag-bucket-" + randomString(8)
-
-	// Create table bucket with tags
-	initialTags := map[string]string{"Environment": "test"}
-	createBucketResp, err := client.CreateTableBucket(bucketName, initialTags)
-	require.NoError(t, err, "Failed to create table bucket")
-	defer client.DeleteTableBucket(createBucketResp.ARN)
-
-	bucketARN := createBucketResp.ARN
-
-	// List tags
-	listTagsResp, err := client.ListTagsForResource(bucketARN)
-	require.NoError(t, err, "Failed to list tags")
-	assert.Equal(t, "test", listTagsResp.Tags["Environment"])
-	t.Logf("✓ Listed tags: %v", listTagsResp.Tags)
-
-	// Add more tags
-	newTags := map[string]string{"Department": "Engineering"}
-	err = client.TagResource(bucketARN, newTags)
-	require.NoError(t, err, "Failed to tag resource")
-	t.Logf("✓ Added tags")
-
-	// Verify tags
-	listTagsResp, err = client.ListTagsForResource(bucketARN)
-	require.NoError(t, err, "Failed to list tags")
-	assert.Equal(t, "test", listTagsResp.Tags["Environment"])
-	assert.Equal(t, "Engineering", listTagsResp.Tags["Department"])
-	t.Logf("✓ Verified tags: %v", listTagsResp.Tags)
-
-	// Remove a tag
-	err = client.UntagResource(bucketARN, []string{"Environment"})
-	require.NoError(t, err, "Failed to untag resource")
-	t.Logf("✓ Removed tag")
-
-	// Verify tag is removed
-	listTagsResp, err = client.ListTagsForResource(bucketARN)
-	require.NoError(t, err, "Failed to list tags")
-	_, hasEnvironment := listTagsResp.Tags["Environment"]
-	assert.False(t, hasEnvironment, "Environment tag should be removed")
-	assert.Equal(t, "Engineering", listTagsResp.Tags["Department"])
-	t.Logf("✓ Verified tag removal")
-}
-
-func testTargetOperations(t *testing.T, client *S3TablesClient) {
-	bucketName := "test-target-bucket-" + randomString(8)
-
-	var createResp s3tables.CreateTableBucketResponse
-	err := client.doTargetRequestAndDecode("CreateTableBucket", &s3tables.CreateTableBucketRequest{
-		Name: bucketName,
-	}, &createResp)
-	require.NoError(t, err, "Failed to create table bucket via target")
-	defer client.doTargetRequestAndDecode("DeleteTableBucket", &s3tables.DeleteTableBucketRequest{
-		TableBucketARN: createResp.ARN,
-	}, nil)
-
-	var listResp s3tables.ListTableBucketsResponse
-	err = client.doTargetRequestAndDecode("ListTableBuckets", &s3tables.ListTableBucketsRequest{}, &listResp)
-	require.NoError(t, err, "Failed to list table buckets via target")
-	found := false
-	for _, b := range listResp.TableBuckets {
-		if b.Name == bucketName {
-			found = true
-			break
-		}
-	}
-	assert.True(t, found, "Created bucket should appear in target list")
-
-	var getResp s3tables.GetTableBucketResponse
-	err = client.doTargetRequestAndDecode("GetTableBucket", &s3tables.GetTableBucketRequest{
-		TableBucketARN: createResp.ARN,
-	}, &getResp)
-	require.NoError(t, err, "Failed to get table bucket via target")
-	assert.Equal(t, bucketName, getResp.Name)
-
-	namespaceName := "target_ns"
-	var createNsResp s3tables.CreateNamespaceResponse
-	err = client.doTargetRequestAndDecode("CreateNamespace", &s3tables.CreateNamespaceRequest{
-		TableBucketARN: createResp.ARN,
-		Namespace:      []string{namespaceName},
-	}, &createNsResp)
-	require.NoError(t, err, "Failed to create namespace via target")
-	defer client.doTargetRequestAndDecode("DeleteNamespace", &s3tables.DeleteNamespaceRequest{
-		TableBucketARN: createResp.ARN,
-		Namespace:      []string{namespaceName},
-	}, nil)
-
-	var listNsResp s3tables.ListNamespacesResponse
-	err = client.doTargetRequestAndDecode("ListNamespaces", &s3tables.ListNamespacesRequest{
-		TableBucketARN: createResp.ARN,
-	}, &listNsResp)
-	require.NoError(t, err, "Failed to list namespaces via target")
-
-	tableName := "target_table"
-	var createTableResp s3tables.CreateTableResponse
-	err = client.doTargetRequestAndDecode("CreateTable", &s3tables.CreateTableRequest{
-		TableBucketARN: createResp.ARN,
-		Namespace:      []string{namespaceName},
-		Name:           tableName,
-		Format:         "ICEBERG",
-	}, &createTableResp)
-	require.NoError(t, err, "Failed to create table via target")
-	defer client.doTargetRequestAndDecode("DeleteTable", &s3tables.DeleteTableRequest{
-		TableBucketARN: createResp.ARN,
-		Namespace:      []string{namespaceName},
-		Name:           tableName,
-	}, nil)
-
-	var listTablesResp s3tables.ListTablesResponse
-	err = client.doTargetRequestAndDecode("ListTables", &s3tables.ListTablesRequest{
-		TableBucketARN: createResp.ARN,
-		Namespace:      []string{namespaceName},
-	}, &listTablesResp)
-	require.NoError(t, err, "Failed to list tables via target")
-
-	var getTableResp s3tables.GetTableResponse
-	err = client.doTargetRequestAndDecode("GetTable", &s3tables.GetTableRequest{
-		TableBucketARN: createResp.ARN,
-		Namespace:      []string{namespaceName},
-		Name:           tableName,
-	}, &getTableResp)
-	require.NoError(t, err, "Failed to get table via target")
-	assert.Equal(t, tableName, getTableResp.Name)
-
-	policy := `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":"*","Action":"s3tables:*","Resource":"*"}]}`
-	err = client.doTargetRequestAndDecode("PutTableBucketPolicy", &s3tables.PutTableBucketPolicyRequest{
-		TableBucketARN: createResp.ARN,
-		ResourcePolicy: policy,
-	}, nil)
-	require.NoError(t, err, "Failed to put bucket policy via target")
-
-	var getPolicyResp s3tables.GetTableBucketPolicyResponse
-	err = client.doTargetRequestAndDecode("GetTableBucketPolicy", &s3tables.GetTableBucketPolicyRequest{
-		TableBucketARN: createResp.ARN,
-	}, &getPolicyResp)
-	require.NoError(t, err, "Failed to get bucket policy via target")
-	assert.Equal(t, policy, getPolicyResp.ResourcePolicy)
-
-	err = client.doTargetRequestAndDecode("DeleteTableBucketPolicy", &s3tables.DeleteTableBucketPolicyRequest{
-		TableBucketARN: createResp.ARN,
-	}, nil)
-	require.NoError(t, err, "Failed to delete bucket policy via target")
-
-	err = client.doTargetRequestAndDecode("TagResource", &s3tables.TagResourceRequest{
-		ResourceARN: createResp.ARN,
-		Tags:        map[string]string{"Environment": "test"},
-	}, nil)
-	require.NoError(t, err, "Failed to tag resource via target")
-
-	var listTagsResp s3tables.ListTagsForResourceResponse
-	err = client.doTargetRequestAndDecode("ListTagsForResource", &s3tables.ListTagsForResourceRequest{
-		ResourceARN: createResp.ARN,
-	}, &listTagsResp)
-	require.NoError(t, err, "Failed to list tags via target")
-	assert.Equal(t, "test", listTagsResp.Tags["Environment"])
-
-	err = client.doTargetRequestAndDecode("UntagResource", &s3tables.UntagResourceRequest{
-		ResourceARN: createResp.ARN,
-		TagKeys:     []string{"Environment"},
-	}, nil)
-	require.NoError(t, err, "Failed to untag resource via target")
-}
-
-// Helper functions
-
-// findAvailablePort finds an available port by binding to port 0
-func findAvailablePort() (int, error) {
-	listener, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		return 0, err
-	}
-	defer listener.Close()
-
-	addr := listener.Addr().(*net.TCPAddr)
-	return addr.Port, nil
-}
-
-// startMiniCluster starts a weed mini instance directly without exec
-func startMiniCluster(t *testing.T) (*TestCluster, error) {
-	// Find available ports
-	masterPort, err := findAvailablePort()
-	if err != nil {
-		return nil, fmt.Errorf("failed to find master port: %v", err)
-	}
-	masterGrpcPort, err := findAvailablePort()
-	if err != nil {
-		return nil, fmt.Errorf("failed to find master grpc port: %v", err)
-	}
-	volumePort, err := findAvailablePort()
-	if err != nil {
-		return nil, fmt.Errorf("failed to find volume port: %v", err)
-	}
-	volumeGrpcPort, err := findAvailablePort()
-	if err != nil {
-		return nil, fmt.Errorf("failed to find volume grpc port: %v", err)
-	}
-	filerPort, err := findAvailablePort()
-	if err != nil {
-		return nil, fmt.Errorf("failed to find filer port: %v", err)
-	}
-	filerGrpcPort, err := findAvailablePort()
-	if err != nil {
-		return nil, fmt.Errorf("failed to find filer grpc port: %v", err)
-	}
-	s3Port, err := findAvailablePort()
-	if err != nil {
-		return nil, fmt.Errorf("failed to find s3 port: %v", err)
-	}
-	s3GrpcPort, err := findAvailablePort()
-	if err != nil {
-		return nil, fmt.Errorf("failed to find s3 grpc port: %v", err)
-	}
-	// Create temporary directory for test data
-	testDir := t.TempDir()
-
-	// Ensure no configuration file from previous runs
-	configFile := filepath.Join(testDir, "mini.options")
-	_ = os.Remove(configFile)
-
-	// Create context with timeout
-	ctx, cancel := context.WithCancel(context.Background())
-
-	s3Endpoint := fmt.Sprintf("http://127.0.0.1:%d", s3Port)
-	cluster := &TestCluster{
-		t:          t,
-		dataDir:    testDir,
-		ctx:        ctx,
-		cancel:     cancel,
-		masterPort: masterPort,
-		volumePort: volumePort,
-		filerPort:  filerPort,
-		s3Port:     s3Port,
-		s3Endpoint: s3Endpoint,
-	}
-
-	// Create empty security.toml to disable JWT authentication in tests
-	securityToml := filepath.Join(testDir, "security.toml")
-	err = os.WriteFile(securityToml, []byte("# Empty security config for testing\n"), 0644)
-	if err != nil {
-		cancel()
-		return nil, fmt.Errorf("failed to create security.toml: %v", err)
-	}
-
-	// Start weed mini in a goroutine by calling the command directly
-	cluster.wg.Add(1)
-	go func() {
-		defer cluster.wg.Done()
-
-		// Protect global state mutation with a mutex
-		miniClusterMutex.Lock()
-		defer miniClusterMutex.Unlock()
-
-		// Save current directory and args
-		oldDir, _ := os.Getwd()
-		oldArgs := os.Args
-		defer func() {
-			os.Chdir(oldDir)
-			os.Args = oldArgs
-		}()
-
-		// Change to test directory so mini picks up security.toml
-		os.Chdir(testDir)
-
-		// Configure args for mini command
-		os.Args = []string{
-			"weed",
-			"-dir=" + testDir,
-			"-master.port=" + strconv.Itoa(masterPort),
-			"-master.port.grpc=" + strconv.Itoa(masterGrpcPort),
-			"-volume.port=" + strconv.Itoa(volumePort),
-			"-volume.port.grpc=" + strconv.Itoa(volumeGrpcPort),
-			"-filer.port=" + strconv.Itoa(filerPort),
-			"-filer.port.grpc=" + strconv.Itoa(filerGrpcPort),
-			"-s3.port=" + strconv.Itoa(s3Port),
-			"-s3.port.grpc=" + strconv.Itoa(s3GrpcPort),
-			"-webdav.port=0",               // Disable WebDAV
-			"-admin.ui=false",              // Disable admin UI
-			"-master.volumeSizeLimitMB=32", // Small volumes for testing
-			"-ip=127.0.0.1",
-			"-master.peers=none",     // Faster startup
-			"-s3.iam.readOnly=false", // Enable IAM write operations for tests
-		}
-
-		// Suppress most logging during tests
-		glog.MaxSize = 1024 * 1024
-
-		// Find and run the mini command
-		for _, cmd := range command.Commands {
-			if cmd.Name() == "mini" && cmd.Run != nil {
-				cmd.Flag.Parse(os.Args[1:])
-				args := cmd.Flag.Args()
-				command.MiniClusterCtx = ctx
-				cmd.Run(cmd, args)
-				command.MiniClusterCtx = nil
-				return
-			}
-		}
-	}()
-
-	// Wait for S3 service to be ready
-	err = waitForS3Ready(cluster.s3Endpoint, 30*time.Second)
-	if err != nil {
-		cancel()
-		return nil, fmt.Errorf("S3 service failed to start: %v", err)
-	}
-
-	cluster.isRunning = true
-
-	t.Logf("Test cluster started successfully at %s", cluster.s3Endpoint)
-	return cluster, nil
-}
-
-// Stop stops the test cluster
-func (c *TestCluster) Stop() {
-	if c.cancel != nil {
-		c.cancel()
-	}
-	// Give services time to shut down gracefully
-	if c.isRunning {
-		time.Sleep(500 * time.Millisecond)
-	}
-	// Wait for the mini goroutine to finish
-	done := make(chan struct{})
-	go func() {
-		c.wg.Wait()
-		close(done)
-	}()
-	timer := time.NewTimer(2 * time.Second)
-	defer timer.Stop()
-	select {
-	case <-done:
-		// Goroutine finished
-	case <-timer.C:
-		// Timeout - goroutine doesn't respond to context cancel
-		// This may indicate the mini cluster didn't shut down cleanly
-		c.t.Log("Warning: Test cluster shutdown timed out after 2 seconds")
-	}
-
-	// Reset the global cmdMini flags to prevent state leakage to other tests
-	for _, cmd := range command.Commands {
-		if cmd.Name() == "mini" {
-			// Reset flags to defaults
-			cmd.Flag.VisitAll(func(f *flag.Flag) {
-				// Reset to default value
-				f.Value.Set(f.DefValue)
-			})
-			break
-		}
-	}
-}
-
-// waitForS3Ready waits for the S3 service to be ready
-func waitForS3Ready(endpoint string, timeout time.Duration) error {
-	client := &http.Client{Timeout: 1 * time.Second}
-	deadline := time.Now().Add(timeout)
-
-	for time.Now().Before(deadline) {
-		resp, err := client.Get(endpoint)
-		if err == nil {
-			resp.Body.Close()
-			// Wait a bit more to ensure service is fully ready
-			time.Sleep(500 * time.Millisecond)
-			return nil
-		}
-		time.Sleep(200 * time.Millisecond)
-	}
-
-	return fmt.Errorf("timeout waiting for S3 service at %s", endpoint)
-}
-
-// randomString generates a random string for unique naming
-func randomString(length int) string {
-	const charset = "abcdefghijklmnopqrstuvwxyz0123456789"
-	b := make([]byte, length)
-	if _, err := cryptorand.Read(b); err != nil {
-		panic("failed to generate random string: " + err.Error())
-	}
-	for i := range b {
-		b[i] = charset[int(b[i])%len(charset)]
-	}
-	return string(b)
-}

test/s3tables/setup.go

@@ -1,53 +0,0 @@
-package s3tables
-
-import (
-	"context"
-	"net/http"
-	"sync"
-	"testing"
-	"time"
-)
-
-// TestCluster manages the weed mini instance for integration testing
-type TestCluster struct {
-	t          *testing.T
-	dataDir    string
-	ctx        context.Context
-	cancel     context.CancelFunc
-	isRunning  bool
-	startOnce  sync.Once
-	wg         sync.WaitGroup
-	masterPort int
-	volumePort int
-	filerPort  int
-	s3Port     int
-	s3Endpoint string
-}
-
-// S3TablesClient is a simple client for S3 Tables API
-type S3TablesClient struct {
-	endpoint  string
-	region    string
-	accessKey string
-	secretKey string
-	client    *http.Client
-}
-
-// NewS3TablesClient creates a new S3 Tables client
-func NewS3TablesClient(endpoint, region, accessKey, secretKey string) *S3TablesClient {
-	return &S3TablesClient{
-		endpoint:  endpoint,
-		region:    region,
-		accessKey: accessKey,
-		secretKey: secretKey,
-		client:    &http.Client{Timeout: 30 * time.Second},
-	}
-}
-
-// Test configuration constants
-const (
-	testRegion    = "us-west-2"
-	testAccessKey = "admin"
-	testSecretKey = "admin"
-	testAccountID = "111122223333"
-)

weed/admin/README.md

@@ -8,7 +8,6 @@ A modern web-based administration interface for SeaweedFS clusters built with Go
 - **Master Management**: Monitor master nodes and leadership status
 - **Volume Server Management**: View volume servers, capacity, and health
 - **Object Store Bucket Management**: Create, delete, and manage Object Store buckets with web interface
-- **S3 Tables Management**: Manage table buckets, namespaces, tables, tags, and policies via the admin UI
 - **System Health**: Overall cluster health monitoring
 - **Responsive Design**: Bootstrap-based UI that works on all devices
 - **Authentication**: Optional user authentication with sessions
@@ -97,6 +96,7 @@ make fmt
 weed/admin/
 ├── Makefile              # Admin-specific build tasks
 ├── README.md             # This file
+├── S3_BUCKETS.md         # Object Store bucket management documentation
 ├── admin.go              # Main application entry point
 ├── dash/                 # Server and handler logic
 │   ├── admin_server.go   # HTTP server setup
@@ -110,20 +110,20 @@ weed/admin/
     ├── app/              # Application templates
     │   ├── admin.templ   # Main dashboard template
     │   ├── s3_buckets.templ # Object Store bucket management template
-    │   ├── s3tables_*.templ # S3 Tables management templates
     │   └── *_templ.go    # Generated Go code
     └── layout/           # Layout templates
         ├── layout.templ  # Base layout template
         └── layout_templ.go # Generated Go code
 ```
 
-### Object Store Management
+### S3 Bucket Management
 
-The admin interface includes Object Store and S3 Tables management capabilities:
+The admin interface includes comprehensive Object Store bucket management capabilities. See [S3_BUCKETS.md](S3_BUCKETS.md) for detailed documentation on:
 
-- Create/delete Object Store buckets and adjust quotas or ownership.
-- Manage S3 Tables buckets, namespaces, and tables.
-- Update S3 Tables policies and tags via the UI and API endpoints.
+- Creating and deleting Object Store buckets
+- Viewing bucket contents and metadata
+- Managing bucket permissions and settings
+- API endpoints for programmatic access
 
 ## Usage
 
@@ -276,4 +276,4 @@ The admin component follows a clean architecture:
 - **Business Logic**: Handler functions in `dash/` package
 - **Data Layer**: Communicates with SeaweedFS masters and filers
 
-This separation makes the code maintainable and testable. 
+This separation makes the code maintainable and testable. 

weed/admin/dash/admin_server.go

@@ -1,6 +1,7 @@
 package dash
 
 import (
+	"bytes"
 	"context"
 	"fmt"
 	"net/http"
@@ -13,9 +14,11 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/admin/maintenance"
 	"github.com/seaweedfs/seaweedfs/weed/cluster"
 	"github.com/seaweedfs/seaweedfs/weed/credential"
+	"github.com/seaweedfs/seaweedfs/weed/filer"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/mq_pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/schema_pb"
@@ -27,10 +30,7 @@ import (
 
 	"github.com/seaweedfs/seaweedfs/weed/s3api"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
-	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables"
 	"github.com/seaweedfs/seaweedfs/weed/worker/tasks"
-
-	_ "github.com/seaweedfs/seaweedfs/weed/credential/grpc" // Register gRPC credential store
 )
 
 // FilerConfig holds filer configuration needed for bucket operations
@@ -102,8 +102,6 @@ type AdminServer struct {
 	collectionStatsCache          map[string]collectionStats
 	lastCollectionStatsUpdate     time.Time
 	collectionStatsCacheThreshold time.Duration
-
-	s3TablesManager *s3tables.Manager
 }
 
 // Type definitions moved to types.go
@@ -135,14 +133,13 @@ func NewAdminServer(masters string, templateFS http.FileSystem, dataDir string)
 		filerCacheExpiration:          30 * time.Second, // Cache filers for 30 seconds
 		configPersistence:             NewConfigPersistence(dataDir),
 		collectionStatsCacheThreshold: 30 * time.Second,
-		s3TablesManager:               newS3TablesManager(),
 	}
 
 	// Initialize topic retention purger
 	server.topicRetentionPurger = NewTopicRetentionPurger(server)
 
 	// Initialize credential manager with defaults
-	credentialManager, err := credential.NewCredentialManagerWithDefaults(credential.StoreTypeGrpc)
+	credentialManager, err := credential.NewCredentialManagerWithDefaults("")
 	if err != nil {
 		glog.Warningf("Failed to initialize credential manager: %v", err)
 		// Continue without credential manager - will fall back to legacy approach
@@ -521,13 +518,27 @@ func (s *AdminServer) DeleteS3Bucket(bucketName string) error {
 
 // GetObjectStoreUsers retrieves object store users from identity.json
 func (s *AdminServer) GetObjectStoreUsers(ctx context.Context) ([]ObjectStoreUser, error) {
-	if s.credentialManager == nil {
-		return []ObjectStoreUser{}, nil
-	}
+	s3cfg := &iam_pb.S3ApiConfiguration{}
+
+	// Load IAM configuration from filer
+	err := s.WithFilerClient(func(client filer_pb.SeaweedFilerClient) error {
+		var buf bytes.Buffer
+		if err := filer.ReadEntry(nil, client, filer.IamConfigDirectory, filer.IamIdentityFile, &buf); err != nil {
+			if err == filer_pb.ErrNotFound {
+				// If file doesn't exist, return empty configuration
+				return nil
+			}
+			return err
+		}
+		if buf.Len() > 0 {
+			return filer.ParseS3ConfigurationFromBytes(buf.Bytes(), s3cfg)
+		}
+		return nil
+	})
 
-	s3cfg, err := s.credentialManager.LoadConfiguration(ctx)
 	if err != nil {
-		return nil, fmt.Errorf("failed to load IAM configuration: %w", err)
+		glog.Errorf("Failed to load IAM configuration: %v", err)
+		return []ObjectStoreUser{}, nil // Return empty list instead of error for UI
 	}
 
 	var users []ObjectStoreUser
@@ -1816,11 +1827,6 @@ func (s *AdminServer) Shutdown() {
 		glog.Errorf("Failed to stop worker gRPC server: %v", err)
 	}
 
-	// Shutdown credential manager
-	if s.credentialManager != nil {
-		s.credentialManager.Shutdown()
-	}
-
 	glog.V(1).Infof("Admin server shutdown complete")
 }
 

weed/admin/dash/file_browser_data.go

@@ -39,11 +39,9 @@ type FileBrowserData struct {
 	Breadcrumbs []BreadcrumbItem `json:"breadcrumbs"`
 	Entries     []FileEntry      `json:"entries"`
 
-	LastUpdated       time.Time `json:"last_updated"`
-	IsBucketPath      bool      `json:"is_bucket_path"`
-	BucketName        string    `json:"bucket_name"`
-	IsTableBucketPath bool      `json:"is_table_bucket_path"`
-	TableBucketName   string    `json:"table_bucket_name"`
+	LastUpdated  time.Time `json:"last_updated"`
+	IsBucketPath bool      `json:"is_bucket_path"`
+	BucketName   string    `json:"bucket_name"`
 	// Pagination fields
 	PageSize            int    `json:"page_size"`
 	HasNextPage         bool   `json:"has_next_page"`
@@ -229,28 +227,15 @@ func (s *AdminServer) GetFileBrowser(dir string, lastFileName string, pageSize i
 		}
 	}
 
-	// Check if this is a table bucket path
-	isTableBucketPath := false
-	tableBucketName := ""
-	if strings.HasPrefix(dir, "/table-buckets/") {
-		isTableBucketPath = true
-		pathParts := strings.Split(strings.Trim(dir, "/"), "/")
-		if len(pathParts) >= 2 {
-			tableBucketName = pathParts[1]
-		}
-	}
-
 	return &FileBrowserData{
 		CurrentPath: dir,
 		ParentPath:  parentPath,
 		Breadcrumbs: breadcrumbs,
 		Entries:     entries,
 
-		LastUpdated:       time.Now(),
-		IsBucketPath:      isBucketPath,
-		BucketName:        bucketName,
-		IsTableBucketPath: isTableBucketPath,
-		TableBucketName:   tableBucketName,
+		LastUpdated:  time.Now(),
+		IsBucketPath: isBucketPath,
+		BucketName:   bucketName,
 		// Pagination metadata
 		PageSize:            pageSize,
 		HasNextPage:         hasNextPage,
@@ -287,12 +272,8 @@ func (s *AdminServer) generateBreadcrumbs(dir string) []BreadcrumbItem {
 		displayName := part
 		if len(breadcrumbs) == 1 && part == "buckets" {
 			displayName = "Object Store Buckets"
-		} else if len(breadcrumbs) == 1 && part == "table-buckets" {
-			displayName = "Table Buckets"
 		} else if len(breadcrumbs) == 2 && strings.HasPrefix(dir, "/buckets/") {
 			displayName = "📦 " + part // Add bucket icon to bucket name
-		} else if len(breadcrumbs) == 2 && strings.HasPrefix(dir, "/table-buckets/") {
-			displayName = "🧊 " + part
 		}
 
 		breadcrumbs = append(breadcrumbs, BreadcrumbItem{

weed/admin/dash/file_browser_data_test.go

@@ -51,15 +51,6 @@ func TestGenerateBreadcrumbs(t *testing.T) {
 				{Name: "📦 mybucket", Path: "/buckets/mybucket"},
 			},
 		},
-		{
-			name: "table bucket path",
-			path: "/table-buckets/mytablebucket",
-			expected: []BreadcrumbItem{
-				{Name: "Root", Path: "/"},
-				{Name: "Table Buckets", Path: "/table-buckets"},
-				{Name: "🧊 mytablebucket", Path: "/table-buckets/mytablebucket"},
-			},
-		},
 		{
 			name: "bucket nested path",
 			path: "/buckets/mybucket/folder",
@@ -70,16 +61,6 @@ func TestGenerateBreadcrumbs(t *testing.T) {
 				{Name: "folder", Path: "/buckets/mybucket/folder"},
 			},
 		},
-		{
-			name: "table bucket nested path",
-			path: "/table-buckets/mytablebucket/folder",
-			expected: []BreadcrumbItem{
-				{Name: "Root", Path: "/"},
-				{Name: "Table Buckets", Path: "/table-buckets"},
-				{Name: "🧊 mytablebucket", Path: "/table-buckets/mytablebucket"},
-				{Name: "folder", Path: "/table-buckets/mytablebucket/folder"},
-			},
-		},
 		{
 			name: "path with trailing slash",
 			path: "/folder/",
@@ -195,11 +176,6 @@ func TestParentPathCalculationLogic(t *testing.T) {
 			currentDir: "/buckets/mybucket",
 			expected:   "/buckets",
 		},
-		{
-			name:       "table bucket directory",
-			currentDir: "/table-buckets/mytablebucket",
-			expected:   "/table-buckets",
-		},
 	}
 
 	for _, tt := range tests {

weed/admin/dash/policies_management.go

@@ -56,33 +56,72 @@ func NewCredentialStorePolicyManager(credentialManager *credential.CredentialMan
 }
 
 // GetPolicies retrieves all IAM policies via credential store
-// Deprecated: This method delegates to the credential manager and will be moved/removed in a future release.
 func (cspm *CredentialStorePolicyManager) GetPolicies(ctx context.Context) (map[string]policy_engine.PolicyDocument, error) {
-	return cspm.credentialManager.GetPolicies(ctx)
+	// Get policies from credential store
+	// We'll use the credential store to access the filer indirectly
+	// Since policies are stored separately, we need to access the underlying store
+	store := cspm.credentialManager.GetStore()
+	glog.V(1).Infof("Getting policies from credential store: %T", store)
+
+	// Check if the store supports policy management
+	if policyStore, ok := store.(credential.PolicyManager); ok {
+		glog.V(1).Infof("Store supports policy management, calling GetPolicies")
+		policies, err := policyStore.GetPolicies(ctx)
+		if err != nil {
+			glog.Errorf("Error getting policies from store: %v", err)
+			return nil, err
+		}
+		glog.V(1).Infof("Got %d policies from store", len(policies))
+		return policies, nil
+	} else {
+		// Fallback: use empty policies for stores that don't support policies
+		glog.V(1).Infof("Credential store doesn't support policy management, returning empty policies")
+		return make(map[string]policy_engine.PolicyDocument), nil
+	}
 }
 
 // CreatePolicy creates a new IAM policy via credential store
-// Deprecated: This method delegates to the credential manager and will be moved/removed in a future release.
 func (cspm *CredentialStorePolicyManager) CreatePolicy(ctx context.Context, name string, document policy_engine.PolicyDocument) error {
-	return cspm.credentialManager.CreatePolicy(ctx, name, document)
+	store := cspm.credentialManager.GetStore()
+
+	if policyStore, ok := store.(credential.PolicyManager); ok {
+		return policyStore.CreatePolicy(ctx, name, document)
+	}
+
+	return fmt.Errorf("credential store doesn't support policy creation")
 }
 
 // UpdatePolicy updates an existing IAM policy via credential store
-// Deprecated: This method delegates to the credential manager and will be moved/removed in a future release.
 func (cspm *CredentialStorePolicyManager) UpdatePolicy(ctx context.Context, name string, document policy_engine.PolicyDocument) error {
-	return cspm.credentialManager.UpdatePolicy(ctx, name, document)
+	store := cspm.credentialManager.GetStore()
+
+	if policyStore, ok := store.(credential.PolicyManager); ok {
+		return policyStore.UpdatePolicy(ctx, name, document)
+	}
+
+	return fmt.Errorf("credential store doesn't support policy updates")
 }
 
 // DeletePolicy deletes an IAM policy via credential store
-// Deprecated: This method delegates to the credential manager and will be moved/removed in a future release.
 func (cspm *CredentialStorePolicyManager) DeletePolicy(ctx context.Context, name string) error {
-	return cspm.credentialManager.DeletePolicy(ctx, name)
+	store := cspm.credentialManager.GetStore()
+
+	if policyStore, ok := store.(credential.PolicyManager); ok {
+		return policyStore.DeletePolicy(ctx, name)
+	}
+
+	return fmt.Errorf("credential store doesn't support policy deletion")
 }
 
 // GetPolicy retrieves a specific IAM policy via credential store
-// Deprecated: This method delegates to the credential manager and will be moved/removed in a future release.
 func (cspm *CredentialStorePolicyManager) GetPolicy(ctx context.Context, name string) (*policy_engine.PolicyDocument, error) {
-	return cspm.credentialManager.GetPolicy(ctx, name)
+	store := cspm.credentialManager.GetStore()
+
+	if policyStore, ok := store.(credential.PolicyManager); ok {
+		return policyStore.GetPolicy(ctx, name)
+	}
+
+	return nil, fmt.Errorf("credential store doesn't support policy retrieval")
 }
 
 // AdminServer policy management methods using credential.PolicyManager

weed/admin/dash/s3tables_management.go

@@ -1,605 +0,0 @@
-package dash
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"net/http"
-	"strings"
-	"time"
-
-	"github.com/gin-gonic/gin"
-	"github.com/seaweedfs/seaweedfs/weed/glog"
-	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
-	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
-	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables"
-)
-
-// S3Tables data structures for admin UI
-
-type S3TablesBucketsData struct {
-	Username     string                  `json:"username"`
-	Buckets      []S3TablesBucketSummary `json:"buckets"`
-	TotalBuckets int                     `json:"total_buckets"`
-	LastUpdated  time.Time               `json:"last_updated"`
-}
-
-type S3TablesBucketSummary struct {
-	ARN            string    `json:"arn"`
-	Name           string    `json:"name"`
-	OwnerAccountID string    `json:"ownerAccountId"`
-	CreatedAt      time.Time `json:"createdAt"`
-}
-
-type S3TablesNamespacesData struct {
-	Username        string                      `json:"username"`
-	BucketARN       string                      `json:"bucket_arn"`
-	Namespaces      []s3tables.NamespaceSummary `json:"namespaces"`
-	TotalNamespaces int                         `json:"total_namespaces"`
-	LastUpdated     time.Time                   `json:"last_updated"`
-}
-
-type S3TablesTablesData struct {
-	Username    string                  `json:"username"`
-	BucketARN   string                  `json:"bucket_arn"`
-	Namespace   string                  `json:"namespace"`
-	Tables      []s3tables.TableSummary `json:"tables"`
-	TotalTables int                     `json:"total_tables"`
-	LastUpdated time.Time               `json:"last_updated"`
-}
-
-type tableBucketMetadata struct {
-	Name           string    `json:"name"`
-	CreatedAt      time.Time `json:"createdAt"`
-	OwnerAccountID string    `json:"ownerAccountId"`
-}
-
-// S3Tables manager helpers
-
-const s3TablesAdminListLimit = 1000
-
-func newS3TablesManager() *s3tables.Manager {
-	manager := s3tables.NewManager()
-	manager.SetAccountID(s3_constants.AccountAdminId)
-	return manager
-}
-
-func (s *AdminServer) executeS3TablesOperation(ctx context.Context, operation string, req interface{}, resp interface{}) error {
-	return s.WithFilerClient(func(client filer_pb.SeaweedFilerClient) error {
-		mgrClient := s3tables.NewManagerClient(client)
-		return s.s3TablesManager.Execute(ctx, mgrClient, operation, req, resp, s3_constants.AccountAdminId)
-	})
-}
-
-// S3Tables data retrieval for pages
-
-func (s *AdminServer) GetS3TablesBucketsData(ctx context.Context) (S3TablesBucketsData, error) {
-	var buckets []S3TablesBucketSummary
-	err := s.WithFilerClient(func(client filer_pb.SeaweedFilerClient) error {
-		resp, err := client.ListEntries(ctx, &filer_pb.ListEntriesRequest{
-			Directory:          s3tables.TablesPath,
-			Limit:              uint32(s3TablesAdminListLimit * 2),
-			InclusiveStartFrom: true,
-		})
-		if err != nil {
-			return err
-		}
-		for len(buckets) < s3TablesAdminListLimit {
-			entry, recvErr := resp.Recv()
-			if recvErr != nil {
-				if recvErr == io.EOF {
-					break
-				}
-				return recvErr
-			}
-			if entry.Entry == nil || !entry.Entry.IsDirectory {
-				continue
-			}
-			if strings.HasPrefix(entry.Entry.Name, ".") {
-				continue
-			}
-			metaBytes, ok := entry.Entry.Extended[s3tables.ExtendedKeyMetadata]
-			if !ok {
-				continue
-			}
-			var metadata tableBucketMetadata
-			if err := json.Unmarshal(metaBytes, &metadata); err != nil {
-				glog.V(1).Infof("S3Tables: failed to decode table bucket metadata for %s: %v", entry.Entry.Name, err)
-				continue
-			}
-			arn, err := s3tables.BuildBucketARN(s3tables.DefaultRegion, metadata.OwnerAccountID, entry.Entry.Name)
-			if err != nil {
-				glog.V(1).Infof("S3Tables: failed to build table bucket ARN for %s: %v", entry.Entry.Name, err)
-				continue
-			}
-			buckets = append(buckets, S3TablesBucketSummary{
-				ARN:            arn,
-				Name:           entry.Entry.Name,
-				OwnerAccountID: metadata.OwnerAccountID,
-				CreatedAt:      metadata.CreatedAt,
-			})
-		}
-		return nil
-	})
-	if err != nil {
-		return S3TablesBucketsData{}, err
-	}
-	return S3TablesBucketsData{
-		Buckets:      buckets,
-		TotalBuckets: len(buckets),
-		LastUpdated:  time.Now(),
-	}, nil
-}
-
-func (s *AdminServer) GetS3TablesNamespacesData(ctx context.Context, bucketArn string) (S3TablesNamespacesData, error) {
-	var resp s3tables.ListNamespacesResponse
-	req := &s3tables.ListNamespacesRequest{TableBucketARN: bucketArn, MaxNamespaces: s3TablesAdminListLimit}
-	if err := s.executeS3TablesOperation(ctx, "ListNamespaces", req, &resp); err != nil {
-		return S3TablesNamespacesData{}, err
-	}
-	return S3TablesNamespacesData{
-		BucketARN:       bucketArn,
-		Namespaces:      resp.Namespaces,
-		TotalNamespaces: len(resp.Namespaces),
-		LastUpdated:     time.Now(),
-	}, nil
-}
-
-func (s *AdminServer) GetS3TablesTablesData(ctx context.Context, bucketArn, namespace string) (S3TablesTablesData, error) {
-	var resp s3tables.ListTablesResponse
-	var ns []string
-	if namespace != "" {
-		ns = []string{namespace}
-	}
-	req := &s3tables.ListTablesRequest{TableBucketARN: bucketArn, Namespace: ns, MaxTables: s3TablesAdminListLimit}
-	if err := s.executeS3TablesOperation(ctx, "ListTables", req, &resp); err != nil {
-		return S3TablesTablesData{}, err
-	}
-	return S3TablesTablesData{
-		BucketARN:   bucketArn,
-		Namespace:   namespace,
-		Tables:      resp.Tables,
-		TotalTables: len(resp.Tables),
-		LastUpdated: time.Now(),
-	}, nil
-}
-
-// API handlers
-
-func (s *AdminServer) ListS3TablesBucketsAPI(c *gin.Context) {
-	data, err := s.GetS3TablesBucketsData(c.Request.Context())
-	if err != nil {
-		writeS3TablesError(c, err)
-		return
-	}
-	c.JSON(200, data)
-}
-
-func (s *AdminServer) CreateS3TablesBucket(c *gin.Context) {
-	var req struct {
-		Name  string            `json:"name"`
-		Tags  map[string]string `json:"tags"`
-		Owner string            `json:"owner"`
-	}
-	if err := c.ShouldBindJSON(&req); err != nil {
-		c.JSON(400, gin.H{"error": "Invalid request: " + err.Error()})
-		return
-	}
-	if req.Name == "" {
-		c.JSON(400, gin.H{"error": "Bucket name is required"})
-		return
-	}
-	owner := strings.TrimSpace(req.Owner)
-	if len(owner) > MaxOwnerNameLength {
-		c.JSON(400, gin.H{"error": fmt.Sprintf("Owner name must be %d characters or less", MaxOwnerNameLength)})
-		return
-	}
-	if len(req.Tags) > 0 {
-		if err := s3tables.ValidateTags(req.Tags); err != nil {
-			c.JSON(400, gin.H{"error": "Invalid tags: " + err.Error()})
-			return
-		}
-	}
-	createReq := &s3tables.CreateTableBucketRequest{Name: req.Name, Tags: req.Tags}
-	var resp s3tables.CreateTableBucketResponse
-	if err := s.executeS3TablesOperation(c.Request.Context(), "CreateTableBucket", createReq, &resp); err != nil {
-		writeS3TablesError(c, err)
-		return
-	}
-	if owner != "" {
-		if err := s.SetTableBucketOwner(c.Request.Context(), req.Name, owner); err != nil {
-			deleteReq := &s3tables.DeleteTableBucketRequest{TableBucketARN: resp.ARN}
-			if deleteErr := s.executeS3TablesOperation(c.Request.Context(), "DeleteTableBucket", deleteReq, nil); deleteErr != nil {
-				c.JSON(500, gin.H{"error": fmt.Sprintf("Failed to set table bucket owner: %v; rollback delete failed: %v", err, deleteErr)})
-				return
-			}
-			writeS3TablesError(c, err)
-			return
-		}
-	}
-	c.JSON(201, gin.H{"arn": resp.ARN})
-}
-
-func (s *AdminServer) SetTableBucketOwner(ctx context.Context, bucketName, owner string) error {
-	return s.WithFilerClient(func(client filer_pb.SeaweedFilerClient) error {
-		resp, err := client.LookupDirectoryEntry(ctx, &filer_pb.LookupDirectoryEntryRequest{
-			Directory: s3tables.TablesPath,
-			Name:      bucketName,
-		})
-		if err != nil {
-			return fmt.Errorf("lookup table bucket %s: %w", bucketName, err)
-		}
-		if resp.Entry == nil {
-			return fmt.Errorf("table bucket %s not found", bucketName)
-		}
-		entry := resp.Entry
-		if entry.Extended == nil {
-			return fmt.Errorf("table bucket %s metadata missing", bucketName)
-		}
-		metaBytes, ok := entry.Extended[s3tables.ExtendedKeyMetadata]
-		if !ok {
-			return fmt.Errorf("table bucket %s metadata missing", bucketName)
-		}
-		var metadata tableBucketMetadata
-		if err := json.Unmarshal(metaBytes, &metadata); err != nil {
-			return fmt.Errorf("failed to parse table bucket metadata: %w", err)
-		}
-		metadata.OwnerAccountID = owner
-		updated, err := json.Marshal(&metadata)
-		if err != nil {
-			return fmt.Errorf("failed to marshal table bucket metadata: %w", err)
-		}
-		entry.Extended[s3tables.ExtendedKeyMetadata] = updated
-		if _, err := client.UpdateEntry(ctx, &filer_pb.UpdateEntryRequest{
-			Directory: s3tables.TablesPath,
-			Entry:     entry,
-		}); err != nil {
-			return fmt.Errorf("failed to update table bucket owner: %w", err)
-		}
-		return nil
-	})
-}
-
-func (s *AdminServer) DeleteS3TablesBucket(c *gin.Context) {
-	bucketArn := c.Query("bucket")
-	if bucketArn == "" {
-		c.JSON(400, gin.H{"error": "Bucket ARN is required"})
-		return
-	}
-	req := &s3tables.DeleteTableBucketRequest{TableBucketARN: bucketArn}
-	if err := s.executeS3TablesOperation(c.Request.Context(), "DeleteTableBucket", req, nil); err != nil {
-		writeS3TablesError(c, err)
-		return
-	}
-	c.JSON(200, gin.H{"message": "Bucket deleted"})
-}
-
-func (s *AdminServer) ListS3TablesNamespacesAPI(c *gin.Context) {
-	bucketArn := c.Query("bucket")
-	if bucketArn == "" {
-		c.JSON(400, gin.H{"error": "bucket query parameter is required"})
-		return
-	}
-	data, err := s.GetS3TablesNamespacesData(c.Request.Context(), bucketArn)
-	if err != nil {
-		writeS3TablesError(c, err)
-		return
-	}
-	c.JSON(200, data)
-}
-
-func (s *AdminServer) CreateS3TablesNamespace(c *gin.Context) {
-	var req struct {
-		BucketARN string `json:"bucket_arn"`
-		Name      string `json:"name"`
-	}
-	if err := c.ShouldBindJSON(&req); err != nil {
-		c.JSON(400, gin.H{"error": "Invalid request: " + err.Error()})
-		return
-	}
-	if req.BucketARN == "" || req.Name == "" {
-		c.JSON(400, gin.H{"error": "bucket_arn and name are required"})
-		return
-	}
-	createReq := &s3tables.CreateNamespaceRequest{TableBucketARN: req.BucketARN, Namespace: []string{req.Name}}
-	var resp s3tables.CreateNamespaceResponse
-	if err := s.executeS3TablesOperation(c.Request.Context(), "CreateNamespace", createReq, &resp); err != nil {
-		writeS3TablesError(c, err)
-		return
-	}
-	c.JSON(201, gin.H{"namespace": resp.Namespace})
-}
-
-func (s *AdminServer) DeleteS3TablesNamespace(c *gin.Context) {
-	bucketArn := c.Query("bucket")
-	namespace := c.Query("name")
-	if bucketArn == "" || namespace == "" {
-		c.JSON(400, gin.H{"error": "bucket and name query parameters are required"})
-		return
-	}
-	req := &s3tables.DeleteNamespaceRequest{TableBucketARN: bucketArn, Namespace: []string{namespace}}
-	if err := s.executeS3TablesOperation(c.Request.Context(), "DeleteNamespace", req, nil); err != nil {
-		writeS3TablesError(c, err)
-		return
-	}
-	c.JSON(200, gin.H{"message": "Namespace deleted"})
-}
-
-func (s *AdminServer) ListS3TablesTablesAPI(c *gin.Context) {
-	bucketArn := c.Query("bucket")
-	if bucketArn == "" {
-		c.JSON(400, gin.H{"error": "bucket query parameter is required"})
-		return
-	}
-	namespace := c.Query("namespace")
-	data, err := s.GetS3TablesTablesData(c.Request.Context(), bucketArn, namespace)
-	if err != nil {
-		writeS3TablesError(c, err)
-		return
-	}
-	c.JSON(200, data)
-}
-
-func (s *AdminServer) CreateS3TablesTable(c *gin.Context) {
-	var req struct {
-		BucketARN string                  `json:"bucket_arn"`
-		Namespace string                  `json:"namespace"`
-		Name      string                  `json:"name"`
-		Format    string                  `json:"format"`
-		Tags      map[string]string       `json:"tags"`
-		Metadata  *s3tables.TableMetadata `json:"metadata"`
-	}
-	if err := c.ShouldBindJSON(&req); err != nil {
-		c.JSON(400, gin.H{"error": "Invalid request: " + err.Error()})
-		return
-	}
-	if req.BucketARN == "" || req.Namespace == "" || req.Name == "" {
-		c.JSON(400, gin.H{"error": "bucket_arn, namespace, and name are required"})
-		return
-	}
-	format := req.Format
-	if format == "" {
-		format = "ICEBERG"
-	}
-	if len(req.Tags) > 0 {
-		if err := s3tables.ValidateTags(req.Tags); err != nil {
-			c.JSON(400, gin.H{"error": "Invalid tags: " + err.Error()})
-			return
-		}
-	}
-	createReq := &s3tables.CreateTableRequest{
-		TableBucketARN: req.BucketARN,
-		Namespace:      []string{req.Namespace},
-		Name:           req.Name,
-		Format:         format,
-		Tags:           req.Tags,
-		Metadata:       req.Metadata,
-	}
-	var resp s3tables.CreateTableResponse
-	if err := s.executeS3TablesOperation(c.Request.Context(), "CreateTable", createReq, &resp); err != nil {
-		writeS3TablesError(c, err)
-		return
-	}
-	c.JSON(201, gin.H{"table_arn": resp.TableARN, "version_token": resp.VersionToken})
-}
-
-func (s *AdminServer) DeleteS3TablesTable(c *gin.Context) {
-	bucketArn := c.Query("bucket")
-	namespace := c.Query("namespace")
-	name := c.Query("name")
-	version := c.Query("version")
-	if bucketArn == "" || namespace == "" || name == "" {
-		c.JSON(400, gin.H{"error": "bucket, namespace, and name query parameters are required"})
-		return
-	}
-	req := &s3tables.DeleteTableRequest{TableBucketARN: bucketArn, Namespace: []string{namespace}, Name: name, VersionToken: version}
-	if err := s.executeS3TablesOperation(c.Request.Context(), "DeleteTable", req, nil); err != nil {
-		writeS3TablesError(c, err)
-		return
-	}
-	c.JSON(200, gin.H{"message": "Table deleted"})
-}
-
-func (s *AdminServer) PutS3TablesBucketPolicy(c *gin.Context) {
-	var req struct {
-		BucketARN string `json:"bucket_arn"`
-		Policy    string `json:"policy"`
-	}
-	if err := c.ShouldBindJSON(&req); err != nil {
-		c.JSON(400, gin.H{"error": "Invalid request: " + err.Error()})
-		return
-	}
-	if req.BucketARN == "" || req.Policy == "" {
-		c.JSON(400, gin.H{"error": "bucket_arn and policy are required"})
-		return
-	}
-	putReq := &s3tables.PutTableBucketPolicyRequest{TableBucketARN: req.BucketARN, ResourcePolicy: req.Policy}
-	if err := s.executeS3TablesOperation(c.Request.Context(), "PutTableBucketPolicy", putReq, nil); err != nil {
-		writeS3TablesError(c, err)
-		return
-	}
-	c.JSON(200, gin.H{"message": "Policy updated"})
-}
-
-func (s *AdminServer) GetS3TablesBucketPolicy(c *gin.Context) {
-	bucketArn := c.Query("bucket")
-	if bucketArn == "" {
-		c.JSON(400, gin.H{"error": "bucket query parameter is required"})
-		return
-	}
-	getReq := &s3tables.GetTableBucketPolicyRequest{TableBucketARN: bucketArn}
-	var resp s3tables.GetTableBucketPolicyResponse
-	if err := s.executeS3TablesOperation(c.Request.Context(), "GetTableBucketPolicy", getReq, &resp); err != nil {
-		writeS3TablesError(c, err)
-		return
-	}
-	c.JSON(200, gin.H{"policy": resp.ResourcePolicy})
-}
-
-func (s *AdminServer) DeleteS3TablesBucketPolicy(c *gin.Context) {
-	bucketArn := c.Query("bucket")
-	if bucketArn == "" {
-		c.JSON(400, gin.H{"error": "bucket query parameter is required"})
-		return
-	}
-	deleteReq := &s3tables.DeleteTableBucketPolicyRequest{TableBucketARN: bucketArn}
-	if err := s.executeS3TablesOperation(c.Request.Context(), "DeleteTableBucketPolicy", deleteReq, nil); err != nil {
-		writeS3TablesError(c, err)
-		return
-	}
-	c.JSON(200, gin.H{"message": "Policy deleted"})
-}
-
-func (s *AdminServer) PutS3TablesTablePolicy(c *gin.Context) {
-	var req struct {
-		BucketARN string `json:"bucket_arn"`
-		Namespace string `json:"namespace"`
-		Name      string `json:"name"`
-		Policy    string `json:"policy"`
-	}
-	if err := c.ShouldBindJSON(&req); err != nil {
-		c.JSON(400, gin.H{"error": "Invalid request: " + err.Error()})
-		return
-	}
-	if req.BucketARN == "" || req.Namespace == "" || req.Name == "" || req.Policy == "" {
-		c.JSON(400, gin.H{"error": "bucket_arn, namespace, name, and policy are required"})
-		return
-	}
-	putReq := &s3tables.PutTablePolicyRequest{TableBucketARN: req.BucketARN, Namespace: []string{req.Namespace}, Name: req.Name, ResourcePolicy: req.Policy}
-	if err := s.executeS3TablesOperation(c.Request.Context(), "PutTablePolicy", putReq, nil); err != nil {
-		writeS3TablesError(c, err)
-		return
-	}
-	c.JSON(200, gin.H{"message": "Policy updated"})
-}
-
-func (s *AdminServer) GetS3TablesTablePolicy(c *gin.Context) {
-	bucketArn := c.Query("bucket")
-	namespace := c.Query("namespace")
-	name := c.Query("name")
-	if bucketArn == "" || namespace == "" || name == "" {
-		c.JSON(400, gin.H{"error": "bucket, namespace, and name query parameters are required"})
-		return
-	}
-	getReq := &s3tables.GetTablePolicyRequest{TableBucketARN: bucketArn, Namespace: []string{namespace}, Name: name}
-	var resp s3tables.GetTablePolicyResponse
-	if err := s.executeS3TablesOperation(c.Request.Context(), "GetTablePolicy", getReq, &resp); err != nil {
-		writeS3TablesError(c, err)
-		return
-	}
-	c.JSON(200, gin.H{"policy": resp.ResourcePolicy})
-}
-
-func (s *AdminServer) DeleteS3TablesTablePolicy(c *gin.Context) {
-	bucketArn := c.Query("bucket")
-	namespace := c.Query("namespace")
-	name := c.Query("name")
-	if bucketArn == "" || namespace == "" || name == "" {
-		c.JSON(400, gin.H{"error": "bucket, namespace, and name query parameters are required"})
-		return
-	}
-	deleteReq := &s3tables.DeleteTablePolicyRequest{TableBucketARN: bucketArn, Namespace: []string{namespace}, Name: name}
-	if err := s.executeS3TablesOperation(c.Request.Context(), "DeleteTablePolicy", deleteReq, nil); err != nil {
-		writeS3TablesError(c, err)
-		return
-	}
-	c.JSON(200, gin.H{"message": "Policy deleted"})
-}
-
-func (s *AdminServer) TagS3TablesResource(c *gin.Context) {
-	var req struct {
-		ResourceARN string            `json:"resource_arn"`
-		Tags        map[string]string `json:"tags"`
-	}
-	if err := c.ShouldBindJSON(&req); err != nil {
-		c.JSON(400, gin.H{"error": "Invalid request: " + err.Error()})
-		return
-	}
-	if req.ResourceARN == "" || len(req.Tags) == 0 {
-		c.JSON(400, gin.H{"error": "resource_arn and tags are required"})
-		return
-	}
-	if err := s3tables.ValidateTags(req.Tags); err != nil {
-		c.JSON(400, gin.H{"error": "Invalid tags: " + err.Error()})
-		return
-	}
-	tagReq := &s3tables.TagResourceRequest{ResourceARN: req.ResourceARN, Tags: req.Tags}
-	if err := s.executeS3TablesOperation(c.Request.Context(), "TagResource", tagReq, nil); err != nil {
-		writeS3TablesError(c, err)
-		return
-	}
-	c.JSON(200, gin.H{"message": "Tags updated"})
-}
-
-func (s *AdminServer) ListS3TablesTags(c *gin.Context) {
-	resourceArn := c.Query("arn")
-	if resourceArn == "" {
-		c.JSON(400, gin.H{"error": "arn query parameter is required"})
-		return
-	}
-	listReq := &s3tables.ListTagsForResourceRequest{ResourceARN: resourceArn}
-	var resp s3tables.ListTagsForResourceResponse
-	if err := s.executeS3TablesOperation(c.Request.Context(), "ListTagsForResource", listReq, &resp); err != nil {
-		writeS3TablesError(c, err)
-		return
-	}
-	c.JSON(200, resp)
-}
-
-func (s *AdminServer) UntagS3TablesResource(c *gin.Context) {
-	var req struct {
-		ResourceARN string   `json:"resource_arn"`
-		TagKeys     []string `json:"tag_keys"`
-	}
-	if err := c.ShouldBindJSON(&req); err != nil {
-		c.JSON(400, gin.H{"error": "Invalid request: " + err.Error()})
-		return
-	}
-	if req.ResourceARN == "" || len(req.TagKeys) == 0 {
-		c.JSON(400, gin.H{"error": "resource_arn and tag_keys are required"})
-		return
-	}
-	untagReq := &s3tables.UntagResourceRequest{ResourceARN: req.ResourceARN, TagKeys: req.TagKeys}
-	if err := s.executeS3TablesOperation(c.Request.Context(), "UntagResource", untagReq, nil); err != nil {
-		writeS3TablesError(c, err)
-		return
-	}
-	c.JSON(200, gin.H{"message": "Tags removed"})
-}
-
-func parseS3TablesErrorMessage(err error) string {
-	if err == nil {
-		return ""
-	}
-	var s3Err *s3tables.S3TablesError
-	if errors.As(err, &s3Err) {
-		if s3Err.Message != "" {
-			return fmt.Sprintf("%s: %s", s3Err.Type, s3Err.Message)
-		}
-		return s3Err.Type
-	}
-	return err.Error()
-}
-
-func writeS3TablesError(c *gin.Context, err error) {
-	c.JSON(s3TablesErrorStatus(err), gin.H{"error": parseS3TablesErrorMessage(err)})
-}
-
-func s3TablesErrorStatus(err error) int {
-	var s3Err *s3tables.S3TablesError
-	if errors.As(err, &s3Err) {
-		switch s3Err.Type {
-		case s3tables.ErrCodeInvalidRequest:
-			return http.StatusBadRequest
-		case s3tables.ErrCodeNoSuchBucket, s3tables.ErrCodeNoSuchNamespace, s3tables.ErrCodeNoSuchTable, s3tables.ErrCodeNoSuchPolicy:
-			return http.StatusNotFound
-		case s3tables.ErrCodeAccessDenied:
-			return http.StatusForbidden
-		case s3tables.ErrCodeBucketAlreadyExists, s3tables.ErrCodeNamespaceAlreadyExists, s3tables.ErrCodeTableAlreadyExists, s3tables.ErrCodeConflict:
-			return http.StatusConflict
-		}
-	}
-	return http.StatusInternalServerError
-}

weed/admin/dash/service_account_helpers.go

@@ -0,0 +1,53 @@
+package dash
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
+)
+
+// identityToServiceAccount converts an IAM identity to a ServiceAccount struct
+// This helper reduces code duplication across GetServiceAccounts, GetServiceAccountDetails,
+// UpdateServiceAccount, and GetServiceAccountByAccessKey
+func identityToServiceAccount(identity *iam_pb.Identity) (*ServiceAccount, error) {
+	if identity == nil {
+		return nil, fmt.Errorf("identity cannot be nil")
+	}
+	if !strings.HasPrefix(identity.GetName(), serviceAccountPrefix) {
+		return nil, fmt.Errorf("not a service account: %s", identity.GetName())
+	}
+
+	parts := strings.SplitN(identity.GetName(), ":", 3)
+	if len(parts) < 3 {
+		return nil, fmt.Errorf("invalid service account ID format")
+	}
+
+	sa := &ServiceAccount{
+		ID:         identity.GetName(),
+		ParentUser: parts[1],
+		Status:     StatusActive,
+		CreateDate: getCreationDate(identity.GetActions()),
+		Expiration: getExpiration(identity.GetActions()),
+	}
+
+	// Get description from account display name
+	if identity.Account != nil {
+		sa.Description = identity.Account.GetDisplayName()
+	}
+
+	// Get access key from credentials
+	if len(identity.Credentials) > 0 {
+		sa.AccessKeyId = identity.Credentials[0].GetAccessKey()
+	}
+
+	// Check if disabled
+	for _, action := range identity.GetActions() {
+		if action == disabledAction {
+			sa.Status = StatusInactive
+			break
+		}
+	}
+
+	return sa, nil
+}

weed/admin/dash/service_account_management.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"strconv"
 	"strings"
 	"time"
 
@@ -17,57 +18,140 @@ var (
 )
 
 const (
-	serviceAccountPrefix = "sa:"
-	accessKeyPrefix      = "ABIA" // Service account access keys use ABIA prefix
+	createdAtActionPrefix  = "createdAt:"
+	expirationActionPrefix = "expiresAt:"
+	disabledAction         = "__disabled__"
+	serviceAccountPrefix   = "sa:"
+	accessKeyPrefix        = "ABIA" // Service account access keys use ABIA prefix
 
 	// Status constants
 	StatusActive   = "Active"
 	StatusInactive = "Inactive"
 )
 
+// Helper functions for managing creation timestamps in actions
+func getCreationDate(actions []string) time.Time {
+	for _, action := range actions {
+		if strings.HasPrefix(action, createdAtActionPrefix) {
+			timestampStr := strings.TrimPrefix(action, createdAtActionPrefix)
+			if timestamp, err := strconv.ParseInt(timestampStr, 10, 64); err == nil {
+				return time.Unix(timestamp, 0)
+			}
+		}
+	}
+	return time.Time{} // Return zero time for legacy service accounts without stored creation date
+}
+
+func setCreationDate(actions []string, createDate time.Time) []string {
+	// Remove any existing createdAt action
+	filtered := make([]string, 0, len(actions)+1)
+	for _, action := range actions {
+		if !strings.HasPrefix(action, createdAtActionPrefix) {
+			filtered = append(filtered, action)
+		}
+	}
+	// Add new createdAt action
+	filtered = append(filtered, fmt.Sprintf("%s%d", createdAtActionPrefix, createDate.Unix()))
+	return filtered
+}
+
+// Helper functions for managing expiration timestamps in actions
+func getExpiration(actions []string) time.Time {
+	for _, action := range actions {
+		if strings.HasPrefix(action, expirationActionPrefix) {
+			timestampStr := strings.TrimPrefix(action, expirationActionPrefix)
+			if timestamp, err := strconv.ParseInt(timestampStr, 10, 64); err == nil {
+				return time.Unix(timestamp, 0)
+			}
+		}
+	}
+	return time.Time{} // No expiration set
+}
+
+func setExpiration(actions []string, expiration time.Time) []string {
+	// Remove any existing expiration action
+	filtered := make([]string, 0, len(actions)+1)
+	for _, action := range actions {
+		if !strings.HasPrefix(action, expirationActionPrefix) {
+			filtered = append(filtered, action)
+		}
+	}
+	// Add new expiration action if not zero
+	if !expiration.IsZero() {
+		filtered = append(filtered, fmt.Sprintf("%s%d", expirationActionPrefix, expiration.Unix()))
+	}
+	return filtered
+}
+
 // GetServiceAccounts returns all service accounts, optionally filtered by parent user
+// NOTE: Service accounts are stored as special identities with "sa:" prefix
 func (s *AdminServer) GetServiceAccounts(ctx context.Context, parentUser string) ([]ServiceAccount, error) {
 	if s.credentialManager == nil {
 		return nil, fmt.Errorf("credential manager not available")
 	}
 
-	pbAccounts, err := s.credentialManager.ListServiceAccounts(ctx)
+	// Load the current configuration to find service account identities
+	config, err := s.credentialManager.LoadConfiguration(ctx)
 	if err != nil {
-		return nil, fmt.Errorf("failed to list service accounts: %w", err)
+		return nil, fmt.Errorf("failed to load configuration: %w", err)
 	}
 
 	var accounts []ServiceAccount
-	for _, sa := range pbAccounts {
-		if sa == nil {
+
+	// Service accounts are stored as identities with "sa:" prefix in their name
+	// Format: "sa:<parent_user>:<uuid>"
+	for _, identity := range config.GetIdentities() {
+		if !strings.HasPrefix(identity.GetName(), serviceAccountPrefix) {
 			continue
 		}
+
+		parts := strings.SplitN(identity.GetName(), ":", 3)
+		if len(parts) < 3 {
+			continue
+		}
+
+		parent := parts[1]
+		saId := identity.GetName()
+
 		// Filter by parent user if specified
-		if parentUser != "" && sa.ParentUser != parentUser {
+		if parentUser != "" && parent != parentUser {
 			continue
 		}
 
+		// Extract description from account display name if available
+		description := ""
 		status := StatusActive
-		if sa.Disabled {
-			status = StatusInactive
+		if identity.Account != nil {
+			description = identity.Account.GetDisplayName()
 		}
 
-		account := ServiceAccount{
-			ID:          sa.Id,
-			ParentUser:  sa.ParentUser,
-			Description: sa.Description,
+		// Get access key from credentials
+		accessKey := ""
+		if len(identity.Credentials) > 0 {
+			accessKey = identity.Credentials[0].GetAccessKey()
+			// Service accounts use ABIA prefix
+			if !strings.HasPrefix(accessKey, accessKeyPrefix) {
+				continue // Not a service account
+			}
+		}
+
+		// Check if disabled (stored in actions)
+		for _, action := range identity.GetActions() {
+			if action == disabledAction {
+				status = StatusInactive
+				break
+			}
+		}
+
+		accounts = append(accounts, ServiceAccount{
+			ID:          saId,
+			ParentUser:  parent,
+			Description: description,
+			AccessKeyId: accessKey,
 			Status:      status,
-			CreateDate:  time.Unix(sa.CreatedAt, 0),
-		}
-
-		if sa.Expiration > 0 {
-			account.Expiration = time.Unix(sa.Expiration, 0)
-		}
-
-		if sa.Credential != nil {
-			account.AccessKeyId = sa.Credential.AccessKey
-		}
-
-		accounts = append(accounts, account)
+			CreateDate:  getCreationDate(identity.GetActions()),
+			Expiration:  getExpiration(identity.GetActions()),
+		})
 	}
 
 	return accounts, nil
@@ -79,33 +163,43 @@ func (s *AdminServer) GetServiceAccountDetails(ctx context.Context, id string) (
 		return nil, fmt.Errorf("credential manager not available")
 	}
 
-	sa, err := s.credentialManager.GetServiceAccount(ctx, id)
+	// Get the identity
+	identity, err := s.credentialManager.GetUser(ctx, id)
 	if err != nil {
-		return nil, fmt.Errorf("failed to get service account: %w", err)
-	}
-	if sa == nil {
-		return nil, ErrServiceAccountNotFound
+		return nil, fmt.Errorf("%w: %s", ErrServiceAccountNotFound, id)
 	}
 
-	status := StatusActive
-	if sa.Disabled {
-		status = StatusInactive
+	if !strings.HasPrefix(identity.GetName(), serviceAccountPrefix) {
+		return nil, fmt.Errorf("%w: not a service account: %s", ErrServiceAccountNotFound, id)
+	}
+
+	parts := strings.SplitN(identity.GetName(), ":", 3)
+	if len(parts) < 3 {
+		return nil, fmt.Errorf("invalid service account ID format")
 	}
 
 	account := &ServiceAccount{
-		ID:          sa.Id,
-		ParentUser:  sa.ParentUser,
-		Description: sa.Description,
-		Status:      status,
-		CreateDate:  time.Unix(sa.CreatedAt, 0),
+		ID:         id,
+		ParentUser: parts[1],
+		Status:     StatusActive,
+		CreateDate: getCreationDate(identity.GetActions()),
+		Expiration: getExpiration(identity.GetActions()),
 	}
 
-	if sa.Expiration > 0 {
-		account.Expiration = time.Unix(sa.Expiration, 0)
+	if identity.Account != nil {
+		account.Description = identity.Account.GetDisplayName()
 	}
 
-	if sa.Credential != nil {
-		account.AccessKeyId = sa.Credential.AccessKey
+	if len(identity.Credentials) > 0 {
+		account.AccessKeyId = identity.Credentials[0].GetAccessKey()
+	}
+
+	// Check if disabled
+	for _, action := range identity.GetActions() {
+		if action == disabledAction {
+			account.Status = StatusInactive
+			break
+		}
 	}
 
 	return account, nil
@@ -118,48 +212,55 @@ func (s *AdminServer) CreateServiceAccount(ctx context.Context, req CreateServic
 	}
 
 	// Validate parent user exists
-	if _, err := s.credentialManager.GetUser(ctx, req.ParentUser); err != nil {
-		return nil, fmt.Errorf("parent user lookup failed for %s: %w", req.ParentUser, err)
+	_, err := s.credentialManager.GetUser(ctx, req.ParentUser)
+	if err != nil {
+		return nil, fmt.Errorf("parent user not found: %s", req.ParentUser)
 	}
 
 	// Generate unique ID and credentials
 	uuid := generateAccountId()
-	// Maintain consistent ID format: sa:<parent>:<uuid>
 	saId := fmt.Sprintf("sa:%s:%s", req.ParentUser, uuid)
-
-	accessKey := accessKeyPrefix + generateAccessKey()[len(accessKeyPrefix):]
+	accessKey := accessKeyPrefix + generateAccessKey()[len(accessKeyPrefix):] // Use ABIA prefix for service accounts
 	secretKey := generateSecretKey()
 
+	// Create the service account as a special identity
 	now := time.Now()
 
-	sa := &iam_pb.ServiceAccount{
-		Id:          saId,
-		ParentUser:  req.ParentUser,
-		Description: req.Description,
-		Credential: &iam_pb.Credential{
-			AccessKey: accessKey,
-			SecretKey: secretKey,
-			Status:    StatusActive,
-		},
-		CreatedAt: now.Unix(),
-		Disabled:  false,
-	}
-
+	// Parse expiration if provided
+	var expiration time.Time
 	if req.Expiration != "" {
-		exp, err := time.Parse(time.RFC3339, req.Expiration)
+		var err error
+		expiration, err = time.Parse(time.RFC3339, req.Expiration)
 		if err != nil {
 			return nil, fmt.Errorf("invalid expiration format: %w", err)
 		}
-		sa.Expiration = exp.Unix()
 	}
 
-	if err := s.credentialManager.CreateServiceAccount(ctx, sa); err != nil {
+	identity := &iam_pb.Identity{
+		Name: saId,
+		Account: &iam_pb.Account{
+			Id:          uuid,
+			DisplayName: req.Description,
+		},
+		Credentials: []*iam_pb.Credential{
+			{
+				AccessKey: accessKey,
+				SecretKey: secretKey,
+			},
+		},
+		// Store creation date and expiration in actions
+		Actions: setExpiration(setCreationDate([]string{}, now), expiration),
+	}
+
+	// Create the service account
+	err = s.credentialManager.CreateUser(ctx, identity)
+	if err != nil {
 		return nil, fmt.Errorf("failed to create service account: %w", err)
 	}
 
 	glog.V(1).Infof("Created service account %s for user %s", saId, req.ParentUser)
 
-	resp := &ServiceAccount{
+	return &ServiceAccount{
 		ID:              saId,
 		ParentUser:      req.ParentUser,
 		Description:     req.Description,
@@ -167,13 +268,8 @@ func (s *AdminServer) CreateServiceAccount(ctx context.Context, req CreateServic
 		SecretAccessKey: secretKey, // Only returned on creation
 		Status:          StatusActive,
 		CreateDate:      now,
-	}
-
-	if sa.Expiration > 0 {
-		resp.Expiration = time.Unix(sa.Expiration, 0)
-	}
-
-	return resp, nil
+		Expiration:      expiration,
+	}, nil
 }
 
 // UpdateServiceAccount updates an existing service account
@@ -182,67 +278,85 @@ func (s *AdminServer) UpdateServiceAccount(ctx context.Context, id string, req U
 		return nil, fmt.Errorf("credential manager not available")
 	}
 
-	sa, err := s.credentialManager.GetServiceAccount(ctx, id)
+	// Get existing identity
+	identity, err := s.credentialManager.GetUser(ctx, id)
 	if err != nil {
-		return nil, fmt.Errorf("failed to get service account: %w", err)
-	}
-	if sa == nil {
-		return nil, ErrServiceAccountNotFound
+		return nil, fmt.Errorf("%w: %s", ErrServiceAccountNotFound, id)
 	}
 
+	if !strings.HasPrefix(identity.GetName(), serviceAccountPrefix) {
+		return nil, fmt.Errorf("%w: not a service account: %s", ErrServiceAccountNotFound, id)
+	}
+
+	// Update description if provided
 	if req.Description != "" {
-		sa.Description = req.Description
-	}
-
-	if req.Status != "" {
-		switch req.Status {
-		case StatusInactive:
-			sa.Disabled = true
-		case StatusActive:
-			sa.Disabled = false
-		default:
-			return nil, fmt.Errorf("invalid status value: %s (must be %s or %s)", req.Status, StatusActive, StatusInactive)
+		if identity.Account == nil {
+			identity.Account = &iam_pb.Account{}
 		}
+		identity.Account.DisplayName = req.Description
 	}
 
+	// Update status by adding/removing disabled action
+	if req.Status != "" {
+		// Remove existing disabled marker
+		newActions := make([]string, 0, len(identity.Actions))
+		for _, action := range identity.Actions {
+			if action != disabledAction {
+				newActions = append(newActions, action)
+			}
+		}
+		// Add disabled action if setting to Inactive
+		if req.Status == StatusInactive {
+			newActions = append(newActions, disabledAction)
+		}
+		identity.Actions = newActions
+	}
+
+	// Update expiration if provided
 	if req.Expiration != "" {
-		exp, err := time.Parse(time.RFC3339, req.Expiration)
+		var expiration time.Time
+		var err error
+		expiration, err = time.Parse(time.RFC3339, req.Expiration)
 		if err != nil {
 			return nil, fmt.Errorf("invalid expiration format: %w", err)
 		}
-		sa.Expiration = exp.Unix()
+		identity.Actions = setExpiration(identity.Actions, expiration)
 	}
 
-	if err := s.credentialManager.UpdateServiceAccount(ctx, id, sa); err != nil {
+	// Update the identity
+	err = s.credentialManager.UpdateUser(ctx, id, identity)
+	if err != nil {
 		return nil, fmt.Errorf("failed to update service account: %w", err)
 	}
 
 	glog.V(1).Infof("Updated service account %s", id)
 
-	status := StatusActive
-	if sa.Disabled {
-		status = StatusInactive
+	// Build response
+	parts := strings.SplitN(id, ":", 3)
+	if len(parts) < 3 {
+		return nil, fmt.Errorf("invalid service account ID format")
 	}
 
-	accessKeyId := ""
-	if sa.Credential != nil {
-		accessKeyId = sa.Credential.AccessKey
+	result := &ServiceAccount{
+		ID:          id,
+		ParentUser:  parts[1],
+		Description: identity.Account.GetDisplayName(),
+		Status:      StatusActive,
+		CreateDate:  getCreationDate(identity.Actions),
 	}
 
-	resp := &ServiceAccount{
-		ID:          sa.Id,
-		ParentUser:  sa.ParentUser,
-		Description: sa.Description,
-		Status:      status,
-		CreateDate:  time.Unix(sa.CreatedAt, 0),
-		AccessKeyId: accessKeyId,
+	if len(identity.Credentials) > 0 {
+		result.AccessKeyId = identity.Credentials[0].GetAccessKey()
 	}
 
-	if sa.Expiration > 0 {
-		resp.Expiration = time.Unix(sa.Expiration, 0)
+	for _, action := range identity.Actions {
+		if action == disabledAction {
+			result.Status = StatusInactive
+			break
+		}
 	}
 
-	return resp, nil
+	return result, nil
 }
 
 // DeleteServiceAccount deletes a service account
@@ -251,16 +365,19 @@ func (s *AdminServer) DeleteServiceAccount(ctx context.Context, id string) error
 		return fmt.Errorf("credential manager not available")
 	}
 
-	// Verify existence
-	sa, err := s.credentialManager.GetServiceAccount(ctx, id)
+	// Verify it's a service account
+	identity, err := s.credentialManager.GetUser(ctx, id)
 	if err != nil {
-		return fmt.Errorf("failed to check service account: %w", err)
-	}
-	if sa == nil {
-		return ErrServiceAccountNotFound
+		return fmt.Errorf("%w: %s", ErrServiceAccountNotFound, id)
 	}
 
-	if err := s.credentialManager.DeleteServiceAccount(ctx, id); err != nil {
+	if !strings.HasPrefix(identity.GetName(), serviceAccountPrefix) {
+		return fmt.Errorf("%w: not a service account: %s", ErrServiceAccountNotFound, id)
+	}
+
+	// Delete the identity
+	err = s.credentialManager.DeleteUser(ctx, id)
+	if err != nil {
 		return fmt.Errorf("failed to delete service account: %w", err)
 	}
 
@@ -278,30 +395,40 @@ func (s *AdminServer) GetServiceAccountByAccessKey(ctx context.Context, accessKe
 		return nil, fmt.Errorf("credential manager not available")
 	}
 
-	// Efficient lookup is now supported by the interface and optimized stores
-	sa, err := s.credentialManager.GetStore().GetServiceAccountByAccessKey(ctx, accessKey)
+	// Find identity by access key
+	identity, err := s.credentialManager.GetUserByAccessKey(ctx, accessKey)
 	if err != nil {
-		return nil, fmt.Errorf("failed to find service account: %w", err)
+		return nil, fmt.Errorf("service account not found for access key: %s", accessKey)
 	}
 
-	status := StatusActive
-	if sa.Disabled {
-		status = StatusInactive
+	if !strings.HasPrefix(identity.GetName(), serviceAccountPrefix) {
+		return nil, fmt.Errorf("not a service account")
 	}
-	accessKeyId := ""
-	if sa.Credential != nil {
-		accessKeyId = sa.Credential.AccessKey
+
+	parts := strings.SplitN(identity.GetName(), ":", 3)
+	if len(parts) < 3 {
+		return nil, fmt.Errorf("invalid service account ID format")
 	}
-	resp := &ServiceAccount{
-		ID:          sa.Id,
-		ParentUser:  sa.ParentUser,
-		Description: sa.Description,
-		AccessKeyId: accessKeyId,
-		Status:      status,
-		CreateDate:  time.Unix(sa.CreatedAt, 0),
+
+	account := &ServiceAccount{
+		ID:          identity.GetName(),
+		ParentUser:  parts[1],
+		AccessKeyId: accessKey,
+		Status:      StatusActive,
+		CreateDate:  getCreationDate(identity.GetActions()),
+		Expiration:  getExpiration(identity.GetActions()),
 	}
-	if sa.Expiration > 0 {
-		resp.Expiration = time.Unix(sa.Expiration, 0)
+
+	if identity.Account != nil {
+		account.Description = identity.Account.GetDisplayName()
 	}
-	return resp, nil
+
+	for _, action := range identity.GetActions() {
+		if action == disabledAction {
+			account.Status = StatusInactive
+			break
+		}
+	}
+
+	return account, nil
 }

weed/admin/handlers/admin_handlers.go

@@ -9,8 +9,6 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/admin/dash"
 	"github.com/seaweedfs/seaweedfs/weed/admin/view/app"
 	"github.com/seaweedfs/seaweedfs/weed/admin/view/layout"
-	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
-	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables"
 	"github.com/seaweedfs/seaweedfs/weed/stats"
 )
 
@@ -88,9 +86,6 @@ func (h *AdminHandlers) SetupRoutes(r *gin.Engine, authRequired bool, adminUser,
 		protected.GET("/object-store/users", h.userHandlers.ShowObjectStoreUsers)
 		protected.GET("/object-store/policies", h.policyHandlers.ShowPolicies)
 		protected.GET("/object-store/service-accounts", h.serviceAccountHandlers.ShowServiceAccounts)
-		protected.GET("/object-store/s3tables/buckets", h.ShowS3TablesBuckets)
-		protected.GET("/object-store/s3tables/buckets/:bucket/namespaces", h.ShowS3TablesNamespaces)
-		protected.GET("/object-store/s3tables/buckets/:bucket/namespaces/:namespace/tables", h.ShowS3TablesTables)
 
 		// File browser routes
 		protected.GET("/files", h.fileBrowserHandlers.ShowFileBrowser)
@@ -179,29 +174,6 @@ func (h *AdminHandlers) SetupRoutes(r *gin.Engine, authRequired bool, adminUser,
 				objectStorePoliciesApi.POST("/validate", h.policyHandlers.ValidatePolicy)
 			}
 
-			// S3 Tables API routes
-			s3TablesApi := api.Group("/s3tables")
-			{
-				s3TablesApi.GET("/buckets", h.adminServer.ListS3TablesBucketsAPI)
-				s3TablesApi.POST("/buckets", dash.RequireWriteAccess(), h.adminServer.CreateS3TablesBucket)
-				s3TablesApi.DELETE("/buckets", dash.RequireWriteAccess(), h.adminServer.DeleteS3TablesBucket)
-				s3TablesApi.GET("/namespaces", h.adminServer.ListS3TablesNamespacesAPI)
-				s3TablesApi.POST("/namespaces", dash.RequireWriteAccess(), h.adminServer.CreateS3TablesNamespace)
-				s3TablesApi.DELETE("/namespaces", dash.RequireWriteAccess(), h.adminServer.DeleteS3TablesNamespace)
-				s3TablesApi.GET("/tables", h.adminServer.ListS3TablesTablesAPI)
-				s3TablesApi.POST("/tables", dash.RequireWriteAccess(), h.adminServer.CreateS3TablesTable)
-				s3TablesApi.DELETE("/tables", dash.RequireWriteAccess(), h.adminServer.DeleteS3TablesTable)
-				s3TablesApi.PUT("/bucket-policy", dash.RequireWriteAccess(), h.adminServer.PutS3TablesBucketPolicy)
-				s3TablesApi.GET("/bucket-policy", h.adminServer.GetS3TablesBucketPolicy)
-				s3TablesApi.DELETE("/bucket-policy", dash.RequireWriteAccess(), h.adminServer.DeleteS3TablesBucketPolicy)
-				s3TablesApi.PUT("/table-policy", dash.RequireWriteAccess(), h.adminServer.PutS3TablesTablePolicy)
-				s3TablesApi.GET("/table-policy", h.adminServer.GetS3TablesTablePolicy)
-				s3TablesApi.DELETE("/table-policy", dash.RequireWriteAccess(), h.adminServer.DeleteS3TablesTablePolicy)
-				s3TablesApi.PUT("/tags", dash.RequireWriteAccess(), h.adminServer.TagS3TablesResource)
-				s3TablesApi.GET("/tags", h.adminServer.ListS3TablesTags)
-				s3TablesApi.DELETE("/tags", dash.RequireWriteAccess(), h.adminServer.UntagS3TablesResource)
-			}
-
 			// File management API routes
 			filesApi := api.Group("/files")
 			{
@@ -256,9 +228,6 @@ func (h *AdminHandlers) SetupRoutes(r *gin.Engine, authRequired bool, adminUser,
 		r.GET("/object-store/users", h.userHandlers.ShowObjectStoreUsers)
 		r.GET("/object-store/policies", h.policyHandlers.ShowPolicies)
 		r.GET("/object-store/service-accounts", h.serviceAccountHandlers.ShowServiceAccounts)
-		r.GET("/object-store/s3tables/buckets", h.ShowS3TablesBuckets)
-		r.GET("/object-store/s3tables/buckets/:bucket/namespaces", h.ShowS3TablesNamespaces)
-		r.GET("/object-store/s3tables/buckets/:bucket/namespaces/:namespace/tables", h.ShowS3TablesTables)
 
 		// File browser routes
 		r.GET("/files", h.fileBrowserHandlers.ShowFileBrowser)
@@ -346,29 +315,6 @@ func (h *AdminHandlers) SetupRoutes(r *gin.Engine, authRequired bool, adminUser,
 				objectStorePoliciesApi.POST("/validate", h.policyHandlers.ValidatePolicy)
 			}
 
-			// S3 Tables API routes
-			s3TablesApi := api.Group("/s3tables")
-			{
-				s3TablesApi.GET("/buckets", h.adminServer.ListS3TablesBucketsAPI)
-				s3TablesApi.POST("/buckets", h.adminServer.CreateS3TablesBucket)
-				s3TablesApi.DELETE("/buckets", h.adminServer.DeleteS3TablesBucket)
-				s3TablesApi.GET("/namespaces", h.adminServer.ListS3TablesNamespacesAPI)
-				s3TablesApi.POST("/namespaces", h.adminServer.CreateS3TablesNamespace)
-				s3TablesApi.DELETE("/namespaces", h.adminServer.DeleteS3TablesNamespace)
-				s3TablesApi.GET("/tables", h.adminServer.ListS3TablesTablesAPI)
-				s3TablesApi.POST("/tables", h.adminServer.CreateS3TablesTable)
-				s3TablesApi.DELETE("/tables", h.adminServer.DeleteS3TablesTable)
-				s3TablesApi.PUT("/bucket-policy", h.adminServer.PutS3TablesBucketPolicy)
-				s3TablesApi.GET("/bucket-policy", h.adminServer.GetS3TablesBucketPolicy)
-				s3TablesApi.DELETE("/bucket-policy", h.adminServer.DeleteS3TablesBucketPolicy)
-				s3TablesApi.PUT("/table-policy", h.adminServer.PutS3TablesTablePolicy)
-				s3TablesApi.GET("/table-policy", h.adminServer.GetS3TablesTablePolicy)
-				s3TablesApi.DELETE("/table-policy", h.adminServer.DeleteS3TablesTablePolicy)
-				s3TablesApi.PUT("/tags", h.adminServer.TagS3TablesResource)
-				s3TablesApi.GET("/tags", h.adminServer.ListS3TablesTags)
-				s3TablesApi.DELETE("/tags", h.adminServer.UntagS3TablesResource)
-			}
-
 			// File management API routes
 			filesApi := api.Group("/files")
 			{
@@ -452,91 +398,6 @@ func (h *AdminHandlers) ShowS3Buckets(c *gin.Context) {
 	}
 }
 
-// ShowS3TablesBuckets renders the S3 Tables buckets page
-func (h *AdminHandlers) ShowS3TablesBuckets(c *gin.Context) {
-	username := c.GetString("username")
-	if username == "" {
-		username = "admin"
-	}
-
-	data, err := h.adminServer.GetS3TablesBucketsData(c.Request.Context())
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to get S3 Tables buckets: " + err.Error()})
-		return
-	}
-	data.Username = username
-
-	c.Header("Content-Type", "text/html")
-	component := app.S3TablesBuckets(data)
-	layoutComponent := layout.Layout(c, component)
-	if err := layoutComponent.Render(c.Request.Context(), c.Writer); err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to render template: " + err.Error()})
-	}
-}
-
-// ShowS3TablesNamespaces renders namespaces for a table bucket
-func (h *AdminHandlers) ShowS3TablesNamespaces(c *gin.Context) {
-	username := c.GetString("username")
-	if username == "" {
-		username = "admin"
-	}
-
-	bucketName := c.Param("bucket")
-	arn, err := buildS3TablesBucketArn(bucketName)
-	if err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
-		return
-	}
-
-	data, err := h.adminServer.GetS3TablesNamespacesData(c.Request.Context(), arn)
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to get S3 Tables namespaces: " + err.Error()})
-		return
-	}
-	data.Username = username
-
-	c.Header("Content-Type", "text/html")
-	component := app.S3TablesNamespaces(data)
-	layoutComponent := layout.Layout(c, component)
-	if err := layoutComponent.Render(c.Request.Context(), c.Writer); err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to render template: " + err.Error()})
-	}
-}
-
-// ShowS3TablesTables renders tables for a namespace
-func (h *AdminHandlers) ShowS3TablesTables(c *gin.Context) {
-	username := c.GetString("username")
-	if username == "" {
-		username = "admin"
-	}
-
-	bucketName := c.Param("bucket")
-	namespace := c.Param("namespace")
-	arn, err := buildS3TablesBucketArn(bucketName)
-	if err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
-		return
-	}
-
-	data, err := h.adminServer.GetS3TablesTablesData(c.Request.Context(), arn, namespace)
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to get S3 Tables tables: " + err.Error()})
-		return
-	}
-	data.Username = username
-
-	c.Header("Content-Type", "text/html")
-	component := app.S3TablesTables(data)
-	layoutComponent := layout.Layout(c, component)
-	if err := layoutComponent.Render(c.Request.Context(), c.Writer); err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to render template: " + err.Error()})
-	}
-}
-
-func buildS3TablesBucketArn(bucketName string) (string, error) {
-	return s3tables.BuildBucketARN(s3tables.DefaultRegion, s3_constants.AccountAdminId, bucketName)
-}
-
 // ShowBucketDetails returns detailed information about a specific bucket
 func (h *AdminHandlers) ShowBucketDetails(c *gin.Context) {
 	bucketName := c.Param("bucket")

weed/admin/handlers/file_browser_handlers.go

@@ -22,7 +22,6 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/admin/view/layout"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
-	"github.com/seaweedfs/seaweedfs/weed/security"
 	"github.com/seaweedfs/seaweedfs/weed/util"
 	"github.com/seaweedfs/seaweedfs/weed/util/http/client"
 )
@@ -122,6 +121,7 @@ func (h *FileBrowserHandlers) DeleteFile(c *gin.Context) {
 		})
 		return err
 	})
+
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to delete file: " + err.Error()})
 		return
@@ -228,7 +228,7 @@ func (h *FileBrowserHandlers) CreateFolder(c *gin.Context) {
 				Name:        filepath.Base(fullPath),
 				IsDirectory: true,
 				Attributes: &filer_pb.FuseAttributes{
-					FileMode: uint32(0o755 | os.ModeDir), // Directory mode
+					FileMode: uint32(0755 | os.ModeDir), // Directory mode
 					Uid:      filer_pb.OS_UID,
 					Gid:      filer_pb.OS_GID,
 					Crtime:   time.Now().Unix(),
@@ -239,6 +239,7 @@ func (h *FileBrowserHandlers) CreateFolder(c *gin.Context) {
 		})
 		return err
 	})
+
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create folder: " + err.Error()})
 		return
@@ -406,9 +407,6 @@ func (h *FileBrowserHandlers) uploadFileToFiler(filePath string, fileHeader *mul
 	// Set content type with boundary
 	req.Header.Set("Content-Type", writer.FormDataContentType())
 
-	// Add JWT Token to Authorization Header
-	h.setupFilerJwtAuth(req, "jwt.filer_signing.key", "jwt.filer_signing.expires_after_seconds", "filer upload")
-
 	// Send request using TLS-aware HTTP client with 60s timeout for large file uploads
 	// lgtm[go/ssrf]
 	// Safe: filerAddress validated by validateFilerAddress() to match configured filer
@@ -527,12 +525,7 @@ func (h *FileBrowserHandlers) fetchFileContent(filePath string, timeout time.Dur
 	// Safe: filerAddress validated by validateFilerAddress() to match configured filer
 	// Safe: cleanFilePath validated and cleaned by validateAndCleanFilePath() to prevent path traversal
 	client := h.newClientWithTimeout(timeout)
-	req, err := http.NewRequest("GET", fileURL, nil)
-	if err != nil {
-		return "", fmt.Errorf("failed to create request: %w", err)
-	}
-	h.addFilerJwtAuthHeader(req)
-	resp, err := client.Do(req)
+	resp, err := client.Get(fileURL)
 	if err != nil {
 		return "", fmt.Errorf("failed to fetch file from filer: %w", err)
 	}
@@ -602,9 +595,6 @@ func (h *FileBrowserHandlers) DownloadFile(c *gin.Context) {
 		return
 	}
 	client := h.newClientWithTimeout(5 * time.Minute) // Longer timeout for large file downloads
-
-	h.addFilerJwtAuthHeader(req)
-
 	resp, err := client.Do(req)
 	if err != nil {
 		c.JSON(http.StatusBadGateway, gin.H{"error": "Failed to fetch file from filer: " + err.Error()})
@@ -697,6 +687,7 @@ func (h *FileBrowserHandlers) ViewFile(c *gin.Context) {
 
 		return nil
 	})
+
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to get file metadata: " + err.Error()})
 		return
@@ -846,6 +837,7 @@ func (h *FileBrowserHandlers) GetFileProperties(c *gin.Context) {
 
 		return nil
 	})
+
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to get file properties: " + err.Error()})
 		return
@@ -1040,13 +1032,7 @@ func (h *FileBrowserHandlers) isLikelyTextFile(filePath string, maxCheckSize int
 	// Safe: filerAddress validated by validateFilerAddress() to match configured filer
 	// Safe: cleanFilePath validated and cleaned by validateAndCleanFilePath() to prevent path traversal
 	client := h.newClientWithTimeout(10 * time.Second)
-	req, err := http.NewRequest("GET", fileURL, nil)
-	if err != nil {
-		glog.Errorf("Failed to create request: %v", err)
-		return false
-	}
-	h.addFilerJwtAuthHeader(req)
-	resp, err := client.Do(req)
+	resp, err := client.Get(fileURL)
 	if err != nil {
 		return false
 	}
@@ -1100,36 +1086,3 @@ func min(a, b int64) int64 {
 	}
 	return b
 }
-
-// setupFilerJwtAuth generates a JWT token and adds it to the request Authorization header if configured.
-func (h *FileBrowserHandlers) setupFilerJwtAuth(req *http.Request, keyPath, expiresPath, operation string) {
-	// Load security configuration
-	v := util.GetViper()
-
-	// Read Filer JWT token from security.toml
-	signingKey := security.SigningKey(v.GetString(keyPath))
-	expiresAfterSec := v.GetInt(expiresPath)
-
-	//  Generate JWT token to authenticate with Filer
-	var jwtToken security.EncodedJwt
-	if len(signingKey) > 0 {
-		jwtToken = security.GenJwtForFilerServer(signingKey, expiresAfterSec)
-		glog.V(4).Infof("Generated JWT token for %s (expires in %d sec)", operation, expiresAfterSec)
-	} else {
-		if v.GetString("jwt.signing.key") != "" {
-			glog.Warningf("JWT %s key not configured, but general JWT security is enabled. %s without authentication.", keyPath, operation)
-		} else {
-			glog.V(1).Infof("No JWT signing key configured, %s without authentication", operation)
-		}
-	}
-
-	// Add JWT Token to Authorization Header
-	if jwtToken != "" {
-		req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", string(jwtToken)))
-		glog.V(4).Infof("Added JWT authorization header for %s", operation)
-	}
-}
-
-func (h *FileBrowserHandlers) addFilerJwtAuthHeader(req *http.Request) {
-	h.setupFilerJwtAuth(req, "jwt.filer_signing.read.key", "jwt.filer_signing.read.expires_after_seconds", "filer request")
-}