mount: stable-read open fence, causal log timestamp on the cache response

An event applied while the open's lookup was in flight could already be
reflected in the returned entry while sitting above the pre-lookup
cursor, so the fence under-covered and the queued invalidation replaced
the fresher entry. The open now re-reads until the cursor is stable
across the lookup; on sustained churn the last pre-lookup value stands,
which can only under-fence, never block a newer event.

A pre-RPC ping likewise cannot vouch for events committed during the
RPC itself. CacheRemoteObjectToLocalCluster now returns a log timestamp
stamped before the filer reads the entry — events are logged after
their store write on that same clock, so everything at or below it is
reflected in the returned entry, making the fence causal with the
response. The mount prefers the response event's timestamp, then this
log timestamp, and keeps the pre-RPC ping only for filers that return
neither.

.codespellrc

@@ -1,22 +0,0 @@
-[codespell]
-# Ref: https://github.com/codespell-project/codespell#using-a-config-file
-skip = .git,.git-meta,.gitignore,.gitattributes,*.svg,go.sum,vendor,*.lock,*.css,*.min.*,.codespellrc,*_templ.go
-check-hidden = true
-# Ignore camelCase and PascalCase identifiers (very common in Go/Rust/JS
-# source, e.g. allLocations, publishErr, ReadInside, FlushInterval).
-ignore-regex = \b[a-z]+[A-Z]\w*\b|\b[A-Z][a-z]+[A-Z]\w*\b
-# visibles: variable name for VisibleInterval collections in filer/mount code
-# fo: `*FilerOptions` receiver name (e.g. `func (fo *FilerOptions) ...`)
-# te: "truncate error" local variable (e.g. `if te := w.Truncate(end); te != nil`)
-# ser: Rust serde serializer variable (`serde_json::ser`, `let mut ser = ...`)
-# bject: intentional wildcard test data (e.g. `s3:Get?bject` matching `s3:GetObject`)
-# unparseable: accepted alternate spelling used throughout the codebase
-# keep-alives: correct plural of the technical term (SSH/HTTP keep-alive)
-# tread: valid English word in the idiom "tread carefully" (help text)
-# anc: variable abbreviation for "ancestor" in tree/path tests
-# ue: appears inside JSON test fixtures with embedded escaped quotes (Bl\"ue)
-# auther: local variable meaning "authenticator" (tls.go: `auther := Authenticator{}`)
-# thirdparty: literal Maven groupId `org.apache.hadoop.thirdparty` (external, cannot rename)
-# unknwon: GitHub username / Go module path (`github.com/unknwon/goconfig`)
-# atleast: CLI mode literal string in test/benchmark/fuse_db/bin/sqlite_verify.py
-ignore-words-list = visibles,fo,te,ser,bject,unparseable,keep-alives,tread,anc,ue,auther,thirdparty,unknwon,atleast

.github/actions/fix-fusermount-setuid/action.yml

@@ -1,66 +0,0 @@
-name: Fix fusermount3 setuid
-description: >
-  Make sure the fusermount3 an unprivileged mount will find can actually mount.
-  Some runner images carry a second, source-built fusermount3 in /usr/local/bin
-  that shadows the distro one in PATH; it is neither setuid nor root-owned, so
-  every mount fails with "mount failed: Operation not permitted". Both the Go
-  mount and sw-fuse resolve the helper through PATH.
-  Run it after the step that apt-installs fuse3.
-
-runs:
-  using: composite
-  steps:
-    - name: Point PATH at a fusermount3 that can mount
-      shell: bash
-      run: |
-        set -euo pipefail
-
-        # setuid only grants root when root owns the file, and exec follows
-        # symlinks, so judge the target.
-        can_mount() {
-          [ -u "$1" ] && [ "$(stat -Lc %u "$1")" = 0 ]
-        }
-
-        bin=$(command -v fusermount3 || true)
-        if [ -z "$bin" ]; then
-          echo "no fusermount3 in PATH" >&2
-          exit 1
-        fi
-        if can_mount "$bin"; then
-          ls -l "$bin"
-          exit 0
-        fi
-        echo "$bin cannot mount unprivileged:"
-        ls -l "$bin"
-
-        # The distro fusermount3 is setuid root and is the one meant to be used.
-        # Reach it through a symlink earlier in PATH: exec resolves the link, so
-        # the target keeps its setuid bit, and nothing on the image is modified.
-        for distro in /usr/bin/fusermount3 /bin/fusermount3; do
-          if [ "$distro" != "$bin" ] && can_mount "$distro"; then
-            mkdir -p "$RUNNER_TEMP/fuse-bin"
-            ln -sf "$distro" "$RUNNER_TEMP/fuse-bin/fusermount3"
-            echo "$RUNNER_TEMP/fuse-bin" >> "$GITHUB_PATH"
-            echo "using $distro instead"
-            ls -l "$distro"
-            exit 0
-          fi
-        done
-
-        # No usable distro binary, so setting the bit is the only way out - but
-        # the target came from PATH: do that only for a root-owned system binary,
-        # never for anything else that happens to sit there.
-        case "$bin" in
-          /bin/*|/sbin/*|/usr/bin/*|/usr/sbin/*|/usr/local/bin/*|/usr/local/sbin/*) ;;
-          *) echo "refusing to setuid $bin: outside the system bin paths" >&2; exit 1 ;;
-        esac
-        if [ -L "$bin" ] || [ ! -f "$bin" ] || [ ! -x "$bin" ]; then
-          echo "refusing to setuid $bin: not a regular executable file" >&2
-          exit 1
-        fi
-        if [ "$(stat -c %u "$bin")" != 0 ] || [ "$(stat -c %g "$bin")" != 0 ]; then
-          echo "refusing to setuid $bin: not owned by root:root" >&2
-          exit 1
-        fi
-        sudo chmod u+s "$bin"
-        ls -l "$bin"

.github/workflows/binaries_dev.yml

@@ -48,7 +48,7 @@ jobs:
     steps:
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v2
 
       - name: Set BUILD_TIME env
         run: echo BUILD_TIME=$(date -u +%Y%m%d-%H%M) >> ${GITHUB_ENV}
@@ -97,7 +97,7 @@ jobs:
     steps:
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v2
 
       - name: Set BUILD_TIME env
         run: echo BUILD_TIME=$(date -u +%Y%m%d-%H%M) >> ${GITHUB_ENV}

.github/workflows/binaries_release0.yml

@@ -28,7 +28,7 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v2
       - name: Go Release Binaries Normal Volume Size
         uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.22
         with:

.github/workflows/binaries_release1.yml

@@ -28,7 +28,7 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v2
       - name: Go Release Binaries Normal Volume Size
         uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.22
         with:

.github/workflows/binaries_release2.yml

@@ -28,7 +28,7 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v2
       - name: Go Release Binaries Normal Volume Size
         uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.22
         with:

.github/workflows/binaries_release3.yml

@@ -28,7 +28,7 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v2
       - name: Go Release Binaries Normal Volume Size
         uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.22
         with:

.github/workflows/binaries_release4.yml

@@ -28,7 +28,7 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v2
       - name: Go Release Binaries Normal Volume Size
         uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.22
         with:

.github/workflows/binaries_release5.yml

@@ -28,7 +28,7 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v2
       - name: Go Release Binaries Normal Volume Size
         uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.22
         with:

.github/workflows/codeql.yml

@@ -23,11 +23,11 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4.37.9
+        uses: github/codeql-action/init@v4
         # Override language selection by uncommenting this and choosing your languages
         with:
           languages: go
@@ -35,7 +35,7 @@ jobs:
       # Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below).
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v4.37.9
+        uses: github/codeql-action/autobuild@v4
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -49,4 +49,4 @@ jobs:
       #     make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4.37.9
+        uses: github/codeql-action/analyze@v4

.github/workflows/codespell.yml

@@ -1,23 +0,0 @@
-# Codespell configuration is within .codespellrc
----
-name: Codespell
-
-on:
-  push:
-    branches: [master]
-  pull_request:
-    branches: [master]
-
-permissions:
-  contents: read
-
-jobs:
-  codespell:
-    name: Check for spelling errors
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-      - name: Codespell
-        uses: codespell-project/actions-codespell@8f01853be192eb0f849a5c7d721450e7a467c579  # v2.2

.github/workflows/container_dev.yml

@@ -6,7 +6,6 @@ on:
     paths:
       - 'weed/**'
       - 'seaweed-volume/**'
-      - 'seaweed-worker/**'
       - 'docker/**'
       - 'go.mod'
       - 'go.sum'
@@ -17,7 +16,7 @@ permissions:
 
 jobs:
 
-  # ── Pre-build the Rust binaries natively ────────────────────────────
+  # ── Pre-build Rust volume server binaries natively ──────────────────
   build-rust-binaries:
     runs-on: ubuntu-22.04
     strategy:
@@ -32,6 +31,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v7
 
+      - name: Install protobuf compiler
+        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
+
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
         with:
@@ -56,26 +58,10 @@ jobs:
             ~/.cargo/registry
             ~/.cargo/git
             seaweed-volume/target
-            seaweed-worker/target/${{ matrix.target }}/release
-          key: rust-docker-dev-${{ matrix.target }}-${{ hashFiles('seaweed-volume/Cargo.lock', 'seaweed-worker/Cargo.lock') }}
+          key: rust-docker-dev-${{ matrix.target }}-${{ hashFiles('seaweed-volume/Cargo.lock') }}
           restore-keys: |
             rust-docker-dev-${{ matrix.target }}-
 
-      # lance's build scripts compile their own protos and look for a protoc.
-      # Point them at the one protoc-bin-vendored ships, which seaweed-worker's
-      # own build already uses, so no job depends on a system package and every
-      # build sees the same version.
-      - name: Use the vendored protoc
-        run: |
-          cd seaweed-worker
-          cargo fetch
-          # The version from the lock, not whatever else a restored cache holds.
-          version=$(awk '/^name = "protoc-bin-vendored-linux-x86_64"$/{found=1; next} found && /^version = /{gsub(/"/,"",$3); print $3; exit}' Cargo.lock)
-          test -n "$version" || { echo "protoc-bin-vendored-linux-x86_64 is not in Cargo.lock" >&2; exit 1; }
-          protoc=$(find ~/.cargo/registry/src -path "*protoc-bin-vendored-linux-x86_64-$version/bin/protoc" | head -1)
-          test -x "$protoc" || { echo "no vendored protoc $version in the registry" >&2; exit 1; }
-          echo "PROTOC=$protoc" >> "$GITHUB_ENV"
-
       - name: Build normal variant
         env:
           SEAWEEDFS_COMMIT: ${{ github.sha }}
@@ -84,19 +70,11 @@ jobs:
           cargo build --release --target ${{ matrix.target }} --no-default-features
           cp target/${{ matrix.target }}/release/weed-volume ../weed-volume-normal-${{ matrix.arch }}
 
-      - name: Build the Rust maintenance worker
-        run: |
-          cd seaweed-worker
-          cargo build --release -p weed-lance-worker --target ${{ matrix.target }}
-          cp target/${{ matrix.target }}/release/weed-worker ../weed-worker-${{ matrix.arch }}
-
       - name: Upload artifacts
         uses: actions/upload-artifact@v7
         with:
-          name: rust-bins-${{ matrix.arch }}
-          path: |
-            weed-volume-normal-${{ matrix.arch }}
-            weed-worker-${{ matrix.arch }}
+          name: rust-volume-${{ matrix.arch }}
+          path: weed-volume-normal-${{ matrix.arch }}
 
   build-dev-containers:
     needs: [build-rust-binaries]
@@ -109,7 +87,7 @@ jobs:
       - name: Download pre-built Rust binaries
         uses: actions/download-artifact@v8
         with:
-          pattern: rust-bins-*
+          pattern: rust-volume-*
           merge-multiple: true
           path: ./rust-bins
 
@@ -123,16 +101,7 @@ jobs:
               echo "Placed pre-built Rust binary for ${arch}"
             fi
           done
-          mkdir -p docker/weed-worker-prebuilt
-          for arch in amd64 arm64; do
-            src="./rust-bins/weed-worker-${arch}"
-            if [ -f "$src" ]; then
-              cp "$src" "docker/weed-worker-prebuilt/weed-worker-${arch}"
-              echo "Placed pre-built Rust worker for ${arch}"
-            fi
-          done
           ls -la docker/weed-volume-prebuilt/
-          ls -la docker/weed-worker-prebuilt/
 
       - name: Docker meta
         id: docker_meta
@@ -166,14 +135,14 @@ jobs:
 
       - name: Login to Docker Hub
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v4.6.0
+        uses: docker/login-action@v4.4.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
       - name: Login to GHCR
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v4.6.0
+        uses: docker/login-action@v4.4.0
         with:
           registry: ghcr.io
           username: ${{ secrets.GHCR_USERNAME }}

.github/workflows/container_foundationdb_version.yml

@@ -133,24 +133,20 @@ jobs:
 
       - name: Login to Docker Hub
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v4.6.0
+        uses: docker/login-action@v4.4.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
       - name: Determine branch to build
         id: branch
-        env:
-          INPUT_REF: ${{ inputs.seaweedfs_ref }}
-          HEAD_REF: ${{ github.head_ref }}
-          REF_NAME: ${{ github.ref_name }}
         run: |
-          if [ -n "$INPUT_REF" ]; then
-            echo "branch=$INPUT_REF" >> "$GITHUB_OUTPUT"
+          if [ -n "${{ inputs.seaweedfs_ref }}" ]; then
+            echo "branch=${{ inputs.seaweedfs_ref }}" >> "$GITHUB_OUTPUT"
           elif [ "${{ github.event_name }}" = "pull_request" ]; then
-            echo "branch=$HEAD_REF" >> "$GITHUB_OUTPUT"
+            echo "branch=${{ github.head_ref }}" >> "$GITHUB_OUTPUT"
           else
-            echo "branch=$REF_NAME" >> "$GITHUB_OUTPUT"
+            echo "branch=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Build and push image

.github/workflows/container_latest.yml

@@ -59,7 +59,7 @@ jobs:
             echo "publish=true" >> "$GITHUB_OUTPUT"
           fi
 
-  # ── Pre-build the Rust binaries natively ────────────────────────────
+  # ── Pre-build Rust volume server binaries natively ──────────────────
   build-rust-binaries:
     runs-on: ubuntu-22.04
     strategy:
@@ -76,6 +76,9 @@ jobs:
         with:
           ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.source_ref || github.ref }}
 
+      - name: Install protobuf compiler
+        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
+
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
         with:
@@ -100,26 +103,10 @@ jobs:
             ~/.cargo/registry
             ~/.cargo/git
             seaweed-volume/target
-            seaweed-worker/target/${{ matrix.target }}/release
-          key: rust-docker-${{ matrix.target }}-${{ hashFiles('seaweed-volume/Cargo.lock', 'seaweed-worker/Cargo.lock') }}
+          key: rust-docker-${{ matrix.target }}-${{ hashFiles('seaweed-volume/Cargo.lock') }}
           restore-keys: |
             rust-docker-${{ matrix.target }}-
 
-      # lance's build scripts compile their own protos and look for a protoc.
-      # Point them at the one protoc-bin-vendored ships, which seaweed-worker's
-      # own build already uses, so no job depends on a system package and every
-      # build sees the same version.
-      - name: Use the vendored protoc
-        run: |
-          cd seaweed-worker
-          cargo fetch
-          # The version from the lock, not whatever else a restored cache holds.
-          version=$(awk '/^name = "protoc-bin-vendored-linux-x86_64"$/{found=1; next} found && /^version = /{gsub(/"/,"",$3); print $3; exit}' Cargo.lock)
-          test -n "$version" || { echo "protoc-bin-vendored-linux-x86_64 is not in Cargo.lock" >&2; exit 1; }
-          protoc=$(find ~/.cargo/registry/src -path "*protoc-bin-vendored-linux-x86_64-$version/bin/protoc" | head -1)
-          test -x "$protoc" || { echo "no vendored protoc $version in the registry" >&2; exit 1; }
-          echo "PROTOC=$protoc" >> "$GITHUB_ENV"
-
       - name: Build large-disk variant
         env:
           SEAWEEDFS_COMMIT: ${{ github.sha }}
@@ -136,20 +123,13 @@ jobs:
           cargo build --release --target ${{ matrix.target }} --no-default-features
           cp target/${{ matrix.target }}/release/weed-volume ../weed-volume-normal-${{ matrix.arch }}
 
-      - name: Build the Rust maintenance worker
-        run: |
-          cd seaweed-worker
-          cargo build --release -p weed-lance-worker --target ${{ matrix.target }}
-          cp target/${{ matrix.target }}/release/weed-worker ../weed-worker-${{ matrix.arch }}
-
       - name: Upload artifacts
         uses: actions/upload-artifact@v7
         with:
-          name: rust-bins-${{ matrix.arch }}
+          name: rust-volume-${{ matrix.arch }}
           path: |
             weed-volume-large-disk-${{ matrix.arch }}
             weed-volume-normal-${{ matrix.arch }}
-            weed-worker-${{ matrix.arch }}
 
   build:
     needs: [setup, build-rust-binaries]
@@ -197,7 +177,7 @@ jobs:
       - name: Download pre-built Rust binaries
         uses: actions/download-artifact@v8
         with:
-          pattern: rust-bins-*
+          pattern: rust-volume-*
           merge-multiple: true
           path: ./rust-bins
 
@@ -211,16 +191,7 @@ jobs:
               echo "Placed pre-built Rust binary for ${arch}"
             fi
           done
-          mkdir -p docker/weed-worker-prebuilt
-          for arch in amd64 arm64; do
-            src="./rust-bins/weed-worker-${arch}"
-            if [ -f "$src" ]; then
-              cp "$src" "docker/weed-worker-prebuilt/weed-worker-${arch}"
-              echo "Placed pre-built Rust worker for ${arch}"
-            fi
-          done
           ls -la docker/weed-volume-prebuilt/
-          ls -la docker/weed-worker-prebuilt/
 
       - name: Docker meta
         id: docker_meta
@@ -250,13 +221,13 @@ jobs:
           buildkitd-config: /tmp/buildkitd.toml
       - name: Login to Docker Hub
         if: needs.setup.outputs.publish == 'true'
-        uses: docker/login-action@v4.6.0
+        uses: docker/login-action@v4.4.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
       - name: Login to GHCR
         if: needs.setup.outputs.publish == 'true'
-        uses: docker/login-action@v4.6.0
+        uses: docker/login-action@v4.4.0
         with:
           registry: ghcr.io
           username: ${{ secrets.GHCR_USERNAME }}
@@ -304,7 +275,7 @@ jobs:
           fi
       - name: Login to GHCR
         if: needs.setup.outputs.publish == 'true'
-        uses: docker/login-action@v4.6.0
+        uses: docker/login-action@v4.4.0
         with:
           registry: ghcr.io
           username: ${{ secrets.GHCR_USERNAME }}
@@ -318,7 +289,7 @@ jobs:
         if: needs.setup.outputs.publish != 'true'
         uses: actions/download-artifact@v8
         with:
-          pattern: rust-bins-*
+          pattern: rust-volume-*
           merge-multiple: true
           path: ./rust-bins
       - name: Place Rust binaries in Docker context for local scan
@@ -336,16 +307,7 @@ jobs:
               echo "Placed pre-built Rust binary for ${arch}"
             fi
           done
-          mkdir -p docker/weed-worker-prebuilt
-          for arch in amd64 arm64; do
-            src="./rust-bins/weed-worker-${arch}"
-            if [ -f "$src" ]; then
-              cp "$src" "docker/weed-worker-prebuilt/weed-worker-${arch}"
-              echo "Placed pre-built Rust worker for ${arch}"
-            fi
-          done
           ls -la docker/weed-volume-prebuilt/
-          ls -la docker/weed-worker-prebuilt/
       - name: Create BuildKit config for local scan build
         if: needs.setup.outputs.publish != 'true'
         run: |
@@ -405,7 +367,7 @@ jobs:
           output: trivy-results.sarif
           exit-code: '0'
       - name: Upload Trivy scan results to GitHub Security
-        uses: github/codeql-action/upload-sarif@v4.37.9
+        uses: github/codeql-action/upload-sarif@v4
         if: always()
         with:
           sarif_file: trivy-results.sarif
@@ -468,12 +430,12 @@ jobs:
             ghcr.io/chrislusf/seaweedfs
           tags: type=raw,value=${{ github.event_name == 'workflow_dispatch' && github.event.inputs.image_tag || 'latest' }},suffix=${{ steps.config.outputs.tag_suffix }}
       - name: Login to Docker Hub
-        uses: docker/login-action@v4.6.0
+        uses: docker/login-action@v4.4.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
       - name: Login to GHCR
-        uses: docker/login-action@v4.6.0
+        uses: docker/login-action@v4.4.0
         with:
           registry: ghcr.io
           username: ${{ secrets.GHCR_USERNAME }}

.github/workflows/container_release_foundationdb.yml

@@ -50,7 +50,7 @@ jobs:
       -
         name: Login to Docker Hub
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v4.6.0
+        uses: docker/login-action@v4.4.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}

.github/workflows/container_release_unified.yml

@@ -42,10 +42,9 @@ concurrency:
 
 jobs:
 
-  # ── Pre-build the Rust binaries natively ────────────────────────────
-  # The volume server and the Rust maintenance worker, cross-compiled for
-  # amd64 and arm64 without QEMU, turning a 5-hour emulated cargo build into
-  # ~15 minutes of native compilation.
+  # ── Pre-build Rust volume server binaries natively ──────────────────
+  # Cross-compiles for amd64 and arm64 without QEMU, turning a 5-hour
+  # emulated cargo build into ~15 minutes of native compilation.
   build-rust-binaries:
     runs-on: ubuntu-22.04
     strategy:
@@ -60,6 +59,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v7
 
+      - name: Install protobuf compiler
+        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
+
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
         with:
@@ -84,26 +86,10 @@ jobs:
             ~/.cargo/registry
             ~/.cargo/git
             seaweed-volume/target
-            seaweed-worker/target/${{ matrix.target }}/release
-          key: rust-docker-${{ matrix.target }}-${{ hashFiles('seaweed-volume/Cargo.lock', 'seaweed-worker/Cargo.lock') }}
+          key: rust-docker-${{ matrix.target }}-${{ hashFiles('seaweed-volume/Cargo.lock') }}
           restore-keys: |
             rust-docker-${{ matrix.target }}-
 
-      # lance's build scripts compile their own protos and look for a protoc.
-      # Point them at the one protoc-bin-vendored ships, which seaweed-worker's
-      # own build already uses, so no job depends on a system package and every
-      # build sees the same version.
-      - name: Use the vendored protoc
-        run: |
-          cd seaweed-worker
-          cargo fetch
-          # The version from the lock, not whatever else a restored cache holds.
-          version=$(awk '/^name = "protoc-bin-vendored-linux-x86_64"$/{found=1; next} found && /^version = /{gsub(/"/,"",$3); print $3; exit}' Cargo.lock)
-          test -n "$version" || { echo "protoc-bin-vendored-linux-x86_64 is not in Cargo.lock" >&2; exit 1; }
-          protoc=$(find ~/.cargo/registry/src -path "*protoc-bin-vendored-linux-x86_64-$version/bin/protoc" | head -1)
-          test -x "$protoc" || { echo "no vendored protoc $version in the registry" >&2; exit 1; }
-          echo "PROTOC=$protoc" >> "$GITHUB_ENV"
-
       - name: Build large-disk variant
         env:
           SEAWEEDFS_COMMIT: ${{ github.sha }}
@@ -120,20 +106,13 @@ jobs:
           cargo build --release --target ${{ matrix.target }} --no-default-features
           cp target/${{ matrix.target }}/release/weed-volume ../weed-volume-normal-${{ matrix.arch }}
 
-      - name: Build the Rust maintenance worker
-        run: |
-          cd seaweed-worker
-          cargo build --release -p weed-lance-worker --target ${{ matrix.target }}
-          cp target/${{ matrix.target }}/release/weed-worker ../weed-worker-${{ matrix.arch }}
-
       - name: Upload artifacts
         uses: actions/upload-artifact@v7
         with:
-          name: rust-bins-${{ matrix.arch }}
+          name: rust-volume-${{ matrix.arch }}
           path: |
             weed-volume-large-disk-${{ matrix.arch }}
             weed-volume-normal-${{ matrix.arch }}
-            weed-worker-${{ matrix.arch }}
 
   # One job per (variant, platform) on a native runner, pushed by digest;
   # the merge job stitches the digests into one multi-arch tag.
@@ -179,7 +158,7 @@ jobs:
         if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
         uses: actions/download-artifact@v8
         with:
-          pattern: rust-bins-*
+          pattern: rust-volume-*
           merge-multiple: true
           path: ./rust-bins
 
@@ -194,16 +173,7 @@ jobs:
               echo "Placed pre-built Rust binary for ${arch}"
             fi
           done
-          mkdir -p docker/weed-worker-prebuilt
-          for arch in amd64 arm64; do
-            src="./rust-bins/weed-worker-${arch}"
-            if [ -f "$src" ]; then
-              cp "$src" "docker/weed-worker-prebuilt/weed-worker-${arch}"
-              echo "Placed pre-built Rust worker for ${arch}"
-            fi
-          done
           ls -la docker/weed-volume-prebuilt/
-          ls -la docker/weed-worker-prebuilt/
 
       - name: Free Disk Space
         if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
@@ -249,7 +219,7 @@ jobs:
 
       - name: Login to GHCR
         if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
-        uses: docker/login-action@v4.6.0
+        uses: docker/login-action@v4.4.0
         with:
           registry: ghcr.io
           username: ${{ secrets.GHCR_USERNAME }}
@@ -323,7 +293,7 @@ jobs:
 
       - name: Login to GHCR
         if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
-        uses: docker/login-action@v4.6.0
+        uses: docker/login-action@v4.4.0
         with:
           registry: ghcr.io
           username: ${{ secrets.GHCR_USERNAME }}
@@ -340,7 +310,7 @@ jobs:
 
       - name: Login to Docker Hub
         if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
-        uses: docker/login-action@v4.6.0
+        uses: docker/login-action@v4.4.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
@@ -404,7 +374,7 @@ jobs:
             variant: large_disk
     steps:
       - name: Login to GHCR
-        uses: docker/login-action@v4.6.0
+        uses: docker/login-action@v4.4.0
         with:
           registry: ghcr.io
           username: ${{ secrets.GHCR_USERNAME }}
@@ -430,7 +400,7 @@ jobs:
 
       - name: Upload Trivy scan results to GitHub Security
         if: always()
-        uses: github/codeql-action/upload-sarif@v4.37.9
+        uses: github/codeql-action/upload-sarif@v4
         with:
           sarif_file: trivy-results.sarif
           category: trivy-${{ matrix.variant }}
@@ -453,13 +423,13 @@ jobs:
             latest_tag: latest_large_disk
     steps:
       - name: Login to Docker Hub
-        uses: docker/login-action@v4.6.0
+        uses: docker/login-action@v4.4.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
       - name: Login to GHCR
-        uses: docker/login-action@v4.6.0
+        uses: docker/login-action@v4.4.0
         with:
           registry: ghcr.io
           username: ${{ secrets.GHCR_USERNAME }}

.github/workflows/container_rocksdb_version.yml

@@ -25,7 +25,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v2
 
       - name: Prepare Docker tag
         id: tag
@@ -88,7 +88,7 @@ jobs:
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v1
 
       - name: Login to Docker Hub
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v1
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v1
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}

.github/workflows/deploy_telemetry.yml

@@ -26,17 +26,14 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
-          go-version-file: 'telemetry/server/go.mod'
+          go-version-file: 'go.mod'
 
       - name: Build Telemetry Server
         if: github.event_name == 'workflow_dispatch' && inputs.deploy
         run: |
-          # telemetry/server is its own Go module; build from within it
-          cd telemetry/server
           go mod tidy
           echo "Building telemetry server..."
-          GOOS=linux GOARCH=amd64 go build -o ../../telemetry-server .
-          cd ../..
+          GOOS=linux GOARCH=amd64 go build -o telemetry-server ./telemetry/server/main.go
           ls -la telemetry-server
           echo "Build completed successfully"
 

.github/workflows/depsreview.yml

@@ -9,6 +9,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Checkout Repository'
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
       - name: 'Dependency Review'
         uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294

.github/workflows/e2e.yml

@@ -61,10 +61,13 @@ jobs:
 
     - name: Install dependencies
       run: |
+        # Use faster mirrors and install with timeout
         sudo rm -f /etc/apt/sources.list.d/azure-cli.list /etc/apt/sources.list.d/microsoft-prod.list
-        # Same helper the e2e image installs through: the runner's own list is
-        # azure-only too, and an outage there fails this step outright.
-        sudo ./apt-install fuse
+        echo "deb http://azure.archive.ubuntu.com/ubuntu/ $(lsb_release -cs) main restricted universe multiverse" | sudo tee /etc/apt/sources.list
+        echo "deb http://azure.archive.ubuntu.com/ubuntu/ $(lsb_release -cs)-updates main restricted universe multiverse" | sudo tee -a /etc/apt/sources.list
+        
+        sudo apt-get update --fix-missing
+        sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends fuse
         
         # Verify FUSE installation
         echo "FUSE version: $(fusermount --version 2>&1 || echo 'fusermount not found')"

.github/workflows/ec-integration-tests.yml

@@ -30,7 +30,7 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v7
       with:
-        go-version: ^1.26
+        go-version: ^1.25
       id: go
 
     - name: Check out code into the Go module directory
@@ -43,10 +43,7 @@ jobs:
     - name: Run EC Integration Tests
       working-directory: test/erasure_coding
       run: |
-        # The suite now includes the interruption matrix and runs close to Go's
-        # default 10m binary timeout on slower runners; bound it by the job's
-        # 30m budget instead.
-        go test -v -timeout 25m
+        go test -v
 
     - name: Collect server logs on failure
       if: failure()

.github/workflows/fuse-dlm-integration.yml

@@ -8,7 +8,6 @@ on:
       - 'weed/cluster/**'
       - 'test/fuse_dlm/**'
       - '.github/workflows/fuse-dlm-integration.yml'
-      - '.github/actions/fix-fusermount-setuid/**'
   push:
     branches: [master]
     paths:
@@ -16,7 +15,6 @@ on:
       - 'weed/mount/**'
       - 'weed/cluster/**'
       - 'test/fuse_dlm/**'
-      - '.github/actions/fix-fusermount-setuid/**'
 
 concurrency:
   group: ${{ github.head_ref || github.ref }}/fuse-dlm-integration
@@ -40,17 +38,13 @@ jobs:
         with:
           go-version-file: 'go.mod'
 
-      - name: Configure FUSE
+      - name: Install FUSE dependencies
         run: |
-          # Nothing to install: fuse3 ships fusermount3 and is pre-installed,
-          # and go-fuse is pure Go, so the libfuse headers were never linked
-          # against.
+          sudo apt-get update
+          sudo apt-get install -y libfuse3-dev
           echo 'user_allow_other' | sudo tee -a /etc/fuse.conf
           sudo chmod 644 /etc/fuse.conf
 
-      - name: Repair the fusermount3 setuid bit
-        uses: ./.github/actions/fix-fusermount-setuid
-
       - name: Build SeaweedFS
         run: go build -o weed/weed -buildvcs=false ./weed
 

.github/workflows/fuse-failover.yml

@@ -1,76 +0,0 @@
-name: "FUSE Volume Server Failover Tests"
-
-on:
-  pull_request:
-    paths:
-      - 'weed/command/mount*.go'
-      - 'weed/mount/**'
-      - 'weed/filer/**'
-      - 'weed/wdclient/**'
-      - 'weed/operation/upload_content.go'
-      - 'test/fuse_failover/**'
-      - '.github/workflows/fuse-failover.yml'
-      - '.github/actions/fix-fusermount-setuid/**'
-  push:
-    branches: [master]
-    paths:
-      - 'weed/command/mount*.go'
-      - 'weed/mount/**'
-      - 'weed/filer/**'
-      - 'weed/wdclient/**'
-      - 'weed/operation/upload_content.go'
-      - 'test/fuse_failover/**'
-      - '.github/workflows/fuse-failover.yml'
-      - '.github/actions/fix-fusermount-setuid/**'
-
-concurrency:
-  group: ${{ github.head_ref || github.ref }}/fuse-failover
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  fuse-failover:
-    name: FUSE Volume Server Failover
-    runs-on: ubuntu-22.04
-    timeout-minutes: 40
-
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-
-      - name: Configure FUSE
-        run: |
-          # Nothing to install: fuse3 ships fusermount3 and is pre-installed,
-          # and go-fuse is pure Go, so the libfuse headers were never linked
-          # against.
-          echo 'user_allow_other' | sudo tee -a /etc/fuse.conf
-          sudo chmod 644 /etc/fuse.conf
-
-      - name: Repair the fusermount3 setuid bit
-        uses: ./.github/actions/fix-fusermount-setuid
-
-      - name: Build SeaweedFS
-        run: go build -o weed/weed -buildvcs=false ./weed
-
-      - name: Run failover integration tests
-        timeout-minutes: 35
-        env:
-          WEED_BINARY: ${{ github.workspace }}/weed/weed
-        run: go test -v -count=1 -timeout=30m ./test/fuse_failover/...
-
-      - name: Upload logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: fuse-failover-test-logs
-          path: /tmp/seaweedfs-fuse-failover-logs/
-          retention-days: 3

.github/workflows/fuse-integration.yml

@@ -7,14 +7,12 @@ on:
       - 'weed/**'
       - 'test/fuse_integration/**'
       - '.github/workflows/fuse-integration.yml'
-      - '.github/actions/fix-fusermount-setuid/**'
   pull_request:
     branches: [ master, main ]
     paths:
       - 'weed/**'
       - 'test/fuse_integration/**'
       - '.github/workflows/fuse-integration.yml'
-      - '.github/actions/fix-fusermount-setuid/**'
 
 concurrency:
   group: ${{ github.head_ref }}/fuse-integration
@@ -38,10 +36,12 @@ jobs:
       with:
         go-version-file: 'go.mod'
 
-    - name: Configure FUSE
+    - name: Install FUSE and dependencies
       run: |
-        # Nothing to install: fuse3 ships fusermount3 and is pre-installed, and
-        # go-fuse is pure Go, so the libfuse headers were never linked against.
+        sudo apt-get update
+        # fuse3 is pre-installed on ubuntu-22.04 runners and conflicts
+        # with the legacy fuse package, so only install the dev headers.
+        sudo apt-get install -y libfuse3-dev
         # Allow non-root FUSE mounts with allow_other
         echo 'user_allow_other' | sudo tee -a /etc/fuse.conf
         sudo chmod 644 /etc/fuse.conf
@@ -49,9 +49,6 @@ jobs:
         fusermount3 --version || fusermount --version || true
         ls -la /dev/fuse
 
-    - name: Repair the fusermount3 setuid bit
-      uses: ./.github/actions/fix-fusermount-setuid
-
     - name: Build SeaweedFS
       run: |
         cd weed

.github/workflows/fuse-p2p-integration.yml

@@ -11,7 +11,6 @@ on:
       - 'weed/pb/filer.proto'
       - 'test/fuse_p2p/**'
       - '.github/workflows/fuse-p2p-integration.yml'
-      - '.github/actions/fix-fusermount-setuid/**'
   push:
     branches: [master]
     paths:
@@ -22,7 +21,6 @@ on:
       - 'weed/pb/mount_peer.proto'
       - 'weed/pb/filer.proto'
       - 'test/fuse_p2p/**'
-      - '.github/actions/fix-fusermount-setuid/**'
 
 concurrency:
   group: ${{ github.head_ref || github.ref }}/fuse-p2p-integration
@@ -46,17 +44,13 @@ jobs:
         with:
           go-version-file: 'go.mod'
 
-      - name: Configure FUSE
+      - name: Install FUSE dependencies
         run: |
-          # Nothing to install: fuse3 ships fusermount3 and is pre-installed,
-          # and go-fuse is pure Go, so the libfuse headers were never linked
-          # against.
+          sudo apt-get update
+          sudo apt-get install -y libfuse3-dev
           echo 'user_allow_other' | sudo tee -a /etc/fuse.conf
           sudo chmod 644 /etc/fuse.conf
 
-      - name: Repair the fusermount3 setuid bit
-        uses: ./.github/actions/fix-fusermount-setuid
-
       - name: Build SeaweedFS
         run: go build -o weed/weed -buildvcs=false ./weed
 

.github/workflows/go.yml

@@ -75,52 +75,9 @@ jobs:
     - name: Build
       run: cd weed; go build -tags "elastic gocdk sqlite ydb tarantool tikv rclone" -v .
 
-  build-cross:
-    name: Build cross-platform (${{ matrix.goos }}/${{ matrix.goarch }})
-    runs-on: ubuntu-latest
-    strategy:
-      # One target's breakage should not hide the other three.
-      fail-fast: false
-      matrix:
-        include:
-          - { goos: windows, goarch: amd64 }
-          - { goos: windows, goarch: arm64 }
-          - { goos: freebsd, goarch: amd64 }
-          - { goos: darwin, goarch: arm64 }
-    steps:
-    - name: Check out code into the Go module directory
-      uses: actions/checkout@v7
-    - name: Set up Go
-      uses: actions/setup-go@v7
-      with:
-        go-version-file: 'go.mod'
-    # Nothing else on a PR compiles these, so per-OS syscall constants creep
-    # back into shared files unnoticed and only a release build catches it.
-    - name: Cross-compile
-      env:
-        GOOS: ${{ matrix.goos }}
-        GOARCH: ${{ matrix.goarch }}
-      run: |
-        go build ./weed/...
-        # Tests too: they reach for per-OS syscall constants the build does
-        # not, and only compiling them catches an untagged one.
-        go vet ./weed/mount/... ./weed/command/... 2>&1 |
-          grep -v "MessageState contains sync.Mutex" | tee /tmp/vet.txt
-        if grep -q "vet:" /tmp/vet.txt; then exit 1; fi
-
   test:
     name: Test
     runs-on: ubuntu-latest
-    services:
-      redis:
-        image: redis:8
-        ports:
-          - 6379:6379
-        options: >-
-          --health-cmd "redis-cli ping"
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
     steps:
     - name: Check out code into the Go module directory
       uses: actions/checkout@v7
@@ -129,8 +86,6 @@ jobs:
       with:
         go-version-file: 'go.mod'
     - name: Test
-      env:
-        RUN_REDIS_TESTS: "1"
       run: cd weed; go test -tags "elastic gocdk sqlite ydb tarantool tikv rclone" -v ./...
 
   test-32bit:

.github/workflows/java_integration_tests.yml

@@ -34,7 +34,7 @@ jobs:
         id: go
       
       - name: Set up Java
-        uses: actions/setup-java@v6
+        uses: actions/setup-java@v5
         with:
           java-version: ${{ matrix.java }}
           distribution: 'temurin'

.github/workflows/java_release.yml

@@ -73,7 +73,7 @@ jobs:
           echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v6
+        uses: actions/setup-java@v5
         with:
           java-version: '17'
           distribution: 'temurin'

.github/workflows/java_unit_tests.yml

@@ -26,7 +26,7 @@ jobs:
         uses: actions/checkout@v7
       
       - name: Set up Java
-        uses: actions/setup-java@v6
+        uses: actions/setup-java@v5
         with:
           java-version: ${{ matrix.java }}
           distribution: 'temurin'

.github/workflows/kafka-quicktest.yml

@@ -42,7 +42,7 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v7
       with:
-        go-version: ^1.26
+        go-version: ^1.25
         cache: true
         cache-dependency-path: |
           **/go.sum

.github/workflows/kafka-tests.yml

@@ -43,7 +43,7 @@ jobs:
       matrix:
         container-id: [unit-tests-1]
     container:
-      image: golang:1.26-alpine
+      image: golang:1.24-alpine
       options: --cpus 1.0 --memory 1g --hostname kafka-unit-${{ matrix.container-id }}
     env:
       GOMAXPROCS: 1
@@ -53,7 +53,7 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v7
       with:
-        go-version: ^1.26
+        go-version: ^1.25
       id: go
 
     - name: Check out code
@@ -87,7 +87,7 @@ jobs:
       matrix:
         container-id: [integration-1]
     container:
-      image: golang:1.26-alpine
+      image: golang:1.24-alpine
       options: --cpus 2.0 --memory 2g --ulimit nofile=1024:1024 --hostname kafka-integration-${{ matrix.container-id }}
     env:
       GOMAXPROCS: 2
@@ -98,7 +98,7 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v7
       with:
-        go-version: ^1.26
+        go-version: ^1.25
       id: go
 
     - name: Check out code
@@ -134,7 +134,7 @@ jobs:
       matrix:
         container-id: [e2e-1]
     container:
-      image: golang:1.26-alpine
+      image: golang:1.24-alpine
       options: --cpus 2.0 --memory 2g --hostname kafka-e2e-${{ matrix.container-id }}
     env:
       GOMAXPROCS: 2
@@ -148,7 +148,7 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v7
       with:
-        go-version: ^1.26
+        go-version: ^1.25
         cache: true
         cache-dependency-path: |
           **/go.sum
@@ -313,7 +313,7 @@ jobs:
       matrix:
         container-id: [consumer-group-1]
     container:
-      image: golang:1.26-alpine
+      image: golang:1.24-alpine
       options: --cpus 1.0 --memory 2g --ulimit nofile=512:512 --hostname kafka-consumer-${{ matrix.container-id }}
     env:
       GOMAXPROCS: 1
@@ -327,7 +327,7 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v7
       with:
-        go-version: ^1.26
+        go-version: ^1.25
         cache: true
         cache-dependency-path: |
           **/go.sum
@@ -475,7 +475,7 @@ jobs:
       matrix:
         container-id: [client-compat-1]
     container:
-      image: golang:1.26-alpine
+      image: golang:1.24-alpine
       options: --cpus 1.0 --memory 1.5g --shm-size 256m --hostname kafka-client-${{ matrix.container-id }}
     env:
       GOMAXPROCS: 1
@@ -489,7 +489,7 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v7
       with:
-        go-version: ^1.26
+        go-version: ^1.25
         cache: true
         cache-dependency-path: |
           **/go.sum
@@ -633,7 +633,7 @@ jobs:
       matrix:
         container-id: [smq-integration-1]
     container:
-      image: golang:1.26-alpine
+      image: golang:1.24-alpine
       options: --cpus 1.0 --memory 2g --hostname kafka-smq-${{ matrix.container-id }}
     env:
       GOMAXPROCS: 1
@@ -647,7 +647,7 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v7
       with:
-        go-version: ^1.26
+        go-version: ^1.25
         cache: true
         cache-dependency-path: |
           **/go.sum
@@ -794,7 +794,7 @@ jobs:
       matrix:
         container-id: [protocol-1]
     container:
-      image: golang:1.26-alpine
+      image: golang:1.24-alpine
       options: --cpus 1.0 --memory 1g --tmpfs /tmp:exec --hostname kafka-protocol-${{ matrix.container-id }}
     env:
       GOMAXPROCS: 1
@@ -805,7 +805,7 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v7
       with:
-        go-version: ^1.26
+        go-version: ^1.25
       id: go
 
     - name: Check out code

.github/workflows/metadata-subscribe-tests.yml

@@ -8,7 +8,6 @@ on:
       - 'weed/pb/filer_pb/**'
       - 'weed/util/log_buffer/**'
       - 'weed/server/filer_grpc_server_sub_meta.go'
-      - 'weed/server/master_grpc_server.go'
       - 'weed/command/filer_backup.go'
       - 'test/metadata_subscribe/**'
       - '.github/workflows/metadata-subscribe-tests.yml'
@@ -19,7 +18,6 @@ on:
       - 'weed/pb/filer_pb/**'
       - 'weed/util/log_buffer/**'
       - 'weed/server/filer_grpc_server_sub_meta.go'
-      - 'weed/server/master_grpc_server.go'
       - 'weed/command/filer_backup.go'
       - 'test/metadata_subscribe/**'
       - '.github/workflows/metadata-subscribe-tests.yml'

.github/workflows/mount-benchmark.yml

@@ -1,203 +0,0 @@
-name: "mount: benchmark"
-
-# Manual benchmark: native WinFsp mount vs rclone+WebDAV on the same Windows
-# runner, with a Linux FUSE mount of the same build as a reference. Numbers
-# from shared runners are noisy; this is for finding factor-of-N gaps, not
-# regressions of a few percent.
-on:
-  workflow_dispatch:
-  push:
-    branches: [ 'winfsp-bench**' ]
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  bench-windows:
-    name: Windows native vs rclone
-    runs-on: windows-latest
-    timeout-minutes: 60
-    env:
-      CGO_ENABLED: 0
-
-    steps:
-    - uses: actions/checkout@v7
-      with:
-        persist-credentials: false
-
-    - uses: actions/setup-go@v7
-      with:
-        go-version-file: 'go.mod'
-
-    - name: Install WinFsp and rclone
-      run: choco install winfsp rclone -y --no-progress
-
-    - name: Build weed.exe
-      run: go build -o weed.exe ./weed
-
-    - name: Benchmark both mounts
-      shell: pwsh
-      run: |
-        $ErrorActionPreference = 'Stop'
-
-        function Test-Port($port) {
-          $client = New-Object System.Net.Sockets.TcpClient
-          try { $client.Connect('127.0.0.1', $port); return $client.Connected }
-          catch { return $false }
-          finally { $client.Dispose() }
-        }
-
-        function Wait-Drive($drive, $what) {
-          $deadline = (Get-Date).AddMinutes(2)
-          while ((Get-Date) -lt $deadline) {
-            if (Test-Path "${drive}\") { Write-Host "$what is mounted on $drive"; return }
-            Start-Sleep -Seconds 2
-          }
-          throw "$what never appeared on $drive"
-        }
-
-        function Invoke-Bench($dir, $label, $out) {
-          Write-Host "::group::bench $label"
-          & go run ./test/mount_bench -dir $dir -label $label -filer 127.0.0.1:8888 -out $out
-          $code = $LASTEXITCODE
-          Write-Host "::endgroup::"
-          if ($code -ne 0) { throw "bench $label failed with exit $code" }
-        }
-
-        New-Item -ItemType Directory -Force -Path C:\seaweed-data | Out-Null
-        Start-Process -FilePath .\weed.exe `
-          -ArgumentList '-logtostderr','mini','-dir=C:\seaweed-data','-ip=127.0.0.1' `
-          -RedirectStandardOutput C:\seaweed-mini.log -RedirectStandardError C:\seaweed-mini.err.log
-
-        $deadline = (Get-Date).AddMinutes(3)
-        while ((Get-Date) -lt $deadline) {
-          if ((Test-Port 8888) -and (Test-Port 18888) -and (Test-Port 7333)) { break }
-          Start-Sleep -Seconds 3
-        }
-        if (-not ((Test-Port 8888) -and (Test-Port 18888) -and (Test-Port 7333))) {
-          Get-Content C:\seaweed-mini.log, C:\seaweed-mini.err.log -ErrorAction SilentlyContinue
-          throw "mini cluster never came up"
-        }
-        Write-Host "filer on 8888/18888, webdav on 7333"
-
-        # --- native WinFsp mount ---
-        Start-Process -FilePath .\weed.exe `
-          -ArgumentList '-logtostderr','mount','-filer=127.0.0.1:8888','-dir=S:' `
-          -RedirectStandardOutput C:\seaweed-mount.log -RedirectStandardError C:\seaweed-mount.err.log
-        Wait-Drive 'S:' 'weed mount'
-
-        Invoke-Bench 'S:\bench-native' 'winfsp-native' 'C:\results-native.json'
-
-        Get-CimInstance Win32_Process -Filter "Name = 'weed.exe'" |
-          Where-Object { $_.CommandLine -like '*mount*' } |
-          ForEach-Object { Stop-Process -Id $_.ProcessId -Force }
-        $deadline = (Get-Date).AddMinutes(1)
-        while ((Get-Date) -lt $deadline -and (Test-Path S:\)) { Start-Sleep -Seconds 2 }
-
-        # --- rclone + WebDAV on the same WinFsp ---
-        # rclone serves listings from a directory cache it fills lazily, so the
-        # big-listing files have to exist before it mounts or it never sees them.
-        & go run ./test/mount_bench -filer 127.0.0.1:8888 -seed bench-rclone/biglist
-        if ($LASTEXITCODE -ne 0) { throw "seeding failed" }
-
-        $env:RCLONE_CONFIG_SEAWEED_TYPE = 'webdav'
-        $env:RCLONE_CONFIG_SEAWEED_URL = 'http://127.0.0.1:7333'
-        $env:RCLONE_CONFIG_SEAWEED_VENDOR = 'other'
-        Start-Process -FilePath rclone `
-          -ArgumentList 'mount','seaweed:','T:','--vfs-cache-mode=writes','-v','--log-file=C:\rclone.log'
-        Wait-Drive 'T:' 'rclone mount'
-
-        Invoke-Bench 'T:\bench-rclone' 'rclone-webdav' 'C:\results-rclone.json'
-
-        Stop-Process -Name rclone -Force -ErrorAction SilentlyContinue
-
-        # --- comparison ---
-        $table = & go run ./test/mount_bench -compare C:\results-native.json,C:\results-rclone.json
-        $table | Write-Host
-        "## Windows: native WinFsp vs rclone+WebDAV" | Out-File -Append $env:GITHUB_STEP_SUMMARY
-        $table | Out-File -Append $env:GITHUB_STEP_SUMMARY
-
-    - name: Logs
-      if: always()
-      shell: pwsh
-      run: |
-        foreach ($f in 'C:\seaweed-mount.log','C:\seaweed-mount.err.log','C:\rclone.log','C:\seaweed-mini.log','C:\seaweed-mini.err.log') {
-          if (Test-Path $f) { Write-Host "===== $f"; Get-Content $f -Tail 100 }
-        }
-
-    - name: Results
-      if: always()
-      uses: actions/upload-artifact@v7
-      with:
-        name: results-windows
-        path: C:\results-*.json
-        if-no-files-found: ignore
-
-  bench-linux:
-    name: Linux FUSE reference
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-
-    steps:
-    - uses: actions/checkout@v7
-      with:
-        persist-credentials: false
-
-    - uses: actions/setup-go@v7
-      with:
-        go-version-file: 'go.mod'
-
-    - name: Repair the fusermount3 setuid bit
-      uses: ./.github/actions/fix-fusermount-setuid
-
-    - name: Allow non-root FUSE mounts with allow_other
-      run: |
-        echo 'user_allow_other' | sudo tee -a /etc/fuse.conf
-        sudo chmod 644 /etc/fuse.conf
-
-    - name: Build weed
-      run: go build -o /tmp/weed ./weed
-
-    - name: Benchmark FUSE mount
-      run: |
-        set -e
-        mkdir -p /tmp/seaweed-data
-        /tmp/weed -logtostderr mini -dir=/tmp/seaweed-data -ip=127.0.0.1 > /tmp/mini.log 2>&1 &
-
-        for i in $(seq 1 60); do
-          if nc -z 127.0.0.1 8888 && nc -z 127.0.0.1 18888; then break; fi
-          sleep 3
-        done
-        nc -z 127.0.0.1 8888 || { cat /tmp/mini.log; echo "filer never came up"; exit 1; }
-
-        mkdir -p "$HOME/mnt"
-        /tmp/weed -logtostderr mount -filer=127.0.0.1:8888 -dir="$HOME/mnt" > /tmp/mount.log 2>&1 &
-        for i in $(seq 1 60); do
-          if mountpoint -q "$HOME/mnt"; then break; fi
-          sleep 2
-        done
-        mountpoint -q "$HOME/mnt" || { cat /tmp/mount.log; echo "mount never appeared"; exit 1; }
-
-        go run ./test/mount_bench -dir "$HOME/mnt/bench-linux" -label linux-fuse -filer 127.0.0.1:8888 -out /tmp/results-linux.json
-
-        {
-          echo "## Linux FUSE reference"
-          go run ./test/mount_bench -compare /tmp/results-linux.json
-        } >> "$GITHUB_STEP_SUMMARY"
-
-    - name: Logs
-      if: always()
-      run: |
-        tail -n 100 /tmp/mount.log /tmp/mini.log 2>/dev/null || true
-
-    - name: Results
-      if: always()
-      uses: actions/upload-artifact@v7
-      with:
-        name: results-linux
-        path: /tmp/results-linux.json
-        if-no-files-found: ignore

.github/workflows/mount-windows-conformance.yml

@@ -1,124 +0,0 @@
-name: "mount: windows conformance"
-
-on:
-  push:
-    branches: [ master ]
-    paths:
-      - 'weed/mount/**'
-      - 'weed/command/mount*.go'
-      - 'weed/storage/volume_vacuum*.go'
-      - 'weed/storage/volume_loading.go'
-      - 'weed/storage/disk_location.go'
-      - 'test/winfsp-conformance/**'
-      - '.github/workflows/mount-windows-conformance.yml'
-  # No base branch filter: this is the only thing that runs the Windows mount,
-  # so it should cover a pull request stacked on another one too.
-  pull_request:
-    paths:
-      - 'weed/mount/**'
-      - 'weed/command/mount*.go'
-      - 'weed/storage/volume_vacuum*.go'
-      - 'weed/storage/volume_loading.go'
-      - 'weed/storage/disk_location.go'
-      - 'test/winfsp-conformance/**'
-      - '.github/workflows/mount-windows-conformance.yml'
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  conformance:
-    name: WinFsp conformance
-    runs-on: windows-latest
-    timeout-minutes: 60
-    env:
-      # The runner ships MinGW, so cgo is on by default and cgofuse picks its
-      # cgo variant, which wants WinFsp's headers. The nocgo variant loads
-      # winfsp-x64.dll at run time instead, which is how weed.exe is released.
-      CGO_ENABLED: 0
-
-    steps:
-    - uses: actions/checkout@v7
-      with:
-        persist-credentials: false
-
-    - uses: actions/setup-go@v7
-      with:
-        go-version-file: 'go.mod'
-
-    # cgofuse loads winfsp-x64.dll at run time, so WinFsp is needed here but
-    # not to build.
-    - name: Install WinFsp
-      run: choco install winfsp -y --no-progress
-
-    - name: Build weed.exe
-      run: go build -o weed.exe ./weed
-
-    # The runner tears down a step's process tree when its shell exits, so a
-    # cluster started in one step is gone by the next. Everything that needs
-    # the cluster and the mount alive has to share a step.
-    - name: Mount and run winfsp-tests
-      shell: pwsh
-      run: |
-        $ErrorActionPreference = 'Stop'
-
-        function Test-Port($port) {
-          # A plain connect, because Test-NetConnection has reported success
-          # here for a port nothing was listening on.
-          $client = New-Object System.Net.Sockets.TcpClient
-          try { $client.Connect('127.0.0.1', $port); return $client.Connected }
-          catch { return $false }
-          finally { $client.Dispose() }
-        }
-
-        function Start-Mount($log) {
-          Start-Process -FilePath .\weed.exe `
-            -ArgumentList '-logtostderr','mount','-filer=127.0.0.1:8888','-dir=S:' `
-            -RedirectStandardOutput "C:\$log.log" -RedirectStandardError "C:\$log.err.log"
-          $deadline = (Get-Date).AddMinutes(2)
-          while ((Get-Date) -lt $deadline) {
-            if (Test-Path S:\) { Write-Host "S: is mounted"; return }
-            Start-Sleep -Seconds 2
-          }
-          Get-Content "C:\$log.log", "C:\$log.err.log" -ErrorAction SilentlyContinue
-          throw "S: never appeared"
-        }
-
-        New-Item -ItemType Directory -Force -Path C:\seaweed-data | Out-Null
-        # -ip pins the cluster to loopback; it otherwise advertises and binds
-        # the runner's LAN address, which 127.0.0.1 cannot reach.
-        Start-Process -FilePath .\weed.exe `
-          -ArgumentList '-logtostderr','mini','-dir=C:\seaweed-data','-ip=127.0.0.1' `
-          -RedirectStandardOutput C:\seaweed-mini.log -RedirectStandardError C:\seaweed-mini.err.log
-
-        $deadline = (Get-Date).AddMinutes(3)
-        while ((Get-Date) -lt $deadline) {
-          # The mount dials grpc, not http, so both ports have to answer.
-          if ((Test-Port 8888) -and (Test-Port 18888)) { break }
-          Start-Sleep -Seconds 3
-        }
-        if (-not ((Test-Port 8888) -and (Test-Port 18888))) {
-          Get-Content C:\seaweed-mini.log, C:\seaweed-mini.err.log -ErrorAction SilentlyContinue
-          throw "filer never came up"
-        }
-        Write-Host "filer is up on http 8888 and grpc 18888"
-
-        Start-Mount 'seaweed-mount'
-
-        Write-Host "::group::winfsp-tests"
-        & pwsh -File test/winfsp-conformance/run.ps1 -MountPoint S:\
-        $code = $LASTEXITCODE
-        Write-Host "::endgroup::"
-        if ($code -ne 0) { throw "winfsp-tests failed with exit $code" }
-
-    - name: Logs
-      if: always()
-      shell: pwsh
-      run: |
-        foreach ($f in 'C:\seaweed-mount.log','C:\seaweed-mount.err.log','C:\seaweed-mini.log','C:\seaweed-mini.err.log') {
-          if (Test-Path $f) { Write-Host "===== $f"; Get-Content $f -Tail 200 }
-        }

.github/workflows/mount-windows.yml

@@ -1,194 +0,0 @@
-name: "mount: windows"
-
-on:
-  push:
-    branches: [ master ]
-    paths:
-      - 'weed/mount/**'
-      - 'weed/command/mount*.go'
-      - 'weed/storage/volume_vacuum*.go'
-      - 'weed/storage/volume_loading.go'
-      - 'weed/storage/disk_location.go'
-      - 'test/winfsp/**'
-      - '.github/workflows/mount-windows.yml'
-  # No base branch filter: this is the only thing that runs the Windows mount,
-  # so it should cover a pull request stacked on another one too.
-  pull_request:
-    paths:
-      - 'weed/mount/**'
-      - 'weed/command/mount*.go'
-      - 'weed/storage/volume_vacuum*.go'
-      - 'weed/storage/volume_loading.go'
-      - 'weed/storage/disk_location.go'
-      - 'test/winfsp/**'
-      - '.github/workflows/mount-windows.yml'
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  mount-windows:
-    name: Mount on Windows
-    runs-on: windows-latest
-    timeout-minutes: 40
-    env:
-      # The runner ships MinGW, so cgo is on by default and cgofuse picks its
-      # cgo variant, which wants WinFsp's headers. The nocgo variant loads
-      # winfsp-x64.dll at run time instead, which is how weed.exe is released.
-      CGO_ENABLED: 0
-
-    steps:
-    - uses: actions/checkout@v7
-      with:
-        persist-credentials: false
-
-    - uses: actions/setup-go@v7
-      with:
-        go-version-file: 'go.mod'
-
-    # cgofuse loads winfsp-x64.dll at run time, so WinFsp is needed here but
-    # not to build.
-    - name: Install WinFsp
-      run: choco install winfsp -y --no-progress
-
-    - name: Build weed.exe
-      run: go build -o weed.exe ./weed
-
-    # The runner tears down a step's process tree when its shell exits, so a
-    # cluster started in one step is gone by the next. Everything that needs
-    # the cluster and the mount alive has to share a step.
-    - name: Mount and exercise
-      shell: pwsh
-      run: |
-        $ErrorActionPreference = 'Stop'
-
-        function Test-Port($port) {
-          # A plain connect, because Test-NetConnection has reported success
-          # here for a port nothing was listening on.
-          $client = New-Object System.Net.Sockets.TcpClient
-          try { $client.Connect('127.0.0.1', $port); return $client.Connected }
-          catch { return $false }
-          finally { $client.Dispose() }
-        }
-
-        function Start-Mount($log) {
-          Start-Process -FilePath .\weed.exe `
-            -ArgumentList '-logtostderr','mount','-filer=127.0.0.1:8888','-dir=S:' `
-            -RedirectStandardOutput "C:\$log.log" -RedirectStandardError "C:\$log.err.log"
-          $deadline = (Get-Date).AddMinutes(2)
-          while ((Get-Date) -lt $deadline) {
-            if (Test-Path S:\) { Write-Host "S: is mounted"; return }
-            Start-Sleep -Seconds 2
-          }
-          Get-Content "C:\$log.log", "C:\$log.err.log" -ErrorAction SilentlyContinue
-          throw "S: never appeared"
-        }
-
-        function Stop-Mount {
-          Get-CimInstance Win32_Process -Filter "Name = 'weed.exe'" |
-            Where-Object { $_.CommandLine -like '*mount*' } |
-            ForEach-Object { Stop-Process -Id $_.ProcessId -Force }
-          $deadline = (Get-Date).AddMinutes(1)
-          while ((Get-Date) -lt $deadline -and (Test-Path S:\)) { Start-Sleep -Seconds 2 }
-          if (Test-Path S:\) { throw "S: still present after stopping the mount" }
-          Write-Host "unmounted"
-        }
-
-        function Invoke-Tests($label, [string[]]$goArgs) {
-          Write-Host "::group::$label"
-          & go @goArgs
-          $code = $LASTEXITCODE
-          Write-Host "::endgroup::"
-          if ($code -ne 0) { throw "$label failed with exit $code" }
-        }
-
-        New-Item -ItemType Directory -Force -Path C:\seaweed-data | Out-Null
-        # -ip pins the cluster to loopback; it otherwise advertises and binds
-        # the runner's LAN address, which 127.0.0.1 cannot reach.
-        Start-Process -FilePath .\weed.exe `
-          -ArgumentList '-logtostderr','mini','-dir=C:\seaweed-data','-ip=127.0.0.1' `
-          -RedirectStandardOutput C:\seaweed-mini.log -RedirectStandardError C:\seaweed-mini.err.log
-
-        $deadline = (Get-Date).AddMinutes(3)
-        while ((Get-Date) -lt $deadline) {
-          # The mount dials grpc, not http, so both ports have to answer.
-          if ((Test-Port 8888) -and (Test-Port 18888)) { break }
-          Start-Sleep -Seconds 3
-        }
-        if (-not ((Test-Port 8888) -and (Test-Port 18888))) {
-          Get-Content C:\seaweed-mini.log, C:\seaweed-mini.err.log -ErrorAction SilentlyContinue
-          throw "filer never came up"
-        }
-        Write-Host "filer is up on http 8888 and grpc 18888"
-
-        Start-Mount 'seaweed-mount'
-
-        Invoke-Tests 'exercise' @('test','-v','-timeout','20m','./test/winfsp','-mountpoint=S:\')
-        Invoke-Tests 'persist-write' @('test','-v','-timeout','15m','./test/winfsp','-run','TestPersistence','-mountpoint=S:\','-phase=write','-filer=127.0.0.1:8888')
-
-        Stop-Mount
-        Start-Mount 'seaweed-remount'
-
-        Invoke-Tests 'persist-verify' @('test','-v','-timeout','15m','./test/winfsp','-run','TestPersistence','-mountpoint=S:\','-phase=verify')
-
-        # WinFsp creates the mount directory itself, so the path must not
-        # exist; only its parent has to.
-        Write-Host "::group::mount over a directory"
-        Stop-Mount
-        Remove-Item C:\seaweed-mnt -Recurse -Force -ErrorAction SilentlyContinue
-        Start-Process -FilePath .\weed.exe `
-          -ArgumentList '-logtostderr','mount','-filer=127.0.0.1:8888','-dir=C:\seaweed-mnt' `
-          -RedirectStandardOutput C:\seaweed-dirmount.log -RedirectStandardError C:\seaweed-dirmount.err.log
-        $deadline = (Get-Date).AddMinutes(2)
-        $ok = $false
-        while ((Get-Date) -lt $deadline) {
-          # Listing succeeds on the plain empty directory too, so wait for the
-          # reparse point WinFsp turns it into. Otherwise this step passes
-          # without a mount and writes to local disk.
-          $item = Get-Item C:\seaweed-mnt -Force -ErrorAction SilentlyContinue
-          if ($null -ne $item -and $item.Attributes.ToString() -like '*ReparsePoint*') { $ok = $true; break }
-          Start-Sleep -Seconds 2
-        }
-        if (-not $ok) {
-          Get-Content C:\seaweed-dirmount.log, C:\seaweed-dirmount.err.log -ErrorAction SilentlyContinue
-          throw "mounting over a directory failed"
-        }
-        Set-Content -Path C:\seaweed-mnt\dirmount.txt -Value 'via directory mount'
-        if ((Get-Content C:\seaweed-mnt\dirmount.txt) -ne 'via directory mount') { throw "readback through the directory mount differs" }
-        Remove-Item C:\seaweed-mnt\dirmount.txt -Force
-        Get-CimInstance Win32_Process -Filter "Name = 'weed.exe'" |
-          Where-Object { $_.CommandLine -like '*mount*' } |
-          ForEach-Object { Stop-Process -Id $_.ProcessId -Force }
-        Start-Sleep -Seconds 5
-        Write-Host "::endgroup::"
-
-        Start-Mount 'seaweed-remount2'
-
-        Write-Host "::group::explorer-style walk"
-        New-Item -ItemType Directory -Force -Path S:\walk | Out-Null
-        1..200 | ForEach-Object { Set-Content -Path "S:\walk\f$_.txt" -Value "line $_" }
-        $names = @(Get-ChildItem S:\walk | ForEach-Object { $_.Name })
-        if ($names.Count -ne 200) {
-          # Name the strays: a dot entry surfacing here is a different problem
-          # from a missing or duplicated file.
-          $unexpected = $names | Where-Object { $_ -notmatch '^f\d+\.txt$' }
-          throw "listed $($names.Count) entries, expected 200; unexpected: $($unexpected -join ', ')"
-        }
-        $body = Get-Content S:\walk\f42.txt
-        if ($body -ne 'line 42') { throw "unexpected content: $body" }
-        Copy-Item S:\walk\f42.txt S:\walk\copy.txt
-        Remove-Item S:\walk -Recurse -Force
-        if (Test-Path S:\walk) { throw "directory survived recursive delete" }
-        Write-Host "::endgroup::"
-
-    - name: Logs
-      if: always()
-      shell: pwsh
-      run: |
-        foreach ($f in 'C:\seaweed-mount.log','C:\seaweed-mount.err.log','C:\seaweed-remount.log','C:\seaweed-remount.err.log','C:\seaweed-remount2.log','C:\seaweed-remount2.err.log','C:\seaweed-dirmount.log','C:\seaweed-dirmount.err.log','C:\seaweed-mini.log','C:\seaweed-mini.err.log') {
-          if (Test-Path $f) { Write-Host "===== $f"; Get-Content $f -Tail 200 }
-        }

.github/workflows/performance.yml

@@ -175,6 +175,10 @@ jobs:
         with:
           go-version-file: 'go.mod'
 
+      - name: Install protobuf compiler
+        if: matrix.impl == 'rust'
+        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
+
       - name: Install Rust toolchain
         if: matrix.impl == 'rust'
         uses: dtolnay/rust-toolchain@stable
@@ -327,6 +331,10 @@ jobs:
         with:
           go-version-file: 'go.mod'
 
+      - name: Install protobuf compiler
+        if: matrix.impl == 'rust'
+        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
+
       - name: Install Rust toolchain
         if: matrix.impl == 'rust'
         uses: dtolnay/rust-toolchain@stable

.github/workflows/postgres-tests.yml

@@ -41,7 +41,7 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v7
       with:
-        go-version: ^1.26
+        go-version: ^1.25
       id: go
 
     - name: Check out code

.github/workflows/release_version_bump.yml

@@ -1,17 +1,4 @@
-name: "release: bump version and cut the release"
-
-# One entry point for a SeaweedFS release:
-#   1. bump MAJOR/MINOR in constants.go and the Helm Chart.yaml, commit to master
-#   2. push the <appVersion> tag, which fans out to the workflows that trigger on
-#      `push: tags` (binaries_release*, container_release_unified, helm_manual_release)
-#   3. create the GitHub release, with GitHub's generated notes
-#   4. dispatch "Prepare release" in seaweedfs-csi-driver and seaweedfs-operator,
-#      which pick up the new master through `go get -u`, and wait for both
-#
-# Events raised by the default GITHUB_TOKEN do not start other workflows, and it
-# cannot reach the other two repositories at all. Add a repo secret RELEASE_PAT
-# with `contents: write` here and `actions: write` on the csi-driver and operator
-# repos. Without it the tag is still pushed, but nothing downstream of it runs.
+name: "release: bump version"
 
 on:
   workflow_dispatch:
@@ -27,37 +14,15 @@ on:
         description: "Explicit MAJOR.MINOR to set, e.g. 4.36 (overrides 'bump')"
         type: string
         required: false
-      downstream:
-        description: "Also release the CSI driver and the operator"
-        type: boolean
-        default: true
-      dry_run:
-        description: "Show the version bump, but change nothing"
-        type: boolean
-        default: false
+
+permissions:
+  contents: write
 
 jobs:
-  release:
+  bump-version:
     runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    outputs:
-      app_version: ${{ steps.compute.outputs.app_version }}
-      sha: ${{ steps.tag.outputs.sha }}
     steps:
       - uses: actions/checkout@v7
-        with:
-          ref: master
-          fetch-depth: 0
-          token: ${{ secrets.RELEASE_PAT || secrets.GITHUB_TOKEN }}
-
-      - name: Check the release token
-        env:
-          HAS_PAT: ${{ secrets.RELEASE_PAT != '' }}
-        run: |
-          if [ "$HAS_PAT" != "true" ]; then
-            echo "::warning::RELEASE_PAT is not set. The tag will be pushed with GITHUB_TOKEN, so the binary, container and helm workflows will not start on their own."
-          fi
 
       - name: Compute new version
         id: compute
@@ -134,103 +99,17 @@ jobs:
           sed -i -E "s/^version:.*/version: ${CHART_VERSION}/" "$CHART"
           cat "$CHART"
 
-      - name: Commit, and push the tag
-        id: tag
+      - name: Commit and push
         env:
-          TAG: ${{ steps.compute.outputs.app_version }}
-          DRY_RUN: ${{ inputs.dry_run }}
+          APP_VERSION: ${{ steps.compute.outputs.app_version }}
         run: |
           set -euo pipefail
-          if git ls-remote --exit-code --tags origin "refs/tags/${TAG}" >/dev/null 2>&1; then
-            echo "::error::Tag ${TAG} already exists."
-            exit 1
-          fi
-          if [ "$DRY_RUN" = "true" ]; then
-            git --no-pager diff --stat
-            echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+          if git diff --quiet; then
+            echo "No version change to commit."
             exit 0
           fi
-
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          if git diff --quiet; then
-            echo "::warning::Version files are already at ${TAG}; tagging the current HEAD."
-          else
-            git add weed/util/version/constants.go k8s/charts/seaweedfs/Chart.yaml
-            git commit -m "${TAG}"
-            git push
-          fi
-
-          # Push the tag with git so the `push: tags` triggers fire. Creating the
-          # tag through the release API alone would only emit a `create` event.
-          git tag "$TAG"
-          git push origin "$TAG"
-          echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
-
-      - name: Create the release
-        if: ${{ !inputs.dry_run }}
-        env:
-          GH_TOKEN: ${{ secrets.RELEASE_PAT || secrets.GITHUB_TOKEN }}
-          TAG: ${{ steps.compute.outputs.app_version }}
-        run: gh release create "$TAG" --title "$TAG" --generate-notes --verify-tag
-
-  downstream:
-    needs: release
-    if: ${{ inputs.downstream && !inputs.dry_run }}
-    runs-on: ubuntu-latest
-    permissions: {}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - repo: seaweedfs/seaweedfs-csi-driver
-            workflow: prepare_release.yaml
-          - repo: seaweedfs/seaweedfs-operator
-            workflow: prepare_release.yml
-    steps:
-      - name: Release ${{ matrix.repo }}
-        env:
-          GH_TOKEN: ${{ secrets.RELEASE_PAT }}
-          REPO: ${{ matrix.repo }}
-          WORKFLOW: ${{ matrix.workflow }}
-          SHA: ${{ needs.release.outputs.sha }}
-          MODULE: github.com/seaweedfs/seaweedfs
-        run: |
-          set -euo pipefail
-          if [ -z "${GH_TOKEN}" ]; then
-            echo "::error::RELEASE_PAT with actions:write on ${REPO} is required to release it"
-            exit 1
-          fi
-
-          # The dispatched workflow pins seaweedfs with `go get -u ...@latest`, so
-          # wait until the proxy serves the release commit as the tip. Asking for
-          # the commit by name is what makes the proxy fetch it.
-          for _ in $(seq 30); do
-            curl -sf "https://proxy.golang.org/${MODULE}/@v/${SHA}.info" >/dev/null || true
-            TIP=$(curl -sf "https://proxy.golang.org/${MODULE}/@latest" | jq -r '.Origin.Hash // ""' || true)
-            [ "$TIP" = "$SHA" ] && break
-            sleep 10
-          done
-          if [ "$TIP" != "$SHA" ]; then
-            echo "::error::the module proxy still serves ${TIP} as the tip, so ${REPO} would pin a pre-release commit. Run ${WORKFLOW} there once it catches up."
-            exit 1
-          fi
-
-          # Wait on the release the dispatched workflow publishes, not on the run
-          # that publishes it: a dispatch cannot be told apart from a concurrent
-          # one through the API, and the release is what we are here for.
-          released() { gh api "repos/${REPO}/releases?per_page=30" --jq '[.[].tag_name]'; }
-
-          BEFORE=$(released)
-          gh workflow run -R "$REPO" "$WORKFLOW" --ref master -f bump=patch -f update_seaweedfs=true
-
-          for _ in $(seq 80); do
-            sleep 15
-            NEW=$(released | jq -c --argjson before "$BEFORE" '. - $before')
-            [ "$(jq length <<<"$NEW")" -gt 0 ] && break
-          done
-          if [ "$(jq length <<<"$NEW")" -eq 0 ]; then
-            echo "::error::${REPO} published no release within 20 minutes; see https://github.com/${REPO}/actions/workflows/${WORKFLOW}"
-            exit 1
-          fi
-          echo "${REPO} released $(jq -r 'join(", ")' <<<"$NEW")"
+          git add weed/util/version/constants.go k8s/charts/seaweedfs/Chart.yaml
+          git commit -m "${APP_VERSION}"
+          git push

.github/workflows/rust-volume-server-tests.yml

@@ -36,15 +36,12 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v7
 
+      - name: Install protobuf compiler
+        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
+
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
 
-      # cargo tracks its own inputs but not the runner's C toolchain, so a cached
-      # target/ can carry C objects built against a different glibc than we link against.
-      - name: Fingerprint build toolchain
-        id: toolchain
-        run: echo "fingerprint=$(getconf GNU_LIBC_VERSION | tr ' ' '-')-rustc-$(rustc -V | awk '{print $2}')" >> "$GITHUB_OUTPUT"
-
       - name: Cache cargo registry and target
         uses: actions/cache@v6
         with:
@@ -52,9 +49,9 @@ jobs:
             ~/.cargo/registry
             ~/.cargo/git
             seaweed-volume/target
-          key: rust-${{ steps.toolchain.outputs.fingerprint }}-${{ hashFiles('seaweed-volume/Cargo.lock') }}
+          key: rust-${{ hashFiles('seaweed-volume/Cargo.lock') }}
           restore-keys: |
-            rust-${{ steps.toolchain.outputs.fingerprint }}-
+            rust-
 
       - name: Build Rust volume server
         run: cd seaweed-volume && cargo build --release
@@ -76,15 +73,12 @@ jobs:
         with:
           go-version-file: 'go.mod'
 
+      - name: Install protobuf compiler
+        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
+
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
 
-      # cargo tracks its own inputs but not the runner's C toolchain, so a cached
-      # target/ can carry C objects built against a different glibc than we link against.
-      - name: Fingerprint build toolchain
-        id: toolchain
-        run: echo "fingerprint=$(getconf GNU_LIBC_VERSION | tr ' ' '-')-rustc-$(rustc -V | awk '{print $2}')" >> "$GITHUB_OUTPUT"
-
       - name: Cache cargo registry and target
         uses: actions/cache@v6
         with:
@@ -92,9 +86,9 @@ jobs:
             ~/.cargo/registry
             ~/.cargo/git
             seaweed-volume/target
-          key: rust-${{ steps.toolchain.outputs.fingerprint }}-${{ hashFiles('seaweed-volume/Cargo.lock') }}
+          key: rust-${{ hashFiles('seaweed-volume/Cargo.lock') }}
           restore-keys: |
-            rust-${{ steps.toolchain.outputs.fingerprint }}-
+            rust-
 
       - name: Build Go weed binary
         run: |
@@ -140,9 +134,6 @@ jobs:
     name: Go Tests with Rust Volume (${{ matrix.test-type }} - Shard ${{ matrix.shard }})
     runs-on: ubuntu-22.04
     timeout-minutes: 45
-    env:
-      # Keep in step with the length of matrix.shard below.
-      SHARD_COUNT: 3
     strategy:
       fail-fast: false
       matrix:
@@ -158,15 +149,12 @@ jobs:
         with:
           go-version-file: 'go.mod'
 
+      - name: Install protobuf compiler
+        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
+
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
 
-      # cargo tracks its own inputs but not the runner's C toolchain, so a cached
-      # target/ can carry C objects built against a different glibc than we link against.
-      - name: Fingerprint build toolchain
-        id: toolchain
-        run: echo "fingerprint=$(getconf GNU_LIBC_VERSION | tr ' ' '-')-rustc-$(rustc -V | awk '{print $2}')" >> "$GITHUB_OUTPUT"
-
       - name: Cache cargo registry and target
         uses: actions/cache@v6
         with:
@@ -174,9 +162,9 @@ jobs:
             ~/.cargo/registry
             ~/.cargo/git
             seaweed-volume/target
-          key: rust-${{ steps.toolchain.outputs.fingerprint }}-${{ hashFiles('seaweed-volume/Cargo.lock') }}
+          key: rust-${{ hashFiles('seaweed-volume/Cargo.lock') }}
           restore-keys: |
-            rust-${{ steps.toolchain.outputs.fingerprint }}-
+            rust-
 
       - name: Build Go weed binary
         run: |
@@ -188,28 +176,30 @@ jobs:
       - name: Build Rust volume binary
         run: cd seaweed-volume && cargo build --release
 
-      # Dealing the listed tests out one by one keeps the shards even. Bucketing
-      # them by first letter did not: names cluster, so ^Test[I-S] drew 50 of
-      # the 114 grpc tests and ran nearly twice as long as the other two shards.
-      - name: Select this shard's tests
-        env:
-          TEST_TYPE: ${{ matrix.test-type }}
-          SHARD: ${{ matrix.shard }}
-        run: |
-          tests=$(go test -tags 5BytesOffset ./test/volume_server/"$TEST_TYPE"/... -list '.*' | grep '^Test' | sort -u)
-          # An empty list would make -run match nothing and the shard pass vacuously.
-          [ -n "$tests" ] || { echo "listed no tests in test/volume_server/$TEST_TYPE"; exit 1; }
-          selected=$(echo "$tests" | awk -v n="$SHARD_COUNT" -v i="$SHARD" 'NR % n == i - 1')
-          echo "shard $SHARD of $SHARD_COUNT runs $(echo "$selected" | wc -l) of $(echo "$tests" | wc -l) tests"
-          echo "TEST_PATTERN=^($(echo "$selected" | paste -sd'|' -))\$" >> "$GITHUB_ENV"
-
       - name: Run volume server integration tests with Rust volume
         env:
           WEED_BINARY: ${{ github.workspace }}/weed/weed
           RUST_VOLUME_BINARY: ${{ github.workspace }}/seaweed-volume/target/release/weed-volume
           VOLUME_SERVER_IMPL: rust
         run: |
-          echo "Running Go volume server tests with Rust volume for ${{ matrix.test-type }} (Shard ${{ matrix.shard }} of ${SHARD_COUNT})..."
+          if [ "${{ matrix.test-type }}" == "grpc" ]; then
+            if [ "${{ matrix.shard }}" == "1" ]; then
+              TEST_PATTERN="^Test[A-H]"
+            elif [ "${{ matrix.shard }}" == "2" ]; then
+              TEST_PATTERN="^Test[I-S]"
+            else
+              TEST_PATTERN="^Test[T-Z]"
+            fi
+          else
+            if [ "${{ matrix.shard }}" == "1" ]; then
+              TEST_PATTERN="^Test[A-G]"
+            elif [ "${{ matrix.shard }}" == "2" ]; then
+              TEST_PATTERN="^Test[H-R]"
+            else
+              TEST_PATTERN="^Test[S-Z]"
+            fi
+          fi
+          echo "Running Go volume server tests with Rust volume for ${{ matrix.test-type }} (Shard ${{ matrix.shard }}, pattern: ${TEST_PATTERN})..."
           go test -v -count=1 -tags 5BytesOffset -timeout=30m ./test/volume_server/${{ matrix.test-type }}/... -run "${TEST_PATTERN}"
 
       - name: Collect logs on failure
@@ -230,6 +220,23 @@ jobs:
       - name: Test summary
         if: always()
         run: |
+          if [ "${{ matrix.test-type }}" == "grpc" ]; then
+            if [ "${{ matrix.shard }}" == "1" ]; then
+              TEST_PATTERN="^Test[A-H]"
+            elif [ "${{ matrix.shard }}" == "2" ]; then
+              TEST_PATTERN="^Test[I-S]"
+            else
+              TEST_PATTERN="^Test[T-Z]"
+            fi
+          else
+            if [ "${{ matrix.shard }}" == "1" ]; then
+              TEST_PATTERN="^Test[A-G]"
+            elif [ "${{ matrix.shard }}" == "2" ]; then
+              TEST_PATTERN="^Test[H-R]"
+            else
+              TEST_PATTERN="^Test[S-Z]"
+            fi
+          fi
           echo "## Rust Volume - Go Test Summary (${{ matrix.test-type }} - Shard ${{ matrix.shard }})" >> "$GITHUB_STEP_SUMMARY"
-          echo "- Suite: test/volume_server/${{ matrix.test-type }} (shard ${{ matrix.shard }} of ${SHARD_COUNT}, see 'Select this shard's tests' for the split)" >> "$GITHUB_STEP_SUMMARY"
+          echo "- Suite: test/volume_server/${{ matrix.test-type }} (Pattern: ${TEST_PATTERN})" >> "$GITHUB_STEP_SUMMARY"
           echo "- Volume server: Rust (VOLUME_SERVER_IMPL=rust)" >> "$GITHUB_STEP_SUMMARY"

.github/workflows/rust-worker-tests.yml

@@ -1,82 +0,0 @@
-name: "Rust Plugin Worker Tests"
-
-on:
-  pull_request:
-    branches: [ master ]
-    paths:
-      - 'seaweed-worker/**'
-      - 'weed/pb/plugin.proto'
-      - '.github/workflows/rust-worker-tests.yml'
-  push:
-    branches: [ master, main ]
-    paths:
-      - 'seaweed-worker/**'
-      - 'weed/pb/plugin.proto'
-      - '.github/workflows/rust-worker-tests.yml'
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  rust-worker-build:
-    name: Rust Plugin Worker Build and Unit Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 45
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-
-      # cargo tracks its own inputs but not the runner's C toolchain, so a cached
-      # target/ can carry C objects built against a different glibc than we link against.
-      - name: Fingerprint build toolchain
-        id: toolchain
-        run: echo "fingerprint=$(getconf GNU_LIBC_VERSION | tr ' ' '-')-rustc-$(rustc -V | awk '{print $2}')" >> "$GITHUB_OUTPUT"
-
-      - name: Cache cargo registry and target
-        uses: actions/cache@v6
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            seaweed-worker/target/release
-          key: rust-worker-${{ steps.toolchain.outputs.fingerprint }}-${{ hashFiles('seaweed-worker/Cargo.lock') }}
-          restore-keys: |
-            rust-worker-${{ steps.toolchain.outputs.fingerprint }}-
-
-      # lance's build scripts compile their own protos and look for a protoc.
-      # Point them at the one protoc-bin-vendored ships, which seaweed-worker's
-      # own build already uses, so no job depends on a system package and every
-      # build sees the same version.
-      - name: Use the vendored protoc
-        run: |
-          cd seaweed-worker
-          cargo fetch
-          # The version from the lock, not whatever else a restored cache holds.
-          version=$(awk '/^name = "protoc-bin-vendored-linux-x86_64"$/{found=1; next} found && /^version = /{gsub(/"/,"",$3); print $3; exit}' Cargo.lock)
-          test -n "$version" || { echo "protoc-bin-vendored-linux-x86_64 is not in Cargo.lock" >&2; exit 1; }
-          protoc=$(find ~/.cargo/registry/src -path "*protoc-bin-vendored-linux-x86_64-$version/bin/protoc" | head -1)
-          test -x "$protoc" || { echo "no vendored protoc $version in the registry" >&2; exit 1; }
-          echo "PROTOC=$protoc" >> "$GITHUB_ENV"
-
-      # The release profile is what ships, and it is where the release and the
-      # container builds would otherwise discover a break for the first time.
-      - name: Build the plugin workers
-        run: cd seaweed-worker && cargo build --release
-
-      # The tests that need a live gateway skip themselves without one, the way
-      # the Go integration tests skip without Docker; the lifecycle suite in
-      # test/s3tables/lifecycle is what runs them against a real cluster.
-      # Release, so this reuses the build above rather than compiling lance,
-      # arrow and datafusion a second time in another profile.
-      - name: Run unit tests
-        run: cd seaweed-worker && cargo test --release --workspace

.github/workflows/rust_binaries_dev.yml

@@ -41,6 +41,9 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
+      - name: Install protobuf compiler
+        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
+
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
 
@@ -107,6 +110,9 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
+      - name: Install protobuf compiler
+        run: brew install protobuf
+
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
         with:

.github/workflows/rust_binaries_release.yml

@@ -1,4 +1,4 @@
-name: "rust: build versioned binaries"
+name: "rust: build versioned volume server binaries"
 
 on:
   push:
@@ -28,6 +28,9 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
+      - name: Install protobuf compiler
+        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
+
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
         with:
@@ -113,102 +116,6 @@ jobs:
             weed-volume_${{ matrix.asset_suffix }}.tar.gz
             weed-volume_${{ matrix.asset_suffix }}.tar.gz.md5
 
-  # The Rust maintenance worker: Linux only, because it runs beside the cluster
-  # it maintains rather than on a laptop, and its dependency tree (lance, arrow,
-  # datafusion) makes every extra target an expensive build.
-  build-rust-worker-linux:
-    permissions:
-      contents: write
-    runs-on: ubuntu-22.04
-    strategy:
-      matrix:
-        include:
-          - target: x86_64-unknown-linux-gnu
-            asset_suffix: linux_amd64
-          - target: aarch64-unknown-linux-gnu
-            asset_suffix: linux_arm64
-            cross: true
-
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          # The upload step is handed a token explicitly; a cargo build script
-          # should not find another one sitting in the checkout's git config.
-          persist-credentials: false
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: ${{ matrix.target }}
-
-      - name: Install cross-compilation tools
-        if: matrix.cross
-        run: |
-          sudo dpkg --add-architecture arm64
-          sudo sed -i 's/^deb /deb [arch=amd64] /' /etc/apt/sources.list
-          echo "deb [arch=arm64] http://ports.ubuntu.com/ jammy main restricted universe multiverse" | sudo tee /etc/apt/sources.list.d/arm64.list
-          echo "deb [arch=arm64] http://ports.ubuntu.com/ jammy-updates main restricted universe multiverse" | sudo tee -a /etc/apt/sources.list.d/arm64.list
-          sudo apt-get update
-          sudo apt-get install -y gcc-aarch64-linux-gnu
-          echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc" >> "$GITHUB_ENV"
-
-      - name: Cache cargo registry and target
-        uses: actions/cache@v6
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            seaweed-worker/target/${{ matrix.target }}/release
-          key: rust-worker-release-${{ matrix.target }}-${{ hashFiles('seaweed-worker/Cargo.lock') }}
-          restore-keys: |
-            rust-worker-release-${{ matrix.target }}-
-
-      # lance's build scripts compile their own protos and look for a protoc.
-      # Point them at the one protoc-bin-vendored ships, which seaweed-worker's
-      # own build already uses, so no job depends on a system package and every
-      # build sees the same version.
-      - name: Use the vendored protoc
-        run: |
-          cd seaweed-worker
-          cargo fetch
-          # The version from the lock, not whatever else a restored cache holds.
-          version=$(awk '/^name = "protoc-bin-vendored-linux-x86_64"$/{found=1; next} found && /^version = /{gsub(/"/,"",$3); print $3; exit}' Cargo.lock)
-          test -n "$version" || { echo "protoc-bin-vendored-linux-x86_64 is not in Cargo.lock" >&2; exit 1; }
-          protoc=$(find ~/.cargo/registry/src -path "*protoc-bin-vendored-linux-x86_64-$version/bin/protoc" | head -1)
-          test -x "$protoc" || { echo "no vendored protoc $version in the registry" >&2; exit 1; }
-          echo "PROTOC=$protoc" >> "$GITHUB_ENV"
-
-      - name: Build the Rust maintenance worker
-        run: |
-          cd seaweed-worker
-          cargo build --release -p weed-lance-worker --target ${{ matrix.target }}
-
-      - name: Package binary
-        run: |
-          cp seaweed-worker/target/${{ matrix.target }}/release/weed-worker weed-worker
-          tar czf weed-worker_${{ matrix.asset_suffix }}.tar.gz weed-worker
-          rm weed-worker
-          md5sum weed-worker_${{ matrix.asset_suffix }}.tar.gz > weed-worker_${{ matrix.asset_suffix }}.tar.gz.md5
-
-      - name: Upload release assets
-        if: startsWith(github.ref, 'refs/tags/')
-        uses: softprops/action-gh-release@v3
-        with:
-          files: |
-            weed-worker_${{ matrix.asset_suffix }}.tar.gz
-            weed-worker_${{ matrix.asset_suffix }}.tar.gz.md5
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Upload artifacts
-        if: ${{ !startsWith(github.ref, 'refs/tags/') }}
-        uses: actions/upload-artifact@v7
-        with:
-          name: rust-worker-${{ matrix.asset_suffix }}
-          path: |
-            weed-worker_${{ matrix.asset_suffix }}.tar.gz
-            weed-worker_${{ matrix.asset_suffix }}.tar.gz.md5
-
   build-rust-volume-darwin:
     permissions:
       contents: write
@@ -224,6 +131,9 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
+      - name: Install protobuf compiler
+        run: brew install protobuf
+
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
         with:
@@ -301,6 +211,9 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
+      - name: Install protobuf compiler
+        run: choco install protoc -y
+
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
 

.github/workflows/s3-example-integration-tests.yml

@@ -64,14 +64,6 @@ jobs:
           echo "=== Running S3 Empty Directory Marker Tests ==="
           go test -v -timeout=180s -run TestS3ListObjectsEmptyDirectoryMarkers ./...
 
-      - name: Run S3 Prefix Object Tests
-        timeout-minutes: 15
-        working-directory: test/s3/normal
-        run: |
-          set -x
-          echo "=== Running S3 Prefix Object Tests ==="
-          go test -v -timeout=180s -run TestS3PrefixObjectKeys ./...
-
       - name: Run IAM Integration Tests
         timeout-minutes: 15
         working-directory: test/s3/normal

.github/workflows/s3-mutation-regression-tests.yml

@@ -38,22 +38,7 @@ jobs:
         working-directory: test/s3/versioning
         run: |
           set -x
-          # Run every versioning test, so a regression test lands covered instead
-          # of waiting for someone to remember this file. Name a test in EXCLUDE,
-          # with the reason, to keep it out.
-          #
-          # TestVersioningPagination*: opt-in stress tests that build 1500+
-          # versions. They self-skip without ENABLE_STRESS_TESTS and have their
-          # own make target, so this gate should not carry them.
-          EXCLUDE='TestVersioningPagination.*'
-          tests=$(go test . -list '.*' | grep '^Test' | sort -u)
-          # An empty list would make -run match nothing and pass this job vacuously.
-          [ -n "$tests" ] || { echo "listed no versioning tests"; exit 1; }
-          selected=$(echo "$tests" | grep -vE "^($EXCLUDE)$")
-          [ -n "$selected" ] || { echo "EXCLUDE matched every test"; exit 1; }
-          echo "running $(echo "$selected" | wc -l) of $(echo "$tests" | wc -l) versioning tests"
-          # make swallows a lone trailing $, taking the anchor with it, so escape it.
-          make test-with-server TEST_PATTERN="^($(echo "$selected" | paste -sd'|' -))"'$$'
+          make test-with-server TEST_PATTERN="TestVersioningCompleteMultipartUploadIsIdempotent|TestVersioningSelfCopyMetadataReplaceCreatesNewVersion|TestVersioningSelfCopyMetadataReplaceSuspendedKeepsNullVersion|TestSuspendedDeleteCreatesDeleteMarker"
 
       - name: Show server logs on failure
         if: failure()

.github/workflows/s3-parquet-tests.yml

@@ -41,7 +41,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
-          go-version: ^1.26
+          go-version: ^1.25
           cache: true
       
       - name: Set up Python ${{ matrix.python-version }}
@@ -148,7 +148,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
-          go-version: ^1.26
+          go-version: ^1.25
           cache: true
       
       - name: Run Go unit tests

.github/workflows/s3-tables-tests.yml

@@ -6,7 +6,6 @@ on:
       - 'weed/s3api/**'
       - 'weed/filer/**'
       - 'weed/server/**'
-      - 'weed/worker/tasks/iceberg/**'
       - 'test/s3tables/**'
       - 'go.mod'
       - 'go.sum'
@@ -354,91 +353,6 @@ jobs:
           path: test/s3tables/catalog_doris/test-output.log
           retention-days: 3
 
-  clickhouse-iceberg-catalog-tests:
-    name: ClickHouse Iceberg Catalog Integration Tests (${{ matrix.tag }})
-    runs-on: ubuntu-22.04
-    timeout-minutes: 30
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          # Pinned baseline, and latest so new ClickHouse releases are
-          # exercised without a code change.
-          - clickhouse-image: clickhouse/clickhouse-server:25.8
-            tag: "25.8"
-          - clickhouse-image: clickhouse/clickhouse-server:latest
-            tag: latest
-
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Configure Docker Hub mirror
-        run: |
-          echo '{"registry-mirrors": ["https://mirror.gcr.io"]}' | sudo tee /etc/docker/daemon.json
-          sudo systemctl restart docker
-
-      - name: Pre-pull images
-        run: |
-          pull() { for i in 1 2 3; do docker pull "$1" && return 0; sleep 15; done; return 1; }
-          pull ${{ matrix.clickhouse-image }}
-          pull python:3.11-slim
-
-      - name: Run go mod tidy
-        run: go mod tidy
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false ./weed
-
-      - name: Run ClickHouse Iceberg Catalog Integration Tests
-        timeout-minutes: 25
-        working-directory: test/s3tables/catalog_clickhouse
-        env:
-          CLICKHOUSE_IMAGE: ${{ matrix.clickhouse-image }}
-        run: |
-          set -x
-          set -o pipefail
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          df -h
-          docker info
-          echo "=== Starting ClickHouse Iceberg Catalog Tests ==="
-
-          go test -v -timeout 20m . 2>&1 | tee test-output.log || {
-            echo "ClickHouse Iceberg catalog integration tests failed"
-            exit 1
-          }
-
-      - name: Show test output on failure
-        if: failure()
-        working-directory: test/s3tables/catalog_clickhouse
-        run: |
-          echo "=== Test Output ==="
-          if [ -f test-output.log ]; then
-            tail -200 test-output.log
-          fi
-
-          echo "=== Process information ==="
-          ps aux | grep -E "(weed|test|docker|clickhouse)" || true
-          echo "=== ClickHouse containers ==="
-          docker ps -a --filter "name=seaweed-clickhouse" || true
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: clickhouse-iceberg-catalog-test-logs-${{ matrix.tag }}
-          path: test/s3tables/catalog_clickhouse/test-output.log
-          retention-days: 3
-
   polaris-integration-tests:
     name: Polaris Integration Tests
     runs-on: ubuntu-22.04
@@ -875,293 +789,6 @@ jobs:
           path: test/s3tables/unity_catalog/test-output.log
           retention-days: 3
 
-  lancedb-namespace-tests:
-    name: LanceDB Namespace Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 30
-
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Configure Docker Hub mirror
-        run: |
-          echo '{"registry-mirrors": ["https://mirror.gcr.io"]}' | sudo tee /etc/docker/daemon.json
-          sudo systemctl restart docker
-
-      - name: Pre-pull images
-        run: |
-          pull() { for i in 1 2 3; do docker pull "$1" && return 0; sleep 15; done; return 1; }
-          pull python:3.11-slim
-
-      - name: Run go mod tidy
-        run: go mod tidy
-
-      - name: Build SeaweedFS
-        run: |
-          cd weed && go build -buildvcs=false .
-
-      - name: Run LanceDB Namespace Integration Tests
-        timeout-minutes: 25
-        working-directory: test/s3tables/catalog_lancedb
-        run: |
-          set -x
-          set -o pipefail
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          df -h
-          docker info
-          echo "=== Starting LanceDB Namespace Tests ==="
-
-          go test -v -timeout 20m . 2>&1 | tee test-output.log || {
-            echo "LanceDB namespace integration tests failed"
-            exit 1
-          }
-
-      - name: Show test output on failure
-        if: failure()
-        working-directory: test/s3tables/catalog_lancedb
-        run: |
-          echo "=== Test Output ==="
-          if [ -f test-output.log ]; then
-            tail -200 test-output.log
-          fi
-
-          echo "=== Process information ==="
-          ps aux | grep -E "(weed|test|docker)" || true
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: lancedb-namespace-test-logs
-          path: test/s3tables/catalog_lancedb/test-output.log
-          retention-days: 3
-
-  table-lifecycle-tests:
-    name: Table Lifecycle Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 40
-
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Configure Docker Hub mirror
-        run: |
-          echo '{"registry-mirrors": ["https://mirror.gcr.io"]}' | sudo tee /etc/docker/daemon.json
-          sudo systemctl restart docker
-
-      - name: Pre-pull images
-        run: |
-          pull() { for i in 1 2 3; do docker pull "$1" && return 0; sleep 15; done; return 1; }
-          pull python:3.11-slim
-          pull duckdb/duckdb:latest
-
-      - name: Run go mod tidy
-        run: go mod tidy
-
-      - name: Build SeaweedFS
-        run: |
-          cd weed && go build -buildvcs=false .
-
-      - name: Run Table Lifecycle Integration Tests
-        timeout-minutes: 35
-        working-directory: test/s3tables/lifecycle
-        env:
-          # The Rust worker's own tests cover its handlers; a cold build of the
-          # lance crate costs more here than the layer it would be checking.
-          WEED_LANCE_MAINTENANCE: library
-        run: |
-          set -x
-          set -o pipefail
-          go test -v -timeout 30m . 2>&1 | tee test-output.log || {
-            echo "Table lifecycle integration tests failed"
-            exit 1
-          }
-
-      - name: Show test output on failure
-        if: failure()
-        working-directory: test/s3tables/lifecycle
-        run: |
-          echo "=== Test Output ==="
-          if [ -f test-output.log ]; then
-            tail -200 test-output.log
-          fi
-
-          echo "=== Process information ==="
-          ps aux | grep -E "(weed|test|docker)" || true
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: table-lifecycle-test-logs
-          path: test/s3tables/lifecycle/test-output.log
-          retention-days: 3
-
-  duckdb-lance-tests:
-    name: DuckDB Lance Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 30
-
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-        with:
-          # The job uploads a test log on failure; nothing here needs to push,
-          # so do not leave a token in the checkout for it to pick up.
-          persist-credentials: false
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Configure Docker Hub mirror
-        run: |
-          echo '{"registry-mirrors": ["https://mirror.gcr.io"]}' | sudo tee /etc/docker/daemon.json
-          sudo systemctl restart docker
-
-      - name: Pre-pull images
-        run: |
-          pull() { for i in 1 2 3; do docker pull "$1" && return 0; sleep 15; done; return 1; }
-          pull duckdb/duckdb:latest
-          pull python:3.11-slim
-
-      - name: Run go mod tidy
-        run: go mod tidy
-
-      - name: Build SeaweedFS
-        run: |
-          cd weed && go build -buildvcs=false .
-
-      - name: Run DuckDB Lance Integration Tests
-        timeout-minutes: 25
-        working-directory: test/s3tables/catalog_duckdb_lance
-        run: |
-          set -x
-          set -o pipefail
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          df -h
-          docker info
-          echo "=== Starting DuckDB Lance Tests ==="
-
-          go test -v -timeout 20m . 2>&1 | tee test-output.log || {
-            echo "DuckDB Lance integration tests failed"
-            exit 1
-          }
-
-      - name: Show test output on failure
-        if: failure()
-        working-directory: test/s3tables/catalog_duckdb_lance
-        run: |
-          echo "=== Test Output ==="
-          if [ -f test-output.log ]; then
-            tail -200 test-output.log
-          fi
-
-          echo "=== Process information ==="
-          ps aux | grep -E "(weed|test|docker|duckdb)" || true
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: duckdb-lance-test-logs
-          path: test/s3tables/catalog_duckdb_lance/test-output.log
-          retention-days: 3
-
-  spark-lance-namespace-tests:
-    name: Spark Lance Namespace Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 40
-
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-        with:
-          # The job uploads a test log on failure; nothing here needs to push,
-          # so do not leave a token in the checkout for it to pick up.
-          persist-credentials: false
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Configure Docker Hub mirror
-        run: |
-          echo '{"registry-mirrors": ["https://mirror.gcr.io"]}' | sudo tee /etc/docker/daemon.json
-          sudo systemctl restart docker
-
-      - name: Pre-pull images
-        run: |
-          pull() { for i in 1 2 3; do docker pull "$1" && return 0; sleep 15; done; return 1; }
-          pull apache/spark:3.5.1
-
-      - name: Run go mod tidy
-        run: go mod tidy
-
-      - name: Build SeaweedFS
-        run: |
-          cd weed && go build -buildvcs=false .
-
-      - name: Run Spark Lance Namespace Integration Tests
-        timeout-minutes: 35
-        working-directory: test/s3tables/catalog_spark_lance
-        run: |
-          set -x
-          set -o pipefail
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          df -h
-          docker info
-          echo "=== Starting Spark Lance Namespace Tests ==="
-
-          go test -v -timeout 30m . 2>&1 | tee test-output.log || {
-            echo "Spark Lance namespace integration tests failed"
-            exit 1
-          }
-
-      - name: Show test output on failure
-        if: failure()
-        working-directory: test/s3tables/catalog_spark_lance
-        run: |
-          echo "=== Test Output ==="
-          if [ -f test-output.log ]; then
-            tail -200 test-output.log
-          fi
-
-          echo "=== Process information ==="
-          ps aux | grep -E "(weed|test|docker|spark)" || true
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: spark-lance-namespace-test-logs
-          path: test/s3tables/catalog_spark_lance/test-output.log
-          retention-days: 3
-
   s3-tables-build-verification:
     name: S3 Tables Build Verification
     runs-on: ubuntu-22.04

.github/workflows/s3tests.yml

@@ -694,12 +694,10 @@ jobs:
           export WEED_DATA_DIR="/tmp/seaweedfs-copy-test-$(date +%s)"
           mkdir -p "$WEED_DATA_DIR"
           set -x
-          # Each test bucket is its own collection and grows 7 volumes; the suite runs
-          # faster than the heartbeat that returns slots from the deleted collections.
           weed -v 0 server -filer -filer.maxMB=64 -s3 -ip.bind 0.0.0.0 \
             -dir="$WEED_DATA_DIR" \
             -master.raftHashicorp -master.electionTimeout 1s -master.volumeSizeLimitMB=100 \
-            -volume.max=300 -volume.preStopSeconds=1 \
+            -volume.max=100 -volume.preStopSeconds=1 \
             -master.port=9336 -volume.port=8083 -filer.port=8891 -s3.port=8003 -metricsPort=9327 \
             -s3.allowDeleteBucketNotEmpty=true -s3.config="$GITHUB_WORKSPACE/docker/compose/s3.json" -master.peers=none &
           pid=$!
@@ -767,7 +765,7 @@ jobs:
             sleep 2
           done
           
-          MASTER_ENDPOINT="http://127.0.0.1:9336" go test -v
+          go test -v
           kill -9 $pid || true
           # Clean up data directory
           rm -rf "$WEED_DATA_DIR" || true

.github/workflows/spark-integration-tests.yml

@@ -34,7 +34,7 @@ jobs:
       uses: actions/checkout@v7
 
     - name: Set up JDK 11
-      uses: actions/setup-java@v6
+      uses: actions/setup-java@v5
       with:
         java-version: '11'
         distribution: 'temurin'

.github/workflows/test-s3-over-https-using-awscli.yml

@@ -36,7 +36,7 @@ jobs:
 
       - uses: actions/setup-go@v7
         with:
-          go-version: ^1.26
+          go-version: ^1.25
 
       - name: Build SeaweedFS
         run: |

.github/workflows/tls-rotation-tests.yml

@@ -30,7 +30,7 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v7
       with:
-        go-version: ^1.26
+        go-version: ^1.25
       id: go
 
     - name: Check out code into the Go module directory

.github/workflows/vacuum-integration-tests.yml

@@ -30,7 +30,7 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v7
       with:
-        go-version: ^1.26
+        go-version: ^1.25
       id: go
 
     - name: Check out code into the Go module directory

.github/workflows/volume-server-integration-tests.yml

@@ -29,8 +29,6 @@ permissions:
 
 env:
   TEST_TIMEOUT: '30m'
-  # Keep in step with the length of matrix.shard below.
-  SHARD_COUNT: 3
 
 jobs:
   volume-server-integration-tests:
@@ -59,26 +57,28 @@ jobs:
           chmod +x weed
           ./weed version
 
-      # Dealing the listed tests out one by one keeps the shards even. Bucketing
-      # them by first letter did not: names cluster, so ^Test[I-S] drew 50 of
-      # the 114 grpc tests and ran nearly twice as long as the other two shards.
-      - name: Select this shard's tests
-        env:
-          TEST_TYPE: ${{ matrix.test-type }}
-          SHARD: ${{ matrix.shard }}
-        run: |
-          tests=$(go test ./test/volume_server/"$TEST_TYPE"/... -list '.*' | grep '^Test' | sort -u)
-          # An empty list would make -run match nothing and the shard pass vacuously.
-          [ -n "$tests" ] || { echo "listed no tests in test/volume_server/$TEST_TYPE"; exit 1; }
-          selected=$(echo "$tests" | awk -v n="$SHARD_COUNT" -v i="$SHARD" 'NR % n == i - 1')
-          echo "shard $SHARD of $SHARD_COUNT runs $(echo "$selected" | wc -l) of $(echo "$tests" | wc -l) tests"
-          echo "TEST_PATTERN=^($(echo "$selected" | paste -sd'|' -))\$" >> "$GITHUB_ENV"
-
       - name: Run volume server integration tests
         env:
           WEED_BINARY: ${{ github.workspace }}/weed/weed
         run: |
-          echo "Running volume server integration tests for ${{ matrix.test-type }} (Shard ${{ matrix.shard }} of ${SHARD_COUNT})..."
+          if [ "${{ matrix.test-type }}" == "grpc" ]; then
+            if [ "${{ matrix.shard }}" == "1" ]; then
+              TEST_PATTERN="^Test[A-H]"
+            elif [ "${{ matrix.shard }}" == "2" ]; then
+              TEST_PATTERN="^Test[I-S]"
+            else
+              TEST_PATTERN="^Test[T-Z]"
+            fi
+          else
+            if [ "${{ matrix.shard }}" == "1" ]; then
+              TEST_PATTERN="^Test[A-G]"
+            elif [ "${{ matrix.shard }}" == "2" ]; then
+              TEST_PATTERN="^Test[H-R]"
+            else
+              TEST_PATTERN="^Test[S-Z]"
+            fi
+          fi
+          echo "Running volume server integration tests for ${{ matrix.test-type }} (Shard ${{ matrix.shard }}, pattern: ${TEST_PATTERN})..."
           go test -v -count=1 -timeout=${{ env.TEST_TIMEOUT }} ./test/volume_server/${{ matrix.test-type }}/... -run "${TEST_PATTERN}"
 
       - name: Collect logs on failure
@@ -99,6 +99,23 @@ jobs:
       - name: Test summary
         if: always()
         run: |
+          if [ "${{ matrix.test-type }}" == "grpc" ]; then
+            if [ "${{ matrix.shard }}" == "1" ]; then
+              TEST_PATTERN="^Test[A-H]"
+            elif [ "${{ matrix.shard }}" == "2" ]; then
+              TEST_PATTERN="^Test[I-S]"
+            else
+              TEST_PATTERN="^Test[T-Z]"
+            fi
+          else
+            if [ "${{ matrix.shard }}" == "1" ]; then
+              TEST_PATTERN="^Test[A-G]"
+            elif [ "${{ matrix.shard }}" == "2" ]; then
+              TEST_PATTERN="^Test[H-R]"
+            else
+              TEST_PATTERN="^Test[S-Z]"
+            fi
+          fi
           echo "## Volume Server Integration Test Summary (${{ matrix.test-type }} - Shard ${{ matrix.shard }})" >> "$GITHUB_STEP_SUMMARY"
-          echo "- Suite: test/volume_server/${{ matrix.test-type }} (shard ${{ matrix.shard }} of ${SHARD_COUNT}, see 'Select this shard's tests' for the split)" >> "$GITHUB_STEP_SUMMARY"
-          echo "- Command: go test -v -count=1 -timeout=${{ env.TEST_TIMEOUT }} ./test/volume_server/${{ matrix.test-type }}/... -run \"\${TEST_PATTERN}\"" >> "$GITHUB_STEP_SUMMARY"
+          echo "- Suite: test/volume_server/${{ matrix.test-type }} (Pattern: ${TEST_PATTERN})" >> "$GITHUB_STEP_SUMMARY"
+          echo "- Command: go test -v -count=1 -timeout=${{ env.TEST_TIMEOUT }} ./test/volume_server/${{ matrix.test-type }}/... -run \"${TEST_PATTERN}\"" >> "$GITHUB_STEP_SUMMARY"

README.md

@@ -61,14 +61,14 @@ Table of Contents
 * [Features](#features)
     * [Additional Features](#additional-features)
     * [Filer Features](#filer-features)
-* [Example: Using Seaweed Blob Store](#example-using-seaweed-blob-store)
+* [Example: Using Seaweed Object Store](#example-using-seaweed-object-store)
 * [Architecture](#object-store-architecture)
 * [Compared to Other File Systems](#compared-to-other-file-systems)
     * [Compared to HDFS](#compared-to-hdfs)
     * [Compared to GlusterFS, Ceph](#compared-to-glusterfs-ceph)
     * [Compared to GlusterFS](#compared-to-glusterfs)
     * [Compared to Ceph](#compared-to-ceph)
-    * [Compared to MinIO, RustFS](#compared-to-minio-rustfs)
+    * [Compared to Minio](#compared-to-minio)
 * [Dev Plan](#dev-plan)
 * [Installation Guide](#installation-guide)
 * [Disk Related Topics](#disk-related-topics)
@@ -90,7 +90,7 @@ S3_BUCKET=my-bucket \
 ./weed mini -dir=/data
 ```
 
-That's it — the S3 endpoint is at http://localhost:8333, `my-bucket` already exists, and `admin`/`secret` are valid credentials. `S3_BUCKET` accepts a comma-separated list (e.g. `raw,processed`); use `S3_TABLE_BUCKET` for S3 Tables buckets, each `name` or `name:FORMAT` where the format is `ICEBERG` (the default) or `LANCE`. Drop any of the env vars to skip that piece (no AWS keys → S3 runs in unauthenticated "Allow All" mode for development).
+That's it — the S3 endpoint is at http://localhost:8333, `my-bucket` already exists, and `admin`/`secret` are valid credentials. `S3_BUCKET` accepts a comma-separated list (e.g. `raw,processed`); use `S3_TABLE_BUCKET` for S3 Tables (Iceberg) buckets. Drop any of the env vars to skip that piece (no AWS keys → S3 runs in unauthenticated "Allow All" mode for development).
 
 The same command starts everything else too:
 - **S3 Endpoint**: http://localhost:8333
@@ -466,8 +466,7 @@ The architectures are mostly the same. SeaweedFS aims to store and read files fa
 | GlusterFS      | hashing          |                  | FUSE, NFS          |          |                           |
 | Ceph           | hashing + rules  |                  | FUSE               | Yes      |                           |
 | MooseFS        | in memory        |                  | FUSE               |       | No                          |
-| MinIO          | separate meta file per drive for each file  |                  |         | Yes   | No                          |
-| RustFS         | separate meta file per drive for each file  |                  |         | Yes   | No                          |
+| MinIO          | separate meta file for each file  |                  |         | Yes   | No                          |
 
 [Back to TOC](#table-of-contents)
 
@@ -509,26 +508,24 @@ SeaweedFS Filer uses off-the-shelf stores, such as MySql, Postgres, Sqlite, Mong
 
 [Back to TOC](#table-of-contents)
 
-### Compared to MinIO, RustFS ###
+### Compared to MinIO ###
 
-Please note, as Apr 25, 2026 MinIO ceased development. It's strongly discouraged to use that unmaintained software with multiple security bugs. RustFS is a MinIO reimplementation in Rust, Apache 2.0 licensed and still developed, keeping MinIO's storage model down to a byte-compatible on-disk format. So the points below apply to both.
+Please note, as Apr 25, 2026 MinIO ceased developement. It's strongly discouraged to use that unmaintained software with multiple security bugs.
 
 MinIO followed AWS S3 closely and was ideal for testing for S3 API. It had good UI, policies, versionings, etc. SeaweedFS is trying to catch up here. 
 
-The metadata are in simple files. Each file write incurs extra writes to the corresponding meta file, on every drive of the erasure set. Changing only tags or retention rewrites that meta file on all of them, so the write amplification does not shrink with object size.
+MinIO metadata were in simple files. Each file write will incur extra writes to corresponding meta file.
 
-There is no optimization for lots of small files. The files are simply stored as is to local disks.
+MinIO did not have optimization for lots of small files. The files were simply stored as is to local disks.
 Plus the extra meta file and shards for erasure coding, it only amplifies the LOSF problem.
 
-Multiple disk IO are needed to read one file. SeaweedFS has O(1) disk reads, even for erasure coded files.
+MinIO had multiple disk IO to read one file. SeaweedFS has O(1) disk reads, even for erasure coded files.
 
-Erasure coding is full-time. SeaweedFS uses replication on hot data for faster speed and optionally applies erasure coding on warm data.
+MinIO had full-time erasure coding. SeaweedFS uses replication on hot data for faster speed and optionally applies erasure coding on warm data.
 
-No POSIX-like API support.
+MinIO did not have POSIX-like API support.
 
-There are specific requirements on storage layout, which makes it hard to scale out and to maintain. An erasure set must be 2 to 16 drives and must divide the drive list symmetrically, and capacity grows or shrinks a whole pool at a time. In SeaweedFS, just start one volume server pointing to the master. That's all.
-
-[Back to TOC](#table-of-contents)
+MinIO had specific requirements on storage layout. It is not flexible to adjust capacity. In SeaweedFS, just start one volume server pointing to the master. That's all.
 
 ## Dev Plan ##
 

design-lance-catalog.md

@@ -1,696 +0,0 @@
-# Lance Catalog for SeaweedFS
-
-A second catalog surface next to the Iceberg REST catalog, speaking the Lance Namespace
-REST spec, over the same table buckets and the same filer.
-
-## Why
-
-Gravitino 1.1 added a Lance REST service and 1.3 ships it as a standalone server; Lakekeeper
-added Lance in the same window by a completely different route. That is the useful signal:
-two unrelated catalogs decided independently that Lance had to be first-class, not a niche.
-The client side is already there — `lance-spark` (`LanceNamespaceSparkCatalog`
-with `impl=rest`), `lance-ray`, and the generated Python/Java/Rust clients all talk the same
-OpenAPI. Implementing the spec means those engines work against SeaweedFS with no
-SeaweedFS-specific code on the client.
-
-The second reason is that Gravitino's own documentation names the gap it cannot close:
-DuckDB, pandas and DataFusion "do not support Lance REST natively yet" and have to fetch a
-location from the catalog and then open the dataset directly. Gravitino cannot help there,
-because it does not own the storage. SeaweedFS does. That is the whole design opportunity
-below.
-
-## Prior art: three families
-
-Upstream lists twelve catalog implementations, and they fall into three shapes. Knowing
-which one we are building matters more than any individual API decision.
-
-**1. Storage-native, no service.** The Lance Directory Catalog. V1 is a directory listing
-where every `<name>.lance/` child of a prefix is a table; V2 adds a `__manifest` table —
-itself a Lance table — holding `object_id`/`object_type`/`location` rows, with nested
-namespaces, hash-prefixed table directories, and optional managed versioning. No server, no
-credentials, no governance. This is the floor every other implementation has to beat.
-
-**2. Protocol-native server.** Someone implements the Lance Namespace REST OpenAPI and
-clients connect with `impl=rest`. Gravitino is the only one of the twelve that does this,
-and it is what this design proposes.
-
-**3. Client-side adapters onto an existing catalog.** Nine of the twelve. The Lance client
-translates namespace operations into whatever the backing catalog already speaks: Apache
-Polaris, Unity Catalog, AWS Glue, Hive Metastore v2 and v3, Google BigLake, Dataproc,
-Microsoft OneLake — and Apache Iceberg REST. Two flavors:
-
-- Catalogs with a real non-Iceberg table concept mark the format directly. Polaris uses its
-  Generic Table API with `format = lance`; Unity uses an `EXTERNAL` table with
-  `table_type=lance` in properties and the path in `storage_location`; Glue uses
-  `EXTERNAL_TABLE` plus `table_type=lance` in `Parameters`, path in
-  `StorageDescriptor.Location`.
-- Catalogs with no such concept fake one. The Iceberg REST adapter registers **a regular
-  Iceberg table with a dummy schema — a single nullable string column named `dummy`** —
-  carrying the property `table_type=lance`, and treats the Iceberg table location as the
-  Lance dataset root.
-
-Every adapter in family 3 lands in the same place: `DeclareTable`/`ListTables`/
-`DescribeTable`/`DeregisterTable` only, `DropNamespace` in RESTRICT mode only,
-`load_detailed_metadata=false` only, and `managed_versioning=false`. They are a name-to-
-location map and nothing more.
-
-Lakekeeper is the instructive outlier. It has the same generic-table concept Polaris has,
-but no upstream adapter exists for it — there is no `lance-namespace` reference anywhere in
-its repository and no page for it in the supported-catalogs list. So Polaris's generic tables
-are reachable from a stock Lance client and Lakekeeper's are not, despite being the same
-idea. Shipping the concept is not the same as shipping the integration.
-
-## Gravitino and Lakekeeper: the two opposite bets
-
-Both shipped Lance support in the same window and did not build the same thing.
-
-**Gravitino implements the protocol.** Its `lance/` module serves the Lance Namespace REST
-spec on its own port (`:9101/lance`), so stock `lance-spark` and `lance-ray` connect with
-`impl=rest` and no vendor-specific client. The cost is governance: storage credentials are
-static properties on the catalog (`lance.storage.access_key_id`, `secret_access_key`,
-`endpoint`, `region`, `allow_http`), optionally overridden per table, handed to the engine
-as-is. No STS, no expiry, no per-table scoping.
-
-**Lakekeeper refuses the protocol and governs the object instead.** There is no
-`lance-namespace` anywhere in the repository; Lance arrived in 0.13.0 (2026-06-30, issue
-#1673 `Generic Table API with Lance`) as one `format` string on a Lakekeeper-native Generic
-Table API:
-
-```
-POST/GET/DELETE /lakekeeper/v1/{prefix}/namespaces/{ns}/generic-tables[/{table}]
-GET             /lakekeeper/v1/{prefix}/namespaces/{ns}/generic-tables/{table}/credentials
-POST            /lakekeeper/v1/{prefix}/generic-tables/rename
-```
-
-`format` is opaque, `schema` and `statistics` are stored but never validated, and the
-catalog writes no format-specific metadata — engines go straight to the location. In
-exchange Lance tables get everything Iceberg tables get: STS-vended prefix-scoped
-credentials, OpenFGA per-action permissions (16 actions), soft-delete with undrop, a
-protection flag, rename, pagination, and name uniqueness across Iceberg tables, views and
-generic tables in one namespace. The price is that no stock Lance client can talk to it —
-you need `pylakekeeper`, which exists mainly to translate vended credentials into
-`lance_storage_options`.
-
-So: protocol fidelity and weak governance, or strong governance and client lock-in. Both
-documented their limit honestly, and it is the same limit. Lakekeeper's capability table
-says it outright — "Commit coordination: the catalog does not arbitrate writes — engines
-write directly." Gravitino does not claim it either. Neither of them coordinates a Lance
-commit, which is exactly the thing a store can do and a control plane cannot.
-
-We do not have to choose. Serve the Lance protocol natively the way Gravitino does, over
-the `s3tables` entries that already carry ARNs, policies, tags and maintenance config, and
-the governance comes from the layer underneath rather than from a proprietary API on top.
-That is only available to us because we are the store, which is also what makes the third
-option — arbitrating the commit — available.
-
-## We are probably already a Lance catalog, and that is a problem
-
-The Iceberg REST adapter does not care whose Iceberg catalog it is talking to. It needs
-`/v1/config?warehouse=`, `/v1/{prefix}/namespaces`, `/v1/{prefix}/namespaces/{ns}/tables`
-and unit-separator (`\x1F`) multi-level namespaces. We serve all of those, and
-`parseNamespace` in `weed/s3api/iceberg/utils.go:22` already splits on `\x1F`. So a stock
-Lance client pointed at our Iceberg catalog on :8181 with the Iceberg impl should already
-create, list, describe and deregister Lance tables today, with no SeaweedFS change at all.
-
-That is worth testing before writing a line of the design above, for two reasons. It is a
-free baseline — and possibly a free announcement. And it is a data-loss hazard.
-
-A Lance table registered this way is an Iceberg table whose metadata references no data
-files, sitting on top of a Lance dataset that uses `data/` for its fragments — the same
-subdirectory name Iceberg uses. The maintenance worker's orphan cleaner walks exactly
-`<table>/metadata` and `<table>/data`, and deletes every file not referenced by a snapshot
-and older than `orphan_older_than_hours`
-(`weed/worker/tasks/iceberg/operations.go:331`, default 72). Against an adapter-registered
-Lance table, every fragment is unreferenced by construction. Run maintenance and the
-dataset is deleted.
-
-Maintenance is disabled by default (`handler.go:334`), so this is a latent hazard rather
-than a live one: it needs an operator to enable Iceberg maintenance on a bucket that also
-holds adapter-registered Lance tables. But it costs nothing to close — detection should
-skip any table carrying a non-Iceberg format marker (`table_type` property, or
-`Format != "ICEBERG"` once the format field is honest), and that guard is worth landing on
-its own regardless of whether the rest of this design ever gets built. It is the same
-"catalog-only, no maintenance" marker the generic-format question needs.
-
-## Where we differ from Gravitino
-
-Gravitino is a metadata service in front of somebody else's object store:
-
-```
-  Spark / Ray                  Spark / Ray / pandas / duckdb
-      |                              |
-  Lance REST                    Lance REST          (direct S3)
-      |                              |                   |
-  Gravitino                     SeaweedFS S3 gateway ----+
-      |                              |
-   S3 keys handed out           SeaweedFS filer + volumes
-      |
-  somebody else's S3
-```
-
-It resolves a name to a location plus `lance.storage.*` credentials, and steps out of the
-way. Everything a Lance table actually is — `_versions/`, `data/`, `_indices/` — is opaque
-to it.
-
-We are the store. Three things follow that Gravitino cannot do:
-
-1. The catalog and a plain directory listing can be made to agree, so a client with no
-   catalog at all still sees the right tables.
-2. `_versions/` is a filer directory listing, not an object-store `LIST`. Version history
-   is cheap and can back the admin UI.
-3. We can offer a genuinely atomic commit reservation. Lance's commit protocol needs
-   put-if-not-exists; our S3 layer does not currently provide one (see
-   [Commit safety](#commit-safety)). The filer does.
-
-## Placement
-
-The Iceberg catalog is a thin HTTP shell over `s3tables.Manager`; the storage work lives in
-`weed/s3api/s3tables`. Table buckets live under `TablesPath = s3_constants.DefaultBucketsPath`,
-i.e. the same filer tree the S3 gateway serves, so `s3://bucket/ns/table/` is simultaneously
-a catalog entry and an S3 prefix. Catalog entries are filer directories carrying `s3tables.*`
-extended attributes. `Table.Format` already exists and is hard-checked against `"ICEBERG"`
-in `weed/s3api/s3tables/handler_table.go:48`.
-
-So:
-
-```
-weed/s3api/lance/          new: HTTP surface, id codec, error model
-weed/s3api/s3tables/       extended: Format "LANCE", lance state xattr, version entries
-weed/command/s3.go         new: -port.lance (default 9101), startLanceServer
-```
-
-`Format: "LANCE"` on the table entry is the whole storage-model change for phase 1.
-Everything else — namespaces, ARNs, policies, tags, ownership — is shared verbatim.
-
-```
-                        s3tables.Manager (filer)
-                                 |
-        +------------------------+------------------------+
-        |                                                 |
-  weed/s3api/iceberg                              weed/s3api/lance
-   Iceberg REST :8181                              Lance REST :9101
-        |                                                 |
-  Iceberg tables                                   Lance datasets
-        \                                                 /
-         +-------------------- s3 :8333 -----------------+
-                                 |
-                         SeaweedFS volumes
-```
-
-## Identifier mapping
-
-Lance identifiers are `["ns", ..., "table"]`, encoded in the URL as a single string joined
-by a delimiter that defaults to `$`. The delimiter alone means the root namespace, so
-`/v1/namespace/$/list` lists the root's children.
-
-Iceberg had to invent a warehouse selector because its identifier is flat and every table
-bucket is a separate catalog. Lance does not need that — its identifier is already
-hierarchical, and Gravitino uses exactly three levels (`["lance_catalog", "sales", "orders"]`).
-That maps onto us without inventing anything:
-
-```
-  $                            root      -> list of table buckets
-  $analytics                   level 1   -> a table bucket
-  $analytics$sales             level 2   -> a namespace in that bucket
-  $analytics$sales$orders      table
-```
-
-`spark.sql.catalog.lance.parent = analytics` then makes `sales.orders` resolve, which is the
-same shape Gravitino's Spark example uses.
-
-Levels 2..N join into one `s3tables` namespace with `.`, matching what the Iceberg catalog
-already does with `flattenNamespacePath`. The flattened form is only the directory name —
-`namespaceMetadata.Namespace []string` in the xattr keeps the authoritative parts, so the
-mapping stays invertible even though `.` is a legal character inside a namespace part.
-Reject `$` in any name part with `InvalidInput`; our charsets already exclude it, so no
-escaping scheme is needed.
-
-Root-level `ListNamespaces` returning table buckets means an unauthenticated or
-broadly-scoped caller can enumerate buckets. Filter it through the same
-`s3tables/permissions.go` check `ListTableBuckets` uses, not a separate path.
-
-`CreateNamespace` on a one-part identifier creates a table bucket, and it does so only if
-the caller is permitted to — the namespace never creates a bucket as a side effect of
-creating something inside it. A table bucket is a tenant resource with its own policy, ARN
-and lifecycle, and conjuring one because a client said `CREATE SCHEMA` is a privilege
-escalation dressed as a convenience. Lakekeeper draws the same line explicitly: its client
-creates tables, not warehouses.
-
-## Storage layout
-
-Lay tables out as:
-
-```
-s3://<table-bucket>/<flattened-namespace>/<table>/
-    data/
-    _versions/
-    _indices/
-```
-
-**Built without the `.lance` suffix this design originally proposed.** The suffix would have
-made every namespace prefix a valid Lance Directory Catalog V1 root, since V1 recognises a
-table by exactly that naming. It does not survive contact with the storage layer: the
-catalog entry *is* the dataset directory, `validateTableName` excludes `.` from the charset,
-and a suffixed entry name would leak into ARNs, policy documents and the S3 Tables API,
-where the same table would answer to two different names. Making `GetTablePath` format-aware
-instead spreads an "unless it is Lance" branch through code that has no business knowing —
-the exact cross-cutting cost this design rejects family 3 for.
-
-So one name, one directory. What survives is direct access by URI, which is the larger half
-of the story and needs no naming convention at all:
-
-```python
-# with the catalog
-spark.sql("SELECT * FROM lance.sales.orders")
-
-# without it, same bytes
-lance.dataset("s3://analytics/sales/orders")
-```
-
-DuckDB, pandas and DataFusion still reach the data with no catalog running, which is the gap
-Gravitino's documentation admits to. What they no longer get for free is *enumeration* — a
-directory-catalog client pointed at the namespace prefix will not list these as tables. If
-that turns out to matter, the cheapest fix is a repair-style tool that materialises `.lance`
-aliases, not a rename of the catalog entry.
-
-Note also that the directory catalog's own V2 mode puts child-namespace tables in
-`<hash>_<ns$table>` directories at the root and creates no physical subdirectories for
-namespaces, so full directory-catalog fidelity was never on offer anyway. We are a
-server-backed catalog; the human-readable prefix layout is worth more than partial V1
-lookalike behaviour.
-
-## The table bucket was not a neutral container
-
-This design assumed a table bucket is a place to put a table's files. It is
-not: `validateTableBucketObjectPath` runs on every S3 write into one and
-validated the path against Iceberg's layout, so a Lance client got 403 on
-`data/*.lance`, on `_versions/`, and on `_transactions/` — a directory Lance
-writes that neither the spec documentation nor this design anticipated. Nothing
-about the catalog worked end to end until that changed.
-
-The layout guard now admits the union of what the supported formats write, and
-treats any underscore-prefixed top-level directory as belonging to the format,
-checking only that the path stays inside the table. Enumerating Lance's
-internal directories by name is exactly the mistake that missed
-`_transactions`. Iceberg writes none of them, so it loses nothing.
-
-Found by pointing the real Python client at a running gateway, not by reading
-the spec. Worth remembering for the next format: the premise to check first is
-whether the storage layer will accept its files at all.
-
-## Table lifecycle
-
-Lance has three table states, and the spec pins them to marker files:
-
-| State | Marker | Created by | Visible in ListTables |
-| --- | --- | --- | --- |
-| declared | `.lance-reserved` | `DeclareTable` | yes, when `include_declared=true` |
-| created | `_versions/` present | client writes, or `CreateTable` | yes |
-| deregistered | `.lance-deregistered` | `DeregisterTable` | no; data preserved |
-
-Record the state in an xattr (`s3tables.lanceState`) on the catalog entry *and* write the
-marker file into the table directory. The xattr is what the catalog reads; the marker is
-what keeps a directory-catalog client honest. Dual-write is the price of the interop claim
-above, and it is one extra filer write on three rarely-called operations.
-
-`DeclareTable` is the operation `lance-spark` actually calls on `CREATE TABLE` (it replaced
-the legacy `create-empty`), so it is not optional in practice even though the spec marks
-only a subset as required.
-
-`DeregisterTable` preserving data is the same shape as our Iceberg rename, where the catalog
-entry moves and the data stays put — reuse `TableDataDirFromMetadataLocation`'s idea rather
-than re-deriving the data path from the catalog name.
-
-## Commit safety
-
-This is the part I got wrong, and the correction removed a feature rather than adding one.
-
-Lance commits a version by writing `_versions/{v}.manifest` with put-if-not-exists: exactly
-one writer is supposed to win, and the loser rebases. In lance 10 that path is not optional
-and needs nothing bolted on — `commit_handler_from_url` hands every `s3://` dataset a
-`ConditionalPutCommitHandler`, which calls `put_opts` with `PutMode::Create`, which
-object_store's S3 backend sends as `If-None-Match: *`.
-
-I originally read our gateway as evaluating that header check-then-act, and designed around
-it. That was already out of date. `buildWriteCondition`
-(`weed/s3api/s3api_object_routed_write.go`) reduces `If-None-Match: *` to a filer
-`WriteCondition{IF_NOT_EXISTS}`, and `putToFiler` routes the create to the object's owner
-filer, which evaluates the precondition under its per-path lock; when routing is not
-available it falls back to the object write lock, which evaluates it under the lock too.
-Either way it is atomic. Sixteen concurrent writers of the same fresh key get one 200 and
-fifteen 412s, repeatedly.
-
-So the store already has the primitive Lance needs, cluster-wide, for every conditional-PUT
-client and not just this one.
-
-### What that removed
-
-An earlier draft of this design offered the catalog as an **external manifest store**:
-`managed_versioning: true` plus `CreateTableVersion` and friends, with the reserve step as a
-filer `CreateEntry` with `o_excl`. It was implemented, tested, and shipped behind a default-off
-flag — and it should not exist.
-
-- It solves a problem this store does not have. The spec offers that path for stores that
-  cannot order commits themselves.
-- It moves a table's version history out of the dataset and into the catalog, so a reader
-  that does not go through this namespace no longer sees the whole picture. That is a real
-  cost paid for nothing.
-- lance 10 cannot even use it past the first commit: `NamespaceManifestStore::put_if_not_exists`
-  answers "put_if_not_exists is not supported for namespace-backed stores", which is exactly
-  what a second `append` needs.
-
-The version operations now answer `Unsupported` alongside the other operations the catalog
-does not serve, and `managed_versioning` is answered `false`. The property they were
-protecting is covered instead by a test that races eight writers at the manifest key through
-S3 and asserts one wins — testing the path Lance actually takes.
-
-## Credential vending
-
-Iceberg needed a header (`X-Iceberg-Access-Delegation: vended-credentials`) and a bespoke
-response shape. Lance has it in the spec: `vend_credentials: true` on the request,
-`storage_options` on the response, with `expires_at_millis` as the well-known expiry key.
-
-Reuse the existing vendor interface unchanged — `iceberg.CredentialVendor` /
-`STSService.AssumeRoleForPrincipal` scoped to the table prefix (#10777) — and map its output
-to the storage options Lance passes through to `object_store`:
-
-```
-aws_access_key_id, aws_secret_access_key, aws_session_token,
-aws_region, aws_endpoint, allow_http, expires_at_millis
-```
-
-Those are the names `pylakekeeper` emits as `lance_storage_options`, which is the shape
-Lakekeeper's tested S3 path actually feeds to Lance. `object_store` also accepts the
-un-prefixed aliases (`endpoint`, `region`) that the directory catalog's `storage.` prefix
-strips down to and that Gravitino's `lance.storage.endpoint` resolves to, but the `aws_`
-forms are the ones with a tested integration behind them, so emit those. `aws_endpoint`
-should come from `deriveS3AdvertisedEndpoint()`, the same source the Iceberg `FileIO` config
-uses, and `allow_http` must be set when that endpoint is plain HTTP or every read fails with
-a TLS error that looks like a credential problem — Lakekeeper vends both automatically for
-exactly this reason, and calls out that there is then no per-vendor branch in client code.
-
-We emit this server-side, in the `storage_options` field the Lance spec already defines,
-which is strictly better than Lakekeeper's arrangement: no client library has to translate
-anything, so vending works from any stock Lance client rather than only from theirs.
-
-Guard the same way #10777 had to after review: bucket-scoped list grants need an `s3:prefix`
-condition, and a location containing `*` or `?` must be refused rather than widened into a
-resource pattern.
-
-## Auth and authorization
-
-Authentication reuses `S3Authenticator` and `CredentialValidator` as-is. The Lance spec maps
-identity to headers — `api_key` to `x-api-key`, `auth_token` to `Authorization: Bearer` — and
-SigV4 keeps working because it is the same authenticator the Iceberg catalog already fronts.
-
-Authorization needs nothing new. A Lance table gets the same ARN shape,
-`arn:aws:s3tables:...:bucket/B/table/NS/T`, so every existing table-bucket policy covers
-Lance tables with no new policy language and no second permission model. Route it through
-`s3tables/permissions.go` and inherit the `DefaultAllow` semantics the Iceberg server already
-mirrors from the S3 port.
-
-One spec quirk worth honoring: request context entries prefixed `header.` become request
-headers, and every response header comes back as a `header.`-prefixed context entry. Echoing
-`x-request-id` through it costs nothing and makes tracing work.
-
-## What to take from Lakekeeper
-
-Rejecting Lakekeeper's API shape does not mean rejecting what it learned building it.
-
-**Deregister is soft-delete, so implement it as one.** Lakekeeper gives generic tables
-soft-deletion with undrop and a `protected` flag that makes a drop require `force=true`.
-Lance already has the concept — `DeregisterTable` preserves the data and hides the table —
-so the `.lance-deregistered` marker is a soft-delete by another name, and a re-register is
-an undrop. A protection flag on table-bucket entries is worth having regardless of Lance:
-it is a few lines against the existing xattrs and it applies to Iceberg tables too.
-
-**Enforce one identifier space across entry kinds.** Lakekeeper rejects a generic table
-whose name collides with an Iceberg table or view in the same namespace. Our catalog entries
-already share one filer directory and already carry `s3tables.entryType`, so this is
-structurally true — but it has to be enforced deliberately on every path, or a Lance handler
-happily loads an Iceberg table's directory and vice versa. That is the same crossover bug
-class as the view/table rename authorization fixed in #10776; the `catalogEntryKind` pattern
-from that change is the thing to reuse rather than re-derive.
-
-**A re-vend path matters more than it looks.** Lakekeeper exposes `/credentials` separately
-from load, because STS credentials expire in the middle of long jobs and re-loading the
-whole table to refresh them is wasteful. In Lance the spec's answer is another
-`DescribeTable` with `vend_credentials: true`, which is fine — but it means `DescribeTable`
-must stay cheap when `load_detailed_metadata` is false, which is another reason not to open
-the dataset on that path.
-
-**Generic tables are a cheap orthogonal win.** Lakekeeper's real insight is that Delta,
-Parquet, CSV, Vortex and Paimon all get governance for free once the catalog stops caring
-what the format is. Our `Table.Format` field already exists and the only thing stopping it
-is the hard `"ICEBERG"` check in `handler_table.go:48`. Loosening that and letting the S3
-Tables API register a table with an arbitrary format and a location — no metadata, no
-commits — is a small change that makes every format cataloguable. It is independent of this
-design and probably worth doing first, since `Format: "LANCE"` is then just a value rather
-than a special case.
-
-**Skip remote signing.** It is Lakekeeper's fallback for S3-compatible stores with no STS,
-and their own documentation notes that Lance will not use it — format libraries with their
-own S3 client expect static credentials and do not implement the Iceberg signer protocol. We
-have STS, so vended credentials are the path, and the signer is not worth building for a
-client that cannot consume it.
-
-## Errors
-
-Lance uses `{code, error, detail, instance}` with numeric codes, not Iceberg's exception-type
-strings. The mapping is mechanical:
-
-| HTTP | code | when |
-| --- | --- | --- |
-| 400 | 13 InvalidInput | charset violations, malformed id, route/body mismatch |
-| 401 | 16 Unauthenticated | |
-| 403 | 15 PermissionDenied | |
-| 404 | 1 NamespaceNotFound, 4 TableNotFound, 11 TableVersionNotFound | |
-| 409 | 2/5 AlreadyExists, 3 NamespaceNotEmpty, 14 ConcurrentModification | |
-| 501 | 0 Unsupported | every phase-3 data operation |
-
-Route/body mismatch is a spec requirement, not a nicety: when the identifier appears in both
-the path and the body and they disagree, the server must return 400. Cheap to get right at
-the decode step, annoying to retrofit.
-
-## Route surface
-
-Phase 0 is not in this table: point a stock Lance client at the existing Iceberg catalog
-with the Iceberg impl, see how far it gets, and land the maintenance guard either way. That
-tells us what the native server actually has to beat.
-
-Phase 1, the whole `lance-spark` and `lance-ray` contract:
-
-```
-POST /v1/namespace/{id}/create         CreateNamespace       mode: Create|ExistOk|Overwrite
-GET  /v1/namespace/{id}/list           ListNamespaces
-POST /v1/namespace/{id}/describe       DescribeNamespace
-POST /v1/namespace/{id}/drop           DropNamespace         mode: Fail|Skip, behavior: Restrict|Cascade
-POST /v1/namespace/{id}/exists         NamespaceExists
-GET  /v1/namespace/{id}/table/list     ListTables            ?include_declared, ?page_token, ?limit
-GET  /v1/table                         ListAllTables
-POST /v1/table/{id}/declare            DeclareTable
-POST /v1/table/{id}/describe           DescribeTable         ?with_table_uri, ?load_detailed_metadata, ?check_declared
-POST /v1/table/{id}/exists             TableExists
-POST /v1/table/{id}/register           RegisterTable         mode: Create|Overwrite
-POST /v1/table/{id}/deregister         DeregisterTable
-POST /v1/table/{id}/drop               DropTable
-POST /v1/table/{id}/rename             RenameTable
-```
-
-`DescribeTable` with `load_detailed_metadata=false` needs only `location`, which is the
-common case and which we can answer from xattrs alone. With `load_detailed_metadata=true`
-the spec wants `version`, `schema` and `stats`, which means reading the Lance manifest. For
-phase 1, return the fields we can derive from the filer — `version` from the highest entry in
-`_versions/`, given V2 naming is `{u64::MAX - version:020}.manifest` and V1 is
-`{version}.manifest` — and omit `schema`/`stats` rather than fabricating them. The spec
-tolerates a partial response here; it does not tolerate a wrong one.
-
-Phase 2 was the five version operations plus `managed_versioning`; it was built and then
-removed, for the reasons under Commit safety.
-
-Phase 3 is the data plane: `CreateTable`, `InsertIntoTable`, `MergeInsertIntoTable`,
-`UpdateTable`, `DeleteFromTable`, `QueryTable`, `CountTableRows`, and the index and tag
-operations. These exchange Arrow IPC, and more to the point they require reading and writing
-the Lance file format, for which no Go implementation exists. Return `Unsupported` (code 0)
-and say so in the docs. `arrow-go/v18` is already an indirect dependency, so Arrow framing is
-not the blocker — Lance is.
-
-## Does a Lance table need maintenance?
-
-Yes, and one part of it has no Iceberg equivalent. The client exposes three jobs:
-
-- `optimize.compact_files()` — Lance writes a fragment per write batch, so a table fed by
-  small appends accumulates small files exactly the way an Iceberg table does.
-- `optimize.optimize_indices()` — **rows written after an index was built are not covered by
-  it.** A vector search against a stale index silently misses recent data. That is a
-  correctness-shaped failure, not a slow query, and it is specific to what people use Lance
-  for.
-- `cleanup_old_versions()` — every version is retained until something removes it. Lance can
-  do this itself: `optimize.enable_auto_cleanup()` sets it on the dataset, so this one need
-  not be an external job at all.
-
-None of it can run in the Go worker. All three read and rewrite Lance files, which needs
-Lance format code that does not exist in Go, and there is no useful subset either: deciding
-which fragments an old version still references means parsing Lance manifests.
-
-So the maintenance worker must not touch a Lance table, and it declines by reading the format
-the catalog recorded rather than by failing to parse Iceberg metadata.
-
-## The worker can be Rust, and it is not a sidecar
-
-The Go worker is not the only worker. `weed/pb/plugin.proto` defines `PluginControlService`,
-a language-agnostic gRPC stream that external maintenance workers connect on: the worker
-opens `WorkerStream`, sends `WorkerHello` with the job types it can `detect` and `execute`,
-answers `RequestConfigSchema` with a `JobTypeDescriptor`, replies to `RunDetectionRequest`
-with `JobProposal`s and to `ExecuteJobRequest` with `JobProgressUpdate`s and `JobCompleted`.
-`weed worker -admin=host:23646` is the Go reference implementation of exactly that contract,
-from outside the admin process.
-
-Nothing in it is Go-specific, and the Rust toolchain is already in the tree.
-`seaweed-volume/build.rs` compiles protos straight out of `../weed/pb/` with `tonic_build`,
-including `filer.proto`, on tonic 0.12 and prost 0.13. A Lance worker is that same build
-with `plugin.proto` added and the `lance` crate as a dependency — the real one, no FFI and
-no Python.
-
-Three job types, one per real maintenance operation:
-
-| Job type | Calls | Detected from |
-| --- | --- | --- |
-| `lance_compact` | `optimize.compact_files` | fragment count and sizes |
-| `lance_optimize_indices` | `optimize.optimize_indices` | rows an index does not cover |
-| `lance_cleanup_versions` | `cleanup_old_versions` | version count and age |
-
-What the existing machinery then supplies for free is the part worth noticing. Scheduling,
-retries, dedupe by `dedupe_key`, progress reporting, per-job concurrency limits and the
-admin settings page all come from the protocol: a worker that answers `RequestConfigSchema`
-with a descriptor gets its configuration form rendered in the admin UI without a line of Go
-or templ. A Rust worker is a first-class maintenance worker, not an appendage.
-
-The remaining wiring is small and mostly decided already. `RunDetectionRequest` carries a
-`ClusterContext` with filer and S3 addresses plus a free-form `metadata` map, which is where
-the Lance namespace URL goes; the worker lists Lance tables from the namespace, which is the
-catalog of record and already filters by format. It gets at the data by asking
-`DescribeTable` for `storage_options` with `vend_credentials`, so the worker is just another
-client of the STS path rather than a component with its own credentials. And when it commits
-a compaction it goes through `CreateTableVersion` like any other writer, which is what
-managed versioning was for.
-
-## The worker is also the only thing that can describe the table
-
-Admin can render an Iceberg table because it can read Iceberg metadata. It cannot read
-Lance: it knows the dataset's location and its format string, and that is the whole of it.
-The details page showed a location and two empty panels, which is an honest answer and a
-useless one.
-
-The worker already knows. Detection opens every dataset to decide whether it needs
-compacting, so at that moment it holds the schema, the row count, the fragment count and
-the version count. It just had no way to say so — every message on the stream was about
-work.
-
-So `WorkerObservations` is a body on `WorkerToAdminMessage`: a repeated `ObjectObservation`
-of `object_id`, `object_kind`, `format`, and a `ConfigValue` map the worker fills with
-whatever it can cheaply say. Admin keeps the last observation per object and serves it back
-with the time it was taken and the worker that took it. Nothing schedules from it, and it is
-not authoritative — it is a cache with its staleness on the label, which is why the page
-badges it rather than presenting it as metadata it read itself.
-
-The keys are the worker's to choose, which keeps the protocol out of the business of knowing
-what a Lance table is. A worker for any other format admin cannot parse describes itself the
-same way.
-
-## A bucket declares its format
-
-Format was recorded per table, which is enough for the storage layer and not enough for
-anything that has to answer a question about a bucket. The admin UI printed one Iceberg
-endpoint for every bucket, including the ones holding Lance datasets, where that endpoint
-serves nothing; an empty bucket had no format at all.
-
-So `CreateTableBucket` takes an optional `format`, stored with the rest of the bucket
-metadata. Empty means `ICEBERG` - what AWS S3 Tables serves, and therefore what an SDK
-that has never heard of the field means. `CreateTable` refuses another format, and
-`CreateView` refuses outright outside an Iceberg bucket, a view being Iceberg metadata.
-The Lance namespace declares `LANCE` for the buckets it creates.
-
-**Enforced rather than defaulted**, because the point of showing a format at all is the
-endpoint that follows from it, and that endpoint is only truthful if the bucket holds one
-format. **Buckets that already exist stay undeclared** and keep taking anything: nothing is
-migrated, and the UI shows "unset" as a fact about the bucket's age rather than a fault.
-That state is also the only way to hold both formats at once, which is what the
-Iceberg-REST adapter path produces.
-
-## Sample rows are fetched, not cached
-
-The same asymmetry has a second half. Admin renders an Iceberg table's rows by
-reading its Parquet files directly; for Lance it has nothing to read with, so the data
-page offered a Browse Data button that led to an empty grid.
-
-`RequestObjectPreview` / `ObjectPreviewResponse` mirror the config-schema round trip
-already on the stream: admin asks, the worker scans the dataset and hands back rows it
-has already rendered as text, because it is the only side that knows the types. Admin
-picks the worker from the observation store, so the one that last described a table is
-the one asked to read it.
-
-The rows are deliberately not cached, and that is the line between the two channels. An
-observation describes an object, so a copy with a timestamp on it is useful. Rows are the
-object's contents: a copy held in admin would be stale, larger, and nobody's business.
-The page fetches on load, bounded, or says why it cannot.
-
-## The sidecar question
-
-The data plane is a different problem, and this design previously conflated the two.
-Maintenance rides the worker protocol; `QueryTable` and `InsertIntoTable` do not, because
-they are synchronous REST operations on the namespace's own surface. Serving those means a
-Rust process that answers HTTP, either behind the Go namespace as a proxy target or in front
-of it. It would make SeaweedFS a store you can run vector search *in* rather than one you
-read vectors *out of*, which is the larger prize and the reason to keep the option open.
-
-Neither should gate phase 1. Phases 1 and 2 are pure Go over the filer and are worth
-shipping on their own — they are what makes Spark and Ray work.
-
-## Testing
-
-Mirror the Iceberg package: `httptest` plus a fake filer client for the handler tests, in
-`weed/s3api/lance`. Then an integration suite under `test/s3tables/catalog/` next to the
-existing `pyiceberg_test.go`, driving the generated Python `lance-namespace` client against
-a live gateway. Three things that suite must cover and unit tests cannot:
-
-- the storage-options key names actually work, i.e. a client that gets `storage_options` from
-  `DescribeTable` can open the dataset;
-- a table created through the catalog is visible to `lance.dataset()` by URI and to a V1
-  directory-catalog client rooted at the namespace prefix;
-- concurrent writers do not lose a commit, which is the phase-2 acceptance test and the
-  thing that justifies the external manifest store.
-
-Phase 1 is validated: `lance_namespace` 0.11.1 with `impl=rest` drives the namespace,
-`lance.write_dataset` writes to the vended location with the vended `storage_options`, and
-the rows read back. Note that this client version drops `check_declared` and
-`include_declared` on the wire, so `is_only_declared` reads null through it however the
-server behaves.
-
-The commit path is validated at both levels. The mechanism: eight writers race the same
-manifest key through S3 with `If-None-Match: *`, and exactly one wins. The property that
-actually matters, which single-winner exclusivity does not by itself establish: eight
-writers append to one dataset concurrently through lance, and afterwards every batch is
-still there — the losers saw the conflict, rebased, and committed again. That second test
-is also the sequence managed versioning could not complete at all, since its store answers
-"put_if_not_exists is not supported" to the second commit.
-
-One more that belongs in the Iceberg suite, not this one: a Lance dataset registered through
-the Iceberg adapter must survive a full maintenance pass. Reading the code, that test should
-fail today; it has not been run.
-
-## Open questions
-
-- Root-level `ListNamespaces` enumerating table buckets is convenient and is a listing
-  surface we do not have on the Iceberg side. Decide whether it is gated behind a flag.
-- Whether the `.lance` directory suffix is worth the divergence from the Iceberg layout. I
-  think yes — it is what makes the catalog optional — but it means the two catalogs' tables
-  do not look alike on disk, and the admin UI has to know that.
-- Names: our charsets are lowercase-only and Lance identifiers are arbitrary strings. Reject
-  and document, as Iceberg does, or case-fold. Rejecting is right, but see #10734 for how
-  case handling bites when only one side normalizes.
-- Whether to land generic-format registration first. Dropping the `"ICEBERG"` check and
-  letting a table carry an arbitrary format plus a location is smaller than this whole
-  design, gets Delta and Parquet catalogued as a side effect, and turns `Format: "LANCE"`
-  into an ordinary value. The argument against is that it invites tables the maintenance
-  worker cannot service, so it needs a "catalog-only, no maintenance" marker to be honest.

docker/Dockerfile.e2e

@@ -2,21 +2,25 @@ FROM ubuntu:22.04
 
 LABEL author="Chris Lu"
 
+# Use Azure's Ubuntu mirror — much faster than archive.ubuntu.com from GitHub-hosted runners,
+# which have been hanging long enough on Ign:/retry to trip the 10-min step timeout.
 # Note: This e2e test image intentionally runs as root for simplicity and compatibility.
 # Production images (Dockerfile.go_build) use proper user isolation with su-exec.
 # For testing purposes, running as root avoids permission complexities and dependency
 # on Alpine-specific tools like su-exec (not available in Ubuntu repos).
-
-# apt-install prefers Azure's mirror, which archive.ubuntu.com is slow enough from
-# GitHub-hosted runners to justify, and falls through to archive.ubuntu.com when
-# Azure is unreachable - which it periodically is, and Acquire::Retries against a
-# single mirror just retries a dead host. Images built FROM this one install
-# through it for the same reason.
-COPY apt-install /usr/local/bin/apt-install
-RUN chmod +x /usr/local/bin/apt-install && \
-    apt-install curl fio fuse ca-certificates && \
-    rm -rf /tmp/* /var/tmp/*
-
+RUN sed -i 's|http://archive.ubuntu.com/ubuntu|http://azure.archive.ubuntu.com/ubuntu|g; s|http://security.ubuntu.com/ubuntu|http://azure.archive.ubuntu.com/ubuntu|g' /etc/apt/sources.list && \
+    apt-get -o Acquire::http::Timeout=15 update && \
+    DEBIAN_FRONTEND=noninteractive apt-get -o Acquire::http::Timeout=15 install -y \
+    --no-install-recommends \
+    --no-install-suggests \
+    curl \
+    fio \
+    fuse \
+    ca-certificates \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* \
+    && rm -rf /tmp/* \
+    && rm -rf /var/tmp/*
 RUN mkdir -p /etc/seaweedfs /data/filerldb2
 
 COPY ./weed /usr/bin/

docker/Dockerfile.foundationdb_large

@@ -1,4 +1,4 @@
-FROM golang:1.26 AS builder
+FROM golang:1.25 AS builder
 
 RUN apt-get update && \
     apt-get install -y build-essential wget ca-certificates && \

docker/Dockerfile.go_build

@@ -1,6 +1,6 @@
 # Pin the builder to the host arch and cross-compile the (CGO-free) Go binary,
 # so arm64/arm/386 targets skip QEMU emulation of the whole compile.
-FROM --platform=$BUILDPLATFORM golang:1.26-alpine AS builder
+FROM --platform=$BUILDPLATFORM golang:1.25-alpine AS builder
 RUN apk add git g++ fuse
 RUN mkdir -p /go/src/github.com/seaweedfs/
 ARG BRANCH=${BRANCH:-master}
@@ -29,7 +29,6 @@ FROM alpine:3.23 as rust_builder
 ARG TARGETARCH
 ARG TAGS
 COPY weed-volume-prebuilt/ /prebuilt/
-COPY weed-worker-prebuilt/ /prebuilt-worker/
 COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/seaweed-volume /build/seaweed-volume
 COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/weed /build/weed
 WORKDIR /build/seaweed-volume
@@ -48,30 +47,16 @@ RUN if [ -f "/prebuilt/weed-volume-${TARGETARCH}" ]; then \
       echo "Skipping Rust build for $TARGETARCH (unsupported)" && \
       touch /weed-volume; \
     fi
-# The Rust maintenance worker is taken pre-built or not at all: the lance jobs
-# it carries pull in arrow and datafusion, a far larger dependency tree than
-# the image build can carry, so an architecture CI did not build for gets the
-# same empty placeholder the entrypoint refuses to exec.
-RUN if [ -f "/prebuilt-worker/weed-worker-${TARGETARCH}" ]; then \
-      echo "Using pre-built Rust worker for ${TARGETARCH}" && \
-      cp "/prebuilt-worker/weed-worker-${TARGETARCH}" /weed-worker; \
-    else \
-      echo "No pre-built Rust worker for ${TARGETARCH}" && \
-      touch /weed-worker; \
-    fi
-
 # Pre-built binaries arrive via GitHub Actions artifacts, which drop the
 # executable bit, so the copied file is 0644 and exec fails with "Permission
-# denied". Restore it (no-op for the empty placeholders, which stay size 0).
-RUN chmod 0755 /weed-volume /weed-worker
+# denied". Restore it (no-op for the empty placeholder, which stays size 0).
+RUN chmod 0755 /weed-volume
 
 FROM alpine AS final
 LABEL author="Chris Lu"
 COPY --from=builder /go/bin/weed /usr/bin/
 # Copy Rust volume server binary (real binary on amd64/arm64, empty placeholder on other platforms)
 COPY --from=rust_builder /weed-volume /usr/bin/weed-volume
-# Same for the Rust maintenance worker, which serves Lance table buckets
-COPY --from=rust_builder /weed-worker /usr/bin/weed-worker
 RUN mkdir -p /etc/seaweedfs
 COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/docker/filer.toml /etc/seaweedfs/filer.toml
 COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/docker/entrypoint.sh /entrypoint.sh

docker/Dockerfile.rocksdb_dev_env

@@ -1,4 +1,4 @@
-FROM golang:1.26 AS builder
+FROM golang:1.25 AS builder
 
 RUN apt-get update
 RUN apt-get install -y build-essential libsnappy-dev zlib1g-dev libbz2-dev libgflags-dev liblz4-dev libzstd-dev

docker/Dockerfile.rocksdb_large

@@ -1,4 +1,4 @@
-FROM golang:1.26 AS builder
+FROM golang:1.25 AS builder
 
 RUN apt-get update
 RUN apt-get install -y build-essential libsnappy-dev zlib1g-dev libbz2-dev libgflags-dev liblz4-dev libzstd-dev

docker/apt-install

@@ -1,25 +0,0 @@
-#!/bin/sh
-# Install packages, falling through to the next Ubuntu mirror when one is
-# unreachable. See docker/Dockerfile.e2e.
-set -e
-
-# Every rewrite starts from the pristine list, so a mirror that just failed does
-# not become the pattern the next rewrite has to match.
-[ -f /etc/apt/sources.list.orig ] || cp /etc/apt/sources.list /etc/apt/sources.list.orig
-
-for mirror in azure.archive.ubuntu.com archive.ubuntu.com; do
-	# Any archive host, so this works whether the pristine list came from the
-	# base image (archive.ubuntu.com) or a CI runner (azure.archive.ubuntu.com).
-	sed "s|http://[a-z0-9.]*archive\.ubuntu\.com/ubuntu|http://$mirror/ubuntu|g; s|http://security\.ubuntu\.com/ubuntu|http://$mirror/ubuntu|g" \
-		/etc/apt/sources.list.orig > /etc/apt/sources.list
-	if apt-get -o Acquire::Retries=3 -o Acquire::http::Timeout=15 update && \
-		DEBIAN_FRONTEND=noninteractive apt-get -o Acquire::Retries=3 -o Acquire::http::Timeout=15 install -y \
-			--no-install-recommends --no-install-suggests "$@"; then
-		apt-get clean
-		rm -rf /var/lib/apt/lists/*
-		exit 0
-	fi
-	echo "apt: $mirror unreachable, trying the next mirror" >&2
-done
-
-exit 1

docker/entrypoint.sh

@@ -90,16 +90,6 @@ case "$1" in
   	exec /usr/bin/weed-volume $ARGS $@
 	;;
 
-  'worker-rust')
-  	shift
-  	if [ ! -s /usr/bin/weed-worker ]; then
-  	  echo "Error: Rust maintenance worker is not available on this platform ($(uname -m))." >&2
-  	  echo "Use 'worker' for the Go maintenance worker instead." >&2
-  	  exit 1
-  	fi
-  	exec /usr/bin/weed-worker "$@"
-	;;
-
   'server')
   	ARGS="-dir=/data -volume.max=0 -master.volumeSizeLimitMB=1024"
   	if isArgPassed "-volume.max" "$@"; then

docker/prometheus/prometheus.yml

@@ -11,8 +11,4 @@ scrape_configs:
           - 'master:9324'
           - 'volume:9325'
           - 'filer:9326'
-          - 's3:9327'
-          # A plugin worker publishes its own metrics when started with
-          # -metricsPort (Go) or --metrics-port (Rust). 9328 continues the
-          # series, since 9327 is already the S3 gateway's.
-          # - 'worker:9328'
+          - 's3:9327'

docker/tarantool/storage.lua

@@ -46,7 +46,7 @@ local filer_metadata = {
     delete_by_directory_idx = function(directory)
         local space = box.space.filer_metadata
         local index = space.index.directory_idx
-        -- for each found directory
+        -- for each finded directories
         for _, tuple in index:pairs({ directory }, { iterator = 'EQ' }) do
             space:delete({ tuple[1], tuple[3] })
         end
@@ -64,7 +64,7 @@ local filer_metadata = {
         end
         -- init results
         local results = {}
-        -- for each found directory
+        -- for each finded directories
         for _, tuple in directory_idx:pairs({ dirPath }, { iterator = 'EQ' }) do
             -- filter by name
             if filter_filename_func(tuple[3]) then

go.mod

@@ -1,18 +1,19 @@
 module github.com/seaweedfs/seaweedfs
 
-go 1.26
+go 1.25.8
 
 require (
 	cloud.google.com/go v0.123.0 // indirect
-	cloud.google.com/go/pubsub v1.51.1
-	cloud.google.com/go/storage v1.64.0
+	cloud.google.com/go/pubsub v1.50.2
+	cloud.google.com/go/storage v1.62.3
 	github.com/Shopify/sarama v1.38.1
 	github.com/aws/aws-sdk-go v1.55.8
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bwmarrin/snowflake v0.3.0
 	github.com/cenkalti/backoff/v4 v4.3.0
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/coreos/go-semver v0.3.1 // indirect
-	github.com/coreos/go-systemd/v22 v22.7.0 // indirect
+	github.com/coreos/go-systemd/v22 v22.6.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/dustin/go-humanize v1.0.1
 	github.com/eapache/go-resiliency v1.6.0 // indirect
@@ -32,7 +33,7 @@ require (
 	github.com/google/btree v1.1.3
 	github.com/google/uuid v1.6.0
 	github.com/google/wire v0.7.0 // indirect
-	github.com/googleapis/gax-go/v2 v2.24.0 // indirect
+	github.com/googleapis/gax-go/v2 v2.23.0 // indirect
 	github.com/gorilla/mux v1.8.1
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
@@ -44,12 +45,12 @@ require (
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/json-iterator/go v1.1.12
 	github.com/karlseguin/ccache/v2 v2.0.8
-	github.com/klauspost/compress v1.19.1
+	github.com/klauspost/compress v1.19.0
 	github.com/klauspost/reedsolomon v1.14.1
 	github.com/kurin/blazer v0.5.3
 	github.com/linxGnu/grocksdb v1.10.8
-	github.com/mailru/easyjson v0.9.2 // indirect
-	github.com/mattn/go-isatty v0.0.24 // indirect
+	github.com/mailru/easyjson v0.9.1 // indirect
+	github.com/mattn/go-isatty v0.0.22 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/olivere/elastic/v7 v7.0.32
@@ -58,14 +59,14 @@ require (
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/posener/complete v1.2.3
 	github.com/pquerna/cachecontrol v0.2.0
-	github.com/prometheus/client_golang v1.24.1
+	github.com/prometheus/client_golang v1.24.0
 	github.com/prometheus/client_model v0.6.2
-	github.com/prometheus/common v0.70.1 // indirect
+	github.com/prometheus/common v0.70.0 // indirect
 	github.com/prometheus/procfs v0.21.1
 	github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
-	github.com/seaweedfs/goexif v2.0.0+incompatible
-	github.com/seaweedfs/raft v1.2.0
+	github.com/seaweedfs/goexif v1.0.3
+	github.com/seaweedfs/raft v1.1.8
 	github.com/sirupsen/logrus v1.9.4 // indirect
 	github.com/spf13/afero v1.15.0 // indirect
 	github.com/spf13/cast v1.10.0 // indirect
@@ -84,52 +85,51 @@ require (
 	github.com/xdg-go/scram v1.2.0
 	github.com/xdg-go/stringprep v1.0.4 // indirect
 	github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect
-	go.etcd.io/etcd/client/v3 v3.7.1
+	go.etcd.io/etcd/client/v3 v3.6.12
 	go.mongodb.org/mongo-driver v1.17.9
 	go.opencensus.io v0.24.0 // indirect
 	gocloud.dev v0.46.0
 	gocloud.dev/pubsub/natspubsub v0.46.0
 	gocloud.dev/pubsub/rabbitpubsub v0.46.0
-	golang.org/x/crypto v0.55.0
-	golang.org/x/exp v0.0.0-20260709172345-9ea1abe57597
-	golang.org/x/image v0.44.0
-	golang.org/x/net v0.58.0
+	golang.org/x/crypto v0.54.0
+	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f
+	golang.org/x/image v0.43.0
+	golang.org/x/net v0.57.0
 	golang.org/x/oauth2 v0.36.0
 	golang.org/x/sys v0.47.0
-	golang.org/x/text v0.41.0 // indirect
-	golang.org/x/tools v0.48.0 // indirect
+	golang.org/x/text v0.40.0 // indirect
+	golang.org/x/tools v0.47.0 // indirect
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
-	google.golang.org/api v0.294.0
-	google.golang.org/genproto v0.0.0-20260715232425-e75dac1f907d // indirect
-	google.golang.org/grpc v1.85.0-dev
-	google.golang.org/protobuf v1.36.12
+	google.golang.org/api v0.289.0
+	google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 // indirect
+	google.golang.org/grpc v1.82.0
+	google.golang.org/protobuf v1.36.11
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	modernc.org/b v1.0.0 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.11.0 // indirect
-	modernc.org/sqlite v1.57.0
+	modernc.org/sqlite v1.53.0
 )
 
 require (
-	cloud.google.com/go/kms v1.33.0
+	cloud.google.com/go/kms v1.31.0
 	github.com/Azure/azure-sdk-for-go/sdk/keyvault/azkeys v0.10.0
 	github.com/DATA-DOG/go-sqlmock v1.5.2
 	github.com/Jille/raft-grpc-transport v1.6.1
-	github.com/ThreeDotsLabs/watermill v1.5.2
+	github.com/ThreeDotsLabs/watermill v1.5.1
 	github.com/a-h/templ v0.3.1020
 	github.com/apache/cassandra-gocql-driver/v2 v2.1.2
 	github.com/apache/iceberg-go v0.6.0
 	github.com/apple/foundationdb/bindings/go v0.0.0-20250911184653-27f7192f47c3
 	github.com/arangodb/go-driver v1.6.9
 	github.com/armon/go-metrics v0.4.1
-	github.com/aws/aws-sdk-go-v2 v1.45.1
-	github.com/aws/aws-sdk-go-v2/config v1.32.33
-	github.com/aws/aws-sdk-go-v2/credentials v1.19.34
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.105.2
-	github.com/cespare/xxhash/v2 v2.3.0
+	github.com/aws/aws-sdk-go-v2 v1.42.1
+	github.com/aws/aws-sdk-go-v2/config v1.32.25
+	github.com/aws/aws-sdk-go-v2/credentials v1.19.28
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.102.2
 	github.com/cognusion/imaging v1.0.4
 	github.com/fluent/fluent-logger-golang v1.10.1
-	github.com/getsentry/sentry-go v0.48.0
+	github.com/getsentry/sentry-go v0.44.1
 	github.com/go-ldap/ldap/v3 v3.4.13
 	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/google/flatbuffers/go v0.0.0-20230108230133-3b8644d32c50
@@ -141,23 +141,23 @@ require (
 	github.com/linkedin/goavro/v2 v2.15.0
 	github.com/minio/crc64nvme v1.1.1
 	github.com/orcaman/concurrent-map/v2 v2.0.1
-	github.com/parquet-go/parquet-go v0.32.0
+	github.com/parquet-go/parquet-go v0.30.1
 	github.com/pkg/sftp v1.13.11
-	github.com/rabbitmq/amqp091-go v1.14.0
-	github.com/rclone/rclone v1.75.0
+	github.com/rabbitmq/amqp091-go v1.11.0
+	github.com/rclone/rclone v1.74.3
 	github.com/rdleal/intervalst v1.5.0
 	github.com/redis/go-redis/v9 v9.21.0
 	github.com/schollz/progressbar/v3 v3.19.1
-	github.com/seaweedfs/go-fuse/v2 v2.9.4
-	github.com/shirou/gopsutil/v4 v4.26.7
+	github.com/seaweedfs/go-fuse/v2 v2.9.3
+	github.com/shirou/gopsutil/v4 v4.26.5
 	github.com/tarantool/go-option v1.1.0
-	github.com/tarantool/go-tarantool/v3 v3.0.1
+	github.com/tarantool/go-tarantool/v3 v3.0.0
 	github.com/testcontainers/testcontainers-go v0.43.0
 	github.com/tikv/client-go/v2 v2.0.7
 	github.com/xeipuuv/gojsonschema v1.2.0
 	github.com/ydb-platform/ydb-go-sdk-auth-environ v0.5.2
-	github.com/ydb-platform/ydb-go-sdk/v3 v3.151.1
-	go.etcd.io/etcd/client/pkg/v3 v3.7.1
+	github.com/ydb-platform/ydb-go-sdk/v3 v3.144.5
+	go.etcd.io/etcd/client/pkg/v3 v3.6.12
 	go.uber.org/atomic v1.11.0
 	golang.org/x/sync v0.22.0
 	golang.org/x/tools/godoc v0.1.0-deprecated
@@ -170,30 +170,29 @@ require (
 	atomicgo.dev/cursor v0.2.0 // indirect
 	atomicgo.dev/keyboard v0.2.9 // indirect
 	atomicgo.dev/schedule v0.1.0 // indirect
-	cloud.google.com/go/longrunning v1.2.0 // indirect
-	cloud.google.com/go/pubsub/v2 v2.6.0 // indirect
+	cloud.google.com/go/longrunning v0.9.0 // indirect
+	cloud.google.com/go/pubsub/v2 v2.4.0 // indirect
 	dario.cat/mergo v1.0.2 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/keyvault/internal v0.7.1 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
 	github.com/FilenCloudDienste/filen-sdk-go v0.0.39 // indirect
-	github.com/ProtonMail/gopenpgp/v3 v3.4.1 // indirect
 	github.com/a1ex3/zstd-seekable-format-go/pkg v0.10.0 // indirect
 	github.com/adrg/xdg v0.5.3 // indirect
-	github.com/anchore/go-lzo v0.1.1 // indirect
+	github.com/anchore/go-lzo v0.1.0 // indirect
 	github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
-	github.com/apache/arrow-go/v18 v18.7.0 // indirect
-	github.com/apache/thrift v0.24.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/signin v1.5.4 // indirect
+	github.com/apache/arrow-go/v18 v18.6.0 // indirect
+	github.com/apache/thrift v0.23.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/signin v1.4.0 // indirect
 	github.com/bahlo/generic-list-go v0.2.0 // indirect
 	github.com/bazelbuild/rules_go v0.46.0 // indirect
 	github.com/biogo/store v0.0.0-20201120204734-aad293a2328f // indirect
 	github.com/blevesearch/snowballstem v0.9.0 // indirect
 	github.com/boombuler/barcode v1.1.0 // indirect
-	github.com/buger/jsonparser v1.2.0 // indirect
+	github.com/buger/jsonparser v1.1.2 // indirect
 	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
 	github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
 	github.com/cockroachdb/apd/v3 v3.2.1 // indirect
-	github.com/cockroachdb/errors v1.14.0 // indirect
+	github.com/cockroachdb/errors v1.11.3 // indirect
 	github.com/cockroachdb/logtags v0.0.0-20241215232642-bb51bb14a506 // indirect
 	github.com/cockroachdb/redact v1.1.5 // indirect
 	github.com/cockroachdb/version v0.0.0-20250314144055-3860cd14adf2 // indirect
@@ -204,7 +203,7 @@ require (
 	github.com/containerd/platforms v1.0.0-rc.4 // indirect
 	github.com/cpuguy83/dockercfg v0.3.2 // indirect
 	github.com/dave/dst v0.27.2 // indirect
-	github.com/diskfs/go-diskfs v1.9.4 // indirect
+	github.com/diskfs/go-diskfs v1.7.0 // indirect
 	github.com/distribution/reference v0.6.0 // indirect
 	github.com/docker/go-connections v0.6.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
@@ -223,7 +222,7 @@ require (
 	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
 	github.com/hashicorp/go-sockaddr v1.0.7 // indirect
 	github.com/hashicorp/hcl v1.0.1-vault-7 // indirect
-	github.com/internxt/rclone-adapter v0.0.0-20260708165336-dd6561bacfa2 // indirect
+	github.com/internxt/rclone-adapter v0.0.0-20260331173834-036f908d0160 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
@@ -235,18 +234,16 @@ require (
 	github.com/lib/pq v1.12.0 // indirect
 	github.com/lithammer/fuzzysearch v1.1.8 // indirect
 	github.com/lithammer/shortuuid/v3 v3.0.7 // indirect
-	github.com/lpar/calendar v0.2.0 // indirect
 	github.com/magiconair/properties v1.8.10 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
-	github.com/moby/go-archive v0.3.0 // indirect
+	github.com/moby/go-archive v0.2.0 // indirect
 	github.com/moby/moby/api v1.54.2 // indirect
 	github.com/moby/moby/client v0.4.0 // indirect
 	github.com/moby/patternmatcher v0.6.1 // indirect
-	github.com/moby/sys/sequential v0.7.0 // indirect
-	github.com/moby/sys/user v0.4.1 // indirect
+	github.com/moby/sys/sequential v0.6.0 // indirect
+	github.com/moby/sys/user v0.4.0 // indirect
 	github.com/moby/sys/userns v0.1.0 // indirect
 	github.com/moby/term v0.5.2 // indirect
-	github.com/oklog/ulid/v2 v2.1.1 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
 	github.com/openzipkin/zipkin-go v0.4.3 // indirect
@@ -257,17 +254,15 @@ require (
 	github.com/pquerna/otp v1.5.0 // indirect
 	github.com/pterm/pterm v0.12.83 // indirect
 	github.com/quic-go/qpack v0.6.0 // indirect
-	github.com/rclone/Proton-API-Bridge v1.0.4 // indirect
-	github.com/rclone/go-proton-api v1.0.3 // indirect
-	github.com/rogpeppe/go-internal v1.15.0 // indirect
-	github.com/rwcarlsen/goexif v0.0.0-20190401172101-9e8deecbddbd // indirect
+	github.com/rclone/Proton-API-Bridge v1.0.3 // indirect
+	github.com/rclone/go-proton-api v1.0.2 // indirect
+	github.com/rogpeppe/go-internal v1.14.1 // indirect
 	github.com/ryanuber/go-glob v1.0.0 // indirect
 	github.com/sasha-s/go-deadlock v0.3.1 // indirect
 	github.com/smarty/assertions v1.15.0 // indirect
-	github.com/sony/gobreaker/v2 v2.4.0 // indirect
 	github.com/stretchr/objx v0.5.3 // indirect
 	github.com/substrait-io/substrait v0.87.0 // indirect
-	github.com/substrait-io/substrait-go/v8 v8.1.1 // indirect
+	github.com/substrait-io/substrait-go/v8 v8.1.0 // indirect
 	github.com/substrait-io/substrait-protobuf/go v0.85.0 // indirect
 	github.com/twmb/avro v1.7.2 // indirect
 	github.com/twpayne/go-geom v1.6.1 // indirect
@@ -286,66 +281,69 @@ require (
 	go.uber.org/mock v0.5.2 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/mod v0.38.0 // indirect
+	golang.org/x/mod v0.37.0 // indirect
 	gonum.org/v1/gonum v0.17.0 // indirect
 )
 
 require (
-	cel.dev/expr v0.25.2 // indirect
-	cloud.google.com/go/auth v0.23.2 // indirect
+	cel.dev/expr v0.25.1 // indirect
+	cloud.google.com/go/auth v0.20.0 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
 	cloud.google.com/go/compute/metadata v0.9.0 // indirect
-	cloud.google.com/go/iam v1.12.0 // indirect
-	cloud.google.com/go/monitoring v1.30.0 // indirect
+	cloud.google.com/go/iam v1.7.0 // indirect
+	cloud.google.com/go/monitoring v1.24.3 // indirect
 	filippo.io/edwards25519 v1.2.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0
 	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0
 	github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.8.0
-	github.com/Azure/azure-sdk-for-go/sdk/storage/azfile v1.7.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/storage/azfile v1.5.4 // indirect
 	github.com/Azure/go-ntlmssp v0.1.1 // indirect
 	github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2 // indirect
-	github.com/Files-com/files-sdk-go/v3 v3.3.194 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.34.0 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.57.0 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.57.0 // indirect
-	github.com/IBM/go-sdk-core/v5 v5.23.1 // indirect
+	github.com/Files-com/files-sdk-go/v3 v3.3.82 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.32.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0 // indirect
+	github.com/IBM/go-sdk-core/v5 v5.21.2 // indirect
 	github.com/Max-Sum/base32768 v0.0.0-20230304063302-18e6ce5945fd // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/ProtonMail/bcrypt v0.0.0-20211005172633-e235017c1baf // indirect
 	github.com/ProtonMail/gluon v0.17.1-0.20230724134000-308be39be96e // indirect
 	github.com/ProtonMail/go-crypto v1.4.1 // indirect
+	github.com/ProtonMail/go-mime v0.0.0-20230322103455-7d82a3887f2f // indirect
 	github.com/ProtonMail/go-srp v0.0.7 // indirect
-	github.com/PuerkitoBio/goquery v1.12.0 // indirect
+	github.com/ProtonMail/gopenpgp/v2 v2.9.0 // indirect
+	github.com/PuerkitoBio/goquery v1.11.0 // indirect
 	github.com/abbot/go-http-auth v0.4.0 // indirect
-	github.com/andybalholm/brotli v1.2.2 // indirect
-	github.com/andybalholm/cascadia v1.3.4 // indirect
+	github.com/andybalholm/brotli v1.2.1 // indirect
+	github.com/andybalholm/cascadia v1.3.3 // indirect
 	github.com/appscode/go-querystring v0.0.0-20170504095604-0126cfb3f1dc // indirect
 	github.com/arangodb/go-velocypack v0.0.0-20200318135517-5af53c29c67e // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.14 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.35 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.22.34 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.35 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.35 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.36 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.15 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.23 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.35 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.31 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.11 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.30 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.22.13 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.30 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.30 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.31 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.13 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.18 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.30 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.25 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sns v1.39.14 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sqs v1.42.24 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.33.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.45.4
-	github.com/aws/smithy-go v1.28.1
+	github.com/aws/aws-sdk-go-v2/service/sso v1.32.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.37.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.44.0
+	github.com/aws/smithy-go v1.27.3
 	github.com/boltdb/bolt v1.3.1 // indirect
 	github.com/bradenaw/juniper v0.15.3 // indirect
+	github.com/bradfitz/iter v0.0.0-20191230175014-e8f45d346db8 // indirect
 	github.com/buengese/sgzip v0.1.1 // indirect
 	github.com/calebcase/tmpfile v1.0.3 // indirect
 	github.com/chilts/sid v0.0.0-20190607042430-660e94789ec9 // indirect
-	github.com/cloudflare/circl v1.6.4 // indirect
-	github.com/cloudinary/cloudinary-go/v2 v2.16.0 // indirect
-	github.com/cloudsoda/go-smb2 v0.0.0-20260701064823-d8c5600d73b8 // indirect
+	github.com/cloudflare/circl v1.6.3 // indirect
+	github.com/cloudinary/cloudinary-go/v2 v2.15.0 // indirect
+	github.com/cloudsoda/go-smb2 v0.0.0-20250228001242-d4c70e6251cc // indirect
 	github.com/cloudsoda/sddl v0.0.0-20250224235906-926454e91efc // indirect
 	github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 // indirect
 	github.com/colinmarc/hdfs/v2 v2.4.0 // indirect
@@ -354,29 +352,29 @@ require (
 	github.com/cznic/mathutil v0.0.0-20181122101859-297441e03548 // indirect
 	github.com/d4l3k/messagediff v1.2.1 // indirect
 	github.com/dgryski/go-farm v0.0.0-20200201041132-a6ae2369ad13 // indirect
-	github.com/dropbox/dropbox-sdk-go-unofficial/v6 v6.4.0 // indirect
-	github.com/ebitengine/purego v0.10.2 // indirect
+	github.com/dropbox/dropbox-sdk-go-unofficial/v6 v6.0.5 // indirect
+	github.com/ebitengine/purego v0.10.0 // indirect
 	github.com/elastic/gosigar v0.14.3 // indirect
 	github.com/emersion/go-message v0.18.2 // indirect
-	github.com/emersion/go-vcard v0.0.0-20260618161152-d854b7e0e2d3 // indirect
+	github.com/emersion/go-vcard v0.0.0-20241024213814-c9703dde27ff // indirect
 	github.com/envoyproxy/go-control-plane/envoy v1.37.0 // indirect
 	github.com/envoyproxy/protoc-gen-validate v1.3.3 // indirect
 	github.com/fatih/color v1.18.0 // indirect
-	github.com/felixge/httpsnoop v1.1.0 // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/flynn/noise v1.1.0 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.13 // indirect
 	github.com/geoffgarside/ber v1.2.0 // indirect
-	github.com/go-chi/chi/v5 v5.3.1 // indirect
+	github.com/go-chi/chi/v5 v5.2.5 // indirect
 	github.com/go-darwin/apfs v0.0.0-20211011131704-f84b94dbf348 // indirect
 	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-ole/go-ole v1.3.0 // indirect
-	github.com/go-openapi/errors v0.22.8 // indirect
-	github.com/go-openapi/strfmt v0.27.0 // indirect
+	github.com/go-openapi/errors v0.22.6 // indirect
+	github.com/go-openapi/strfmt v0.25.0 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
 	github.com/go-playground/universal-translator v0.18.1 // indirect
-	github.com/go-playground/validator/v10 v10.30.3 // indirect
+	github.com/go-playground/validator/v10 v10.30.1 // indirect
 	github.com/go-resty/resty/v2 v2.17.2 // indirect
 	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
 	github.com/goccy/go-json v0.10.6 // indirect
@@ -384,12 +382,12 @@ require (
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.3.20 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.18 // indirect
 	github.com/gorilla/schema v1.4.1 // indirect
 	github.com/gorilla/securecookie v1.1.2 // indirect
 	github.com/gorilla/sessions v1.4.0
 	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-hclog v1.6.3 // indirect
 	github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
@@ -407,16 +405,17 @@ require (
 	github.com/jtolio/noiseconn v0.0.0-20231127013910-f6d9ecbf1de7 // indirect
 	github.com/jzelinskie/whirlpool v0.0.0-20201016144138-0675e54bb004 // indirect
 	github.com/k0kubun/pp v3.0.1+incompatible
-	github.com/klauspost/cpuid/v2 v2.4.0 // indirect
+	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
 	github.com/koofr/go-httpclient v0.0.0-20240520111329-e20f8f203988 // indirect
 	github.com/koofr/go-koofrclient v0.0.0-20221207135200-cbd7fc9ad6a6 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/kylelemons/godebug v1.1.0 // indirect
 	github.com/lanrat/extsort v1.4.2 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
-	github.com/lufia/plan9stats v0.0.0-20260627054121-477a66015f15 // indirect
-	github.com/mattn/go-colorable v0.1.15 // indirect
-	github.com/mattn/go-runewidth v0.0.24 // indirect
+	github.com/lpar/date v1.0.0 // indirect
+	github.com/lufia/plan9stats v0.0.0-20260216142805-b3301c5f2a88 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
+	github.com/mattn/go-runewidth v0.0.22 // indirect
 	github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/mitchellh/mapstructure v1.5.1-0.20220423185008-bf980b35cac4
@@ -431,13 +430,13 @@ require (
 	github.com/oklog/ulid v1.3.1 // indirect
 	github.com/onsi/ginkgo/v2 v2.23.3 // indirect
 	github.com/opentracing/opentracing-go v1.2.0 // indirect
-	github.com/oracle/oci-go-sdk/v65 v65.121.0 // indirect
-	github.com/panjf2000/ants/v2 v2.12.1 // indirect
+	github.com/oracle/oci-go-sdk/v65 v65.111.0 // indirect
+	github.com/panjf2000/ants/v2 v2.11.5 // indirect
 	github.com/patrickmn/go-cache v2.1.0+incompatible // indirect
 	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/pengsrc/go-shared v0.2.1-0.20190131101655-1999055a4a14 // indirect
 	github.com/philhofer/fwd v1.2.0 // indirect
-	github.com/pierrec/lz4/v4 v4.1.28
+	github.com/pierrec/lz4/v4 v4.1.27
 	github.com/pingcap/errors v0.11.5-0.20211224045212-9687c2b0f87c // indirect
 	github.com/pingcap/failpoint v0.0.0-20220801062533-2eaa32854a6c // indirect
 	github.com/pingcap/kvproto v0.0.0-20230403051650-e166ae588106 // indirect
@@ -452,42 +451,41 @@ require (
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06 // indirect
 	github.com/sagikazarmark/locafero v0.11.0 // indirect
-	github.com/samber/lo v1.53.0 // indirect
+	github.com/samber/lo v1.52.0 // indirect
 	github.com/seaweedfs/cockroachdb-parser v0.0.0-20260225204133-2f342c5ea564
 	github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 // indirect
 	github.com/sony/gobreaker v1.0.0 // indirect
 	github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect
 	github.com/spacemonkeygo/monkit/v3 v3.0.25-0.20251022131615-eb24eb109368 // indirect
 	github.com/spf13/pflag v1.0.10 // indirect
-	github.com/spiffe/go-spiffe/v2 v2.8.1 // indirect
+	github.com/spiffe/go-spiffe/v2 v2.6.0 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
-	github.com/t3rm1n4l/go-mega v0.0.0-20260717075258-c6acd6a5bd04 // indirect
+	github.com/t3rm1n4l/go-mega v0.0.0-20251120131202-6845944c051c // indirect
 	github.com/tarantool/go-iproto v1.1.0 // indirect
 	github.com/tiancaiamao/gp v0.0.0-20221230034425-4025bc8a4d4a // indirect
 	github.com/tikv/pd/client v0.0.0-20230329114254-1948c247c2b1 // indirect
-	github.com/tinylib/msgp v1.6.4 // indirect
-	github.com/tklauser/go-sysconf v0.4.0 // indirect
-	github.com/tklauser/numcpus v0.12.0 // indirect
+	github.com/tinylib/msgp v1.6.3 // indirect
+	github.com/tklauser/go-sysconf v0.3.16 // indirect
+	github.com/tklauser/numcpus v0.11.0 // indirect
 	github.com/twmb/murmur3 v1.1.8 // indirect
 	github.com/unknwon/goconfig v1.0.0 // indirect
 	github.com/vmihailenco/msgpack/v5 v5.4.1 // indirect
 	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
-	github.com/winfsp/cgofuse v1.6.1-0.20260126094232-f2c4fccdb286
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
 	github.com/yandex-cloud/go-genproto v0.0.0-20211115083454-9ca41db5ed9e // indirect
-	github.com/ydb-platform/ydb-go-genproto v0.0.0-20260810122915-65bfd5c4b705 // indirect
+	github.com/ydb-platform/ydb-go-genproto v0.0.0-20260428144813-1c07baab7f7b // indirect
 	github.com/ydb-platform/ydb-go-yc v0.12.1 // indirect
 	github.com/ydb-platform/ydb-go-yc-metadata v0.6.1 // indirect
 	github.com/yunify/qingstor-sdk-go/v3 v3.2.0 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
 	github.com/zeebo/blake3 v0.2.4 // indirect
 	github.com/zeebo/errs v1.4.0 // indirect
-	go.etcd.io/bbolt v1.5.0 // indirect
-	go.etcd.io/etcd/api/v3 v3.7.1 // indirect
+	go.etcd.io/bbolt v1.4.3 // indirect
+	go.etcd.io/etcd/api/v3 v3.6.12 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/detectors/gcp v1.44.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 // indirect
+	go.opentelemetry.io/contrib/detectors/gcp v1.43.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 // indirect
 	go.opentelemetry.io/otel v1.44.0 // indirect
 	go.opentelemetry.io/otel/metric v1.44.0 // indirect
 	go.opentelemetry.io/otel/sdk v1.44.0 // indirect
@@ -497,21 +495,21 @@ require (
 	go.uber.org/zap v1.27.1 // indirect
 	golang.org/x/term v0.45.0
 	golang.org/x/time v0.15.0
-	google.golang.org/genproto/googleapis/api v0.0.0-20260715232425-e75dac1f907d // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800 // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
 	gopkg.in/validator.v2 v2.0.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	modernc.org/libc v1.74.4 // indirect
+	modernc.org/libc v1.73.4 // indirect
 	moul.io/http2curl/v2 v2.3.0 // indirect
 	sigs.k8s.io/yaml v1.6.0 // indirect
-	storj.io/common v0.0.0-20260629224719-ba1bff0a7846 // indirect
-	storj.io/drpc v1.0.0 // indirect
-	storj.io/eventkit v0.0.0-20260716074419-6861a92e2aa5 // indirect
+	storj.io/common v0.0.0-20260225132117-99155641c30a // indirect
+	storj.io/drpc v0.0.35-0.20250513201419-f7819ea69b55 // indirect
+	storj.io/eventkit v0.0.0-20250410172343-61f26d3de156 // indirect
 	storj.io/infectious v0.0.2 // indirect
 	storj.io/picobuf v0.0.4 // indirect
-	storj.io/uplink v1.14.3 // indirect
+	storj.io/uplink v1.14.0 // indirect
 )
 
 // replace github.com/seaweedfs/raft => /Users/chrislu/go/src/github.com/seaweedfs/raft

install.sh

@@ -9,7 +9,7 @@
 #   curl -fsSL ... | bash -s -- --version 4.34 --dir /usr/local/bin
 #
 # Options:
-#   --component COMP   Which binary to install: weed, volume-rust, worker-rust, all (default: weed)
+#   --component COMP   Which binary to install: weed, volume-rust, all (default: weed)
 #   --version VER      Release version tag (default: latest)
 #   --large-disk       Use large disk variant (5-byte offset, 8TB max volume)
 #   --dir DIR          Installation directory (default: /usr/local/bin)
@@ -22,7 +22,6 @@ COMPONENT="weed"
 VERSION=""
 LARGE_DISK=false
 INSTALL_DIR="/usr/local/bin"
-WORKER_INSTALLED=false
 
 # Colors (if terminal supports them)
 if [ -t 1 ]; then
@@ -129,33 +128,6 @@ rust_asset_name() {
     fi
 }
 
-# Does a release carry this asset? Answers 0 for yes and 1 for a 404, and stops
-# the installer on anything else: a rate limit or a network blip must not read
-# as "this release predates the binary" and quietly skip it.
-asset_exists() {
-    local url="$1" code=""
-    if command -v curl &>/dev/null; then
-        code="$(curl -sL -o /dev/null -I -w '%{http_code}' "$url" || true)"
-    elif command -v wget &>/dev/null; then
-        # --spider's exit status folds 404 in with every other server error, so
-        # read the status line itself; -S prints one per redirect hop.
-        code="$(wget -S --spider -q -O /dev/null "$url" 2>&1 | awk '/^ *HTTP\// {c=$2} END {print c}')"
-    fi
-
-    case "$code" in
-        200) return 0 ;;
-        404) return 1 ;;
-        *)   error "Could not check ${url} (HTTP ${code:-none}). Retry, or install components one at a time." ;;
-    esac
-}
-
-# Build Rust maintenance worker asset name. No large-disk variant: the worker
-# maintains tables through the namespace and never opens a volume file.
-worker_asset_name() {
-    local os="$1" arch="$2"
-    echo "weed-worker_${os}_${arch}.tar.gz"
-}
-
 # Install a single component
 install_component() {
     local component="$1" os="$2" arch="$3"
@@ -232,48 +204,10 @@ install_component() {
             ok "Installed weed-volume to ${INSTALL_DIR}/${dest_name}"
             ;;
 
-        worker-rust)
-            # Published for linux only: the worker runs beside the cluster it
-            # maintains, and its dependency tree makes every extra target an
-            # expensive build.
-            case "$os" in
-                linux) ;;
-                *) error "Rust maintenance worker is not available for ${os}. Supported: linux" ;;
-            esac
-            case "$arch" in
-                amd64|arm64) ;;
-                *) error "Rust maintenance worker is not available for ${arch}. Supported: amd64, arm64" ;;
-            esac
-
-            asset_name="$(worker_asset_name "$os" "$arch")"
-            download_url="https://github.com/${REPO}/releases/download/${VERSION}/${asset_name}"
-            download "$download_url" "${tmpdir}/${asset_name}"
-
-            info "Extracting ${asset_name}..."
-            tar xzf "${tmpdir}/${asset_name}" -C "$tmpdir"
-
-            local worker_bin
-            worker_bin="$(find "$tmpdir" -name 'weed-worker' -type f | head -1)"
-            if [ -z "$worker_bin" ]; then
-                error "Could not find weed-worker binary in archive"
-            fi
-
-            chmod +x "$worker_bin"
-            install_binary "$worker_bin" "weed-worker"
-            WORKER_INSTALLED=true
-            ok "Installed weed-worker to ${INSTALL_DIR}/weed-worker"
-            ;;
-
         *)
-            error "Unknown component: ${component}. Use: weed, volume-rust, worker-rust, all"
+            error "Unknown component: ${component}. Use: weed, volume-rust, all"
             ;;
     esac
-
-    # The trap is per-process, so a later component's would replace this one and
-    # leave the earlier extraction behind. Clean up here and hand the trap back;
-    # the error paths above exit, which still fires it.
-    rm -rf "$tmpdir"
-    trap - EXIT
 }
 
 # Copy binary to install dir, using sudo if needed
@@ -317,16 +251,6 @@ main() {
         all)
             install_component "weed" "$os" "$arch"
             install_component "volume-rust" "$os" "$arch"
-            # The worker is published for linux amd64/arm64 only, and only by
-            # releases new enough to carry it; skip either case rather than fail
-            # an install that has already put two binaries in place.
-            if [ "$os" != "linux" ] || { [ "$arch" != "amd64" ] && [ "$arch" != "arm64" ]; }; then
-                warn "Skipping the Rust maintenance worker: no build for ${os}/${arch}"
-            elif ! asset_exists "https://github.com/${REPO}/releases/download/${VERSION}/$(worker_asset_name "$os" "$arch")"; then
-                warn "Skipping the Rust maintenance worker: ${VERSION} does not carry one"
-            else
-                install_component "worker-rust" "$os" "$arch"
-            fi
             ;;
         *)
             install_component "$COMPONENT" "$os" "$arch"
@@ -341,17 +265,11 @@ main() {
     if [ "$COMPONENT" = "volume-rust" ] || [ "$COMPONENT" = "all" ]; then
         info "  weed-volume:  ${INSTALL_DIR}/weed-volume"
     fi
-    if [ "$WORKER_INSTALLED" = true ]; then
-        info "  weed-worker:     ${INSTALL_DIR}/weed-worker"
-    fi
     echo ""
     info "Quick start:"
     info "  weed master                          # Start master server"
     info "  weed volume -mserver=localhost:9333   # Start Go volume server"
     info "  weed-volume -mserver localhost:9333 # Start Rust volume server"
-    if [ "$WORKER_INSTALLED" = true ]; then
-        info "  weed-worker --admin localhost:23646  # Start the Rust maintenance worker"
-    fi
 }
 
 main

k8s/charts/seaweedfs/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v1
 description: SeaweedFS
 name: seaweedfs
-appVersion: "4.44"
+appVersion: "4.40"
 # Dev note: Trigger a helm chart release by `git tag -a helm-<version>`
-version: 4.44.0
+version: 4.40.0

k8s/charts/seaweedfs/README.md

@@ -22,8 +22,8 @@ helm install --values=values.yaml seaweedfs seaweedfs/seaweedfs
 ## Info:
 * master/filer/volume are stateful sets with anti-affinity on the hostname,
 so your deployment will be spread/HA.
-* leveldb2 is the default filer backend; a mysql-compatible database (memsql, ...) enables HA (multiple filer instances) and the backup/HA it can provide.
-* with `filer.extraEnvironmentVars.WEED_MYSQL_ENABLED` set to `"true"`, mysql user/password are created in a k8s secret (default: `<release>-seaweedfs-db-secret`) and injected to the filer with ENV. On any other store neither the secret nor the `WEED_MYSQL_*` env, plain or secret-backed, is rendered.
+* chart is using memsql(mysql) as the filer backend to enable HA (multiple filer instances) and backup/HA memsql can provide.
+* mysql user/password are created in a k8s secret (default: `<release>-seaweedfs-db-secret`) and injected to the filer with ENV.
 * cert config exists and can be enabled, but not been tested, requires cert-manager to be installed.
 
 ## Prerequisites
@@ -107,120 +107,6 @@ https://github.com/rancher/local-path-provisioner
 you can use ANY storage class you like, just update the correct storage-class
 for your deployment.
 
-### Master data: hostPath vs a claim
-
-The master's `-mdir` holds its Raft log and snapshots, and with them the
-cluster's identity (its topology UUID). `master.data.type` defaults to
-`hostPath`, which does not follow a pod to another node: a master that is
-rescheduled comes back with an empty data directory and a brand new cluster
-UUID. With the chart's default of a single master replica there is no peer to
-recover the identity from either.
-
-Putting the master's data on a claim avoids that:
-
-```yaml
-master:
-  data:
-    type: "persistentVolumeClaim"
-    size: "1Gi"
-    storageClass: ""   # empty uses the cluster's default StorageClass
-```
-
-Raft state is small, so a modest claim is enough — sizing matters far more for
-volume and filer.
-
-The default is left at `hostPath` for backward compatibility:
-`volumeClaimTemplates` is immutable on a StatefulSet, so flipping the type on a
-release that already exists fails, whether the chart changes the default or you
-change it yourself:
-
-```text
-StatefulSet.apps "<release>-seaweedfs-master" is invalid: spec: Forbidden:
-updates to statefulset spec for fields other than 'replicas', ... are forbidden
-```
-
-New installs can set the claim from the start. To move an **existing** release
-onto a claim without losing the cluster UUID, use the migration below. The
-claim has to be seeded while the master is stopped: a running master rewrites
-its Raft state, so copying into a live pod is silently undone by the next
-restart.
-
-The steps below are for the chart's default of a single master
-(`master.replicas: 1`). With several master replicas, repeat steps 1, 3 and 4
-for every ordinal, or migrate one at a time and let the remaining quorum
-re-replicate.
-
-Take the names from the cluster rather than assembling them — the release
-name, `nameOverride` and `fullnameOverride` all feed the chart's fullname
-helper, so `<release>-seaweedfs` is not always right:
-
-```bash
-NS=<namespace>; REL=<release>
-# scope by instance as well as component: several releases can share a namespace
-STS=$(kubectl -n $NS get sts \
-        -l app.kubernetes.io/instance=$REL,app.kubernetes.io/component=master \
-        -o jsonpath='{.items[0].metadata.name}')
-POD=$STS-0
-# a StatefulSet names its claims <template>-<statefulset>-<ordinal>, and this
-# chart's template is data-<namespace>
-PVC=data-$NS-$STS-0
-
-# 1. back up the master data directory
-kubectl -n $NS cp $POD:/data ./master-backup
-
-# 2. stop the master, leaving the rest of the release running
-kubectl -n $NS delete sts $STS --cascade=orphan
-kubectl -n $NS delete pod $POD
-
-# 3. create the claim the new StatefulSet will adopt, and seed it through a
-#    pod that actually mounts it
-kubectl -n $NS apply -f - <<EOF
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: $PVC
-spec:
-  accessModes: ["ReadWriteOnce"]
-  resources:
-    requests:
-      storage: 1Gi
----
-apiVersion: v1
-kind: Pod
-metadata:
-  name: seed
-spec:
-  containers:
-    - name: seed
-      image: alpine:3.20
-      command: ["sleep", "600"]
-      volumeMounts:
-        - name: d
-          mountPath: /data
-  volumes:
-    - name: d
-      persistentVolumeClaim:
-        claimName: $PVC
-EOF
-kubectl -n $NS wait --for=condition=Ready pod/seed --timeout=120s
-kubectl -n $NS cp ./master-backup/m9333 seed:/data/
-kubectl -n $NS exec seed -- ls /data/m9333    # conf, log, snapshot, state
-kubectl -n $NS delete pod seed
-
-# 4. upgrade; the StatefulSet adopts the claim you created
-helm upgrade $REL seaweedfs/seaweedfs -n $NS -f values.yaml
-```
-
-Confirm the UUID survived — it must match what the cluster reported before the
-migration:
-
-```bash
-kubectl -n $NS exec $POD -- curl -s localhost:9333/license/status
-```
-
-**Or accept a new cluster UUID** and, if you run the enterprise edition, have
-the license re-issued against it.
-
 ## current instances config (AIO):
 
 1 instance for each type (master/filer+s3/volume)
@@ -289,32 +175,6 @@ stringData:
   seaweedfs_s3_config: '{"identities":[{"name":"anvAdmin","credentials":[{"accessKey":"snu8yoP6QAlY0ne4","secretKey":"PNzBcmeLNEdR0oviwm04NQAicOrDH1Km"}],"actions":["Admin","Read","Write"]},{"name":"anvReadOnly","credentials":[{"accessKey":"SCigFee6c5lbi04A","secretKey":"kgFhbT38R8WUYVtiFQ1OiSVOrYr3NKku"}],"actions":["Read"]}]}'
 ```
 
-#### Source S3 credentials from an existing Secret
-
-To keep the keys out of `values.yaml` while still letting the chart generate the
-identities file, point an identity at an existing Secret:
-
-```yaml
-s3:
-  enabled: true
-  enableAuth: true
-  credentials:
-    admin:
-      existingSecret: minio-root
-      accessKeyKey: root-user
-      secretKeyKey: root-password
-```
-
-`accessKeyKey` and `secretKeyKey` default to the chart's own key names
-(`admin_access_key_id`, `admin_secret_access_key`, and the `read_` pair). The
-generated `seaweedfs_s3_config` references the keys as `${SEAWEEDFS_S3_ADMIN_ACCESS_KEY_ID}`
-and the gateway resolves them from the environment, which the chart wires up
-from the Secret. Nothing is read from the cluster at render time, so
-`helm template`, `--dry-run` and an Argo CD diff all render what an install
-applies. Rotating a key in the Secret takes effect on the next pod restart, as
-with any other environment variable. The COSI driver parses the config itself
-and does not resolve these references.
-
 ## Admin Component
 
 The admin component provides a modern web-based administration interface for managing SeaweedFS clusters. It includes:
@@ -505,47 +365,6 @@ helm install seaweedfs-worker-vacuum seaweedfs/seaweedfs -f values-worker-vacuum
 helm install seaweedfs-worker-balance seaweedfs/seaweedfs -f values-worker-balance.yaml
 ```
 
-## Network Policies
-
-In a namespace with a default-deny policy the install hangs: the components cannot resolve each other, and the post-install bucket hook waits on the master and filer until it gives up. `networkPolicy.enabled` renders one `NetworkPolicy` per component, selecting its pods by the standard `app.kubernetes.io/{name,instance,component}` labels and admitting traffic from the other pods of the release on the ports that component listens on.
-
-```bash
-helm install seaweedfs seaweedfs/seaweedfs --set networkPolicy.enabled=true
-```
-
-That alone leaves outbound traffic untouched, which is enough when the namespace's default-deny only restricts ingress. If it lists `Egress` in its `policyTypes` too - the usual baseline - the components still cannot resolve DNS, and you need the second opt-in below as well.
-
-Egress is separate because the chart knows where its own components live but not where your filer store, notification sink or remote tier does, and because in a namespace with no default-deny at all, adding egress rules would narrow the components from "may reach anything" to "may reach these peers":
-
-```yaml
-networkPolicy:
-  enabled: true
-  egress:
-    enabled: true
-    kubeApiServer:
-      # the endpoint behind the kubernetes service, not its ClusterIP
-      cidrs: ["172.18.0.2/32"]
-    extraEgress:
-      - to:
-          - podSelector:
-              matchLabels:
-                app.kubernetes.io/name: postgresql
-        ports:
-          - protocol: TCP
-            port: 5432
-```
-
-`kubeApiServer.cidrs` is only demanded when something in the release actually needs the API server, which is the COSI sidecar and, on an upgrade that grows a volume PVC, the resize hook. No seaweedfs component itself speaks to it.
-
-Anything reaching the release from outside - an ingress controller, a Prometheus in another namespace - goes into `networkPolicy.extraIngress`, or into `networkPolicy.components.<component>.extraIngress` for a single component. See the `networkPolicy` block in `values.yaml` for the full set.
-
-Two things worth knowing before you turn this on:
-
-- **Monitoring stops.** The metrics ports are admitted from release pods like every other port, so with `global.seaweedfs.monitoring.enabled` the ServiceMonitors keep scraping targets a Prometheus in another namespace can no longer reach. Nothing reports it; add the scraper's namespace to `extraIngress`.
-- **The resize hook's policy is a Helm hook.** Its Job runs before the release manifest is applied, so the policy has to be a `pre-install` hook too. Helm does not garbage-collect hook resources, so on an upgrade that grows a volume PVC the policy is created and then left behind on uninstall - delete `<release>-seaweedfs-volume-resize-hook` by hand if it bothers you.
-
-The DNS selectors default to CoreDNS as kubeadm, kind and the managed offerings from AWS, Google and Azure install it. On OpenShift, override `egress.dnsNamespaceSelector` and `egress.dnsPodSelector` to match `openshift-dns`; see the comment in `values.yaml`.
-
 ## OpenShift Support
 
 SeaweedFS can be deployed on OpenShift or any cluster enforcing the Kubernetes "restricted" Pod Security Standard. By default, OpenShift blocks containers that run as root or use `hostPath` volumes.
@@ -566,38 +385,3 @@ helm install seaweedfs seaweedfs/seaweedfs \
 
 For enterprise users, please visit [seaweedfs.com](https://seaweedfs.com) for the SeaweedFS Enterprise Edition, 
 which has advanced features, including data recovery, self-healing storage, customizable erasure coding, EC vacuum and repair, etc.
-
-To run it, set the image and point the chart at a Secret holding the license
-file:
-
-```bash
-kubectl create secret generic seaweedfs-license -n <namespace> \
-  --from-file=seaweed-license.json=/path/to/seaweed-license.json
-```
-
-```yaml
-global:
-  seaweedfs:
-    image:
-      name: chrislusf/seaweedfs-enterprise
-    license:
-      existingSecret: seaweedfs-license
-      # secretKey: seaweed-license.json     # key within the Secret
-      # mountPath: /etc/seaweedfs/license   # directory it is mounted at
-```
-
-Set the image globally rather than per component: a per-component
-`imageOverride` wins, and a cluster that mixes editions comes up looking
-healthy with enterprise features quietly off.
-
-Only the master reads the license, so the Secret is mounted read-only there
-and on all-in-one (which runs `weed server -master`). It is mounted as a
-directory, not a `subPath`, so a renewed Secret reaches the running master —
-which re-reads the file periodically — without a restart.
-
-The license is tied to the cluster UUID kept in the master's Raft state, so put
-`master.data` on a claim — a master that restarts onto an empty data directory
-generates a new UUID and the license stops matching. See
-[Master data](#master-data-hostpath-vs-a-claim). Check the binding with
-`kubectl exec <master-pod> -- curl -s localhost:9333/license/status`
-(`cluster_uuid` must equal `license_uuid`).

k8s/charts/seaweedfs/templates/admin/admin-service.yaml

@@ -21,7 +21,6 @@ spec:
   {{- $nodePorts = .Values.admin.service.nodePorts | default dict }}
   {{- end }}
   type: {{ $serviceType }}
-  {{- include "seaweedfs.service.loadBalancerFields" .Values.admin.service }}
   ports:
   - name: "http"
     port: {{ .Values.admin.port }}

k8s/charts/seaweedfs/templates/admin/admin-statefulset.yaml

@@ -69,9 +69,6 @@ spec:
       {{- if .Values.admin.priorityClassName }}
       priorityClassName: {{ .Values.admin.priorityClassName | quote }}
       {{- end }}
-      {{- if .Values.admin.schedulerName }}
-      schedulerName: {{ .Values.admin.schedulerName | quote }}
-      {{- end }}
       enableServiceLinks: false
       {{- if .Values.admin.serviceAccountName }}
       serviceAccountName: {{ .Values.admin.serviceAccountName | quote }}

k8s/charts/seaweedfs/templates/all-in-one/all-in-one-deployment.yaml

@@ -64,9 +64,6 @@ spec:
       {{- if .Values.allInOne.priorityClassName }}
       priorityClassName: {{ .Values.allInOne.priorityClassName | quote }}
       {{- end }}
-      {{- if .Values.allInOne.schedulerName }}
-      schedulerName: {{ .Values.allInOne.schedulerName | quote }}
-      {{- end }}
       {{- if .Values.allInOne.serviceAccountName }}
       serviceAccountName: {{ .Values.allInOne.serviceAccountName | quote }}
       {{- end }}
@@ -83,10 +80,6 @@ spec:
           image: {{ template "seaweedfs.master.image" . }}
           imagePullPolicy: {{ default "IfNotPresent" .Values.global.seaweedfs.imagePullPolicy }}
           env:
-            {{- include "seaweedfs.licenseEnv" . | nindent 12 }}
-            {{- if and .Values.allInOne.s3.enabled (or .Values.allInOne.s3.enableAuth .Values.s3.enableAuth .Values.filer.s3.enableAuth) }}
-            {{- include "seaweedfs.s3.credentialEnv" . | nindent 12 }}
-            {{- end }}
             {{- /* Determine default cluster alias and the corresponding env var keys to avoid conflicts */}}
             {{- $mergedExtraEnvironmentVars := dict }}
             {{- include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" .Values.global.seaweedfs "component" .Values.allInOne "target" $mergedExtraEnvironmentVars) }}
@@ -127,13 +120,11 @@ spec:
               value: {{ include "seaweedfs.cluster.filerAddress" . | quote }}
             {{- if .Values.allInOne.secretExtraEnvironmentVars }}
             {{- range $key, $value := .Values.allInOne.secretExtraEnvironmentVars }}
-            {{- if not (and $key (eq $key "SEAWEED_LICENSE") (include "seaweedfs.licenseEnabled" $)) }}
             - name: {{ $key }}
               valueFrom:
                 {{ toYaml $value | nindent 16 }}
             {{- end }}
             {{- end }}
-            {{- end }}
           command:
             - "/bin/sh"
             - "-ec"
@@ -361,7 +352,6 @@ spec:
             {{- include "seaweedfs.s3.tlsVolumeMount" . | nindent 12 }}
             {{- end }}
             {{- end }}
-            {{- include "seaweedfs.licenseVolumeMount" . | nindent 12 }}
             {{ tpl .Values.allInOne.extraVolumeMounts . | nindent 12 }}
           ports:
             - containerPort: {{ .Values.master.port }}
@@ -429,7 +419,6 @@ spec:
       {{- include "seaweedfs.tplvalues.render" (dict "value" .Values.allInOne.sidecars "context" $) | nindent 8 }}
       {{- end }}
       volumes:
-        {{- include "seaweedfs.licenseVolume" . | nindent 8 }}
         - name: data
           {{- if eq .Values.allInOne.data.type "hostPath" }}
           hostPath:

k8s/charts/seaweedfs/templates/all-in-one/all-in-one-service.yml

@@ -21,7 +21,6 @@ spec:
   {{- $nodePorts = .Values.allInOne.service.nodePorts | default dict }}
   {{- end }}
   type: {{ $serviceType }}
-  {{- include "seaweedfs.service.loadBalancerFields" .Values.allInOne.service }}
   internalTrafficPolicy: {{ .Values.allInOne.service.internalTrafficPolicy | default "Cluster" }}
   {{- if and (semverCompare ">=1.31-0" .Capabilities.KubeVersion.GitVersion) .Values.allInOne.s3.trafficDistribution }}
   trafficDistribution: {{ include "seaweedfs.trafficDistribution" (dict "value" .Values.allInOne.s3.trafficDistribution "Capabilities" .Capabilities) }}

k8s/charts/seaweedfs/templates/cosi/cosi-deployment.yaml

@@ -57,9 +57,6 @@ spec:
       {{- if .Values.cosi.priorityClassName }}
       priorityClassName: {{ .Values.cosi.priorityClassName | quote }}
       {{- end }}
-      {{- if .Values.cosi.schedulerName }}
-      schedulerName: {{ .Values.cosi.schedulerName | quote }}
-      {{- end }}
       enableServiceLinks: false
       serviceAccountName: {{ include "seaweedfs.componentName" (list . "objectstorage-provisioner") }}
       {{- if .Values.cosi.initContainers }}

k8s/charts/seaweedfs/templates/filer/filer-service-client.yaml

@@ -10,6 +10,9 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: filer
+{{- if .Values.filer.metricsPort }}
+    monitoring: "true"
+{{- end }}
 {{- if .Values.filer.annotations }}
   annotations:
     {{- toYaml .Values.filer.annotations | nindent 4 }}

k8s/charts/seaweedfs/templates/filer/filer-service.yaml

@@ -10,9 +10,6 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: filer
-{{- if .Values.filer.metricsPort }}
-    monitoring: "true"
-{{- end }}
   annotations:
     service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
 {{- if .Values.filer.annotations }}

k8s/charts/seaweedfs/templates/filer/filer-servicemonitor.yaml

@@ -30,7 +30,6 @@ spec:
       app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
       app.kubernetes.io/instance: {{ .Release.Name }}
       app.kubernetes.io/component: filer
-      monitoring: "true"
 {{- end }}
 {{- end }}
 {{- end }}

k8s/charts/seaweedfs/templates/filer/filer-statefulset.yaml

@@ -76,9 +76,6 @@ spec:
       {{- if .Values.filer.priorityClassName }}
       priorityClassName: {{ .Values.filer.priorityClassName | quote }}
       {{- end }}
-      {{- if .Values.filer.schedulerName }}
-      schedulerName: {{ .Values.filer.schedulerName | quote }}
-      {{- end }}
       enableServiceLinks: false
       {{- if .Values.filer.initContainers }}
       initContainers:
@@ -92,7 +89,6 @@ spec:
           image: {{ template "seaweedfs.filer.image" . }}
           imagePullPolicy: {{ default "IfNotPresent" .Values.global.seaweedfs.imagePullPolicy }}
           env:
-            {{- $mysqlEnabled := include "seaweedfs.filer.mysqlEnabled" . }}
             - name: POD_IP
               valueFrom:
                 fieldRef:
@@ -105,7 +101,6 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: metadata.namespace
-            {{- if $mysqlEnabled }}
             - name: WEED_MYSQL_USERNAME
               valueFrom:
                 secretKeyRef:
@@ -118,21 +113,10 @@ spec:
                   name: {{ include "seaweedfs.fullname" . }}-db-secret
                   key: password
                   optional: true
-            {{- end }}
             - name: SEAWEEDFS_FULLNAME
               value: "{{ include "seaweedfs.fullname" . }}"
-            {{- if and .Values.filer.s3.enabled .Values.filer.s3.enableAuth }}
-            {{- include "seaweedfs.s3.credentialEnv" . | nindent 12 }}
-            {{- end }}
             {{- $mergedExtraEnvironmentVars := dict }}
             {{- include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" .Values.global.seaweedfs "component" .Values.filer "target" $mergedExtraEnvironmentVars) }}
-            {{- if not $mysqlEnabled }}
-            {{- range $key := keys $mergedExtraEnvironmentVars }}
-            {{- if hasPrefix "WEED_MYSQL_" $key }}
-            {{- $_ := unset $mergedExtraEnvironmentVars $key }}
-            {{- end }}
-            {{- end }}
-            {{- end }}
             {{- range $key := keys $mergedExtraEnvironmentVars | sortAlpha }}
             {{- $value := index $mergedExtraEnvironmentVars $key }}
             - name: {{ $key }}
@@ -145,12 +129,10 @@ spec:
             {{- end }}
             {{- if .Values.filer.secretExtraEnvironmentVars }}
             {{- range $key, $value := .Values.filer.secretExtraEnvironmentVars }}
-            {{- if or $mysqlEnabled (not (hasPrefix "WEED_MYSQL_" $key)) }}
             - name: {{ $key }}
               valueFrom: {{ toYaml $value | nindent 16 }}
             {{- end }}
             {{- end }}
-            {{- end }}
           command:
             - "/bin/sh"
             - "-ec"
@@ -374,7 +356,6 @@ spec:
         - name: db-schema-config-volume
           configMap:
             name: {{ default (printf "%s-db-init-config" (include "seaweedfs.fullname" .)) .Values.filer.dbInitConfigName }}
-            optional: true
         {{- if and .Values.filer.s3.enabled .Values.filer.s3.enableAuth }}
         - name: config-users
           secret:

k8s/charts/seaweedfs/templates/master/master-statefulset.yaml

@@ -69,9 +69,6 @@ spec:
       {{- if .Values.master.priorityClassName }}
       priorityClassName: {{ .Values.master.priorityClassName | quote }}
       {{- end }}
-      {{- if .Values.master.schedulerName }}
-      schedulerName: {{ .Values.master.schedulerName | quote }}
-      {{- end }}
       enableServiceLinks: false
       serviceAccountName: {{ .Values.master.serviceAccountName | default (include "seaweedfs.serviceAccountName" .) | quote }} # for deleting statefulset pods after migration
       {{- if .Values.master.initContainers }}
@@ -86,7 +83,6 @@ spec:
           image: {{ template "seaweedfs.master.image" . }}
           imagePullPolicy: {{ default "IfNotPresent" .Values.global.seaweedfs.imagePullPolicy }}
           env:
-            {{- include "seaweedfs.licenseEnv" . | nindent 12 }}
             - name: POD_IP
               valueFrom:
                 fieldRef:
@@ -215,7 +211,6 @@ spec:
               readOnly: true
               mountPath: /usr/local/share/ca-certificates/client/
             {{- end }}
-            {{- include "seaweedfs.licenseVolumeMount" . | nindent 12 }}
             {{ tpl .Values.master.extraVolumeMounts . | nindent 12 | trim }}
           ports:
             - containerPort: {{ .Values.master.port }}
@@ -261,7 +256,6 @@ spec:
         {{- include "seaweedfs.tplvalues.render" (dict "value" .Values.master.sidecars "context" $) | nindent 8 }}
         {{- end }}
       volumes:
-        {{- include "seaweedfs.licenseVolume" . | nindent 8 }}
         {{- if eq .Values.master.logs.type "hostPath" }}
         - name: seaweedfs-master-log-volume
           hostPath:

k8s/charts/seaweedfs/templates/s3/s3-deployment.yaml

@@ -61,9 +61,6 @@ spec:
       {{- if .Values.s3.priorityClassName }}
       priorityClassName: {{ .Values.s3.priorityClassName | quote }}
       {{- end }}
-      {{- if .Values.s3.schedulerName }}
-      schedulerName: {{ .Values.s3.schedulerName | quote }}
-      {{- end }}
       enableServiceLinks: false
       {{- if .Values.s3.serviceAccountName }}
       serviceAccountName: {{ .Values.s3.serviceAccountName | quote }}
@@ -94,9 +91,6 @@ spec:
                   fieldPath: metadata.namespace
             - name: SEAWEEDFS_FULLNAME
               value: "{{ include "seaweedfs.fullname" . }}"
-            {{- if .Values.s3.enableAuth }}
-            {{- include "seaweedfs.s3.credentialEnv" . | nindent 12 }}
-            {{- end }}
             {{- $mergedExtraEnvironmentVars := dict }}
             {{- include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" .Values.global.seaweedfs "component" .Values.s3 "target" $mergedExtraEnvironmentVars) }}
             {{- range $key := keys $mergedExtraEnvironmentVars | sortAlpha }}
@@ -149,8 +143,6 @@ spec:
               {{- if .Values.s3.icebergPort }}
               -port.iceberg={{ .Values.s3.icebergPort }} \
               {{- end }}
-              {{- /* rendered even when 0: an if would drop the flag and weed would serve its default */}}
-              -port.lance={{ .Values.s3.lancePort | default 0 }} \
               {{- range .Values.s3.extraArgs }}
               {{ . }} \
               {{- end }}
@@ -200,10 +192,6 @@ spec:
             - containerPort: {{ .Values.s3.icebergPort }}
               name: swfs-iceberg
             {{- end }}
-            {{- if .Values.s3.lancePort }}
-            - containerPort: {{ .Values.s3.lancePort }}
-              name: swfs-lance
-            {{- end }}
             {{- if .Values.s3.metricsPort }}
             - containerPort: {{ .Values.s3.metricsPort }}
               name: metrics

k8s/charts/seaweedfs/templates/s3/s3-lance-ingress.yaml

@@ -1,61 +0,0 @@
-{{- define "seaweedfs.s3.lance.ingress.paths" -}}
-paths:
-- path: {{ .Values.s3.lanceIngress.path | quote }}
-  pathType: {{ .Values.s3.lanceIngress.pathType | quote }}
-  backend:
-    {{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion }}
-    service:
-      name: {{ include "seaweedfs.componentName" (list . "s3") }}
-      port:
-        number: {{ .Values.s3.lancePort }}
-    {{- else }}
-    serviceName: {{ include "seaweedfs.componentName" (list . "s3") }}
-    servicePort: {{ .Values.s3.lancePort }}
-    {{- end }}
-{{- end -}}
-{{- if and .Values.s3.enabled .Values.s3.lancePort .Values.s3.lanceIngress.enabled }}
-{{- $hosts := list }}
-{{- if kindIs "slice" .Values.s3.lanceIngress.host }}
-  {{- $hosts = .Values.s3.lanceIngress.host }}
-{{- else if .Values.s3.lanceIngress.host }}
-  {{- $hosts = list .Values.s3.lanceIngress.host }}
-{{- end }}
-{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion }}
-apiVersion: networking.k8s.io/v1
-{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion }}
-apiVersion: networking.k8s.io/v1beta1
-{{- else }}
-apiVersion: extensions/v1beta1
-{{- end }}
-kind: Ingress
-metadata:
-  name: ingress-{{ include "seaweedfs.fullname" . }}-s3-lance
-  namespace: {{ .Release.Namespace }}
-  {{- with .Values.s3.lanceIngress.annotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  labels:
-    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/component: s3-lance
-spec:
-  {{- if .Values.s3.lanceIngress.className }}
-  ingressClassName: {{ .Values.s3.lanceIngress.className | quote }}
-  {{- end }}
-  tls:
-    {{ .Values.s3.lanceIngress.tls | default list | toYaml | nindent 6}}
-  rules:
-{{- if $hosts }}
-{{- range $host := $hosts }}
-  - host: {{ $host | quote }}
-    http:
-      {{- include "seaweedfs.s3.lance.ingress.paths" $ | nindent 6 }}
-{{- end }}
-{{- else }}
-  - http:
-      {{- include "seaweedfs.s3.lance.ingress.paths" . | nindent 4 }}
-{{- end }}
-{{- end }}

k8s/charts/seaweedfs/templates/s3/s3-secret.yaml

@@ -1,7 +1,4 @@
-{{- /* Mirrors the condition the all-in-one deployment mounts this secret under,
-       so the flags that make it mount are exactly the flags that create it. */}}
-{{- $allInOneAuth := and .Values.allInOne.enabled .Values.allInOne.s3.enabled (or .Values.allInOne.s3.enableAuth .Values.s3.enableAuth .Values.filer.s3.enableAuth) (not (or .Values.allInOne.s3.existingConfigSecret .Values.s3.existingConfigSecret .Values.filer.s3.existingConfigSecret)) }}
-{{- if or (and (or .Values.s3.enabled .Values.allInOne.enabled) .Values.s3.enableAuth (not .Values.s3.existingConfigSecret)) (and .Values.filer.s3.enabled .Values.filer.s3.enableAuth (not .Values.filer.s3.existingConfigSecret)) $allInOneAuth }}
+{{- if or (and (or .Values.s3.enabled .Values.allInOne.enabled) .Values.s3.enableAuth (not .Values.s3.existingConfigSecret)) (and .Values.filer.s3.enabled .Values.filer.s3.enableAuth (not .Values.filer.s3.existingConfigSecret)) }}
 {{- $secretName := printf "%s-s3-secret" (include "seaweedfs.fullname" .) }}
 {{- $legacySecretName := "seaweedfs-s3-secret" }}
 {{- $lookupName := $secretName }}
@@ -17,20 +14,14 @@
 {{- $adminCreds := $creds.admin | default dict -}}
 {{- $access_key_admin := $adminCreds.accessKey -}}
 {{- $secret_key_admin := $adminCreds.secretKey -}}
-{{- if $adminCreds.existingSecret -}}
-  {{- $access_key_admin = printf "${%s}" (include "seaweedfs.s3.credentialEnvName" (list "admin" "accessKey")) -}}
-  {{- $secret_key_admin = printf "${%s}" (include "seaweedfs.s3.credentialEnvName" (list "admin" "secretKey")) -}}
-{{- else if not (and $access_key_admin $secret_key_admin) -}}
+{{- if not (and $access_key_admin $secret_key_admin) -}}
   {{- $access_key_admin = include "seaweedfs.getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "admin_access_key_id" "length" 20 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
   {{- $secret_key_admin = include "seaweedfs.getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "admin_secret_access_key" "length" 40 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
 {{- end -}}
 {{- $readCreds := $creds.read | default dict -}}
 {{- $access_key_read := $readCreds.accessKey -}}
 {{- $secret_key_read := $readCreds.secretKey -}}
-{{- if $readCreds.existingSecret -}}
-  {{- $access_key_read = printf "${%s}" (include "seaweedfs.s3.credentialEnvName" (list "read" "accessKey")) -}}
-  {{- $secret_key_read = printf "${%s}" (include "seaweedfs.s3.credentialEnvName" (list "read" "secretKey")) -}}
-{{- else if not (and $access_key_read $secret_key_read) -}}
+{{- if not (and $access_key_read $secret_key_read) -}}
   {{- $access_key_read = include "seaweedfs.getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "read_access_key_id" "length" 20 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
   {{- $secret_key_read = include "seaweedfs.getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "read_secret_access_key" "length" 40 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
 {{- end -}}
@@ -50,16 +41,10 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: s3
 stringData:
-  {{- /* An identity read from an existing Secret keeps its keys there; the
-         config below names the environment variables carrying them. */}}
-  {{- if not $adminCreds.existingSecret }}
   admin_access_key_id: {{ $access_key_admin }}
   admin_secret_access_key: {{ $secret_key_admin }}
-  {{- end }}
-  {{- if not $readCreds.existingSecret }}
   read_access_key_id: {{ $access_key_read }}
   read_secret_access_key: {{ $secret_key_read }}
-  {{- end }}
   seaweedfs_s3_config: '{"identities":[{"name":"anvAdmin","credentials":[{"accessKey":"{{ $access_key_admin }}","secretKey":"{{ $secret_key_admin }}"}],"actions":["Admin","Read","Write"]},{"name":"anvReadOnly","credentials":[{"accessKey":"{{ $access_key_read }}","secretKey":"{{ $secret_key_read }}"}],"actions":["Read"]}]}'
   {{- if .Values.filer.s3.auditLogConfig }}
   filer_s3_auditLogConfig.json: |

k8s/charts/seaweedfs/templates/s3/s3-service.yaml

@@ -21,7 +21,6 @@ spec:
   {{- $nodePorts = .Values.s3.service.nodePorts | default dict }}
   {{- end }}
   type: {{ $serviceType }}
-  {{- include "seaweedfs.service.loadBalancerFields" .Values.s3.service }}
   internalTrafficPolicy: {{ .Values.s3.internalTrafficPolicy | default "Cluster" }}
   {{- $td := .Values.s3.trafficDistribution | default .Values.filer.s3.trafficDistribution }}
   {{- if and (semverCompare ">=1.31-0" .Capabilities.KubeVersion.GitVersion) $td }}
@@ -44,15 +43,6 @@ spec:
 {{- end }}
     protocol: TCP
 {{- end }}
-{{- if and .Values.s3.enabled .Values.s3.lancePort }}
-  - name: "swfs-lance"
-    port: {{ .Values.s3.lancePort }}
-    targetPort: {{ .Values.s3.lancePort }}
-{{- if $nodePorts.lance }}
-    nodePort: {{ $nodePorts.lance }}
-{{- end }}
-    protocol: TCP
-{{- end }}
 {{- if and .Values.s3.enabled .Values.s3.httpsPort }}
   - name: "swfs-s3-tls"
     port: {{ .Values.s3.httpsPort }}

k8s/charts/seaweedfs/templates/sftp/sftp-deployment.yaml

@@ -61,9 +61,6 @@ spec:
       {{- if .Values.sftp.priorityClassName }}
       priorityClassName: {{ .Values.sftp.priorityClassName | quote }}
       {{- end }}
-      {{- if .Values.sftp.schedulerName }}
-      schedulerName: {{ .Values.sftp.schedulerName | quote }}
-      {{- end }}
       enableServiceLinks: false
       {{- if .Values.sftp.serviceAccountName }}
       serviceAccountName: {{ .Values.sftp.serviceAccountName | quote }}

k8s/charts/seaweedfs/templates/sftp/sftp-service.yaml

@@ -21,7 +21,6 @@ spec:
   {{- $nodePorts = .Values.sftp.service.nodePorts | default dict }}
   {{- end }}
   type: {{ $serviceType }}
-  {{- include "seaweedfs.service.loadBalancerFields" .Values.sftp.service }}
   internalTrafficPolicy: {{ .Values.sftp.internalTrafficPolicy | default "Cluster" }}
   ports:
   - name: "swfs-sftp"

k8s/charts/seaweedfs/templates/shared/_helpers.tpl

@@ -69,23 +69,6 @@ Inject extra environment vars in the format key:value, if populated
 {{- range $key, $value := $component }}
 {{- $_ := set $target $key $value }}
 {{- end }}
-{{/* the license block owns SEAWEED_LICENSE; letting one through here too would
-     render the key twice in one container */}}
-{{- if ((.global | default dict).license | default dict).existingSecret }}
-{{- $_ := unset $target "SEAWEED_LICENSE" }}
-{{- end }}
-{{- end -}}
-
-{{/* Whether the mysql filer store is selected; a flag the chart cannot read counts as selected. */}}
-{{- define "seaweedfs.filer.mysqlEnabled" -}}
-{{- $merged := dict -}}
-{{- $_ := include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" .Values.global.seaweedfs "component" .Values.filer "target" $merged) -}}
-{{- $enabled := index $merged "WEED_MYSQL_ENABLED" -}}
-{{- if or (kindIs "map" $enabled) (hasKey (.Values.filer.secretExtraEnvironmentVars | default dict) "WEED_MYSQL_ENABLED") -}}
-true
-{{- else if and $enabled (eq (lower (toString $enabled)) "true") -}}
-true
-{{- end -}}
 {{- end -}}
 
 {{/* Return the proper filer image */}}
@@ -148,15 +131,6 @@ true
 {{- end -}}
 {{- end -}}
 
-{{/* Lance namespace URL the worker's Lance container maintains; empty when unreachable */}}
-{{- define "seaweedfs.worker.lanceNamespaceUrl" -}}
-{{- if .Values.worker.namespaceUrl -}}
-{{- .Values.worker.namespaceUrl -}}
-{{- else if and .Values.s3.enabled .Values.s3.lancePort -}}
-{{- printf "http://%s.%s:%d" (include "seaweedfs.componentName" (list . "s3")) .Release.Namespace (int .Values.s3.lancePort) -}}
-{{- end -}}
-{{- end -}}
-
 {{/* Return the proper volume image */}}
 {{- define "seaweedfs.volume.image" -}}
 {{- if .Values.volume.imageOverride -}}
@@ -370,81 +344,6 @@ true
 {{- end -}}
 {{- end -}}
 
-{{/* True when the post-install bucket hook Job renders: an S3 endpoint, plus
-     buckets to create on it. Read by the Job itself and by its NetworkPolicy,
-     which has to appear exactly when the Job does - a Job without its policy
-     hangs in a default-deny namespace. */}}
-{{- define "seaweedfs.bucketHookEnabled" -}}
-{{- if .Values.allInOne.enabled -}}
-{{-   if and .Values.allInOne.s3.enabled .Values.allInOne.s3.createBuckets -}}
-true
-{{-   end -}}
-{{- else if .Values.master.enabled -}}
-{{-   if and (or .Values.filer.s3.enabled .Values.s3.enabled) (or .Values.s3.createBuckets .Values.filer.s3.createBuckets) -}}
-true
-{{-   end -}}
-{{- end -}}
-{{- end -}}
-
-{{/* The kubectl commands the volume resize hook has to run, one per line: a
-     cascade-orphan delete for every StatefulSet whose volumeClaimTemplates no
-     longer match the values, and a patch for every PVC the values grew.
-
-     Empty when there is nothing to resize, which is what gates the Job. Read by
-     its NetworkPolicy too, which has to appear exactly when the Job does - a Job
-     without its policy hangs in a default-deny namespace, and a policy without
-     its Job is an orphaned hook resource on every install.
-
-     Built on lookup, so it is always empty under helm template and on a fresh
-     install, where there is no StatefulSet to compare against yet. */}}
-{{- define "seaweedfs.volumeResizeHookCommands" -}}
-{{- $seaweedfsName := include "seaweedfs.fullname" $ }}
-{{- $volumes := deepCopy .Values.volumes | mergeOverwrite (dict "" .Values.volume) }}
-{{- $commands := list }}
-{{- if .Values.volume.resizeHook.enabled }}
-{{-   range $vname, $volume := $volumes }}
-{{-     $volumeName := trimSuffix "-" (printf "volume-%s" $vname) }}
-{{-     $volume := mergeOverwrite (deepCopy $.Values.volume) (dict "enabled" true) $volume }}
-{{-     if $volume.enabled }}
-{{-       $replicas := int $volume.replicas }}
-{{-       $statefulsetName := printf "%s-%s" $seaweedfsName $volumeName }}
-{{-       $statefulset := (lookup "apps/v1" "StatefulSet" $.Release.Namespace $statefulsetName) }}
-{{- /* Check for changes in volumeClaimTemplates */}}
-{{-       if $statefulset }}
-{{-         range $dir := $volume.dataDirs }}
-{{-           if eq .type "persistentVolumeClaim" }}
-{{-             $desiredSize := .size }}
-{{-             range $statefulset.spec.volumeClaimTemplates }}
-{{-               if and (eq .metadata.name $dir.name) (ne .spec.resources.requests.storage $desiredSize) }}
-{{-                 $commands = append $commands (printf "kubectl delete statefulset %s --cascade=orphan" $statefulsetName) }}
-{{-               end }}
-{{-             end }}
-{{-           end }}
-{{-         end }}
-{{-       end }}
-{{- /* Check for the need for patching existing PVCs */}}
-{{-       range $dir := $volume.dataDirs }}
-{{-         if eq .type "persistentVolumeClaim" }}
-{{-           $desiredSize := .size }}
-{{-           range $i, $e := until $replicas }}
-{{-             $pvcName := printf "%s-%s-%s-%d" $dir.name $seaweedfsName $volumeName $e }}
-{{-             $currentPVC := (lookup "v1" "PersistentVolumeClaim" $.Release.Namespace $pvcName) }}
-{{-             if $currentPVC }}
-{{-               $oldSize := include "seaweedfs.resource-quantity" $currentPVC.spec.resources.requests.storage }}
-{{-               $newSize := include "seaweedfs.resource-quantity" $desiredSize }}
-{{-               if gt $newSize $oldSize }}
-{{-                 $commands = append $commands (printf "kubectl patch pvc %s-%s-%s-%d -p '{\"spec\":{\"resources\":{\"requests\":{\"storage\":\"%s\"}}}}'" $dir.name $seaweedfsName $volumeName $e $desiredSize) }}
-{{-               end }}
-{{-             end }}
-{{-           end }}
-{{-         end }}
-{{-       end }}
-{{-     end }}
-{{-   end }}
-{{- end }}
-{{- join "\n" $commands }}
-{{- end -}}
-
 {{/* S3 TLS cert/key arguments, using custom secret if s3.tlsSecret is set */}}
 {{- define "seaweedfs.s3.tlsArgs" -}}
 {{- $prefix := .prefix -}}
@@ -476,80 +375,6 @@ true
 {{- end }}
 {{- end -}}
 
-{{/* True when an enterprise license Secret is configured. */}}
-{{- define "seaweedfs.licenseEnabled" -}}
-{{- if ((.Values.global.seaweedfs).license).existingSecret -}}
-true
-{{- end -}}
-{{- end -}}
-
-{{/* Enterprise license volume. Projects just the license key. */}}
-{{- define "seaweedfs.licenseVolume" -}}
-{{- if include "seaweedfs.licenseEnabled" . -}}
-- name: seaweedfs-license
-  secret:
-    secretName: {{ .Values.global.seaweedfs.license.existingSecret }}
-    defaultMode: 0444
-    items:
-      - key: {{ .Values.global.seaweedfs.license.secretKey | default "seaweed-license.json" | quote }}
-        path: {{ .Values.global.seaweedfs.license.secretKey | default "seaweed-license.json" | quote }}
-{{- end }}
-{{- end -}}
-
-{{/* Enterprise license volume mount. Never a subPath: that is resolved once at
-     container start, so a renewed Secret would not reach a running master. */}}
-{{- define "seaweedfs.licenseVolumeMount" -}}
-{{- if include "seaweedfs.licenseEnabled" . -}}
-- name: seaweedfs-license
-  readOnly: true
-  mountPath: {{ .Values.global.seaweedfs.license.mountPath | default "/etc/seaweedfs/license" | quote }}
-{{- end }}
-{{- end -}}
-
-{{/* SEAWEED_LICENSE, set explicitly rather than relying on the binary's search
-     paths, which depend on the working directory. */}}
-{{- define "seaweedfs.licenseEnv" -}}
-{{- if include "seaweedfs.licenseEnabled" . -}}
-- name: SEAWEED_LICENSE
-  value: {{ printf "%s/%s"
-      (.Values.global.seaweedfs.license.mountPath | default "/etc/seaweedfs/license")
-      (.Values.global.seaweedfs.license.secretKey | default "seaweed-license.json") | quote }}
-{{- end }}
-{{- end -}}
-
-{{/* Name of the environment variable carrying one generated S3 credential
-     field, e.g. SEAWEEDFS_S3_ADMIN_ACCESS_KEY_ID. The generated identities file
-     names it in place of the key when the key lives in an existing Secret.
-     Usage: include "seaweedfs.s3.credentialEnvName" (list "admin" "accessKey") */}}
-{{- define "seaweedfs.s3.credentialEnvName" -}}
-{{- $identity := index . 0 -}}
-{{- $field := index . 1 -}}
-{{- printf "SEAWEEDFS_S3_%s_%s" (upper $identity) (ternary "ACCESS_KEY_ID" "SECRET_ACCESS_KEY" (eq $field "accessKey")) -}}
-{{- end -}}
-
-{{/* Environment for the S3 identities the chart generates from an existing
-     Secret. The gateway resolves the ${VAR} references the identities file
-     carries, so the keys never enter the rendered manifests and a dry run
-     renders the same as an install. */}}
-{{- define "seaweedfs.s3.credentialEnv" -}}
-{{- $creds := $.Values.s3.credentials | default dict -}}
-{{- range $identity := list "admin" "read" -}}
-{{- $identityCreds := index $creds $identity | default dict -}}
-{{- if $identityCreds.existingSecret }}
-- name: {{ include "seaweedfs.s3.credentialEnvName" (list $identity "accessKey") }}
-  valueFrom:
-    secretKeyRef:
-      name: {{ $identityCreds.existingSecret | quote }}
-      key: {{ default (printf "%s_access_key_id" $identity) $identityCreds.accessKeyKey | quote }}
-- name: {{ include "seaweedfs.s3.credentialEnvName" (list $identity "secretKey") }}
-  valueFrom:
-    secretKeyRef:
-      name: {{ $identityCreds.existingSecret | quote }}
-      key: {{ default (printf "%s_secret_access_key" $identity) $identityCreds.secretKeyKey | quote }}
-{{- end -}}
-{{- end -}}
-{{- end -}}
-
 {{/* Generate a compatible trafficDistribution value due to "PreferClose" fast deprecation in k8s v1.35.
      Accepts a dict with "value" (the trafficDistribution string) and "Capabilities". */}}
 {{- define "seaweedfs.trafficDistribution" -}}
@@ -557,23 +382,3 @@ true
 {{- and (eq .value "PreferClose") (semverCompare ">=1.35-0" .Capabilities.KubeVersion.GitVersion) | ternary "PreferSameZone" .value -}}
 {{- end -}}
 {{- end -}}
-
-{{/*
-Render LoadBalancer-specific service fields (loadBalancerClass, loadBalancerIP,
-loadBalancerSourceRanges), only when the service type is LoadBalancer.
-Usage: {{ include "seaweedfs.service.loadBalancerFields" .Values.s3.service }}
-*/}}
-{{- define "seaweedfs.service.loadBalancerFields" -}}
-{{- if eq (.type | default "ClusterIP") "LoadBalancer" }}
-{{- with .loadBalancerClass }}
-  loadBalancerClass: {{ . }}
-{{- end }}
-{{- with .loadBalancerIP }}
-  loadBalancerIP: {{ . }}
-{{- end }}
-{{- with .loadBalancerSourceRanges }}
-  loadBalancerSourceRanges:
-    {{- toYaml . | nindent 4 }}
-{{- end }}
-{{- end }}
-{{- end -}}

k8s/charts/seaweedfs/templates/shared/networkpolicy.yaml

@@ -1,267 +0,0 @@
-{{- include "seaweedfs.compat" . -}}
-{{- if .Values.networkPolicy.enabled }}
-{{- $np := .Values.networkPolicy }}
-{{- $egressCfg := $np.egress | default dict }}
-{{- $overrides := $np.components | default dict }}
-
-{{- /* One entry per rendered workload, keyed by its app.kubernetes.io/component
-       label. "ports" is everything the workload listens on, taken from the same
-       values the containerPorts are taken from, so a changed port cannot drift
-       out of the policy. "apiserver" marks the workloads that talk to the
-       Kubernetes API. "name" overrides the object name where the component
-       label already reads as a full name. */}}
-{{- $targets := list }}
-
-{{- /* allInOne.enabled does not turn the individual components off - their
-       templates only look at their own enabled flag - so the all-in-one pod is
-       an addition here, not an alternative. */}}
-{{- if .Values.allInOne.enabled }}
-{{-   $ports := list .Values.master.port .Values.master.grpcPort .Values.volume.port .Values.volume.grpcPort .Values.filer.port .Values.filer.grpcPort }}
-{{-   if .Values.allInOne.metricsPort }}
-{{-     $ports = append $ports .Values.allInOne.metricsPort }}
-{{-   end }}
-{{-   if .Values.allInOne.s3.enabled }}
-{{-     $ports = append $ports (.Values.allInOne.s3.port | default .Values.s3.port) }}
-{{-     $https := .Values.allInOne.s3.httpsPort | default .Values.s3.httpsPort }}
-{{-     if and $https (gt (int $https) 0) }}
-{{-       $ports = append $ports $https }}
-{{-     end }}
-{{-   end }}
-{{-   if .Values.allInOne.sftp.enabled }}
-{{-     $ports = append $ports (.Values.allInOne.sftp.port | default .Values.sftp.port) }}
-{{-   end }}
-{{-   $targets = append $targets (dict "component" "seaweedfs-all-in-one" "name" "all-in-one" "ports" $ports) }}
-{{- end }}
-{{- if .Values.master.enabled }}
-{{-   $ports := list .Values.master.port .Values.master.grpcPort }}
-{{-   if .Values.master.metricsPort }}
-{{-     $ports = append $ports .Values.master.metricsPort }}
-{{-   end }}
-{{-   $targets = append $targets (dict "component" "master" "ports" $ports) }}
-{{- end }}
-{{- /* Every volume group carries its own component label and its own ports. */}}
-{{- $volumes := deepCopy .Values.volumes | mergeOverwrite (dict "" .Values.volume) }}
-{{- range $vname, $volume := $volumes }}
-{{-   $volumeName := trimSuffix "-" (printf "volume-%s" $vname) }}
-{{-   $volume := mergeOverwrite (deepCopy $.Values.volume) (dict "enabled" true) $volume }}
-{{-   if $volume.enabled }}
-{{-     $ports := list $volume.port $volume.grpcPort }}
-{{-     if $volume.metricsPort }}
-{{-       $ports = append $ports $volume.metricsPort }}
-{{-     end }}
-{{-     $targets = append $targets (dict "component" $volumeName "ports" $ports) }}
-{{-   end }}
-{{- end }}
-{{- if .Values.filer.enabled }}
-{{-   $ports := list .Values.filer.port .Values.filer.grpcPort }}
-{{-   if .Values.filer.metricsPort }}
-{{-     $ports = append $ports .Values.filer.metricsPort }}
-{{-   end }}
-{{-   if .Values.filer.s3.enabled }}
-{{-     $ports = append $ports .Values.filer.s3.port }}
-{{-     if and .Values.filer.s3.httpsPort (gt (int .Values.filer.s3.httpsPort) 0) }}
-{{-       $ports = append $ports .Values.filer.s3.httpsPort }}
-{{-     end }}
-{{-   end }}
-{{-   $targets = append $targets (dict "component" "filer" "ports" $ports) }}
-{{- end }}
-{{- if .Values.s3.enabled }}
-{{-   $ports := list .Values.s3.port }}
-{{-   if and .Values.s3.httpsPort (gt (int .Values.s3.httpsPort) 0) }}
-{{-     $ports = append $ports .Values.s3.httpsPort }}
-{{-   end }}
-{{-   if .Values.s3.icebergPort }}
-{{-     $ports = append $ports .Values.s3.icebergPort }}
-{{-   end }}
-{{-   if .Values.s3.lancePort }}
-{{-     $ports = append $ports .Values.s3.lancePort }}
-{{-   end }}
-{{-   if .Values.s3.metricsPort }}
-{{-     $ports = append $ports .Values.s3.metricsPort }}
-{{-   end }}
-{{-   $targets = append $targets (dict "component" "s3" "ports" $ports) }}
-{{- end }}
-{{- if .Values.sftp.enabled }}
-{{-   $ports := list .Values.sftp.port }}
-{{-   if .Values.sftp.metricsPort }}
-{{-     $ports = append $ports .Values.sftp.metricsPort }}
-{{-   end }}
-{{-   $targets = append $targets (dict "component" "sftp" "ports" $ports) }}
-{{- end }}
-{{- /* No seaweedfs binary speaks to the Kubernetes API - the repository has no
-       client-go dependency - so admin gets no apiserver rule. The pod-RW
-       ClusterRole under global.seaweedfs.createClusterRole is a leftover from a
-       migration and is not exercised by any component. */}}
-{{- if .Values.admin.enabled }}
-{{-   $targets = append $targets (dict "component" "admin" "ports" (list .Values.admin.port .Values.admin.grpcPort)) }}
-{{- end }}
-{{- if .Values.worker.enabled }}
-{{-   $ports := list }}
-{{-   if .Values.worker.metricsPort }}
-{{-     $ports = append $ports .Values.worker.metricsPort }}
-{{-   end }}
-{{-   if and .Values.worker.lanceMetricsPort (include "seaweedfs.worker.lanceNamespaceUrl" .) }}
-{{-     $ports = append $ports .Values.worker.lanceMetricsPort }}
-{{-   end }}
-{{-   $targets = append $targets (dict "component" "worker" "ports" $ports) }}
-{{- end }}
-
-{{- if .Values.cosi.enabled }}
-{{- /* The provisioner sidecar watches the COSI CRs, so it needs the API
-       server; nothing needs to reach the driver itself. */}}
-{{-   $targets = append $targets (dict "component" "objectstorage-provisioner" "ports" (list) "apiserver" true) }}
-{{- end }}
-
-{{- /* The hook Jobs. Nothing connects to either, but under a default-deny
-       namespace they need egress or they hang: the bucket hook waits on the
-       master and filer, the resize hook shells out to kubectl.
-
-       The bucket hook is post-install, and Helm applies the release manifest
-       before post-install hooks run, so a plain policy is already in place by
-       then. The resize hook is pre-install weight 0, which runs before the
-       manifest is applied at all, so its policy has to be a pre-install hook
-       itself, at a weight below the Job's. */}}
-{{- if include "seaweedfs.bucketHookEnabled" . }}
-{{-   $targets = append $targets (dict "component" "bucket-hook" "ports" (list)) }}
-{{- end }}
-{{- /* Same cluster lookup the Job is gated on, so the policy appears on exactly
-       the upgrades that grow a PVC and never on the ones that do not. Helm does
-       not garbage-collect hook resources, so a policy rendered unconditionally
-       would be left in the namespace by every install that uninstalls again -
-       and would make egress.kubeApiServer.cidrs mandatory for every release,
-       for a Job most of them never run. */}}
-{{- if include "seaweedfs.volumeResizeHookCommands" . | trim }}
-{{-   $targets = append $targets (dict "component" "volume-resize-hook" "ports" (list) "apiserver" true "hook" "pre-install,pre-upgrade" "hookWeight" "-10") }}
-{{- end }}
-
-{{- /* A key under networkPolicy.components that names no component would be
-       read as "these rules are applied" and silently do nothing. Check against
-       every component the chart can produce rather than the ones enabled here,
-       so one values file can still carry overrides for a component this release
-       leaves off. */}}
-{{- $known := list "master" "filer" "s3" "sftp" "admin" "worker" "volume" "bucket-hook" "volume-resize-hook" "objectstorage-provisioner" "seaweedfs-all-in-one" }}
-{{- range $vname, $_ := (.Values.volumes | default dict) }}
-{{-   $known = append $known (trimSuffix "-" (printf "volume-%s" $vname)) }}
-{{- end }}
-{{- range $name, $_ := $overrides }}
-{{-   if not (has $name $known) }}
-{{-     fail (printf "networkPolicy.components: %q is not a component of this chart, so its rules would never be applied. Known components: %s." $name (join ", " (sortAlpha $known))) }}
-{{-   end }}
-{{- end }}
-
-{{- range $target := $targets }}
-{{- $component := $target.component }}
-{{- $override := get $overrides $component | default dict }}
----
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: {{ include "seaweedfs.componentName" (list $ ($target.name | default $component)) }}
-  namespace: {{ $.Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "seaweedfs.name" $ | quote }}
-    helm.sh/chart: {{ $.Chart.Name }}-{{ $.Chart.Version | replace "+" "_" }}
-    app.kubernetes.io/managed-by: {{ $.Release.Service | quote }}
-    app.kubernetes.io/instance: {{ $.Release.Name | quote }}
-    app.kubernetes.io/component: {{ $component | quote }}
-{{- if $target.hook }}
-  annotations:
-    {{- /* Only before-hook-creation: the policy has to outlive the Job it
-           covers, so it must not be deleted when the Job succeeds. That does
-           leave it behind on uninstall, the usual trade-off for Helm hook
-           resources. */}}
-    "helm.sh/hook": {{ $target.hook }}
-    "helm.sh/hook-weight": {{ $target.hookWeight | quote }}
-    "helm.sh/hook-delete-policy": before-hook-creation
-{{- end }}
-spec:
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: {{ include "seaweedfs.name" $ | quote }}
-      app.kubernetes.io/instance: {{ $.Release.Name | quote }}
-      app.kubernetes.io/component: {{ $component | quote }}
-  policyTypes:
-    - Ingress
-{{- if $egressCfg.enabled }}
-    - Egress
-{{- end }}
-  ingress:
-{{- $extraIngress := concat ($np.extraIngress | default list) ($override.extraIngress | default list) }}
-{{- if and (not $target.ports) (not $extraIngress) }}
-    []
-{{- end }}
-{{- if $target.ports }}
-    - from:
-        - podSelector:
-            matchLabels:
-              app.kubernetes.io/name: {{ include "seaweedfs.name" $ | quote }}
-              app.kubernetes.io/instance: {{ $.Release.Name | quote }}
-      ports:
-{{- range $port := $target.ports }}
-        - protocol: TCP
-          port: {{ $port }}
-{{- end }}
-{{- end }}
-{{- with $extraIngress }}
-{{- toYaml . | nindent 4 }}
-{{- end }}
-{{- if $egressCfg.enabled }}
-  egress:
-    - to:
-        - podSelector:
-            matchLabels:
-              app.kubernetes.io/name: {{ include "seaweedfs.name" $ | quote }}
-              app.kubernetes.io/instance: {{ $.Release.Name | quote }}
-{{- if $egressCfg.allowDNS }}
-{{- /* Emit only the selectors that are set. An empty one has to be left out
-       rather than rendered as null: a missing podSelector means every pod in
-       the namespace, and a missing namespaceSelector means this namespace
-       instead of the one DNS runs in. */}}
-{{- if not (or $egressCfg.dnsNamespaceSelector $egressCfg.dnsPodSelector) }}
-{{- fail "networkPolicy: egress.allowDNS is on but both egress.dnsNamespaceSelector and egress.dnsPodSelector are empty, which would open port 53 to every pod in the release namespace. Set at least one of them, or turn allowDNS off and name the resolver in egress.extraEgress." }}
-{{- end }}
-    - to:
-{{- if and $egressCfg.dnsNamespaceSelector $egressCfg.dnsPodSelector }}
-        - namespaceSelector:
-            {{- toYaml $egressCfg.dnsNamespaceSelector | nindent 12 }}
-          podSelector:
-            {{- toYaml $egressCfg.dnsPodSelector | nindent 12 }}
-{{- else if $egressCfg.dnsNamespaceSelector }}
-        - namespaceSelector:
-            {{- toYaml $egressCfg.dnsNamespaceSelector | nindent 12 }}
-{{- else }}
-        - podSelector:
-            {{- toYaml $egressCfg.dnsPodSelector | nindent 12 }}
-{{- end }}
-      ports:
-        - protocol: UDP
-          port: 53
-        - protocol: TCP
-          port: 53
-{{- end }}
-{{- if and $target.apiserver ($egressCfg.kubeApiServer).enabled }}
-{{- if not $egressCfg.kubeApiServer.cidrs }}
-{{- fail (printf "networkPolicy: %s needs the Kubernetes API server, but networkPolicy.egress.kubeApiServer.cidrs is empty. Set it to your API server address(es), or disable networkPolicy.egress.kubeApiServer and allow it through networkPolicy.egress.extraEgress." $component) }}
-{{- end }}
-{{- /* An empty port list is not "no ports" in a NetworkPolicy, it is every
-       port, so refuse it rather than quietly opening the CIDR up. */}}
-{{- if not $egressCfg.kubeApiServer.ports }}
-{{- fail "networkPolicy: egress.kubeApiServer.ports is empty, which allows every port on the API server CIDR(s) rather than none. Set it (the default is [443, 6443]), or turn egress.kubeApiServer off and describe the access in egress.extraEgress." }}
-{{- end }}
-{{- range $cidr := $egressCfg.kubeApiServer.cidrs }}
-    - to:
-        - ipBlock:
-            cidr: {{ $cidr }}
-      ports:
-{{- range $port := $egressCfg.kubeApiServer.ports }}
-        - protocol: TCP
-          port: {{ $port }}
-{{- end }}
-{{- end }}
-{{- end }}
-{{- with concat ($egressCfg.extraEgress | default list) ($override.extraEgress | default list) }}
-{{- toYaml . | nindent 4 }}
-{{- end }}
-{{- end }}
-{{- end }}
-{{- end }}

k8s/charts/seaweedfs/templates/shared/post-install-bucket-hook.yaml

@@ -1,6 +1,7 @@
 {{- include "seaweedfs.compat" . -}}
 {{- /* Support bucket creation for both standalone filer.s3 and allInOne modes */}}
 {{- $createBuckets := list }}
+{{- $s3Enabled := false }}
 {{- $enableAuth := false }}
 {{- $existingConfigSecret := "" }}
 {{- $bucketsFolder := "/buckets" }}
@@ -12,14 +13,11 @@
 {{- end }}
 {{- $bucketsFolder = default $bucketsFolder (get $bucketEnvVars "WEED_FILER_BUCKETS_FOLDER") }}
 {{- $bucketsFolder = trimSuffix "/" $bucketsFolder }}
-{{- $clusterAlias := default "sw" (get $bucketEnvVars "WEED_CLUSTER_DEFAULT") }}
-{{- $clusterUpper := upper $clusterAlias }}
-{{- $clusterMasterKey := printf "WEED_CLUSTER_%s_MASTER" $clusterUpper }}
-{{- $clusterFilerKey := printf "WEED_CLUSTER_%s_FILER" $clusterUpper }}
 
 {{- /* Check allInOne mode first */}}
 {{- if .Values.allInOne.enabled }}
   {{- if .Values.allInOne.s3.enabled }}
+    {{- $s3Enabled = true }}
     {{- if .Values.allInOne.s3.createBuckets }}
       {{- $createBuckets = .Values.allInOne.s3.createBuckets }}
     {{- end }}
@@ -29,6 +27,7 @@
 {{- else if .Values.master.enabled }}
   {{- /* Check if embedded (in filer) or standalone S3 gateway is enabled */}}
   {{- if or .Values.filer.s3.enabled .Values.s3.enabled }}
+    {{- $s3Enabled = true }}
     {{- if .Values.s3.createBuckets }}
       {{- $createBuckets = .Values.s3.createBuckets }}
       {{- $enableAuth = .Values.s3.enableAuth }}
@@ -41,20 +40,15 @@
   {{- end }}
 {{- end }}
 
-{{- /* Shared with networkpolicy.yaml, which renders this Job's policy exactly
-       when the Job itself renders. */}}
-{{- if include "seaweedfs.bucketHookEnabled" . }}
+{{- if and $s3Enabled $createBuckets }}
 ---
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: "{{ $.Release.Name }}-bucket-hook"
   labels:
-    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
     app.kubernetes.io/instance: {{ .Release.Name | quote }}
-    app.kubernetes.io/component: bucket-hook
   annotations:
     "helm.sh/hook": post-install,post-upgrade
     "helm.sh/hook-weight": "-5"
@@ -64,11 +58,8 @@ spec:
     metadata:
       name: "{{ .Release.Name }}"
       labels:
-        app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-        helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
         app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
         app.kubernetes.io/instance: {{ .Release.Name | quote }}
-        app.kubernetes.io/component: bucket-hook
     spec:
       restartPolicy: Never
       {{- if .Values.filer.podSecurityContext.enabled }}
@@ -80,6 +71,12 @@ spec:
         image: {{ template "seaweedfs.master.image" . }}
         imagePullPolicy: {{ $.Values.global.seaweedfs.imagePullPolicy | default "IfNotPresent" }}
         env:
+          - name: WEED_CLUSTER_DEFAULT
+            value: "sw"
+          - name: WEED_CLUSTER_SW_MASTER
+            value: {{ include "seaweedfs.cluster.masterAddress" . | quote }}
+          - name: WEED_CLUSTER_SW_FILER
+            value: {{ include "seaweedfs.cluster.filerAddress" . | quote }}
           - name: POD_IP
             valueFrom:
               fieldRef:
@@ -94,28 +91,6 @@ spec:
                 fieldPath: metadata.namespace
           - name: SEAWEEDFS_FULLNAME
             value: "{{ include "seaweedfs.fullname" . }}"
-          {{- /* Carries the JWT signing keys when they are set as environment
-                 overrides rather than in security.toml. */}}
-          {{- range $key := keys $bucketEnvVars | sortAlpha }}
-          {{- $value := index $bucketEnvVars $key }}
-          {{- if not (has $key (list "WEED_CLUSTER_DEFAULT" $clusterMasterKey $clusterFilerKey)) }}
-          - name: {{ $key }}
-          {{- if kindIs "string" $value }}
-            value: {{ tpl $value $ | quote }}
-          {{- else }}
-            valueFrom:
-              {{ toYaml $value | nindent 14 | trim }}
-          {{- end }}
-          {{- end }}
-          {{- end }}
-          {{- /* Computed, as in all-in-one: the values pick the cluster alias,
-                 the chart still owns the endpoints the script waits on. */}}
-          - name: WEED_CLUSTER_DEFAULT
-            value: {{ $clusterAlias | quote }}
-          - name: {{ $clusterMasterKey }}
-            value: {{ include "seaweedfs.cluster.masterAddress" . | quote }}
-          - name: {{ $clusterFilerKey }}
-            value: {{ include "seaweedfs.cluster.filerAddress" . | quote }}
         command:
           - "/bin/sh"
           - "-ec"
@@ -128,7 +103,7 @@ spec:
               
               echo "Waiting for service at $url..."
               while [ $attempt -le $max_attempts ]; do
-                if curl -sS -o /dev/null --max-time 5 "$url" >/dev/null 2>&1; then
+                if wget -q --spider "$url" >/dev/null 2>&1; then
                   echo "Service at $url is up!"
                   return 0
                 fi
@@ -140,11 +115,11 @@ spec:
               exit 1
             }
             {{- if .Values.allInOne.enabled }}
-            wait_for_service "http://${{ $clusterMasterKey }}{{ .Values.allInOne.readinessProbe.httpGet.path }}"
-            wait_for_service "http://${{ $clusterFilerKey }}{{ .Values.filer.readinessProbe.httpGet.path }}"
+            wait_for_service "http://$WEED_CLUSTER_SW_MASTER{{ .Values.allInOne.readinessProbe.httpGet.path }}"
+            wait_for_service "http://$WEED_CLUSTER_SW_FILER{{ .Values.filer.readinessProbe.httpGet.path }}"
             {{- else }}
-            wait_for_service "http://${{ $clusterMasterKey }}{{ .Values.master.readinessProbe.httpGet.path }}"
-            wait_for_service "http://${{ $clusterFilerKey }}{{ .Values.filer.readinessProbe.httpGet.path }}"
+            wait_for_service "http://$WEED_CLUSTER_SW_MASTER{{ .Values.master.readinessProbe.httpGet.path }}"
+            wait_for_service "http://$WEED_CLUSTER_SW_FILER{{ .Values.filer.readinessProbe.httpGet.path }}"
             {{- end }}
             {{- range $createBuckets }}
             {{- $bucketName := .name }}
@@ -202,19 +177,11 @@ spec:
                 /usr/bin/weed shell
           {{- end }}  
           {{- end }}
-        {{- if or $enableAuth (include "seaweedfs.securityConfigEnabled" .) }}
+        {{- if $enableAuth }}
         volumeMounts:
-          {{- if $enableAuth }}
           - name: config-users
             mountPath: /etc/sw
             readOnly: true
-          {{- end }}
-          {{- if include "seaweedfs.securityConfigEnabled" . }}
-          - name: security-config
-            readOnly: true
-            mountPath: /etc/seaweedfs/security.toml
-            subPath: security.toml
-          {{- end }}
         {{- end }}
         ports:
           - containerPort: {{ .Values.master.port }}
@@ -232,9 +199,8 @@ spec:
         {{- if .Values.filer.containerSecurityContext.enabled }}
         securityContext: {{- omit .Values.filer.containerSecurityContext "enabled" | toYaml | nindent 12 }}
         {{- end }}
-    {{- if or $enableAuth (include "seaweedfs.securityConfigEnabled" .) }}
+    {{- if $enableAuth }}
       volumes:
-        {{- if $enableAuth }}
         - name: config-users
           secret:
             defaultMode: 420
@@ -243,11 +209,5 @@ spec:
             {{- else }}
             secretName: {{ include "seaweedfs.fullname" . }}-s3-secret
             {{- end }}
-        {{- end }}
-        {{- if include "seaweedfs.securityConfigEnabled" . }}
-        - name: security-config
-          configMap:
-            name: {{ include "seaweedfs.fullname" . }}-security-config
-        {{- end }}
     {{- end }}
 {{- end }}

k8s/charts/seaweedfs/templates/shared/secret-seaweedfs-db.yaml

@@ -1,4 +1,4 @@
-{{- if and .Values.filer.enabled (include "seaweedfs.filer.mysqlEnabled" .) }}
+{{- if .Values.filer.enabled }}
 apiVersion: v1
 kind: Secret
 type: Opaque

k8s/charts/seaweedfs/templates/volume/volume-resize-hook.yaml

@@ -1,20 +1,58 @@
 {{- $seaweedfsName := include "seaweedfs.fullname" $ }}
-{{- /* Shared with networkpolicy.yaml, which renders this Job's policy exactly
-       when the Job itself renders. */}}
-{{- /* trim: include returns a string, and a whitespace-only one is truthy. */}}
-{{- $commands := include "seaweedfs.volumeResizeHookCommands" . | trim }}
+{{- $volumes := deepCopy .Values.volumes | mergeOverwrite (dict "" .Values.volume)  }}
 
-{{- if $commands }}
+
+{{- if .Values.volume.resizeHook.enabled }}
+{{-   $commands := list }}
+{{-   range $vname, $volume := $volumes }}
+{{-     $volumeName := trimSuffix "-" (printf "volume-%s" $vname) }}
+{{-     $volume := mergeOverwrite (deepCopy $.Values.volume) (dict "enabled" true) $volume }}
+
+{{-     if $volume.enabled }}
+{{-       $replicas := int $volume.replicas -}}
+{{-       $statefulsetName := printf "%s-%s" $seaweedfsName $volumeName -}}
+{{-       $statefulset := (lookup "apps/v1" "StatefulSet" $.Release.Namespace $statefulsetName) -}}
+
+{{/*      Check for changes in volumeClaimTemplates */}}
+{{-       if $statefulset }}
+{{-         range $dir := $volume.dataDirs }}
+{{-           if eq .type "persistentVolumeClaim" }}
+{{-             $desiredSize := .size }}
+{{-             range $statefulset.spec.volumeClaimTemplates }}
+{{-               if and (eq .metadata.name $dir.name) (ne .spec.resources.requests.storage $desiredSize) }}
+{{-                 $commands = append $commands (printf "kubectl delete statefulset %s --cascade=orphan" $statefulsetName) }}
+{{-               end }}
+{{-             end }}
+{{-           end }}
+{{-         end }}
+{{-       end }}
+
+{{/*      Check for the need for patching existing PVCs */}}
+{{-       range $dir := $volume.dataDirs }}
+{{-         if eq .type "persistentVolumeClaim" }}
+{{-           $desiredSize := .size }}
+{{-           range $i, $e := until $replicas }}
+{{-             $pvcName := printf "%s-%s-%s-%d" $dir.name $seaweedfsName $volumeName $e }}
+{{-             $currentPVC := (lookup "v1" "PersistentVolumeClaim" $.Release.Namespace $pvcName) }}
+{{-             if and $currentPVC }}
+{{-             $oldSize := include "seaweedfs.resource-quantity" $currentPVC.spec.resources.requests.storage }}
+{{-             $newSize := include "seaweedfs.resource-quantity" $desiredSize }}
+{{-               if gt $newSize $oldSize }}
+{{-               $commands = append $commands (printf "kubectl patch pvc %s-%s-%s-%d -p '{\"spec\":{\"resources\":{\"requests\":{\"storage\":\"%s\"}}}}'" $dir.name $seaweedfsName $volumeName $e $desiredSize) }}
+{{-               end }}
+{{-             end }}
+{{-           end }}
+{{-         end }}
+{{-       end }}
+
+{{-     end }}
+{{-   end }}
+
+{{-   if $commands }}
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: "{{ $seaweedfsName }}-volume-resize-hook"
-  labels:
-    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
-    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-    app.kubernetes.io/instance: {{ .Release.Name | quote }}
-    app.kubernetes.io/component: volume-resize-hook
   annotations:
     helm.sh/hook: pre-install,pre-upgrade
     helm.sh/hook-weight: "0"
@@ -22,13 +60,6 @@ metadata:
 spec:
   backoffLimit: 1
   template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-        helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
-        app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-        app.kubernetes.io/instance: {{ .Release.Name | quote }}
-        app.kubernetes.io/component: volume-resize-hook
     spec:
       serviceAccountName: {{ $seaweedfsName }}-volume-resize-hook
       restartPolicy: Never
@@ -38,7 +69,9 @@ spec:
           command: ["sh", "-xec"]
           args:
             - |
-{{ $commands | indent 14 }}
+              {{- range $commands }}
+              {{ . }}
+              {{- end }}
 ---
 apiVersion: v1
 kind: ServiceAccount
@@ -80,4 +113,5 @@ roleRef:
   kind: Role
   name: {{ $seaweedfsName }}-volume-resize-hook
   apiGroup: rbac.authorization.k8s.io
+{{-   end }}
 {{- end }}

k8s/charts/seaweedfs/templates/volume/volume-statefulset.yaml

@@ -73,9 +73,6 @@ spec:
       {{- if $volume.priorityClassName }}
       priorityClassName: {{ $volume.priorityClassName | quote }}
       {{- end }}
-      {{- if $volume.schedulerName }}
-      schedulerName: {{ $volume.schedulerName | quote }}
-      {{- end }}
       enableServiceLinks: false
       serviceAccountName: {{ $volume.serviceAccountName | default (include "seaweedfs.serviceAccountName" $) | quote }} # for deleting statefulset pods after migration
       {{- $initContainers_exists := include "seaweedfs.volume.initContainers_exists" $ -}}

k8s/charts/seaweedfs/templates/worker/worker-deployment.yaml

@@ -64,9 +64,6 @@ spec:
       {{- if .Values.worker.priorityClassName }}
       priorityClassName: {{ .Values.worker.priorityClassName | quote }}
       {{- end }}
-      {{- if .Values.worker.schedulerName }}
-      schedulerName: {{ .Values.worker.schedulerName | quote }}
-      {{- end }}
       enableServiceLinks: false
       {{- if .Values.worker.serviceAccountName }}
       serviceAccountName: {{ .Values.worker.serviceAccountName | quote }}
@@ -223,81 +220,6 @@ spec:
           {{- if .Values.worker.containerSecurityContext.enabled }}
           securityContext: {{- omit .Values.worker.containerSecurityContext "enabled" | toYaml | nindent 12 }}
           {{- end }}
-        {{- if include "seaweedfs.worker.lanceNamespaceUrl" . }}
-        - name: worker-lance
-          image: {{ template "seaweedfs.worker.image" . }}
-          imagePullPolicy: {{ default "IfNotPresent" .Values.global.seaweedfs.imagePullPolicy }}
-          env:
-            - name: POD_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-            {{- /* the URL crosses a shell line; metacharacters must arrive as data, not syntax */}}
-            - name: LANCE_NAMESPACE_URL
-              value: {{ include "seaweedfs.worker.lanceNamespaceUrl" . | quote }}
-          command:
-            - "/bin/sh"
-            - "-ec"
-            - |
-              {{- /* the armv7/386 placeholder is empty; exec of it becomes the shell and exits 0 */}}
-              if [ ! -s /usr/bin/weed-worker ]; then
-                echo "the Rust worker is not available on this platform ($(uname -m)); it ships for amd64 and arm64" >&2
-                exit 1
-              fi
-              exec /usr/bin/weed-worker \
-              --id="$POD_NAME" \
-              {{- if .Values.worker.adminServer }}
-              --admin={{ .Values.worker.adminServer }} \
-              {{- else }}
-              --admin={{ template "seaweedfs.fullname" . }}-admin.{{ .Release.Namespace }}:{{ .Values.admin.port }}{{ if .Values.admin.grpcPort }}.{{ .Values.admin.grpcPort }}{{ end }} \
-              {{- end }}
-              --namespace="$LANCE_NAMESPACE_URL" \
-              {{- if .Values.global.seaweedfs.enableSecurity }}
-              --tls-ca=/usr/local/share/ca-certificates/ca/tls.crt \
-              --tls-cert=/usr/local/share/ca-certificates/worker/tls.crt \
-              --tls-key=/usr/local/share/ca-certificates/worker/tls.key \
-              {{- end }}
-              {{- if .Values.worker.lanceMetricsPort }}
-              --metrics-port={{ .Values.worker.lanceMetricsPort }} \
-              --metrics-ip=0.0.0.0 \
-              {{- end }}
-              --max-concurrency={{ .Values.worker.maxExecute }}
-          {{- if .Values.global.seaweedfs.enableSecurity }}
-          volumeMounts:
-            - name: ca-cert
-              readOnly: true
-              mountPath: /usr/local/share/ca-certificates/ca/
-            - name: worker-cert
-              readOnly: true
-              mountPath: /usr/local/share/ca-certificates/worker/
-          {{- end }}
-          {{- if .Values.worker.lanceMetricsPort }}
-          ports:
-            - containerPort: {{ .Values.worker.lanceMetricsPort }}
-              name: lance-metrics
-          livenessProbe:
-            httpGet:
-              path: /health
-              port: lance-metrics
-            initialDelaySeconds: 30
-            periodSeconds: 60
-            successThreshold: 1
-            failureThreshold: 5
-            timeoutSeconds: 10
-          readinessProbe:
-            httpGet:
-              path: /ready
-              port: lance-metrics
-            initialDelaySeconds: 20
-            periodSeconds: 15
-            successThreshold: 1
-            failureThreshold: 3
-            timeoutSeconds: 10
-          {{- end }}
-          {{- if .Values.worker.containerSecurityContext.enabled }}
-          securityContext: {{- omit .Values.worker.containerSecurityContext "enabled" | toYaml | nindent 12 }}
-          {{- end }}
-        {{- end }}
       {{- if .Values.worker.sidecars }}
       {{- include "seaweedfs.tplvalues.render" (dict "value" .Values.worker.sidecars "context" $) | nindent 8 }}
       {{- end }}

k8s/charts/seaweedfs/templates/worker/worker-service.yaml

@@ -12,22 +12,13 @@ metadata:
     app.kubernetes.io/component: worker
 spec:
   clusterIP: None  # Headless service
-  {{- $lanceMetrics := and .Values.worker.lanceMetricsPort (include "seaweedfs.worker.lanceNamespaceUrl" .) }}
-  {{- if or .Values.worker.metricsPort $lanceMetrics }}
-  ports:
   {{- if .Values.worker.metricsPort }}
+  ports:
   - name: "metrics"
     port: {{ .Values.worker.metricsPort }}
     targetPort: {{ .Values.worker.metricsPort }}
     protocol: TCP
   {{- end }}
-  {{- if $lanceMetrics }}
-  - name: "lance-metrics"
-    port: {{ .Values.worker.lanceMetricsPort }}
-    targetPort: {{ .Values.worker.lanceMetricsPort }}
-    protocol: TCP
-  {{- end }}
-  {{- end }}
   selector:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     app.kubernetes.io/instance: {{ .Release.Name }}

k8s/charts/seaweedfs/templates/worker/worker-servicemonitor.yaml

@@ -1,7 +1,6 @@
 {{- include "seaweedfs.compat" . -}}
 {{- if .Values.worker.enabled }}
-{{- $lanceMetrics := and .Values.worker.lanceMetricsPort (include "seaweedfs.worker.lanceNamespaceUrl" .) }}
-{{- if or .Values.worker.metricsPort $lanceMetrics }}
+{{- if .Values.worker.metricsPort }}
 {{- if .Values.global.seaweedfs.monitoring.enabled }}
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
@@ -23,16 +22,9 @@ metadata:
 {{- end }}
 spec:
   endpoints:
-    {{- if .Values.worker.metricsPort }}
     - interval: 30s
       port: metrics
       scrapeTimeout: 5s
-    {{- end }}
-    {{- if $lanceMetrics }}
-    - interval: 30s
-      port: lance-metrics
-      scrapeTimeout: 5s
-    {{- end }}
   selector:
     matchLabels:
       app.kubernetes.io/name: {{ template "seaweedfs.name" . }}

k8s/charts/seaweedfs/values.yaml

@@ -12,16 +12,7 @@ global:
     image:
       # if repository is set, it overrides the namespace part of image.name
       repository: ""
-      # chrislusf/seaweedfs-enterprise for the enterprise edition
       name: chrislusf/seaweedfs
-    # Enterprise license file, held in a Secret in the release namespace and
-    # mounted read-only on the components that run a master. A renewed Secret
-    # reaches the running master without a restart. SEAWEED_LICENSE is reserved
-    # while this is set: an extraEnvironmentVars entry of that name is dropped.
-    license:
-      existingSecret: ""
-      secretKey: seaweed-license.json
-      mountPath: /etc/seaweedfs/license
     imagePullPolicy: IfNotPresent
     restartPolicy: Always
     loggingLevel: 1
@@ -134,7 +125,7 @@ master:
   #    annotations:
   #      "key": "value"
   #
-  # You may also specify an existing claim:
+  # You may also spacify an existing claim:
   #  data:
   #    type: "existingClaim"
   #    claimName: "my-pvc"
@@ -142,13 +133,8 @@ master:
   # You can also use emptyDir storage:
   #  data:
   #    type: "emptyDir"
-  # -mdir holds the Raft log and snapshots, and with them the cluster's
-  # identity (its topology UUID). A hostPath does not follow a rescheduled pod,
-  # so prefer type "persistentVolumeClaim" for new installs. The default stays
-  # hostPath so existing releases keep upgrading; see the README to switch one.
   data:
     type: "hostPath"
-    size: "1Gi"
     storageClass: ""
     hostPathPrefix: /ssd
 
@@ -242,10 +228,6 @@ master:
   # ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
   priorityClassName: ""
 
-  # used to specify a custom scheduler for master pods
-  # ref: https://kubernetes.io/docs/concepts/scheduling-eviction/kube-scheduler/
-  schedulerName: ""
-
   # used to assign a service account.
   # ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
   serviceAccountName: ""
@@ -369,7 +351,7 @@ volume:
   #      "key": "value"
   #     maxVolumes: 0  # If set to zero on non-windows OS, the limit will be auto configured. (default "7")
   #
-  # You may also specify an existing claim:
+  # You may also spacify an existing claim:
   #   - name: data
   #     type: "existingClaim"
   #     claimName: "my-pvc"
@@ -539,10 +521,6 @@ volume:
   # ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
   priorityClassName: ""
 
-  # used to specify a custom scheduler for volume pods
-  # ref: https://kubernetes.io/docs/concepts/scheduling-eviction/kube-scheduler/
-  schedulerName: ""
-
   # used to assign a service account.
   # ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
   serviceAccountName: ""
@@ -823,10 +801,6 @@ filer:
   # ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
   priorityClassName: ""
 
-  # used to specify a custom scheduler for filer pods
-  # ref: https://kubernetes.io/docs/concepts/scheduling-eviction/kube-scheduler/
-  schedulerName: ""
-
   # used to assign a service account.
   # ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
   serviceAccountName: ""
@@ -897,7 +871,6 @@ filer:
 
   # extraEnvVars is a list of extra environment variables to set with the stateful set.
   extraEnvironmentVars:
-    # the WEED_MYSQL_* keys and the db credential secret only render while this is "true"
     WEED_MYSQL_ENABLED: "false"
     WEED_MYSQL_HOSTNAME: "mysql-db-host"
     WEED_MYSQL_PORT: "3306"
@@ -1006,9 +979,6 @@ s3:
   # Iceberg catalog REST port (Apache Iceberg REST Catalog API)
   # Set to a port number to enable, or 0/null to disable
   icebergPort: null
-  # Lance Namespace port; weed serves 9101 by default, 0 disables it
-  # (and, unless worker.namespaceUrl points elsewhere, the worker's Lance container)
-  lancePort: 9101
   loggingOverrideLevel: null
   # enable user & permission to s3 (need to inject to all services)
   enableAuth: false
@@ -1018,24 +988,13 @@ s3:
   # Optionally provide explicit credentials for the S3 gateway.
   # When set, these are used in the generated s3 secret instead of
   # auto-generating random credentials.
-  # An identity may instead name an existing Secret to read its keys from. The
-  # generated config then references the keys through environment variables, so
-  # nothing is looked up at render time and a dry run renders what an install
-  # applies. Note the COSI driver parses the config itself and does not resolve
-  # those references.
   # credentials:
   #   admin:
   #     accessKey: ""
   #     secretKey: ""
-  #     existingSecret: ""
-  #     accessKeyKey: admin_access_key_id
-  #     secretKeyKey: admin_secret_access_key
   #   read:
   #     accessKey: ""
   #     secretKey: ""
-  #     existingSecret: ""
-  #     accessKeyKey: read_access_key_id
-  #     secretKeyKey: read_secret_access_key
   auditLogConfig: {}
   # You may specify buckets to be created during the install or upgrade process.
   # Buckets may be exposed publicly by setting `anonymousRead` to `true`
@@ -1101,10 +1060,6 @@ s3:
   # ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
   priorityClassName: ""
 
-  # used to assign a custom scheduler to server pods
-  # ref: https://kubernetes.io/docs/tasks/extend-kubernetes/configure-multiple-schedulers/
-  schedulerName: ""
-
   # used to assign a service account.
   # ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
   serviceAccountName: ""
@@ -1187,16 +1142,11 @@ s3:
   # Service settings
   service:
     type: ClusterIP
-    # used only when type is LoadBalancer
-    loadBalancerClass: ""
-    loadBalancerIP: ""
-    loadBalancerSourceRanges: []
     # fixed nodePorts, used only when type is NodePort or LoadBalancer
     nodePorts:
       http: null
       https: null
       iceberg: null
-      lance: null
       metrics: null
 
   icebergIngress:
@@ -1208,15 +1158,6 @@ s3:
     annotations: {}
     tls: []
 
-  lanceIngress:
-    enabled: false
-    className: ""
-    host: "seaweedfs-lance.cluster.local"
-    path: "/"
-    pathType: Prefix
-    annotations: {}
-    tls: []
-
 sftp:
   enabled: false
   imageOverride: null
@@ -1272,7 +1213,6 @@ sftp:
   tolerations: ""
   nodeSelector: ""
   priorityClassName: ""
-  schedulerName: ""
   serviceAccountName: ""
   podSecurityContext: {}
   containerSecurityContext: {}
@@ -1305,10 +1245,6 @@ sftp:
   # Service settings
   service:
     type: ClusterIP
-    # used only when type is LoadBalancer
-    loadBalancerClass: ""
-    loadBalancerIP: ""
-    loadBalancerSourceRanges: []
     # fixed nodePorts, used only when type is NodePort or LoadBalancer
     nodePorts:
       sftp: null
@@ -1401,7 +1337,6 @@ admin:
   tolerations: ""
   nodeSelector: ""
   priorityClassName: ""
-  schedulerName: ""
   serviceAccountName: ""
   podSecurityContext: {}
   containerSecurityContext: {}
@@ -1451,10 +1386,6 @@ admin:
   service:
     type: ClusterIP
     annotations: {}
-    # used only when type is LoadBalancer
-    loadBalancerClass: ""
-    loadBalancerIP: ""
-    loadBalancerSourceRanges: []
     # fixed nodePorts, used only when type is NodePort or LoadBalancer
     nodePorts:
       http: null
@@ -1473,15 +1404,6 @@ worker:
   metricsPort: 9327
   metricsIp: ""  # If empty, defaults to 0.0.0.0
 
-  # The lance_* jobs run in their own container, /usr/bin/weed-worker.
-  # amd64/arm64 only; pin mixed clusters with worker.affinity/nodeSelector.
-
-  # Lance namespace URL override; empty derives it from s3.lancePort.
-  namespaceUrl: ""
-
-  # Metrics port for the Lance worker container; the Go worker keeps metricsPort
-  lanceMetricsPort: 9328
-
   # Admin server to connect to
   adminServer: ""
 
@@ -1557,7 +1479,6 @@ worker:
   tolerations: ""
   nodeSelector: ""
   priorityClassName: ""
-  schedulerName: ""
   serviceAccountName: ""
   podSecurityContext: {}
   containerSecurityContext: {}
@@ -1688,10 +1609,6 @@ allInOne:
     annotations: {}  # Annotations for the service
     type: ClusterIP  # Service type (ClusterIP, NodePort, LoadBalancer)
     internalTrafficPolicy: Cluster  # Internal traffic policy
-    # used only when type is LoadBalancer
-    loadBalancerClass: ""
-    loadBalancerIP: ""
-    loadBalancerSourceRanges: []
     # fixed nodePorts, used only when type is NodePort or LoadBalancer
     nodePorts:
       master: null
@@ -1801,10 +1718,6 @@ allInOne:
   # ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
   priorityClassName: ""
 
-  # Used to assign a custom scheduler to pods
-  # ref: https://kubernetes.io/docs/tasks/extend-kubernetes/configure-multiple-schedulers/
-  schedulerName: ""
-
   # Used to assign a service account.
   # ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
   serviceAccountName: ""
@@ -1867,10 +1780,6 @@ cosi:
   podSecurityContext: {}
   containerSecurityContext: {}
 
-  # used to assign a custom scheduler to cosi pods
-  # ref: https://kubernetes.io/docs/tasks/extend-kubernetes/configure-multiple-schedulers/
-  schedulerName: ""
-
   extraVolumes: ""
   extraVolumeMounts: ""
 
@@ -1901,140 +1810,3 @@ certificates:
 podLabels: {}
 # Annotations to be added to all the created pods
 podAnnotations: {}
-
-networkPolicy:
-  # Opt-in. While false the chart renders no NetworkPolicy objects at all and
-  # the cluster default (usually allow-all) applies. Turn this on for a
-  # namespace with a default-deny policy, where the components otherwise
-  # cannot reach each other and the install hangs.
-  #
-  # This alone covers a default-deny that only restricts ingress. If yours has
-  # Egress in its policyTypes as well - the usual baseline - the components
-  # still cannot resolve DNS or reach each other, and you need egress.enabled
-  # below too, together with an extraEgress entry for the filer store.
-  enabled: false
-
-  # One policy is rendered per component, selecting its pods by the standard
-  # app.kubernetes.io/{name,instance,component} labels. Each policy admits
-  # traffic from any pod of this release, on the ports that component listens
-  # on - the same values the containerPorts are taken from, so changing a port
-  # does not leave the policy behind. Everything else is denied.
-  #
-  # Traffic from outside the release has to be added here. Rules are plain
-  # NetworkPolicyIngressRule entries, appended to every component's policy.
-  #
-  # The metrics ports are covered by the same rule as everything else, so with
-  # global.seaweedfs.monitoring.enabled the ServiceMonitors keep pointing at
-  # ports a Prometheus outside the release can no longer reach. Nothing reports
-  # that - the targets just go down - so add the scraper here:
-  #
-  #   extraIngress:
-  #     # an ingress controller reaching filer/s3/admin
-  #     - from:
-  #         - namespaceSelector:
-  #             matchLabels:
-  #               kubernetes.io/metadata.name: ingress-nginx
-  #       ports:
-  #         - protocol: TCP
-  #           port: 8888
-  #         - protocol: TCP
-  #           port: 8333
-  #     # Prometheus scraping the metrics ports
-  #     - from:
-  #         - namespaceSelector:
-  #             matchLabels:
-  #               kubernetes.io/metadata.name: monitoring
-  #       ports:
-  #         - protocol: TCP
-  #           port: 9327
-  #
-  # An ingress controller running on the host network is not a pod as far as
-  # the policy is concerned; select it with an ipBlock of the node addresses
-  # instead of a namespaceSelector.
-  #
-  # Kubelet probes are not covered by these rules. Node-to-pod traffic is
-  # outside NetworkPolicy in the CNIs that come up without host endpoints
-  # (Calico, Cilium); if yours polices it, allow the node addresses here.
-  extraIngress: []
-
-  egress:
-    # Egress is a separate opt-in: the chart knows the addresses of its own
-    # components, but not where your filer store (MySQL, Postgres, Redis,
-    # ...), notification sink or remote tier lives. Enabling this without
-    # listing those under extraEgress will cut the filer off from its store.
-    #
-    # It cannot be on by default either. In a namespace with no default-deny,
-    # egress rules would take the components from "may reach anything" down to
-    # "may reach the peers listed here", which is the same breakage from the
-    # other direction. Required if your default-deny covers egress.
-    enabled: false
-
-    # Every component resolves its peers by DNS name, so this is required
-    # for the release to function at all.
-    #
-    # The defaults below are CoreDNS as kubeadm, kind and the managed offerings
-    # from AWS, Google and Azure install it. OpenShift runs its resolver
-    # elsewhere and needs both overridden:
-    #   dnsNamespaceSelector:
-    #     matchLabels:
-    #       kubernetes.io/metadata.name: openshift-dns
-    #   dnsPodSelector:
-    #     matchLabels:
-    #       dns.operator.openshift.io/daemonset-dns: default
-    # A node-local DNS cache is not a pod peer at all - the resolver address is
-    # a link-local IP - so name it with an ipBlock in extraEgress instead.
-    allowDNS: true
-    dnsNamespaceSelector:
-      matchLabels:
-        kubernetes.io/metadata.name: kube-system
-    dnsPodSelector:
-      matchLabels:
-        k8s-app: kube-dns
-
-    # The COSI sidecar watches the COSI custom resources and the volume resize
-    # hook shells out to kubectl. Only those two get this rule - no seaweedfs
-    # component itself speaks to the Kubernetes API. The resize hook's policy,
-    # and with it this requirement, only appears on an upgrade that actually
-    # grows a volume PVC.
-    kubeApiServer:
-      enabled: true
-      # The API server cannot be selected by label, so its address has to be
-      # given here - there is no sane default, and 0.0.0.0/0 would defeat the
-      # point. Rendering fails with a pointer to this value if a component
-      # needs the API server and this is empty.
-      #
-      # Use the endpoint behind the kubernetes service, not its ClusterIP:
-      # kube-proxy rewrites the destination before the packet is matched.
-      #   kubectl get endpointslice kubernetes -o jsonpath='{.endpoints[*].addresses[*]}'
-      cidrs: []
-      ports: [443, 6443]
-
-    # Plain NetworkPolicyEgressRule entries, appended to every component's
-    # policy. This is where the filer store and the notification sinks go:
-    #
-    #   extraEgress:
-    #     - to:
-    #         - podSelector:
-    #             matchLabels:
-    #               app.kubernetes.io/name: mysql
-    #       ports:
-    #         - protocol: TCP
-    #           port: 3306
-    extraEgress: []
-
-  # Per-component additions, keyed by the component's app.kubernetes.io/component
-  # label value, for rules that should not apply to the whole release. The keys
-  # are master, filer, s3, sftp, admin, worker, bucket-hook,
-  # volume-resize-hook, objectstorage-provisioner, seaweedfs-all-in-one, and
-  # volume (plus volume-<name> for every entry under `volumes`):
-  #
-  #   components:
-  #     filer:
-  #       extraEgress:
-  #         - to:
-  #             - ipBlock:
-  #                 cidr: 10.0.0.5/32
-  #           ports:
-  #             - protocol: TCP
-  #               port: 5432
-  components: {}

note/icon.svg

@@ -1,66 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<svg id="Ebene_2" data-name="Ebene 2" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 512 512">
-  <defs>
-    <style>
-      .cls-1 {
-        fill: url(#Unbenannter_Verlauf_20);
-      }
-
-      .cls-2 {
-        fill: url(#Unbenannter_Verlauf_32);
-      }
-
-      .cls-3 {
-        fill: url(#Unbenannter_Verlauf_42);
-      }
-
-      .cls-4 {
-        fill: #fff;
-      }
-
-      .cls-5 {
-        fill: url(#Unbenannter_Verlauf_12);
-      }
-
-      .cls-6 {
-        fill: url(#Unbenannter_Verlauf_28);
-      }
-    </style>
-    <linearGradient id="Unbenannter_Verlauf_12" data-name="Unbenannter Verlauf 12" x1="19.92" y1="19.92" x2="492.08" y2="492.08" gradientUnits="userSpaceOnUse">
-      <stop offset="0" stop-color="#0282e9"/>
-      <stop offset=".48" stop-color="#0162bf"/>
-      <stop offset=".87" stop-color="#01469b"/>
-    </linearGradient>
-    <linearGradient id="Unbenannter_Verlauf_42" data-name="Unbenannter Verlauf 42" x1="180.67" y1="151.78" x2="234.43" y2="384.66" gradientUnits="userSpaceOnUse">
-      <stop offset="0" stop-color="#23b5e6"/>
-      <stop offset=".41" stop-color="#138bcf"/>
-      <stop offset=".86" stop-color="#0158b3"/>
-    </linearGradient>
-    <linearGradient id="Unbenannter_Verlauf_28" data-name="Unbenannter Verlauf 28" x1="275.58" y1="46.33" x2="275.58" y2="466.33" gradientUnits="userSpaceOnUse">
-      <stop offset="0" stop-color="#9fecf6"/>
-      <stop offset=".49" stop-color="#62dff2"/>
-      <stop offset="1" stop-color="#0a6cb7"/>
-    </linearGradient>
-    <linearGradient id="Unbenannter_Verlauf_20" data-name="Unbenannter Verlauf 20" x1="124.99" y1="226.28" x2="235.06" y2="462.33" gradientUnits="userSpaceOnUse">
-      <stop offset="0" stop-color="#c9f9fd"/>
-      <stop offset=".29" stop-color="#9fe7f6"/>
-      <stop offset=".93" stop-color="#36bbe5"/>
-      <stop offset="1" stop-color="#2ab6e3"/>
-    </linearGradient>
-    <linearGradient id="Unbenannter_Verlauf_32" data-name="Unbenannter Verlauf 32" x1="358.38" y1="251.34" x2="277.45" y2="473.69" gradientUnits="userSpaceOnUse">
-      <stop offset="0" stop-color="#43cbee"/>
-      <stop offset=".42" stop-color="#29a1d6"/>
-      <stop offset="1" stop-color="#0161b2"/>
-    </linearGradient>
-  </defs>
-  <g id="seaweedfs">
-    <rect id="background" class="cls-5" width="512" height="512" rx="68" ry="68"/>
-    <circle class="cls-4" cx="366.58" cy="152.44" r="31.33"/>
-    <circle class="cls-4" cx="386.81" cy="223.33" r="18.67"/>
-    <circle class="cls-4" cx="383.69" cy="288" r="9.22"/>
-    <path class="cls-3" d="M177.81,152.44s22.5,8.02,30.17,28.02c7.67,20,3.83,61.31,9.5,81.98s19.33,29,21,45.67-1.67,76-1.67,76c0,0-24-31.89-29.5-64s-21.53-41.06-24.6-65.72c-3.07-24.67.77-32.61,2.1-54.61s-1.84-35.72-7-47.33Z"/>
-    <path class="cls-6" d="M288.58,46.33c-14.56,7.67-42.22,35.22-42.22,79.11s23.11,54.22,23.11,94.22-38.89,48.11-38.89,95.56,21.56,66,21.56,95.56-11.11,55.56-11.11,55.56c0,0,26.97-17.72,33.33-60s-6.89-54.44,7.22-81.78,39-48.22,39-92.89-36.78-89.22-40.89-108.44-2.33-43.22,8.89-76.89Z"/>
-    <path class="cls-1" d="M120.58,228.33s31.72,14.27,41.55,36.5c9.83,22.22,3.45,40.17,17.45,61.17s51,41,56,73.33-7.67,66.33-7.67,66.33c0,0-5.67-59-30.33-73.33s-46.33-35.67-54.33-59-1.33-50.67-5.33-69c-4-18.33-7.33-23.67-17.33-36Z"/>
-    <path class="cls-2" d="M352.25,249.11c-9,5.67-18.87,17.85-21.71,31.2s2.94,19.57-7.06,41.57-22.19,25.28-30.97,49.72.21,35.36-11.33,59.56-23.92,35.17-23.92,35.17c0,0,34.77-8.17,45.69-30.94s5.08-35.22,20.53-52.61,24.67-30.89,27.25-56.72-7.33-26.22,1.53-76.94Z"/>
-  </g>
-</svg>

other/java/client/src/main/java/seaweedfs/client/SeaweedInputStream.java

@@ -205,7 +205,7 @@ public class SeaweedInputStream extends InputStream {
      * length returned is the length
      * as of the time the Stream was opened. Specifically, if there have been
      * subsequent appends to the file,
-     * they won't be reflected in the returned length.
+     * they wont be reflected in the returned length.
      *
      * @return length of the file.
      * @throws IOException if the stream is closed

other/java/client/src/main/proto/filer.proto

@@ -121,12 +121,6 @@ message LookupDirectoryEntryRequest {
 
 message LookupDirectoryEntryResponse {
     Entry entry = 1;
-    // filer log position stamped before the entry read: every event at or
-    // below it is reflected in the returned entry
-    int64 log_ts_ns = 2;
-    // signature of the filer whose clock stamped log_ts_ns; positions are
-    // only comparable with events that filer logged
-    int32 log_signature = 3;
 }
 
 message ListEntriesRequest {
@@ -136,10 +130,6 @@ message ListEntriesRequest {
     bool inclusiveStartFrom = 4;
     uint32 limit = 5;
     int64 snapshot_ts_ns = 6;
-    // Leave the chunk list out of every entry in the response. The attributes
-    // still carry the file size, so a listing that only reads attributes can
-    // ask for this and skip the largest part of the payload.
-    bool omit_chunks = 7;
 }
 
 message ListEntriesResponse {
@@ -456,10 +446,6 @@ message CreateEntryResponse {
     string error = 1;                          // kept for human readability + backward compat
     SubscribeMetadataResponse metadata_event = 2;
     FilerError error_code = 3;                 // machine-readable error code
-    // filer log position stamped under the path lock before the write:
-    // every event at or below it is reflected in the acknowledged state
-    int64 log_ts_ns = 4;
-    int32 log_signature = 5; // filer whose clock stamped log_ts_ns
 }
 
 message UpdateEntryRequest {
@@ -475,10 +461,6 @@ message UpdateEntryRequest {
 }
 message UpdateEntryResponse {
     SubscribeMetadataResponse metadata_event = 1;
-    // filer log position stamped under the path lock before the write:
-    // every event at or below it is reflected in the acknowledged state
-    int64 log_ts_ns = 2;
-    int32 log_signature = 3; // filer whose clock stamped log_ts_ns
 }
 
 message TouchAccessTimeRequest {
@@ -608,9 +590,6 @@ message StatisticsResponse {
     uint64 total_size = 4;
     uint64 used_size = 5;
     uint64 file_count = 6;
-    // sizes counting one copy of the data, as reported by the master
-    uint64 logical_total_size = 7;
-    uint64 logical_used_size = 8;
 }
 
 message PingRequest {
@@ -765,8 +744,7 @@ message FilerConf {
         string data_node = 11;
         uint32 max_file_name_length = 12;
         bool disable_chunk_deletion = 13;
-        // unset inherits from the enclosing path rule, set overrides it
-        optional bool worm = 14;
+        bool worm = 14;
         uint64 worm_grace_period_seconds = 15;
         uint64 worm_retention_time_seconds = 16;
     }
@@ -785,10 +763,6 @@ message CacheRemoteObjectToLocalClusterRequest {
 message CacheRemoteObjectToLocalClusterResponse {
     Entry entry = 1;
     SubscribeMetadataResponse metadata_event = 2;
-    // filer log position stamped before the entry read: every event at or
-    // below it is reflected in the returned entry
-    int64 log_ts_ns = 3;
-    int32 log_signature = 4; // filer whose clock stamped log_ts_ns
 }
 
 /////////////////////////