fix: prevent unhandled promise rejection for scheduler status fetch

Attach .catch at promise creation to mark it as handled by the runtime, then check the result type after await. This prevents an unhandledrejection event if the fetch rejects before the await. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
fix: use lifecycle context for job-type budget and retry backoff
2026-10-19 21:12:35 +00:00 · 2026-03-03 19:27:17 -08:00 · 2026-03-03 19:27:06 -08:00 · 2026-03-03 19:05:56 -08:00 · 2026-03-03 18:49:37 -08:00 · 2026-03-03 18:49:28 -08:00
478 changed files with 7595 additions and 45663 deletions
@@ -1,54 +0,0 @@
-name: Claude Code Review
-
-on:
-  pull_request:
-    types: [opened, synchronize, ready_for_review, reopened]
-    # Optional: Only run on specific file changes
-    # paths:
-    #   - "src/**/*.ts"
-    #   - "src/**/*.tsx"
-    #   - "src/**/*.js"
-    #   - "src/**/*.jsx"
-
-jobs:
-  claude-review:
-    # Optional: Filter by PR author
-    # if: |
-    #   github.event.pull_request.user.login == 'external-contributor' ||
-    #   github.event.pull_request.user.login == 'new-developer' ||
-    #   github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR'
-
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: read
-      issues: read
-      id-token: write
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-
-      - name: Install Claude Code
-        run: npm install -g @anthropic-ai/claude-code
-
-      - name: Run Claude Code Review
-        id: claude-review
-        uses: anthropics/claude-code-action@v1
-        with:
-          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-          path_to_claude_code_executable: claude
-          allowed_bots: "*"
-          plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
-          plugins: 'code-review@claude-code-plugins'
-          prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}'
-          # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
-          # or https://code.claude.com/docs/en/cli-reference for available options
-
@@ -1,50 +0,0 @@
-name: Claude Code
-
-on:
-  issue_comment:
-    types: [created]
-  pull_request_review_comment:
-    types: [created]
-  issues:
-    types: [opened, assigned]
-  pull_request_review:
-    types: [submitted]
-
-jobs:
-  claude:
-    if: |
-      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
-      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
-      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
-      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: read
-      issues: read
-      id-token: write
-      actions: read # Required for Claude to read CI results on PRs
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-
-      - name: Run Claude Code
-        id: claude
-        uses: anthropics/claude-code-action@v1
-        with:
-          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-
-          # This is an optional setting that allows Claude to read CI results on PRs
-          additional_permissions: |
-            actions: read
-
-          # Optional: Give a custom prompt to Claude. If this is not specified, Claude will perform the instructions specified in the comment that tagged it.
-          # prompt: 'Update the pull request description to include a summary of changes.'
-
-          # Optional: Add claude_args to customize behavior and configuration
-          # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
-          # or https://code.claude.com/docs/en/cli-reference for available options
-          # claude_args: '--allowed-tools Bash(gh pr:*)'
-
@@ -19,7 +19,7 @@ jobs:
      -
        name: Docker meta
        id: docker_meta
-        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v3
+        uses: docker/metadata-action@318604b99e75e41977312d83839a89be02ca4893 # v3
        with:
          images: |
            chrislusf/seaweedfs
@@ -32,7 +32,7 @@ jobs:
            org.opencontainers.image.vendor=Chris Lu
      -
        name: Set up QEMU
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v1
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v1
      -
        name: Create BuildKit config
        run: |
@@ -42,28 +42,28 @@ jobs:
          EOF
      -
        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v1
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v1
        with:
          buildkitd-flags: "--debug"
          buildkitd-config: /tmp/buildkitd.toml
      -
        name: Login to Docker Hub
        if: github.event_name != 'pull_request'
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v1
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v1
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      -
        name: Login to GHCR
        if: github.event_name != 'pull_request'
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v1
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v1
        with:
          registry: ghcr.io
          username: ${{ secrets.GHCR_USERNAME }}
          password: ${{ secrets.GHCR_TOKEN }}
      -
        name: Build
-        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v2
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v2
        with:
          context: ./docker
          push: ${{ github.event_name != 'pull_request' }}
@@ -126,14 +126,14 @@ jobs:
          echo "seaweedfs_ref=$seaweed" >> "$GITHUB_OUTPUT"

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
        if: github.event_name != 'pull_request'
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
@@ -150,7 +150,7 @@ jobs:
          fi

      - name: Build and push image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v6
        with:
          context: ./docker
          push: ${{ github.event_name != 'pull_request' }}
@@ -86,7 +86,7 @@ jobs:

      - name: Docker meta
        id: docker_meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@v5
        with:
          images: |
            chrislusf/seaweedfs
@@ -98,7 +98,7 @@ jobs:
            org.opencontainers.image.vendor=Chris Lu
      - name: Set up QEMU
        if: matrix.platform != 'amd64'
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@v3
      - name: Create BuildKit config
        run: |
          cat > /tmp/buildkitd.toml <<EOF
@@ -106,25 +106,25 @@ jobs:
            mirrors = ["https://mirror.gcr.io"]
          EOF
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3
        with:
          buildkitd-flags: "--debug"
          buildkitd-config: /tmp/buildkitd.toml
      - name: Login to Docker Hub
        if: github.event_name != 'pull_request'
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      - name: Login to GHCR
        if: github.event_name != 'pull_request'
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ secrets.GHCR_USERNAME }}
          password: ${{ secrets.GHCR_TOKEN }}
      - name: Build ${{ matrix.platform }} ${{ matrix.variant }}
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v6
        env:
          DOCKER_BUILDKIT: 1
        with:
@@ -173,19 +173,19 @@ jobs:

      - name: Docker meta
        id: docker_meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@v5
        with:
          images: |
            chrislusf/seaweedfs
            ghcr.io/chrislusf/seaweedfs
          tags: type=raw,value=${{ github.event_name == 'workflow_dispatch' && github.event.inputs.image_tag || 'latest' }},suffix=${{ steps.config.outputs.tag_suffix }}
      - name: Login to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      - name: Login to GHCR
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ secrets.GHCR_USERNAME }}
@@ -21,7 +21,7 @@ jobs:
      -
        name: Docker meta
        id: docker_meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@v5
        with:
          images: |
            chrislusf/seaweedfs
@@ -35,14 +35,14 @@ jobs:
            org.opencontainers.image.vendor=Chris Lu
      -
        name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@v3
      -
        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3
      -
        name: Login to Docker Hub
        if: github.event_name != 'pull_request'
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
@@ -57,7 +57,7 @@ jobs:
          fi
      -
        name: Build
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v6
        with:
          context: ./docker
          push: ${{ github.event_name != 'pull_request' }}
@@ -60,16 +60,16 @@ jobs:
            build_args: TAGS=5BytesOffset
            tag_suffix: _large_disk
            
-          # Full tags - multi-arch
+          # Full tags - amd64 only
          - variant: full
-            platforms: linux/amd64,linux/arm64
+            platforms: linux/amd64
            dockerfile: ./docker/Dockerfile.go_build
            build_args: TAGS=elastic,gocdk,rclone,sqlite,tarantool,tikv,ydb
            tag_suffix: _full
-
-          # Large disk + full tags - multi-arch
+            
+          # Large disk + full tags - amd64 only
          - variant: large_disk_full
-            platforms: linux/amd64,linux/arm64
+            platforms: linux/amd64
            dockerfile: ./docker/Dockerfile.go_build
            build_args: TAGS=5BytesOffset,elastic,gocdk,rclone,sqlite,tarantool,tikv,ydb
            tag_suffix: _large_disk_full
@@ -103,7 +103,7 @@ jobs:
      - name: Docker meta
        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
        id: docker_meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@v5
        with:
          images: |
            chrislusf/seaweedfs
@@ -117,7 +117,7 @@ jobs:
            
      - name: Set up QEMU
        if: (github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant) && contains(matrix.platforms, 'arm')
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@v3
        
      - name: Create BuildKit config
        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
@@ -129,20 +129,20 @@ jobs:
          
      - name: Set up Docker Buildx
        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3
        with:
          buildkitd-config: /tmp/buildkitd.toml
          
      - name: Login to Docker Hub
        if: (github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant) && github.event_name != 'pull_request'
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
          
      - name: Login to GHCR
        if: (github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant) && github.event_name != 'pull_request'
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ secrets.GHCR_USERNAME }}
@@ -150,7 +150,7 @@ jobs:
          
      - name: Build and push ${{ matrix.variant }}
        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v6
        env:
          DOCKER_BUILDKIT: 1
        with:
@@ -198,14 +198,14 @@ jobs:
    steps:
      - name: Login to Docker Hub
        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
          
      - name: Login to GHCR
        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ secrets.GHCR_USERNAME }}
@@ -82,19 +82,19 @@ jobs:
          echo "seaweedfs_ref=$seaweed" >> "$GITHUB_OUTPUT"

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v1
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v1

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v1
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v1

      - name: Login to Docker Hub
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v1
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v1
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Build and push image
-        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v2
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v2
        with:
          context: ./docker
          push: true
@@ -26,7 +26,7 @@ jobs:
      - name: Set up Go
        uses: actions/setup-go@v6
        with:
-          go-version-file: 'go.mod'
+          go-version: '1.24'

      - name: Build Telemetry Server
        if: github.event_name == 'workflow_dispatch' && inputs.deploy
@@ -11,4 +11,4 @@ jobs:
      - name: 'Checkout Repository'
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
      - name: 'Dependency Review'
-        uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48
+        uses: actions/dependency-review-action@05fe4576374b728f0c523d6a13d64c25081e0803
@@ -23,16 +23,17 @@ jobs:
    runs-on: ubuntu-22.04
    timeout-minutes: 30
    steps:
-    - name: Check out code into the Go module directory
-      uses: actions/checkout@v6
-
-    - name: Set up Go
-      uses: actions/setup-go@v6
+    - name: Set up Go 1.x
+      uses: actions/setup-go@a5f9b05d2d216f63e13859e0d847461041025775 # v2
      with:
-        go-version-file: 'go.mod'
+        go-version: ^1.13
+      id: go
+
+    - name: Check out code into the Go module directory
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v2

    - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v4
+      uses: docker/setup-buildx-action@v3
      
    - name: Cache Docker layers
      uses: actions/cache@v5
@@ -18,7 +18,7 @@ jobs:
    - name: Set up Go 1.x
      uses: actions/setup-go@v6
      with:
-        go-version: ^1.25
+        go-version: ^1.24
      id: go

    - name: Check out code into the Go module directory
@@ -28,7 +28,7 @@ jobs:
    - name: Set up Go
      uses: actions/setup-go@v6
      with:
-        go-version-file: 'go.mod'
+        go-version: '1.24'
        
    - name: Build weed binary
      run: |
@@ -22,6 +22,7 @@ permissions:
  contents: read

 env:
+  GO_VERSION: '1.24'
  TEST_TIMEOUT: '45m'

 jobs:
@@ -34,10 +35,10 @@ jobs:
    - name: Checkout code
      uses: actions/checkout@v6
      
-    - name: Set up Go
+    - name: Set up Go ${{ env.GO_VERSION }}
      uses: actions/setup-go@v6
      with:
-        go-version-file: 'go.mod'
+        go-version: ${{ env.GO_VERSION }}
        
    - name: Install FUSE and dependencies
      run: |
@@ -19,12 +19,13 @@ jobs:
    name: Go Vet
    runs-on: ubuntu-latest
    steps:
-    - name: Check out code into the Go module directory
-      uses: actions/checkout@v6
-    - name: Set up Go
-      uses: actions/setup-go@v6
+    - name: Set up Go 1.x
+      uses: actions/setup-go@a5f9b05d2d216f63e13859e0d847461041025775 # v2
      with:
-        go-version-file: 'go.mod'
+        go-version: ^1.13
+      id: go
+    - name: Check out code into the Go module directory
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v2
    - name: Get dependencies
      run: |
        cd weed; go get -v -t -d ./...
@@ -41,12 +42,13 @@ jobs:
    name: Build
    runs-on: ubuntu-latest
    steps:
-    - name: Check out code into the Go module directory
-      uses: actions/checkout@v6
-    - name: Set up Go
-      uses: actions/setup-go@v6
+    - name: Set up Go 1.x
+      uses: actions/setup-go@a5f9b05d2d216f63e13859e0d847461041025775 # v2
      with:
-        go-version-file: 'go.mod'
+        go-version: ^1.13
+      id: go
+    - name: Check out code into the Go module directory
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v2
    - name: Build
      run: cd weed; go build -tags "elastic gocdk sqlite ydb tarantool tikv rclone" -v .

@@ -54,11 +56,12 @@ jobs:
    name: Test
    runs-on: ubuntu-latest
    steps:
-    - name: Check out code into the Go module directory
-      uses: actions/checkout@v6
-    - name: Set up Go
-      uses: actions/setup-go@v6
+    - name: Set up Go 1.x
+      uses: actions/setup-go@a5f9b05d2d216f63e13859e0d847461041025775 # v2
      with:
-        go-version-file: 'go.mod'
+        go-version: ^1.13
+      id: go
+    - name: Check out code into the Go module directory
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v2
    - name: Test
      run: cd weed; go test -tags "elastic gocdk sqlite ydb tarantool tikv rclone" -v ./...
@@ -64,15 +64,15 @@ jobs:
          echo "✓ All-in-one deployment renders correctly"
          
          echo "=== Testing with security enabled ==="
-          helm template test $CHART_DIR --set global.seaweedfs.enableSecurity=true > /tmp/security.yaml
+          helm template test $CHART_DIR --set global.enableSecurity=true > /tmp/security.yaml
          grep -q "security-config" /tmp/security.yaml
          echo "✓ Security configuration renders correctly"
-
+          
          echo "=== Testing with monitoring enabled ==="
          helm template test $CHART_DIR \
-            --set global.seaweedfs.monitoring.enabled=true \
-            --set global.seaweedfs.monitoring.gatewayHost=prometheus \
-            --set global.seaweedfs.monitoring.gatewayPort=9091 > /tmp/monitoring.yaml
+            --set global.monitoring.enabled=true \
+            --set global.monitoring.gatewayHost=prometheus \
+            --set global.monitoring.gatewayPort=9091 > /tmp/monitoring.yaml
          echo "✓ Monitoring configuration renders correctly"
          
          echo "=== Testing with PVC storage ==="
@@ -116,107 +116,6 @@ jobs:
          echo "✓ COSI driver renders correctly"
          
          echo ""
-          echo "=== Testing long release name: service names match DNS references ==="
-          # Use a release name that, combined with chart name "seaweedfs", exceeds 63 chars.
-          # fullname = "my-very-long-release-name-that-will-cause-truncation-seaweedfs" (65 chars before trunc)
-          LONG_RELEASE="my-very-long-release-name-that-will-cause-truncation"
-
-          # --- Normal mode: master + filer-client services vs helper-produced addresses ---
-          helm template "$LONG_RELEASE" $CHART_DIR \
-            --set s3.enabled=true \
-            --set global.seaweedfs.createBuckets[0].name=test > /tmp/longname.yaml
-
-          # Extract Service names from metadata
-          MASTER_SVC=$(awk '/kind: Service/{found=1} found && /^ *name:/{print $2; found=0}' /tmp/longname.yaml \
-            | grep -- '-master$')
-          FILER_CLIENT_SVC=$(awk '/kind: Service/{found=1} found && /^ *name:/{print $2; found=0}' /tmp/longname.yaml \
-            | grep -- '-filer-client$')
-
-          # Extract the hostname from WEED_CLUSTER_SW_MASTER in post-install-bucket-hook
-          MASTER_ADDR=$(grep 'WEED_CLUSTER_SW_MASTER' -A1 /tmp/longname.yaml \
-            | grep 'value:' | head -1 | sed 's/.*value: *"\{0,1\}\([^":]*\).*/\1/')
-          FILER_ADDR=$(grep 'WEED_CLUSTER_SW_FILER' -A1 /tmp/longname.yaml \
-            | grep 'value:' | head -1 | sed 's/.*value: *"\{0,1\}\([^":]*\).*/\1/')
-
-          # Extract the hostname from S3 deployment -filer= argument
-          S3_FILER_HOST=$(grep '\-filer=' /tmp/longname.yaml \
-            | head -1 | sed 's/.*-filer=\([^:]*\).*/\1/')
-
-          # The address helpers produce "<svc>.<namespace>:<port>"; extract just the svc name
-          MASTER_ADDR_SVC=$(echo "$MASTER_ADDR" | cut -d. -f1)
-          FILER_ADDR_SVC=$(echo "$FILER_ADDR" | cut -d. -f1)
-          S3_FILER_SVC=$(echo "$S3_FILER_HOST" | cut -d. -f1)
-
-          echo "  master Service.name:       $MASTER_SVC"
-          echo "  cluster.masterAddress svc:  $MASTER_ADDR_SVC"
-          echo "  filer-client Service.name:  $FILER_CLIENT_SVC"
-          echo "  cluster.filerAddress svc:   $FILER_ADDR_SVC"
-          echo "  S3 -filer= svc:             $S3_FILER_SVC"
-
-          [ "$MASTER_SVC" = "$MASTER_ADDR_SVC" ] || { echo "FAIL: master service name mismatch"; exit 1; }
-          [ "$FILER_CLIENT_SVC" = "$FILER_ADDR_SVC" ] || { echo "FAIL: filer-client service name mismatch"; exit 1; }
-          [ "$FILER_CLIENT_SVC" = "$S3_FILER_SVC" ] || { echo "FAIL: S3 -filer= does not match filer-client service"; exit 1; }
-          echo "✓ Normal mode: service names match DNS references with long release name"
-
-          # --- All-in-one mode: all-in-one service vs both helper addresses ---
-          helm template "$LONG_RELEASE" $CHART_DIR \
-            --set allInOne.enabled=true \
-            --set global.seaweedfs.createBuckets[0].name=test > /tmp/longname-aio.yaml
-
-          AIO_SVC=$(awk '/kind: Service/{found=1} found && /^ *name:/{print $2; found=0}' /tmp/longname-aio.yaml \
-            | grep -- '-all-in-one$')
-          AIO_MASTER_ADDR_SVC=$(grep 'WEED_CLUSTER_SW_MASTER' -A1 /tmp/longname-aio.yaml \
-            | grep 'value:' | head -1 | sed 's/.*value: *"\{0,1\}\([^":]*\).*/\1/' | cut -d. -f1)
-          AIO_FILER_ADDR_SVC=$(grep 'WEED_CLUSTER_SW_FILER' -A1 /tmp/longname-aio.yaml \
-            | grep 'value:' | head -1 | sed 's/.*value: *"\{0,1\}\([^":]*\).*/\1/' | cut -d. -f1)
-
-          echo "  all-in-one Service.name:    $AIO_SVC"
-          echo "  cluster.masterAddress svc:  $AIO_MASTER_ADDR_SVC"
-          echo "  cluster.filerAddress svc:   $AIO_FILER_ADDR_SVC"
-
-          [ "$AIO_SVC" = "$AIO_MASTER_ADDR_SVC" ] || { echo "FAIL: all-in-one master address mismatch"; exit 1; }
-          [ "$AIO_SVC" = "$AIO_FILER_ADDR_SVC" ] || { echo "FAIL: all-in-one filer address mismatch"; exit 1; }
-          echo "✓ All-in-one mode: service names match DNS references with long release name"
-
-          echo ""
-          echo "=== Testing security+S3: no blank lines in shell command blocks ==="
-          # Render the three manifests that include seaweedfs.s3.tlsArgs:
-          #   filer-statefulset, s3-deployment, all-in-one-deployment
-          helm template test $CHART_DIR \
-            --set global.seaweedfs.enableSecurity=true \
-            --set filer.s3.enabled=true \
-            --set s3.enabled=true > /tmp/security-s3.yaml
-          helm template test $CHART_DIR \
-            --set global.seaweedfs.enableSecurity=true \
-            --set allInOne.enabled=true \
-            --set allInOne.s3.enabled=true > /tmp/security-aio.yaml
-
-          pip install pyyaml -q
-          python3 - /tmp/security-s3.yaml /tmp/security-aio.yaml <<'PYEOF'
-          import yaml, sys
-          errors = []
-          for path in sys.argv[1:]:
-              with open(path) as f:
-                  docs = list(yaml.safe_load_all(f))
-              for doc in docs:
-                  if not doc or doc.get("kind") not in ("Deployment", "StatefulSet"):
-                      continue
-                  name = doc["metadata"]["name"]
-                  for c in doc["spec"]["template"]["spec"].get("containers", []):
-                      cmd = c.get("command", [])
-                      if len(cmd) >= 3 and cmd[0] == "/bin/sh" and cmd[1] == "-ec":
-                          script = cmd[2]
-                          for i, line in enumerate(script.splitlines(), 1):
-                              if line.strip() == "":
-                                  errors.append(f"{path}: {name}/{c['name']} has blank line at script line {i}")
-          if errors:
-              for e in errors:
-                  print(f"FAIL: {e}", file=sys.stderr)
-              print("Rendered with: global.seaweedfs.enableSecurity=true, filer.s3.enabled=true, s3.enabled=true, allInOne.enabled=true", file=sys.stderr)
-              sys.exit(1)
-          print("✓ No blank lines in security+S3 command blocks")
-          PYEOF
-
          echo "✅ All template rendering tests passed!"

      - name: Create kind cluster
@@ -6,7 +6,6 @@ on:
 permissions:
  contents: write
  pages: write
-  packages: write

 jobs:
  helm-release:
@@ -16,7 +15,7 @@ jobs:
        with:
          fetch-depth: 0

-      - name: Publish Helm charts to github pages
+      - name: Publish Helm charts
        uses: stefanprodan/helm-gh-pages@v1.7.0
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
@@ -24,15 +23,3 @@ jobs:
          target_dir: helm
          branch: gh-pages
          helm_version: "3.18.4"
-
-      - name: Publish Helm charts to github container registry (ghcr.io)
-        uses: bitdeps/helm-oci-charts-releaser@v0.1.5
-        with:
-          charts_dir: k8s/charts
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          oci_registry: ghcr.io/${{ github.repository_owner }}
-          oci_username: github-actions
-          oci_password: ${{ secrets.GITHUB_TOKEN }}
-          skip_dependencies: true
-          skip_helm_install: true
-          skip_gh_release: true
@@ -26,14 +26,14 @@ jobs:
    - name: Set up Go 1.x
      uses: actions/setup-go@v6
      with:
-        go-version: ^1.25
+        go-version: ^1.24
        cache: true
        cache-dependency-path: |
          **/go.sum
      id: go

    - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v4
+      uses: docker/setup-buildx-action@v3

    - name: Install dependencies
      run: |
@@ -37,7 +37,7 @@ jobs:
    - name: Set up Go 1.x
      uses: actions/setup-go@v6
      with:
-        go-version: ^1.25
+        go-version: ^1.24
      id: go

    - name: Check out code
@@ -82,7 +82,7 @@ jobs:
    - name: Set up Go 1.x
      uses: actions/setup-go@v6
      with:
-        go-version: ^1.25
+        go-version: ^1.24
      id: go

    - name: Check out code
@@ -132,7 +132,7 @@ jobs:
    - name: Set up Go 1.x
      uses: actions/setup-go@v6
      with:
-        go-version: ^1.25
+        go-version: ^1.24
        cache: true
        cache-dependency-path: |
          **/go.sum
@@ -311,7 +311,7 @@ jobs:
    - name: Set up Go 1.x
      uses: actions/setup-go@v6
      with:
-        go-version: ^1.25
+        go-version: ^1.24
        cache: true
        cache-dependency-path: |
          **/go.sum
@@ -473,7 +473,7 @@ jobs:
    - name: Set up Go 1.x
      uses: actions/setup-go@v6
      with:
-        go-version: ^1.25
+        go-version: ^1.24
        cache: true
        cache-dependency-path: |
          **/go.sum
@@ -631,7 +631,7 @@ jobs:
    - name: Set up Go 1.x
      uses: actions/setup-go@v6
      with:
-        go-version: ^1.25
+        go-version: ^1.24
        cache: true
        cache-dependency-path: |
          **/go.sum
@@ -789,7 +789,7 @@ jobs:
    - name: Set up Go 1.x
      uses: actions/setup-go@v6
      with:
-        go-version: ^1.25
+        go-version: ^1.24
      id: go

    - name: Check out code
@@ -30,6 +30,7 @@ permissions:
  contents: read

 env:
+  GO_VERSION: '1.24'
  TEST_TIMEOUT: '10m'

 jobs:
@@ -42,10 +43,10 @@ jobs:
    - name: Checkout code
      uses: actions/checkout@v6
      
-    - name: Set up Go
+    - name: Set up Go ${{ env.GO_VERSION }}
      uses: actions/setup-go@v6
      with:
-        go-version-file: 'go.mod'
+        go-version: ${{ env.GO_VERSION }}
        
    - name: Build SeaweedFS
      run: |
@@ -25,14 +25,14 @@ jobs:
    - name: Set up Go 1.x
      uses: actions/setup-go@v6
      with:
-        go-version: ^1.25
+        go-version: ^1.24
      id: go

    - name: Check out code
      uses: actions/checkout@v6

    - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v4
+      uses: docker/setup-buildx-action@v3

    - name: Cache Docker layers
      uses: actions/cache@v5
@@ -5,8 +5,6 @@ on:
    paths:
      - 'weed/iam/**'
      - 'weed/s3api/**'
-      - 'weed/credential/**'
-      - 'weed/pb/**'
      - 'test/s3/iam/**'
      - '.github/workflows/s3-iam-tests.yml'
  push:
@@ -14,8 +12,6 @@ on:
    paths:
      - 'weed/iam/**'
      - 'weed/s3api/**'
-      - 'weed/credential/**'
-      - 'weed/pb/**'
      - 'test/s3/iam/**'
      - '.github/workflows/s3-iam-tests.yml'
  
@@ -84,7 +80,7 @@ jobs:
    timeout-minutes: 25
    strategy:
      matrix:
-        test-type: ["basic", "advanced", "policy-enforcement", "group"]
+        test-type: ["basic", "advanced", "policy-enforcement"]
        
    steps:
      - name: Check out code
@@ -121,7 +117,7 @@ jobs:
            "basic")
              echo "Running basic IAM functionality tests..."
              make clean setup start-services wait-for-services
-              go test -v -timeout 15m -run "TestS3IAMAuthentication|TestS3IAMBasicWorkflow|TestS3IAMTokenValidation|TestIAMUserManagement|TestIAMAccessKeyManagement|TestIAMPolicyManagement" ./...
+              go test -v -timeout 15m -run "TestS3IAMAuthentication|TestS3IAMBasicWorkflow|TestS3IAMTokenValidation|TestIAM" ./...
              ;;
            "advanced")
              echo "Running advanced IAM feature tests..."
@@ -133,11 +129,6 @@ jobs:
              make clean setup start-services wait-for-services
              go test -v -timeout 15m -run "TestS3IAMPolicyEnforcement|TestS3IAMBucketPolicy|TestS3IAMContextual" ./...
              ;;
-            "group")
-              echo "Running IAM group management tests..."
-              make clean setup start-services wait-for-services
-              go test -v -timeout 15m -run "TestIAMGroup" ./...
-              ;;
            *)
              echo "Unknown test type: ${{ matrix.test-type }}"
              exit 1
@@ -41,7 +41,7 @@ jobs:
      - name: Set up Go
        uses: actions/setup-go@v6
        with:
-          go-version: ^1.25
+          go-version: ^1.24
          cache: true
      
      - name: Set up Python ${{ matrix.python-version }}
@@ -148,7 +148,7 @@ jobs:
      - name: Set up Go
        uses: actions/setup-go@v6
        with:
-          go-version: ^1.25
+          go-version: ^1.24
          cache: true
      
      - name: Run Go unit tests
@@ -29,7 +29,7 @@ jobs:
        id: go

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3

      - name: Build SeaweedFS binary for Linux
        run: |
@@ -33,7 +33,7 @@ jobs:
        id: go

      - name: Set up Docker
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3

      - name: Install SeaweedFS
        run: |
@@ -144,7 +144,7 @@ jobs:
        id: go

      - name: Set up Docker
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3

      - name: Pre-pull Trino image
        run: docker pull trinodb/trino:479
@@ -271,7 +271,7 @@ jobs:
        id: go

      - name: Set up Docker
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3

      - name: Pre-pull Spark image
        run: docker pull apache/spark:3.5.1
@@ -337,7 +337,7 @@ jobs:
        id: go

      - name: Set up Docker
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3

      - name: Pre-pull RisingWave image
        run: |
@@ -405,7 +405,7 @@ jobs:
        id: go

      - name: Set up Docker
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3

      - name: Pre-pull Python image
        run: docker pull python:3
@@ -471,7 +471,7 @@ jobs:
        id: go

      - name: Set up Docker
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3

      - name: Pre-pull Python image
        run: docker pull python:3
@@ -24,6 +24,7 @@ permissions:
  contents: read

 env:
+  GO_VERSION: '1.24'
  TEST_TIMEOUT: '15m'

 jobs:
@@ -36,10 +37,10 @@ jobs:
    - name: Checkout code
      uses: actions/checkout@v6
      
-    - name: Set up Go
+    - name: Set up Go ${{ env.GO_VERSION }}
      uses: actions/setup-go@v6
      with:
-        go-version-file: 'go.mod'
+        go-version: ${{ env.GO_VERSION }}
        
    - name: Install dependencies
      run: |
@@ -43,7 +43,7 @@ jobs:
    - name: Set up Go
      uses: actions/setup-go@v6
      with:
-        go-version-file: 'go.mod'
+        go-version: '1.24'

    - name: Build SeaweedFS binary
      run: |
@@ -24,7 +24,7 @@ jobs:

      - uses: actions/setup-go@v6
        with:
-          go-version: ^1.25
+          go-version: ^1.24

      - name: Build SeaweedFS
        run: |
@@ -28,6 +28,7 @@ permissions:
  contents: read

 env:
+  GO_VERSION: '1.24'
  TEST_TIMEOUT: '30m'

 jobs:
@@ -45,10 +46,10 @@ jobs:
      - name: Checkout code
        uses: actions/checkout@v6

-      - name: Set up Go
+      - name: Set up Go ${{ env.GO_VERSION }}
        uses: actions/setup-go@v6
        with:
-          go-version-file: 'go.mod'
+          go-version: ${{ env.GO_VERSION }}

      - name: Build SeaweedFS binary
        run: |
@@ -1,4 +1,4 @@
-FROM golang:1.25 AS builder
+FROM golang:1.24 AS builder

 RUN apt-get update && \
    apt-get install -y build-essential wget ca-certificates && \
@@ -1,4 +1,4 @@
-FROM golang:1.25-alpine AS builder
+FROM golang:1.24-alpine as builder
 RUN apk add git g++ fuse
 RUN mkdir -p /go/src/github.com/seaweedfs/
 ARG BRANCH=${BRANCH:-master}
@@ -1,4 +1,4 @@
-FROM golang:1.25 AS builder
+FROM golang:1.24 AS builder

 RUN apt-get update
 RUN apt-get install -y build-essential libsnappy-dev zlib1g-dev libbz2-dev libgflags-dev liblz4-dev libzstd-dev
@@ -1,4 +1,4 @@
-FROM golang:1.25 AS builder
+FROM golang:1.24 AS builder

 RUN apt-get update
 RUN apt-get install -y build-essential libsnappy-dev zlib1g-dev libbz2-dev libgflags-dev liblz4-dev libzstd-dev
@@ -7,7 +7,6 @@

 [master.maintenance]
 # periodically run these scripts are the same as running them from 'weed shell'
-# Scripts are skipped while an admin server is connected.
 scripts = """
  lock
  ec.encode -fullPercent=95 -quietFor=1h
@@ -1,6 +1,6 @@
 module github.com/seaweedfs/seaweedfs

-go 1.25.0
+go 1.24.9

 require (
 	cloud.google.com/go v0.123.0 // indirect
@@ -63,11 +63,11 @@ require (
 	github.com/prometheus/client_golang v1.23.2
 	github.com/prometheus/client_model v0.6.2 // indirect
 	github.com/prometheus/common v0.67.2 // indirect
-	github.com/prometheus/procfs v0.20.1
+	github.com/prometheus/procfs v0.19.2
 	github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/seaweedfs/goexif v1.0.3
-	github.com/seaweedfs/raft v1.1.7
+	github.com/seaweedfs/raft v1.1.6
 	github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af // indirect
 	github.com/spf13/afero v1.15.0 // indirect
 	github.com/spf13/cast v1.10.0 // indirect
@@ -87,7 +87,7 @@ require (
 	github.com/xdg-go/stringprep v1.0.4 // indirect
 	github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect
 	go.etcd.io/etcd/client/v3 v3.6.7
-	go.mongodb.org/mongo-driver v1.17.9
+	go.mongodb.org/mongo-driver v1.17.6
 	go.opencensus.io v0.24.0 // indirect
 	gocloud.dev v0.45.0
 	gocloud.dev/pubsub/natspubsub v0.45.0
@@ -96,14 +96,14 @@ require (
 	golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546
 	golang.org/x/image v0.36.0
 	golang.org/x/net v0.49.0
-	golang.org/x/oauth2 v0.36.0
-	golang.org/x/sys v0.42.0
+	golang.org/x/oauth2 v0.35.0
+	golang.org/x/sys v0.41.0
 	golang.org/x/text v0.34.0 // indirect
 	golang.org/x/tools v0.41.0 // indirect
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
 	google.golang.org/api v0.258.0
 	google.golang.org/genproto v0.0.0-20251124214823-79d6a2a48846 // indirect
-	google.golang.org/grpc v1.79.3
+	google.golang.org/grpc v1.78.0
 	google.golang.org/protobuf v1.36.11
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	modernc.org/b v1.0.0 // indirect
@@ -124,13 +124,13 @@ require (
 	github.com/apple/foundationdb/bindings/go v0.0.0-20250911184653-27f7192f47c3
 	github.com/arangodb/go-driver v1.6.9
 	github.com/armon/go-metrics v0.4.1
-	github.com/aws/aws-sdk-go-v2 v1.41.4
+	github.com/aws/aws-sdk-go-v2 v1.41.1
 	github.com/aws/aws-sdk-go-v2/config v1.32.7
-	github.com/aws/aws-sdk-go-v2/credentials v1.19.12
+	github.com/aws/aws-sdk-go-v2/credentials v1.19.7
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.95.0
 	github.com/cognusion/imaging v1.0.2
 	github.com/fluent/fluent-logger-golang v1.10.1
-	github.com/getsentry/sentry-go v0.43.0
+	github.com/getsentry/sentry-go v0.42.0
 	github.com/go-ldap/ldap/v3 v3.4.12
 	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/google/flatbuffers/go v0.0.0-20230108230133-3b8644d32c50
@@ -151,7 +151,7 @@ require (
 	github.com/schollz/progressbar/v3 v3.19.0
 	github.com/seaweedfs/go-fuse/v2 v2.9.1
 	github.com/shirou/gopsutil/v4 v4.26.2
-	github.com/tarantool/go-tarantool/v2 v2.4.2
+	github.com/tarantool/go-tarantool/v2 v2.4.1
 	github.com/testcontainers/testcontainers-go v0.39.0
 	github.com/tikv/client-go/v2 v2.0.7
 	github.com/xeipuuv/gojsonschema v1.2.0
@@ -183,13 +183,13 @@ require (
 	github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
 	github.com/apache/arrow-go/v18 v18.4.1 // indirect
 	github.com/apache/thrift v0.22.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/signin v1.0.8 // indirect
+	github.com/aws/aws-sdk-go-v2/service/signin v1.0.5 // indirect
 	github.com/bahlo/generic-list-go v0.2.0 // indirect
 	github.com/bazelbuild/rules_go v0.46.0 // indirect
 	github.com/biogo/store v0.0.0-20201120204734-aad293a2328f // indirect
 	github.com/blevesearch/snowballstem v0.9.0 // indirect
 	github.com/boombuler/barcode v1.1.0 // indirect
-	github.com/buger/jsonparser v1.1.2 // indirect
+	github.com/buger/jsonparser v1.1.1 // indirect
 	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
 	github.com/clipperhouse/stringish v0.1.1 // indirect
 	github.com/clipperhouse/uax29/v2 v2.3.0 // indirect
@@ -326,22 +326,22 @@ require (
 	github.com/appscode/go-querystring v0.0.0-20170504095604-0126cfb3f1dc // indirect
 	github.com/arangodb/go-velocypack v0.0.0-20200318135517-5af53c29c67e // indirect
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.4 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.17 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.20.12 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.20 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.20 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.17 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.17 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.16 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.7 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.20 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.17 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.16 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sns v1.39.7 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sqs v1.42.17 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.30.13 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.41.9
-	github.com/aws/smithy-go v1.24.2
+	github.com/aws/aws-sdk-go-v2/service/sso v1.30.9 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.13 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.41.6
+	github.com/aws/smithy-go v1.24.0
 	github.com/boltdb/bolt v1.3.1 // indirect
 	github.com/bradenaw/juniper v0.15.3 // indirect
 	github.com/bradfitz/iter v0.0.0-20191230175014-e8f45d346db8 // indirect
@@ -352,7 +352,7 @@ require (
 	github.com/cloudinary/cloudinary-go/v2 v2.13.0 // indirect
 	github.com/cloudsoda/go-smb2 v0.0.0-20250228001242-d4c70e6251cc // indirect
 	github.com/cloudsoda/sddl v0.0.0-20250224235906-926454e91efc // indirect
-	github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 // indirect
+	github.com/cncf/xds/go v0.0.0-20251110193048-8bfbf64dc13e // indirect
 	github.com/colinmarc/hdfs/v2 v2.4.0 // indirect
 	github.com/creasty/defaults v1.8.0 // indirect
 	github.com/cronokirby/saferith v0.33.0 // indirect
@@ -365,7 +365,7 @@ require (
 	github.com/emersion/go-message v0.18.2 // indirect
 	github.com/emersion/go-vcard v0.0.0-20241024213814-c9703dde27ff // indirect
 	github.com/envoyproxy/go-control-plane/envoy v1.36.0 // indirect
-	github.com/envoyproxy/protoc-gen-validate v1.3.0 // indirect
+	github.com/envoyproxy/protoc-gen-validate v1.2.1 // indirect
 	github.com/fatih/color v1.18.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/flynn/noise v1.1.0 // indirect
@@ -443,7 +443,7 @@ require (
 	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/pengsrc/go-shared v0.2.1-0.20190131101655-1999055a4a14 // indirect
 	github.com/philhofer/fwd v1.2.0 // indirect
-	github.com/pierrec/lz4/v4 v4.1.26
+	github.com/pierrec/lz4/v4 v4.1.25
 	github.com/pingcap/errors v0.11.5-0.20211224045212-9687c2b0f87c // indirect
 	github.com/pingcap/failpoint v0.0.0-20220801062533-2eaa32854a6c // indirect
 	github.com/pingcap/kvproto v0.0.0-20230403051650-e166ae588106 // indirect
@@ -490,7 +490,7 @@ require (
 	go.etcd.io/bbolt v1.4.3 // indirect
 	go.etcd.io/etcd/api/v3 v3.6.7 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/detectors/gcp v1.39.0 // indirect
+	go.opentelemetry.io/contrib/detectors/gcp v1.38.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 // indirect
 	go.opentelemetry.io/otel v1.40.0 // indirect
@@ -502,7 +502,7 @@ require (
 	go.uber.org/zap v1.27.1 // indirect
 	golang.org/x/term v0.40.0 // indirect
 	golang.org/x/time v0.14.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20251124214823-79d6a2a48846 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20251213004720-97cd9d5aeac2 // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
 	gopkg.in/validator.v2 v2.0.1 // indirect
@@ -716,50 +716,50 @@ github.com/armon/go-metrics v0.4.1/go.mod h1:E6amYzXo6aW1tqzoZGT755KkbgrJsSdpwZ+
 github.com/atomicgo/cursor v0.0.1/go.mod h1:cBON2QmmrysudxNBFthvMtN32r3jxVRIvzkUiF/RuIk=
 github.com/aws/aws-sdk-go v1.55.8 h1:JRmEUbU52aJQZ2AjX4q4Wu7t4uZjOu71uyNmaWlUkJQ=
 github.com/aws/aws-sdk-go v1.55.8/go.mod h1:ZkViS9AqA6otK+JBBNH2++sx1sgxrPKcSzPPvQkUtXk=
-github.com/aws/aws-sdk-go-v2 v1.41.4 h1:10f50G7WyU02T56ox1wWXq+zTX9I1zxG46HYuG1hH/k=
-github.com/aws/aws-sdk-go-v2 v1.41.4/go.mod h1:mwsPRE8ceUUpiTgF7QmQIJ7lgsKUPQOUl3o72QBrE1o=
+github.com/aws/aws-sdk-go-v2 v1.41.1 h1:ABlyEARCDLN034NhxlRUSZr4l71mh+T5KAeGh6cerhU=
+github.com/aws/aws-sdk-go-v2 v1.41.1/go.mod h1:MayyLB8y+buD9hZqkCW3kX1AKq07Y5pXxtgB+rRFhz0=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.4 h1:489krEF9xIGkOaaX3CE/Be2uWjiXrkCH6gUX+bZA/BU=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.4/go.mod h1:IOAPF6oT9KCsceNTvvYMNHy0+kMF8akOjeDvPENWxp4=
 github.com/aws/aws-sdk-go-v2/config v1.32.7 h1:vxUyWGUwmkQ2g19n7JY/9YL8MfAIl7bTesIUykECXmY=
 github.com/aws/aws-sdk-go-v2/config v1.32.7/go.mod h1:2/Qm5vKUU/r7Y+zUk/Ptt2MDAEKAfUtKc1+3U1Mo3oY=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.12 h1:oqtA6v+y5fZg//tcTWahyN9PEn5eDU/Wpvc2+kJ4aY8=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.12/go.mod h1:U3R1RtSHx6NB0DvEQFGyf/0sbrpJrluENHdPy1j/3TE=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20 h1:zOgq3uezl5nznfoK3ODuqbhVg1JzAGDUhXOsU0IDCAo=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20/go.mod h1:z/MVwUARehy6GAg/yQ1GO2IMl0k++cu1ohP9zo887wE=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.7 h1:tHK47VqqtJxOymRrNtUXN5SP/zUTvZKeLx4tH6PGQc8=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.7/go.mod h1:qOZk8sPDrxhf+4Wf4oT2urYJrYt3RejHSzgAquYeppw=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.17 h1:I0GyV8wiYrP8XpA70g1HBcQO1JlQxCMTW9npl5UbDHY=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.17/go.mod h1:tyw7BOl5bBe/oqvoIeECFJjMdzXoa/dfVz3QQ5lgHGA=
 github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.20.12 h1:Zy6Tme1AA13kX8x3CnkHx5cqdGWGaj/anwOiWGnA0Xo=
 github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.20.12/go.mod h1:ql4uXYKoTM9WUAUSmthY4AtPVrlTBZOvnBJTiCUdPxI=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.20 h1:CNXO7mvgThFGqOFgbNAP2nol2qAWBOGfqR/7tQlvLmc=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.20/go.mod h1:oydPDJKcfMhgfcgBUZaG+toBbwy8yPWubJXBVERtI4o=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.20 h1:tN6W/hg+pkM+tf9XDkWUbDEjGLb+raoBMFsTodcoYKw=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.20/go.mod h1:YJ898MhD067hSHA6xYCx5ts/jEd8BSOLtQDL3iZsvbc=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.17 h1:xOLELNKGp2vsiteLsvLPwxC+mYmO6OZ8PYgiuPJzF8U=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.17/go.mod h1:5M5CI3D12dNOtH3/mk6minaRwI2/37ifCURZISxA/IQ=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.17 h1:WWLqlh79iO48yLkj1v3ISRNiv+3KdQoZ6JWyfcsyQik=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.17/go.mod h1:EhG22vHRrvF8oXSTYStZhJc1aUgKtnJe+aOiFEV90cM=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 h1:WKuaxf++XKWlHWu9ECbMlha8WOEGm0OUEZqm4K/Gcfk=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4/go.mod h1:ZWy7j6v1vWGmPReu0iSGvRiise4YI5SkR3OHKTZ6Wuc=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.16 h1:CjMzUs78RDDv4ROu3JnJn/Ig1r6ZD7/T2DXLLRpejic=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.16/go.mod h1:uVW4OLBqbJXSHJYA9svT9BluSvvwbzLQ2Crf6UPzR3c=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 h1:5EniKhLZe4xzL7a+fU3C2tfUN4nWIqlLesfrjkuPFTY=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7/go.mod h1:x0nZssQ3qZSnIcePWLvcoFisRXJzcTVvYpAAdYX8+GI=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4 h1:0ryTNEdJbzUCEWkVXEXoqlXV72J5keC1GvILMOuD00E=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4/go.mod h1:HQ4qwNZh32C3CBeO6iJLQlgtMzqeG17ziAA/3KDJFow=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.7 h1:DIBqIrJ7hv+e4CmIk2z3pyKT+3B6qVMgRsawHiR3qso=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.7/go.mod h1:vLm00xmBke75UmpNvOcZQ/Q30ZFjbczeLFqGx5urmGo=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.20 h1:2HvVAIq+YqgGotK6EkMf+KIEqTISmTYh5zLpYyeTo1Y=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.20/go.mod h1:V4X406Y666khGa8ghKmphma/7C0DAtEQYhkq9z4vpbk=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.17 h1:RuNSMoozM8oXlgLG/n6WLaFGoea7/CddrCfIiSA+xdY=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.17/go.mod h1:F2xxQ9TZz5gDWsclCtPQscGpP0VUOc8RqgFM3vDENmU=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.16 h1:NSbvS17MlI2lurYgXnCOLvCFX38sBW4eiVER7+kkgsU=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.16/go.mod h1:SwT8Tmqd4sA6G1qaGdzWCJN99bUmPGHfRwwq3G5Qb+A=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.95.0 h1:MIWra+MSq53CFaXXAywB2qg9YvVZifkk6vEGl/1Qor0=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.95.0/go.mod h1:79S2BdqCJpScXZA2y+cpZuocWsjGjJINyXnOsf5DTz8=
-github.com/aws/aws-sdk-go-v2/service/signin v1.0.8 h1:0GFOLzEbOyZABS3PhYfBIx2rNBACYcKty+XGkTgw1ow=
-github.com/aws/aws-sdk-go-v2/service/signin v1.0.8/go.mod h1:LXypKvk85AROkKhOG6/YEcHFPoX+prKTowKnVdcaIxE=
+github.com/aws/aws-sdk-go-v2/service/signin v1.0.5 h1:VrhDvQib/i0lxvr3zqlUwLwJP4fpmpyD9wYG1vfSu+Y=
+github.com/aws/aws-sdk-go-v2/service/signin v1.0.5/go.mod h1:k029+U8SY30/3/ras4G/Fnv/b88N4mAfliNn08Dem4M=
 github.com/aws/aws-sdk-go-v2/service/sns v1.39.7 h1:fovS7qGMT+BBSuifkySdVaMWxXTyaYT6qaBx/1y6Ij4=
 github.com/aws/aws-sdk-go-v2/service/sns v1.39.7/go.mod h1:gFahrattA8ulEtiS4XL/fQiQ77l+Urc52Y96/r1e6ks=
 github.com/aws/aws-sdk-go-v2/service/sqs v1.42.17 h1:ZNMxVFPayuHe14u/vn+BwLi3wxQvxcNTw8WdPv2gqBc=
 github.com/aws/aws-sdk-go-v2/service/sqs v1.42.17/go.mod h1:ZxqweFQ2w6NNznWMUvWV9AvkAfM6J8F/MC250Mb4n1I=
-github.com/aws/aws-sdk-go-v2/service/sso v1.30.13 h1:kiIDLZ005EcKomYYITtfsjn7dtOwHDOFy7IbPXKek2o=
-github.com/aws/aws-sdk-go-v2/service/sso v1.30.13/go.mod h1:2h/xGEowcW/g38g06g3KpRWDlT+OTfxxI0o1KqayAB8=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17 h1:jzKAXIlhZhJbnYwHbvUQZEB8KfgAEuG0dc08Bkda7NU=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17/go.mod h1:Al9fFsXjv4KfbzQHGe6V4NZSZQXecFcvaIF4e70FoRA=
-github.com/aws/aws-sdk-go-v2/service/sts v1.41.9 h1:Cng+OOwCHmFljXIxpEVXAGMnBia8MSU6Ch5i9PgBkcU=
-github.com/aws/aws-sdk-go-v2/service/sts v1.41.9/go.mod h1:LrlIndBDdjA/EeXeyNBle+gyCwTlizzW5ycgWnvIxkk=
-github.com/aws/smithy-go v1.24.2 h1:FzA3bu/nt/vDvmnkg+R8Xl46gmzEDam6mZ1hzmwXFng=
-github.com/aws/smithy-go v1.24.2/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
+github.com/aws/aws-sdk-go-v2/service/sso v1.30.9 h1:v6EiMvhEYBoHABfbGB4alOYmCIrcgyPPiBE1wZAEbqk=
+github.com/aws/aws-sdk-go-v2/service/sso v1.30.9/go.mod h1:yifAsgBxgJWn3ggx70A3urX2AN49Y5sJTD1UQFlfqBw=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.13 h1:gd84Omyu9JLriJVCbGApcLzVR3XtmC4ZDPcAI6Ftvds=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.13/go.mod h1:sTGThjphYE4Ohw8vJiRStAcu3rbjtXRsdNB0TvZ5wwo=
+github.com/aws/aws-sdk-go-v2/service/sts v1.41.6 h1:5fFjR/ToSOzB2OQ/XqWpZBmNvmP/pJ1jOWYlFDJTjRQ=
+github.com/aws/aws-sdk-go-v2/service/sts v1.41.6/go.mod h1:qgFDZQSD/Kys7nJnVqYlWKnh0SSdMjAi0uSwON4wgYQ=
+github.com/aws/smithy-go v1.24.0 h1:LpilSUItNPFr1eY85RYgTIg5eIEPtvFbskaFcmmIUnk=
+github.com/aws/smithy-go v1.24.0/go.mod h1:LEj2LM3rBRQJxPZTB4KuzZkaZYnZPnvgIhb4pu07mx0=
 github.com/bahlo/generic-list-go v0.2.0 h1:5sz/EEAK+ls5wF+NeqDpk5+iNdMDXrh3z3nPnH1Wvgk=
 github.com/bahlo/generic-list-go v0.2.0/go.mod h1:2KvAjgMlE5NNynlg/5iLrrCCZ2+5xWbdbCW3pNTGyYg=
 github.com/bazelbuild/rules_go v0.46.0 h1:CTefzjN/D3Cdn3rkrM6qMWuQj59OBcuOjyIp3m4hZ7s=
@@ -796,8 +796,8 @@ github.com/bufbuild/protocompile v0.14.1 h1:iA73zAf/fyljNjQKwYzUHD6AD4R8KMasmwa/
 github.com/bufbuild/protocompile v0.14.1/go.mod h1:ppVdAIhbr2H8asPk6k4pY7t9zB1OU5DoEw9xY/FUi1c=
 github.com/buger/goterm v1.0.4 h1:Z9YvGmOih81P0FbVtEYTFF6YsSgxSUKEhf/f9bTMXbY=
 github.com/buger/goterm v1.0.4/go.mod h1:HiFWV3xnkolgrBV3mY8m0X0Pumt4zg4QhbdOzQtB8tE=
-github.com/buger/jsonparser v1.1.2 h1:frqHqw7otoVbk5M8LlE/L7HTnIq2v9RX6EJ48i9AxJk=
-github.com/buger/jsonparser v1.1.2/go.mod h1:6RYKKt7H4d4+iWqouImQ9R2FZql3VbhNgx27UK13J/0=
+github.com/buger/jsonparser v1.1.1 h1:2PnMjfWD7wBILjqQbt530v576A/cAbQvEW9gGIpYMUs=
+github.com/buger/jsonparser v1.1.1/go.mod h1:6RYKKt7H4d4+iWqouImQ9R2FZql3VbhNgx27UK13J/0=
 github.com/bwesterb/go-ristretto v1.2.0/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7NFEuV9ekS419A0=
 github.com/bwmarrin/snowflake v0.3.0 h1:xm67bEhkKh6ij1790JB83OujPR5CzNe8QuQqAgISZN0=
 github.com/bwmarrin/snowflake v0.3.0/go.mod h1:NdZxfVWX+oR6y2K0o6qAYv6gIOP9rjG0/E9WsDpxqwE=
@@ -857,8 +857,8 @@ github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWH
 github.com/cncf/xds/go v0.0.0-20220314180256-7f1daf1720fc/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20230105202645-06c439db220b/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20230310173818-32f1caf87195/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 h1:6xNmx7iTtyBRev0+D/Tv1FZd4SCg8axKApyNyRsAt/w=
-github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5/go.mod h1:KdCmV+x/BuvyMxRnYBlmVaq4OLiKW6iRQfvC62cvdkI=
+github.com/cncf/xds/go v0.0.0-20251110193048-8bfbf64dc13e h1:gt7U1Igw0xbJdyaCM5H2CnlAlPSkzrhsebQB6WQWjLA=
+github.com/cncf/xds/go v0.0.0-20251110193048-8bfbf64dc13e/go.mod h1:KdCmV+x/BuvyMxRnYBlmVaq4OLiKW6iRQfvC62cvdkI=
 github.com/cockroachdb/apd/v3 v3.2.1 h1:U+8j7t0axsIgvQUqthuNm82HIrYXodOV2iWLWtEaIwg=
 github.com/cockroachdb/apd/v3 v3.2.1/go.mod h1:klXJcjp+FffLTHlhIG69tezTDvdP065naDsHzKhYSqc=
 github.com/cockroachdb/errors v1.11.3 h1:5bA+k2Y6r+oz/6Z/RFlNeVCesGARKuC6YymtcDrbC/I=
@@ -1000,8 +1000,8 @@ github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.
 github.com/envoyproxy/go-control-plane v0.10.2-0.20220325020618-49ff273808a1/go.mod h1:KJwIaB5Mv44NWtYuAOFCVOjcI94vtpEz2JU/D2v6IjE=
 github.com/envoyproxy/go-control-plane v0.10.3/go.mod h1:fJJn/j26vwOu972OllsvAgJJM//w9BV6Fxbg2LuVd34=
 github.com/envoyproxy/go-control-plane v0.11.0/go.mod h1:VnHyVMpzcLvCFt9yUz1UnCwHLhwx1WguiVDV7pTG/tI=
-github.com/envoyproxy/go-control-plane v0.14.0 h1:hbG2kr4RuFj222B6+7T83thSPqLjwBIfQawTkC++2HA=
-github.com/envoyproxy/go-control-plane v0.14.0/go.mod h1:NcS5X47pLl/hfqxU70yPwL9ZMkUlwlKxtAohpi2wBEU=
+github.com/envoyproxy/go-control-plane v0.13.5-0.20251024222203-75eaa193e329 h1:K+fnvUM0VZ7ZFJf0n4L/BRlnsb9pL/GuDG6FqaH+PwM=
+github.com/envoyproxy/go-control-plane v0.13.5-0.20251024222203-75eaa193e329/go.mod h1:Alz8LEClvR7xKsrq3qzoc4N0guvVNSS8KmSChGYr9hs=
 github.com/envoyproxy/go-control-plane/envoy v1.36.0 h1:yg/JjO5E7ubRyKX3m07GF3reDNEnfOboJ0QySbH736g=
 github.com/envoyproxy/go-control-plane/envoy v1.36.0/go.mod h1:ty89S1YCCVruQAm9OtKeEkQLTb+Lkz0k8v9W0Oxsv98=
 github.com/envoyproxy/go-control-plane/ratelimit v0.1.0 h1:/G9QYbddjL25KvtKTv3an9lx6VBE2cnb8wp1vEGNYGI=
@@ -1010,8 +1010,8 @@ github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7
 github.com/envoyproxy/protoc-gen-validate v0.6.7/go.mod h1:dyJXwwfPK2VSqiB9Klm1J6romD608Ba7Hij42vrOBCo=
 github.com/envoyproxy/protoc-gen-validate v0.9.1/go.mod h1:OKNgG7TCp5pF4d6XftA0++PMirau2/yoOwVac3AbF2w=
 github.com/envoyproxy/protoc-gen-validate v0.10.0/go.mod h1:DRjgyB0I43LtJapqN6NiRwroiAU2PaFuvk/vjgh61ss=
-github.com/envoyproxy/protoc-gen-validate v1.3.0 h1:TvGH1wof4H33rezVKWSpqKz5NXWg5VPuZ0uONDT6eb4=
-github.com/envoyproxy/protoc-gen-validate v1.3.0/go.mod h1:HvYl7zwPa5mffgyeTUHA9zHIH36nmrm7oCbo4YKoSWA=
+github.com/envoyproxy/protoc-gen-validate v1.2.1 h1:DEo3O99U8j4hBFwbJfrz9VtgcDfUKS7KJ7spH3d86P8=
+github.com/envoyproxy/protoc-gen-validate v1.2.1/go.mod h1:d/C80l/jxXLdfEIhX1W2TmLfsJ31lvEjwamM4DxlWXU=
 github.com/facebookgo/clock v0.0.0-20150410010913-600d898af40a h1:yDWHCSQ40h88yih2JAcL6Ls/kVkSE8GFACTGVnMPruw=
 github.com/facebookgo/clock v0.0.0-20150410010913-600d898af40a/go.mod h1:7Ga40egUymuWXxAe151lTNnCv97MddSOVsjpPPkityA=
 github.com/facebookgo/ensure v0.0.0-20200202191622-63f1cf65ac4c h1:8ISkoahWXwZR41ois5lSJBSVw4D0OV19Ht/JSTzvSv0=
@@ -1053,8 +1053,8 @@ github.com/gabriel-vasile/mimetype v1.4.11 h1:AQvxbp830wPhHTqc1u7nzoLT+ZFxGY7emj
 github.com/gabriel-vasile/mimetype v1.4.11/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
 github.com/geoffgarside/ber v1.2.0 h1:/loowoRcs/MWLYmGX9QtIAbA+V/FrnVLsMMPhwiRm64=
 github.com/geoffgarside/ber v1.2.0/go.mod h1:jVPKeCbj6MvQZhwLYsGwaGI52oUorHoHKNecGT85ZCc=
-github.com/getsentry/sentry-go v0.43.0 h1:XbXLpFicpo8HmBDaInk7dum18G9KSLcjZiyUKS+hLW4=
-github.com/getsentry/sentry-go v0.43.0/go.mod h1:XDotiNZbgf5U8bPDUAfvcFmOnMQQceESxyKaObSssW0=
+github.com/getsentry/sentry-go v0.42.0 h1:eeFMACuZTbUQf90RE8dE4tXeSe4CZyfvR1MBL7RLEt8=
+github.com/getsentry/sentry-go v0.42.0/go.mod h1:eRXCoh3uvmjQLY6qu63BjUZnaBu5L5WhMV1RwYO8W5s=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/gin-contrib/sse v1.1.0 h1:n0w2GMuUpWDVp7qSpvze6fAu9iRxJY4Hmj6AmBOU05w=
 github.com/gin-contrib/sse v1.1.0/go.mod h1:hxRZ5gVpWMT7Z0B0gSNYqqsSCNIJMjzvm6fqCz9vjwM=
@@ -1698,8 +1698,8 @@ github.com/phpdave11/gofpdf v1.4.2/go.mod h1:zpO6xFn9yxo3YLyMvW8HcKWVdbNqgIfOOp2
 github.com/phpdave11/gofpdi v1.0.12/go.mod h1:vBmVV0Do6hSBHC8uKUQ71JGW+ZGQq74llk/7bXwjDoI=
 github.com/phpdave11/gofpdi v1.0.13/go.mod h1:vBmVV0Do6hSBHC8uKUQ71JGW+ZGQq74llk/7bXwjDoI=
 github.com/pierrec/lz4/v4 v4.1.15/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
-github.com/pierrec/lz4/v4 v4.1.26 h1:GrpZw1gZttORinvzBdXPUXATeqlJjqUG/D87TKMnhjY=
-github.com/pierrec/lz4/v4 v4.1.26/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4=
+github.com/pierrec/lz4/v4 v4.1.25 h1:kocOqRffaIbU5djlIBr7Wh+cx82C0vtFb0fOurZHqD0=
+github.com/pierrec/lz4/v4 v4.1.25/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4=
 github.com/pierrre/compare v1.0.2 h1:k4IUsHgh+dbcAOIWCfxVa/7G6STjADH2qmhomv+1quc=
 github.com/pierrre/compare v1.0.2/go.mod h1:8UvyRHH+9HS8Pczdd2z5x/wvv67krDwVxoOndaIIDVU=
 github.com/pierrre/geohash v1.0.0 h1:f/zfjdV4rVofTCz1FhP07T+EMQAvcMM2ioGZVt+zqjI=
@@ -1769,8 +1769,8 @@ github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsT
 github.com/prometheus/procfs v0.0.8/go.mod h1:7Qr8sr6344vo1JqZ6HhLceV9o3AJ1Ff+GxbHq6oeK9A=
 github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
 github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
-github.com/prometheus/procfs v0.20.1 h1:XwbrGOIplXW/AU3YhIhLODXMJYyC1isLFfYCsTEycfc=
-github.com/prometheus/procfs v0.20.1/go.mod h1:o9EMBZGRyvDrSPH1RqdxhojkuXstoe4UlK79eF5TGGo=
+github.com/prometheus/procfs v0.19.2 h1:zUMhqEW66Ex7OXIiDkll3tl9a1ZdilUOd/F6ZXw4Vws=
+github.com/prometheus/procfs v0.19.2/go.mod h1:M0aotyiemPhBCM0z5w87kL22CxfcH05ZpYlu+b4J7mw=
 github.com/pterm/pterm v0.12.27/go.mod h1:PhQ89w4i95rhgE+xedAoqous6K9X+r6aSOI2eFF7DZI=
 github.com/pterm/pterm v0.12.29/go.mod h1:WI3qxgvoQFFGKGjGnJR849gU0TsEOvKn5Q8LlY1U7lg=
 github.com/pterm/pterm v0.12.30/go.mod h1:MOqLIyMOgmTDz9yorcYbcw+HsgoZo3BQfg2wtl3HEFE=
@@ -1849,8 +1849,8 @@ github.com/seaweedfs/go-fuse/v2 v2.9.1 h1:gnKmfrKreCRGJmekGz5WMnNZqXEf9s9+V2hdWQ
 github.com/seaweedfs/go-fuse/v2 v2.9.1/go.mod h1:zABdmWEa6A0bwaBeEOBUeUkGIZlxUhcdv+V1Dcc/U/I=
 github.com/seaweedfs/goexif v1.0.3 h1:ve/OjI7dxPW8X9YQsv3JuVMaxEyF9Rvfd04ouL+Bz30=
 github.com/seaweedfs/goexif v1.0.3/go.mod h1:Oni780Z236sXpIQzk1XoJlTwqrJ02smEin9zQeff7Fk=
-github.com/seaweedfs/raft v1.1.7 h1:3mVJZ2p4rdvBtbbrHROPjYKtH+q5qjMBc56G6VRu1kA=
-github.com/seaweedfs/raft v1.1.7/go.mod h1:fgs/rAVEzjQ7e04XMzG3eJhwZZRmBW+2uRtjakeCGeU=
+github.com/seaweedfs/raft v1.1.6 h1:e83Xn0boscPnuSiBllUPeWRVS6JKrqJPYBozgFyBiC0=
+github.com/seaweedfs/raft v1.1.6/go.mod h1:9cYlEBA+djJbnf/5tWsCybtbL7ICYpi+Uxcg3MxjuNs=
 github.com/secure-systems-lab/go-securesystemslib v0.4.0 h1:b23VGrQhTA8cN2CbBw7/FulN9fTtqYUdS5+Oxzt+DUE=
 github.com/secure-systems-lab/go-securesystemslib v0.4.0/go.mod h1:FGBZgq2tXWICsxWQW1msNf49F0Pf2Op5Htayx335Qbs=
 github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
@@ -1940,8 +1940,8 @@ github.com/t3rm1n4l/go-mega v0.0.0-20251031123324-a804aaa87491/go.mod h1:ykucQyi
 github.com/tailscale/depaware v0.0.0-20210622194025-720c4b409502/go.mod h1:p9lPsd+cx33L3H9nNoecRRxPssFKUwwI50I3pZ0yT+8=
 github.com/tarantool/go-iproto v1.1.0 h1:HULVOIHsiehI+FnHfM7wMDntuzUddO09DKqu2WnFQ5A=
 github.com/tarantool/go-iproto v1.1.0/go.mod h1:LNCtdyZxojUed8SbOiYHoc3v9NvaZTB7p96hUySMlIo=
-github.com/tarantool/go-tarantool/v2 v2.4.2 h1:rkzYtFhLJLA9RDIhjzN93MJBN5PBxHW4+soq+RB90gE=
-github.com/tarantool/go-tarantool/v2 v2.4.2/go.mod h1:MTbhdjFc3Jl63Lgi/UJr5D+QbT+QegqOzsNJGmaw7VM=
+github.com/tarantool/go-tarantool/v2 v2.4.1 h1:Bk9mh+gMPVmHTSefHvVBpEkf6P2UZA/8xa5kqgyQtyo=
+github.com/tarantool/go-tarantool/v2 v2.4.1/go.mod h1:MTbhdjFc3Jl63Lgi/UJr5D+QbT+QegqOzsNJGmaw7VM=
 github.com/testcontainers/testcontainers-go v0.39.0 h1:uCUJ5tA+fcxbFAB0uP3pIK3EJ2IjjDUHFSZ1H1UxAts=
 github.com/testcontainers/testcontainers-go v0.39.0/go.mod h1:qmHpkG7H5uPf/EvOORKvS6EuDkBUPE3zpVGaH9NL7f8=
 github.com/testcontainers/testcontainers-go/modules/compose v0.39.0 h1:N9Kn9UOIq24o3Y01SFDYF5y3hpq4dNBzDS4pynHb/OQ=
@@ -2113,8 +2113,8 @@ go.etcd.io/etcd/client/pkg/v3 v3.6.7 h1:vvzgyozz46q+TyeGBuFzVuI53/yd133CHceNb/Ah
 go.etcd.io/etcd/client/pkg/v3 v3.6.7/go.mod h1:2IVulJ3FZ/czIGl9T4lMF1uxzrhRahLqe+hSgy+Kh7Q=
 go.etcd.io/etcd/client/v3 v3.6.7 h1:9WqA5RpIBtdMxAy1ukXLAdtg2pAxNqW5NUoO2wQrE6U=
 go.etcd.io/etcd/client/v3 v3.6.7/go.mod h1:2XfROY56AXnUqGsvl+6k29wrwsSbEh1lAouQB1vHpeE=
-go.mongodb.org/mongo-driver v1.17.9 h1:IexDdCuuNJ3BHrELgBlyaH9p60JXAvdzWR128q+U5tU=
-go.mongodb.org/mongo-driver v1.17.9/go.mod h1:LlOhpH5NUEfhxcAwG0UEkMqwYcc4JU18gtCdGudk/tQ=
+go.mongodb.org/mongo-driver v1.17.6 h1:87JUG1wZfWsr6rIz3ZmpH90rL5tea7O3IHuSwHUpsss=
+go.mongodb.org/mongo-driver v1.17.6/go.mod h1:Hy04i7O2kC4RS06ZrhPRqj/u4DTYkFDAAccj+rVKqgQ=
 go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
 go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
 go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
@@ -2126,8 +2126,8 @@ go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/contrib/detectors/gcp v1.39.0 h1:kWRNZMsfBHZ+uHjiH4y7Etn2FK26LAGkNFw7RHv1DhE=
-go.opentelemetry.io/contrib/detectors/gcp v1.39.0/go.mod h1:t/OGqzHBa5v6RHZwrDBJ2OirWc+4q/w2fTbLZwAKjTk=
+go.opentelemetry.io/contrib/detectors/gcp v1.38.0 h1:ZoYbqX7OaA/TAikspPl3ozPI6iY6LiIY9I8cUfm+pJs=
+go.opentelemetry.io/contrib/detectors/gcp v1.38.0/go.mod h1:SU+iU7nu5ud4oCb3LQOhIZ3nRLj6FNVrKgtflbaf2ts=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0 h1:YH4g8lQroajqUwWbq/tr2QX1JFmEXaDLgG+ew9bLMWo=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0/go.mod h1:fvPi2qXDqFs8M4B4fmJhE92TyQs9Ydjlg3RvfUp+NbQ=
 go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.56.0 h1:4BZHA+B1wXEQoGNHxW8mURaLhcdGwvRnmhGbm+odRbc=
@@ -2380,8 +2380,8 @@ golang.org/x/oauth2 v0.0.0-20221014153046-6fdb5e3db783/go.mod h1:h4gKUeWbJ4rQPri
 golang.org/x/oauth2 v0.4.0/go.mod h1:RznEsdpjGAINPTOF0UH/t+xJ75L18YO3Ho6Pyn+uRec=
 golang.org/x/oauth2 v0.5.0/go.mod h1:9/XBHVqLaWO3/BRHs5jbpYCnOZVjj5V0ndyaAM7KB4I=
 golang.org/x/oauth2 v0.6.0/go.mod h1:ycmewcwgD4Rpr3eZJLSB4Kyyljb3qDh40vJ8STE5HKw=
-golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
-golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
+golang.org/x/oauth2 v0.35.0 h1:Mv2mzuHuZuY2+bkyWXIHMfhNdJAdwW3FuWeCPYN5GVQ=
+golang.org/x/oauth2 v0.35.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -2509,8 +2509,8 @@ golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
-golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
+golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/telemetry v0.0.0-20260109210033-bd525da824e2 h1:O1cMQHRfwNpDfDJerqRoE2oD+AFlyid87D40L/OkkJo=
 golang.org/x/telemetry v0.0.0-20260109210033-bd525da824e2/go.mod h1:b7fPSJ0pKZ3ccUh8gnTONJxhn3c/PS6tyzQvyqw4iA8=
@@ -2846,8 +2846,8 @@ google.golang.org/genproto v0.0.0-20230222225845-10f96fb3dbec/go.mod h1:3Dl5ZL0q
 google.golang.org/genproto v0.0.0-20230306155012-7f2fa6fef1f4/go.mod h1:NWraEVixdDnqcqQ30jipen1STv2r/n24Wb7twVTGR4s=
 google.golang.org/genproto v0.0.0-20251124214823-79d6a2a48846 h1:dDbsTLIK7EzwUq36kCSAsk0slouq/S0tWHeeGi97cD8=
 google.golang.org/genproto v0.0.0-20251124214823-79d6a2a48846/go.mod h1:PP0g88Dz3C7hRAfbQCQggeWAXjuqGsNPLE4s7jh0RGU=
-google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 h1:fCvbg86sFXwdrl5LgVcTEvNC+2txB5mgROGmRL5mrls=
-google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217/go.mod h1:+rXWjjaukWZun3mLfjmVnQi18E1AsFbDN9QdJ5YXLto=
+google.golang.org/genproto/googleapis/api v0.0.0-20251124214823-79d6a2a48846 h1:ZdyUkS9po3H7G0tuh955QVyyotWvOD4W0aEapeGeUYk=
+google.golang.org/genproto/googleapis/api v0.0.0-20251124214823-79d6a2a48846/go.mod h1:Fk4kyraUvqD7i5H6S43sj2W98fbZa75lpZz/eUyhfO0=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20251213004720-97cd9d5aeac2 h1:2I6GHUeJ/4shcDpoUlLs/2WPnhg7yJwvXtqcMJt9liA=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20251213004720-97cd9d5aeac2/go.mod h1:7i2o+ce6H/6BluujYR+kqX3GKH+dChPTQU19wjRPiGk=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
@@ -2890,8 +2890,8 @@ google.golang.org/grpc v1.51.0/go.mod h1:wgNDFcnuBGmxLKI/qn4T+m5BtEBYXJPvibbUPsA
 google.golang.org/grpc v1.52.0/go.mod h1:pu6fVzoFb+NBYNAvQL08ic+lvB2IojljRYuun5vorUY=
 google.golang.org/grpc v1.53.0/go.mod h1:OnIrk0ipVdj4N5d9IUoFUx72/VlD7+jUsHwZgwSMQpw=
 google.golang.org/grpc v1.55.0/go.mod h1:iYEXKGkEBhg1PjZQvoYEVPTDkHo1/bjTnfwTeGONTY8=
-google.golang.org/grpc v1.79.3 h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE=
-google.golang.org/grpc v1.79.3/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=
+google.golang.org/grpc v1.78.0 h1:K1XZG/yGDJnzMdd/uZHAkVqJE+xIDOcmdSFZkBUicNc=
+google.golang.org/grpc v1.78.0/go.mod h1:I47qjTo4OKbMkjA/aOOwxDIiPSBofUtQUI5EfpWvW7U=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/grpc/examples v0.0.0-20250407062114-b368379ef8f6 h1:ExN12ndbJ608cboPYflpTny6mXSzPrDLh0iTaVrRrds=
 google.golang.org/grpc/examples v0.0.0-20250407062114-b368379ef8f6/go.mod h1:6ytKWczdvnpnO+m+JiG9NjEDzR1FJfsnmJdG7B8QVZ8=
@@ -1,6 +1,6 @@
 apiVersion: v1
 description: SeaweedFS
 name: seaweedfs
-appVersion: "4.17"
+appVersion: "4.13"
 # Dev note: Trigger a helm chart release by `git tag -a helm-<version>`
-version: 4.17.0
+version: 4.0.413
@@ -165,9 +165,8 @@ admin:
  enabled: true
  port: 23646
  grpcPort: 33646  # For worker connections
-  secret:
-    adminUser: "admin"
-    adminPassword: "your-secure-password"  # Leave empty to disable auth
+  adminUser: "admin"
+  adminPassword: "your-secure-password"  # Leave empty to disable auth
  
  # Optional: persist admin data
  data:
@@ -192,8 +191,6 @@ If `adminPassword` is set, the admin interface requires authentication:

 If `adminPassword` is empty or not set, the admin interface runs without authentication (not recommended for production).

-As an alternative, a kubernetes Secret can be used (`admin.secret.existingSecret`).
-
 ### Admin Data Persistence

 The admin component can store configuration and maintenance data. You can configure storage in several ways:
@@ -1539,7 +1539,7 @@
      "pluginVersion": "10.3.1",
      "targets": [
        {
-          "expr": "sum(rate(SeaweedFS_s3_bucket_traffic_received_bytes_total{namespace=\"$NAMESPACE\"}[$__rate_interval])) by (bucket)",
+          "expr": "sum(rate(SeaweedFS_s3_bucket_traffic_received_bytes_total{namespace=\"$NAMESPACE\"}[$__interval])) by (bucket)",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 2,
@@ -1584,7 +1584,7 @@
      "pluginVersion": "10.3.1",
      "targets": [
        {
-          "expr": "sum(rate(SeaweedFS_s3_bucket_traffic_sent_bytes_total{namespace=\"$NAMESPACE\"}[$__rate_interval])) by (bucket)",
+          "expr": "sum(rate(SeaweedFS_s3_bucket_traffic_sent_bytes_total{namespace=\"$NAMESPACE\"}[$__interval])) by (bucket)",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 2,
@@ -1679,7 +1679,7 @@
      "pluginVersion": "10.3.1",
      "targets": [
        {
-          "expr": "sum(rate(SeaweedFS_s3_request_total{namespace=\"$NAMESPACE\"}[$__rate_interval])) by (bucket)",
+          "expr": "sum(rate(SeaweedFS_s3_request_total{namespace=\"$NAMESPACE\"}[$__interval])) by (bucket)",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 2,
@@ -23,15 +23,8 @@
 #
 # Adjust storageClass and sizes to match your cluster's available StorageClasses.
 # On OpenShift you can discover them with: oc get storageclass
-global:
-  enableReplication: true
-  #  replication type is XYZ:
-  # X number of replica in other data centers
-  # Y number of replica in other racks in the same data center
-  # Z number of replica in other servers in the same rack
-  replicationPlacement: "000" # no data replica
+
 master:
-  replicas: 1
  data:
    type: "persistentVolumeClaim"
    size: "10Gi"
@@ -56,7 +49,6 @@ master:
      type: RuntimeDefault

 volume:
-  replicas: 1
  dataDirs:
    - name: data1
      type: "persistentVolumeClaim"
@@ -83,7 +75,6 @@ volume:
      type: RuntimeDefault

 filer:
-  replicas: 1
  data:
    type: "persistentVolumeClaim"
    size: "25Gi"
@@ -1,6 +1,5 @@
-{{- include "seaweedfs.compat" . -}}
 {{- if .Values.admin.enabled }}
-{{- if .Values.global.seaweedfs.monitoring.enabled }}
+{{- if .Values.global.monitoring.enabled }}
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
@@ -12,7 +11,7 @@ metadata:
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: admin
-    {{- with .Values.global.seaweedfs.monitoring.additionalLabels }}
+    {{- with .Values.global.monitoring.additionalLabels }}
    {{- toYaml . | nindent 4 }}
    {{- end }}
 {{- with .Values.admin.serviceMonitor.annotations }}
@@ -1,10 +1,9 @@
-{{- include "seaweedfs.compat" . -}}
 {{- if .Values.admin.enabled }}
 {{- if gt (.Values.admin.replicas | int) 1 }}
 {{- fail "admin.replicas must be 0 or 1" -}}
 {{- end }}
-{{- if and (not .Values.admin.masters) (not .Values.global.seaweedfs.masterServer) (not .Values.master.enabled) }}
-{{- fail "admin.masters or global.seaweedfs.masterServer must be set if master.enabled is false" -}}
+{{- if and (not .Values.admin.masters) (not .Values.global.masterServer) (not .Values.master.enabled) }}
+{{- fail "admin.masters or global.masterServer must be set if master.enabled is false" -}}
 {{- end }}
 apiVersion: apps/v1
 kind: StatefulSet
@@ -51,7 +50,7 @@ spec:
      {{- toYaml . | nindent 8 }}
      {{- end }}
    spec:
-      restartPolicy: {{ default .Values.global.seaweedfs.restartPolicy .Values.admin.restartPolicy }}
+      restartPolicy: {{ default .Values.global.restartPolicy .Values.admin.restartPolicy }}
      {{- if .Values.admin.affinity }}
      affinity:
        {{ tpl .Values.admin.affinity . | nindent 8 | trim }}
@@ -83,12 +82,8 @@ spec:
      containers:
        - name: seaweedfs
          image: {{ template "admin.image" . }}
-          imagePullPolicy: {{ default "IfNotPresent" .Values.global.seaweedfs.imagePullPolicy }}
+          imagePullPolicy: {{ default "IfNotPresent" .Values.global.imagePullPolicy }}
          {{- $adminAuthEnabled := or .Values.admin.secret.existingSecret .Values.admin.secret.adminPassword }}
-          {{- $urlPrefix := .Values.admin.urlPrefix }}
-          {{- if and (not $urlPrefix) .Values.admin.ingress.enabled (ne .Values.admin.ingress.path "/") }}
-          {{- $urlPrefix = trimSuffix "/" .Values.admin.ingress.path }}
-          {{- end }}
          {{- if and .Values.admin.secret.existingSecret (not .Values.admin.secret.userKey) -}}
          {{-   fail "admin.secret.userKey must be set when admin.secret.existingSecret is provided" -}}
          {{- end -}}
@@ -98,12 +93,12 @@ spec:
          {{- $adminSecretName := .Values.admin.secret.existingSecret | default (printf "%s-admin-secret" (include "seaweedfs.fullname" .)) }}
          env:
            {{- if $adminAuthEnabled }}
-            - name: WEED_ADMIN_USER
+            - name: SEAWEEDFS_ADMIN_USER
              valueFrom:
                secretKeyRef:
                  name: {{ $adminSecretName }}
                  key: {{ if .Values.admin.secret.existingSecret }}{{ .Values.admin.secret.userKey }}{{ else }}adminUser{{ end }}
-            - name: WEED_ADMIN_PASSWORD
+            - name: SEAWEEDFS_ADMIN_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: {{ $adminSecretName }}
@@ -124,7 +119,7 @@ spec:
            - name: SEAWEEDFS_FULLNAME
              value: "{{ include "seaweedfs.fullname" . }}"
            {{- $mergedExtraEnvironmentVars := dict }}
-            {{- include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" .Values.global.seaweedfs "component" .Values.admin "target" $mergedExtraEnvironmentVars) }}
+            {{- include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" .Values.global "component" .Values.admin "target" $mergedExtraEnvironmentVars) }}
            {{- range $key := keys $mergedExtraEnvironmentVars | sortAlpha }}
            {{- $value := index $mergedExtraEnvironmentVars $key }}
            - name: {{ $key }}
@@ -148,7 +143,7 @@ spec:
              {{- if .Values.admin.loggingOverrideLevel }}
              -v={{ .Values.admin.loggingOverrideLevel }} \
              {{- else }}
-              -v={{ .Values.global.seaweedfs.loggingLevel }} \
+              -v={{ .Values.global.loggingLevel }} \
              {{- end }}
              admin \
              -port={{ .Values.admin.port }} \
@@ -158,15 +153,16 @@ spec:
              {{- else if .Values.admin.dataDir }}
              -dataDir={{ .Values.admin.dataDir }} \
              {{- end }}
-              {{- if .Values.admin.masters }}
-              -masters={{ .Values.admin.masters }}{{- if or $urlPrefix .Values.admin.extraArgs }} \{{ end }}
-              {{- else if .Values.global.seaweedfs.masterServer }}
-              -masters={{ .Values.global.seaweedfs.masterServer }}{{- if or $urlPrefix .Values.admin.extraArgs }} \{{ end }}
-              {{- else }}
-              -masters={{ range $index := until (.Values.master.replicas | int) }}${SEAWEEDFS_FULLNAME}-master-{{ $index }}.${SEAWEEDFS_FULLNAME}-master.{{ $.Release.Namespace }}:{{ $.Values.master.port }}{{ if lt $index (sub ($.Values.master.replicas | int) 1) }},{{ end }}{{ end }}{{- if or $urlPrefix .Values.admin.extraArgs }} \{{ end }}
+              {{- if $adminAuthEnabled }}
+              -adminUser="${SEAWEEDFS_ADMIN_USER}" \
+              -adminPassword="${SEAWEEDFS_ADMIN_PASSWORD}" \
              {{- end }}
-              {{- if $urlPrefix }}
-              -urlPrefix={{ $urlPrefix }}{{- if .Values.admin.extraArgs }} \{{ end }}
+              {{- if .Values.admin.masters }}
+              -masters={{ .Values.admin.masters }}{{- if .Values.admin.extraArgs }} \{{ end }}
+              {{- else if .Values.global.masterServer }}
+              -masters={{ .Values.global.masterServer }}{{- if .Values.admin.extraArgs }} \{{ end }}
+              {{- else }}
+              -masters={{ range $index := until (.Values.master.replicas | int) }}${SEAWEEDFS_FULLNAME}-master-{{ $index }}.${SEAWEEDFS_FULLNAME}-master.{{ $.Release.Namespace }}:{{ $.Values.master.port }}{{ if lt $index (sub ($.Values.master.replicas | int) 1) }},{{ end }}{{ end }}{{- if .Values.admin.extraArgs }} \{{ end }}
              {{- end }}
              {{- range $index, $arg := .Values.admin.extraArgs }}
              {{ $arg }}{{- if lt $index (sub (len $.Values.admin.extraArgs) 1) }} \{{ end }}
@@ -180,7 +176,7 @@ spec:
            - name: admin-logs
              mountPath: /logs
            {{- end }}
-            {{- if .Values.global.seaweedfs.enableSecurity }}
+            {{- if .Values.global.enableSecurity }}
            - name: security-config
              readOnly: true
              mountPath: /etc/seaweedfs/security.toml
@@ -213,7 +209,7 @@ spec:
          {{- if .Values.admin.readinessProbe.enabled }}
          readinessProbe:
            httpGet:
-              path: {{ if $urlPrefix }}{{ $urlPrefix }}{{ end }}{{ .Values.admin.readinessProbe.httpGet.path }}
+              path: {{ .Values.admin.readinessProbe.httpGet.path }}
              port: http
              scheme: {{ .Values.admin.readinessProbe.httpGet.scheme }}
            initialDelaySeconds: {{ .Values.admin.readinessProbe.initialDelaySeconds }}
@@ -225,7 +221,7 @@ spec:
          {{- if .Values.admin.livenessProbe.enabled }}
          livenessProbe:
            httpGet:
-              path: {{ if $urlPrefix }}{{ $urlPrefix }}{{ end }}{{ .Values.admin.livenessProbe.httpGet.path }}
+              path: {{ .Values.admin.livenessProbe.httpGet.path }}
              port: http
              scheme: {{ .Values.admin.livenessProbe.httpGet.scheme }}
            initialDelaySeconds: {{ .Values.admin.livenessProbe.initialDelaySeconds }}
@@ -275,7 +271,7 @@ spec:
          persistentVolumeClaim:
            claimName: {{ .Values.admin.logs.claimName }}
        {{- end }}
-        {{- if .Values.global.seaweedfs.enableSecurity }}
+        {{- if .Values.global.enableSecurity }}
        - name: security-config
          configMap:
            name: {{ include "seaweedfs.fullname" . }}-security-config
@@ -1,4 +1,3 @@
-{{- include "seaweedfs.compat" . -}}
 {{- if .Values.allInOne.enabled }}
 apiVersion: apps/v1
 kind: Deployment
@@ -45,7 +44,7 @@ spec:
        {{- toYaml . | nindent 8 }}
        {{- end }}
    spec:
-      restartPolicy: {{ default .Values.global.seaweedfs.restartPolicy .Values.allInOne.restartPolicy }}
+      restartPolicy: {{ default .Values.global.restartPolicy .Values.allInOne.restartPolicy }}
      {{- if .Values.allInOne.affinity }}
      affinity:
        {{ tpl .Values.allInOne.affinity . | nindent 8 | trim }}
@@ -78,10 +77,10 @@ spec:
      containers:
        - name: seaweedfs
          image: {{ template "master.image" . }}
-          imagePullPolicy: {{ default "IfNotPresent" .Values.global.seaweedfs.imagePullPolicy }}
+          imagePullPolicy: {{ default "IfNotPresent" .Values.global.imagePullPolicy }}
          env:
            {{- /* Determine default cluster alias and the corresponding env var keys to avoid conflicts */}}
-            {{- $envMerged := merge (.Values.global.seaweedfs.extraEnvironmentVars | default dict) (.Values.allInOne.extraEnvironmentVars | default dict) }}
+            {{- $envMerged := merge (.Values.global.extraEnvironmentVars | default dict) (.Values.allInOne.extraEnvironmentVars | default dict) }}
            {{- $clusterDefault := default "sw" (index $envMerged "WEED_CLUSTER_DEFAULT") }}
            {{- $clusterUpper := upper $clusterDefault }}
            {{- $clusterMasterKey := printf "WEED_CLUSTER_%s_MASTER" $clusterUpper }}
@@ -113,8 +112,8 @@ spec:
            {{- end }}
            {{- end }}
            {{- end }}
-            {{- if .Values.global.seaweedfs.extraEnvironmentVars }}
-            {{- range $key, $value := .Values.global.seaweedfs.extraEnvironmentVars }}
+            {{- if .Values.global.extraEnvironmentVars }}
+            {{- range $key, $value := .Values.global.extraEnvironmentVars }}
            {{- if and (ne $key $clusterMasterKey) (ne $key $clusterFilerKey) }}
            - name: {{ $key }}
              {{- if kindIs "string" $value }}
@@ -146,7 +145,7 @@ spec:
              {{- if .Values.allInOne.loggingOverrideLevel }}
              -v={{ .Values.allInOne.loggingOverrideLevel }} \
              {{- else }}
-              -v={{ .Values.global.seaweedfs.loggingLevel }} \
+              -v={{ .Values.global.loggingLevel }} \
              {{- end }}
              server \
              -dir=/data \
@@ -169,16 +168,12 @@ spec:
              {{- if .Values.allInOne.disableHttp }}
              -disableHttp={{ .Values.allInOne.disableHttp }} \
              {{- end }}
-              {{- if .Values.volume.dataDirs }}
-              {{- with (first .Values.volume.dataDirs) }}
-              {{- if and (hasKey . "maxVolumes") (ne .maxVolumes nil) }}
-              -volume.max={{ .maxVolumes }} \
-              {{- end }}
-              {{- end }}
+              {{- if and (.Values.volume.dataDirs) (index .Values.volume.dataDirs 0 "maxVolumes") }}
+              -volume.max={{ index .Values.volume.dataDirs 0 "maxVolumes" }} \
              {{- end }}
              -master.port={{ .Values.master.port }} \
-              {{- if .Values.global.seaweedfs.enableReplication }}
-              -master.defaultReplication={{ .Values.global.seaweedfs.replicationPlacement }} \
+              {{- if .Values.global.enableReplication }}
+              -master.defaultReplication={{ .Values.global.replicationPlacement }} \
              {{- else }}
              -master.defaultReplication={{ .Values.master.defaultReplication }} \
              {{- end }}
@@ -216,8 +211,8 @@ spec:
              -filer.disableDirListing \
              {{- end }}
              -filer.dirListLimit={{ .Values.filer.dirListLimit }} \
-              {{- if .Values.global.seaweedfs.enableReplication }}
-              -filer.defaultReplicaPlacement={{ .Values.global.seaweedfs.replicationPlacement }} \
+              {{- if .Values.global.enableReplication }}
+              -filer.defaultReplicaPlacement={{ .Values.global.replicationPlacement }} \
              {{- else }}
              -filer.defaultReplicaPlacement={{ .Values.filer.defaultReplicaPlacement }} \
              {{- end }}
@@ -243,12 +238,13 @@ spec:
              {{- if $domainName }}
              -s3.domainName={{ $domainName }} \
              {{- end }}
-              {{- if .Values.global.seaweedfs.enableSecurity }}
+              {{- if .Values.global.enableSecurity }}
              {{- $httpsPort := .Values.allInOne.s3.httpsPort | default .Values.s3.httpsPort }}
              {{- if $httpsPort }}
              -s3.port.https={{ $httpsPort }} \
              {{- end }}
-              {{- include "seaweedfs.s3.tlsArgs" (dict "root" . "prefix" "s3.") | nindent 14 }}
+              -s3.cert.file=/usr/local/share/ca-certificates/client/tls.crt \
+              -s3.key.file=/usr/local/share/ca-certificates/client/tls.key \
              {{- end }}
              {{- if or .Values.allInOne.s3.enableAuth .Values.s3.enableAuth .Values.filer.s3.enableAuth }}
              -s3.config=/etc/sw/s3/seaweedfs_s3_config \
@@ -330,7 +326,7 @@ spec:
              mountPath: /etc/seaweedfs/master.toml
              subPath: master.toml
              readOnly: true
-            {{- if .Values.global.seaweedfs.enableSecurity }}
+            {{- if .Values.global.enableSecurity }}
            - name: security-config
              mountPath: /etc/seaweedfs/security.toml
              subPath: security.toml
@@ -350,9 +346,6 @@ spec:
            - name: client-cert
              mountPath: /usr/local/share/ca-certificates/client/
              readOnly: true
-            {{- if .Values.allInOne.s3.enabled }}
-            {{- include "seaweedfs.s3.tlsVolumeMount" . | nindent 12 }}
-            {{- end }}
            {{- end }}
            {{ tpl .Values.allInOne.extraVolumeMounts . | nindent 12 }}
          ports:
@@ -461,7 +454,7 @@ spec:
        - name: master-config
          configMap:
            name: {{ include "seaweedfs.fullname" . }}-master-config
-        {{- if .Values.global.seaweedfs.enableSecurity }}
+        {{- if .Values.global.enableSecurity }}
        - name: security-config
          configMap:
            name: {{ include "seaweedfs.fullname" . }}-security-config
@@ -480,9 +473,6 @@ spec:
        - name: client-cert
          secret:
            secretName: {{ include "seaweedfs.fullname" . }}-client-cert
-        {{- if .Values.allInOne.s3.enabled }}
-        {{- include "seaweedfs.s3.tlsVolume" . | nindent 8 }}
-        {{- end }}
        {{- end }}
        {{ tpl .Values.allInOne.extraVolumes . | nindent 8 }}
      {{- if .Values.allInOne.nodeSelector }}
@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ include "seaweedfs.componentName" (list . "all-in-one") }}
+  name: {{ printf "%s-all-in-one" (include "seaweedfs.fullname" .) | trunc 63 | trimSuffix "-" }}
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -17,9 +17,6 @@ metadata:
 spec:
  type: {{ .Values.allInOne.service.type | default "ClusterIP" }}
  internalTrafficPolicy: {{ .Values.allInOne.service.internalTrafficPolicy | default "Cluster" }}
-  {{- if and (semverCompare ">=1.31-0" .Capabilities.KubeVersion.GitVersion) .Values.allInOne.s3.trafficDistribution }}
-  trafficDistribution: {{ include "seaweedfs.trafficDistribution" (dict "value" .Values.allInOne.s3.trafficDistribution "Capabilities" .Capabilities) }}
-  {{- end }}
  ports:
  # Master ports
  - name: "swfs-master"
@@ -73,7 +70,7 @@ spec:
    targetPort: {{ .Values.allInOne.sftp.port | default .Values.sftp.port }}
    protocol: TCP
  {{- end }}
-
+  
  # Server metrics port (single metrics endpoint for all services)
  {{- if .Values.allInOne.metricsPort }}
  - name: "server-metrics"
@@ -1,6 +1,5 @@
-{{- include "seaweedfs.compat" . -}}
 {{- if .Values.allInOne.enabled }}
-{{- if .Values.global.seaweedfs.monitoring.enabled }}
+{{- if .Values.global.monitoring.enabled }}
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
@@ -12,7 +11,7 @@ metadata:
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: all-in-one
-    {{- with .Values.global.seaweedfs.monitoring.additionalLabels }}
+    {{- with .Values.global.monitoring.additionalLabels }}
    {{- toYaml . | nindent 4 }}
    {{- end }}
 spec:
@@ -1,6 +1,5 @@
-{{- include "seaweedfs.compat" . -}}
-{{- if and .Values.global.seaweedfs.enableSecurity (not .Values.certificates.externalCertificates.enabled)}}
-apiVersion: cert-manager.io/v1{{ if .Values.global.seaweedfs.certificates.alphacrds }}alpha1{{ end }}
+{{- if and .Values.global.enableSecurity (not .Values.certificates.externalCertificates.enabled)}}
+apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Certificate
 metadata:
  name: {{ include "seaweedfs.fullname" . }}-admin-cert
@@ -1,6 +1,5 @@
-{{- include "seaweedfs.compat" . -}}
-{{- if and .Values.global.seaweedfs.enableSecurity (not .Values.certificates.externalCertificates.enabled)}}
-apiVersion: cert-manager.io/v1{{ if .Values.global.seaweedfs.certificates.alphacrds }}alpha1{{ end }}
+{{- if and .Values.global.enableSecurity (not .Values.certificates.externalCertificates.enabled)}}
+apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Certificate
 metadata:
  name: {{ include "seaweedfs.fullname" . }}-ca-cert
@@ -1,6 +1,5 @@
-{{- include "seaweedfs.compat" . -}}
-{{- if and .Values.global.seaweedfs.enableSecurity (not .Values.certificates.externalCertificates.enabled)}}
-apiVersion: cert-manager.io/v1{{ if .Values.global.seaweedfs.certificates.alphacrds }}alpha1{{ end }}
+{{- if and .Values.global.enableSecurity (not .Values.certificates.externalCertificates.enabled)}}
+apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Issuer
 metadata:
  name: {{ include "seaweedfs.fullname" . }}-ca-issuer
@@ -1,6 +1,5 @@
-{{- include "seaweedfs.compat" . -}}
-{{- if and .Values.global.seaweedfs.enableSecurity (not .Values.certificates.externalCertificates.enabled)}}
-apiVersion: cert-manager.io/v1{{ if .Values.global.seaweedfs.certificates.alphacrds }}alpha1{{ end }}
+{{- if and .Values.global.enableSecurity (not .Values.certificates.externalCertificates.enabled)}}
+apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Issuer
 metadata:
  name: {{ include "seaweedfs.fullname" . }}-issuer
@@ -1,6 +1,5 @@
-{{- include "seaweedfs.compat" . -}}
-{{- if and .Values.global.seaweedfs.enableSecurity (not .Values.certificates.externalCertificates.enabled)}}
-apiVersion: cert-manager.io/v1{{ if .Values.global.seaweedfs.certificates.alphacrds }}alpha1{{ end }}
+{{- if and .Values.global.enableSecurity (not .Values.certificates.externalCertificates.enabled)}}
+apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Certificate
 metadata:
  name: {{ include "seaweedfs.fullname" . }}-client-cert
@@ -1,6 +1,5 @@
-{{- include "seaweedfs.compat" . -}}
-{{- if and .Values.global.seaweedfs.enableSecurity (not .Values.certificates.externalCertificates.enabled)}}
-apiVersion: cert-manager.io/v1{{ if .Values.global.seaweedfs.certificates.alphacrds }}alpha1{{ end }}
+{{- if and .Values.global.enableSecurity (not .Values.certificates.externalCertificates.enabled)}}
+apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Certificate
 metadata:
  name: {{ include "seaweedfs.fullname" . }}-filer-cert
@@ -1,6 +1,5 @@
-{{- include "seaweedfs.compat" . -}}
-{{- if and .Values.global.seaweedfs.enableSecurity (not .Values.certificates.externalCertificates.enabled)}}
-apiVersion: cert-manager.io/v1{{ if .Values.global.seaweedfs.certificates.alphacrds }}alpha1{{ end }}
+{{- if and .Values.global.enableSecurity (not .Values.certificates.externalCertificates.enabled)}}
+apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Certificate
 metadata:
  name: {{ include "seaweedfs.fullname" . }}-master-cert
@@ -1,6 +1,5 @@
-{{- include "seaweedfs.compat" . -}}
-{{- if and .Values.global.seaweedfs.enableSecurity (not .Values.certificates.externalCertificates.enabled)}}
-apiVersion: cert-manager.io/v1{{ if .Values.global.seaweedfs.certificates.alphacrds }}alpha1{{ end }}
+{{- if and .Values.global.enableSecurity (not .Values.certificates.externalCertificates.enabled)}}
+apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Certificate
 metadata:
  name: {{ include "seaweedfs.fullname" . }}-volume-cert
@@ -1,6 +1,5 @@
-{{- include "seaweedfs.compat" . -}}
-{{- if and .Values.global.seaweedfs.enableSecurity (not .Values.certificates.externalCertificates.enabled)}}
-apiVersion: cert-manager.io/v1{{ if .Values.global.seaweedfs.certificates.alphacrds }}alpha1{{ end }}
+{{- if and .Values.global.enableSecurity (not .Values.certificates.externalCertificates.enabled)}}
+apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Certificate
 metadata:
  name: {{ include "seaweedfs.fullname" . }}-worker-cert
@@ -1,4 +1,3 @@
-{{- include "seaweedfs.compat" . -}}
 {{- if .Values.cosi.enabled }}
 ---
 kind: ClusterRole
@@ -61,7 +60,7 @@ metadata:
    app.kubernetes.io/instance: {{ .Release.Name }}
 subjects:
  - kind: ServiceAccount
-    name: {{ .Values.global.seaweedfs.serviceAccountName }}-objectstorage-provisioner
+    name: {{ .Values.global.serviceAccountName }}-objectstorage-provisioner
    namespace: {{ .Release.Namespace }}
 roleRef:
  kind: ClusterRole
@@ -1,4 +1,3 @@
-{{- include "seaweedfs.compat" . -}}
 {{- if .Values.cosi.enabled }}
 apiVersion: apps/v1
 kind: Deployment
@@ -39,7 +38,7 @@ spec:
      {{- toYaml . | nindent 8 }}
      {{- end }}
    spec:
-      restartPolicy: {{ default .Values.global.seaweedfs.restartPolicy .Values.cosi.restartPolicy }}
+      restartPolicy: {{ default .Values.global.restartPolicy .Values.cosi.restartPolicy }}
      {{- if .Values.cosi.affinity }}
      affinity:
        {{ tpl .Values.cosi.affinity . | nindent 8 | trim }}
@@ -69,7 +68,7 @@ spec:
      containers:
        - name: seaweedfs-cosi-driver
          image: "{{ .Values.cosi.image }}"
-          imagePullPolicy: {{ default "IfNotPresent" .Values.global.seaweedfs.imagePullPolicy }}
+          imagePullPolicy: {{ default "IfNotPresent" .Values.global.imagePullPolicy }}
          env:
            - name: DRIVERNAME
              value: "{{ .Values.cosi.driverName }}"
@@ -89,7 +88,7 @@ spec:
            {{- end }}
            - name: SEAWEEDFS_FILER
              value: "{{ include "seaweedfs.componentName" (list . "filer") }}:{{ .Values.filer.grpcPort }}"
-            {{- if .Values.global.seaweedfs.enableSecurity }}
+            {{- if .Values.global.enableSecurity }}
            - name: WEED_GRPC_CLIENT_KEY
              value: /usr/local/share/ca-certificates/client/tls.key
            - name: WEED_GRPC_CLIENT_CERT
@@ -98,7 +97,7 @@ spec:
              value: /usr/local/share/ca-certificates/client/ca.crt
            {{- end }}
            {{- $mergedExtraEnvironmentVars := dict }}
-            {{- include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" .Values.global.seaweedfs "component" .Values.cosi "target" $mergedExtraEnvironmentVars) }}
+            {{- include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" .Values.global "component" .Values.cosi "target" $mergedExtraEnvironmentVars) }}
            {{- range $key := keys $mergedExtraEnvironmentVars | sortAlpha }}
            {{- $value := index $mergedExtraEnvironmentVars $key }}
            - name: {{ $key }}
@@ -117,7 +116,7 @@ spec:
              name: config-users
              readOnly: true
            {{- end }}
-            {{- if .Values.global.seaweedfs.enableSecurity }}
+            {{- if .Values.global.enableSecurity }}
            - name: security-config
              readOnly: true
              mountPath: /etc/seaweedfs/security.toml
@@ -145,7 +144,7 @@ spec:
          {{- end }}
        - name: seaweedfs-cosi-sidecar
          image: "{{ .Values.cosi.sidecar.image }}"
-          imagePullPolicy: {{ default "IfNotPresent" .Values.global.seaweedfs.imagePullPolicy }}
+          imagePullPolicy: {{ default "IfNotPresent" .Values.global.imagePullPolicy }}
          args:
            - {{ printf "--v=%s" (default "5" .Values.cosi.sidecar.logLevel) }}
          env:
@@ -179,7 +178,7 @@ spec:
            secretName: {{ include "seaweedfs.fullname" . }}-s3-secret
            {{- end }}
        {{- end }}
-        {{- if .Values.global.seaweedfs.enableSecurity }}
+        {{- if .Values.global.enableSecurity }}
        - name: security-config
          configMap:
            name: {{ include "seaweedfs.fullname" . }}-security-config
@@ -1,14 +1,13 @@
-{{- include "seaweedfs.compat" . -}}
 {{- if .Values.cosi.enabled }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ .Values.global.seaweedfs.serviceAccountName }}-objectstorage-provisioner
+  name: {{ .Values.global.serviceAccountName }}-objectstorage-provisioner
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
-automountServiceAccountToken: {{ .Values.global.seaweedfs.automountServiceAccountToken }}
+automountServiceAccountToken: {{ .Values.global.automountServiceAccountToken }}
 {{- end }}
@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ include "seaweedfs.componentName" (list . "filer-client") }}
+  name: {{ printf "%s-filer-client" (include "seaweedfs.fullname" .) | trunc 63 | trimSuffix "-" }}
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -4,7 +4,7 @@ kind: Service
 metadata:
  annotations:
    service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
-  name: {{ include "seaweedfs.componentName" (list . "filer") }}
+  name: {{ printf "%s-filer" (include "seaweedfs.fullname" .) | trunc 63 | trimSuffix "-" }}
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -1,7 +1,6 @@
-{{- include "seaweedfs.compat" . -}}
 {{- if .Values.filer.enabled }}
 {{- if .Values.filer.metricsPort }}
-{{- if .Values.global.seaweedfs.monitoring.enabled }}
+{{- if .Values.global.monitoring.enabled }}
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
@@ -13,7 +12,7 @@ metadata:
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: filer
-    {{- with .Values.global.seaweedfs.monitoring.additionalLabels }}
+    {{- with .Values.global.monitoring.additionalLabels }}
    {{- toYaml . | nindent 4 }}
    {{- end }}
 {{- if .Values.filer.annotations }}
@@ -1,4 +1,3 @@
-{{- include "seaweedfs.compat" . -}}
 {{- if .Values.filer.enabled }}
 apiVersion: apps/v1
 kind: StatefulSet
@@ -57,7 +56,7 @@ spec:
        checksum/s3config: {{ include (print .Template.BasePath "/s3/s3-secret.yaml") . | sha256sum }}
      {{- end }}
    spec:
-      restartPolicy: {{ default .Values.global.seaweedfs.restartPolicy .Values.filer.restartPolicy }}
+      restartPolicy: {{ default .Values.global.restartPolicy .Values.filer.restartPolicy }}
      {{- if .Values.filer.affinity }}
      affinity:
        {{ tpl .Values.filer.affinity . | nindent 8 | trim }}
@@ -87,7 +86,7 @@ spec:
      containers:
        - name: seaweedfs
          image: {{ template "filer.image" . }}
-          imagePullPolicy: {{ default "IfNotPresent" .Values.global.seaweedfs.imagePullPolicy }}
+          imagePullPolicy: {{ default "IfNotPresent" .Values.global.imagePullPolicy }}
          env:
            - name: POD_IP
              valueFrom:
@@ -116,7 +115,7 @@ spec:
            - name: SEAWEEDFS_FULLNAME
              value: "{{ include "seaweedfs.fullname" . }}"
            {{- $mergedExtraEnvironmentVars := dict }}
-            {{- include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" .Values.global.seaweedfs "component" .Values.filer "target" $mergedExtraEnvironmentVars) }}
+            {{- include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" .Values.global "component" .Values.filer "target" $mergedExtraEnvironmentVars) }}
            {{- range $key := keys $mergedExtraEnvironmentVars | sortAlpha }}
            {{- $value := index $mergedExtraEnvironmentVars $key }}
            - name: {{ $key }}
@@ -146,7 +145,7 @@ spec:
              {{- if .Values.filer.loggingOverrideLevel }}
              -v={{ .Values.filer.loggingOverrideLevel }} \
              {{- else }}
-              -v={{ .Values.global.seaweedfs.loggingLevel }} \
+              -v={{ .Values.global.loggingLevel }} \
              {{- end }}
              filer \
              -port={{ .Values.filer.port }} \
@@ -166,8 +165,8 @@ spec:
              -disableDirListing \
              {{- end }}
              -dirListLimit={{ .Values.filer.dirListLimit }} \
-              {{- if .Values.global.seaweedfs.enableReplication }}
-              -defaultReplicaPlacement={{ .Values.global.seaweedfs.replicationPlacement }} \
+              {{- if .Values.global.enableReplication }}
+              -defaultReplicaPlacement={{ .Values.global.replicationPlacement }} \
              {{- else }}
              -defaultReplicaPlacement={{ .Values.filer.defaultReplicaPlacement }} \
              {{- end }}
@@ -197,11 +196,12 @@ spec:
              {{- if .Values.filer.s3.domainName }}
              -s3.domainName={{ .Values.filer.s3.domainName }} \
              {{- end }}
-              {{- if .Values.global.seaweedfs.enableSecurity }}
+              {{- if .Values.global.enableSecurity }}
              {{- if .Values.filer.s3.httpsPort }}
              -s3.port.https={{ .Values.filer.s3.httpsPort }} \
              {{- end }}
-              {{- include "seaweedfs.s3.tlsArgs" (dict "root" . "prefix" "s3.") | nindent 14 }}
+              -s3.cert.file=/usr/local/share/ca-certificates/client/tls.crt \
+              -s3.key.file=/usr/local/share/ca-certificates/client/tls.key \
              {{- end }}
              {{- if .Values.filer.s3.enableAuth }}
              -s3.config=/etc/sw/seaweedfs_s3_config \
@@ -234,7 +234,7 @@ spec:
              mountPath: /etc/seaweedfs/notification.toml
              subPath: notification.toml
            {{- end }}
-            {{- if .Values.global.seaweedfs.enableSecurity }}
+            {{- if .Values.global.enableSecurity }}
            - name: security-config
              readOnly: true
              mountPath: /etc/seaweedfs/security.toml
@@ -254,9 +254,6 @@ spec:
            - name: client-cert
              readOnly: true
              mountPath: /usr/local/share/ca-certificates/client
-            {{- if .Values.filer.s3.enabled }}
-            {{- include "seaweedfs.s3.tlsVolumeMount" . | nindent 12 }}
-            {{- end }}
            {{- end }}
            {{ tpl .Values.filer.extraVolumeMounts . | nindent 12 | trim }}
          ports:
@@ -274,7 +271,7 @@ spec:
              name: swfs-s3-tls
            {{- end }}
            {{- end }}
-          {{- $isJwtEnabled := or .Values.global.seaweedfs.securityConfig.jwtSigning.filerWrite .Values.global.seaweedfs.securityConfig.jwtSigning.filerRead }}
+          {{- $isJwtEnabled := or .Values.global.securityConfig.jwtSigning.filerWrite .Values.global.securityConfig.jwtSigning.filerRead }}
          {{- if .Values.filer.readinessProbe.enabled }}
          readinessProbe:
          {{- if or $isJwtEnabled .Values.filer.readinessProbe.tcpSocket }}
@@ -368,7 +365,7 @@ spec:
          configMap:
            name: {{ include "seaweedfs.fullname" . }}-notification-config
        {{- end }}
-        {{- if .Values.global.seaweedfs.enableSecurity }}
+        {{- if .Values.global.enableSecurity }}
        - name: security-config
          configMap:
            name: {{ include "seaweedfs.fullname" . }}-security-config
@@ -387,9 +384,6 @@ spec:
        - name: client-cert
          secret:
            secretName: {{ include "seaweedfs.fullname" . }}-client-cert
-        {{- if .Values.filer.s3.enabled }}
-        {{- include "seaweedfs.s3.tlsVolume" . | nindent 8 }}
-        {{- end }}
        {{- end }}
        {{ tpl .Values.filer.extraVolumes . | indent 8 | trim }}
      {{- if .Values.filer.nodeSelector }}
@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ include "seaweedfs.componentName" (list . "master") }}
+  name: {{ printf "%s-master" (include "seaweedfs.fullname" .) | trunc 63 | trimSuffix "-" }}
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -1,7 +1,6 @@
-{{- include "seaweedfs.compat" . -}}
 {{- if .Values.master.enabled }}
 {{- if .Values.master.metricsPort }}
-{{- if .Values.global.seaweedfs.monitoring.enabled }}
+{{- if .Values.global.monitoring.enabled }}
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
@@ -13,7 +12,7 @@ metadata:
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: master
-    {{- with .Values.global.seaweedfs.monitoring.additionalLabels }}
+    {{- with .Values.global.monitoring.additionalLabels }}
    {{- toYaml . | nindent 4 }}
    {{- end }}
 {{- if .Values.master.annotations }}
@@ -1,4 +1,3 @@
-{{- include "seaweedfs.compat" . -}}
 {{- if .Values.master.enabled }}
 apiVersion: apps/v1
 kind: StatefulSet
@@ -51,7 +50,7 @@ spec:
      {{- toYaml . | nindent 8 }}
      {{- end }}
    spec:
-      restartPolicy: {{ default .Values.global.seaweedfs.restartPolicy .Values.master.restartPolicy }}
+      restartPolicy: {{ default .Values.global.restartPolicy .Values.master.restartPolicy }}
      {{- if .Values.master.affinity }}
      affinity:
        {{ tpl .Values.master.affinity . | nindent 8 | trim }}
@@ -81,7 +80,7 @@ spec:
      containers:
        - name: seaweedfs
          image: {{ template "master.image" . }}
-          imagePullPolicy: {{ default "IfNotPresent" .Values.global.seaweedfs.imagePullPolicy }}
+          imagePullPolicy: {{ default "IfNotPresent" .Values.global.imagePullPolicy }}
          env:
            - name: POD_IP
              valueFrom:
@@ -98,7 +97,7 @@ spec:
            - name: SEAWEEDFS_FULLNAME
              value: "{{ include "seaweedfs.fullname" . }}"
            {{- $mergedExtraEnvironmentVars := dict }}
-            {{- include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" .Values.global.seaweedfs "component" .Values.master "target" $mergedExtraEnvironmentVars) }}
+            {{- include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" .Values.global "component" .Values.master "target" $mergedExtraEnvironmentVars) }}
            {{- range $key := keys $mergedExtraEnvironmentVars | sortAlpha }}
            {{- $value := index $mergedExtraEnvironmentVars $key }}
            - name: {{ $key }}
@@ -122,23 +121,23 @@ spec:
              {{- if .Values.master.loggingOverrideLevel }}
              -v={{ .Values.master.loggingOverrideLevel }} \
              {{- else }}
-              -v={{ .Values.global.seaweedfs.loggingLevel }} \
+              -v={{ .Values.global.loggingLevel }} \
              {{- end }}
              master \
              -port={{ .Values.master.port }} \
              -mdir=/data \
              -ip.bind={{ .Values.master.ipBind }} \
-              {{- if .Values.global.seaweedfs.enableReplication }}
-              -defaultReplication={{ .Values.global.seaweedfs.replicationPlacement }} \
+              {{- if .Values.global.enableReplication }}
+              -defaultReplication={{ .Values.global.replicationPlacement }} \
              {{- else }}
              -defaultReplication={{ .Values.master.defaultReplication }} \
              {{- end }}
              {{- if .Values.master.volumePreallocate }}
              -volumePreallocate \
              {{- end }}
-              {{- if .Values.global.seaweedfs.monitoring.enabled }}
-              {{- if and .Values.global.seaweedfs.monitoring.gatewayHost .Values.global.seaweedfs.monitoring.gatewayPort }}
-              -metrics.address="{{ .Values.global.seaweedfs.monitoring.gatewayHost }}:{{ .Values.global.seaweedfs.monitoring.gatewayPort }}" \
+              {{- if .Values.global.monitoring.enabled }}
+              {{- if and .Values.global.monitoring.gatewayHost .Values.global.monitoring.gatewayPort }}
+              -metrics.address="{{ .Values.global.monitoring.gatewayHost }}:{{ .Values.global.monitoring.gatewayPort }}" \
              {{- if .Values.master.metricsIntervalSec }}
              -metrics.intervalSeconds={{ .Values.master.metricsIntervalSec }} \
              {{- end }}
@@ -188,7 +187,7 @@ spec:
              readOnly: true
              mountPath: /etc/seaweedfs/master.toml
              subPath: master.toml
-            {{- if .Values.global.seaweedfs.enableSecurity }}
+            {{- if .Values.global.enableSecurity }}
            - name: security-config
              readOnly: true
              mountPath: /etc/seaweedfs/security.toml
@@ -213,7 +212,7 @@ spec:
          ports:
            - containerPort: {{ .Values.master.port }}
              name: swfs-master
-            {{- if and .Values.global.seaweedfs.monitoring.enabled .Values.master.metricsPort }}
+            {{- if and .Values.global.monitoring.enabled .Values.master.metricsPort }}
            - containerPort: {{ .Values.master.metricsPort }}
              name: metrics
            {{- end }}
@@ -287,7 +286,7 @@ spec:
        - name: master-config
          configMap:
            name: {{ include "seaweedfs.fullname" . }}-master-config
-        {{- if .Values.global.seaweedfs.enableSecurity }}
+        {{- if .Values.global.enableSecurity }}
        - name: security-config
          configMap:
            name: {{ include "seaweedfs.fullname" . }}-security-config
@@ -1,4 +1,3 @@
-{{- include "seaweedfs.compat" . -}}
 {{- if .Values.s3.enabled }}
 apiVersion: apps/v1
 kind: Deployment
@@ -43,7 +42,7 @@ spec:
      {{- toYaml . | nindent 8 }}
      {{- end }}
    spec:
-      restartPolicy: {{ default .Values.global.seaweedfs.restartPolicy .Values.s3.restartPolicy }}
+      restartPolicy: {{ default .Values.global.restartPolicy .Values.s3.restartPolicy }}
      {{- if .Values.s3.affinity }}
      affinity:
        {{ tpl .Values.s3.affinity . | nindent 8 | trim }}
@@ -75,7 +74,7 @@ spec:
      containers:
        - name: seaweedfs
          image: {{ template "s3.image" . }}
-          imagePullPolicy: {{ default "IfNotPresent" .Values.global.seaweedfs.imagePullPolicy }}
+          imagePullPolicy: {{ default "IfNotPresent" .Values.global.imagePullPolicy }}
          env:
            - name: POD_IP
              valueFrom:
@@ -92,7 +91,7 @@ spec:
            - name: SEAWEEDFS_FULLNAME
              value: "{{ include "seaweedfs.fullname" . }}"
            {{- $mergedExtraEnvironmentVars := dict }}
-            {{- include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" .Values.global.seaweedfs "component" .Values.s3 "target" $mergedExtraEnvironmentVars) }}
+            {{- include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" .Values.global "component" .Values.s3 "target" $mergedExtraEnvironmentVars) }}
            {{- range $key := keys $mergedExtraEnvironmentVars | sortAlpha }}
            {{- $value := index $mergedExtraEnvironmentVars $key }}
            - name: {{ $key }}
@@ -116,7 +115,7 @@ spec:
              {{- if .Values.s3.loggingOverrideLevel }}
              -v={{ .Values.s3.loggingOverrideLevel }} \
              {{- else }}
-              -v={{ .Values.global.seaweedfs.loggingLevel }} \
+              -v={{ .Values.global.loggingLevel }} \
              {{- end }}
              s3 \
              -ip.bind={{ .Values.s3.bindAddress }} \
@@ -124,11 +123,12 @@ spec:
              {{- if .Values.s3.metricsPort }}
              -metricsPort {{ .Values.s3.metricsPort }} \
              {{- end }}
-              {{- if .Values.global.seaweedfs.enableSecurity }}
+              {{- if .Values.global.enableSecurity }}
              {{- if .Values.s3.httpsPort }}
              -port.https={{ .Values.s3.httpsPort }} \
              {{- end }}
-              {{- include "seaweedfs.s3.tlsArgs" (dict "root" . "prefix" "") | nindent 14 }}
+              -cert.file=/usr/local/share/ca-certificates/client/tls.crt \
+              -key.file=/usr/local/share/ca-certificates/client/tls.key \
              {{- end }}
              {{- if .Values.s3.domainName }}
              -domainName={{ .Values.s3.domainName }} \
@@ -156,7 +156,7 @@ spec:
              name: config-users
              readOnly: true
            {{- end }}
-            {{- if .Values.global.seaweedfs.enableSecurity }}
+            {{- if .Values.global.enableSecurity }}
            - name: security-config
              readOnly: true
              mountPath: /etc/seaweedfs/security.toml
@@ -176,7 +176,6 @@ spec:
            - name: client-cert
              readOnly: true
              mountPath: /usr/local/share/ca-certificates/client/
-            {{- include "seaweedfs.s3.tlsVolumeMount" . | nindent 12 }}
            {{- end }}
            {{ tpl .Values.s3.extraVolumeMounts . | nindent 12 | trim }}
          ports:
@@ -249,7 +248,7 @@ spec:
        - name: logs
          emptyDir: {}
        {{- end }}
-        {{- if .Values.global.seaweedfs.enableSecurity }}
+        {{- if .Values.global.enableSecurity }}
        - name: security-config
          configMap:
            name: {{ include "seaweedfs.fullname" . }}-security-config
@@ -268,7 +267,6 @@ spec:
        - name: client-cert
          secret:
            secretName: {{ include "seaweedfs.fullname" . }}-client-cert
-        {{- include "seaweedfs.s3.tlsVolume" . | nindent 8 }}
        {{- end }}
        {{ tpl .Values.s3.extraVolumes . | indent 8 | trim }}
      {{- if .Values.s3.nodeSelector }}
@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ include "seaweedfs.componentName" (list . "s3") }}
+  name: {{ printf "%s-s3" (include "seaweedfs.fullname" .) | trunc 63 | trimSuffix "-" }}
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -16,9 +16,8 @@ metadata:
 {{- end }}
 spec:
  internalTrafficPolicy: {{ .Values.s3.internalTrafficPolicy | default "Cluster" }}
-  {{- $td := .Values.s3.trafficDistribution | default .Values.filer.s3.trafficDistribution }}
-  {{- if and (semverCompare ">=1.31-0" .Capabilities.KubeVersion.GitVersion) $td }}
-  trafficDistribution: {{ include "seaweedfs.trafficDistribution" (dict "value" $td "Capabilities" .Capabilities) }}
+  {{- if and (semverCompare ">=1.31-0" .Capabilities.KubeVersion.GitVersion) (or .Values.s3.trafficDistribution .Values.filer.s3.trafficDistribution) }}
+  trafficDistribution: {{ include "seaweedfs.trafficDistribution" . }}
  {{- end }}
  ports:
  - name: "swfs-s3"
@@ -1,7 +1,6 @@
-{{- include "seaweedfs.compat" . -}}
 {{- if or .Values.s3.enabled .Values.filer.s3.enabled }}
 {{- if .Values.s3.metricsPort }}
-{{- if .Values.global.seaweedfs.monitoring.enabled }}
+{{- if .Values.global.monitoring.enabled }}
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
@@ -13,7 +12,7 @@ metadata:
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: s3
-    {{- with .Values.global.seaweedfs.monitoring.additionalLabels }}
+    {{- with .Values.global.monitoring.additionalLabels }}
    {{- toYaml . | nindent 4 }}
    {{- end }}
 {{- if .Values.s3.annotations }}
@@ -1,4 +1,3 @@
-{{- include "seaweedfs.compat" . -}}
 {{- if .Values.sftp.enabled }}
 apiVersion: apps/v1
 kind: Deployment
@@ -43,14 +42,14 @@ spec:
      {{- toYaml . | nindent 8 }}
      {{- end }}
    spec:
-      restartPolicy: {{ default .Values.global.seaweedfs.restartPolicy .Values.sftp.restartPolicy }}
+      restartPolicy: {{ default .Values.global.restartPolicy .Values.sftp.restartPolicy }}
      {{- if .Values.sftp.affinity }}
      affinity:
        {{ tpl .Values.sftp.affinity . | nindent 8 | trim }}
      {{- end }}
      {{- if .Values.sftp.topologySpreadConstraints }}
      topologySpreadConstraints:
-        {{ tpl .Values.sftp.topologySpreadConstraints . | nindent 8 | trim }}
+        {{ tpl .Values.sftp.topologySpreadConstraint . | nindent 8 | trim }}
      {{- end }}
      {{- if .Values.sftp.tolerations }}
      tolerations:
@@ -75,7 +74,7 @@ spec:
      containers:
        - name: seaweedfs
          image: {{ template "sftp.image" . }}
-          imagePullPolicy: {{ default "IfNotPresent" .Values.global.seaweedfs.imagePullPolicy }}
+          imagePullPolicy: {{ default "IfNotPresent" .Values.global.imagePullPolicy }}
          env:
            - name: POD_IP
              valueFrom:
@@ -92,7 +91,7 @@ spec:
            - name: SEAWEEDFS_FULLNAME
              value: "{{ include "seaweedfs.fullname" . }}"
            {{- $mergedExtraEnvironmentVars := dict }}
-            {{- include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" .Values.global.seaweedfs "component" .Values.sftp "target" $mergedExtraEnvironmentVars) }}
+            {{- include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" .Values.global "component" .Values.sftp "target" $mergedExtraEnvironmentVars) }}
            {{- range $key := keys $mergedExtraEnvironmentVars | sortAlpha }}
            {{- $value := index $mergedExtraEnvironmentVars $key }}
            - name: {{ $key }}
@@ -116,7 +115,7 @@ spec:
              {{- if .Values.sftp.loggingOverrideLevel }}
              -v={{ .Values.sftp.loggingOverrideLevel }} \
              {{- else }}
-              -v={{ .Values.global.seaweedfs.loggingLevel }} \
+              -v={{ .Values.global.loggingLevel }} \
              {{- end }}
              sftp \
              -ip.bind={{ .Values.sftp.bindAddress }} \
@@ -157,7 +156,7 @@ spec:
              {{- if .Values.sftp.localSocket }}
              -localSocket={{ .Values.sftp.localSocket }} \
              {{- end }}
-              {{- if .Values.global.seaweedfs.enableSecurity }}
+              {{- if .Values.global.enableSecurity }}
              -cert.file=/usr/local/share/ca-certificates/client/tls.crt \
              -key.file=/usr/local/share/ca-certificates/client/tls.key \
              {{- end }}
@@ -176,7 +175,7 @@ spec:
            - mountPath: /etc/sw/ssh
              name: config-ssh
              readOnly: true
-            {{- if .Values.global.seaweedfs.enableSecurity }}
+            {{- if .Values.global.enableSecurity }}
            - name: security-config
              readOnly: true
              mountPath: /etc/seaweedfs/security.toml
@@ -264,7 +263,7 @@ spec:
        - name: logs
          emptyDir: {}
        {{- end }}
-        {{- if .Values.global.seaweedfs.enableSecurity }}
+        {{- if .Values.global.enableSecurity }}
        - name: security-config
          configMap:
            name: {{ include "seaweedfs.fullname" . }}-security-config
@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ include "seaweedfs.componentName" (list . "sftp") }}
+  name: {{ printf "%s-sftp" (include "seaweedfs.fullname" .) | trunc 63 | trimSuffix "-" }}
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -1,7 +1,6 @@
-{{- include "seaweedfs.compat" . -}}
 {{- if .Values.sftp.enabled }}
 {{- if .Values.sftp.metricsPort }}
-{{- if .Values.global.seaweedfs.monitoring.enabled }}
+{{- if .Values.global.monitoring.enabled }}
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
@@ -13,7 +12,7 @@ metadata:
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: sftp
-    {{- with .Values.global.seaweedfs.monitoring.additionalLabels }}
+    {{- with .Values.global.monitoring.additionalLabels }}
    {{- toYaml . | nindent 4 }}
    {{- end }}
 {{- if .Values.sftp.annotations }}
@@ -1,59 +0,0 @@
-{{/*
-Backward-compatibility shim for the global.* → global.seaweedfs.* migration.
-
-When the chart is used as a subchart, .Values.global is shared with sibling
-charts.  To avoid namespace pollution, app-specific values were moved under
-global.seaweedfs.* (and global.registry was renamed to global.imageRegistry).
-
-If a user still passes the OLD key paths (e.g. --set global.enableSecurity=true),
-those keys will no longer have defaults in values.yaml, so their mere presence in
-.Values.global means the user explicitly provided them.  This helper merges them
-into global.seaweedfs.* so the rest of the templates see a single, canonical
-location.
-
-The helper mutates .Values.global.seaweedfs in-place via `set` and produces no
-output.  It is idempotent (safe to call more than once in the same render).
-
-Usage:  {{- include "seaweedfs.compat" . -}}
-*/}}
-{{- define "seaweedfs.compat" -}}
-{{- $g  := .Values.global -}}
-{{- $sw := $g.seaweedfs | default dict -}}
-
-{{/* --- image-related renames --- */}}
-{{- if hasKey $g "registry" -}}
-{{-   $_ := set $g "imageRegistry" (default $g.imageRegistry $g.registry) -}}
-{{- end -}}
-{{- if hasKey $g "repository" -}}
-{{-   $img := $sw.image | default dict -}}
-{{-   $_ := set $img "repository" (default $img.repository $g.repository) -}}
-{{-   $_ := set $sw "image" $img -}}
-{{- end -}}
-{{- if hasKey $g "imageName" -}}
-{{-   $img := $sw.image | default dict -}}
-{{-   $_ := set $img "name" (default $img.name $g.imageName) -}}
-{{-   $_ := set $sw "image" $img -}}
-{{- end -}}
-
-{{/* --- scalar keys that moved 1:1 under global.seaweedfs --- */}}
-{{- range $key := list "createClusterRole" "imagePullPolicy" "restartPolicy" "loggingLevel" "enableSecurity" "masterServer" "serviceAccountName" "automountServiceAccountToken" "enableReplication" "replicationPlacement" -}}
-{{-   if hasKey $g $key -}}
-{{-     $_ := set $sw $key (index $g $key) -}}
-{{-   end -}}
-{{- end -}}
-
-{{/* --- nested dict keys: deep-merge so partial overrides work --- */}}
-{{- range $key := list "securityConfig" "certificates" "monitoring" "serviceAccountAnnotations" "extraEnvironmentVars" -}}
-{{-   if hasKey $g $key -}}
-{{-     $old := index $g $key | default dict -}}
-{{-     $new := index $sw $key | default dict -}}
-{{-     if and (kindIs "map" $old) (kindIs "map" $new) -}}
-{{-       $_ := set $sw $key (merge $old $new) -}}
-{{-     else -}}
-{{-       $_ := set $sw $key $old -}}
-{{-     end -}}
-{{-   end -}}
-{{- end -}}
-
-{{- $_ := set $g "seaweedfs" $sw -}}
-{{- end -}}
@@ -143,9 +143,9 @@ Inject extra environment vars in the format key:value, if populated

 {{/* Computes the container image name for all components (if they are not overridden) */}}
 {{- define "common.image" -}}
-{{- $registryName := default .Values.image.registry .Values.global.imageRegistry | toString -}}
-{{- $repositoryName := default .Values.image.repository .Values.global.seaweedfs.image.repository | toString -}}
-{{- $name := .Values.global.seaweedfs.image.name | toString -}}
+{{- $registryName := default .Values.image.registry .Values.global.registry | toString -}}
+{{- $repositoryName := default .Values.image.repository .Values.global.repository | toString -}}
+{{- $name := .Values.global.imageName | toString -}}
 {{- $tag := default .Chart.AppVersion .Values.image.tag  | toString -}}
 {{- if .Values.image.repository -}}
 {{-   $name = $repositoryName -}}
@@ -287,8 +287,11 @@ Compute the master service address to be used in cluster env vars.
 If allInOne is enabled, point to the all-in-one service; otherwise, point to the master service.
 */}}
 {{- define "seaweedfs.cluster.masterAddress" -}}
-{{- $component := ternary "all-in-one" "master" .Values.allInOne.enabled -}}
-{{- printf "%s.%s:%d" (include "seaweedfs.componentName" (list . $component)) .Release.Namespace (int .Values.master.port) -}}
+{{- $serviceNameSuffix := "-master" -}}
+{{- if .Values.allInOne.enabled -}}
+{{-   $serviceNameSuffix = "-all-in-one" -}}
+{{- end -}}
+{{- printf "%s.%s:%d" (printf "%s%s" (include "seaweedfs.fullname" .) $serviceNameSuffix | trunc 63 | trimSuffix "-") .Release.Namespace (int .Values.master.port) -}}
 {{- end -}}

 {{/*
@@ -296,8 +299,11 @@ Compute the filer service address to be used in cluster env vars.
 If allInOne is enabled, point to the all-in-one service; otherwise, point to the filer-client service.
 */}}
 {{- define "seaweedfs.cluster.filerAddress" -}}
-{{- $component := ternary "all-in-one" "filer-client" .Values.allInOne.enabled -}}
-{{- printf "%s.%s:%d" (include "seaweedfs.componentName" (list . $component)) .Release.Namespace (int .Values.filer.port) -}}
+{{- $serviceNameSuffix := "-filer-client" -}}
+{{- if .Values.allInOne.enabled -}}
+{{-   $serviceNameSuffix = "-all-in-one" -}}
+{{- end -}}
+{{- printf "%s.%s:%d" (printf "%s%s" (include "seaweedfs.fullname" .) $serviceNameSuffix | trunc 63 | trimSuffix "-") .Release.Namespace (int .Values.filer.port) -}}
 {{- end -}}

 {{/*
@@ -318,8 +324,8 @@ Generate master server argument value, using global.masterServer if set, otherwi
 Usage: {{ include "seaweedfs.masterServerArg" . }}
 */}}
 {{- define "seaweedfs.masterServerArg" -}}
-{{- if .Values.global.seaweedfs.masterServer -}}
-{{- .Values.global.seaweedfs.masterServer -}}
+{{- if .Values.global.masterServer -}}
+{{- .Values.global.masterServer -}}
 {{- else -}}
 {{- include "seaweedfs.masterServers" . -}}
 {{- end -}}
@@ -329,44 +335,14 @@ Usage: {{ include "seaweedfs.masterServerArg" . }}
 Create the name of the service account to use
 */}}
 {{- define "seaweedfs.serviceAccountName" -}}
-{{- .Values.global.seaweedfs.serviceAccountName | default "seaweedfs" -}}
+{{- .Values.global.serviceAccountName | default "seaweedfs" -}}
 {{- end -}}

-{{/* S3 TLS cert/key arguments, using custom secret if s3.tlsSecret is set */}}
-{{- define "seaweedfs.s3.tlsArgs" -}}
-{{- $prefix := .prefix -}}
-{{- $root := .root -}}
-{{- if $root.Values.s3.tlsSecret -}}
-{{ $prefix }}cert.file=/usr/local/share/ca-certificates/s3/tls.crt \
-{{ $prefix }}key.file=/usr/local/share/ca-certificates/s3/tls.key \
-{{- else -}}
-{{ $prefix }}cert.file=/usr/local/share/ca-certificates/client/tls.crt \
-{{ $prefix }}key.file=/usr/local/share/ca-certificates/client/tls.key \
-{{- end -}}
-{{- end -}}
-
-{{/* S3 custom TLS volume mount */}}
-{{- define "seaweedfs.s3.tlsVolumeMount" -}}
-{{- if .Values.s3.tlsSecret }}
- name: s3-tls-cert
-  readOnly: true
-  mountPath: /usr/local/share/ca-certificates/s3/
-{{- end }}
-{{- end -}}
-
-{{/* S3 custom TLS volume */}}
-{{- define "seaweedfs.s3.tlsVolume" -}}
-{{- if .Values.s3.tlsSecret }}
- name: s3-tls-cert
-  secret:
-    secretName: {{ .Values.s3.tlsSecret }}
-{{- end }}
-{{- end -}}
-
-{{/* Generate a compatible trafficDistribution value due to "PreferClose" fast deprecation in k8s v1.35.
-     Accepts a dict with "value" (the trafficDistribution string) and "Capabilities". */}}
+{{/* Generate a compatible trafficDistribution value due to "PreferClose" fast deprecation in k8s v1.35 */}}
 {{- define "seaweedfs.trafficDistribution" -}}
-{{- if .value -}}
-{{- and (eq .value "PreferClose") (semverCompare ">=1.35-0" .Capabilities.KubeVersion.GitVersion) | ternary "PreferSameZone" .value -}}
+{{- if .Values.s3.trafficDistribution -}}
+{{- and (eq .Values.s3.trafficDistribution "PreferClose") (semverCompare ">=1.35-0" .Capabilities.KubeVersion.GitVersion) | ternary "PreferSameZone" .Values.s3.trafficDistribution -}}
+{{- else if .Values.filer.s3.trafficDistribution -}}
+{{- and (eq .Values.filer.s3.trafficDistribution "PreferClose") (semverCompare ">=1.35-0" .Capabilities.KubeVersion.GitVersion) | ternary "PreferSameZone" .Values.filer.s3.trafficDistribution -}}
 {{- end -}}
 {{- end -}}
@@ -1,5 +1,4 @@
-{{- include "seaweedfs.compat" . -}}
-{{- if .Values.global.seaweedfs.createClusterRole }}
+{{- if .Values.global.createClusterRole }}
 #hack for delete pod master after migration
 ---
 kind: ClusterRole
@@ -1,11 +1,10 @@
-{{- include "seaweedfs.compat" . -}}
 {{- /* Support bucket creation for both standalone filer.s3 and allInOne modes */}}
 {{- $createBuckets := list }}
 {{- $s3Enabled := false }}
 {{- $enableAuth := false }}
 {{- $existingConfigSecret := "" }}
 {{- $bucketsFolder := "/buckets" }}
-{{- $bucketEnvVars := merge (dict) (.Values.global.seaweedfs.extraEnvironmentVars | default dict) }}
+{{- $bucketEnvVars := merge (dict) (.Values.global.extraEnvironmentVars | default dict) }}
 {{- if .Values.allInOne.enabled }}
  {{- $bucketEnvVars = merge (.Values.allInOne.extraEnvironmentVars | default dict) $bucketEnvVars }}
 {{- else }}
@@ -52,7 +51,7 @@ metadata:
  annotations:
    "helm.sh/hook": post-install,post-upgrade
    "helm.sh/hook-weight": "-5"
-    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+    "helm.sh/hook-delete-policy": hook-succeeded
 spec:
  template:
    metadata:
@@ -65,11 +64,9 @@ spec:
      {{- if .Values.filer.podSecurityContext.enabled }}
      securityContext: {{- omit .Values.filer.podSecurityContext "enabled" | toYaml | nindent 8 }}
      {{- end }}
-      {{- include "seaweedfs.imagePullSecrets" $ | nindent 6 }}
      containers:
      - name: post-install-job
        image: {{ template "master.image" . }}
-        imagePullPolicy: {{ $.Values.global.seaweedfs.imagePullPolicy | default "IfNotPresent" }}
        env:
          - name: WEED_CLUSTER_DEFAULT
            value: "sw"
@@ -95,7 +92,6 @@ spec:
          - "/bin/sh"
          - "-ec"
          - |
-            set -o pipefail
            wait_for_service() {
              local url=$1
              local max_attempts=60  # 5 minutes total (5s * 60)
@@ -121,7 +117,8 @@ spec:
            wait_for_service "http://$WEED_CLUSTER_SW_MASTER{{ .Values.master.readinessProbe.httpGet.path }}"
            wait_for_service "http://$WEED_CLUSTER_SW_FILER{{ .Values.filer.readinessProbe.httpGet.path }}"
            {{- end }}
-            {{- range $createBuckets }}
+          set -o pipefail
+          {{- range $createBuckets }}
            {{- $bucketName := .name }}
            {{- $bucketLock := or .lock .objectLock .withLock }}
            bucket_list=$(/bin/echo 's3.bucket.list' | /usr/bin/weed shell) || { echo "Error listing s3 buckets"; exit 1; }
@@ -184,16 +181,12 @@ spec:
        ports:
          - containerPort: {{ .Values.master.port }}
            name: swfs-master
-          {{- if and .Values.global.seaweedfs.monitoring.enabled .Values.master.metricsPort }}
+          {{- if and .Values.global.monitoring.enabled .Values.master.metricsPort }}
          - containerPort: {{ .Values.master.metricsPort }}
            name: metrics
          {{- end }}
          - containerPort: {{ .Values.master.grpcPort }}
            #name: swfs-master-grpc
-        {{- with coalesce .Values.allInOne.s3.createBucketsHook.resources .Values.s3.createBucketsHook.resources .Values.filer.s3.createBucketsHook.resources }}
-        resources:
-          {{- toYaml . | nindent 10 }}
-        {{- end }}
        {{- if .Values.filer.containerSecurityContext.enabled }}
        securityContext: {{- omit .Values.filer.containerSecurityContext "enabled" | toYaml | nindent 12 }}
        {{- end }}
@@ -1,5 +1,4 @@
-{{- include "seaweedfs.compat" . -}}
-{{- if .Values.global.seaweedfs.monitoring.enabled }}
+{{- if .Values.global.monitoring.enabled }}
 {{- $files := .Files.Glob "dashboards/*.json" }}
 {{- if $files }}
 {{- range $path, $file := $files }}
@@ -1,5 +1,4 @@
-{{- include "seaweedfs.compat" . -}}
-{{- if .Values.global.seaweedfs.enableSecurity }}
+{{- if .Values.global.enableSecurity }}
 apiVersion: v1
 kind: ConfigMap
 metadata:
@@ -22,14 +21,14 @@ data:
  security.toml: |-
    # this file is read by master, volume server, and filer

-    {{- if .Values.global.seaweedfs.securityConfig.jwtSigning.volumeWrite }}
+    {{- if .Values.global.securityConfig.jwtSigning.volumeWrite }}
    # the jwt signing key is read by master and volume server
    # a jwt expires in 10 seconds
    [jwt.signing]
    key = "{{ dig "jwt" "signing" "key" (randAlphaNum 10 | b64enc) $securityConfig }}"
    {{- end }}

-    {{- if .Values.global.seaweedfs.securityConfig.jwtSigning.volumeRead }}
+    {{- if .Values.global.securityConfig.jwtSigning.volumeRead }}
    # this jwt signing key is read by master and volume server, and it is used for read operations:
    # - the Master server generates the JWT, which can be used to read a certain file on a volume server
    # - the Volume server validates the JWT on reading
@@ -37,7 +36,7 @@ data:
    key = "{{ dig "jwt" "signing" "read" "key" (randAlphaNum 10 | b64enc) $securityConfig }}"
    {{- end }}

-    {{- if .Values.global.seaweedfs.securityConfig.jwtSigning.filerWrite }}
+    {{- if .Values.global.securityConfig.jwtSigning.filerWrite }}
    # If this JWT key is configured, Filer only accepts writes over HTTP if they are signed with this JWT:
    # - f.e. the S3 API Shim generates the JWT
    # - the Filer server validates the JWT on writing
@@ -46,7 +45,7 @@ data:
    key = "{{ dig "jwt" "filer_signing" "key" (randAlphaNum 10 | b64enc) $securityConfig }}"
    {{- end }}

-    {{- if .Values.global.seaweedfs.securityConfig.jwtSigning.filerRead }}
+    {{- if .Values.global.securityConfig.jwtSigning.filerRead }}
    # If this JWT key is configured, Filer only accepts reads over HTTP if they are signed with this JWT:
    # - f.e. the S3 API Shim generates the JWT
    # - the Filer server validates the JWT on reading
@@ -1,10 +1,9 @@
-{{- include "seaweedfs.compat" . -}}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
  name: {{ include "seaweedfs.serviceAccountName" . }}
  namespace: {{ .Release.Namespace }}
-  {{- with .Values.global.seaweedfs.serviceAccountAnnotations }}
+  {{- with .Values.global.serviceAccountAnnotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}
@@ -13,4 +12,4 @@ metadata:
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
-automountServiceAccountToken: {{ .Values.global.seaweedfs.automountServiceAccountToken }}
+automountServiceAccountToken: {{ .Values.global.automountServiceAccountToken }}
@@ -1,8 +1,4 @@
-{{- /* Volume ingress works for both normal mode (volume.enabled) and all-in-one mode (allInOne.enabled) */}}
-{{- $volumeEnabled := or .Values.volume.enabled .Values.allInOne.enabled }}
-{{- if and $volumeEnabled .Values.volume.ingress.enabled }}
-{{- /* Determine service name based on deployment mode */}}
-{{- $serviceName := ternary (include "seaweedfs.componentName" (list . "all-in-one")) (include "seaweedfs.componentName" (list . "volume")) .Values.allInOne.enabled }}
+{{- if and .Values.volume.enabled .Values.volume.ingress.enabled }}
 {{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion }}
 apiVersion: networking.k8s.io/v1
 {{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion }}
@@ -46,11 +42,11 @@ spec:
        backend:
 {{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion }}
          service:
-            name: {{ $serviceName }}
+            name: {{ include "seaweedfs.componentName" (list . "volume") }}
            port:
              number: {{ .Values.volume.port }}
 {{- else }}
-          serviceName: {{ $serviceName }}
+          serviceName: {{ include "seaweedfs.componentName" (list . "volume") }}
          servicePort: {{ .Values.volume.port }}
 {{- end }}
 {{- end }}
@@ -8,7 +8,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ include "seaweedfs.componentName" (list $ $volumeName) }}
+  name: {{ printf "%s-%s" (include "seaweedfs.fullname" $) $volumeName | trunc 63 | trimSuffix "-" }}
  namespace: {{ $.Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" $ }}
@@ -1,4 +1,3 @@
-{{- include "seaweedfs.compat" . -}}
 {{ $volumes := deepCopy .Values.volumes | mergeOverwrite (dict "" .Values.volume)  }}
 {{- range $vname, $volume := $volumes }}
 {{- $volumeName := trimSuffix "-" (printf "volume-%s" $vname) }}
@@ -6,7 +5,7 @@

 {{- if $volume.enabled }}
 {{- if $volume.metricsPort }}
-{{- if $.Values.global.seaweedfs.monitoring.enabled }}
+{{- if $.Values.global.monitoring.enabled }}
 ---
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
@@ -19,7 +18,7 @@ metadata:
    app.kubernetes.io/managed-by: {{ $.Release.Service }}
    app.kubernetes.io/instance: {{ $.Release.Name }}
    app.kubernetes.io/component: {{ $volumeName }}
-    {{- with $.Values.global.seaweedfs.monitoring.additionalLabels }}
+    {{- with $.Values.global.monitoring.additionalLabels }}
    {{- toYaml . | nindent 4 }}
    {{- end }}
 {{- with $volume.annotations }}
@@ -1,4 +1,3 @@
-{{- include "seaweedfs.compat" . -}}
 {{ $volumes := deepCopy .Values.volumes | mergeOverwrite (dict "" .Values.volume)  }}
 {{- range $vname, $volume := $volumes }}
 {{- $volumeName := trimSuffix "-" (printf "volume-%s" $vname) }}
@@ -59,7 +58,7 @@ spec:
      topologySpreadConstraints:
        {{ tpl (printf "{{ $volumeName := \"%s\" }}%s" $volumeName $volume.topologySpreadConstraints) $ | nindent 8 | trim }}
      {{- end }}
-      restartPolicy: {{ default $.Values.global.seaweedfs.restartPolicy $volume.restartPolicy }}
+      restartPolicy: {{ default $.Values.global.restartPolicy $volume.restartPolicy }}
      {{- if $volume.tolerations }}
      tolerations:
        {{ tpl (printf "{{ $volumeName := \"%s\" }}%s" $volumeName $volume.tolerations) $ | indent 8 | trim }}
@@ -77,7 +76,7 @@ spec:
        {{- if $volume.idx }}
        - name: seaweedfs-vol-move-idx
          image: {{ template "volume.image" $ }}
-          imagePullPolicy: {{ $.Values.global.seaweedfs.imagePullPolicy | default "IfNotPresent" }}
+          imagePullPolicy: {{ $.Values.global.imagePullPolicy | default "IfNotPresent" }}
          command: [ '/bin/sh', '-c' ]
          args: [ '{{range $dir :=  $volume.dataDirs }}if ls /{{$dir.name}}/*.idx  >/dev/null 2>&1; then mv /{{$dir.name}}/*.idx /idx/ ; fi; {{end}}' ]
          volumeMounts:
@@ -87,10 +86,6 @@ spec:
            - name: {{ $dir.name }}
              mountPath: /{{ $dir.name }}
          {{- end }}
-          {{- with $volume.idxVolMoveResources }}
-          resources:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
          {{- if $volume.containerSecurityContext.enabled }}
          securityContext: {{- omit $volume.containerSecurityContext "enabled" | toYaml | nindent 12 }}
          {{- end }}
@@ -105,7 +100,7 @@ spec:
      containers:
        - name: seaweedfs
          image: {{ template "volume.image" $ }}
-          imagePullPolicy: {{ default "IfNotPresent" $.Values.global.seaweedfs.imagePullPolicy }}
+          imagePullPolicy: {{ default "IfNotPresent" $.Values.global.imagePullPolicy }}
          env:
            - name: POD_NAME
              valueFrom:
@@ -122,7 +117,7 @@ spec:
            - name: SEAWEEDFS_FULLNAME
              value: "{{ include "seaweedfs.fullname" $ }}"
            {{- $mergedExtraEnvironmentVars := dict }}
-            {{- include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" $.Values.global.seaweedfs "component" $volume "target" $mergedExtraEnvironmentVars) }}
+            {{- include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" $.Values.global "component" $volume "target" $mergedExtraEnvironmentVars) }}
            {{- range $key := keys $mergedExtraEnvironmentVars | sortAlpha }}
            {{- $value := index $mergedExtraEnvironmentVars $key }}
            - name: {{ $key }}
@@ -146,7 +141,7 @@ spec:
                {{- if $volume.loggingOverrideLevel }}
                -v={{ $volume.loggingOverrideLevel }} \
                {{- else }}
-                -v={{ $.Values.global.seaweedfs.loggingLevel }} \
+                -v={{ $.Values.global.loggingLevel }} \
                {{- end }}
                volume \
                -port={{ $volume.port }} \
@@ -211,7 +206,7 @@ spec:
            - name: idx
              mountPath: "/idx/"
            {{- end }}
-            {{- if $.Values.global.seaweedfs.enableSecurity }}
+            {{- if $.Values.global.enableSecurity }}
            - name: security-config
              readOnly: true
              mountPath: /etc/seaweedfs/security.toml
@@ -333,7 +328,7 @@ spec:
          emptyDir: {}
       {{- end }}
     {{- end }}
-     {{- if $.Values.global.seaweedfs.enableSecurity }}
+     {{- if $.Values.global.enableSecurity }}
        - name: security-config
          configMap:
            name: {{ include "seaweedfs.fullname" $ }}-security-config
@@ -1,4 +1,3 @@
-{{- include "seaweedfs.compat" . -}}
 {{- if .Values.worker.enabled }}
 {{- if and (not .Values.worker.adminServer) (not .Values.admin.enabled) }}
 {{- fail "worker.adminServer must be set if admin.enabled is false within the same release" -}}
@@ -46,7 +45,7 @@ spec:
      {{- toYaml . | nindent 8 }}
      {{- end }}
    spec:
-      restartPolicy: {{ default .Values.global.seaweedfs.restartPolicy .Values.worker.restartPolicy }}
+      restartPolicy: {{ default .Values.global.restartPolicy .Values.worker.restartPolicy }}
      {{- if .Values.worker.affinity }}
      affinity:
        {{ tpl .Values.worker.affinity . | nindent 8 | trim }}
@@ -78,7 +77,7 @@ spec:
      containers:
        - name: seaweedfs
          image: {{ template "worker.image" . }}
-          imagePullPolicy: {{ default "IfNotPresent" .Values.global.seaweedfs.imagePullPolicy }}
+          imagePullPolicy: {{ default "IfNotPresent" .Values.global.imagePullPolicy }}
          env:
            - name: POD_IP
              valueFrom:
@@ -95,7 +94,7 @@ spec:
            - name: SEAWEEDFS_FULLNAME
              value: "{{ include "seaweedfs.fullname" . }}"
            {{- $mergedExtraEnvironmentVars := dict }}
-            {{- include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" .Values.global.seaweedfs "component" .Values.worker "target" $mergedExtraEnvironmentVars) }}
+            {{- include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" .Values.global "component" .Values.worker "target" $mergedExtraEnvironmentVars) }}
            {{- range $key := keys $mergedExtraEnvironmentVars | sortAlpha }}
            {{- $value := index $mergedExtraEnvironmentVars $key }}
            - name: {{ $key }}
@@ -119,7 +118,7 @@ spec:
              {{- if .Values.worker.loggingOverrideLevel }}
              -v={{ .Values.worker.loggingOverrideLevel }} \
              {{- else }}
-              -v={{ .Values.global.seaweedfs.loggingLevel }} \
+              -v={{ .Values.global.loggingLevel }} \
              {{- end }}
              worker \
              {{- if .Values.worker.adminServer }}
@@ -149,7 +148,7 @@ spec:
            - name: worker-logs
              mountPath: /logs
            {{- end }}
-            {{- if .Values.global.seaweedfs.enableSecurity }}
+            {{- if .Values.global.enableSecurity }}
            - name: security-config
              readOnly: true
              mountPath: /etc/seaweedfs/security.toml
@@ -252,7 +251,7 @@ spec:
          persistentVolumeClaim:
            claimName: {{ .Values.worker.logs.claimName }}
        {{- end }}
-        {{- if .Values.global.seaweedfs.enableSecurity }}
+        {{- if .Values.global.enableSecurity }}
        - name: security-config
          configMap:
            name: {{ include "seaweedfs.fullname" . }}-security-config
@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ include "seaweedfs.componentName" (list . "worker") }}
+  name: {{ printf "%s-worker" (include "seaweedfs.fullname" .) | trunc 63 | trimSuffix "-" }}
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -1,7 +1,6 @@
-{{- include "seaweedfs.compat" . -}}
 {{- if .Values.worker.enabled }}
 {{- if .Values.worker.metricsPort }}
-{{- if .Values.global.seaweedfs.monitoring.enabled }}
+{{- if .Values.global.monitoring.enabled }}
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
@@ -13,7 +12,7 @@ metadata:
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: worker
-    {{- with .Values.global.seaweedfs.monitoring.additionalLabels }}
+    {{- with .Values.global.monitoring.additionalLabels }}
    {{- toYaml . | nindent 4 }}
    {{- end }}
 {{- with .Values.worker.serviceMonitor.annotations }}
@@ -1,57 +1,51 @@
 # Available parameters and their default values for the SeaweedFS chart.

 global:
-  # global.imageRegistry and global.imagePullSecrets are standard Helm conventions
-  # shared across subcharts. See https://helm.sh/docs/chart_template_guide/subcharts_and_globals/
-  imageRegistry: ""
+  createClusterRole: true
+  registry: ""
+  # if repository is set, it overrides the namespace part of imageName
+  repository: ""
+  imageName: chrislusf/seaweedfs
+  imagePullPolicy: IfNotPresent
  imagePullSecrets: ""
-  # All app-specific global values are namespaced under global.seaweedfs
-  # to avoid polluting the shared global namespace when used as a subchart.
-  seaweedfs:
-    createClusterRole: true
-    image:
-      # if repository is set, it overrides the namespace part of image.name
-      repository: ""
-      name: chrislusf/seaweedfs
-    imagePullPolicy: IfNotPresent
-    restartPolicy: Always
-    loggingLevel: 1
-    enableSecurity: false
-    masterServer: null
-    securityConfig:
-      jwtSigning:
-        volumeWrite: true
-        volumeRead: false
-        filerWrite: false
-        filerRead: false
-    # we will use this serviceAccountName for all ClusterRoles/ClusterRoleBindings
-    serviceAccountName: "seaweedfs"
-    serviceAccountAnnotations: {}
-    automountServiceAccountToken: true
-    certificates:
-      duration: 87600h
-      renewBefore: 720h
-      alphacrds: false
-    monitoring:
-      enabled: false
-      gatewayHost: null
-      gatewayPort: null
-      additionalLabels: {}
-    # if enabled will use global.seaweedfs.replicationPlacement and override master & filer defaultReplicaPlacement config
-    enableReplication: false
-    #  replication type is XYZ:
-    # X number of replica in other data centers
-    # Y number of replica in other racks in the same data center
-    # Z number of replica in other servers in the same rack
-    replicationPlacement: "001"
-    extraEnvironmentVars:
-      WEED_CLUSTER_DEFAULT: "sw"
-      WEED_CLUSTER_SW_MASTER: "{{ include \"seaweedfs.cluster.masterAddress\" . }}"
-      WEED_CLUSTER_SW_FILER: "{{ include \"seaweedfs.cluster.filerAddress\" . }}"
-      # WEED_JWT_SIGNING_KEY:
-      #   secretKeyRef:
-      #     name: seaweedfs-signing-key
-      #     key: signingKey
+  restartPolicy: Always
+  loggingLevel: 1
+  enableSecurity: false
+  masterServer: null
+  securityConfig:
+    jwtSigning:
+      volumeWrite: true
+      volumeRead: false
+      filerWrite: false
+      filerRead: false
+  # we will use this serviceAccountName for all ClusterRoles/ClusterRoleBindings
+  serviceAccountName: "seaweedfs"
+  serviceAccountAnnotations: {}
+  automountServiceAccountToken: true
+  certificates:
+    duration: 87600h
+    renewBefore: 720h
+    alphacrds: false
+  monitoring:
+    enabled: false
+    gatewayHost: null
+    gatewayPort: null
+    additionalLabels: {}
+  # if enabled will use global.replicationPlacement and override master & filer defaultReplicaPlacement config
+  enableReplication: false
+  #  replication type is XYZ:
+  # X number of replica in other data centers
+  # Y number of replica in other racks in the same data center
+  # Z number of replica in other servers in the same rack
+  replicationPlacement: "001"
+  extraEnvironmentVars:
+    WEED_CLUSTER_DEFAULT: "sw"
+    WEED_CLUSTER_SW_MASTER: "{{ include \"seaweedfs.cluster.masterAddress\" . }}"
+    WEED_CLUSTER_SW_FILER: "{{ include \"seaweedfs.cluster.filerAddress\" . }}"
+    # WEED_JWT_SIGNING_KEY:
+    #   secretKeyRef:
+    #     name: seaweedfs-signing-key
+    #     key: signingKey

 image:
  registry: ""
@@ -399,12 +393,6 @@ volume:

  idx: {}

-  # Resource requests, limits, etc. for the vol-move-idx initContainer. This
-  # should map directly to the value of the resources field for a PodSpec,
-  # formatted as a multi-line string. By default no direct resource request
-  # is made.
-  idxVolMoveResources: {}
-
  logs: {}

  # limit background compaction or copying speed in mega bytes per second
@@ -921,8 +909,6 @@ filer:
    #     versioning: Enabled
    #   - name: bucket-b
    #     anonymousRead: false
-    createBucketsHook:
-      resources: {}

 s3:
  enabled: false
@@ -933,13 +919,6 @@ s3:
  port: 8333
  # add additional https port
  httpsPort: 0
-  # Use a custom TLS certificate secret for the S3 HTTPS endpoint.
-  # When set, this Kubernetes Secret (must contain tls.crt and tls.key) is used
-  # instead of the internal self-signed client certificate generated by cert-manager.
-  # This allows using a publicly trusted certificate (e.g., from Let's Encrypt)
-  # so that S3 clients don't need to trust the internal CA.
-  # Requires global.seaweedfs.enableSecurity to be true.
-  tlsSecret: null
  metricsPort: 9327
  # Iceberg catalog REST port (Apache Iceberg REST Catalog API)
  # Set to a port number to enable, or 0/null to disable
@@ -1090,9 +1069,6 @@ s3:
    failureThreshold: 100
    timeoutSeconds: 10

-  createBucketsHook:
-    resources: {}
-
  ingress:
    enabled: false
    className: ""
@@ -1209,14 +1185,9 @@ admin:
  dataDir: ""  # If empty, configuration is kept in memory only

  # Master servers to connect to
-  # If empty, uses global.seaweedfs.masterServer or auto-discovers from master statefulset
+  # If empty, uses global.masterServer or auto-discovers from master statefulset
  masters: ""

-  # URL path prefix when running behind a reverse proxy under a subdirectory
-  # Example: "/seaweedfs-admin" makes the UI available at /seaweedfs-admin/
-  # If empty and ingress is enabled with a non-root path, the ingress path is used automatically
-  urlPrefix: ""
-
  # Custom command line arguments to add to the admin command
  # Example: ["-customFlag", "value", "-anotherFlag"]
  extraArgs: []
@@ -1482,7 +1453,6 @@ allInOne:
    # The s3-secret.yaml template only reads from .Values.s3.credentials.
    # See: s3.credentials.admin.accessKey, s3.credentials.read.accessKey
    auditLogConfig: null  # S3 audit log configuration (null inherits from s3.auditLogConfig)
-    trafficDistribution: null  # Service traffic distribution (e.g., "PreferClose"); auto-converts to "PreferSameZone" on k8s >=1.35
    # You may specify buckets to be created during the install process.
    # Buckets may be exposed publicly by setting `anonymousRead` to `true`
    # ttl format: [1-255][m|h|d|w|M|y] (e.g., 7d)
@@ -1496,8 +1466,6 @@ allInOne:
    #     versioning: Enabled
    #   - name: bucket-b
    #     anonymousRead: false
-    createBucketsHook:
-      resources: {}

  # SFTP server configuration
  # Note: Most parameters below default to null, which means they inherit from
@@ -100,12 +100,10 @@ message ListEntriesRequest {
    string startFromFileName = 3;
    bool inclusiveStartFrom = 4;
    uint32 limit = 5;
-    int64 snapshot_ts_ns = 6;
 }

 message ListEntriesResponse {
    Entry entry = 1;
-    int64 snapshot_ts_ns = 2;
 }

 message RemoteEntry {
@@ -205,7 +203,6 @@ message CreateEntryRequest {

 message CreateEntryResponse {
    string error = 1;
-    SubscribeMetadataResponse metadata_event = 2;
 }

 message UpdateEntryRequest {
@@ -213,10 +210,8 @@ message UpdateEntryRequest {
    Entry entry = 2;
    bool is_from_other_cluster = 3;
    repeated int32 signatures = 4;
-    map<string, bytes> expected_extended = 5;
 }
 message UpdateEntryResponse {
-    SubscribeMetadataResponse metadata_event = 1;
 }

 message AppendToEntryRequest {
@@ -241,7 +236,6 @@ message DeleteEntryRequest {

 message DeleteEntryResponse {
    string error = 1;
-    SubscribeMetadataResponse metadata_event = 2;
 }

 message AtomicRenameEntryRequest {
@@ -472,12 +466,9 @@ message FilerConf {
 message CacheRemoteObjectToLocalClusterRequest {
    string directory = 1;
    string name = 2;
-    int32 chunk_concurrency = 3; // parallel chunk downloads per file, 0 = default (8)
-    int32 download_concurrency = 4; // multipart download concurrency per chunk (if supported by remote storage), 0 = default (5 for S3)
 }
 message CacheRemoteObjectToLocalClusterResponse {
    Entry entry = 1;
-    SubscribeMetadataResponse metadata_event = 2;
 }

 /////////////////////////
@@ -465,7 +465,7 @@
          "bars": false,
          "dashLength": 10,
          "dashes": false,
-          "datasource": "${DS_PROMETHEUS}",
+          "datasource": "Prometheus",
          "fill": 1,
          "gridPos": {
            "h": 6,
@@ -547,7 +547,7 @@
          "bars": false,
          "dashLength": 10,
          "dashes": false,
-          "datasource": "${DS_PROMETHEUS}",
+          "datasource": "Prometheus",
          "fill": 1,
          "gridPos": {
            "h": 6,
@@ -649,7 +649,7 @@
          "bars": false,
          "dashLength": 10,
          "dashes": false,
-          "datasource": "${DS_PROMETHEUS}",
+          "datasource": "Prometheus",
          "fill": 1,
          "gridPos": {
            "h": 6,
@@ -731,7 +731,7 @@
          "bars": false,
          "dashLength": 10,
          "dashes": false,
-          "datasource": "${DS_PROMETHEUS}",
+          "datasource": "Prometheus",
          "fill": 1,
          "gridPos": {
            "h": 6,
@@ -1182,7 +1182,7 @@
      "steppedLine": false,
      "targets": [
        {
-          "expr": "sum(rate(SeaweedFS_s3_bucket_traffic_received_bytes_total[$__rate_interval])) by (bucket)",
+          "expr": "sum(rate(SeaweedFS_s3_bucket_traffic_received_bytes_total[$__interval])) by (bucket)",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 2,
@@ -1275,7 +1275,7 @@
      "steppedLine": false,
      "targets": [
        {
-          "expr": "sum(rate(SeaweedFS_s3_bucket_traffic_sent_bytes_total[$__rate_interval])) by (bucket)",
+          "expr": "sum(rate(SeaweedFS_s3_bucket_traffic_sent_bytes_total[$__interval])) by (bucket)",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 2,
@@ -1368,7 +1368,7 @@
      "steppedLine": false,
      "targets": [
        {
-          "expr": "sum(rate(SeaweedFS_s3_request_total[$__rate_interval])) by (bucket)",
+          "expr": "sum(rate(SeaweedFS_s3_request_total[$__interval])) by (bucket)",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 2,
@@ -3309,4 +3309,4 @@
  "title": "SeaweedFS",
  "uid": "nh02dOVnz",
  "version": 2
-}
+}
@@ -754,7 +754,7 @@
          "steppedLine": false,
          "targets": [
            {
-              "expr": "sum(rate(SeaweedFS_s3_bucket_traffic_received_bytes_total[$__rate_interval])) by (bucket)",
+              "expr": "sum(rate(SeaweedFS_s3_bucket_traffic_received_bytes_total[$__interval])) by (bucket)",
              "format": "time_series",
              "hide": false,
              "intervalFactor": 2,
@@ -835,7 +835,7 @@
          "steppedLine": false,
          "targets": [
            {
-              "expr": "sum(rate(SeaweedFS_s3_bucket_traffic_sent_bytes_total[$__rate_interval])) by (bucket)",
+              "expr": "sum(rate(SeaweedFS_s3_bucket_traffic_sent_bytes_total[$__interval])) by (bucket)",
              "format": "time_series",
              "hide": false,
              "intervalFactor": 2,
@@ -914,7 +914,7 @@
          "steppedLine": false,
          "targets": [
            {
-              "expr": "sum(rate(SeaweedFS_s3_request_total[$__rate_interval])) by (bucket)",
+              "expr": "sum(rate(SeaweedFS_s3_request_total[$__interval])) by (bucket)",
              "format": "time_series",
              "hide": false,
              "intervalFactor": 2,
@@ -310,7 +310,7 @@
      "steppedLine": false,
      "targets": [
        {
-          "expr": "sum(rate(SeaweedFS_s3_bucket_traffic_received_bytes_total{namespace=\"$namespace\",service=~\"$service-api\"}[$__rate_interval])) by (bucket)",
+          "expr": "sum(rate(SeaweedFS_s3_bucket_traffic_received_bytes_total{namespace=\"$namespace\",service=~\"$service-api\"}[$__interval])) by (bucket)",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 2,
@@ -403,7 +403,7 @@
      "steppedLine": false,
      "targets": [
        {
-          "expr": "sum(rate(SeaweedFS_s3_bucket_traffic_sent_bytes_total{namespace=\"$namespace\",service=~\"$service-api\"}[$__rate_interval])) by (bucket)",
+          "expr": "sum(rate(SeaweedFS_s3_bucket_traffic_sent_bytes_total{namespace=\"$namespace\",service=~\"$service-api\"}[$__interval])) by (bucket)",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 2,
@@ -496,7 +496,7 @@
      "steppedLine": false,
      "targets": [
        {
-          "expr": "sum(rate(SeaweedFS_s3_request_total{namespace=\"$namespace\",service=~\"$service-api\"}[$__rate_interval])) by (bucket)",
+          "expr": "sum(rate(SeaweedFS_s3_request_total{namespace=\"$namespace\",service=~\"$service-api\"}[$__interval])) by (bucket)",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 2,
@@ -1,5 +1,5 @@
 # Multi-stage build for Go Sidecar
-FROM golang:1.25-alpine AS builder
+FROM golang:1.24-alpine AS builder

 # Install build dependencies
 RUN apk add --no-cache git ca-certificates tzdata
@@ -1,5 +1,5 @@
 # Multi-stage build for Test Client
-FROM golang:1.25-alpine AS builder
+FROM golang:1.23-alpine AS builder

 # Install build dependencies
 RUN apk add --no-cache git ca-certificates tzdata
@@ -135,7 +135,7 @@ func ensureEnvironment(t *testing.T) {
 	// 6. Start Admin
 	os.RemoveAll(filepath.Join("tmp", "admin"))
 	os.MkdirAll(filepath.Join("tmp", "admin"), 0755)
-	startWeed(t, "admin", "admin", "-master=localhost:9333", "-port=23646", "-dataDir=./tmp/admin")
+	startWeed(t, "admin", "admin", "-master=localhost:9333", "-port=23646", "-dataDir=./tmp/admin", "-scheduler.idleSleep=2")
 	waitForUrl(t, AdminUrl+"/health", 60)

 	t.Log("Environment started successfully")
@@ -153,38 +153,6 @@ func waitForUrl(t *testing.T, url string, retries int) {
 	t.Fatalf("Timeout waiting for %s", url)
 }

-func fetchJSON(url string, out interface{}) error {
-	resp, err := http.Get(url)
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode != http.StatusOK {
-		body, _ := io.ReadAll(resp.Body)
-		return fmt.Errorf("status %d: %s", resp.StatusCode, string(body))
-	}
-	return json.NewDecoder(resp.Body).Decode(out)
-}
-
-func mapField(obj map[string]interface{}, key string) (interface{}, bool) {
-	if obj == nil {
-		return nil, false
-	}
-	if value, ok := obj[key]; ok {
-		return value, true
-	}
-	return nil, false
-}
-
-func mapFieldAny(obj map[string]interface{}, keys ...string) (interface{}, bool) {
-	for _, key := range keys {
-		if value, ok := mapField(obj, key); ok {
-			return value, true
-		}
-	}
-	return nil, false
-}
-
 func TestEcEndToEnd(t *testing.T) {
 	defer cleanup()
 	ensureEnvironment(t)
@@ -307,7 +275,6 @@ func TestEcEndToEnd(t *testing.T) {
 	startTime := time.Now()
 	ecVerified := false
 	var lastBody []byte
-	debugTick := 0

 	for time.Since(startTime) < 300*time.Second {
 		// 3.1 Check Master Topology
@@ -333,104 +300,25 @@ func TestEcEndToEnd(t *testing.T) {
 			}
 		}

-		// 3.2 Debug: Check workers, jobs, and scheduler status
-		debugTick++
-
-		var workers []map[string]interface{}
+		// 3.2 Debug: Check workers and jobs
+		wResp, wErr := http.Get(AdminUrl + "/api/plugin/workers")
 		workerCount := 0
-		ecDetectorCount := 0
-		ecExecutorCount := 0
-		if err := fetchJSON(AdminUrl+"/api/plugin/workers", &workers); err == nil {
+		if wErr == nil {
+			var workers []interface{}
+			json.NewDecoder(wResp.Body).Decode(&workers)
+			wResp.Body.Close()
 			workerCount = len(workers)
-			for _, worker := range workers {
-				capsValue, ok := mapFieldAny(worker, "capabilities", "Capabilities")
-				if !ok {
-					continue
-				}
-				caps, ok := capsValue.(map[string]interface{})
-				if !ok {
-					continue
-				}
-				if capValue, ok := caps["erasure_coding"].(map[string]interface{}); ok {
-					if capValue["can_detect"] == true {
-						ecDetectorCount++
-					}
-					if capValue["can_execute"] == true {
-						ecExecutorCount++
-					}
-				}
-			}
 		}

-		var tasks []map[string]interface{}
+		tResp, tErr := http.Get(AdminUrl + "/api/plugin/jobs?limit=1000")
 		taskCount := 0
-		ecTaskCount := 0
-		ecTaskStates := map[string]int{}
-		if err := fetchJSON(AdminUrl+"/api/plugin/jobs?limit=1000", &tasks); err == nil {
+		if tErr == nil {
+			var tasks []interface{}
+			json.NewDecoder(tResp.Body).Decode(&tasks)
+			tResp.Body.Close()
 			taskCount = len(tasks)
-			for _, task := range tasks {
-				jobType, _ := task["job_type"].(string)
-				state, _ := task["state"].(string)
-				if jobType == "erasure_coding" {
-					ecTaskCount++
-					ecTaskStates[state]++
-				}
-			}
-		}
-
-		t.Logf("Waiting for EC... (Workers: %d det=%d exec=%d, Tasks: %d ec=%d, EC States: %+v)",
-			workerCount, ecDetectorCount, ecExecutorCount, taskCount, ecTaskCount, ecTaskStates)
-
-		if debugTick%3 == 0 {
-			var pluginStatus map[string]interface{}
-			if err := fetchJSON(AdminUrl+"/api/plugin/status", &pluginStatus); err == nil {
-				t.Logf("Plugin status: enabled=%v worker_count=%v worker_grpc_port=%v configured=%v",
-					pluginStatus["enabled"], pluginStatus["worker_count"], pluginStatus["worker_grpc_port"], pluginStatus["configured"])
-			}
-
-			var schedulerStatus map[string]interface{}
-			if err := fetchJSON(AdminUrl+"/api/plugin/scheduler-status", &schedulerStatus); err == nil {
-				if schedValue, ok := schedulerStatus["scheduler"].(map[string]interface{}); ok {
-					t.Logf("Scheduler status: current_job_type=%v phase=%v last_iteration_had_jobs=%v idle_sleep_seconds=%v last_iteration_done_at=%v next_detection_at=%v",
-						schedValue["current_job_type"], schedValue["current_phase"],
-						schedValue["last_iteration_had_jobs"], schedValue["idle_sleep_seconds"], schedValue["last_iteration_done_at"], schedValue["next_detection_at"])
-				} else {
-					t.Logf("Scheduler status: %v", schedulerStatus)
-				}
-			}
-
-			var schedulerStates []map[string]interface{}
-			if err := fetchJSON(AdminUrl+"/api/plugin/scheduler-states", &schedulerStates); err == nil {
-				for _, state := range schedulerStates {
-					if state["job_type"] == "erasure_coding" {
-						t.Logf("EC scheduler state: enabled=%v detection_in_flight=%v detector_available=%v executor_workers=%v next_detection_at=%v last_run_status=%v last_run_started_at=%v last_run_completed_at=%v",
-							state["enabled"], state["detection_in_flight"], state["detector_available"],
-							state["executor_worker_count"], state["next_detection_at"], state["last_run_status"],
-							state["last_run_started_at"], state["last_run_completed_at"])
-						break
-					}
-				}
-			}
-
-			var jobTypes []map[string]interface{}
-			if err := fetchJSON(AdminUrl+"/api/plugin/job-types", &jobTypes); err == nil {
-				var names []string
-				for _, jobType := range jobTypes {
-					if name, ok := jobType["job_type"].(string); ok && name != "" {
-						names = append(names, name)
-					}
-				}
-				t.Logf("Plugin job types: %v", names)
-			}
-
-			var activities []map[string]interface{}
-			if err := fetchJSON(AdminUrl+"/api/plugin/activities?job_type=erasure_coding&limit=5", &activities); err == nil {
-				for i := len(activities) - 1; i >= 0; i-- {
-					act := activities[i]
-					t.Logf("EC activity: stage=%v message=%v occurred_at=%v", act["stage"], act["message"], act["occurred_at"])
-				}
-			}
 		}
+		t.Logf("Waiting for EC... (Workers: %d, Active Tasks: %d)", workerCount, taskCount)

 		time.Sleep(10 * time.Second)
 	}
@@ -1,6 +1,6 @@
 # Simplified single-stage build for SeaweedFS with FoundationDB support
 # Force x86_64 platform to use AMD64 FoundationDB packages
-FROM --platform=linux/amd64 golang:1.25-bookworm
+FROM --platform=linux/amd64 golang:1.24-bookworm

 ARG FOUNDATIONDB_VERSION=7.4.5
 ENV FOUNDATIONDB_VERSION=${FOUNDATIONDB_VERSION}
@@ -1,5 +1,5 @@
 # Multi-stage Dockerfile to build SeaweedFS with FoundationDB support for ARM64
-FROM --platform=linux/arm64 golang:1.25-bookworm AS builder
+FROM --platform=linux/arm64 golang:1.24-bookworm AS builder

 ARG FOUNDATIONDB_VERSION=7.4.5
 ENV FOUNDATIONDB_VERSION=${FOUNDATIONDB_VERSION}
@@ -1,5 +1,5 @@
 # Test environment with Go and FoundationDB support
-FROM golang:1.25-bookworm
+FROM golang:1.24-bookworm

 # Install system dependencies
 RUN apt-get update && apt-get install -y \
@@ -16,7 +16,7 @@
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <maven.compiler.source>11</maven.compiler.source>
        <maven.compiler.target>11</maven.compiler.target>
-        <spark.version>3.5.7</spark.version>
+        <spark.version>3.5.0</spark.version>
        <hadoop.version>3.3.6</hadoop.version>
        <scala.binary.version>2.12</scala.binary.version>
        <junit.version>4.13.2</junit.version>
@@ -123,7 +123,7 @@
            <dependency>
                <groupId>org.apache.zookeeper</groupId>
                <artifactId>zookeeper</artifactId>
-                <version>3.9.5</version>
+                <version>3.9.4</version>
            </dependency>

            <!-- Apache Commons - Fix CVEs -->
@@ -1,5 +1,5 @@
 # Dockerfile for Kafka Gateway Integration Testing
-FROM golang:1.25-alpine AS builder
+FROM golang:1.24-alpine AS builder

 # Install build dependencies
 RUN apk add --no-cache git make gcc musl-dev sqlite-dev
@@ -1,5 +1,5 @@
 # Dockerfile for building SeaweedFS components from the current workspace
-FROM golang:1.25-alpine AS builder
+FROM golang:1.24-alpine AS builder

 RUN apk add --no-cache git make gcc musl-dev sqlite-dev

@@ -1,5 +1,5 @@
 # Dockerfile for Kafka Integration Test Setup
-FROM golang:1.25-alpine AS builder
+FROM golang:1.24-alpine AS builder

 # Install build dependencies
 RUN apk add --no-cache git make gcc musl-dev
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Chris LuandClaude Opus 4.6	b1c862e7e3	fix: prevent unhandled promise rejection for scheduler status fetch Attach .catch at promise creation to mark it as handled by the runtime, then check the result type after await. This prevents an unhandledrejection event if the fetch rejects before the await. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-03 19:27:17 -08:00
Chris LuandClaude Opus 4.6	05902c7101	fix: use lifecycle context for job-type budget and retry backoff - Use r.ctx (cancelled on shutdown) as parent for per-job-type budget context instead of context.Background(), so in-flight work is cancelled promptly on plugin shutdown. - Replace waitForShutdownOrTimer with waitForShutdownOrCtx in retry backoff so retries respect the per-job-type budget context. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-03 19:27:06 -08:00
Chris LuandClaude Opus 4.6	e0cccae794	fix: add -scheduler.idleSleep flag to prevent EC integration test hang The new 17-minute default idle sleep caused TestEcEndToEnd to hang because the scheduler would not re-check for work frequently enough after the first iteration found nothing. Add -scheduler.idleSleep CLI flag (in seconds) to configure the idle sleep duration. The EC integration test now passes -scheduler.idleSleep=2 so detection runs every 2 seconds when idle. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-03 19:05:56 -08:00
Chris LuandClaude Opus 4.6	6289beb8f5	fix: add ClusterContextProvider to shutdown test and handle status fetch errors Address PR review nitpicks: - Add ClusterContextProvider to TestGracefulShutdownDuringIteration so the scheduler loop actually starts (New() requires it). - Wrap schedulerStatusPromise await in try/catch in plugin.templ so a failed status fetch does not break refreshJobsAndActivities rendering. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-03 18:49:37 -08:00
Chris LuandClaude Opus 4.6	35786d72e0	fix: unconditional lock release and context-aware executor reservation Address PR review findings: - Make defer releaseLock() unconditional in runSchedulerIteration since acquireAdminLock guarantees a non-nil release func on success. - Add ctx parameter to reserveScheduledExecutor so it honors the per-job-type budget context, preventing waits from exceeding the 30-minute budget. - Add waitForShutdownOrCtx helper that also selects on ctx.Done(). - Update all reserveScheduledExecutor call sites in tests. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-03 18:49:28 -08:00
Chris LuandClaude Opus 4.6	51d715b4e6	plugin: update and add tests for sequential iteration model Update TestListSchedulerStatesIncludesPolicyAndState to use currentJobType for DetectionInFlight and assert MaxJobTypeDurationSeconds. Add new tests: - TestIterationAcquiresLockOnce: verify single lock acquire per iteration - TestIterationReturnsfalseWhenLockFails: lock failure returns no-work - TestSchedulerPhaseTracking: phase transitions and finishIteration - TestGetSchedulerStatusIncludesIterationFields: status field population - TestGracefulShutdownDuringIteration: clean shutdown mid-iteration - TestIdleSleepDurationDefault: default 17m idle sleep - TestIdleSleepDurationCustom: custom idle sleep from Options Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-03 16:42:48 -08:00
Chris LuandClaude Opus 4.6	4f97f7d413	plugin: add scheduler iteration status card to UI Add a Scheduler Iteration card showing the current phase, active job type, idle sleep duration, and last iteration result. Update the Scheduler State table to replace In Flight / Next Detection / Interval columns with Status (Processing/Idle) and Max Duration columns to match the new iteration model. Add renderSchedulerIterationStatus JS function and update refreshJobsAndActivities to fetch and render iteration status. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-03 16:42:26 -08:00
Chris LuandClaude Opus 4.6	c8ad7b528d	plugin: update scheduler status to expose iteration state Add Phase, CurrentJobType, IdleSleepSeconds, IterationStartedAt, LastIterationEndedAt, and LastIterationWorkDetected to SchedulerStatus. Set SchedulerTickSeconds to match IdleSleepSeconds for backward compatibility. Add MaxJobTypeDurationSeconds to SchedulerJobTypeStatus and remove NextDetectionAt and DetectionIntervalSeconds. Update GetSchedulerStatus to read iteration tracking fields and adapt waiting status logic for the new model. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-03 16:42:10 -08:00
Chris LuandClaude Opus 4.6	41f22f5c92	plugin: rewrite scheduler to sequential lock-based iteration model Replace the ticker-based parallel goroutine scheduler with a single-lock sequential-processing iteration model: - schedulerLoop now calls runSchedulerIteration in a loop, sleeping idleSleepDuration (default 17m) when no work is found, or looping immediately when work is detected. - runSchedulerIteration acquires the admin lock once, loads cluster context once, then processes all enabled job types sequentially. - runJobTypeIteration runs detection then execution for one job type within a per-job-type budget (default 30m) enforced via context. - Remove markDetectionDue, finishDetection, pruneSchedulerState, runSchedulerTick, and runScheduledDetection which are no longer needed. - dispatchScheduledProposals and executeScheduledJobWithExecutor now accept a parent context for budget enforcement. - Remove DetectionInterval from schedulerPolicy, add MaxJobTypeDuration. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-03 16:41:59 -08:00
Chris LuandClaude Opus 4.6	05138c6031	plugin: add iteration tracking fields to Plugin struct Replace per-job-type detection maps (nextDetectionAt, detectionInFlight) with iteration-level tracking fields: schedulerPhase, currentJobType, iterationStartedAt, lastIterationEndedAt, lastIterationWorkDetected. Add IdleSleepDuration to Options and idleSleepDuration to Plugin. Add MaxJobTypeDurationSeconds to SchedulerJobTypeState and remove NextDetectionAt and DetectionIntervalSeconds which are no longer needed in the sequential iteration model. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-03 16:40:50 -08:00