docs(g15e): add dynamic cleanup QA instruction

docs(g15d): record dynamic PVC QA pass
docs(g15d): add dynamic PVC QA instruction
2026-10-07 07:06:33 +00:00 · 2026-05-03 14:30:11 -07:00 · 2026-05-03 11:59:48 -07:00 · 2026-05-03 11:23:28 -07:00 · 2026-05-03 11:17:33 -07:00 · 2026-05-03 11:10:35 -07:00
1898 changed files with 421253 additions and 23142 deletions
@@ -5,7 +5,6 @@
 # How are we solving the problem?


-
 # How is the PR tested?


@@ -13,3 +12,8 @@
 # Checks
 - [ ] I have added unit tests if possible.
 - [ ] I will add related wiki document changes and link to this PR after merging.
+- [ ] All AI code review comments have been addressed. No more comments to fix if reviewed again. Reviewer may request additional gemini and copilot reviews.
+
+# Checks for AI generated PRs
+- [ ] I have reviewed every line of code.
+- [ ] The PR is kept as minimum as possible. Large PRs would not be accepted.
@@ -3,7 +3,6 @@ name: "docker: build dev containers"
 on:
  push:
    branches: [ master ]
-  workflow_dispatch: {}

 permissions:
  contents: read
@@ -4,29 +4,58 @@ on:
  push:
    tags:
      - '*'
-  workflow_dispatch: {}
+  workflow_dispatch:
+    inputs:
+      source_ref:
+        description: 'Git ref to build (branch, tag, or commit SHA)'
+        required: true
+        default: 'master'
+      image_tag:
+        description: 'Docker tag to publish (without variant suffix)'
+        required: true
+        default: 'latest'
+      variant:
+        description: 'Variant to build manually'
+        required: true
+        type: choice
+        default: all
+        options:
+          - all
+          - standard
+          - large_disk

 permissions:
  contents: read

 jobs:
+  setup:
+    runs-on: ubuntu-latest
+    outputs:
+      variants: ${{ steps.set-variants.outputs.variants }}
+    steps:
+      - name: Select variants for this run
+        id: set-variants
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ] && [ "${{ github.event.inputs.variant }}" != "all" ]; then
+            variants="[\"${{ github.event.inputs.variant }}\"]"
+          else
+            variants='["standard","large_disk"]'
+          fi
+          echo "variants=$variants" >> "$GITHUB_OUTPUT"
+
  build:
+    needs: [setup]
    runs-on: ubuntu-latest
    strategy:
      matrix:
        platform: [amd64, arm64, arm, 386]
-        include:
-          - platform: amd64
-            qemu: false
-          - platform: arm64
-            qemu: true
-          - platform: arm
-            qemu: true
-          - platform: 386
-            qemu: true
+        variant: ${{ fromJSON(needs.setup.outputs.variants) }}
+
    steps:
      - name: Checkout
        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.source_ref || github.ref }}
      - name: Free Disk Space
        run: |
          echo "Available disk space before cleanup:"
@@ -43,6 +72,18 @@ jobs:
          [ -d /go/pkg ] && rm -rf /go/pkg || true
          echo "Available disk space after cleanup:"
          df -h
+      
+      - name: Configure variant
+        id: config
+        run: |
+          if [ "${{ matrix.variant }}" == "large_disk" ]; then
+            echo "tag_suffix=_large_disk" >> $GITHUB_OUTPUT
+            echo "build_args=TAGS=5BytesOffset" >> $GITHUB_OUTPUT
+          else
+            echo "tag_suffix=" >> $GITHUB_OUTPUT
+            echo "build_args=" >> $GITHUB_OUTPUT
+          fi
+
      - name: Docker meta
        id: docker_meta
        uses: docker/metadata-action@v5
@@ -50,13 +91,13 @@ jobs:
          images: |
            chrislusf/seaweedfs
            ghcr.io/chrislusf/seaweedfs
-          tags: type=raw,value=latest
+          tags: type=raw,value=${{ github.event_name == 'workflow_dispatch' && github.event.inputs.image_tag || 'latest' }},suffix=${{ steps.config.outputs.tag_suffix }}
          labels: |
            org.opencontainers.image.title=seaweedfs
            org.opencontainers.image.description=SeaweedFS is a distributed storage system for blobs, objects, files, and data lake, to store and serve billions of files fast!
            org.opencontainers.image.vendor=Chris Lu
      - name: Set up QEMU
-        if: matrix.qemu
+        if: matrix.platform != 'amd64'
        uses: docker/setup-qemu-action@v3
      - name: Create BuildKit config
        run: |
@@ -82,7 +123,7 @@ jobs:
          registry: ghcr.io
          username: ${{ secrets.GHCR_USERNAME }}
          password: ${{ secrets.GHCR_TOKEN }}
-      - name: Build ${{ matrix.platform }}
+      - name: Build ${{ matrix.platform }} ${{ matrix.variant }}
        uses: docker/build-push-action@v6
        env:
          DOCKER_BUILDKIT: 1
@@ -92,13 +133,14 @@ jobs:
          file: ./docker/Dockerfile.go_build
          platforms: linux/${{ matrix.platform }}
          # Push to GHCR only during build to avoid Docker Hub rate limits
-          tags: ghcr.io/chrislusf/seaweedfs:latest-${{ matrix.platform }}
+          tags: ghcr.io/chrislusf/seaweedfs:${{ github.event_name == 'workflow_dispatch' && github.event.inputs.image_tag || 'latest' }}${{ steps.config.outputs.tag_suffix }}-${{ matrix.platform }}
          labels: ${{ steps.docker_meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=gha,scope=${{ matrix.variant }}-${{ matrix.platform }}
+          cache-to: type=gha,mode=max,scope=${{ matrix.variant }}-${{ matrix.platform }}
          build-args: |
            BUILDKIT_INLINE_CACHE=1
-            BRANCH=${{ github.sha }}
+            BRANCH=${{ github.event_name == 'workflow_dispatch' && github.event.inputs.source_ref || github.sha }}
+            ${{ steps.config.outputs.build_args }}
      - name: Clean up build artifacts
        if: always()
        run: |
@@ -109,11 +151,26 @@ jobs:

  create-manifest:
    runs-on: ubuntu-latest
-    needs: [build]
+    needs: [setup, build]
    if: github.event_name != 'pull_request'
+    strategy:
+      matrix:
+        variant: ${{ fromJSON(needs.setup.outputs.variants) }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.source_ref || github.ref }}
+      
+      - name: Configure variant
+        id: config
+        run: |
+          if [ "${{ matrix.variant }}" == "large_disk" ]; then
+            echo "tag_suffix=_large_disk" >> $GITHUB_OUTPUT
+          else
+            echo "tag_suffix=" >> $GITHUB_OUTPUT
+          fi
+
      - name: Docker meta
        id: docker_meta
        uses: docker/metadata-action@v5
@@ -121,7 +178,7 @@ jobs:
          images: |
            chrislusf/seaweedfs
            ghcr.io/chrislusf/seaweedfs
-          tags: type=raw,value=latest
+          tags: type=raw,value=${{ github.event_name == 'workflow_dispatch' && github.event.inputs.image_tag || 'latest' }},suffix=${{ steps.config.outputs.tag_suffix }}
      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
@@ -142,13 +199,16 @@ jobs:
          crane version
      - name: Create and push manifest
        run: |
+          SUFFIX="${{ steps.config.outputs.tag_suffix }}"
+          BASE_TAG="${{ github.event_name == 'workflow_dispatch' && github.event.inputs.image_tag || 'latest' }}"
+          
          # Create manifest on GHCR first (no rate limits)
          echo "Creating GHCR manifest (no rate limits)..."
-          docker buildx imagetools create -t ghcr.io/chrislusf/seaweedfs:latest \
-            ghcr.io/chrislusf/seaweedfs:latest-amd64 \
-            ghcr.io/chrislusf/seaweedfs:latest-arm64 \
-            ghcr.io/chrislusf/seaweedfs:latest-arm \
-            ghcr.io/chrislusf/seaweedfs:latest-386
+          docker buildx imagetools create -t ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX} \
+            ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-amd64 \
+            ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-arm64 \
+            ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-arm \
+            ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-386
          
          # Copy the complete multi-arch image from GHCR to Docker Hub
          # This only requires one pull from GHCR (no rate limit) and one push to Docker Hub
@@ -184,16 +244,16 @@ jobs:
          # Use crane or skopeo to copy, fallback to docker if not available
          if command -v crane &> /dev/null; then
            echo "Using crane to copy..."
-            retry_with_backoff crane copy ghcr.io/chrislusf/seaweedfs:latest chrislusf/seaweedfs:latest
+            retry_with_backoff crane copy ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX} chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}
          elif command -v skopeo &> /dev/null; then
            echo "Using skopeo to copy..."
-            retry_with_backoff skopeo copy --all docker://ghcr.io/chrislusf/seaweedfs:latest docker://chrislusf/seaweedfs:latest
+            retry_with_backoff skopeo copy --all docker://ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX} docker://chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}
          else
            echo "Using docker buildx imagetools (pulling 4 images from Docker Hub)..."
            # Fallback: create manifest directly on Docker Hub (pulls from Docker Hub - rate limited)
-            retry_with_backoff docker buildx imagetools create -t chrislusf/seaweedfs:latest \
-              ghcr.io/chrislusf/seaweedfs:latest-amd64 \
-              ghcr.io/chrislusf/seaweedfs:latest-arm64 \
-              ghcr.io/chrislusf/seaweedfs:latest-arm \
-              ghcr.io/chrislusf/seaweedfs:latest-386
+            retry_with_backoff docker buildx imagetools create -t chrislusf/seaweedfs:${BASE_TAG}${SUFFIX} \
+              ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-amd64 \
+              ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-arm64 \
+              ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-arm \
+              ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-386
          fi
@@ -1,152 +0,0 @@
-name: "docker: build release containers for normal volume"
-
-# DISABLED: Merged into container_release_unified.yml
-on:
-  workflow_dispatch:
-    inputs:
-      force_run:
-        description: 'This workflow is disabled. Use container_release_unified.yml instead'
-        required: true
-        default: 'disabled'
-
-permissions:
-  contents: read
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        platform: [amd64, arm64, arm, 386]
-        include:
-          - platform: amd64
-            qemu: false
-          - platform: arm64
-            qemu: true
-          - platform: arm
-            qemu: true
-          - platform: 386
-            qemu: true
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-      - name: Free Disk Space
-        run: |
-          echo "Available disk space before cleanup:"
-          df -h
-          # Remove pre-installed tools
-          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL
-          # Clean package managers
-          sudo apt-get clean
-          sudo rm -rf /var/lib/apt/lists/*
-          # Clean Docker aggressively
-          sudo docker system prune -af --volumes
-          # Clean Go cache if it exists
-          [ -d ~/.cache/go-build ] && rm -rf ~/.cache/go-build || true
-          [ -d /go/pkg ] && rm -rf /go/pkg || true
-          echo "Available disk space after cleanup:"
-          df -h
-      - name: Docker meta
-        id: docker_meta
-        uses: docker/metadata-action@v5
-        with:
-          images: chrislusf/seaweedfs
-          tags: type=ref,event=tag
-          flavor: latest=false
-      - name: Set up QEMU
-        if: matrix.qemu
-        uses: docker/setup-qemu-action@v3
-      - name: Create BuildKit config
-        run: |
-          cat > /tmp/buildkitd.toml <<EOF
-          [registry."docker.io"]
-            mirrors = ["https://mirror.gcr.io"]
-          EOF
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-        with:
-          buildkitd-config: /tmp/buildkitd.toml
-      - name: Login to Docker Hub
-        if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-      - name: Build ${{ matrix.platform }}
-        uses: docker/build-push-action@v6
-        env:
-          DOCKER_BUILDKIT: 1
-        with:
-          context: ./docker
-          push: ${{ github.event_name != 'pull_request' }}
-          file: ./docker/Dockerfile.go_build
-          platforms: linux/${{ matrix.platform }}
-          tags: ${{ steps.docker_meta.outputs.tags }}-${{ matrix.platform }}
-          labels: ${{ steps.docker_meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-          build-args: |
-            BUILDKIT_INLINE_CACHE=1
-            BRANCH=${{ github.sha }}
-      - name: Clean up build artifacts
-        if: always()
-        run: |
-          # Clean up Docker build cache and temporary files
-          sudo docker system prune -f
-          # Remove Go build cache
-          sudo rm -rf /tmp/go-build*
-
-  create-manifest:
-    runs-on: ubuntu-latest
-    needs: [build]
-    if: github.event_name != 'pull_request'
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-      - name: Docker meta
-        id: docker_meta
-        uses: docker/metadata-action@v5
-        with:
-          images: chrislusf/seaweedfs
-          tags: type=ref,event=tag
-          flavor: latest=false
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-      - name: Create and push manifest
-        run: |
-          # Function to retry command with exponential backoff
-          retry_with_backoff() {
-            local max_attempts=5
-            local timeout=1
-            local attempt=1
-            local exit_code=0
-            
-            while [ $attempt -le $max_attempts ]; do
-              if "$@"; then
-                return 0
-              else
-                exit_code=$?
-              fi
-              
-              if [ $attempt -lt $max_attempts ]; then
-                echo "Attempt $attempt failed. Retrying in ${timeout}s..." >&2
-                sleep $timeout
-                timeout=$((timeout * 2))
-              fi
-              
-              attempt=$((attempt + 1))
-            done
-            
-            echo "Command failed after $max_attempts attempts" >&2
-            return $exit_code
-          }
-          
-          # Create manifest with retry
-          retry_with_backoff docker buildx imagetools create -t ${{ steps.docker_meta.outputs.tags }} \
-            ${{ steps.docker_meta.outputs.tags }}-amd64 \
-            ${{ steps.docker_meta.outputs.tags }}-arm64 \
-            ${{ steps.docker_meta.outputs.tags }}-arm \
-            ${{ steps.docker_meta.outputs.tags }}-386
@@ -1,153 +0,0 @@
-name: "docker: build release containers for large volume"
-
-# DISABLED: Merged into container_release_unified.yml
-on:
-  workflow_dispatch:
-    inputs:
-      force_run:
-        description: 'This workflow is disabled. Use container_release_unified.yml instead'
-        required: true
-        default: 'disabled'
-
-permissions:
-  contents: read
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        platform: [amd64, arm64, arm, 386]
-        include:
-          - platform: amd64
-            qemu: false
-          - platform: arm64
-            qemu: true
-          - platform: arm
-            qemu: true
-          - platform: 386
-            qemu: true
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-      - name: Free Disk Space
-        run: |
-          echo "Available disk space before cleanup:"
-          df -h
-          # Remove pre-installed tools
-          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL
-          # Clean package managers
-          sudo apt-get clean
-          sudo rm -rf /var/lib/apt/lists/*
-          # Clean Docker aggressively
-          sudo docker system prune -af --volumes
-          # Clean Go cache if it exists
-          [ -d ~/.cache/go-build ] && rm -rf ~/.cache/go-build || true
-          [ -d /go/pkg ] && rm -rf /go/pkg || true
-          echo "Available disk space after cleanup:"
-          df -h
-      - name: Docker meta
-        id: docker_meta
-        uses: docker/metadata-action@v5
-        with:
-          images: chrislusf/seaweedfs
-          tags: type=ref,event=tag,suffix=_large_disk
-          flavor: latest=false
-      - name: Set up QEMU
-        if: matrix.qemu
-        uses: docker/setup-qemu-action@v3
-      - name: Create BuildKit config
-        run: |
-          cat > /tmp/buildkitd.toml <<EOF
-          [registry."docker.io"]
-            mirrors = ["https://mirror.gcr.io"]
-          EOF
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-        with:
-          buildkitd-config: /tmp/buildkitd.toml
-      - name: Login to Docker Hub
-        if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-      - name: Build ${{ matrix.platform }}
-        uses: docker/build-push-action@v6
-        env:
-          DOCKER_BUILDKIT: 1
-        with:
-          context: ./docker
-          push: ${{ github.event_name != 'pull_request' }}
-          file: ./docker/Dockerfile.go_build
-          build-args: |
-            TAGS=5BytesOffset
-            BUILDKIT_INLINE_CACHE=1
-            BRANCH=${{ github.sha }}
-          platforms: linux/${{ matrix.platform }}
-          tags: ${{ steps.docker_meta.outputs.tags }}-${{ matrix.platform }}
-          labels: ${{ steps.docker_meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-      - name: Clean up build artifacts
-        if: always()
-        run: |
-          # Clean up Docker build cache and temporary files
-          sudo docker system prune -f
-          # Remove Go build cache
-          sudo rm -rf /tmp/go-build*
-
-  create-manifest:
-    runs-on: ubuntu-latest
-    needs: [build]
-    if: github.event_name != 'pull_request'
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-      - name: Docker meta
-        id: docker_meta
-        uses: docker/metadata-action@v5
-        with:
-          images: chrislusf/seaweedfs
-          tags: type=ref,event=tag,suffix=_large_disk
-          flavor: latest=false
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-      - name: Create and push manifest
-        run: |
-          # Function to retry command with exponential backoff
-          retry_with_backoff() {
-            local max_attempts=5
-            local timeout=1
-            local attempt=1
-            local exit_code=0
-            
-            while [ $attempt -le $max_attempts ]; do
-              if "$@"; then
-                return 0
-              else
-                exit_code=$?
-              fi
-              
-              if [ $attempt -lt $max_attempts ]; then
-                echo "Attempt $attempt failed. Retrying in ${timeout}s..." >&2
-                sleep $timeout
-                timeout=$((timeout * 2))
-              fi
-              
-              attempt=$((attempt + 1))
-            done
-            
-            echo "Command failed after $max_attempts attempts" >&2
-            return $exit_code
-          }
-          
-          # Create manifest with retry
-          retry_with_backoff docker buildx imagetools create -t ${{ steps.docker_meta.outputs.tags }} \
-            ${{ steps.docker_meta.outputs.tags }}-amd64 \
-            ${{ steps.docker_meta.outputs.tags }}-arm64 \
-            ${{ steps.docker_meta.outputs.tags }}-arm \
-            ${{ steps.docker_meta.outputs.tags }}-386
@@ -1,73 +0,0 @@
-name: "docker: build release containers for rocksdb"
-
-# DISABLED: Merged into container_release_unified.yml
-on:
-  workflow_dispatch:
-    inputs:
-      force_run:
-        description: 'This workflow is disabled. Use container_release_unified.yml instead'
-        required: true
-        default: 'disabled'
-
-permissions:
-  contents: read
-
-jobs:
-
-  build-large-release-container_rocksdb:
-    runs-on: [ubuntu-latest]
-
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v6
-      -
-        name: Free Disk Space
-        run: |
-          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc
-          sudo docker system prune -af
-      -
-        name: Docker meta
-        id: docker_meta
-        uses: docker/metadata-action@v5
-        with:
-          images: chrislusf/seaweedfs
-          tags: type=ref,event=tag,suffix=_large_disk_rocksdb
-          flavor: latest=false
-          labels: |
-            org.opencontainers.image.title=seaweedfs
-            org.opencontainers.image.description=SeaweedFS is a distributed storage system for blobs, objects, files, and data lake, to store and serve billions of files fast!
-            org.opencontainers.image.vendor=Chris Lu
-      -
-        name: Create BuildKit config
-        run: |
-          cat > /tmp/buildkitd.toml <<EOF
-          [registry."docker.io"]
-            mirrors = ["https://mirror.gcr.io"]
-          EOF
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-        with:
-          buildkitd-config: /tmp/buildkitd.toml
-      -
-        name: Login to Docker Hub
-        if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-      -
-        name: Build
-        uses: docker/build-push-action@v6
-        with:
-          context: ./docker
-          push: ${{ github.event_name != 'pull_request' }}
-          file: ./docker/Dockerfile.rocksdb_large
-          build-args: |
-            BRANCH=${{ github.sha }}
-          platforms: linux/amd64
-          tags: ${{ steps.docker_meta.outputs.tags }}
-          labels: ${{ steps.docker_meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
@@ -1,72 +0,0 @@
-name: "docker: build release containers for all tags"
-
-# DISABLED: Merged into container_release_unified.yml
-on:
-  workflow_dispatch:
-    inputs:
-      force_run:
-        description: 'This workflow is disabled. Use container_release_unified.yml instead'
-        required: true
-        default: 'disabled'
-
-permissions:
-  contents: read
-
-jobs:
-  build-default-release-container:
-    runs-on: [ubuntu-latest]
-
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v6
-      -
-        name: Free Disk Space
-        run: |
-          echo "Before cleanup:"
-          df -h
-          sudo rm -rf /usr/share/dotnet
-          sudo rm -rf /usr/local/lib/android
-          sudo rm -rf /opt/ghc
-          sudo rm -rf /opt/hostedtoolcache/CodeQL
-          sudo docker system prune -af
-          echo "After cleanup:"
-          df -h
-      -
-        name: Docker meta
-        id: docker_meta
-        uses: docker/metadata-action@v5
-        with:
-          images: |
-            chrislusf/seaweedfs
-          tags: |
-            type=ref,event=tag,suffix=_full
-          flavor: |
-            latest=false
-          labels: |
-            org.opencontainers.image.title=seaweedfs
-            org.opencontainers.image.description=SeaweedFS is a distributed storage system for blobs, objects, files, and data lake, to store and serve billions of files fast!
-            org.opencontainers.image.vendor=Chris Lu
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      -
-        name: Login to Docker Hub
-        if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-      -
-        name: Build
-        uses: docker/build-push-action@v6
-        with:
-          context: ./docker
-          push: ${{ github.event_name != 'pull_request' }}
-          file: ./docker/Dockerfile.go_build
-          build-args: TAGS=elastic,gocdk,rclone,sqlite,tarantool,tikv,ydb
-          platforms: linux/amd64
-          tags: ${{ steps.docker_meta.outputs.tags }}
-          labels: ${{ steps.docker_meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
@@ -1,62 +0,0 @@
-name: "docker: build release containers for all tags and large volume"
-
-# DISABLED: Merged into container_release_unified.yml
-on:
-  workflow_dispatch:
-    inputs:
-      force_run:
-        description: 'This workflow is disabled. Use container_release_unified.yml instead'
-        required: true
-        default: 'disabled'
-
-permissions:
-  contents: read
-
-jobs:
-  build-default-release-container:
-    runs-on: [ubuntu-latest]
-
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v6
-      -
-        name: Free Disk Space
-        run: |
-          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc
-          sudo docker system prune -af
-      -
-        name: Docker meta
-        id: docker_meta
-        uses: docker/metadata-action@v5
-        with:
-          images: chrislusf/seaweedfs
-          tags: type=ref,event=tag,suffix=_large_disk_full
-          flavor: latest=false
-          labels: |
-            org.opencontainers.image.title=seaweedfs
-            org.opencontainers.image.description=SeaweedFS is a distributed storage system for blobs, objects, files, and data lake, to store and serve billions of files fast!
-            org.opencontainers.image.vendor=Chris Lu
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      -
-        name: Login to Docker Hub
-        if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-      -
-        name: Build
-        uses: docker/build-push-action@v6
-        with:
-          context: ./docker
-          push: ${{ github.event_name != 'pull_request' }}
-          file: ./docker/Dockerfile.go_build
-          build-args: TAGS=5BytesOffset,elastic,gocdk,rclone,sqlite,tarantool,tikv,ydb
-          platforms: linux/amd64
-          tags: ${{ steps.docker_meta.outputs.tags }}
-          labels: ${{ steps.docker_meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
@@ -4,11 +4,35 @@ on:
  push:
    tags:
      - '*'
-  workflow_dispatch: {}
+  workflow_dispatch:
+    inputs:
+      variant:
+        description: 'Variant to build manually'
+        required: true
+        type: choice
+        default: all
+        options:
+          - all
+          - normal
+          - large_disk
+          - full
+          - large_disk_full
+          - rocksdb
+      release_tag:
+        description: 'Release tag to publish (e.g. 3.93)'
+        required: true
+        default: ''
+      rocksdb_version:
+        description: 'RocksDB git tag to use when variant=rocksdb'
+        required: false
+        default: 'v10.10.1'

 permissions:
  contents: read

+env:
+  RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.release_tag || github.ref_name }}
+
 # Limit concurrent builds to avoid rate limits
 concurrency:
  group: release-${{ github.ref }}
@@ -59,9 +83,11 @@ jobs:
            
    steps:
      - name: Checkout
+        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
        uses: actions/checkout@v6
        
      - name: Free Disk Space
+        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
        run: |
          echo "Available disk space before cleanup:"
          df -h
@@ -75,13 +101,14 @@ jobs:
          df -h
          
      - name: Docker meta
+        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
        id: docker_meta
        uses: docker/metadata-action@v5
        with:
          images: |
            chrislusf/seaweedfs
            ghcr.io/chrislusf/seaweedfs
-          tags: type=ref,event=tag,suffix=${{ matrix.tag_suffix }}
+          tags: type=raw,value=${{ env.RELEASE_TAG }}${{ matrix.tag_suffix }}
          flavor: latest=false
          labels: |
            org.opencontainers.image.title=seaweedfs
@@ -89,10 +116,11 @@ jobs:
            org.opencontainers.image.vendor=Chris Lu
            
      - name: Set up QEMU
-        if: contains(matrix.platforms, 'arm')
+        if: (github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant) && contains(matrix.platforms, 'arm')
        uses: docker/setup-qemu-action@v3
        
      - name: Create BuildKit config
+        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
        run: |
          cat > /tmp/buildkitd.toml <<EOF
          [registry."docker.io"]
@@ -100,19 +128,20 @@ jobs:
          EOF
          
      - name: Set up Docker Buildx
+        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
        uses: docker/setup-buildx-action@v3
        with:
          buildkitd-config: /tmp/buildkitd.toml
          
      - name: Login to Docker Hub
-        if: github.event_name != 'pull_request'
+        if: (github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant) && github.event_name != 'pull_request'
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
          
      - name: Login to GHCR
-        if: github.event_name != 'pull_request'
+        if: (github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant) && github.event_name != 'pull_request'
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
@@ -120,6 +149,7 @@ jobs:
          password: ${{ secrets.GHCR_TOKEN }}
          
      - name: Build and push ${{ matrix.variant }}
+        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
        uses: docker/build-push-action@v6
        env:
          DOCKER_BUILDKIT: 1
@@ -130,7 +160,7 @@ jobs:
          platforms: ${{ matrix.platforms }}
          # Push to GHCR to avoid Docker Hub rate limits on pulls
          tags: |
-            ghcr.io/chrislusf/seaweedfs:${{ github.ref_name }}${{ matrix.tag_suffix }}
+            ghcr.io/chrislusf/seaweedfs:${{ env.RELEASE_TAG }}${{ matrix.tag_suffix }}
          labels: ${{ steps.docker_meta.outputs.labels }}
          cache-from: type=gha,scope=${{ matrix.variant }}
          cache-to: type=gha,mode=max,scope=${{ matrix.variant }}
@@ -138,9 +168,10 @@ jobs:
            ${{ matrix.build_args }}
            BUILDKIT_INLINE_CACHE=1
            BRANCH=${{ github.sha }}
+            ${{ matrix.variant == 'rocksdb' && format('ROCKSDB_VERSION={0}', github.event.inputs.rocksdb_version || 'v10.10.1') || '' }}
            
      - name: Clean up build artifacts
-        if: always()
+        if: always() && (github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant)
        run: |
          sudo docker system prune -f
          sudo rm -rf /tmp/go-build*
@@ -166,12 +197,14 @@ jobs:
            
    steps:
      - name: Login to Docker Hub
+        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
          
      - name: Login to GHCR
+        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
@@ -179,6 +212,7 @@ jobs:
          password: ${{ secrets.GHCR_TOKEN }}
          
      - name: Install crane
+        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
        run: |
          cd $(mktemp -d)
          curl -sL "https://github.com/google/go-containerregistry/releases/latest/download/go-containerregistry_Linux_x86_64.tar.gz" | tar xz
@@ -186,6 +220,7 @@ jobs:
          crane version
          
      - name: Copy ${{ matrix.variant }} from GHCR to Docker Hub
+        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
        run: |
          # Function to retry with exponential backoff
          retry_with_backoff() {
@@ -218,14 +253,15 @@ jobs:
          # This is much more efficient than pulling/pushing individual arch images
          echo "Copying ${{ matrix.variant }} from GHCR to Docker Hub..."
          retry_with_backoff crane copy \
-            ghcr.io/chrislusf/seaweedfs:${{ github.ref_name }}${{ matrix.tag_suffix }} \
-            chrislusf/seaweedfs:${{ github.ref_name }}${{ matrix.tag_suffix }}
+            ghcr.io/chrislusf/seaweedfs:${{ env.RELEASE_TAG }}${{ matrix.tag_suffix }} \
+            chrislusf/seaweedfs:${{ env.RELEASE_TAG }}${{ matrix.tag_suffix }}
          
          echo "✓ Successfully copied ${{ matrix.variant }} to Docker Hub"

  helm-release:
    runs-on: ubuntu-latest
    needs: [copy-to-dockerhub]
+    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
    permissions:
      contents: write
      pages: write
@@ -239,7 +275,3 @@ jobs:
          target_dir: helm
          branch: gh-pages
          helm_version: "3.18.4"
-
-
-
-
@@ -4,9 +4,9 @@ on:
  workflow_dispatch:
    inputs:
      rocksdb_version:
-        description: 'RocksDB git tag or branch to build (e.g. v10.5.1)'
+        description: 'RocksDB git tag or branch to build (e.g. v10.10.1)'
        required: true
-        default: 'v10.5.1'
+        default: 'v10.10.1'
      seaweedfs_ref:
        description: 'SeaweedFS git tag, branch, or commit to build'
        required: true
@@ -11,4 +11,4 @@ jobs:
      - name: 'Checkout Repository'
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
      - name: 'Dependency Review'
-        uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261
+        uses: actions/dependency-review-action@05fe4576374b728f0c523d6a13d64c25081e0803
@@ -24,7 +24,7 @@ jobs:
    timeout-minutes: 30
    steps:
    - name: Set up Go 1.x
-      uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v2
+      uses: actions/setup-go@a5f9b05d2d216f63e13859e0d847461041025775 # v2
      with:
        go-version: ^1.13
      id: go
@@ -46,6 +46,7 @@ jobs:
    - name: Install dependencies
      run: |
        # Use faster mirrors and install with timeout
+        sudo rm -f /etc/apt/sources.list.d/azure-cli.list /etc/apt/sources.list.d/microsoft-prod.list
        echo "deb http://azure.archive.ubuntu.com/ubuntu/ $(lsb_release -cs) main restricted universe multiverse" | sudo tee /etc/apt/sources.list
        echo "deb http://azure.archive.ubuntu.com/ubuntu/ $(lsb_release -cs)-updates main restricted universe multiverse" | sudo tee -a /etc/apt/sources.list
        
@@ -0,0 +1,49 @@
+name: EC Integration Tests
+
+on:
+  push:
+    branches: [ master ]
+    paths:
+      - 'weed/admin/**'
+      - 'weed/worker/**'
+      - 'test/erasure_coding/admin_dockertest/**'
+      - '.github/workflows/ec-integration.yml'
+  pull_request:
+    branches: [ master ]
+    paths:
+      - 'weed/admin/**'
+      - 'weed/worker/**'
+      - 'test/erasure_coding/admin_dockertest/**'
+      - '.github/workflows/ec-integration.yml'
+
+jobs:
+  ec-integration-test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v6
+      
+    - name: Set up Go
+      uses: actions/setup-go@v6
+      with:
+        go-version: '1.24'
+        
+    - name: Build weed binary
+      run: |
+        cd weed
+        go build -o ../weed_bin
+        
+    - name: Run EC integration tests
+      run: |
+        cd test/erasure_coding/admin_dockertest
+        go test -v -timeout 15m ec_integration_test.go
+        
+    - name: Upload test logs on failure
+      if: failure()
+      uses: actions/upload-artifact@v6
+      with:
+        name: ec-test-logs
+        path: test/erasure_coding/admin_dockertest/tmp/logs/
+        retention-days: 7
@@ -15,24 +15,20 @@ permissions:

 jobs:

-  build:
-    name: Build
+  vet:
+    name: Go Vet
    runs-on: ubuntu-latest
    steps:
-
    - name: Set up Go 1.x
-      uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v2
+      uses: actions/setup-go@a5f9b05d2d216f63e13859e0d847461041025775 # v2
      with:
        go-version: ^1.13
      id: go
-
    - name: Check out code into the Go module directory
      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v2
-
    - name: Get dependencies
      run: |
        cd weed; go get -v -t -d ./...
-
    - name: Go Vet (excluding protobuf lock copying)
      run: |
        cd weed
@@ -42,8 +38,30 @@ jobs:
        # Fail only if there are actual vet errors (not counting the filtered lock warnings)
        if grep -q "vet:" vet-output.txt; then exit 1; fi

+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    steps:
+    - name: Set up Go 1.x
+      uses: actions/setup-go@a5f9b05d2d216f63e13859e0d847461041025775 # v2
+      with:
+        go-version: ^1.13
+      id: go
+    - name: Check out code into the Go module directory
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v2
    - name: Build
      run: cd weed; go build -tags "elastic gocdk sqlite ydb tarantool tikv rclone" -v .

+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    steps:
+    - name: Set up Go 1.x
+      uses: actions/setup-go@a5f9b05d2d216f63e13859e0d847461041025775 # v2
+      with:
+        go-version: ^1.13
+      id: go
+    - name: Check out code into the Go module directory
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v2
    - name: Test
      run: cd weed; go test -tags "elastic gocdk sqlite ydb tarantool tikv rclone" -v ./...
@@ -27,7 +27,7 @@ jobs:

      - uses: actions/setup-python@v6
        with:
-          python-version: '3.9'
+          python-version: '3.10'
          check-latest: true

      - name: Set up chart-testing
@@ -119,7 +119,7 @@ jobs:
          echo "✅ All template rendering tests passed!"

      - name: Create kind cluster
-        uses: helm/kind-action@v1.13.0
+        uses: helm/kind-action@v1.14.0

      - name: Run chart-testing (install)
        run: ct install --target-branch ${{ github.event.repository.default_branch }} --all --chart-dirs k8s/charts
@@ -0,0 +1,25 @@
+name: "helm: manual release"
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pages: write
+
+jobs:
+  helm-release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Publish Helm charts
+        uses: stefanprodan/helm-gh-pages@v1.7.0
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          charts_dir: k8s/charts
+          target_dir: helm
+          branch: gh-pages
+          helm_version: "3.18.4"
@@ -111,7 +111,7 @@ jobs:
          
          # Wait for S3 API
          for i in {1..30}; do
-            if curl -s http://localhost:8333/ > /dev/null 2>&1; then
+            if curl -s http://localhost:8333/healthz > /dev/null 2>&1; then
              echo "✓ S3 API is ready"
              break
            fi
@@ -0,0 +1,39 @@
+name: "Plugin Worker Integration Tests"
+
+on:
+  push:
+    branches: [ master ]
+  pull_request:
+    branches: [ master ]
+
+permissions:
+  contents: read
+
+jobs:
+  plugin-worker:
+    name: "Plugin Worker: ${{ matrix.worker }}"
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - worker: erasure_coding
+            path: test/plugin_workers/erasure_coding
+          - worker: vacuum
+            path: test/plugin_workers/vacuum
+          - worker: volume_balance
+            path: test/plugin_workers/volume_balance
+
+    steps:
+      - name: Set up Go 1.x
+        uses: actions/setup-go@v6
+        with:
+          go-version: ^1.26
+        id: go
+
+      - name: Check out code into the Go module directory
+        uses: actions/checkout@v6
+
+      - name: Run plugin worker tests
+        run: go test -v ./${{ matrix.path }}
@@ -0,0 +1,64 @@
+name: "S3 Authenticated Integration Tests"
+
+on:
+  pull_request:
+  
+concurrency:
+  group: ${{ github.head_ref }}/s3-integration-tests
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  tests:
+    name: S3 Integration Tests
+    runs-on: ubuntu-22.04
+    timeout-minutes: 30
+    
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: 'go.mod'
+        id: go
+
+      - name: Build SeaweedFS
+        run: |
+          cd weed
+          go build -o weed -buildvcs=false
+
+      - name: Run S3 Integration Tests
+        timeout-minutes: 15
+        working-directory: test/s3/normal
+        run: |
+          set -x
+          echo "=== Running S3 Integration Tests ==="
+          go test -v -timeout=60s -run TestS3Integration ./...
+
+      - name: Run S3 DeleteBucketNotEmpty Tests
+        timeout-minutes: 15
+        working-directory: test/s3/normal
+        run: |
+          set -x
+          echo "=== Running S3 DeleteBucketNotEmpty Tests ==="
+          go test -v -timeout=60s -run TestS3DeleteBucketNotEmpty ./...
+
+      - name: Run IAM Integration Tests
+        timeout-minutes: 15
+        working-directory: test/s3/normal
+        run: |
+          set -x
+          echo "=== Running IAM Integration Tests ==="
+          go test -v -timeout=60s -run TestIAMOperations ./...
+
+      - name: Upload test logs on failure
+        if: failure()
+        uses: actions/upload-artifact@v6
+        with:
+          name: integration-test-logs
+          path: test/s3/normal/*.log
+          retention-days: 3
@@ -461,6 +461,8 @@ jobs:
          export S3_ENDPOINT="http://localhost:8006"
          export S3_ACCESS_KEY="0555b35654ad1656d804"
          export S3_SECRET_KEY="h7GhxuBLTrlhVUyxSPUKUV8r/2EI4ngqJxD7iBdBYLhwluN30JaT3Q=="
+          export AWS_ACCESS_KEY_ID="$S3_ACCESS_KEY"
+          export AWS_SECRET_ACCESS_KEY="$S3_SECRET_KEY"
          
          # Run the specific test that is equivalent to AWS S3 tagging behavior
          make test-with-server || {
@@ -117,7 +117,7 @@ jobs:
            "basic")
              echo "Running basic IAM functionality tests..."
              make clean setup start-services wait-for-services
-              go test -v -timeout 15m -run "TestS3IAMAuthentication|TestS3IAMBasicWorkflow|TestS3IAMTokenValidation" ./...
+              go test -v -timeout 15m -run "TestS3IAMAuthentication|TestS3IAMBasicWorkflow|TestS3IAMTokenValidation|TestIAM" ./...
              ;;
            "advanced")
              echo "Running advanced IAM feature tests..."
@@ -97,7 +97,7 @@ jobs:
          # Verify service accessibility
          echo "=== Verifying Service Accessibility ==="
          curl -f http://localhost:8080/realms/master
-          curl -s http://localhost:8333
+          curl -s http://localhost:8333/healthz
          echo "✅ SeaweedFS S3 API is responding (IAM-protected endpoint)"
          
          # Run Keycloak-specific tests
@@ -0,0 +1,426 @@
+name: "S3 Policy Integration Tests"
+
+on:
+  pull_request:
+    paths:
+      - 'weed/s3api/s3_iam_middleware.go'
+      - 'weed/s3api/s3api_bucket_policy*.go'
+      - 'weed/s3api/s3_action_resolver.go'
+      - 'weed/s3api/policy/**'
+      - 'weed/iam/**'
+      - 'test/s3/iam/**'
+      - 'test/s3/policy/**'
+      - '.github/workflows/s3-policy-tests.yml'
+  push:
+    branches: [ master, main ]
+    paths:
+      - 'weed/s3api/s3_iam_middleware.go'
+      - 'weed/s3api/s3api_bucket_policy*.go'
+      - 'weed/s3api/s3_action_resolver.go'
+      - 'weed/s3api/policy/**'
+      - 'weed/iam/**'
+      - 'test/s3/iam/**'
+      - 'test/s3/policy/**'
+      - '.github/workflows/s3-policy-tests.yml'
+
+concurrency:
+  group: ${{ github.head_ref }}/s3-policy-tests
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    working-directory: weed
+
+jobs:
+  # Unit tests for policy components
+  policy-unit-tests:
+    name: S3 Policy Unit Tests
+    runs-on: ubuntu-22.04
+    timeout-minutes: 15
+    
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: 'go.mod'
+        id: go
+
+      - name: Get dependencies
+        run: |
+          go mod download
+
+      - name: Run S3 Policy Unit Tests
+        timeout-minutes: 10
+        run: |
+          set -x
+          echo "=== Running S3 Action Resolver Tests ==="
+          go test -v -timeout 5m ./s3api/... -run ".*ActionResolver.*"
+          
+          echo "=== Running S3 Bucket Policy Engine Tests ==="
+          go test -v -timeout 5m ./s3api/... -run ".*BucketPolicy.*|.*PolicyEngine.*"
+          
+          echo "=== Running IAM Policy Tests ==="
+          go test -v -timeout 5m ./iam/policy/...
+
+      - name: Upload test results on failure
+        if: failure()
+        uses: actions/upload-artifact@v6
+        with:
+          name: policy-unit-test-results
+          path: |
+            weed/testdata/
+            weed/**/testdata/
+          retention-days: 3
+
+  # S3 Policy Variables Integration Tests
+  s3-policy-variables-tests:
+    name: S3 Policy Variables Integration Tests
+    runs-on: ubuntu-22.04
+    timeout-minutes: 25
+    
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: 'go.mod'
+        id: go
+
+      - name: Install SeaweedFS
+        run: |
+          go install -buildvcs=false
+
+      - name: Run S3 Policy Variables Integration Tests
+        timeout-minutes: 20
+        working-directory: test/s3/iam
+        run: |
+          set -x
+          echo "=== System Information ==="
+          uname -a
+          free -h
+          df -h
+          
+          echo "=== Starting S3 Policy Variables Integration Tests ==="
+          
+          # Set WEED_BINARY to use the installed version
+          export WEED_BINARY=$(which weed)
+          export TEST_TIMEOUT=15m
+          
+          # Run policy variables tests
+          echo "Running policy variables tests..."
+          
+          # Kill any existing weed server on port 8333
+          if lsof -Pi :8333 -sTCP:LISTEN -t >/dev/null 2>&1 ; then
+            kill $(lsof -t -i:8333) 2>/dev/null || true
+            sleep 2
+          fi
+          
+          # Start weed server with IAM configuration
+          echo "Starting weed server with IAM configuration..."
+          $WEED_BINARY server \
+            -s3 \
+            -s3.port=8333 \
+            -s3.iam.config="$(pwd)/test_iam_config.json" \
+            -filer \
+            -volume.max=0 \
+            -master.volumeSizeLimitMB=100 \
+            -s3.allowDeleteBucketNotEmpty=true \
+            > /tmp/weed_policy_test_server.log 2>&1 &
+          
+          SERVER_PID=$!
+          echo "Server started with PID: $SERVER_PID"
+          
+          # Wait for server to be ready
+          echo "Waiting for server to be ready..."
+          MAX_WAIT=30
+          COUNTER=0
+          while ! curl -s http://localhost:8333/status > /dev/null 2>&1; do
+            sleep 1
+            COUNTER=$((COUNTER + 1))
+            if [ $COUNTER -ge $MAX_WAIT ]; then
+              echo "Server failed to start within ${MAX_WAIT} seconds"
+              echo "Server log:"
+              cat /tmp/weed_policy_test_server.log
+              kill $SERVER_PID 2>/dev/null || true
+              exit 1
+            fi
+          done
+          
+          echo "Server is ready!"
+          
+          # Trap to ensure server is killed on exit
+          trap "kill $SERVER_PID 2>/dev/null || true" EXIT
+          
+          # Run the tests
+          go test -v -timeout 15m -run TestS3PolicyVariables ./...
+
+      - name: Show service logs on failure
+        if: failure()
+        working-directory: test/s3/iam
+        run: |
+          echo "=== Service Logs ==="
+          if [ -f /tmp/weed_policy_test_server.log ]; then
+            echo "--- Last 100 lines of Server Log ---"
+            tail -100 /tmp/weed_policy_test_server.log
+          fi
+          echo ""
+          echo "=== Process Information ==="
+          ps aux | grep -E "(weed|test)" || true
+          netstat -tlnp | grep -E "(8333|8888|9333|8080)" || true
+
+      - name: Upload test logs on failure
+        if: failure()
+        uses: actions/upload-artifact@v6
+        with:
+          name: s3-policy-variables-test-logs
+          path: /tmp/weed_policy_test_server.log
+          retention-days: 5
+
+  # S3 Policy Enforcement Integration Tests
+  s3-policy-enforcement-tests:
+    name: S3 Policy Enforcement Integration Tests
+    runs-on: ubuntu-22.04
+    timeout-minutes: 30
+    strategy:
+      matrix:
+        test-case: ["basic-policy", "contextual-policy", "advanced-policy"]
+    
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: 'go.mod'
+        id: go
+
+      - name: Install SeaweedFS
+        run: |
+          go install -buildvcs=false
+
+      - name: Run S3 Policy Enforcement Tests - ${{ matrix.test-case }}
+        timeout-minutes: 25
+        working-directory: test/s3/iam
+        run: |
+          set -x
+          echo "=== System Information ==="
+          uname -a
+          free -h
+          df -h
+          
+          echo "=== Starting S3 Policy Enforcement Tests (${{ matrix.test-case }}) ==="
+          
+          export WEED_BINARY=$(which weed)
+          export TEST_TIMEOUT=20m
+          
+          # Kill any existing weed server on port 8333
+          if lsof -Pi :8333 -sTCP:LISTEN -t >/dev/null 2>&1 ; then
+            kill $(lsof -t -i:8333) 2>/dev/null || true
+            sleep 2
+          fi
+          
+          # Start weed server with IAM configuration
+          echo "Starting weed server with IAM configuration..."
+          $WEED_BINARY server \
+            -s3 \
+            -s3.port=8333 \
+            -s3.iam.config="$(pwd)/test_iam_config.json" \
+            -filer \
+            -volume.max=0 \
+            -master.volumeSizeLimitMB=100 \
+            -s3.allowDeleteBucketNotEmpty=true \
+            > /tmp/weed_policy_enforcement_${{ matrix.test-case }}.log 2>&1 &
+          
+          SERVER_PID=$!
+          echo "Server started with PID: $SERVER_PID"
+          
+          # Wait for server to be ready
+          echo "Waiting for server to be ready..."
+          MAX_WAIT=30
+          COUNTER=0
+          while ! curl -s http://localhost:8333/status > /dev/null 2>&1; do
+            sleep 1
+            COUNTER=$((COUNTER + 1))
+            if [ $COUNTER -ge $MAX_WAIT ]; then
+              echo "Server failed to start within ${MAX_WAIT} seconds"
+              cat /tmp/weed_policy_enforcement_${{ matrix.test-case }}.log
+              kill $SERVER_PID 2>/dev/null || true
+              exit 1
+            fi
+          done
+          
+          echo "Server is ready!"
+          
+          # Trap to ensure server is killed on exit
+          trap "kill $SERVER_PID 2>/dev/null || true" EXIT
+          
+          # Run tests based on test case
+          case "${{ matrix.test-case }}" in
+            "basic-policy")
+              echo "Running basic policy enforcement tests..."
+              go test -v -timeout 20m -run "TestS3IAMBucketPolicy|TestS3IAMPolicyEnforcement" ./...
+              ;;
+            "contextual-policy")
+              echo "Running contextual policy tests..."
+              go test -v -timeout 20m -run "TestS3PolicyVariables|TestS3IAMContextual" ./...
+              ;;
+            "advanced-policy")
+              echo "Running advanced policy tests..."
+              go test -v -timeout 20m -run "TestS3IAMMultipart|TestS3IAMPresigned" ./...
+              ;;
+            *)
+              echo "Unknown test case: ${{ matrix.test-case }}"
+              exit 1
+              ;;
+          esac
+
+      - name: Show service logs on failure
+        if: failure()
+        working-directory: test/s3/iam
+        run: |
+          echo "=== Service Logs ==="
+          if [ -f /tmp/weed_policy_enforcement_${{ matrix.test-case }}.log ]; then
+            echo "--- Last 100 lines of Server Log ---"
+            tail -100 /tmp/weed_policy_enforcement_${{ matrix.test-case }}.log
+          fi
+          echo ""
+          echo "=== Process Information ==="
+          ps aux | grep -E "(weed|test)" || true
+          netstat -tlnp | grep -E "(8333|8888|9333|8080)" || true
+
+      - name: Upload test logs on failure
+        if: failure()
+        uses: actions/upload-artifact@v6
+        with:
+          name: s3-policy-enforcement-logs-${{ matrix.test-case }}
+          path: /tmp/weed_policy_enforcement_${{ matrix.test-case }}.log
+          retention-days: 5
+
+  # Trusted Proxy Detection Tests
+  trusted-proxy-tests:
+    name: Trusted Proxy Detection Tests
+    runs-on: ubuntu-22.04
+    timeout-minutes: 20
+    
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: 'go.mod'
+        id: go
+
+      - name: Install SeaweedFS
+        run: |
+          go install -buildvcs=false
+
+      - name: Run Trusted Proxy Tests
+        timeout-minutes: 15
+        working-directory: test/s3/iam
+        run: |
+          set -x
+          echo "=== Running Trusted Proxy Detection Tests ==="
+          
+          export WEED_BINARY=$(which weed)
+          
+          # Kill any existing weed server on port 8333
+          if lsof -Pi :8333 -sTCP:LISTEN -t >/dev/null 2>&1 ; then
+            kill $(lsof -t -i:8333) 2>/dev/null || true
+            sleep 2
+          fi
+          
+          # Start weed server
+          echo "Starting weed server..."
+          $WEED_BINARY server \
+            -s3 \
+            -s3.port=8333 \
+            -s3.iam.config="$(pwd)/test_iam_config.json" \
+            -filer \
+            -volume.max=0 \
+            -master.volumeSizeLimitMB=100 \
+            -s3.allowDeleteBucketNotEmpty=true \
+            > /tmp/weed_proxy_test.log 2>&1 &
+          
+          SERVER_PID=$!
+          echo "Server started with PID: $SERVER_PID"
+          
+          # Wait for server to be ready
+          echo "Waiting for server to be ready..."
+          MAX_WAIT=30
+          COUNTER=0
+          while ! curl -s http://localhost:8333/status > /dev/null 2>&1; do
+            sleep 1
+            COUNTER=$((COUNTER + 1))
+            if [ $COUNTER -ge $MAX_WAIT ]; then
+              echo "Server failed to start within ${MAX_WAIT} seconds"
+              kill $SERVER_PID 2>/dev/null || true
+              exit 1
+            fi
+          done
+          
+          # Trap to ensure server is killed on exit
+          trap "kill $SERVER_PID 2>/dev/null || true" EXIT
+          
+          # Run proxy tests
+          go test -v -timeout 10m -run "TestTrustedProxy|TestPrivateIP" ./...
+
+      - name: Show service logs on failure
+        if: failure()
+        run: |
+          echo "=== Service Logs ==="
+          if [ -f /tmp/weed_proxy_test.log ]; then
+            echo "--- Last 100 lines of Server Log ---"
+            tail -100 /tmp/weed_proxy_test.log
+          fi
+
+      - name: Upload test logs on failure
+        if: failure()
+        uses: actions/upload-artifact@v6
+        with:
+          name: trusted-proxy-test-logs
+          path: /tmp/weed_proxy_test.log
+          retention-days: 3
+
+  # S3 Policy Shell Integration Tests
+  s3-policy-shell-tests:
+    name: S3 Policy Shell Integration Tests
+    runs-on: ubuntu-22.04
+    timeout-minutes: 15
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: 'go.mod'
+        id: go
+
+      - name: Install SeaweedFS
+        run: |
+          go install -buildvcs=false
+
+      - name: Run S3 Policy Shell Tests
+        timeout-minutes: 10
+        working-directory: test/s3/policy
+        run: |
+          set -x
+          echo "=== Running S3 Policy Shell Tests ==="
+
+          # Set WEED_BINARY to use the installed version (though test uses 'weed' command)
+          export WEED_BINARY=$(which weed)
+          export PATH=$PATH:$(dirname $WEED_BINARY)
+
+          go test -v -timeout 10m ./...
@@ -0,0 +1,122 @@
+name: "S3 Proxy Signature Tests"
+
+on:
+  push:
+    branches: [ master ]
+  pull_request:
+    branches: [ master ]
+
+concurrency:
+  group: ${{ github.head_ref || github.ref }}/s3-proxy-signature-tests
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  proxy-signature-tests:
+    name: S3 Proxy Signature Verification Tests
+    runs-on: ubuntu-22.04
+    timeout-minutes: 15
+    steps:
+      - name: Check out code into the Go module directory
+        uses: actions/checkout@v6
+
+      - name: Set up Go 1.x
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: 'go.mod'
+        id: go
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build SeaweedFS binary for Linux
+        run: |
+          set -x
+          CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -buildvcs=false -v -o test/s3/proxy_signature/weed ./weed
+
+      - name: Run S3 Proxy Signature Tests
+        timeout-minutes: 10
+        working-directory: test/s3/proxy_signature
+        run: |
+          set -x
+          echo "Starting Docker Compose services..."
+          docker compose up -d --build
+          
+          # Check if containers are running
+          echo "Checking container status..."
+          docker compose ps
+          
+          # Wait for services to be ready
+          echo "Waiting for nginx proxy to be ready..."
+          PROXY_READY=0
+          for i in $(seq 1 30); do
+            if curl -s http://localhost:9000/ > /dev/null 2>&1; then
+              echo "Proxy is ready"
+              PROXY_READY=1
+              break
+            fi
+            echo "Waiting for proxy... ($i/30)"
+            sleep 1
+          done
+          if [ $PROXY_READY -eq 0 ]; then
+            echo "ERROR: Proxy failed to become ready after 30 seconds"
+            echo "Docker compose logs:"
+            docker compose logs --no-color || true
+            exit 1
+          fi
+          
+          # Wait for SeaweedFS to be ready
+          echo "Waiting for SeaweedFS S3 gateway to be ready via proxy..."
+          S3_READY=0
+          for i in $(seq 1 30); do
+            # Check logs first for startup message (weed mini says "S3 service is ready")
+            if docker compose logs seaweedfs 2>&1 | grep -qE "S3 (gateway|service).*(started|ready)"; then
+              echo "SeaweedFS S3 gateway is ready"
+              S3_READY=1
+              break
+            fi
+            # Fallback: check headers via proxy (which is already ready)
+            if curl -s -I http://localhost:9000/ | grep -qi "SeaweedFS"; then
+              echo "SeaweedFS S3 gateway is responding via proxy"
+              S3_READY=1
+              break
+            fi
+            echo "Waiting for S3 gateway... ($i/30)"
+            sleep 1
+          done
+          if [ $S3_READY -eq 0 ]; then
+            echo "ERROR: SeaweedFS S3 gateway failed to become ready after 30 seconds"
+            echo "Latest seaweedfs logs:"
+            docker compose logs --no-color --tail 20 seaweedfs || true
+            exit 1
+          fi
+          
+          # Run the test script inside AWS CLI container
+          echo "Running test script..."
+          docker run --rm --network host \
+            --entrypoint bash \
+            amazon/aws-cli:latest \
+            -c "$(cat test.sh)"
+          
+          TEST_RESULT=$?
+          
+          # Cleanup
+          docker compose down
+          
+          exit $TEST_RESULT
+
+      - name: Cleanup on failure
+        if: failure()
+        working-directory: test/s3/proxy_signature
+        run: |
+          echo "Cleaning up Docker containers..."
+          ls -al weed || true
+          ldd weed || true
+          echo "Docker compose logs:"
+          docker compose logs --no-color || true
+          echo "Container status before cleanup:"
+          docker ps -a
+          echo "Stopping services..."
+          docker compose down || true
@@ -0,0 +1,80 @@
+name: "S3 Spark Integration Tests"
+
+on:
+  pull_request:
+    paths:
+      - 'weed/s3api/**'
+      - 'test/s3/spark/**'
+      - 'test/s3tables/testutil/**'
+      - '.github/workflows/s3-spark-tests.yml'
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.head_ref }}/s3-spark-tests
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  s3-spark-issue-repro-tests:
+    name: S3 Spark Issue Reproduction Tests
+    runs-on: ubuntu-22.04
+    timeout-minutes: 45
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: 'go.mod'
+        id: go
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v3
+
+      - name: Install SeaweedFS
+        run: |
+          go install -buildvcs=false ./weed
+
+      - name: Pre-pull Spark image
+        run: docker pull apache/spark:3.5.8
+
+      - name: Run S3 Spark integration tests
+        working-directory: test/s3/spark
+        timeout-minutes: 35
+        run: |
+          set -x
+          set -o pipefail
+          echo "=== System Information ==="
+          uname -a
+          free -h
+          df -h
+          echo "=== Starting S3 Spark Integration Tests ==="
+
+          go test -v -timeout 30m . 2>&1 | tee test-output.log || {
+            echo "S3 Spark integration tests failed"
+            exit 1
+          }
+
+      - name: Show test output on failure
+        if: failure()
+        working-directory: test/s3/spark
+        run: |
+          echo "=== Test Output ==="
+          if [ -f test-output.log ]; then
+            tail -200 test-output.log
+          fi
+
+          echo "=== Process information ==="
+          ps aux | grep -E "(weed|test|docker|spark)" || true
+
+      - name: Upload test logs on failure
+        if: failure()
+        uses: actions/upload-artifact@v6
+        with:
+          name: s3-spark-test-logs
+          path: test/s3/spark/test-output.log
+          retention-days: 3
@@ -0,0 +1,625 @@
+name: "S3 Tables Integration Tests"
+
+on:
+  pull_request:
+  
+concurrency:
+  group: ${{ github.head_ref }}/s3-tables-tests
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+
+jobs:
+  s3-tables-tests:
+    name: S3 Tables Integration Tests
+    runs-on: ubuntu-22.04
+    timeout-minutes: 30
+    
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: 'go.mod'
+        id: go
+
+      - name: Run go mod tidy
+        run: go mod tidy
+
+      - name: Install SeaweedFS
+        run: |
+          go install -buildvcs=false ./weed
+
+      - name: Run S3 Tables Integration Tests
+        timeout-minutes: 25
+        working-directory: test/s3tables/table-buckets
+        run: |
+          set -x
+          set -o pipefail
+          echo "=== System Information ==="
+          uname -a
+          free -h
+          df -h
+          echo "=== Starting S3 Tables Tests ==="
+          
+          # Run S3 Tables integration tests
+          go test -v -timeout 20m . 2>&1 | tee test-output.log || {
+            echo "S3 Tables integration tests failed"
+            exit 1
+          }
+
+      - name: Show test output on failure
+        if: failure()
+        working-directory: test/s3tables/table-buckets
+        run: |
+          echo "=== Test Output ==="
+          if [ -f test-output.log ]; then
+            tail -200 test-output.log
+          fi
+          
+          echo "=== Process information ==="
+          ps aux | grep -E "(weed|test)" || true
+
+      - name: Upload test logs on failure
+        if: failure()
+        uses: actions/upload-artifact@v6
+        with:
+          name: s3-tables-test-logs
+          path: test/s3tables/table-buckets/test-output.log
+          retention-days: 3
+
+  iceberg-catalog-tests:
+    name: Iceberg Catalog Integration Tests
+    runs-on: ubuntu-22.04
+    timeout-minutes: 30
+    
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: 'go.mod'
+        id: go
+
+      - name: Run go mod tidy
+        run: go mod tidy
+
+      - name: Run Iceberg Catalog Integration Tests
+        timeout-minutes: 25
+        working-directory: test/s3tables/catalog
+        run: |
+          set -x
+          set -o pipefail
+          echo "=== System Information ==="
+          uname -a
+          free -h
+          df -h
+          echo "=== Starting Iceberg Catalog Tests ==="
+          
+          # Run Iceberg catalog integration tests using Makefile (handles build)
+          make test 2>&1 | tee test-output.log || {
+            echo "Iceberg catalog integration tests failed"
+            exit 1
+          }
+
+      - name: Show test output on failure
+        if: failure()
+        working-directory: test/s3tables/catalog
+        run: |
+          echo "=== Test Output ==="
+          if [ -f test-output.log ]; then
+            tail -200 test-output.log
+          fi
+          
+          echo "=== Process information ==="
+          ps aux | grep -E "(weed|test|docker)" || true
+
+      - name: Upload test logs on failure
+        if: failure()
+        uses: actions/upload-artifact@v6
+        with:
+          name: iceberg-catalog-test-logs
+          path: test/s3tables/catalog/test-output.log
+          retention-days: 3
+
+  trino-iceberg-catalog-tests:
+    name: Trino Iceberg Catalog Integration Tests
+    runs-on: ubuntu-22.04
+    timeout-minutes: 30
+    
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: 'go.mod'
+        id: go
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v3
+
+      - name: Pre-pull Trino image
+        run: docker pull trinodb/trino:479
+
+      - name: Run go mod tidy
+        run: go mod tidy
+
+      - name: Install SeaweedFS
+        run: |
+          go install -buildvcs=false ./weed
+
+      - name: Run Trino Iceberg Catalog Integration Tests
+        timeout-minutes: 25
+        working-directory: test/s3tables/catalog_trino
+        run: |
+          set -x
+          set -o pipefail
+          echo "=== System Information ==="
+          uname -a
+          free -h
+          df -h
+          echo "=== Starting Trino Iceberg Catalog Tests ==="
+          
+          # Run Trino + Iceberg catalog integration tests
+          go test -v -timeout 20m . 2>&1 | tee test-output.log || {
+            echo "Trino Iceberg catalog integration tests failed"
+            exit 1
+          }
+
+      - name: Show test output on failure
+        if: failure()
+        working-directory: test/s3tables/catalog_trino
+        run: |
+          echo "=== Test Output ==="
+          if [ -f test-output.log ]; then
+            tail -200 test-output.log
+          fi
+          
+          echo "=== Process information ==="
+          ps aux | grep -E "(weed|test|docker)" || true
+
+      - name: Upload test logs on failure
+        if: failure()
+        uses: actions/upload-artifact@v6
+        with:
+          name: trino-iceberg-catalog-test-logs
+          path: test/s3tables/catalog_trino/test-output.log
+          retention-days: 3
+
+  spark-iceberg-catalog-tests:
+    name: Spark Iceberg Catalog Integration Tests
+    runs-on: ubuntu-22.04
+    timeout-minutes: 30
+    
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: 'go.mod'
+        id: go
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v3
+
+      - name: Pre-pull Spark image
+        run: docker pull apache/spark:3.5.1
+
+      - name: Run go mod tidy
+        run: go mod tidy
+
+      - name: Install SeaweedFS
+        run: |
+          go install -buildvcs=false ./weed
+
+      - name: Run Spark Iceberg Catalog Integration Tests
+        timeout-minutes: 25
+        working-directory: test/s3tables/catalog_spark
+        run: |
+          set -x
+          set -o pipefail
+          echo "=== System Information ==="
+          uname -a
+          free -h
+          df -h
+          echo "=== Starting Spark Iceberg Catalog Tests ==="
+          
+          # Run Spark + Iceberg catalog integration tests
+          go test -v -timeout 20m . 2>&1 | tee test-output.log || {
+            echo "Spark Iceberg catalog integration tests failed"
+            exit 1
+          }
+
+      - name: Show test output on failure
+        if: failure()
+        working-directory: test/s3tables/catalog_spark
+        run: |
+          echo "=== Test Output ==="
+          if [ -f test-output.log ]; then
+            tail -200 test-output.log
+          fi
+          
+          echo "=== Process information ==="
+          ps aux | grep -E "(weed|test|docker)" || true
+
+      - name: Upload test logs on failure
+        if: failure()
+        uses: actions/upload-artifact@v6
+        with:
+          name: spark-iceberg-catalog-test-logs
+          path: test/s3tables/catalog_spark/test-output.log
+          retention-days: 3
+
+  risingwave-catalog-tests:
+    name: RisingWave Catalog Integration Tests
+    runs-on: ubuntu-22.04
+    timeout-minutes: 30
+    
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: 'go.mod'
+        id: go
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v3
+
+      - name: Pre-pull RisingWave image
+        run: |
+          docker pull risingwavelabs/risingwave:v2.5.0
+          docker pull postgres:16-alpine
+
+      - name: Run go mod tidy
+        run: go mod tidy
+
+      - name: Install SeaweedFS
+        run: |
+          go install -buildvcs=false ./weed
+
+      - name: Run RisingWave Catalog Integration Tests
+        timeout-minutes: 25
+        working-directory: test/s3tables/catalog_risingwave
+        run: |
+          set -x
+          set -o pipefail
+          echo "=== System Information ==="
+          uname -a
+          free -h
+          df -h
+          echo "=== Starting RisingWave Catalog Tests ==="
+          
+          # Run RisingWave catalog integration tests
+          go test -v -timeout 20m . 2>&1 | tee test-output.log || {
+            echo "RisingWave catalog integration tests failed"
+            exit 1
+          }
+
+      - name: Show test output on failure
+        if: failure()
+        working-directory: test/s3tables/catalog_risingwave
+        run: |
+          echo "=== Test Output ==="
+          if [ -f test-output.log ]; then
+            tail -200 test-output.log
+          fi
+          
+          echo "=== Process information ==="
+          ps aux | grep -E "(weed|test|docker)" || true
+
+      - name: Upload test logs on failure
+        if: failure()
+        uses: actions/upload-artifact@v6
+        with:
+          name: risingwave-catalog-test-logs
+          path: test/s3tables/catalog_risingwave/test-output.log
+          retention-days: 3
+
+  sts-integration-tests:
+    name: STS Integration Tests
+    runs-on: ubuntu-22.04
+    timeout-minutes: 30
+    
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: 'go.mod'
+        id: go
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v3
+
+      - name: Pre-pull Python image
+        run: docker pull python:3
+
+      - name: Run go mod tidy
+        run: go mod tidy
+
+      - name: Install SeaweedFS
+        run: |
+          go install -buildvcs=false ./weed
+
+      - name: Run STS Integration Tests
+        timeout-minutes: 25
+        working-directory: test/s3tables/sts_integration
+        run: |
+          set -x
+          set -o pipefail
+          echo "=== System Information ==="
+          uname -a
+          free -h
+          df -h
+          echo "=== Starting STS Integration Tests ==="
+          
+          # Run STS integration tests
+          go test -v -timeout 20m . 2>&1 | tee test-output.log || {
+            echo "STS integration tests failed"
+            exit 1
+          }
+
+      - name: Show test output on failure
+        if: failure()
+        working-directory: test/s3tables/sts_integration
+        run: |
+          echo "=== Test Output ==="
+          if [ -f test-output.log ]; then
+            tail -200 test-output.log
+          fi
+          
+          echo "=== Process information ==="
+          ps aux | grep -E "(weed|test|docker)" || true
+
+      - name: Upload test logs on failure
+        if: failure()
+        uses: actions/upload-artifact@v6
+        with:
+          name: sts-integration-test-logs
+          path: test/s3tables/sts_integration/test-output.log
+          retention-days: 3
+
+  lakekeeper-integration-tests:
+    name: Lakekeeper Integration Tests
+    runs-on: ubuntu-22.04
+    timeout-minutes: 30
+    
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: 'go.mod'
+        id: go
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v3
+
+      - name: Pre-pull Python image
+        run: docker pull python:3
+        
+      - name: Pre-pull LocalStack image (if needed)
+        run: docker pull localstack/localstack:latest || true
+
+      - name: Run go mod tidy
+        run: go mod tidy
+
+      - name: Install SeaweedFS
+        run: |
+          go install -buildvcs=false ./weed
+
+      - name: Run Lakekeeper Integration Tests
+        timeout-minutes: 25
+        working-directory: test/s3tables/lakekeeper
+        run: |
+          set -x
+          set -o pipefail
+          echo "=== System Information ==="
+          uname -a
+          free -h
+          df -h
+          echo "=== Starting Lakekeeper Integration Tests ==="
+          
+          # Run Lakekeeper integration tests
+          go test -v -timeout 20m . 2>&1 | tee test-output.log || {
+            echo "Lakekeeper integration tests failed"
+            exit 1
+          }
+
+      - name: Show test output on failure
+        if: failure()
+        working-directory: test/s3tables/lakekeeper
+        run: |
+          echo "=== Test Output ==="
+          if [ -f test-output.log ]; then
+            tail -200 test-output.log
+          fi
+          
+          echo "=== Process information ==="
+          ps aux | grep -E "(weed|test|docker)" || true
+
+      - name: Upload test logs on failure
+        if: failure()
+        uses: actions/upload-artifact@v6
+        with:
+          name: lakekeeper-integration-test-logs
+          path: test/s3tables/lakekeeper/test-output.log
+          retention-days: 3
+
+  s3-tables-build-verification:
+    name: S3 Tables Build Verification
+    runs-on: ubuntu-22.04
+    timeout-minutes: 15
+    
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: 'go.mod'
+        id: go
+
+      - name: Verify S3 Tables Package Builds
+        run: |
+          set -x
+          echo "=== Building S3 Tables package ==="
+          go build ./weed/s3api/s3tables || {
+            echo "S3 Tables package build failed"
+            exit 1
+          }
+          echo "S3 Tables package built successfully"
+
+      - name: Verify S3 API Integration Builds
+        run: |
+          set -x
+          echo "=== Building S3 API with S3 Tables integration ==="
+          go build ./weed/s3api || {
+            echo "S3 API build with S3 Tables failed"
+            exit 1
+          }
+          echo "S3 API with S3 Tables integration built successfully"
+
+      - name: Run Go Tests for S3 Tables Package
+        run: |
+          set -x
+          echo "=== Running Go unit tests for S3 Tables ==="
+          go test -v -race -timeout 5m ./weed/s3api/s3tables/... || {
+            echo "S3 Tables unit tests failed"
+            exit 1
+          }
+          echo "S3 Tables unit tests passed"
+
+      - name: Verify Iceberg Package Builds
+        run: |
+          set -x
+          echo "=== Building Iceberg package ==="
+          go build ./weed/s3api/iceberg || {
+            echo "Iceberg package build failed"
+            exit 1
+          }
+          echo "Iceberg package built successfully"
+
+      - name: Run Go Tests for Iceberg Package
+        run: |
+          set -x
+          echo "=== Running Go unit tests for Iceberg ==="
+          go test -v -race -timeout 5m ./weed/s3api/iceberg/... || {
+            echo "Iceberg unit tests failed"
+            exit 1
+          }
+          echo "Iceberg unit tests passed"
+
+  s3-tables-fmt-check:
+    name: S3 Tables Format Check
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: 'go.mod'
+        id: go
+
+      - name: Check Go Format
+        run: |
+          set -x
+          echo "=== Checking S3 Tables Go format ==="
+          unformatted=$(gofmt -l ./weed/s3api/s3tables)
+          if [ -n "$unformatted" ]; then
+            echo "Go format check failed - files need formatting"
+            echo "$unformatted"
+            exit 1
+          fi
+          echo "All S3 Tables files are properly formatted"
+
+      - name: Check S3 Tables Test Format
+        run: |
+          set -x
+          echo "=== Checking S3 Tables test format ==="
+          unformatted=$(gofmt -l ./test/s3tables)
+          if [ -n "$unformatted" ]; then
+            echo "Go format check failed for tests"
+            echo "$unformatted"
+            exit 1
+          fi
+          echo "All S3 Tables test files are properly formatted"
+
+      - name: Check Iceberg Format
+        run: |
+          set -x
+          echo "=== Checking Iceberg Go format ==="
+          unformatted=$(gofmt -l ./weed/s3api/iceberg)
+          if [ -n "$unformatted" ]; then
+            echo "Go format check failed for Iceberg - files need formatting"
+            echo "$unformatted"
+            exit 1
+          fi
+          echo "All Iceberg files are properly formatted"
+
+  s3-tables-vet:
+    name: S3 Tables Go Vet Check
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: 'go.mod'
+        id: go
+
+      - name: Run Go Vet
+        run: |
+          set -x
+          echo "=== Running go vet on S3 Tables package ==="
+          go vet ./weed/s3api/s3tables/... || {
+            echo "go vet check failed"
+            exit 1
+          }
+          echo "go vet checks passed"
+
+      - name: Run Go Vet on Tests
+        run: |
+          set -x
+          echo "=== Running go vet on S3 Tables tests ==="
+          go vet ./test/s3tables/... || {
+            echo "go vet check failed for tests"
+            exit 1
+          }
+          echo "go vet checks passed for tests"
+
+      - name: Run Go Vet on Iceberg
+        run: |
+          set -x
+          echo "=== Running go vet on Iceberg package ==="
+          go vet ./weed/s3api/iceberg/... || {
+            echo "go vet check failed for Iceberg"
+            exit 1
+          }
+          echo "go vet checks passed for Iceberg"
@@ -35,7 +35,7 @@ jobs:
          set -e
          mkdir -p /tmp/data
          ./weed -v=3 server -s3 -dir=/tmp/data -s3.config=../docker/compose/s3.json -master.peers=none > weed.log 2>&1 &
-          until curl -s http://localhost:8333/ > /dev/null; do sleep 1; done
+          until curl -s http://localhost:8333/healthz > /dev/null; do sleep 1; done

      - name: Setup Caddy
        run: |
@@ -54,7 +54,7 @@ jobs:
      - name: Start Caddy
        run: |
          ./caddy start
-          until curl -fsS --insecure https://localhost:8443 > /dev/null; do sleep 1; done
+          until curl -fsS --insecure https://localhost:8443/healthz > /dev/null; do sleep 1; done

      - name: Create Bucket
        run: |
@@ -0,0 +1,122 @@
+name: "Volume Server Integration Tests"
+
+on:
+  pull_request:
+    branches: [ master ]
+    paths:
+      - 'test/volume_server/**'
+      - 'weed/server/**'
+      - 'weed/storage/**'
+      - 'weed/pb/volume_server.proto'
+      - 'weed/pb/volume_server_pb/**'
+      - '.github/workflows/volume-server-integration-tests.yml'
+  push:
+    branches: [ master, main ]
+    paths:
+      - 'test/volume_server/**'
+      - 'weed/server/**'
+      - 'weed/storage/**'
+      - 'weed/pb/volume_server.proto'
+      - 'weed/pb/volume_server_pb/**'
+      - '.github/workflows/volume-server-integration-tests.yml'
+
+concurrency:
+  group: ${{ github.head_ref || github.ref }}/volume-server-integration-tests
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  GO_VERSION: '1.24'
+  TEST_TIMEOUT: '30m'
+
+jobs:
+  volume-server-integration-tests:
+    name: Volume Server Integration Tests (${{ matrix.test-type }} - Shard ${{ matrix.shard }})
+    runs-on: ubuntu-22.04
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      matrix:
+        test-type: [grpc, http]
+        shard: [1, 2, 3]
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Set up Go ${{ env.GO_VERSION }}
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ env.GO_VERSION }}
+
+      - name: Build SeaweedFS binary
+        run: |
+          cd weed
+          go build -o weed .
+          chmod +x weed
+          ./weed version
+
+      - name: Run volume server integration tests
+        env:
+          WEED_BINARY: ${{ github.workspace }}/weed/weed
+        run: |
+          if [ "${{ matrix.test-type }}" == "grpc" ]; then
+            if [ "${{ matrix.shard }}" == "1" ]; then
+              TEST_PATTERN="^Test[A-H]"
+            elif [ "${{ matrix.shard }}" == "2" ]; then
+              TEST_PATTERN="^Test[I-S]"
+            else
+              TEST_PATTERN="^Test[T-Z]"
+            fi
+          else
+            if [ "${{ matrix.shard }}" == "1" ]; then
+              TEST_PATTERN="^Test[A-G]"
+            elif [ "${{ matrix.shard }}" == "2" ]; then
+              TEST_PATTERN="^Test[H-R]"
+            else
+              TEST_PATTERN="^Test[S-Z]"
+            fi
+          fi
+          echo "Running volume server integration tests for ${{ matrix.test-type }} (Shard ${{ matrix.shard }}, pattern: ${TEST_PATTERN})..."
+          go test -v -count=1 -timeout=${{ env.TEST_TIMEOUT }} ./test/volume_server/${{ matrix.test-type }}/... -run "${TEST_PATTERN}"
+
+      - name: Collect logs on failure
+        if: failure()
+        run: |
+          mkdir -p /tmp/volume-server-it-logs
+          find /tmp -maxdepth 1 -type d -name "seaweedfs_volume_server_it_*" -print -exec cp -r {} /tmp/volume-server-it-logs/ \; || true
+
+      - name: Archive logs on failure
+        if: failure()
+        uses: actions/upload-artifact@v6
+        with:
+          name: volume-server-integration-test-logs
+          path: /tmp/volume-server-it-logs/
+          if-no-files-found: warn
+          retention-days: 7
+
+      - name: Test summary
+        if: always()
+        run: |
+          if [ "${{ matrix.test-type }}" == "grpc" ]; then
+            if [ "${{ matrix.shard }}" == "1" ]; then
+              TEST_PATTERN="^Test[A-H]"
+            elif [ "${{ matrix.shard }}" == "2" ]; then
+              TEST_PATTERN="^Test[I-S]"
+            else
+              TEST_PATTERN="^Test[T-Z]"
+            fi
+          else
+            if [ "${{ matrix.shard }}" == "1" ]; then
+              TEST_PATTERN="^Test[A-G]"
+            elif [ "${{ matrix.shard }}" == "2" ]; then
+              TEST_PATTERN="^Test[H-R]"
+            else
+              TEST_PATTERN="^Test[S-Z]"
+            fi
+          fi
+          echo "## Volume Server Integration Test Summary (${{ matrix.test-type }} - Shard ${{ matrix.shard }})" >> "$GITHUB_STEP_SUMMARY"
+          echo "- Suite: test/volume_server/${{ matrix.test-type }} (Pattern: ${TEST_PATTERN})" >> "$GITHUB_STEP_SUMMARY"
+          echo "- Command: go test -v -count=1 -timeout=${{ env.TEST_TIMEOUT }} ./test/volume_server/${{ matrix.test-type }}/... -run \"${TEST_PATTERN}\"" >> "$GITHUB_STEP_SUMMARY"
@@ -137,3 +137,8 @@ test/s3/remote_cache/primary-server.pid
 # ID and PID files
 *.id
 *.pid
+test/s3/iam/.test_env
+/test/erasure_coding/admin_dockertest/tmp
+/test/erasure_coding/admin_dockertest/task_logs
+weed_bin
+.aider*
@@ -1,242 +0,0 @@
-# Bucket Policy Engine Integration - Complete
-
-## Summary
-
-Successfully integrated the `policy_engine` package to evaluate bucket policies for **all requests** (both anonymous and authenticated). This provides comprehensive AWS S3-compatible bucket policy support.
-
-## What Changed
-
-### 1. **New File: `s3api_bucket_policy_engine.go`**
-Created a wrapper around `policy_engine.PolicyEngine` to:
- Load bucket policies from filer entries
- Sync policies from the bucket config cache
- Evaluate policies for any request (bucket, object, action, principal)
- Return structured results (allowed, evaluated, error)
-
-### 2. **Modified: `s3api_server.go`**
- Added `policyEngine *BucketPolicyEngine` field to `S3ApiServer` struct
- Initialized the policy engine in `NewS3ApiServerWithStore()`
- Linked `IdentityAccessManagement` back to `S3ApiServer` for policy evaluation
-
-### 3. **Modified: `auth_credentials.go`**
- Added `s3ApiServer *S3ApiServer` field to `IdentityAccessManagement` struct
- Added `buildPrincipalARN()` helper to convert identities to AWS ARN format
- **Integrated bucket policy evaluation into the authentication flow:**
-  - Policies are now checked **before** IAM/identity-based permissions
-  - Explicit `Deny` in bucket policy blocks access immediately
-  - Explicit `Allow` in bucket policy grants access and **bypasses IAM checks** (enables cross-account access)
-  - If no policy exists, falls through to normal IAM checks
-  - Policy evaluation errors result in access denial (fail-close security)
-
-### 4. **Modified: `s3api_bucket_config.go`**
- Added policy engine sync when bucket configs are loaded
- Ensures policies are loaded into the engine for evaluation
-
-### 5. **Modified: `auth_credentials_subscribe.go`**
- Added policy engine sync when bucket metadata changes
- Keeps the policy engine up-to-date via event-driven updates
-
-## How It Works
-
-### Anonymous Requests
-```
-1. Request comes in (no credentials)
-2. Check ACL-based public access → if public, allow
-3. Check bucket policy for anonymous ("*") access → if allowed, allow
-4. Otherwise, deny
-```
-
-### Authenticated Requests (NEW!)
-```
-1. Request comes in (with credentials)
-2. Authenticate user → get Identity
-3. Build principal ARN (e.g., "arn:aws:iam::123456:user/bob")
-4. Check bucket policy:
-   - If DENY → reject immediately
-   - If ALLOW → grant access immediately (bypasses IAM checks)
-   - If no policy or no matching statements → continue to step 5
-5. Check IAM/identity-based permissions (only if not already allowed by bucket policy)
-6. Allow or deny based on identity permissions
-```
-
-## Policy Evaluation Flow
-
-```
-┌─────────────────────────────────────────────────────────┐
-│                   Request (GET /bucket/file)            │
-└───────────────────────────┬─────────────────────────────┘
-                            │
-                ┌───────────▼──────────┐
-                │  Authenticate User   │
-                │  (or Anonymous)      │
-                └───────────┬──────────┘
-                            │
-                ┌───────────▼──────────────────────────────┐
-                │  Build Principal ARN                     │
-                │  - Anonymous: "*"                        │
-                │  - User: "arn:aws:iam::123456:user/bob"  │
-                └───────────┬──────────────────────────────┘
-                            │
-                ┌───────────▼──────────────────────────────┐
-                │  Evaluate Bucket Policy (PolicyEngine)   │
-                │  - Action: "s3:GetObject"                │
-                │  - Resource: "arn:aws:s3:::bucket/file"  │
-                │  - Principal: (from above)               │
-                └───────────┬──────────────────────────────┘
-                            │
-              ┌─────────────┼─────────────┐
-              │             │             │
-         DENY │        ALLOW │        NO POLICY
-              │             │             │
-              ▼             ▼             ▼
-        Reject Request  Grant Access  Continue
-                                          │
-                      ┌───────────────────┘
-                      │
-         ┌────────────▼─────────────┐
-         │  IAM/Identity Check      │
-         │  (identity.canDo)        │
-         └────────────┬─────────────┘
-                      │
-            ┌─────────┴─────────┐
-            │                   │
-       ALLOW │              DENY │
-            ▼                   ▼
-     Grant Access        Reject Request
-```
-
-## Example Policies That Now Work
-
-### 1. **Public Read Access** (Anonymous)
-```json
-{
-  "Version": "2012-10-17",
-  "Statement": [{
-    "Effect": "Allow",
-    "Principal": "*",
-    "Action": "s3:GetObject",
-    "Resource": "arn:aws:s3:::mybucket/*"
-  }]
-}
-```
- Anonymous users can read all objects
- Authenticated users are also evaluated against this policy. If they don't match an explicit `Allow` for this action, they will fall back to their own IAM permissions
-
-### 2. **Grant Access to Specific User** (Authenticated)
-```json
-{
-  "Version": "2012-10-17",
-  "Statement": [{
-    "Effect": "Allow",
-    "Principal": {"AWS": "arn:aws:iam::123456789012:user/bob"},
-    "Action": ["s3:GetObject", "s3:PutObject"],
-    "Resource": "arn:aws:s3:::mybucket/shared/*"
-  }]
-}
-```
- User "bob" can read/write objects in `/shared/` prefix
- Other users cannot (unless granted by their IAM policies)
-
-### 3. **Deny Access to Specific Path** (Both)
-```json
-{
-  "Version": "2012-10-17",
-  "Statement": [{
-    "Effect": "Deny",
-    "Principal": "*",
-    "Action": "s3:*",
-    "Resource": "arn:aws:s3:::mybucket/confidential/*"
-  }]
-}
-```
- **No one** can access `/confidential/` objects
- Denies override all other allows (AWS policy evaluation rules)
-
-## Performance Characteristics
-
-### Policy Loading
- **Cold start**: Policy loaded from filer → parsed → compiled → cached
- **Warm path**: Policy retrieved from `BucketConfigCache` (already parsed)
- **Updates**: Event-driven sync via metadata subscription (real-time)
-
-### Policy Evaluation
- **Compiled policies**: Pre-compiled regex patterns and matchers
- **Pattern cache**: Regex patterns cached with LRU eviction (max 1000)
- **Fast path**: Common patterns (`*`, exact matches) optimized
- **Case sensitivity**: Actions case-insensitive, resources case-sensitive (AWS-compatible)
-
-### Overhead
- **Anonymous requests**: Minimal (policy already checked, now using compiled engine)
- **Authenticated requests**: ~1-2ms added for policy evaluation (compiled patterns)
- **No policy**: Near-zero overhead (quick indeterminate check)
-
-## Testing
-
-All tests pass:
-```bash
-✅ TestBucketPolicyValidationBasics
-✅ TestPrincipalMatchesAnonymous
-✅ TestActionToS3Action
-✅ TestResourceMatching
-✅ TestMatchesPatternRegexEscaping (security tests)
-✅ TestActionMatchingCaseInsensitive
-✅ TestResourceMatchingCaseSensitive
-✅ All policy_engine package tests (30+ tests)
-```
-
-## Security Improvements
-
-1. **Regex Metacharacter Escaping**: Patterns like `*.json` properly match only files ending in `.json` (not `filexjson`)
-2. **Case-Insensitive Actions**: S3 actions matched case-insensitively per AWS spec
-3. **Case-Sensitive Resources**: Resource paths matched case-sensitively for security
-4. **Pattern Cache Size Limit**: Prevents DoS attacks via unbounded cache growth
-5. **Principal Validation**: Supports `[]string` for manually constructed policies
-
-## AWS Compatibility
-
-The implementation follows AWS S3 bucket policy evaluation rules:
-1. **Explicit Deny** always wins (checked first)
-2. **Explicit Allow** grants access (checked second)
-3. **Default Deny** if no matching statements (implicit)
-4. Bucket policies work alongside IAM policies (both are evaluated)
-
-## Files Changed
-
-```
-Modified:
-  weed/s3api/auth_credentials.go           (+47 lines)
-  weed/s3api/auth_credentials_subscribe.go (+8 lines)
-  weed/s3api/s3api_bucket_config.go        (+8 lines)
-  weed/s3api/s3api_server.go               (+5 lines)
-
-New:
-  weed/s3api/s3api_bucket_policy_engine.go (115 lines)
-```
-
-## Migration Notes
-
- **Backward Compatible**: Existing setups without bucket policies work unchanged
- **No Breaking Changes**: All existing ACL and IAM-based authorization still works
- **Additive Feature**: Bucket policies are an additional layer of authorization
- **Performance**: Minimal impact on existing workloads
-
-## Future Enhancements
-
-Potential improvements (not implemented yet):
- [ ] Condition support (IP address, time-based, etc.) - already in policy_engine
- [ ] Cross-account policies (different AWS accounts)
- [ ] Policy validation API endpoint
- [ ] Policy simulation/testing tool
- [ ] Metrics for policy evaluations (allow/deny counts)
-
-## Conclusion
-
-Bucket policies now work for **all requests** in SeaweedFS S3 API:
- ✅ Anonymous requests (public access)
- ✅ Authenticated requests (user-specific policies)
- ✅ High performance (compiled policies, caching)
- ✅ AWS-compatible (follows AWS evaluation rules)
- ✅ Secure (proper escaping, case sensitivity)
-
-The integration is complete, tested, and ready for use!
-
@@ -1,413 +0,0 @@
-# SeaweedFS Task Distribution System Design
-
-## Overview
-
-This document describes the design of a distributed task management system for SeaweedFS that handles Erasure Coding (EC) and vacuum operations through a scalable admin server and worker process architecture.
-
-## System Architecture
-
-### High-Level Components
-
-```
-┌─────────────────┐    ┌──────────────────┐    ┌─────────────────┐
-│   Master        │◄──►│  Admin Server    │◄──►│   Workers       │
-│                 │    │                  │    │                 │
-│ - Volume Info   │    │ - Task Discovery │    │ - Task Exec     │
-│ - Shard Status  │    │ - Task Assign    │    │ - Progress      │
-│ - Heartbeats    │    │ - Progress Track │    │ - Error Report  │
-└─────────────────┘    └──────────────────┘    └─────────────────┘
-         │                        │                        │
-         │                        │                        │
-         ▼                        ▼                        ▼
-┌─────────────────┐    ┌──────────────────┐    ┌─────────────────┐
-│ Volume Servers  │    │ Volume Monitor   │    │ Task Execution  │
-│                 │    │                  │    │                 │
-│ - Store Volumes │    │ - Health Check   │    │ - EC Convert    │
-│ - EC Shards     │    │ - Usage Stats    │    │ - Vacuum Clean  │
-│ - Report Status │    │ - State Sync     │    │ - Status Report │
-└─────────────────┘    └──────────────────┘    └─────────────────┘
-```
-
-## 1. Admin Server Design
-
-### 1.1 Core Responsibilities
-
- **Task Discovery**: Scan volumes to identify EC and vacuum candidates
- **Worker Management**: Track available workers and their capabilities  
- **Task Assignment**: Match tasks to optimal workers
- **Progress Tracking**: Monitor in-progress tasks for capacity planning
- **State Reconciliation**: Sync with master server for volume state updates
-
-### 1.2 Task Discovery Engine
-
-```go
-type TaskDiscoveryEngine struct {
-    masterClient   MasterClient
-    volumeScanner  VolumeScanner
-    taskDetectors  map[TaskType]TaskDetector
-    scanInterval   time.Duration
-}
-
-type VolumeCandidate struct {
-    VolumeID       uint32
-    Server         string
-    Collection     string
-    TaskType       TaskType
-    Priority       TaskPriority
-    Reason         string
-    DetectedAt     time.Time
-    Parameters     map[string]interface{}
-}
-```
-
-**EC Detection Logic**:
- Find volumes >= 95% full and idle for > 1 hour
- Exclude volumes already in EC format
- Exclude volumes with ongoing operations
- Prioritize by collection and age
-
-**Vacuum Detection Logic**:
- Find volumes with garbage ratio > 30%
- Exclude read-only volumes
- Exclude volumes with recent vacuum operations
- Prioritize by garbage percentage
-
-### 1.3 Worker Registry & Management
-
-```go
-type WorkerRegistry struct {
-    workers        map[string]*Worker
-    capabilities   map[TaskType][]*Worker
-    lastHeartbeat  map[string]time.Time
-    taskAssignment map[string]*Task
-    mutex          sync.RWMutex
-}
-
-type Worker struct {
-    ID            string
-    Address       string
-    Capabilities  []TaskType
-    MaxConcurrent int
-    CurrentLoad   int
-    Status        WorkerStatus
-    LastSeen      time.Time
-    Performance   WorkerMetrics
-}
-```
-
-### 1.4 Task Assignment Algorithm
-
-```go
-type TaskScheduler struct {
-    registry       *WorkerRegistry
-    taskQueue      *PriorityQueue
-    inProgressTasks map[string]*InProgressTask
-    volumeReservations map[uint32]*VolumeReservation
-}
-
-// Worker Selection Criteria:
-// 1. Has required capability (EC or Vacuum)
-// 2. Available capacity (CurrentLoad < MaxConcurrent)
-// 3. Best performance history for task type
-// 4. Lowest current load
-// 5. Geographically close to volume server (optional)
-```
-
-## 2. Worker Process Design
-
-### 2.1 Worker Architecture
-
-```go
-type MaintenanceWorker struct {
-    id              string
-    config          *WorkerConfig
-    adminClient     AdminClient
-    taskExecutors   map[TaskType]TaskExecutor
-    currentTasks    map[string]*RunningTask
-    registry        *TaskRegistry
-    heartbeatTicker *time.Ticker
-    requestTicker   *time.Ticker
-}
-```
-
-### 2.2 Task Execution Framework
-
-```go
-type TaskExecutor interface {
-    Execute(ctx context.Context, task *Task) error
-    EstimateTime(task *Task) time.Duration
-    ValidateResources(task *Task) error
-    GetProgress() float64
-    Cancel() error
-}
-
-type ErasureCodingExecutor struct {
-    volumeClient VolumeServerClient
-    progress     float64
-    cancelled    bool
-}
-
-type VacuumExecutor struct {
-    volumeClient VolumeServerClient
-    progress     float64
-    cancelled    bool
-}
-```
-
-### 2.3 Worker Capabilities & Registration
-
-```go
-type WorkerCapabilities struct {
-    SupportedTasks   []TaskType
-    MaxConcurrent    int
-    ResourceLimits   ResourceLimits
-    PreferredServers []string  // Affinity for specific volume servers
-}
-
-type ResourceLimits struct {
-    MaxMemoryMB      int64
-    MaxDiskSpaceMB   int64
-    MaxNetworkMbps   int64
-    MaxCPUPercent    float64
-}
-```
-
-## 3. Task Lifecycle Management
-
-### 3.1 Task States
-
-```go
-type TaskState string
-
-const (
-    TaskStatePending     TaskState = "pending"
-    TaskStateAssigned    TaskState = "assigned"
-    TaskStateInProgress  TaskState = "in_progress"
-    TaskStateCompleted   TaskState = "completed"
-    TaskStateFailed      TaskState = "failed"
-    TaskStateCancelled   TaskState = "cancelled"
-    TaskStateStuck       TaskState = "stuck"       // Taking too long
-    TaskStateDuplicate   TaskState = "duplicate"   // Detected duplicate
-)
-```
-
-### 3.2 Progress Tracking & Monitoring
-
-```go
-type InProgressTask struct {
-    Task           *Task
-    WorkerID       string
-    StartedAt      time.Time
-    LastUpdate     time.Time
-    Progress       float64
-    EstimatedEnd   time.Time
-    VolumeReserved bool  // Reserved for capacity planning
-}
-
-type TaskMonitor struct {
-    inProgressTasks map[string]*InProgressTask
-    timeoutChecker  *time.Ticker
-    stuckDetector   *time.Ticker
-    duplicateChecker *time.Ticker
-}
-```
-
-## 4. Volume Capacity Reconciliation
-
-### 4.1 Volume State Tracking
-
-```go
-type VolumeStateManager struct {
-    masterClient      MasterClient
-    inProgressTasks   map[uint32]*InProgressTask  // VolumeID -> Task
-    committedChanges  map[uint32]*VolumeChange    // Changes not yet in master
-    reconcileInterval time.Duration
-}
-
-type VolumeChange struct {
-    VolumeID     uint32
-    ChangeType   ChangeType  // "ec_encoding", "vacuum_completed"
-    OldCapacity  int64
-    NewCapacity  int64
-    TaskID       string
-    CompletedAt  time.Time
-    ReportedToMaster bool
-}
-```
-
-### 4.2 Shard Assignment Integration
-
-When the master needs to assign shards, it must consider:
-1. **Current volume state** from its own records
-2. **In-progress capacity changes** from admin server
-3. **Committed but unreported changes** from admin server
-
-```go
-type CapacityOracle struct {
-    adminServer   AdminServerClient
-    masterState   *MasterVolumeState
-    updateFreq    time.Duration
-}
-
-func (o *CapacityOracle) GetAdjustedCapacity(volumeID uint32) int64 {
-    baseCapacity := o.masterState.GetCapacity(volumeID)
-    
-    // Adjust for in-progress tasks
-    if task := o.adminServer.GetInProgressTask(volumeID); task != nil {
-        switch task.Type {
-        case TaskTypeErasureCoding:
-            // EC reduces effective capacity
-            return baseCapacity / 2  // Simplified
-        case TaskTypeVacuum:
-            // Vacuum may increase available space
-            return baseCapacity + int64(float64(baseCapacity) * 0.3)
-        }
-    }
-    
-    // Adjust for completed but unreported changes
-    if change := o.adminServer.GetPendingChange(volumeID); change != nil {
-        return change.NewCapacity
-    }
-    
-    return baseCapacity
-}
-```
-
-## 5. Error Handling & Recovery
-
-### 5.1 Worker Failure Scenarios
-
-```go
-type FailureHandler struct {
-    taskRescheduler *TaskRescheduler
-    workerMonitor   *WorkerMonitor
-    alertManager    *AlertManager
-}
-
-// Failure Scenarios:
-// 1. Worker becomes unresponsive (heartbeat timeout)
-// 2. Task execution fails (reported by worker)
-// 3. Task gets stuck (progress timeout)
-// 4. Duplicate task detection
-// 5. Resource exhaustion
-```
-
-### 5.2 Recovery Strategies
-
-**Worker Timeout Recovery**:
- Mark worker as inactive after 3 missed heartbeats
- Reschedule all assigned tasks to other workers
- Cleanup any partial state
-
-**Task Stuck Recovery**:
- Detect tasks with no progress for > 2x estimated time
- Cancel stuck task and mark volume for cleanup
- Reschedule if retry count < max_retries
-
-**Duplicate Task Prevention**:
-```go
-type DuplicateDetector struct {
-    activeFingerprints map[string]bool  // VolumeID+TaskType
-    recentCompleted    *LRUCache        // Recently completed tasks
-}
-
-func (d *DuplicateDetector) IsTaskDuplicate(task *Task) bool {
-    fingerprint := fmt.Sprintf("%d-%s", task.VolumeID, task.Type)
-    return d.activeFingerprints[fingerprint] || 
-           d.recentCompleted.Contains(fingerprint)
-}
-```
-
-## 6. Simulation & Testing Framework
-
-### 6.1 Failure Simulation
-
-```go
-type TaskSimulator struct {
-    scenarios map[string]SimulationScenario
-}
-
-type SimulationScenario struct {
-    Name            string
-    WorkerCount     int
-    VolumeCount     int
-    FailurePatterns []FailurePattern
-    Duration        time.Duration
-}
-
-type FailurePattern struct {
-    Type        FailureType  // "worker_timeout", "task_stuck", "duplicate"
-    Probability float64      // 0.0 to 1.0
-    Timing      TimingSpec   // When during task execution
-    Duration    time.Duration
-}
-```
-
-### 6.2 Test Scenarios
-
-**Scenario 1: Worker Timeout During EC**
- Start EC task on 30GB volume
- Kill worker at 50% progress
- Verify task reassignment
- Verify no duplicate EC operations
-
-**Scenario 2: Stuck Vacuum Task**
- Start vacuum on high-garbage volume
- Simulate worker hanging at 75% progress
- Verify timeout detection and cleanup
- Verify volume state consistency
-
-**Scenario 3: Duplicate Task Prevention**
- Submit same EC task from multiple sources
- Verify only one task executes
- Verify proper conflict resolution
-
-**Scenario 4: Master-Admin State Divergence**
- Create in-progress EC task
- Simulate master restart
- Verify state reconciliation
- Verify shard assignment accounts for in-progress work
-
-## 7. Performance & Scalability
-
-### 7.1 Metrics & Monitoring
-
-```go
-type SystemMetrics struct {
-    TasksPerSecond     float64
-    WorkerUtilization  float64
-    AverageTaskTime    time.Duration
-    FailureRate        float64
-    QueueDepth         int
-    VolumeStatesSync   bool
-}
-```
-
-### 7.2 Scalability Considerations
-
- **Horizontal Worker Scaling**: Add workers without admin server changes
- **Admin Server HA**: Master-slave admin servers for fault tolerance
- **Task Partitioning**: Partition tasks by collection or datacenter
- **Batch Operations**: Group similar tasks for efficiency
-
-## 8. Implementation Plan
-
-### Phase 1: Core Infrastructure
-1. Admin server basic framework
-2. Worker registration and heartbeat
-3. Simple task assignment
-4. Basic progress tracking
-
-### Phase 2: Advanced Features
-1. Volume state reconciliation
-2. Sophisticated worker selection
-3. Failure detection and recovery
-4. Duplicate prevention
-
-### Phase 3: Optimization & Monitoring
-1. Performance metrics
-2. Load balancing algorithms
-3. Capacity planning integration
-4. Comprehensive monitoring
-
-This design provides a robust, scalable foundation for distributed task management in SeaweedFS while maintaining consistency with the existing architecture patterns. 
@@ -1,4 +1,4 @@
-.PHONY: test admin-generate admin-build admin-clean admin-dev admin-run admin-test admin-fmt admin-help
+.PHONY: test admin-generate admin-build admin-clean admin-dev admin-run admin-test admin-fmt admin-help weed-commands

 BINARY = weed
 ADMIN_DIR = weed/admin
@@ -11,6 +11,9 @@ all: install
 install: admin-generate
 	cd weed; go install

+weed-commands:
+	cd weed && $(MAKE) weed-db weed-sql
+
 warp_install:
 	go install github.com/minio/warp@v0.7.6

@@ -40,7 +43,7 @@ test: admin-generate
 # Admin component targets
 admin-generate:
 	@echo "Generating admin component templates..."
-	@cd $(ADMIN_DIR) && $(MAKE) generate
+	@cd $(ADMIN_DIR) && templ generate ./view

 admin-build: admin-generate
 	@echo "Building admin component..."
@@ -89,8 +89,7 @@ Example:
 ```bash
 # remove quarantine on macOS
 # xattr -d com.apple.quarantine  ./weed
-export AWS_ACCESS_KEY_ID=admin
-export AWS_SECRET_ACCESS_KEY=key
+
 ./weed mini -dir=/data
 ```

@@ -122,7 +121,7 @@ SeaweedFS is a simple and highly scalable distributed file system. There are two
 1. to store billions of files!
 2. to serve the files fast!

-SeaweedFS started as an Object Store to handle small files efficiently. 
+SeaweedFS started as a blob store to handle small files efficiently. 
 Instead of managing all file metadata in a central master, 
 the central master only manages volumes on volume servers, 
 and these volume servers manage files and their metadata. 
@@ -134,16 +133,12 @@ It is so simple with O(1) disk reads that you are welcome to challenge the perfo

 SeaweedFS started by implementing [Facebook's Haystack design paper](http://www.usenix.org/event/osdi10/tech/full_papers/Beaver.pdf). 
 Also, SeaweedFS implements erasure coding with ideas from 
-[f4: Facebook’s Warm BLOB Storage System](https://www.usenix.org/system/files/conference/osdi14/osdi14-paper-muralidhar.pdf), and has a lot of similarities with [Facebook’s Tectonic Filesystem](https://www.usenix.org/system/files/fast21-pan.pdf)
+[f4: Facebook’s Warm BLOB Storage System](https://www.usenix.org/system/files/conference/osdi14/osdi14-paper-muralidhar.pdf), and has a lot of similarities with [Facebook’s Tectonic Filesystem](https://www.usenix.org/system/files/fast21-pan.pdf) and [Google's Colossus File System](https://cloud.google.com/blog/products/storage-data-transfer/a-peek-behind-colossus-googles-file-system)

-On top of the object store, optional [Filer] can support directories and POSIX attributes. 
+On top of the blob store, optional [Filer] can support directories and POSIX attributes. 
 Filer is a separate linearly-scalable stateless server with customizable metadata stores, 
 e.g., MySql, Postgres, Redis, Cassandra, HBase, Mongodb, Elastic Search, LevelDB, RocksDB, Sqlite, MemSql, TiDB, Etcd, CockroachDB, YDB, etc.

-For any distributed key value stores, the large values can be offloaded to SeaweedFS. 
-With the fast access speed and linearly scalable capacity, 
-SeaweedFS can work as a distributed [Key-Large-Value store][KeyLargeValueStore].
-
 SeaweedFS can transparently integrate with the cloud. 
 With hot data on local cluster, and warm data on the cloud with O(1) access time, 
 SeaweedFS can achieve both fast local access time and elastic cloud storage capacity.
@@ -153,13 +148,13 @@ Faster and cheaper than direct cloud storage!
 [Back to TOC](#table-of-contents)

 # Features #
-## Additional Features ##
-* Can choose no replication or different replication levels, rack and data center aware.
+## Additional Blob Store Features ##
+* Support different replication levels, with rack and data center aware.
 * Automatic master servers failover - no single point of failure (SPOF).
-* Automatic Gzip compression depending on file MIME type.
+* Automatic compression depending on file MIME type.
 * Automatic compaction to reclaim disk space after deletion or update.
 * [Automatic entry TTL expiration][VolumeServerTTL].
-* Any server with some disk space can add to the total storage space.
+* Flexible Capacity Expansion: Any server with some disk space can add to the total storage space.
 * Adding/Removing servers does **not** cause any data re-balancing unless triggered by admin commands.
 * Optional picture resizing.
 * Support ETag, Accept-Range, Last-Modified, etc.
@@ -167,7 +162,7 @@ Faster and cheaper than direct cloud storage!
 * Support rebalancing the writable and readonly volumes.
 * [Customizable Multiple Storage Tiers][TieredStorage]: Customizable storage disk types to balance performance and cost.
 * [Transparent cloud integration][CloudTier]: unlimited capacity via tiered cloud storage for warm data.
-* [Erasure Coding for warm storage][ErasureCoding]  Rack-Aware 10.4 erasure coding reduces storage cost and increases availability.
+* [Erasure Coding for warm storage][ErasureCoding]  Rack-Aware 10.4 erasure coding reduces storage cost and increases availability. Enterprise version can customize EC ratio.

 [Back to TOC](#table-of-contents)

@@ -213,7 +208,7 @@ Faster and cheaper than direct cloud storage!

 [Back to TOC](#table-of-contents)

-## Example: Using Seaweed Object Store ##
+## Example: Using Seaweed Blob Store ##

 By default, the master node runs on port 9333, and the volume nodes run on port 8080.
 Let's start one master node, and two volume nodes on port 8080 and 8081. Ideally, they should be started from different machines. We'll use localhost as an example.
@@ -233,23 +228,25 @@ SeaweedFS uses HTTP REST operations to read, write, and delete. The responses ar
 > weed volume -dir="/tmp/data2" -max=10 -master="localhost:9333" -port=8081 &
 ```

-### Write File ###
+### Write A Blob ###

-To upload a file: first, send a HTTP POST, PUT, or GET request to `/dir/assign` to get an `fid` and a volume server URL:
+A blob, also referred as a needle, a chunk, or mistakenly as a file, is just a byte array. It can have attributes, such as name, mime type, create or update time, etc. But basically it is just a byte array of a relatively small size, such as 2 MB ~ 64 MB. The size is not fixed.
+
+To upload a blob: first, send a HTTP POST, PUT, or GET request to `/dir/assign` to get an `fid` and a volume server URL:

 ```
 > curl http://localhost:9333/dir/assign
 {"count":1,"fid":"3,01637037d6","url":"127.0.0.1:8080","publicUrl":"localhost:8080"}
 ```

-Second, to store the file content, send a HTTP multi-part POST request to `url + '/' + fid` from the response:
+Second, to store the blob content, send a HTTP multi-part POST request to `url + '/' + fid` from the response:

 ```
 > curl -F file=@/home/chris/myphoto.jpg http://127.0.0.1:8080/3,01637037d6
 {"name":"myphoto.jpg","size":43234,"eTag":"1cc0118e"}
 ```

-To update, send another POST request with updated file content.
+To update, send another POST request with updated blob content.

 For deletion, send an HTTP DELETE request to the same `url + '/' + fid` URL:

@@ -257,7 +254,7 @@ For deletion, send an HTTP DELETE request to the same `url + '/' + fid` URL:
 > curl -X DELETE http://127.0.0.1:8080/3,01637037d6
 ```

-### Save File Id ###
+### Save Blob Id ###

 Now, you can save the `fid`, 3,01637037d6 in this case, to a database field.

@@ -269,9 +266,9 @@ The file key and file cookie are both coded in hex. You can store the <volume id

 If stored as a string, in theory, you would need 8+1+16+8=33 bytes. A char(33) would be enough, if not more than enough, since most uses will not need 2^32 volumes.

-If space is really a concern, you can store the file id in your own format. You would need one 4-byte integer for volume id, 8-byte long number for file key, and a 4-byte integer for the file cookie. So 16 bytes are more than enough.
+If space is really a concern, you can store the file id in the binary format. You would need one 4-byte integer for volume id, 8-byte long number for file key, and a 4-byte integer for the file cookie. So 16 bytes are more than enough.

-### Read File ###
+### Read a Blob ###

 Here is an example of how to render the URL.

@@ -312,7 +309,7 @@ http://localhost:8080/3/01637037d6.jpg?height=200&width=200&mode=fill

 ### Rack-Aware and Data Center-Aware Replication ###

-SeaweedFS applies the replication strategy at a volume level. So, when you are getting a file id, you can specify the replication strategy. For example:
+SeaweedFS applies the replication strategy at a volume level. So, when you are getting a blob id, you can specify the replication strategy. For example:

 ```
 curl http://localhost:9333/dir/assign?replication=001
@@ -335,7 +332,7 @@ More details about replication can be found [on the wiki][Replication].

 You can also set the default replication strategy when starting the master server.

-### Allocate File Key on Specific Data Center ###
+### Allocate Blob Key on Specific Data Center ###

 Volume servers can be started with a specific data center name:

@@ -344,7 +341,7 @@ Volume servers can be started with a specific data center name:
 weed volume -dir=/tmp/2 -port=8081 -dataCenter=dc2
 ```

-When requesting a file key, an optional "dataCenter" parameter can limit the assigned volume to the specific data center. For example, this specifies that the assigned volume should be limited to 'dc1':
+When requesting a blob key, an optional "dataCenter" parameter can limit the assigned volume to the specific data center. For example, this specifies that the assigned volume should be limited to 'dc1':

 ```
 http://localhost:9333/dir/assign?dataCenter=dc1
@@ -363,15 +360,15 @@ When requesting a file key, an optional "dataCenter" parameter can limit the ass

 [Back to TOC](#table-of-contents)

-## Object Store Architecture ##
+## Blob Store Architecture ##

-Usually distributed file systems split each file into chunks, a central master keeps a mapping of filenames, chunk indices to chunk handles, and also which chunks each chunk server has.
+Usually distributed file systems split each file into chunks. A central server keeps a mapping of filenames to chunks, and also which chunks each chunk server has.

-The main drawback is that the central master can't handle many small files efficiently, and since all read requests need to go through the chunk master, so it might not scale well for many concurrent users.
+The main drawback is that the central server can't handle many small files efficiently, and since all read requests need to go through the central master, so it might not scale well for many concurrent users.

-Instead of managing chunks, SeaweedFS manages data volumes in the master server. Each data volume is 32GB in size, and can hold a lot of files. And each storage node can have many data volumes. So the master node only needs to store the metadata about the volumes, which is a fairly small amount of data and is generally stable.
+Instead of managing chunks, SeaweedFS manages data volumes in the master server. Each data volume is 32GB in size, and can hold a lot of blobs. And each storage node can have many data volumes. So the master node only needs to store the metadata about the volumes, which is a fairly small amount of data and is generally stable.

-The actual file metadata is stored in each volume on volume servers. Since each volume server only manages metadata of files on its own disk, with only 16 bytes for each file, all file access can read file metadata just from memory and only needs one disk operation to actually read file data.
+The actual blob metadata, which are the blob volume, offset, and size, is stored in each volume on volume servers. Since each volume server only manages metadata of blobs on its own disk, with only 16 bytes for each blob, all access can read the metadata just from memory and only needs one disk operation to actually read file data.

 For comparison, consider that an xfs inode structure in Linux is 536 bytes.

@@ -385,23 +382,13 @@ On each write request, the master server also generates a file key, which is a g

 ### Write and Read files ###

-When a client sends a write request, the master server returns (volume id, file key, file cookie, volume node URL) for the file. The client then contacts the volume node and POSTs the file content.
+When a client sends a write request, the master server returns (volume id, file key, file cookie, volume node URL) for the blob. The client then contacts the volume node and POSTs the blob content.

-When a client needs to read a file based on (volume id, file key, file cookie), it asks the master server by the volume id for the (volume node URL, volume node public URL), or retrieves this from a cache. Then the client can GET the content, or just render the URL on web pages and let browsers fetch the content.
-
-Please see the example for details on the write-read process.
-
-### Storage Size ###
-
-In the current implementation, each volume can hold 32 gibibytes (32GiB or 8x2^32 bytes). This is because we align content to 8 bytes. We can easily increase this to 64GiB, or 128GiB, or more, by changing 2 lines of code, at the cost of some wasted padding space due to alignment.
-
-There can be 4 gibibytes (4GiB or 2^32 bytes) of volumes. So the total system size is 8 x 4GiB x 4GiB which is 128 exbibytes (128EiB or 2^67 bytes).
-
-Each individual file size is limited to the volume size.
+When a client needs to read a blob based on (volume id, file key, file cookie), it asks the master server by the volume id for the (volume node URL, volume node public URL), or retrieves this from a cache. Then the client can GET the content, or just render the URL on web pages and let browsers fetch the content.

 ### Saving memory ###

-All file meta information stored on a volume server is readable from memory without disk access. Each file takes just a 16-byte map entry of <64bit key, 32bit offset, 32bit size>. Of course, each map entry has its own space cost for the map. But usually the disk space runs out before the memory does.
+All blob metadata stored on a volume server is readable from memory without disk access. Each file takes just a 16-byte map entry of <64bit key, 32bit offset, 32bit size>. Of course, each map entry has its own space cost for the map. But usually the disk space runs out before the memory does.

 ### Tiered Storage to the cloud ###

@@ -415,6 +402,12 @@ If the hot/warm data is split as 20/80, with 20 servers, you can achieve storage

 [Back to TOC](#table-of-contents)

+## SeaweedFS Filer ##
+
+Built on top of the blob store, SeaweedFS Filer adds directory structure to create a file system. The directory sturcture is an interface that is implemented in many key-value stores or databases.
+
+The content of a file is mapped to one or many blobs, distributed to multiple volumes on multiple volume servers.
+
 ## Compared to Other File Systems ##

 Most other distributed file systems seem more complicated than necessary.
@@ -661,5 +654,4 @@ The text of this page is available for modification and reuse under the terms of
 [Back to TOC](#table-of-contents)

 ## Stargazers over time
-
-[![Stargazers over time](https://starchart.cc/chrislusf/seaweedfs.svg)](https://starchart.cc/chrislusf/seaweedfs)
+[![Stargazers over time](https://starchart.cc/seaweedfs/seaweedfs.svg?variant=adaptive)](https://starchart.cc/seaweedfs/seaweedfs)
@@ -1,145 +0,0 @@
-# SQL Query Engine Feature, Dev, and Test Plan
-
-This document outlines the plan for adding SQL querying support to SeaweedFS, focusing on reading and analyzing data from Message Queue (MQ) topics.
-
-## Feature Plan
-
-**1. Goal**
-
-To provide a SQL querying interface for SeaweedFS, enabling analytics on existing MQ topics. This enables:
- Basic querying with SELECT, WHERE, aggregations on MQ topics
- Schema discovery and metadata operations (SHOW DATABASES, SHOW TABLES, DESCRIBE)
- In-place analytics on Parquet-stored messages without data movement
-
-**2. Key Features**
-
-*   **Schema Discovery and Metadata:**
-    *   `SHOW DATABASES` - List all MQ namespaces
-    *   `SHOW TABLES` - List all topics in a namespace  
-    *   `DESCRIBE table_name` - Show topic schema details
-    *   Automatic schema detection from existing Parquet data
-*   **Basic Query Engine:**
-    *   `SELECT` support with `WHERE`, `LIMIT`, `OFFSET`
-    *   Aggregation functions: `COUNT()`, `SUM()`, `AVG()`, `MIN()`, `MAX()`
-    *   Temporal queries with timestamp-based filtering
-*   **User Interfaces:**
-    *   New CLI command `weed sql` with interactive shell mode
-    *   Optional: Web UI for query execution and result visualization
-*   **Output Formats:**
-    *   JSON (default), CSV, Parquet for result sets
-    *   Streaming results for large queries
-    *   Pagination support for result navigation
-
-## Development Plan
-
-
-
-**3. Data Source Integration**
-
-*   **MQ Topic Connector (Primary):**
-    *   Build on existing `weed/mq/logstore/read_parquet_to_log.go`
-    *   Implement efficient Parquet scanning with predicate pushdown
-    *   Support schema evolution and backward compatibility
-    *   Handle partition-based parallelism for scalable queries
-*   **Schema Registry Integration:**
-    *   Extend `weed/mq/schema/schema.go` for SQL metadata operations
-    *   Read existing topic schemas for query planning
-    *   Handle schema evolution during query execution
-
-**4. API & CLI Integration**
-
-*   **CLI Command:**
-    *   New `weed sql` command with interactive shell mode (similar to `weed shell`)
-    *   Support for script execution and result formatting
-    *   Connection management for remote SeaweedFS clusters
-*   **gRPC API:**
-    *   Add SQL service to existing MQ broker gRPC interface
-    *   Enable efficient query execution with streaming results
-
-## Example Usage Scenarios
-
-**Scenario 1: Schema Discovery and Metadata**
-```sql
-- List all namespaces (databases)
-SHOW DATABASES;
-
-- List topics in a namespace
-USE my_namespace;
-SHOW TABLES;
-
-- View topic structure and discovered schema
-DESCRIBE user_events;
-```
-
-**Scenario 2: Data Querying**
-```sql
-- Basic filtering and projection
-SELECT user_id, event_type, timestamp 
-FROM user_events 
-WHERE timestamp > 1640995200000 
-LIMIT 100;
-
-- Aggregation queries  
-SELECT COUNT(*) as event_count
-FROM user_events 
-WHERE timestamp >= 1640995200000;
-
-- More aggregation examples
-SELECT MAX(timestamp), MIN(timestamp) 
-FROM user_events;
-```
-
-**Scenario 3: Analytics & Monitoring**
-```sql
-- Basic analytics
-SELECT COUNT(*) as total_events
-FROM user_events 
-WHERE timestamp >= 1640995200000;
-
-- Simple monitoring
-SELECT AVG(response_time) as avg_response
-FROM api_logs
-WHERE timestamp >= 1640995200000;
-
-## Architecture Overview
-
-```
-SQL Query Flow:
-                                  1. Parse SQL        2. Plan & Optimize      3. Execute Query
-┌─────────────┐    ┌──────────────┐    ┌─────────────────┐    ┌──────────────┐
-│   Client    │    │  SQL Parser  │    │  Query Planner  │    │   Execution  │
-│    (CLI)    │──→ │ PostgreSQL   │──→ │   & Optimizer   │──→ │    Engine    │
-│             │    │ (Custom)     │    │                 │    │              │
-└─────────────┘    └──────────────┘    └─────────────────┘    └──────────────┘
-                                               │                       │
-                                               │ Schema Lookup         │ Data Access
-                                               ▼                       ▼
-                    ┌─────────────────────────────────────────────────────────────┐
-                    │                    Schema Catalog                            │
-                    │  • Namespace → Database mapping                            │
-                    │  • Topic → Table mapping                                  │
-                    │  • Schema version management                              │
-                    └─────────────────────────────────────────────────────────────┘
-                                                                        ▲
-                                                                        │ Metadata
-                                                                        │
-┌─────────────────────────────────────────────────────────────────────────────┐
-│                          MQ Storage Layer                                      │
-│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐    ▲    │
-│  │   Topic A   │  │   Topic B   │  │   Topic C   │  │     ...     │    │    │
-│  │ (Parquet)   │  │ (Parquet)   │  │ (Parquet)   │  │ (Parquet)   │    │    │
-│  └─────────────┘  └─────────────┘  └─────────────┘  └─────────────┘    │    │
-└──────────────────────────────────────────────────────────────────────────│──┘
-                                                                          │
-                                                                     Data Access
-```
-
-
-## Success Metrics
-
-*   **Feature Completeness:** Support for all specified SELECT operations and metadata commands
-*   **Performance:** 
-    *   **Simple SELECT queries**: < 100ms latency for single-table queries with up to 3 WHERE predicates on ≤ 100K records
-    *   **Complex queries**: < 1s latency for queries involving aggregations (COUNT, SUM, MAX, MIN) on ≤ 1M records
-    *   **Time-range queries**: < 500ms for timestamp-based filtering on ≤ 500K records within 24-hour windows
-*   **Scalability:** Handle topics with millions of messages efficiently
@@ -1,10 +1,11 @@
-package command
+package main

 import (
 	"context"
 	"crypto/tls"
 	"encoding/json"
 	"fmt"
+	"io"
 	"os"
 	"os/signal"
 	"strings"
@@ -13,43 +14,12 @@ import (

 	"github.com/seaweedfs/seaweedfs/weed/server/postgres"
 	"github.com/seaweedfs/seaweedfs/weed/util"
+	flag "github.com/seaweedfs/seaweedfs/weed/util/fla9"
 )

-var (
-	dbOptions DBOptions
-)
+const usageLine = "weed-db -port=5432 -master=<master_server>"

-type DBOptions struct {
-	host        *string
-	port        *int
-	masterAddr  *string
-	authMethod  *string
-	users       *string
-	database    *string
-	maxConns    *int
-	idleTimeout *string
-	tlsCert     *string
-	tlsKey      *string
-}
-
-func init() {
-	cmdDB.Run = runDB // break init cycle
-	dbOptions.host = cmdDB.Flag.String("host", "localhost", "Database server host")
-	dbOptions.port = cmdDB.Flag.Int("port", 5432, "Database server port")
-	dbOptions.masterAddr = cmdDB.Flag.String("master", "localhost:9333", "SeaweedFS master server address")
-	dbOptions.authMethod = cmdDB.Flag.String("auth", "trust", "Authentication method: trust, password, md5")
-	dbOptions.users = cmdDB.Flag.String("users", "", "User credentials for auth (JSON format '{\"user1\":\"pass1\",\"user2\":\"pass2\"}' or file '@/path/to/users.json')")
-	dbOptions.database = cmdDB.Flag.String("database", "default", "Default database name")
-	dbOptions.maxConns = cmdDB.Flag.Int("max-connections", 100, "Maximum concurrent connections per server")
-	dbOptions.idleTimeout = cmdDB.Flag.String("idle-timeout", "1h", "Connection idle timeout")
-	dbOptions.tlsCert = cmdDB.Flag.String("tls-cert", "", "TLS certificate file path")
-	dbOptions.tlsKey = cmdDB.Flag.String("tls-key", "", "TLS private key file path")
-}
-
-var cmdDB = &Command{
-	UsageLine: "db -port=5432 -master=<master_server>",
-	Short:     "start a PostgreSQL-compatible database server for SQL queries",
-	Long: `Start a PostgreSQL wire protocol compatible database server that provides SQL query access to SeaweedFS.
+const longHelp = `Start a PostgreSQL wire protocol compatible database server that provides SQL query access to SeaweedFS.

 This database server enables any PostgreSQL client, tool, or application to connect to SeaweedFS
 and execute SQL queries against MQ topics. It implements the PostgreSQL wire protocol for maximum
@@ -58,25 +28,25 @@ compatibility with the existing PostgreSQL ecosystem.
 Examples:

 	# Start database server on default port 5432
-	weed db
+	weed-db
 	
 	# Start with MD5 authentication using JSON format (recommended)
-	weed db -auth=md5 -users='{"admin":"secret","readonly":"view123"}'
+	weed-db -auth=md5 -users='{"admin":"secret","readonly":"view123"}'
 	
 	# Start with complex passwords using JSON format
-	weed db -auth=md5 -users='{"admin":"pass;with;semicolons","user":"password:with:colons"}'
+	weed-db -auth=md5 -users='{"admin":"pass;with;semicolons","user":"password:with:colons"}'
 	
 	# Start with credentials from JSON file (most secure)
-	weed db -auth=md5 -users="@/etc/seaweedfs/users.json"
+	weed-db -auth=md5 -users="@/etc/seaweedfs/users.json"
 	
 	# Start with custom port and master
-	weed db -port=5433 -master=master1:9333
+	weed-db -port=5433 -master=master1:9333
 	
 	# Allow connections from any host
-	weed db -host=0.0.0.0 -port=5432
+	weed-db -host=0.0.0.0 -port=5432
 	
 	# Start with TLS encryption
-	weed db -tls-cert=server.crt -tls-key=server.key
+	weed-db -tls-cert=server.crt -tls-key=server.key

 Client Connection Examples:

@@ -95,7 +65,7 @@ Programming Language Examples:
 	# Python (psycopg2)
 	import psycopg2
 	conn = psycopg2.connect(
-		host="localhost", port=5432, 
+		host="localhost", port=5432,
 		user="seaweedfs", database="default"
 	)
 	
@@ -116,7 +86,7 @@ Supported SQL Operations:
 	- SELECT queries on MQ topics
 	- DESCRIBE/DESC table_name commands
 	- EXPLAIN query execution plans
-	- SHOW DATABASES/TABLES commands  
+	- SHOW DATABASES/TABLES commands
 	- Aggregation functions (COUNT, SUM, AVG, MIN, MAX)
 	- WHERE clauses with filtering
 	- System columns (_timestamp_ns, _key, _source)
@@ -149,50 +119,95 @@ Performance Features:
 	- PostgreSQL wire protocol
 	- Query result streaming

-`,
+`
+
+type Options struct {
+	Host        string
+	Port        int
+	MasterAddr  string
+	AuthMethod  string
+	Users       string
+	Database    string
+	MaxConns    int
+	IdleTimeout string
+	TLSCert     string
+	TLSKey      string
 }

-func runDB(cmd *Command, args []string) bool {
+// Run executes the weed-db CLI.
+func Run(args []string) int {
+	fs := flag.NewFlagSet("weed-db", flag.ContinueOnError)
+	usageWriter := io.Writer(os.Stderr)
+	fs.SetOutput(usageWriter)

+	var opts Options
+	fs.StringVar(&opts.Host, "host", "localhost", "Database server host")
+	fs.IntVar(&opts.Port, "port", 5432, "Database server port")
+	fs.StringVar(&opts.MasterAddr, "master", "localhost:9333", "SeaweedFS master server address")
+	fs.StringVar(&opts.AuthMethod, "auth", "trust", "Authentication method: trust, password, md5")
+	fs.StringVar(&opts.Users, "users", "", "User credentials for auth (JSON format '{\"user1\":\"pass1\",\"user2\":\"pass2\"}' or file '@/path/to/users.json')")
+	fs.StringVar(&opts.Database, "database", "default", "Default database name")
+	fs.IntVar(&opts.MaxConns, "max-connections", 100, "Maximum concurrent connections per server")
+	fs.StringVar(&opts.IdleTimeout, "idle-timeout", "1h", "Connection idle timeout")
+	fs.StringVar(&opts.TLSCert, "tls-cert", "", "TLS certificate file path")
+	fs.StringVar(&opts.TLSKey, "tls-key", "", "TLS private key file path")
+
+	fs.Usage = func() {
+		fmt.Fprintf(usageWriter, "Usage: %s\n\n%s\n", usageLine, longHelp)
+		fmt.Fprintln(usageWriter, "Default Parameters:")
+		fs.PrintDefaults()
+	}
+
+	if err := fs.Parse(args); err != nil {
+		return 2
+	}
+
+	if !runWithOptions(&opts) {
+		return 1
+	}
+	return 0
+}
+
+func runWithOptions(opts *Options) bool {
 	util.LoadConfiguration("security", false)

-	// Validate options
-	if *dbOptions.masterAddr == "" {
+	// Validate options.
+	if opts.MasterAddr == "" {
 		fmt.Fprintf(os.Stderr, "Error: master address is required\n")
 		return false
 	}

-	// Parse authentication method
-	authMethod, err := parseAuthMethod(*dbOptions.authMethod)
+	// Parse authentication method.
+	authMethod, err := parseAuthMethod(opts.AuthMethod)
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
 		return false
 	}

-	// Parse user credentials
-	users, err := parseUsers(*dbOptions.users, authMethod)
+	// Parse user credentials.
+	users, err := parseUsers(opts.Users, authMethod)
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
 		return false
 	}

-	// Parse idle timeout
-	idleTimeout, err := time.ParseDuration(*dbOptions.idleTimeout)
+	// Parse idle timeout.
+	idleTimeout, err := time.ParseDuration(opts.IdleTimeout)
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "Error parsing idle timeout: %v\n", err)
 		return false
 	}

-	// Validate port number
-	if err := validatePortNumber(*dbOptions.port); err != nil {
+	// Validate port number.
+	if err := validatePortNumber(opts.Port); err != nil {
 		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
 		return false
 	}

-	// Setup TLS if requested
+	// Setup TLS if requested.
 	var tlsConfig *tls.Config
-	if *dbOptions.tlsCert != "" && *dbOptions.tlsKey != "" {
-		cert, err := tls.LoadX509KeyPair(*dbOptions.tlsCert, *dbOptions.tlsKey)
+	if opts.TLSCert != "" && opts.TLSKey != "" {
+		cert, err := tls.LoadX509KeyPair(opts.TLSCert, opts.TLSKey)
 		if err != nil {
 			fmt.Fprintf(os.Stderr, "Error loading TLS certificates: %v\n", err)
 			return false
@@ -202,34 +217,34 @@ func runDB(cmd *Command, args []string) bool {
 		}
 	}

-	// Create server configuration
+	// Create server configuration.
 	config := &postgres.PostgreSQLServerConfig{
-		Host:        *dbOptions.host,
-		Port:        *dbOptions.port,
+		Host:        opts.Host,
+		Port:        opts.Port,
 		AuthMethod:  authMethod,
 		Users:       users,
-		Database:    *dbOptions.database,
-		MaxConns:    *dbOptions.maxConns,
+		Database:    opts.Database,
+		MaxConns:    opts.MaxConns,
 		IdleTimeout: idleTimeout,
 		TLSConfig:   tlsConfig,
 	}

-	// Create database server
-	dbServer, err := postgres.NewPostgreSQLServer(config, *dbOptions.masterAddr)
+	// Create database server.
+	dbServer, err := postgres.NewPostgreSQLServer(config, opts.MasterAddr)
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "Error creating database server: %v\n", err)
 		return false
 	}

-	// Print startup information
+	// Print startup information.
 	fmt.Printf("Starting SeaweedFS Database Server...\n")
-	fmt.Printf("Host: %s\n", *dbOptions.host)
-	fmt.Printf("Port: %d\n", *dbOptions.port)
-	fmt.Printf("Master: %s\n", *dbOptions.masterAddr)
-	fmt.Printf("Database: %s\n", *dbOptions.database)
-	fmt.Printf("Auth Method: %s\n", *dbOptions.authMethod)
-	fmt.Printf("Max Connections: %d\n", *dbOptions.maxConns)
-	fmt.Printf("Idle Timeout: %s\n", *dbOptions.idleTimeout)
+	fmt.Printf("Host: %s\n", opts.Host)
+	fmt.Printf("Port: %d\n", opts.Port)
+	fmt.Printf("Master: %s\n", opts.MasterAddr)
+	fmt.Printf("Database: %s\n", opts.Database)
+	fmt.Printf("Auth Method: %s\n", opts.AuthMethod)
+	fmt.Printf("Max Connections: %d\n", opts.MaxConns)
+	fmt.Printf("Idle Timeout: %s\n", opts.IdleTimeout)
 	if tlsConfig != nil {
 		fmt.Printf("TLS: Enabled\n")
 	} else {
@@ -240,15 +255,15 @@ func runDB(cmd *Command, args []string) bool {
 	}

 	fmt.Printf("\nDatabase Connection Examples:\n")
-	fmt.Printf("  psql -h %s -p %d -U seaweedfs -d %s\n", *dbOptions.host, *dbOptions.port, *dbOptions.database)
+	fmt.Printf("  psql -h %s -p %d -U seaweedfs -d %s\n", opts.Host, opts.Port, opts.Database)
 	if len(users) > 0 {
-		// Show first user as example
+		// Show first user as example.
 		for username := range users {
-			fmt.Printf("  psql -h %s -p %d -U %s -d %s\n", *dbOptions.host, *dbOptions.port, username, *dbOptions.database)
+			fmt.Printf("  psql -h %s -p %d -U %s -d %s\n", opts.Host, opts.Port, username, opts.Database)
 			break
 		}
 	}
-	fmt.Printf("  postgresql://%s:%d/%s\n", *dbOptions.host, *dbOptions.port, *dbOptions.database)
+	fmt.Printf("  postgresql://%s:%d/%s\n", opts.Host, opts.Port, opts.Database)

 	fmt.Printf("\nSupported Operations:\n")
 	fmt.Printf("  - SELECT queries on MQ topics\n")
@@ -261,26 +276,26 @@ func runDB(cmd *Command, args []string) bool {

 	fmt.Printf("\nReady for database connections!\n\n")

-	// Start the server
+	// Start the server.
 	err = dbServer.Start()
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "Error starting database server: %v\n", err)
 		return false
 	}

-	// Set up signal handling for graceful shutdown
+	// Set up signal handling for graceful shutdown.
 	sigChan := make(chan os.Signal, 1)
 	signal.Notify(sigChan, syscall.SIGINT, syscall.SIGTERM)

-	// Wait for shutdown signal
+	// Wait for shutdown signal.
 	<-sigChan
 	fmt.Printf("\nReceived shutdown signal, stopping database server...\n")

-	// Create context with timeout for graceful shutdown
+	// Create context with timeout for graceful shutdown.
 	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 	defer cancel()

-	// Stop the server with timeout
+	// Stop the server with timeout.
 	done := make(chan error, 1)
 	go func() {
 		done <- dbServer.Stop()
@@ -301,7 +316,7 @@ func runDB(cmd *Command, args []string) bool {
 	return true
 }

-// parseAuthMethod parses the authentication method string
+// parseAuthMethod parses the authentication method string.
 func parseAuthMethod(method string) (postgres.AuthMethod, error) {
 	switch strings.ToLower(method) {
 	case "trust":
@@ -315,7 +330,7 @@ func parseAuthMethod(method string) (postgres.AuthMethod, error) {
 	}
 }

-// parseUsers parses the user credentials string with support for secure formats only
+// parseUsers parses the user credentials string with support for secure formats only.
 // Supported formats:
 // 1. JSON format: {"username":"password","username2":"password2"}
 // 2. File format: /path/to/users.json or @/path/to/users.json
@@ -323,41 +338,41 @@ func parseUsers(usersStr string, authMethod postgres.AuthMethod) (map[string]str
 	users := make(map[string]string)

 	if usersStr == "" {
-		// No users specified
+		// No users specified.
 		if authMethod != postgres.AuthTrust {
 			return nil, fmt.Errorf("users must be specified when auth method is not 'trust'")
 		}
 		return users, nil
 	}

-	// Trim whitespace
+	// Trim whitespace.
 	usersStr = strings.TrimSpace(usersStr)

-	// Determine format and parse accordingly
+	// Determine format and parse accordingly.
 	if strings.HasPrefix(usersStr, "{") && strings.HasSuffix(usersStr, "}") {
-		// JSON format
+		// JSON format.
 		return parseUsersJSON(usersStr, authMethod)
 	}

-	// Check if it's a file path (with or without @ prefix) before declaring invalid format
+	// Check if it's a file path (with or without @ prefix) before declaring invalid format.
 	filePath := strings.TrimPrefix(usersStr, "@")
 	if _, err := os.Stat(filePath); err == nil {
-		// File format
-		return parseUsersFile(usersStr, authMethod) // Pass original string to preserve @ handling
+		// File format.
+		return parseUsersFile(usersStr, authMethod) // Pass original string to preserve @ handling.
 	}

-	// Invalid format
+	// Invalid format.
 	return nil, fmt.Errorf("invalid user credentials format. Use JSON format '{\"user\":\"pass\"}' or file format '@/path/to/users.json' or 'path/to/users.json'. Legacy semicolon-separated format is no longer supported")
 }

-// parseUsersJSON parses user credentials from JSON format
+// parseUsersJSON parses user credentials from JSON format.
 func parseUsersJSON(jsonStr string, authMethod postgres.AuthMethod) (map[string]string, error) {
 	var users map[string]string
 	if err := json.Unmarshal([]byte(jsonStr), &users); err != nil {
 		return nil, fmt.Errorf("invalid JSON format for users: %v", err)
 	}

-	// Validate users
+	// Validate users.
 	for username, password := range users {
 		if username == "" {
 			return nil, fmt.Errorf("empty username in JSON user specification")
@@ -370,12 +385,12 @@ func parseUsersJSON(jsonStr string, authMethod postgres.AuthMethod) (map[string]
 	return users, nil
 }

-// parseUsersFile parses user credentials from a JSON file
+// parseUsersFile parses user credentials from a JSON file.
 func parseUsersFile(filePath string, authMethod postgres.AuthMethod) (map[string]string, error) {
-	// Remove @ prefix if present
+	// Remove @ prefix if present.
 	filePath = strings.TrimPrefix(filePath, "@")

-	// Read file content
+	// Read file content.
 	content, err := os.ReadFile(filePath)
 	if err != nil {
 		return nil, fmt.Errorf("failed to read users file '%s': %v", filePath, err)
@@ -383,16 +398,16 @@ func parseUsersFile(filePath string, authMethod postgres.AuthMethod) (map[string

 	contentStr := strings.TrimSpace(string(content))

-	// File must contain JSON format
+	// File must contain JSON format.
 	if !strings.HasPrefix(contentStr, "{") || !strings.HasSuffix(contentStr, "}") {
 		return nil, fmt.Errorf("users file '%s' must contain JSON format: {\"user\":\"pass\"}. Legacy formats are no longer supported", filePath)
 	}

-	// Parse as JSON
+	// Parse as JSON.
 	return parseUsersJSON(contentStr, authMethod)
 }

-// validatePortNumber validates that the port number is reasonable
+// validatePortNumber validates that the port number is reasonable.
 func validatePortNumber(port int) error {
 	if port < 1 || port > 65535 {
 		return fmt.Errorf("port number must be between 1 and 65535, got %d", port)
@@ -0,0 +1,7 @@
+package main
+
+import "os"
+
+func main() {
+	os.Exit(Run(os.Args[1:]))
+}
@@ -0,0 +1,7 @@
+package main
+
+import "os"
+
+func main() {
+	os.Exit(Run(os.Args[1:]))
+}
@@ -1,4 +1,4 @@
-package command
+package main

 import (
 	"context"
@@ -13,28 +13,24 @@ import (

 	"github.com/peterh/liner"
 	"github.com/seaweedfs/seaweedfs/weed/query/engine"
+	flag "github.com/seaweedfs/seaweedfs/weed/util/fla9"
 	"github.com/seaweedfs/seaweedfs/weed/util/grace"
 	"github.com/seaweedfs/seaweedfs/weed/util/sqlutil"
 )

-func init() {
-	cmdSql.Run = runSql
-}
+const usageLine = "weed-sql [-master=localhost:9333] [-interactive] [-file=query.sql] [-output=table|json|csv] [-database=dbname] [-query=\"SQL\"]"

-var cmdSql = &Command{
-	UsageLine: "sql [-master=localhost:9333] [-interactive] [-file=query.sql] [-output=table|json|csv] [-database=dbname] [-query=\"SQL\"]",
-	Short:     "advanced SQL query interface for SeaweedFS MQ topics with multiple execution modes",
-	Long: `Enhanced SQL interface for SeaweedFS Message Queue topics with multiple execution modes.
+const longHelp = `Enhanced SQL interface for SeaweedFS Message Queue topics with multiple execution modes.

 Execution Modes:
- Interactive shell (default): weed sql -interactive
- Single query: weed sql -query "SELECT * FROM user_events"  
- Batch from file: weed sql -file queries.sql
- Context switching: weed sql -database analytics -interactive
+- Interactive shell (default): weed-sql -interactive
+- Single query: weed-sql -query "SELECT * FROM user_events"
+- Batch from file: weed-sql -file queries.sql
+- Context switching: weed-sql -database analytics -interactive

 Output Formats:
 - table: ASCII table format (default for interactive)
- json: JSON format (default for non-interactive) 
+- json: JSON format (default for non-interactive)
 - csv: Comma-separated values

 Features:
@@ -45,24 +41,23 @@ Features:
 - Database context switching

 Examples:
-  weed sql -interactive
-  weed sql -query "SHOW DATABASES" -output json
-  weed sql -file batch_queries.sql -output csv
-  weed sql -database analytics -query "SELECT COUNT(*) FROM metrics"
-  weed sql -master broker1:9333 -interactive
-`,
+  weed-sql -interactive
+  weed-sql -query "SHOW DATABASES" -output json
+  weed-sql -file batch_queries.sql -output csv
+  weed-sql -database analytics -query "SELECT COUNT(*) FROM metrics"
+  weed-sql -master broker1:9333 -interactive
+`
+
+type Options struct {
+	Master      string
+	Interactive bool
+	File        string
+	Output      string
+	Database    string
+	Query       string
 }

-var (
-	sqlMaster      = cmdSql.Flag.String("master", "localhost:9333", "SeaweedFS master server HTTP address")
-	sqlInteractive = cmdSql.Flag.Bool("interactive", false, "start interactive shell mode")
-	sqlFile        = cmdSql.Flag.String("file", "", "execute SQL queries from file")
-	sqlOutput      = cmdSql.Flag.String("output", "", "output format: table, json, csv (auto-detected if not specified)")
-	sqlDatabase    = cmdSql.Flag.String("database", "", "default database context")
-	sqlQuery       = cmdSql.Flag.String("query", "", "execute single SQL query")
-)
-
-// OutputFormat represents different output formatting options
+// OutputFormat represents different output formatting options.
 type OutputFormat string

 const (
@@ -71,50 +66,82 @@ const (
 	OutputCSV   OutputFormat = "csv"
 )

-// SQLContext holds the execution context for SQL operations
+// SQLContext holds the execution context for SQL operations.
 type SQLContext struct {
 	engine          *engine.SQLEngine
 	currentDatabase string
 	outputFormat    OutputFormat
 	interactive     bool
+	master          string
 }

-func runSql(command *Command, args []string) bool {
-	// Initialize SQL engine with master address for service discovery
-	sqlEngine := engine.NewSQLEngine(*sqlMaster)
+// Run executes the weed-sql CLI.
+func Run(args []string) int {
+	fs := flag.NewFlagSet("weed-sql", flag.ContinueOnError)
+	usageWriter := io.Writer(os.Stderr)
+	fs.SetOutput(usageWriter)

-	// Determine execution mode and output format
-	interactive := *sqlInteractive || (*sqlQuery == "" && *sqlFile == "")
-	outputFormat := determineOutputFormat(*sqlOutput, interactive)
+	var opts Options
+	fs.StringVar(&opts.Master, "master", "localhost:9333", "SeaweedFS master server HTTP address")
+	fs.BoolVar(&opts.Interactive, "interactive", false, "start interactive shell mode")
+	fs.StringVar(&opts.File, "file", "", "execute SQL queries from file")
+	fs.StringVar(&opts.Output, "output", "", "output format: table, json, csv (auto-detected if not specified)")
+	fs.StringVar(&opts.Database, "database", "", "default database context")
+	fs.StringVar(&opts.Query, "query", "", "execute single SQL query")

-	// Create SQL context
+	fs.Usage = func() {
+		fmt.Fprintf(usageWriter, "Usage: %s\n\n%s\n", usageLine, longHelp)
+		fmt.Fprintln(usageWriter, "Default Parameters:")
+		fs.PrintDefaults()
+	}
+
+	if err := fs.Parse(args); err != nil {
+		return 2
+	}
+
+	if !runWithOptions(&opts) {
+		return 1
+	}
+	return 0
+}
+
+func runWithOptions(opts *Options) bool {
+	// Initialize SQL engine with master address for service discovery.
+	sqlEngine := engine.NewSQLEngine(opts.Master)
+
+	// Determine execution mode and output format.
+	interactive := opts.Interactive || (opts.Query == "" && opts.File == "")
+	outputFormat := determineOutputFormat(opts.Output, interactive)
+
+	// Create SQL context.
 	ctx := &SQLContext{
 		engine:          sqlEngine,
-		currentDatabase: *sqlDatabase,
+		currentDatabase: opts.Database,
 		outputFormat:    outputFormat,
 		interactive:     interactive,
+		master:          opts.Master,
 	}

-	// Set current database in SQL engine if specified via command line
-	if *sqlDatabase != "" {
-		ctx.engine.GetCatalog().SetCurrentDatabase(*sqlDatabase)
+	// Set current database in SQL engine if specified via command line.
+	if opts.Database != "" {
+		ctx.engine.GetCatalog().SetCurrentDatabase(opts.Database)
 	}

-	// Execute based on mode
+	// Execute based on mode.
 	switch {
-	case *sqlQuery != "":
-		// Single query mode
-		return executeSingleQuery(ctx, *sqlQuery)
-	case *sqlFile != "":
-		// Batch file mode
-		return executeFileQueries(ctx, *sqlFile)
+	case opts.Query != "":
+		// Single query mode.
+		return executeSingleQuery(ctx, opts.Query)
+	case opts.File != "":
+		// Batch file mode.
+		return executeFileQueries(ctx, opts.File)
 	default:
-		// Interactive mode
+		// Interactive mode.
 		return runInteractiveShell(ctx)
 	}
 }

-// determineOutputFormat selects the appropriate output format
+// determineOutputFormat selects the appropriate output format.
 func determineOutputFormat(specified string, interactive bool) OutputFormat {
 	switch strings.ToLower(specified) {
 	case "table":
@@ -124,7 +151,7 @@ func determineOutputFormat(specified string, interactive bool) OutputFormat {
 	case "csv":
 		return OutputCSV
 	default:
-		// Auto-detect based on mode
+		// Auto-detect based on mode.
 		if interactive {
 			return OutputTable
 		}
@@ -132,18 +159,18 @@ func determineOutputFormat(specified string, interactive bool) OutputFormat {
 	}
 }

-// executeSingleQuery executes a single query and outputs the result
+// executeSingleQuery executes a single query and outputs the result.
 func executeSingleQuery(ctx *SQLContext, query string) bool {
 	if ctx.outputFormat != OutputTable {
-		// Suppress banner for non-interactive output
+		// Suppress banner for non-interactive output.
 		return executeAndDisplay(ctx, query, false)
 	}

-	fmt.Printf("Executing query against %s...\n", *sqlMaster)
+	fmt.Printf("Executing query against %s...\n", ctx.master)
 	return executeAndDisplay(ctx, query, true)
 }

-// executeFileQueries processes SQL queries from a file
+// executeFileQueries processes SQL queries from a file.
 func executeFileQueries(ctx *SQLContext, filename string) bool {
 	content, err := os.ReadFile(filename)
 	if err != nil {
@@ -152,10 +179,10 @@ func executeFileQueries(ctx *SQLContext, filename string) bool {
 	}

 	if ctx.outputFormat == OutputTable && ctx.interactive {
-		fmt.Printf("Executing queries from %s against %s...\n", filename, *sqlMaster)
+		fmt.Printf("Executing queries from %s against %s...\n", filename, ctx.master)
 	}

-	// Split file content into individual queries (robust approach)
+	// Split file content into individual queries (robust approach).
 	queries := sqlutil.SplitStatements(string(content))

 	for i, query := range queries {
@@ -176,11 +203,11 @@ func executeFileQueries(ctx *SQLContext, filename string) bool {
 	return true
 }

-// runInteractiveShell starts the enhanced interactive shell with readline support
+// runInteractiveShell starts the enhanced interactive shell with readline support.
 func runInteractiveShell(ctx *SQLContext) bool {
 	fmt.Println("SeaweedFS Enhanced SQL Interface")
 	fmt.Println("Type 'help;' for help, 'exit;' to quit")
-	fmt.Printf("Connected to master: %s\n", *sqlMaster)
+	fmt.Printf("Connected to master: %s\n", ctx.master)
 	if ctx.currentDatabase != "" {
 		fmt.Printf("Current database: %s\n", ctx.currentDatabase)
 	}
@@ -188,24 +215,24 @@ func runInteractiveShell(ctx *SQLContext) bool {
 	fmt.Println("Use up/down arrows for command history")
 	fmt.Println()

-	// Initialize liner for readline functionality
+	// Initialize liner for readline functionality.
 	line := liner.NewLiner()
 	defer line.Close()

-	// Handle Ctrl+C gracefully
+	// Handle Ctrl+C gracefully.
 	line.SetCtrlCAborts(true)
 	grace.OnInterrupt(func() {
 		line.Close()
 	})

-	// Load command history
+	// Load command history.
 	historyPath := path.Join(os.TempDir(), "weed-sql-history")
 	if f, err := os.Open(historyPath); err == nil {
 		line.ReadHistory(f)
 		f.Close()
 	}

-	// Save history on exit
+	// Save history on exit.
 	defer func() {
 		if f, err := os.Create(historyPath); err == nil {
 			line.WriteHistory(f)
@@ -216,7 +243,7 @@ func runInteractiveShell(ctx *SQLContext) bool {
 	var queryBuffer strings.Builder

 	for {
-		// Show prompt with current database context
+		// Show prompt with current database context.
 		var prompt string
 		if queryBuffer.Len() == 0 {
 			if ctx.currentDatabase != "" {
@@ -225,10 +252,10 @@ func runInteractiveShell(ctx *SQLContext) bool {
 				prompt = "seaweedfs> "
 			}
 		} else {
-			prompt = "    -> " // Continuation prompt
+			prompt = "    -> " // Continuation prompt.
 		}

-		// Read line with readline support
+		// Read line with readline support.
 		input, err := line.Prompt(prompt)
 		if err != nil {
 			if err == liner.ErrPromptAborted {
@@ -244,30 +271,30 @@ func runInteractiveShell(ctx *SQLContext) bool {

 		lineStr := strings.TrimSpace(input)

-		// Handle empty lines
+		// Handle empty lines.
 		if lineStr == "" {
 			continue
 		}

-		// Accumulate lines in query buffer
+		// Accumulate lines in query buffer.
 		if queryBuffer.Len() > 0 {
 			queryBuffer.WriteString(" ")
 		}
 		queryBuffer.WriteString(lineStr)

-		// Check if we have a complete statement (ends with semicolon or special command)
+		// Check if we have a complete statement (ends with semicolon or special command).
 		fullQuery := strings.TrimSpace(queryBuffer.String())
 		isComplete := strings.HasSuffix(lineStr, ";") ||
 			isSpecialCommand(fullQuery)

 		if !isComplete {
-			continue // Continue reading more lines
+			continue // Continue reading more lines.
 		}

-		// Add completed command to history
+		// Add completed command to history.
 		line.AppendHistory(fullQuery)

-		// Handle special commands (with or without semicolon)
+		// Handle special commands (with or without semicolon).
 		cleanQuery := strings.TrimSuffix(fullQuery, ";")
 		cleanQuery = strings.TrimSpace(cleanQuery)

@@ -282,19 +309,19 @@ func runInteractiveShell(ctx *SQLContext) bool {
 			continue
 		}

-		// Handle database switching - use proper SQL parser instead of manual parsing
+		// Handle database switching - use proper SQL parser instead of manual parsing.
 		if strings.HasPrefix(strings.ToUpper(cleanQuery), "USE ") {
-			// Execute USE statement through the SQL engine for proper parsing
+			// Execute USE statement through the SQL engine for proper parsing.
 			result, err := ctx.engine.ExecuteSQL(context.Background(), cleanQuery)
 			if err != nil {
 				fmt.Printf("Error: %v\n\n", err)
 			} else if result.Error != nil {
 				fmt.Printf("Error: %v\n\n", result.Error)
 			} else {
-				// Extract the database name from the result message for CLI context
+				// Extract the database name from the result message for CLI context.
 				if len(result.Rows) > 0 && len(result.Rows[0]) > 0 {
 					message := result.Rows[0][0].ToString()
-					// Extract database name from "Database changed to: dbname"
+					// Extract database name from "Database changed to: dbname".
 					if strings.HasPrefix(message, "Database changed to: ") {
 						ctx.currentDatabase = strings.TrimPrefix(message, "Database changed to: ")
 					}
@@ -305,7 +332,7 @@ func runInteractiveShell(ctx *SQLContext) bool {
 			continue
 		}

-		// Handle output format switching
+		// Handle output format switching.
 		if strings.HasPrefix(strings.ToUpper(cleanQuery), "\\FORMAT ") {
 			format := strings.TrimSpace(strings.TrimPrefix(strings.ToUpper(cleanQuery), "\\FORMAT "))
 			switch format {
@@ -325,22 +352,22 @@ func runInteractiveShell(ctx *SQLContext) bool {
 			continue
 		}

-		// Execute SQL query (without semicolon)
+		// Execute SQL query (without semicolon).
 		executeAndDisplay(ctx, cleanQuery, true)

-		// Reset buffer for next query
+		// Reset buffer for next query.
 		queryBuffer.Reset()
 	}

 	return true
 }

-// isSpecialCommand checks if a command is a special command that doesn't require semicolon
+// isSpecialCommand checks if a command is a special command that doesn't require semicolon.
 func isSpecialCommand(query string) bool {
 	cleanQuery := strings.TrimSuffix(strings.TrimSpace(query), ";")
 	cleanQuery = strings.ToLower(cleanQuery)

-	// Special commands that work with or without semicolon
+	// Special commands that work with or without semicolon.
 	specialCommands := []string{
 		"exit", "quit", "\\q", "help",
 	}
@@ -351,7 +378,7 @@ func isSpecialCommand(query string) bool {
 		}
 	}

-	// Commands that are exactly specific commands (not just prefixes)
+	// Commands that are exactly specific commands (not just prefixes).
 	parts := strings.Fields(strings.ToUpper(cleanQuery))
 	if len(parts) == 0 {
 		return false
@@ -360,11 +387,11 @@ func isSpecialCommand(query string) bool {
 		strings.HasPrefix(strings.ToUpper(cleanQuery), "\\FORMAT ")
 }

-// executeAndDisplay executes a query and displays the result in the specified format
+// executeAndDisplay executes a query and displays the result in the specified format.
 func executeAndDisplay(ctx *SQLContext, query string, showTiming bool) bool {
 	startTime := time.Now()

-	// Execute the query
+	// Execute the query.
 	execCtx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 	defer cancel()

@@ -397,7 +424,7 @@ func executeAndDisplay(ctx *SQLContext, query string, showTiming bool) bool {
 		return false
 	}

-	// Display results in the specified format
+	// Display results in the specified format.
 	switch ctx.outputFormat {
 	case OutputTable:
 		displayTableResult(result)
@@ -407,8 +434,8 @@ func executeAndDisplay(ctx *SQLContext, query string, showTiming bool) bool {
 		displayCSVResult(result)
 	}

-	// Show execution time for interactive/table mode
-	// Only show timing if there are columns or if result is truly empty
+	// Show execution time for interactive/table mode.
+	// Only show timing if there are columns or if result is truly empty.
 	if showTiming && ctx.outputFormat == OutputTable && (len(result.Columns) > 0 || len(result.Rows) == 0) {
 		elapsed := time.Since(startTime)
 		fmt.Printf("\n(%d rows in set, %.3f sec)\n\n", len(result.Rows), elapsed.Seconds())
@@ -417,20 +444,20 @@ func executeAndDisplay(ctx *SQLContext, query string, showTiming bool) bool {
 	return true
 }

-// displayTableResult formats and displays query results in ASCII table format
+// displayTableResult formats and displays query results in ASCII table format.
 func displayTableResult(result *engine.QueryResult) {
 	if len(result.Columns) == 0 {
 		fmt.Println("Empty result set")
 		return
 	}

-	// Calculate column widths for formatting
+	// Calculate column widths for formatting.
 	colWidths := make([]int, len(result.Columns))
 	for i, col := range result.Columns {
 		colWidths[i] = len(col)
 	}

-	// Check data for wider columns
+	// Check data for wider columns.
 	for _, row := range result.Rows {
 		for i, val := range row {
 			if i < len(colWidths) {
@@ -442,28 +469,28 @@ func displayTableResult(result *engine.QueryResult) {
 		}
 	}

-	// Print header separator
+	// Print header separator.
 	fmt.Print("+")
 	for _, width := range colWidths {
 		fmt.Print(strings.Repeat("-", width+2) + "+")
 	}
 	fmt.Println()

-	// Print column headers
+	// Print column headers.
 	fmt.Print("|")
 	for i, col := range result.Columns {
 		fmt.Printf(" %-*s |", colWidths[i], col)
 	}
 	fmt.Println()

-	// Print separator
+	// Print separator.
 	fmt.Print("+")
 	for _, width := range colWidths {
 		fmt.Print(strings.Repeat("-", width+2) + "+")
 	}
 	fmt.Println()

-	// Print data rows
+	// Print data rows.
 	for _, row := range result.Rows {
 		fmt.Print("|")
 		for i, val := range row {
@@ -474,7 +501,7 @@ func displayTableResult(result *engine.QueryResult) {
 		fmt.Println()
 	}

-	// Print bottom separator
+	// Print bottom separator.
 	fmt.Print("+")
 	for _, width := range colWidths {
 		fmt.Print(strings.Repeat("-", width+2) + "+")
@@ -482,16 +509,16 @@ func displayTableResult(result *engine.QueryResult) {
 	fmt.Println()
 }

-// displayJSONResult outputs query results in JSON format
+// displayJSONResult outputs query results in JSON format.
 func displayJSONResult(result *engine.QueryResult) {
-	// Convert result to JSON-friendly format
+	// Convert result to JSON-friendly format.
 	jsonResult := map[string]interface{}{
 		"columns": result.Columns,
 		"rows":    make([]map[string]interface{}, len(result.Rows)),
 		"count":   len(result.Rows),
 	}

-	// Convert rows to JSON objects
+	// Convert rows to JSON objects.
 	for i, row := range result.Rows {
 		rowObj := make(map[string]interface{})
 		for j, val := range row {
@@ -502,7 +529,7 @@ func displayJSONResult(result *engine.QueryResult) {
 		jsonResult["rows"].([]map[string]interface{})[i] = rowObj
 	}

-	// Marshal and print JSON
+	// Marshal and print JSON.
 	jsonBytes, err := json.MarshalIndent(jsonResult, "", "  ")
 	if err != nil {
 		fmt.Printf("Error formatting JSON: %v\n", err)
@@ -512,11 +539,11 @@ func displayJSONResult(result *engine.QueryResult) {
 	fmt.Println(string(jsonBytes))
 }

-// displayCSVResult outputs query results in CSV format
+// displayCSVResult outputs query results in CSV format.
 func displayCSVResult(result *engine.QueryResult) {
-	// Handle execution plan results specially to avoid CSV quoting issues
+	// Handle execution plan results specially to avoid CSV quoting issues.
 	if len(result.Columns) == 1 && result.Columns[0] == "Query Execution Plan" {
-		// For execution plans, output directly without CSV encoding to avoid quotes
+		// For execution plans, output directly without CSV encoding to avoid quotes.
 		for _, row := range result.Rows {
 			if len(row) > 0 {
 				fmt.Println(row[0].ToString())
@@ -525,17 +552,17 @@ func displayCSVResult(result *engine.QueryResult) {
 		return
 	}

-	// Standard CSV output for regular query results
+	// Standard CSV output for regular query results.
 	writer := csv.NewWriter(os.Stdout)
 	defer writer.Flush()

-	// Write headers
+	// Write headers.
 	if err := writer.Write(result.Columns); err != nil {
 		fmt.Printf("Error writing CSV headers: %v\n", err)
 		return
 	}

-	// Write data rows
+	// Write data rows.
 	for _, row := range result.Rows {
 		csvRow := make([]string, len(row))
 		for i, val := range row {
@@ -553,7 +580,7 @@ func showEnhancedHelp() {

 METADATA OPERATIONS:
  SHOW DATABASES;              - List all MQ namespaces
-  SHOW TABLES;                 - List all topics in current namespace  
+  SHOW TABLES;                 - List all topics in current namespace
  SHOW TABLES FROM database;   - List topics in specific namespace
  DESCRIBE table_name;         - Show table schema

@@ -581,7 +608,7 @@ SPECIAL COMMANDS:

 EXTENDED WHERE OPERATORS:
  =, <, >, <=, >=             - Comparison operators
-  !=, <>                      - Not equal operators  
+  !=, <>                      - Not equal operators
  LIKE 'pattern%'             - Pattern matching (% = any chars, _ = single char)
  IN (value1, value2, ...)    - Multi-value matching
  AND, OR                     - Logical operators
@@ -3,7 +3,7 @@ FROM golang:1.24 AS builder
 RUN apt-get update
 RUN apt-get install -y build-essential libsnappy-dev zlib1g-dev libbz2-dev libgflags-dev liblz4-dev libzstd-dev

-ARG ROCKSDB_VERSION=v10.5.1
+ARG ROCKSDB_VERSION=v10.10.1
 ENV ROCKSDB_VERSION=${ROCKSDB_VERSION}

 # build RocksDB
@@ -3,7 +3,7 @@ FROM golang:1.24 AS builder
 RUN apt-get update
 RUN apt-get install -y build-essential libsnappy-dev zlib1g-dev libbz2-dev libgflags-dev liblz4-dev libzstd-dev

-ARG ROCKSDB_VERSION=v10.5.1
+ARG ROCKSDB_VERSION=v10.10.1
 ENV ROCKSDB_VERSION=${ROCKSDB_VERSION}

 # build RocksDB
@@ -0,0 +1,247 @@
+# SeaweedFS Block Storage -- Getting Started
+
+Block storage exposes SeaweedFS volumes as `/dev/sdX` block devices via iSCSI.
+You can format them with ext4/xfs, mount them, and use them like any disk.
+
+## Prerequisites
+
+- Linux host with `open-iscsi` installed
+- Docker with compose plugin (`docker compose`)
+
+```bash
+# Install iSCSI initiator (Ubuntu/Debian)
+sudo apt-get install -y open-iscsi
+
+# Verify
+sudo systemctl start iscsid
+```
+
+## Quick Start (5 minutes)
+
+### 1. Build the image
+
+```bash
+# From the seaweedfs repo root
+GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -o docker/compose/weed ./weed
+cd docker
+docker build -f Dockerfile.local -t seaweedfs-block:local .
+```
+
+### 2. Start the cluster
+
+```bash
+cd docker/compose
+
+# Set HOST_IP to your machine's IP (for remote iSCSI clients)
+# Use 127.0.0.1 for local-only testing
+HOST_IP=127.0.0.1 docker compose -f local-block-compose.yml up -d
+```
+
+Wait ~5 seconds for the volume server to register with the master.
+
+### 3. Create a block volume
+
+```bash
+curl -s -X POST http://localhost:9333/block/volume \
+  -H "Content-Type: application/json" \
+  -d '{"name":"myvolume","size_bytes":1073741824}'
+```
+
+This creates a 1GB block volume, auto-assigns it as primary, and starts the
+iSCSI target. The response includes the IQN and iSCSI address.
+
+### 4. Connect via iSCSI
+
+```bash
+# Discover targets
+sudo iscsiadm -m discovery -t sendtargets -p 127.0.0.1:3260
+
+# Login
+sudo iscsiadm -m node -T iqn.2024-01.com.seaweedfs:vol.myvolume \
+  -p 127.0.0.1:3260 --login
+
+# Find the new device
+lsblk | grep sd
+```
+
+### 5. Format and mount
+
+```bash
+# Format with ext4
+sudo mkfs.ext4 /dev/sdX
+
+# Mount
+sudo mkdir -p /mnt/myvolume
+sudo mount /dev/sdX /mnt/myvolume
+
+# Use it like any filesystem
+echo "hello" | sudo tee /mnt/myvolume/test.txt
+```
+
+### 6. Cleanup
+
+```bash
+sudo umount /mnt/myvolume
+sudo iscsiadm -m node -T iqn.2024-01.com.seaweedfs:vol.myvolume \
+  -p 127.0.0.1:3260 --logout
+docker compose -f local-block-compose.yml down -v
+```
+
+## API Reference
+
+All endpoints are on the master server (default: port 9333).
+
+### Create volume
+
+```
+POST /block/volume
+Content-Type: application/json
+
+{
+  "name": "myvolume",
+  "size_bytes": 1073741824,
+  "disk_type": "ssd",
+  "replica_placement": "001",
+  "durability_mode": "best_effort"
+}
+```
+
+| Field | Required | Default | Description |
+|-------|----------|---------|-------------|
+| `name` | yes | -- | Volume name (alphanumeric + hyphens) |
+| `size_bytes` | yes | -- | Volume size in bytes |
+| `disk_type` | no | `""` | Disk type hint: `ssd`, `hdd` |
+| `replica_placement` | no | `000` | SeaweedFS placement: `000` (no replica), `001` (1 replica same rack) |
+| `durability_mode` | no | `best_effort` | `best_effort`, `sync_all`, `sync_quorum` |
+| `replica_factor` | no | `2` | Number of copies: 1, 2, or 3 |
+
+### List volumes
+
+```
+GET /block/volumes
+```
+
+Returns JSON array of all block volumes with status, role, epoch, IQN, etc.
+
+### Lookup volume
+
+```
+GET /block/volume/{name}
+```
+
+### Delete volume
+
+```
+DELETE /block/volume/{name}
+```
+
+### Assign role
+
+```
+POST /block/assign
+Content-Type: application/json
+
+{
+  "name": "myvolume",
+  "epoch": 2,
+  "role": "primary",
+  "lease_ttl_ms": 30000
+}
+```
+
+Roles: `primary`, `replica`, `stale`, `rebuilding`.
+
+### Cluster status
+
+```
+GET /block/status
+```
+
+Returns volume count, server count, failover stats, queue depth.
+
+## Remote Client Setup
+
+To connect from a remote machine (not the Docker host):
+
+1. Set `HOST_IP` to the Docker host's network-reachable IP:
+   ```bash
+   HOST_IP=192.168.1.100 docker compose -f local-block-compose.yml up -d
+   ```
+
+2. On the client machine:
+   ```bash
+   sudo iscsiadm -m discovery -t sendtargets -p 192.168.1.100:3260
+   sudo iscsiadm -m node -T iqn.2024-01.com.seaweedfs:vol.myvolume \
+     -p 192.168.1.100:3260 --login
+   ```
+
+## Volume Lifecycle
+
+```
+create  -->  primary (serving I/O via iSCSI)
+                |
+           unmount/remount OK (lease auto-renewed by master)
+                |
+         assign replica  -->  WAL shipping active
+                |
+          kill primary   -->  promote replica  -->  new primary
+                |
+          old primary    -->  rebuild from new primary
+```
+
+Key points:
+- **Lease renewal is automatic.** The master continuously renews the primary's
+  write lease via the heartbeat stream. Unmount/remount works without manual
+  intervention.
+- **Epoch fencing.** Each role change bumps the epoch. Old primaries cannot
+  write after being demoted -- even if they still have the lease.
+- **Volumes survive container restart.** Data is stored in the Docker volume
+  at `/data/blocks/`. The volume server re-registers with the master on restart.
+
+## Troubleshooting
+
+**iSCSI login fails with "No records found"**
+- Run discovery first: `sudo iscsiadm -m discovery -t sendtargets -p HOST:3260`
+
+**Device not appearing after login**
+- Check `dmesg | tail` for SCSI errors
+- Verify the volume is assigned as primary: `curl http://HOST:9333/block/volumes`
+
+**I/O errors on write**
+- Check volume role is `primary` (not `none` or `stale`)
+- Check master is running (lease renewal requires master heartbeat)
+
+**Stuck iSCSI session after container restart**
+- Force logout: `sudo iscsiadm -m node -T IQN -p HOST:PORT --logout`
+- If stuck: `sudo ss -K dst HOST dport = 3260` to kill the TCP connection
+- Then re-discover and login
+
+## Docker Compose Reference
+
+```yaml
+# local-block-compose.yml
+services:
+  master:
+    image: seaweedfs-block:local
+    ports:
+      - "9333:9333"      # HTTP API
+      - "19333:19333"     # gRPC
+    command: ["master", "-ip=master", "-ip.bind=0.0.0.0", "-mdir=/data"]
+
+  volume:
+    image: seaweedfs-block:local
+    ports:
+      - "8280:8080"       # Volume HTTP
+      - "18280:18080"     # Volume gRPC
+      - "3260:3260"       # iSCSI target
+    command: >
+      volume -ip=volume -master=master:9333 -dir=/data
+      -block.dir=/data/blocks
+      -block.listen=0.0.0.0:3260
+      -block.portal=${HOST_IP:-127.0.0.1}:3260,1
+```
+
+Key flags:
+- `-block.dir`: Directory for `.blk` volume files
+- `-block.listen`: iSCSI target listen address (inside container)
+- `-block.portal`: iSCSI portal address reported to clients (must be reachable)
@@ -0,0 +1,38 @@
+## SeaweedFS Block Storage — Docker Compose
+##
+## Usage:
+##   HOST_IP=192.168.1.100 docker compose -f local-block-compose.yml up -d
+##
+## The HOST_IP is used for iSCSI discovery so external clients can connect.
+## If running on the same host, you can use: HOST_IP=127.0.0.1
+
+services:
+  master:
+    image: seaweedfs-block:local
+    entrypoint: ["/usr/bin/weed"]
+    ports:
+      - "9333:9333"
+      - "19333:19333"
+    command: ["master", "-ip=master", "-ip.bind=0.0.0.0", "-mdir=/data"]
+
+  volume:
+    image: seaweedfs-block:local
+    ports:
+      - "8280:8080"
+      - "18280:18080"
+      - "3260:3260"
+    entrypoint: ["/bin/sh", "-c"]
+    command:
+      - >
+        mkdir -p /data/blocks &&
+        exec /usr/bin/weed volume
+        -ip=volume
+        -master=master:9333
+        -ip.bind=0.0.0.0
+        -port=8080
+        -dir=/data
+        -block.dir=/data/blocks
+        -block.listen=0.0.0.0:3260
+        -block.portal=${HOST_IP:-127.0.0.1}:3260,1
+    depends_on:
+      - master
@@ -1,101 +1,2 @@
 #!/bin/sh
-
-# Enable FIPS 140-3 mode by default (Go 1.24+)
-# To disable: docker run -e GODEBUG=fips140=off ...
-export GODEBUG="${GODEBUG:+$GODEBUG,}fips140=on"
-
-# Fix permissions for mounted volumes
-# If /data is mounted from host, it might have different ownership
-# Fix this by ensuring seaweed user owns the directory
-if [ "$(id -u)" = "0" ]; then
-  # Running as root, check and fix permissions if needed
-  SEAWEED_UID=$(id -u seaweed)
-  SEAWEED_GID=$(id -g seaweed)
-  
-  # Verify seaweed user and group exist
-  if [ -z "$SEAWEED_UID" ] || [ -z "$SEAWEED_GID" ]; then
-    echo "Error: 'seaweed' user or group not found. Cannot fix permissions." >&2
-    exit 1
-  fi
-  
-  DATA_UID=$(stat -c '%u' /data 2>/dev/null)
-  DATA_GID=$(stat -c '%g' /data 2>/dev/null)
-  
-  # Only run chown -R if ownership doesn't match (much faster for subsequent starts)
-    echo "Fixing /data ownership for seaweed user (uid=$SEAWEED_UID, gid=$SEAWEED_GID)"
-    if ! chown -R seaweed:seaweed /data; then
-      echo "Warning: Failed to change ownership of /data. This may cause permission errors." >&2
-      echo "If /data is read-only or has mount issues, the application may fail to start." >&2
-    fi
-  
-  # Use su-exec to drop privileges and run as seaweed user
-  exec su-exec seaweed "$0" "$@"
-fi
-
-isArgPassed() {
-  arg="$1"
-  argWithEqualSign="$1="
-  shift
-  while [ $# -gt 0 ]; do
-    passedArg="$1"
-    shift
-    case $passedArg in
-    "$arg")
-      return 0
-      ;;
-    "$argWithEqualSign"*)
-      return 0
-      ;;
-    esac
-  done
-  return 1
-}
-
-case "$1" in
-
-  'master')
-  	ARGS="-mdir=/data -volumePreallocate -volumeSizeLimitMB=1024"
-  	shift
-  	exec /usr/bin/weed -logtostderr=true master $ARGS $@
-	;;
-
-  'volume')
-  	ARGS="-dir=/data -max=0"
-  	if isArgPassed "-max" "$@"; then
-  	  ARGS="-dir=/data"
-  	fi
-  	shift
-  	exec /usr/bin/weed -logtostderr=true volume $ARGS $@
-	;;
-
-  'server')
-  	ARGS="-dir=/data -volume.max=0 -master.volumePreallocate -master.volumeSizeLimitMB=1024"
-  	if isArgPassed "-volume.max" "$@"; then
-  	  ARGS="-dir=/data -master.volumePreallocate -master.volumeSizeLimitMB=1024"
-  	fi
- 	shift
-  	exec /usr/bin/weed -logtostderr=true server $ARGS $@
-  	;;
-
-  'filer')
-  	ARGS=""
-  	shift
-  	exec /usr/bin/weed -logtostderr=true filer $ARGS $@
-	;;
-
-  's3')
-  	ARGS="-domainName=$S3_DOMAIN_NAME -key.file=$S3_KEY_FILE -cert.file=$S3_CERT_FILE"
-  	shift
-  	exec /usr/bin/weed -logtostderr=true s3 $ARGS $@
-	;;
-
-  'shell')
-  	ARGS="-cluster=$SHELL_CLUSTER -filer=$SHELL_FILER -filerGroup=$SHELL_FILER_GROUP -master=$SHELL_MASTER -options=$SHELL_OPTIONS"
-  	shift
-  	exec echo "$@" | /usr/bin/weed -logtostderr=true shell $ARGS
-  ;;
-
-  *)
-  	exec /usr/bin/weed $@
-	;;
-esac
+exec /usr/bin/weed "$@"
@@ -33,7 +33,7 @@ isArgPassed() {
 case "$1" in

  'master')
-  	ARGS="-mdir=/data -volumePreallocate -volumeSizeLimitMB=1024"
+  	ARGS="-mdir=/data -volumeSizeLimitMB=1024"
  	shift
  	exec /usr/bin/weed -logtostderr=true master $ARGS "$@"
 	;;
@@ -48,9 +48,9 @@ case "$1" in
 	;;

  'server')
-  	ARGS="-dir=/data -volume.max=0 -master.volumePreallocate -master.volumeSizeLimitMB=1024"
+  	ARGS="-dir=/data -volume.max=0 -master.volumeSizeLimitMB=1024"
  	if isArgPassed "-volume.max" "$@"; then
-  	  ARGS="-dir=/data -master.volumePreallocate -master.volumeSizeLimitMB=1024"
+  	  ARGS="-dir=/data -master.volumeSizeLimitMB=1024"
  	fi
 	shift
  	exec /usr/bin/weed -logtostderr=true server $ARGS "$@"
@@ -42,3 +42,12 @@ services:
      - master
      - volume
      - filer
+  admin:
+    image: chrislusf/seaweedfs:dev # use a remote dev image
+    ports:
+      - 23646:23646
+    command: 'admin -master=master:9333'
+    depends_on:
+      - master
+      - volume
+      - filer
@@ -0,0 +1,34 @@
+# Put this file to one of the location, with descending priority
+#    ./security.toml
+#    $HOME/.seaweedfs/security.toml
+#    /etc/seaweedfs/security.toml
+# this file is read by master, volume server, filer, and worker
+
+# comma separated origins allowed to make requests to the filer and s3 gateway. 
+# enter in this format: https://domain.com, or http://localhost:port
+[cors.allowed_origins]
+values = "*"
+
+# this jwt signing key is read by master and volume server, and it is used for write operations:
+# - the Master server generates the JWT, which can be used to write a certain file on a volume server
+# - the Volume server validates the JWT on writing
+# the jwt defaults to expire after 10 seconds.
+# [jwt.signing]
+# key = "V1JJVEVTRUNSRVRFWEFNUExFMTIzNDU2Nzg5MDEy" # Example: WRITESECRETEXAMPLE123456789012
+# this jwt signing key is read by master and volume server, and it is used for read operations:
+# - the Master server generates the JWT, which can be used to read a certain file on a volume server
+# - the Volume server validates the JWT on reading
+# [jwt.signing.read]
+# key = "UkVBRFNFQ1JFVUVYQU1QTEUxMjM0NTY3ODkwMTI=" # Example: READSECRETEXAMPLE123456789012
+# If this JWT key is configured, Filer only accepts writes over HTTP if they are signed with this JWT:
+# - f.e. the S3 API Shim generates the JWT
+# - the Filer server validates the JWT on writing
+# the jwt defaults to expire after 10 seconds.
+# [jwt.filer_signing]
+# key = "RklMRVJXUklURVNFQ1JFVEVYQU1QTEUxMjM0NTY3OA==" # Example: FILERWRITESECRETEXAMPLE12345678
+# If this JWT key is configured, Filer only accepts reads over HTTP if they are signed with this JWT:
+# - f.e. the S3 API Shim generates the JWT
+# - the Filer server validates the JWT on reading
+# the jwt defaults to expire after 10 seconds.
+# [jwt.filer_signing.read]
+# key = "RklMRVJSRUFEU0VDUkVURVhBTVBMRTEyMzQ1Njc4OQ==" # Example: FILERREADSECRETEXAMPLE123456789
@@ -3,9 +3,9 @@ module github.com/seaweedfs/seaweedfs
 go 1.24.9

 require (
-	cloud.google.com/go v0.121.6 // indirect
+	cloud.google.com/go v0.123.0 // indirect
 	cloud.google.com/go/pubsub v1.50.1
-	cloud.google.com/go/storage v1.57.1
+	cloud.google.com/go/storage v1.59.2
 	github.com/Shopify/sarama v1.38.1
 	github.com/aws/aws-sdk-go v1.55.8
 	github.com/beorn7/perks v1.0.1 // indirect
@@ -13,7 +13,7 @@ require (
 	github.com/cenkalti/backoff/v4 v4.3.0
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/coreos/go-semver v0.3.1 // indirect
-	github.com/coreos/go-systemd/v22 v22.5.0 // indirect
+	github.com/coreos/go-systemd/v22 v22.6.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
 	github.com/dustin/go-humanize v1.0.1
@@ -29,7 +29,6 @@ require (
 	github.com/go-redsync/redsync/v4 v4.15.0
 	github.com/go-sql-driver/mysql v1.9.3
 	github.com/go-zookeeper/zk v1.0.3 // indirect
-	github.com/gocql/gocql v1.7.0
 	github.com/golang/protobuf v1.5.4
 	github.com/golang/snappy v1.0.0
 	github.com/google/btree v1.1.3
@@ -37,22 +36,21 @@ require (
 	github.com/google/wire v0.7.0 // indirect
 	github.com/googleapis/gax-go/v2 v2.15.0 // indirect
 	github.com/gorilla/mux v1.8.1
-	github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
-	github.com/jackc/pgx/v5 v5.7.6
+	github.com/jackc/pgx/v5 v5.8.0
 	github.com/jcmturner/gofork v1.7.6 // indirect
 	github.com/jcmturner/gokrb5/v8 v8.4.4 // indirect
 	github.com/jinzhu/copier v0.4.0
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/json-iterator/go v1.1.12
 	github.com/karlseguin/ccache/v2 v2.0.8
-	github.com/klauspost/compress v1.18.2
-	github.com/klauspost/reedsolomon v1.12.6
+	github.com/klauspost/compress v1.18.4
+	github.com/klauspost/reedsolomon v1.13.0
 	github.com/kurin/blazer v0.5.3
-	github.com/linxGnu/grocksdb v1.10.3
-	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/linxGnu/grocksdb v1.10.7
+	github.com/mailru/easyjson v0.9.1 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
@@ -64,13 +62,13 @@ require (
 	github.com/pquerna/cachecontrol v0.2.0
 	github.com/prometheus/client_golang v1.23.2
 	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.66.1 // indirect
+	github.com/prometheus/common v0.67.2 // indirect
 	github.com/prometheus/procfs v0.19.2
 	github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/seaweedfs/goexif v1.0.3
 	github.com/seaweedfs/raft v1.1.6
-	github.com/sirupsen/logrus v1.9.3 // indirect
+	github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af // indirect
 	github.com/spf13/afero v1.15.0 // indirect
 	github.com/spf13/cast v1.10.0 // indirect
 	github.com/spf13/viper v1.21.0
@@ -88,30 +86,30 @@ require (
 	github.com/xdg-go/scram v1.1.2 // indirect
 	github.com/xdg-go/stringprep v1.0.4 // indirect
 	github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect
-	go.etcd.io/etcd/client/v3 v3.6.6
+	go.etcd.io/etcd/client/v3 v3.6.7
 	go.mongodb.org/mongo-driver v1.17.6
 	go.opencensus.io v0.24.0 // indirect
 	gocloud.dev v0.44.0
 	gocloud.dev/pubsub/natspubsub v0.44.0
 	gocloud.dev/pubsub/rabbitpubsub v0.44.0
-	golang.org/x/crypto v0.46.0
-	golang.org/x/exp v0.0.0-20250811191247-51f88131bc50
-	golang.org/x/image v0.34.0
-	golang.org/x/net v0.48.0
+	golang.org/x/crypto v0.48.0
+	golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546
+	golang.org/x/image v0.36.0
+	golang.org/x/net v0.49.0
 	golang.org/x/oauth2 v0.34.0
-	golang.org/x/sys v0.39.0
-	golang.org/x/text v0.32.0 // indirect
-	golang.org/x/tools v0.39.0 // indirect
+	golang.org/x/sys v0.41.0
+	golang.org/x/text v0.34.0 // indirect
+	golang.org/x/tools v0.41.0 // indirect
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
 	google.golang.org/api v0.258.0
-	google.golang.org/genproto v0.0.0-20250715232539-7130f93afb79 // indirect
-	google.golang.org/grpc v1.77.0
+	google.golang.org/genproto v0.0.0-20250922171735-9219d122eba9 // indirect
+	google.golang.org/grpc v1.78.0
 	google.golang.org/protobuf v1.36.11
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	modernc.org/b v1.0.0 // indirect
 	modernc.org/mathutil v1.7.1
 	modernc.org/memory v1.11.0 // indirect
-	modernc.org/sqlite v1.42.2
+	modernc.org/sqlite v1.46.1
 	modernc.org/strutil v1.2.1
 )

@@ -120,44 +118,46 @@ require (
 	github.com/Azure/azure-sdk-for-go/sdk/keyvault/azkeys v0.10.0
 	github.com/Jille/raft-grpc-transport v1.6.1
 	github.com/ThreeDotsLabs/watermill v1.5.1
-	github.com/a-h/templ v0.3.943
+	github.com/a-h/templ v0.3.977
+	github.com/apache/cassandra-gocql-driver/v2 v2.0.0
+	github.com/apache/iceberg-go v0.4.0
 	github.com/apple/foundationdb/bindings/go v0.0.0-20250911184653-27f7192f47c3
 	github.com/arangodb/go-driver v1.6.9
 	github.com/armon/go-metrics v0.4.1
-	github.com/aws/aws-sdk-go-v2 v1.41.0
-	github.com/aws/aws-sdk-go-v2/config v1.32.6
-	github.com/aws/aws-sdk-go-v2/credentials v1.19.6
+	github.com/aws/aws-sdk-go-v2 v1.41.1
+	github.com/aws/aws-sdk-go-v2/config v1.32.7
+	github.com/aws/aws-sdk-go-v2/credentials v1.19.7
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.95.0
 	github.com/cognusion/imaging v1.0.2
+	github.com/container-storage-interface/spec v1.10.0
 	github.com/fluent/fluent-logger-golang v1.10.1
-	github.com/getsentry/sentry-go v0.40.0
-	github.com/gin-contrib/sessions v1.0.4
-	github.com/gin-gonic/gin v1.11.0
-	github.com/golang-jwt/jwt/v5 v5.3.0
+	github.com/getsentry/sentry-go v0.42.0
+	github.com/go-ldap/ldap/v3 v3.4.12
+	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/google/flatbuffers/go v0.0.0-20230108230133-3b8644d32c50
 	github.com/hashicorp/raft v1.7.3
 	github.com/hashicorp/raft-boltdb/v2 v2.3.1
 	github.com/hashicorp/vault/api v1.22.0
-	github.com/jhump/protoreflect v1.17.0
-	github.com/lib/pq v1.10.9
+	github.com/jhump/protoreflect v1.18.0
 	github.com/linkedin/goavro/v2 v2.14.1
-	github.com/mattn/go-sqlite3 v1.14.32
+	github.com/mattn/go-sqlite3 v1.14.34
 	github.com/minio/crc64nvme v1.1.1
 	github.com/orcaman/concurrent-map/v2 v2.0.1
-	github.com/parquet-go/parquet-go v0.26.3
+	github.com/parquet-go/parquet-go v0.28.0
 	github.com/pkg/sftp v1.13.10
 	github.com/rabbitmq/amqp091-go v1.10.0
-	github.com/rclone/rclone v1.71.2
+	github.com/rclone/rclone v1.73.1
 	github.com/rdleal/intervalst v1.5.0
-	github.com/redis/go-redis/v9 v9.17.2
+	github.com/redis/go-redis/v9 v9.18.0
 	github.com/schollz/progressbar/v3 v3.19.0
 	github.com/seaweedfs/go-fuse/v2 v2.9.1
-	github.com/shirou/gopsutil/v4 v4.25.11
+	github.com/shirou/gopsutil/v4 v4.26.1
 	github.com/tarantool/go-tarantool/v2 v2.4.1
+	github.com/testcontainers/testcontainers-go v0.39.0
 	github.com/tikv/client-go/v2 v2.0.7
 	github.com/xeipuuv/gojsonschema v1.2.0
 	github.com/ydb-platform/ydb-go-sdk-auth-environ v0.5.1
-	github.com/ydb-platform/ydb-go-sdk/v3 v3.125.1
+	github.com/ydb-platform/ydb-go-sdk/v3 v3.125.3
 	go.etcd.io/etcd/client/pkg/v3 v3.6.7
 	go.uber.org/atomic v1.11.0
 	golang.org/x/sync v0.19.0
@@ -168,60 +168,129 @@ require (
 require github.com/k0kubun/colorstring v0.0.0-20150214042306-9440f1994b88 // indirect

 require (
-	cloud.google.com/go/longrunning v0.6.7 // indirect
+	atomicgo.dev/cursor v0.2.0 // indirect
+	atomicgo.dev/keyboard v0.2.9 // indirect
+	atomicgo.dev/schedule v0.1.0 // indirect
+	cloud.google.com/go/longrunning v0.7.0 // indirect
 	cloud.google.com/go/pubsub/v2 v2.2.1 // indirect
+	dario.cat/mergo v1.0.2 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/keyvault/internal v0.7.1 // indirect
-	github.com/aws/aws-sdk-go-v2/service/signin v1.0.4 // indirect
+	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
+	github.com/Azure/go-autorest v14.2.0+incompatible // indirect
+	github.com/Azure/go-autorest/autorest/to v0.4.1 // indirect
+	github.com/FilenCloudDienste/filen-sdk-go v0.0.37 // indirect
+	github.com/a1ex3/zstd-seekable-format-go/pkg v0.10.0 // indirect
+	github.com/anchore/go-lzo v0.1.0 // indirect
+	github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
+	github.com/apache/arrow-go/v18 v18.4.1 // indirect
+	github.com/apache/thrift v0.22.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/signin v1.0.5 // indirect
+	github.com/bahlo/generic-list-go v0.2.0 // indirect
 	github.com/bazelbuild/rules_go v0.46.0 // indirect
 	github.com/biogo/store v0.0.0-20201120204734-aad293a2328f // indirect
 	github.com/blevesearch/snowballstem v0.9.0 // indirect
-	github.com/bufbuild/protocompile v0.14.1 // indirect
+	github.com/boombuler/barcode v1.1.0 // indirect
+	github.com/buger/jsonparser v1.1.1 // indirect
 	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
-	github.com/cockroachdb/apd/v3 v3.1.0 // indirect
+	github.com/clipperhouse/stringish v0.1.1 // indirect
+	github.com/clipperhouse/uax29/v2 v2.3.0 // indirect
+	github.com/cockroachdb/apd/v3 v3.2.1 // indirect
 	github.com/cockroachdb/errors v1.11.3 // indirect
 	github.com/cockroachdb/logtags v0.0.0-20241215232642-bb51bb14a506 // indirect
 	github.com/cockroachdb/redact v1.1.5 // indirect
 	github.com/cockroachdb/version v0.0.0-20250314144055-3860cd14adf2 // indirect
+	github.com/containerd/console v1.0.5 // indirect
+	github.com/containerd/errdefs v1.0.0 // indirect
+	github.com/containerd/errdefs/pkg v0.3.0 // indirect
+	github.com/containerd/log v0.1.0 // indirect
+	github.com/containerd/platforms v1.0.0-rc.1 // indirect
+	github.com/cpuguy83/dockercfg v0.3.2 // indirect
 	github.com/dave/dst v0.27.2 // indirect
+	github.com/diskfs/go-diskfs v1.7.0 // indirect
+	github.com/distribution/reference v0.6.0 // indirect
+	github.com/docker/docker v28.5.0+incompatible // indirect
+	github.com/docker/go-connections v0.6.0 // indirect
+	github.com/docker/go-units v0.5.0 // indirect
+	github.com/dromara/dongle v1.0.1 // indirect
+	github.com/gin-gonic/gin v1.11.0 // indirect
+	github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
+	github.com/go-git/go-billy/v5 v5.6.2 // indirect
 	github.com/goccy/go-yaml v1.18.0 // indirect
 	github.com/golang/geo v0.0.0-20210211234256-740aa86cb551 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
+	github.com/gookit/color v1.5.4 // indirect
+	github.com/gopherjs/gopherjs v1.17.2 // indirect
 	github.com/grpc-ecosystem/grpc-gateway v1.16.0 // indirect
+	github.com/hamba/avro/v2 v2.30.0 // indirect
 	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
 	github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 // indirect
 	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
 	github.com/hashicorp/go-sockaddr v1.0.7 // indirect
 	github.com/hashicorp/hcl v1.0.1-vault-7 // indirect
+	github.com/iceber/iouring-go v0.0.0-20230403020409-002cfd2e2a90 // indirect
+	github.com/internxt/rclone-adapter v0.0.0-20260213125353-6f59c89fcb7c // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
 	github.com/jaegertracing/jaeger v1.47.0 // indirect
+	github.com/jhump/protoreflect/v2 v2.0.0-beta.1 // indirect
+	github.com/jtolds/gls v4.20.0+incompatible // indirect
+	github.com/klauspost/asmfmt v1.3.2 // indirect
 	github.com/kr/pretty v0.3.1 // indirect
 	github.com/kr/text v0.2.0 // indirect
+	github.com/lib/pq v1.11.1 // indirect
+	github.com/lithammer/fuzzysearch v1.1.8 // indirect
 	github.com/lithammer/shortuuid/v3 v3.0.7 // indirect
+	github.com/magiconair/properties v1.8.10 // indirect
+	github.com/minio/asm2plan9s v0.0.0-20200509001527-cdd76441f9d8 // indirect
+	github.com/minio/c2goasm v0.0.0-20190812172519-36a3d3bbc4f3 // indirect
+	github.com/moby/docker-image-spec v1.3.1 // indirect
+	github.com/moby/go-archive v0.1.0 // indirect
+	github.com/moby/patternmatcher v0.6.0 // indirect
+	github.com/moby/sys/sequential v0.6.0 // indirect
+	github.com/moby/sys/user v0.4.0 // indirect
+	github.com/moby/sys/userns v0.1.0 // indirect
+	github.com/moby/term v0.5.2 // indirect
+	github.com/morikuni/aec v1.0.0 // indirect
+	github.com/opencontainers/go-digest v1.0.0 // indirect
+	github.com/opencontainers/image-spec v1.1.1 // indirect
 	github.com/openzipkin/zipkin-go v0.4.3 // indirect
 	github.com/parquet-go/bitpack v1.0.0 // indirect
 	github.com/parquet-go/jsonlite v1.0.0 // indirect
-	github.com/petermattis/goid v0.0.0-20180202154549-b0b1615b78e5 // indirect
+	github.com/pawelgaczynski/giouring v0.0.0-20230826085535-69588b89acb9 // indirect
+	github.com/petermattis/goid v0.0.0-20260113132338-7c7de50cc741 // indirect
 	github.com/pierrre/geohash v1.0.0 // indirect
-	github.com/quic-go/qpack v0.6.0 // indirect
+	github.com/pquerna/otp v1.5.0 // indirect
+	github.com/pterm/pterm v0.12.81 // indirect
 	github.com/quic-go/quic-go v0.57.0 // indirect
+	github.com/rclone/Proton-API-Bridge v1.0.1-0.20260127174007-77f974840d11 // indirect
+	github.com/rclone/go-proton-api v1.0.1-0.20260127173028-eb465cac3b18 // indirect
 	github.com/rogpeppe/go-internal v1.14.1 // indirect
 	github.com/ryanuber/go-glob v1.0.0 // indirect
 	github.com/sasha-s/go-deadlock v0.3.1 // indirect
+	github.com/smarty/assertions v1.15.0 // indirect
 	github.com/stretchr/objx v0.5.2 // indirect
-	github.com/twpayne/go-geom v1.4.1 // indirect
-	github.com/twpayne/go-kml v1.5.2 // indirect
-	github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f // indirect
+	github.com/substrait-io/substrait v0.69.0 // indirect
+	github.com/substrait-io/substrait-go/v4 v4.4.0 // indirect
+	github.com/substrait-io/substrait-protobuf/go v0.71.0 // indirect
+	github.com/twpayne/go-geom v1.6.1 // indirect
+	github.com/twpayne/go-kml/v3 v3.2.1 // indirect
+	github.com/tyler-smith/go-bip39 v1.1.0 // indirect
+	github.com/ulikunitz/xz v0.5.15 // indirect
+	github.com/wk8/go-ordered-map/v2 v2.1.8 // indirect
+	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
+	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	github.com/zeebo/xxh3 v1.0.2 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0 // indirect
 	go.opentelemetry.io/otel/exporters/zipkin v1.36.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.7.0 // indirect
-	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	go.uber.org/mock v0.5.2 // indirect
+	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/mod v0.30.0 // indirect
+	golang.org/x/mod v0.32.0 // indirect
+	golang.org/x/telemetry v0.0.0-20260109210033-bd525da824e2 // indirect
 	gonum.org/v1/gonum v0.16.0 // indirect
 )

@@ -230,20 +299,20 @@ require (
 	cloud.google.com/go/auth v0.17.0 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
 	cloud.google.com/go/compute/metadata v0.9.0 // indirect
-	cloud.google.com/go/iam v1.5.2 // indirect
+	cloud.google.com/go/iam v1.5.3 // indirect
 	cloud.google.com/go/monitoring v1.24.2 // indirect
-	filippo.io/edwards25519 v1.1.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0
+	filippo.io/edwards25519 v1.1.1 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0
 	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1
 	github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.3
-	github.com/Azure/azure-sdk-for-go/sdk/storage/azfile v1.5.2 // indirect
-	github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.4
+	github.com/Azure/azure-sdk-for-go/sdk/storage/azfile v1.5.3 // indirect
+	github.com/Azure/go-ntlmssp v0.1.0 // indirect
 	github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 // indirect
-	github.com/Files-com/files-sdk-go/v3 v3.2.218 // indirect
+	github.com/Files-com/files-sdk-go/v3 v3.2.264 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.30.0 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.53.0 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.53.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.54.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.54.0 // indirect
 	github.com/IBM/go-sdk-core/v5 v5.21.0 // indirect
 	github.com/Max-Sum/base32768 v0.0.0-20230304063302-18e6ce5945fd // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
@@ -259,37 +328,33 @@ require (
 	github.com/andybalholm/cascadia v1.3.3 // indirect
 	github.com/appscode/go-querystring v0.0.0-20170504095604-0126cfb3f1dc // indirect
 	github.com/arangodb/go-velocypack v0.0.0-20200318135517-5af53c29c67e // indirect
-	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.4 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.16 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.20.3 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.16 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.16 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.17 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.20.4 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.17 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.17 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.16 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.7 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.16 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.17 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.16 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sns v1.34.7 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sqs v1.38.8 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.30.8 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.12 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.41.5 // indirect
-	github.com/aws/smithy-go v1.24.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.30.9 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.13 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.41.6 // indirect
+	github.com/aws/smithy-go v1.24.0
 	github.com/boltdb/bolt v1.3.1 // indirect
 	github.com/bradenaw/juniper v0.15.3 // indirect
 	github.com/bradfitz/iter v0.0.0-20191230175014-e8f45d346db8 // indirect
 	github.com/buengese/sgzip v0.1.1 // indirect
-	github.com/bytedance/sonic v1.14.0 // indirect
-	github.com/bytedance/sonic/loader v0.3.0 // indirect
 	github.com/calebcase/tmpfile v1.0.3 // indirect
 	github.com/chilts/sid v0.0.0-20190607042430-660e94789ec9 // indirect
-	github.com/cloudflare/circl v1.6.1 // indirect
-	github.com/cloudinary/cloudinary-go/v2 v2.12.0 // indirect
+	github.com/cloudflare/circl v1.6.3 // indirect
+	github.com/cloudinary/cloudinary-go/v2 v2.13.0 // indirect
 	github.com/cloudsoda/go-smb2 v0.0.0-20250228001242-d4c70e6251cc // indirect
 	github.com/cloudsoda/sddl v0.0.0-20250224235906-926454e91efc // indirect
-	github.com/cloudwego/base64x v0.1.6 // indirect
 	github.com/cncf/xds/go v0.0.0-20251022180443-0feb69152e9f // indirect
 	github.com/colinmarc/hdfs/v2 v2.4.0 // indirect
 	github.com/creasty/defaults v1.8.0 // indirect
@@ -307,34 +372,32 @@ require (
 	github.com/fatih/color v1.18.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/flynn/noise v1.1.0 // indirect
-	github.com/gabriel-vasile/mimetype v1.4.9 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.11 // indirect
 	github.com/geoffgarside/ber v1.2.0 // indirect
-	github.com/gin-contrib/sse v1.1.0 // indirect
-	github.com/go-chi/chi/v5 v5.2.2 // indirect
+	github.com/go-chi/chi/v5 v5.2.5 // indirect
 	github.com/go-darwin/apfs v0.0.0-20211011131704-f84b94dbf348 // indirect
 	github.com/go-jose/go-jose/v4 v4.1.3 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-ole/go-ole v1.3.0 // indirect
-	github.com/go-openapi/errors v0.22.2 // indirect
-	github.com/go-openapi/strfmt v0.23.0 // indirect
+	github.com/go-openapi/errors v0.22.4 // indirect
+	github.com/go-openapi/strfmt v0.25.0 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
 	github.com/go-playground/universal-translator v0.18.1 // indirect
-	github.com/go-playground/validator/v10 v10.27.0 // indirect
+	github.com/go-playground/validator/v10 v10.28.0 // indirect
 	github.com/go-resty/resty/v2 v2.16.5 // indirect
 	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
 	github.com/goccy/go-json v0.10.5 // indirect
-	github.com/gofrs/flock v0.12.1 // indirect
+	github.com/gofrs/flock v0.13.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.7 // indirect
-	github.com/gorilla/context v1.1.2 // indirect
 	github.com/gorilla/schema v1.4.1 // indirect
 	github.com/gorilla/securecookie v1.1.2 // indirect
-	github.com/gorilla/sessions v1.4.0 // indirect
+	github.com/gorilla/sessions v1.4.0
 	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.3 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-hclog v1.6.3 // indirect
 	github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
@@ -342,8 +405,6 @@ require (
 	github.com/hashicorp/go-msgpack/v2 v2.1.2 // indirect
 	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
 	github.com/hashicorp/golang-lru v0.6.0 // indirect
-	github.com/henrybear327/Proton-API-Bridge v1.0.0 // indirect
-	github.com/henrybear327/go-proton-api v1.0.0 // indirect
 	github.com/jcmturner/aescts/v2 v2.0.0 // indirect
 	github.com/jcmturner/dnsutils/v2 v2.0.0 // indirect
 	github.com/jcmturner/goidentity/v6 v6.0.1 // indirect
@@ -359,33 +420,33 @@ require (
 	github.com/koofr/go-koofrclient v0.0.0-20221207135200-cbd7fc9ad6a6 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/kylelemons/godebug v1.1.0 // indirect
-	github.com/lanrat/extsort v1.4.0 // indirect
+	github.com/lanrat/extsort v1.4.2 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
 	github.com/lpar/date v1.0.0 // indirect
-	github.com/lufia/plan9stats v0.0.0-20250317134145-8bc96cf8fc35 // indirect
+	github.com/lufia/plan9stats v0.0.0-20251013123823-9fd1530e3ec3 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-runewidth v0.0.16 // indirect
+	github.com/mattn/go-runewidth v0.0.19 // indirect
 	github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
-	github.com/mitchellh/mapstructure v1.5.1-0.20220423185008-bf980b35cac4 // indirect
+	github.com/mitchellh/mapstructure v1.5.1-0.20220423185008-bf980b35cac4
 	github.com/montanaflynn/stats v0.7.1 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/nats-io/nats.go v1.43.0 // indirect
 	github.com/nats-io/nkeys v0.4.11 // indirect
 	github.com/nats-io/nuid v1.0.1 // indirect
-	github.com/ncruces/go-strftime v0.1.9 // indirect
-	github.com/ncw/swift/v2 v2.0.4 // indirect
+	github.com/ncruces/go-strftime v1.0.0 // indirect
+	github.com/ncw/swift/v2 v2.0.5 // indirect
 	github.com/nxadm/tail v1.4.11 // indirect
 	github.com/oklog/ulid v1.3.1 // indirect
 	github.com/onsi/ginkgo/v2 v2.23.3 // indirect
 	github.com/opentracing/opentracing-go v1.2.0 // indirect
-	github.com/oracle/oci-go-sdk/v65 v65.98.0 // indirect
+	github.com/oracle/oci-go-sdk/v65 v65.104.0 // indirect
 	github.com/panjf2000/ants/v2 v2.11.3 // indirect
 	github.com/patrickmn/go-cache v2.1.0+incompatible // indirect
 	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/pengsrc/go-shared v0.2.1-0.20190131101655-1999055a4a14 // indirect
 	github.com/philhofer/fwd v1.2.0 // indirect
-	github.com/pierrec/lz4/v4 v4.1.22
+	github.com/pierrec/lz4/v4 v4.1.25
 	github.com/pingcap/errors v0.11.5-0.20211224045212-9687c2b0f87c // indirect
 	github.com/pingcap/failpoint v0.0.0-20220801062533-2eaa32854a6c // indirect
 	github.com/pingcap/kvproto v0.0.0-20230403051650-e166ae588106 // indirect
@@ -395,31 +456,28 @@ require (
 	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
 	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
 	github.com/putdotio/go-putio/putio v0.0.0-20200123120452-16d982cac2b8 // indirect
-	github.com/relvacode/iso8601 v1.6.0 // indirect
+	github.com/relvacode/iso8601 v1.7.0 // indirect
 	github.com/rfjakob/eme v1.1.2 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06 // indirect
 	github.com/sagikazarmark/locafero v0.11.0 // indirect
-	github.com/samber/lo v1.51.0 // indirect
-	github.com/seaweedfs/cockroachdb-parser v0.0.0-20251021184156-909763b17138
+	github.com/samber/lo v1.52.0 // indirect
+	github.com/seaweedfs/cockroachdb-parser v0.0.0-20260225204133-2f342c5ea564
 	github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 // indirect
-	github.com/smartystreets/goconvey v1.8.1 // indirect
 	github.com/sony/gobreaker v1.0.0 // indirect
 	github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect
-	github.com/spacemonkeygo/monkit/v3 v3.0.24 // indirect
+	github.com/spacemonkeygo/monkit/v3 v3.0.25-0.20251022131615-eb24eb109368 // indirect
 	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/spiffe/go-spiffe/v2 v2.6.0 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
-	github.com/t3rm1n4l/go-mega v0.0.0-20250926104142-ccb8d3498e6c // indirect
+	github.com/t3rm1n4l/go-mega v0.0.0-20251031123324-a804aaa87491 // indirect
 	github.com/tarantool/go-iproto v1.1.0 // indirect
 	github.com/tiancaiamao/gp v0.0.0-20221230034425-4025bc8a4d4a // indirect
 	github.com/tikv/pd/client v0.0.0-20230329114254-1948c247c2b1 // indirect
-	github.com/tinylib/msgp v1.3.0 // indirect
+	github.com/tinylib/msgp v1.5.0 // indirect
 	github.com/tklauser/go-sysconf v0.3.16 // indirect
 	github.com/tklauser/numcpus v0.11.0 // indirect
-	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
-	github.com/twmb/murmur3 v1.1.3 // indirect
-	github.com/ugorji/go/codec v1.3.0 // indirect
+	github.com/twmb/murmur3 v1.1.8 // indirect
 	github.com/unknwon/goconfig v1.0.0 // indirect
 	github.com/vmihailenco/msgpack/v5 v5.4.1 // indirect
 	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
@@ -432,32 +490,31 @@ require (
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
 	github.com/zeebo/blake3 v0.2.4 // indirect
 	github.com/zeebo/errs v1.4.0 // indirect
-	go.etcd.io/bbolt v1.4.2 // indirect
-	go.etcd.io/etcd/api/v3 v3.6.6 // indirect
+	go.etcd.io/bbolt v1.4.3 // indirect
+	go.etcd.io/etcd/api/v3 v3.6.7 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/contrib/detectors/gcp v1.38.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.62.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.62.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 // indirect
 	go.opentelemetry.io/otel v1.38.0 // indirect
 	go.opentelemetry.io/otel/metric v1.38.0 // indirect
 	go.opentelemetry.io/otel/sdk v1.38.0 // indirect
 	go.opentelemetry.io/otel/sdk/metric v1.38.0 // indirect
 	go.opentelemetry.io/otel/trace v1.38.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	go.uber.org/zap v1.27.0 // indirect
-	golang.org/x/arch v0.20.0 // indirect
-	golang.org/x/term v0.38.0 // indirect
+	go.uber.org/zap v1.27.1 // indirect
+	golang.org/x/term v0.40.0 // indirect
 	golang.org/x/time v0.14.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20251022142026-3a174f9686a8 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20251124214823-79d6a2a48846 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20251213004720-97cd9d5aeac2 // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
 	gopkg.in/validator.v2 v2.0.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	modernc.org/libc v1.66.10 // indirect
+	modernc.org/libc v1.67.6 // indirect
 	moul.io/http2curl/v2 v2.3.0 // indirect
 	sigs.k8s.io/yaml v1.6.0 // indirect
-	storj.io/common v0.0.0-20250808122759-804533d519c1 // indirect
+	storj.io/common v0.0.0-20251107171817-6221ae45072c // indirect
 	storj.io/drpc v0.0.35-0.20250513201419-f7819ea69b55 // indirect
 	storj.io/eventkit v0.0.0-20250410172343-61f26d3de156 // indirect
 	storj.io/infectious v0.0.2 // indirect
@@ -466,3 +523,14 @@ require (
 )

 // replace github.com/seaweedfs/raft => /Users/chrislu/go/src/github.com/seaweedfs/raft
+
+// V2 engine bridge modules (Phase 07)
+require (
+	github.com/seaweedfs/seaweedfs/sw-block/engine/replication v0.0.0
+	github.com/seaweedfs/seaweedfs/sw-block/bridge/blockvol v0.0.0
+)
+
+replace (
+	github.com/seaweedfs/seaweedfs/sw-block/engine/replication => ./sw-block/engine/replication
+	github.com/seaweedfs/seaweedfs/sw-block/bridge/blockvol => ./sw-block/bridge/blockvol
+)
@@ -1,6 +1,6 @@
 apiVersion: v1
 description: SeaweedFS
 name: seaweedfs
-appVersion: "4.06"
+appVersion: "4.13"
 # Dev note: Trigger a helm chart release by `git tag -a helm-<version>`
-version: 4.0.406
+version: 4.0.413
@@ -1,6 +1,5 @@
 # SEAWEEDFS - helm chart (2.x+)

-## Getting Started

 ### Add the helm repo

@@ -24,7 +23,7 @@ helm install --values=values.yaml seaweedfs seaweedfs/seaweedfs
 * master/filer/volume are stateful sets with anti-affinity on the hostname,
 so your deployment will be spread/HA.
 * chart is using memsql(mysql) as the filer backend to enable HA (multiple filer instances) and backup/HA memsql can provide.
-* mysql user/password are created in a k8s secret (secret-seaweedfs-db.yaml) and injected to the filer with ENV.
+* mysql user/password are created in a k8s secret (default: `<release>-seaweedfs-db-secret`) and injected to the filer with ENV.
 * cert config exists and can be enabled, but not been tested, requires cert-manager to be installed.

 ## Prerequisites
@@ -35,7 +34,9 @@ leveldb is the default database, this supports multiple filer replicas that will
 When the [limitations](https://github.com/seaweedfs/seaweedfs/wiki/Filer-Store-Replication#limitation) apply, or for a large number of filer replicas, an external datastore is recommended.

 Such as MySQL-compatible database, as specified in the `values.yaml` at `filer.extraEnvironmentVars`.
-This database should be pre-configured and initialized by running:
+This database should be pre-configured and initialized. If using the default `db-init-config`, the configmap name is now dynamic (e.g., `<release>-seaweedfs-db-init-config`). You can override this name via `filer.dbInitConfigName`.
+
+To initialize manually:
 ```sql
 CREATE TABLE IF NOT EXISTS `filemeta` (
  `dirhash`   BIGINT NOT NULL       COMMENT 'first 64 bits of MD5 hash value of directory field',
@@ -211,8 +212,9 @@ To enable workers, add the following to your values.yaml:
 worker:
  enabled: true
  replicas: 2  # Scale based on workload
-  capabilities: "vacuum,balance,erasure_coding"  # Tasks this worker can handle
-  maxConcurrent: 3  # Maximum concurrent tasks per worker
+  jobType: "vacuum,volume_balance,erasure_coding"  # Job types this worker can handle
+  maxDetect: 1  # Maximum concurrent detection requests
+  maxExecute: 4  # Maximum concurrent execution jobs per worker
  
  # Working directory for task execution
  # Default: "/tmp/seaweedfs-worker"
@@ -247,14 +249,14 @@ worker:
      memory: "2Gi"
 ```

-### Worker Capabilities
+### Worker Job Types

-Workers can be configured with different capabilities:
+Workers can be configured with different job types:
 - **vacuum**: Reclaim deleted file space
- **balance**: Balance volumes across volume servers
+- **volume_balance**: Balance volumes across volume servers
 - **erasure_coding**: Handle erasure coding operations

-You can configure workers with all capabilities or create specialized worker pools with specific capabilities.
+You can configure workers with all job types or create specialized worker pools with specific job types.

 ### Worker Deployment Strategy

@@ -263,11 +265,11 @@ For production deployments, consider:
 1. **Multiple Workers**: Deploy 2+ worker replicas for high availability
 2. **Resource Allocation**: Workers need sufficient CPU/memory for maintenance tasks
 3. **Storage**: Workers need temporary storage for vacuum and balance operations (size depends on volume size)
-4. **Specialized Workers**: Create separate worker deployments for different capabilities if needed
+4. **Specialized Workers**: Create separate worker deployments for different job types if needed

 Example specialized worker configuration:

-For specialized worker pools, deploy separate Helm releases with different capabilities:
+For specialized worker pools, deploy separate Helm releases with different job types:

 **values-worker-vacuum.yaml** (for vacuum operations):
 ```yaml
@@ -286,8 +288,8 @@ admin:
 worker:
  enabled: true
  replicas: 2
-  capabilities: "vacuum"
-  maxConcurrent: 2
+  jobType: "vacuum"
+  maxExecute: 2
  # REQUIRED: Point to the admin service of your main SeaweedFS release
  # Replace <namespace> with the namespace where your main seaweedfs is deployed
  # Example: If deploying in namespace "production":
@@ -312,8 +314,8 @@ admin:
 worker:
  enabled: true
  replicas: 1
-  capabilities: "balance"
-  maxConcurrent: 1
+  jobType: "volume_balance"
+  maxExecute: 1
  # REQUIRED: Point to the admin service of your main SeaweedFS release
  # Replace <namespace> with the namespace where your main seaweedfs is deployed
  # Example: If deploying in namespace "production":
@@ -322,6 +324,7 @@ worker:
 ```

 Deploy the specialized workers as separate releases:
+### Specialized Worker Deployment
 ```bash
 # Deploy vacuum workers
 helm install seaweedfs-worker-vacuum seaweedfs/seaweedfs -f values-worker-vacuum.yaml
@@ -330,6 +333,22 @@ helm install seaweedfs-worker-vacuum seaweedfs/seaweedfs -f values-worker-vacuum
 helm install seaweedfs-worker-balance seaweedfs/seaweedfs -f values-worker-balance.yaml
 ```

+## OpenShift Support
+
+SeaweedFS can be deployed on OpenShift or any cluster enforcing the Kubernetes "restricted" Pod Security Standard. By default, OpenShift blocks containers that run as root or use `hostPath` volumes.
+
+To deploy on OpenShift, use the provided `openshift-values.yaml` which overrides the default configuration to:
+1. Use `PersistentVolumeClaims` instead of `hostPath`.
+2. Enable `runAsNonRoot` and omit hardcoded UIDs to allow OpenShift to assign valid UIDs automatically.
+3. Apply appropriate `seccompProfile` and drop capabilities.
+
+Usage:
+```bash
+helm install seaweedfs seaweedfs/seaweedfs \
+  -n seaweedfs --create-namespace \
+  -f openshift-values.yaml
+```
+
 ## Enterprise

 For enterprise users, please visit [seaweedfs.com](https://seaweedfs.com) for the SeaweedFS Enterprise Edition, 
@@ -0,0 +1,116 @@
+# openshift-values.yaml
+#
+# Example overrides for deploying SeaweedFS on OpenShift (or any cluster
+# enforcing the Kubernetes "restricted" Pod Security Standard).
+#
+# OpenShift's default "restricted" SCC blocks containers that:
+#   - Run as UID 0 (root)
+#   - Request privilege escalation
+#   - Use hostPath volumes
+#   - Omit a seccompProfile
+#
+# These overrides satisfy all four requirements by:
+#   1. Replacing hostPath volumes with PersistentVolumeClaims (or emptyDir for logs)
+#   2. Enabling runAsNonRoot: true. By omitting runAsUser, OpenShift will
+#      automatically assign a valid UID from the namespace's allocated range.
+#   3. Dropping all Linux capabilities and setting allowPrivilegeEscalation: false
+#   4. Enabling RuntimeDefault seccompProfile
+#
+# Usage:
+#   helm install seaweedfs seaweedfs/seaweedfs \
+#     -n seaweedfs --create-namespace \
+#     -f openshift-values.yaml
+#
+# Adjust storageClass and sizes to match your cluster's available StorageClasses.
+# On OpenShift you can discover them with: oc get storageclass
+
+master:
+  data:
+    type: "persistentVolumeClaim"
+    size: "10Gi"
+    storageClass: ""        # leave empty to use the cluster default StorageClass
+
+  logs:
+    type: "emptyDir"        # avoids hostPath; use persistentVolumeClaim if you need log persistence
+
+  podSecurityContext:
+    enabled: true
+    # On OpenShift, we omit runAsUser/runAsGroup/fsGroup to let the admission
+    # controller assign them automatically based on the namespace's SCC.
+    runAsNonRoot: true
+
+  containerSecurityContext:
+    enabled: true
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop: ["ALL"]
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+
+volume:
+  dataDirs:
+    - name: data1
+      type: "persistentVolumeClaim"
+      size: "100Gi"
+      storageClass: ""      # leave empty to use the cluster default StorageClass
+      maxVolumes: 0
+
+  logs:
+    type: "emptyDir"
+
+  podSecurityContext:
+    enabled: true
+    # On OpenShift, we omit runAsUser/runAsGroup/fsGroup to let the admission
+    # controller assign them automatically based on the namespace's SCC.
+    runAsNonRoot: true
+
+  containerSecurityContext:
+    enabled: true
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop: ["ALL"]
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+
+filer:
+  data:
+    type: "persistentVolumeClaim"
+    size: "25Gi"
+    storageClass: ""        # leave empty to use the cluster default StorageClass
+
+  logs:
+    type: "emptyDir"
+
+  podSecurityContext:
+    enabled: true
+    # On OpenShift, we omit runAsUser/runAsGroup/fsGroup to let the admission
+    # controller assign them automatically based on the namespace's SCC.
+    runAsNonRoot: true
+
+  containerSecurityContext:
+    enabled: true
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop: ["ALL"]
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+
+# S3 gateway (if enabled)
+s3:
+  podSecurityContext:
+    enabled: true
+    # On OpenShift, we omit runAsUser/runAsGroup/fsGroup to let the admission
+    # controller assign them automatically based on the namespace's SCC.
+    runAsNonRoot: true
+
+  containerSecurityContext:
+    enabled: true
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop: ["ALL"]
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
@@ -8,7 +8,7 @@ apiVersion: extensions/v1beta1
 {{- end }}
 kind: Ingress
 metadata:
-  name: ingress-{{ template "seaweedfs.name" . }}-admin
+  name: ingress-{{ include "seaweedfs.fullname" . }}-admin
  namespace: {{ .Release.Namespace }}
  annotations:
  {{- if and (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) .Values.admin.ingress.className }}
@@ -42,11 +42,11 @@ spec:
        backend:
 {{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion }}
          service:
-            name: {{ template "seaweedfs.name" . }}-admin
+            name: {{ include "seaweedfs.componentName" (list . "admin") }}
            port:
              number: {{ .Values.admin.port }}
 {{- else }}
-          serviceName: {{ template "seaweedfs.name" . }}-admin
+          serviceName: {{ include "seaweedfs.componentName" (list . "admin") }}
          servicePort: {{ .Values.admin.port }}
 {{- end }}
 {{- end }}
@@ -3,7 +3,7 @@ apiVersion: v1
 kind: Secret
 type: Opaque
 metadata:
-  name: {{ template "seaweedfs.name" . }}-admin-secret
+  name: {{ include "seaweedfs.fullname" . }}-admin-secret
  namespace: {{ .Release.Namespace }}
  annotations:
    "helm.sh/resource-policy": keep
@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ template "seaweedfs.name" . }}-admin
+  name: {{ include "seaweedfs.componentName" (list . "admin") }}
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -3,7 +3,7 @@
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
-  name: {{ template "seaweedfs.name" . }}-admin
+  name: {{ include "seaweedfs.fullname" . }}-admin
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -26,6 +26,7 @@ spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
      app.kubernetes.io/component: admin
 {{- end }}
 {{- end }}
@@ -1,11 +1,14 @@
 {{- if .Values.admin.enabled }}
+{{- if gt (.Values.admin.replicas | int) 1 }}
+{{- fail "admin.replicas must be 0 or 1" -}}
+{{- end }}
 {{- if and (not .Values.admin.masters) (not .Values.global.masterServer) (not .Values.master.enabled) }}
 {{- fail "admin.masters or global.masterServer must be set if master.enabled is false" -}}
 {{- end }}
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
-  name: {{ template "seaweedfs.name" . }}-admin
+  name: {{ include "seaweedfs.componentName" (list . "admin") }}
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -18,7 +21,7 @@ metadata:
    {{- toYaml .Values.admin.annotations | nindent 4 }}
 {{- end }}
 spec:
-  serviceName: {{ template "seaweedfs.name" . }}-admin
+  serviceName: {{ include "seaweedfs.componentName" (list . "admin") }}
  podManagementPolicy: {{ .Values.admin.podManagementPolicy }}
  replicas: {{ .Values.admin.replicas }}
  selector:
@@ -87,7 +90,7 @@ spec:
          {{- if and .Values.admin.secret.existingSecret (not .Values.admin.secret.pwKey) -}}
          {{-   fail "admin.secret.pwKey must be set when admin.secret.existingSecret is provided" -}}
          {{- end -}}
-          {{- $adminSecretName := .Values.admin.secret.existingSecret | default (printf "%s-admin-secret" (include "seaweedfs.name" .)) }}
+          {{- $adminSecretName := .Values.admin.secret.existingSecret | default (printf "%s-admin-secret" (include "seaweedfs.fullname" .)) }}
          env:
            {{- if $adminAuthEnabled }}
            - name: SEAWEEDFS_ADMIN_USER
@@ -114,7 +117,7 @@ spec:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: SEAWEEDFS_FULLNAME
-              value: "{{ template "seaweedfs.name" . }}"
+              value: "{{ include "seaweedfs.fullname" . }}"
            {{- if .Values.admin.extraEnvironmentVars }}
            {{- range $key, $value := .Values.admin.extraEnvironmentVars }}
            - name: {{ $key }}
@@ -281,25 +284,25 @@ spec:
        {{- if .Values.global.enableSecurity }}
        - name: security-config
          configMap:
-            name: {{ template "seaweedfs.name" . }}-security-config
+            name: {{ include "seaweedfs.fullname" . }}-security-config
        - name: ca-cert
          secret:
-            secretName: {{ template "seaweedfs.name" . }}-ca-cert
+            secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
        - name: master-cert
          secret:
-            secretName: {{ template "seaweedfs.name" . }}-master-cert
+            secretName: {{ include "seaweedfs.fullname" . }}-master-cert
        - name: volume-cert
          secret:
-            secretName: {{ template "seaweedfs.name" . }}-volume-cert
+            secretName: {{ include "seaweedfs.fullname" . }}-volume-cert
        - name: filer-cert
          secret:
-            secretName: {{ template "seaweedfs.name" . }}-filer-cert
+            secretName: {{ include "seaweedfs.fullname" . }}-filer-cert
        - name: client-cert
          secret:
-            secretName: {{ template "seaweedfs.name" . }}-client-cert
+            secretName: {{ include "seaweedfs.fullname" . }}-client-cert
        - name: admin-cert
          secret:
-            secretName: {{ template "seaweedfs.name" . }}-admin-cert
+            secretName: {{ include "seaweedfs.fullname" . }}-admin-cert
        {{- end }}
        {{ tpl .Values.admin.extraVolumes . | indent 8 | trim }}
      {{- if .Values.admin.nodeSelector }}
@@ -2,7 +2,7 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ template "seaweedfs.name" . }}-all-in-one
+  name: {{ include "seaweedfs.fullname" . }}-all-in-one
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -98,7 +98,7 @@ spec:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: SEAWEEDFS_FULLNAME
-              value: "{{ template "seaweedfs.name" . }}"
+              value: "{{ include "seaweedfs.fullname" . }}"
            {{- if .Values.allInOne.extraEnvironmentVars }}
            {{- range $key, $value := .Values.allInOne.extraEnvironmentVars }}
            {{- if and (ne $key $clusterMasterKey) (ne $key $clusterFilerKey) }}
@@ -421,7 +421,7 @@ spec:
            type: DirectoryOrCreate
          {{- else if eq .Values.allInOne.data.type "persistentVolumeClaim" }}
          persistentVolumeClaim:
-            claimName: {{ template "seaweedfs.name" . }}-all-in-one-data
+            claimName: {{ include "seaweedfs.fullname" . }}-all-in-one-data
          {{- else if eq .Values.allInOne.data.type "existingClaim" }}
          persistentVolumeClaim:
            claimName: {{ .Values.allInOne.data.claimName }}
@@ -432,47 +432,47 @@ spec:
        - name: config-s3-users
          secret:
            defaultMode: 420
-            secretName: {{ default (printf "%s-s3-secret" (include "seaweedfs.name" .)) (or .Values.allInOne.s3.existingConfigSecret .Values.s3.existingConfigSecret .Values.filer.s3.existingConfigSecret) }}
+            secretName: {{ default (printf "%s-s3-secret" (include "seaweedfs.fullname" .)) (or .Values.allInOne.s3.existingConfigSecret .Values.s3.existingConfigSecret .Values.filer.s3.existingConfigSecret) }}
        {{- end }}
        {{- if .Values.allInOne.sftp.enabled }}
        - name: config-ssh
          secret:
            defaultMode: 420
-            secretName: {{ default (printf "%s-sftp-ssh-secret" (include "seaweedfs.name" .)) (or .Values.allInOne.sftp.existingSshConfigSecret .Values.sftp.existingSshConfigSecret) }}
+            secretName: {{ default (printf "%s-sftp-ssh-secret" (include "seaweedfs.fullname" .)) (or .Values.allInOne.sftp.existingSshConfigSecret .Values.sftp.existingSshConfigSecret) }}
        {{- if or .Values.allInOne.sftp.enableAuth .Values.sftp.enableAuth }}
        - name: config-users
          secret:
            defaultMode: 420
-            secretName: {{ default (printf "%s-sftp-secret" (include "seaweedfs.name" .)) (or .Values.allInOne.sftp.existingConfigSecret .Values.sftp.existingConfigSecret) }}
+            secretName: {{ default (printf "%s-sftp-secret" (include "seaweedfs.fullname" .)) (or .Values.allInOne.sftp.existingConfigSecret .Values.sftp.existingConfigSecret) }}
        {{- end }}
        {{- end }}
        {{- if .Values.filer.notificationConfig }}
        - name: notification-config
          configMap:
-            name: {{ template "seaweedfs.name" . }}-notification-config
+            name: {{ include "seaweedfs.fullname" . }}-notification-config
        {{- end }}
        - name: master-config
          configMap:
-            name: {{ template "seaweedfs.name" . }}-master-config
+            name: {{ include "seaweedfs.fullname" . }}-master-config
        {{- if .Values.global.enableSecurity }}
        - name: security-config
          configMap:
-            name: {{ template "seaweedfs.name" . }}-security-config
+            name: {{ include "seaweedfs.fullname" . }}-security-config
        - name: ca-cert
          secret:
-            secretName: {{ template "seaweedfs.name" . }}-ca-cert
+            secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
        - name: master-cert
          secret:
-            secretName: {{ template "seaweedfs.name" . }}-master-cert
+            secretName: {{ include "seaweedfs.fullname" . }}-master-cert
        - name: volume-cert
          secret:
-            secretName: {{ template "seaweedfs.name" . }}-volume-cert
+            secretName: {{ include "seaweedfs.fullname" . }}-volume-cert
        - name: filer-cert
          secret:
-            secretName: {{ template "seaweedfs.name" . }}-filer-cert
+            secretName: {{ include "seaweedfs.fullname" . }}-filer-cert
        - name: client-cert
          secret:
-            secretName: {{ template "seaweedfs.name" . }}-client-cert
+            secretName: {{ include "seaweedfs.fullname" . }}-client-cert
        {{- end }}
        {{ tpl .Values.allInOne.extraVolumes . | nindent 8 }}
      {{- if .Values.allInOne.nodeSelector }}
@@ -3,7 +3,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: {{ template "seaweedfs.name" . }}-all-in-one-data
+  name: {{ include "seaweedfs.fullname" . }}-all-in-one-data
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ template "seaweedfs.name" . }}-all-in-one
+  name: {{ printf "%s-all-in-one" (include "seaweedfs.fullname" .) | trunc 63 | trimSuffix "-" }}
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -81,5 +81,6 @@ spec:
  
  selector:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: seaweedfs-all-in-one
 {{- end }}
@@ -3,7 +3,7 @@
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
-  name: {{ template "seaweedfs.name" . }}-all-in-one
+  name: {{ include "seaweedfs.fullname" . }}-all-in-one
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -24,6 +24,7 @@ spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
      app.kubernetes.io/component: seaweedfs-all-in-one
 {{- end }}
 {{- end }}
@@ -2,7 +2,7 @@
 apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Certificate
 metadata:
-  name: {{ template "seaweedfs.name" . }}-admin-cert
+  name: {{ include "seaweedfs.fullname" . }}-admin-cert
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -15,19 +15,19 @@ metadata:
    {{- toYaml .Values.admin.annotations | nindent 4 }}
  {{- end }}
 spec:
-  secretName: {{ template "seaweedfs.name" . }}-admin-cert
+  secretName: {{ include "seaweedfs.fullname" . }}-admin-cert
  issuerRef:
-    name: {{ template "seaweedfs.name" . }}-ca-issuer
+    name: {{ include "seaweedfs.fullname" . }}-ca-issuer
    kind: Issuer
  commonName: {{ .Values.certificates.commonName }}
  subject:
    organizations:
    - "SeaweedFS CA"
  dnsNames:
-    - '*.{{ template "seaweedfs.name" . }}-admin'
-    - '*.{{ template "seaweedfs.name" . }}-admin.{{ .Release.Namespace }}'
-    - '*.{{ template "seaweedfs.name" . }}-admin.{{ .Release.Namespace }}.svc'
-    - '*.{{ template "seaweedfs.name" . }}-admin.{{ .Release.Namespace }}.svc.cluster.local'
+    - '*.{{ include "seaweedfs.fullname" . }}-admin'
+    - '*.{{ include "seaweedfs.fullname" . }}-admin.{{ .Release.Namespace }}'
+    - '*.{{ include "seaweedfs.fullname" . }}-admin.{{ .Release.Namespace }}.svc'
+    - '*.{{ include "seaweedfs.fullname" . }}-admin.{{ .Release.Namespace }}.svc.cluster.local'
 {{- if .Values.certificates.ipAddresses }}
  ipAddresses:
    {{- range .Values.certificates.ipAddresses }}
@@ -2,7 +2,7 @@
 apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Certificate
 metadata:
-  name: {{ template "seaweedfs.name" . }}-ca-cert
+  name: {{ include "seaweedfs.fullname" . }}-ca-cert
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -10,8 +10,8 @@ metadata:
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
 spec:
-  secretName: {{ template "seaweedfs.name" . }}-ca-cert
-  commonName: "{{ template "seaweedfs.name" . }}-root-ca"
+  secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
+  commonName: "{{ include "seaweedfs.fullname" . }}-root-ca"
  isCA: true
  {{- if .Values.certificates.ca.duration }}
  duration: {{ .Values.certificates.ca.duration }}
@@ -20,6 +20,6 @@ spec:
  renewBefore: {{ .Values.certificates.ca.renewBefore }}
  {{- end }}
  issuerRef:
-    name: {{ template "seaweedfs.name" . }}-issuer
+    name: {{ include "seaweedfs.fullname" . }}-issuer
    kind: Issuer
 {{- end }}
@@ -2,7 +2,7 @@
 apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Issuer
 metadata:
-  name: {{ template "seaweedfs.name" . }}-ca-issuer
+  name: {{ include "seaweedfs.fullname" . }}-ca-issuer
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -11,5 +11,5 @@ metadata:
    app.kubernetes.io/instance: {{ .Release.Name }}
 spec:
  ca:
-    secretName: {{ template "seaweedfs.name" . }}-ca-cert
+    secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
 {{- end }}
@@ -2,7 +2,7 @@
 apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Issuer
 metadata:
-  name: {{ template "seaweedfs.name" . }}-issuer
+  name: {{ include "seaweedfs.fullname" . }}-issuer
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
@@ -2,7 +2,7 @@
 apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Certificate
 metadata:
-  name: {{ template "seaweedfs.name" . }}-client-cert
+  name: {{ include "seaweedfs.fullname" . }}-client-cert
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -10,9 +10,9 @@ metadata:
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
 spec:
-  secretName: {{ template "seaweedfs.name" . }}-client-cert
+  secretName: {{ include "seaweedfs.fullname" . }}-client-cert
  issuerRef:
-    name: {{ template "seaweedfs.name" . }}-ca-issuer
+    name: {{ include "seaweedfs.fullname" . }}-ca-issuer
    kind: Issuer
  commonName: {{ .Values.certificates.commonName }}
  subject:
@@ -22,10 +22,10 @@ spec:
    - '*.{{ .Release.Namespace }}'
    - '*.{{ .Release.Namespace }}.svc'
    - '*.{{ .Release.Namespace }}.svc.cluster.local'
-    - '*.{{ template "seaweedfs.name" . }}-master'
-    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}'
-    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}.svc'
-    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}.svc.cluster.local'
+    - '*.{{ include "seaweedfs.fullname" . }}-master'
+    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}'
+    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc'
+    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc.cluster.local'
 {{- if .Values.certificates.ipAddresses }}
  ipAddresses:
    {{- range .Values.certificates.ipAddresses }}
@@ -2,7 +2,7 @@
 apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Certificate
 metadata:
-  name: {{ template "seaweedfs.name" . }}-filer-cert
+  name: {{ include "seaweedfs.fullname" . }}-filer-cert
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -15,9 +15,9 @@ metadata:
    {{- toYaml .Values.filer.annotations | nindent 4 }}
  {{- end }}
 spec:
-  secretName: {{ template "seaweedfs.name" . }}-filer-cert
+  secretName: {{ include "seaweedfs.fullname" . }}-filer-cert
  issuerRef:
-    name: {{ template "seaweedfs.name" . }}-ca-issuer
+    name: {{ include "seaweedfs.fullname" . }}-ca-issuer
    kind: Issuer
  commonName: {{ .Values.certificates.commonName }}
  subject:
@@ -27,10 +27,10 @@ spec:
    - '*.{{ .Release.Namespace }}'
    - '*.{{ .Release.Namespace }}.svc'
    - '*.{{ .Release.Namespace }}.svc.cluster.local'
-    - '*.{{ template "seaweedfs.name" . }}-master'
-    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}'
-    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}.svc'
-    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}.svc.cluster.local'
+    - '*.{{ include "seaweedfs.fullname" . }}-master'
+    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}'
+    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc'
+    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc.cluster.local'
 {{- if .Values.certificates.ipAddresses }}
  ipAddresses:
    {{- range .Values.certificates.ipAddresses }}
@@ -2,7 +2,7 @@
 apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Certificate
 metadata:
-  name: {{ template "seaweedfs.name" . }}-master-cert
+  name: {{ include "seaweedfs.fullname" . }}-master-cert
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -15,9 +15,9 @@ metadata:
    {{- toYaml .Values.master.annotations | nindent 4 }}
 {{- end }}
 spec:
-  secretName: {{ template "seaweedfs.name" . }}-master-cert
+  secretName: {{ include "seaweedfs.fullname" . }}-master-cert
  issuerRef:
-    name: {{ template "seaweedfs.name" . }}-ca-issuer
+    name: {{ include "seaweedfs.fullname" . }}-ca-issuer
    kind: Issuer
  commonName: {{ .Values.certificates.commonName }}
  subject:
@@ -27,10 +27,10 @@ spec:
    - '*.{{ .Release.Namespace }}'
    - '*.{{ .Release.Namespace }}.svc'
    - '*.{{ .Release.Namespace }}.svc.cluster.local'
-    - '*.{{ template "seaweedfs.name" . }}-master'
-    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}'
-    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}.svc'
-    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}.svc.cluster.local'
+    - '*.{{ include "seaweedfs.fullname" . }}-master'
+    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}'
+    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc'
+    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc.cluster.local'
 {{- if .Values.certificates.ipAddresses }}
  ipAddresses:
    {{- range .Values.certificates.ipAddresses }}
@@ -2,7 +2,7 @@
 apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Certificate
 metadata:
-  name: {{ template "seaweedfs.name" . }}-volume-cert
+  name: {{ include "seaweedfs.fullname" . }}-volume-cert
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -15,9 +15,9 @@ metadata:
    {{- toYaml .Values.volume.annotations | nindent 4 }}
 {{- end }}
 spec:
-  secretName: {{ template "seaweedfs.name" . }}-volume-cert
+  secretName: {{ include "seaweedfs.fullname" . }}-volume-cert
  issuerRef:
-    name: {{ template "seaweedfs.name" . }}-ca-issuer
+    name: {{ include "seaweedfs.fullname" . }}-ca-issuer
    kind: Issuer
  commonName: {{ .Values.certificates.commonName }}
  subject:
@@ -27,10 +27,10 @@ spec:
    - '*.{{ .Release.Namespace }}'
    - '*.{{ .Release.Namespace }}.svc'
    - '*.{{ .Release.Namespace }}.svc.cluster.local'
-    - '*.{{ template "seaweedfs.name" . }}-master'
-    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}'
-    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}.svc'
-    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}.svc.cluster.local'
+    - '*.{{ include "seaweedfs.fullname" . }}-master'
+    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}'
+    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc'
+    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc.cluster.local'
 {{- if .Values.certificates.ipAddresses }}
  ipAddresses:
    {{- range .Values.certificates.ipAddresses }}
@@ -2,7 +2,7 @@
 apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Certificate
 metadata:
-  name: {{ template "seaweedfs.name" . }}-worker-cert
+  name: {{ include "seaweedfs.fullname" . }}-worker-cert
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -15,19 +15,19 @@ metadata:
    {{- toYaml .Values.worker.annotations | nindent 4 }}
  {{- end }}
 spec:
-  secretName: {{ template "seaweedfs.name" . }}-worker-cert
+  secretName: {{ include "seaweedfs.fullname" . }}-worker-cert
  issuerRef:
-    name: {{ template "seaweedfs.name" . }}-ca-issuer
+    name: {{ include "seaweedfs.fullname" . }}-ca-issuer
    kind: Issuer
  commonName: {{ .Values.certificates.commonName }}
  subject:
    organizations:
    - "SeaweedFS CA"
  dnsNames:
-    - '*.{{ template "seaweedfs.name" . }}-worker'
-    - '*.{{ template "seaweedfs.name" . }}-worker.{{ .Release.Namespace }}'
-    - '*.{{ template "seaweedfs.name" . }}-worker.{{ .Release.Namespace }}.svc'
-    - '*.{{ template "seaweedfs.name" . }}-worker.{{ .Release.Namespace }}.svc.cluster.local'
+    - '*.{{ include "seaweedfs.fullname" . }}-worker'
+    - '*.{{ include "seaweedfs.fullname" . }}-worker.{{ .Release.Namespace }}'
+    - '*.{{ include "seaweedfs.fullname" . }}-worker.{{ .Release.Namespace }}.svc'
+    - '*.{{ include "seaweedfs.fullname" . }}-worker.{{ .Release.Namespace }}.svc.cluster.local'
 {{- if .Values.certificates.ipAddresses }}
  ipAddresses:
    {{- range .Values.certificates.ipAddresses }}
@@ -6,6 +6,10 @@ metadata:
  name: {{ .Values.cosi.bucketClassName }}
 driverName: {{ .Values.cosi.driverName }}
 deletionPolicy: Delete
+{{- with .Values.cosi.bucketClassParameters }}
+parameters:
+  {{- toYaml . | nindent 2 }}
+{{- end }}
 ---
 kind: BucketAccessClass
 apiVersion: objectstorage.k8s.io/v1alpha1
@@ -3,7 +3,7 @@
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: {{ .Values.global.serviceAccountName }}-objectstorage-provisioner
+  name: {{ include "seaweedfs.fullname" . }}-objectstorage-provisioner
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
@@ -52,7 +52,7 @@ rules:
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: {{ .Values.global.serviceAccountName }}-objectstorage-provisioner
+  name: {{ include "seaweedfs.fullname" . }}-objectstorage-provisioner
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
@@ -64,6 +64,6 @@ subjects:
    namespace: {{ .Release.Namespace }}
 roleRef:
  kind: ClusterRole
-  name: {{ .Values.global.serviceAccountName }}-objectstorage-provisioner
+  name: {{ include "seaweedfs.fullname" . }}-objectstorage-provisioner
  apiGroup: rbac.authorization.k8s.io
 {{- end }}
@@ -2,7 +2,7 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ template "seaweedfs.name" . }}-objectstorage-provisioner
+  name: {{ include "seaweedfs.fullname" . }}-objectstorage-provisioner
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -57,7 +57,7 @@ spec:
      priorityClassName: {{ .Values.cosi.priorityClassName | quote }}
      {{- end }}
      enableServiceLinks: false
-      serviceAccountName: {{ .Values.global.serviceAccountName }}-objectstorage-provisioner
+      serviceAccountName: {{ include "seaweedfs.componentName" (list . "objectstorage-provisioner") }}
      {{- if .Values.cosi.initContainers }}
      initContainers:
        {{ tpl .Values.cosi.initContainers . | nindent 8 | trim }}
@@ -78,16 +78,16 @@ spec:
              {{- else if .Values.s3.ingress.enabled }}
              value: "{{ printf "https://%s" .Values.s3.ingress.host }}"
              {{- else if .Values.s3.enabled }}
-              value: "{{ printf "https://%s-s3.%s.svc" (include "seaweedfs.name" .) .Release.Namespace }}"
+              value: "{{ printf "https://%s.%s.svc" (include "seaweedfs.componentName" (list . "s3")) .Release.Namespace }}"
              {{- else }}
-              value: "{{ printf "https://%s-filer.%s.svc" (include "seaweedfs.name" .) .Release.Namespace }}"
+              value: "{{ printf "https://%s.%s.svc" (include "seaweedfs.componentName" (list . "filer")) .Release.Namespace }}"
              {{- end }}
            {{- with .Values.cosi.region }}
            - name: REGION
              value: "{{ . }}"
            {{- end }}
            - name: SEAWEEDFS_FILER
-              value: "{{ template "seaweedfs.name" . }}-filer:{{ .Values.filer.grpcPort }}"
+              value: "{{ include "seaweedfs.componentName" (list . "filer") }}:{{ .Values.filer.grpcPort }}"
            {{- if .Values.global.enableSecurity }}
            - name: WEED_GRPC_CLIENT_KEY
              value: /usr/local/share/ca-certificates/client/tls.key
@@ -185,28 +185,28 @@ spec:
            {{- if .Values.cosi.existingConfigSecret }}
            secretName: {{ .Values.cosi.existingConfigSecret }}
            {{- else }}
-            secretName: seaweedfs-s3-secret
+            secretName: {{ include "seaweedfs.fullname" . }}-s3-secret
            {{- end }}
        {{- end }}
        {{- if .Values.global.enableSecurity }}
        - name: security-config
          configMap:
-            name: {{ template "seaweedfs.name" . }}-security-config
+            name: {{ include "seaweedfs.fullname" . }}-security-config
        - name: ca-cert
          secret:
-            secretName: {{ template "seaweedfs.name" . }}-ca-cert
+            secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
        - name: master-cert
          secret:
-            secretName: {{ template "seaweedfs.name" . }}-master-cert
+            secretName: {{ include "seaweedfs.fullname" . }}-master-cert
        - name: volume-cert
          secret:
-            secretName: {{ template "seaweedfs.name" . }}-volume-cert
+            secretName: {{ include "seaweedfs.fullname" . }}-volume-cert
        - name: filer-cert
          secret:
-            secretName: {{ template "seaweedfs.name" . }}-filer-cert
+            secretName: {{ include "seaweedfs.fullname" . }}-filer-cert
        - name: client-cert
          secret:
-            secretName: {{ template "seaweedfs.name" . }}-client-cert
+            secretName: {{ include "seaweedfs.fullname" . }}-client-cert
        {{- end }}
        {{ tpl .Values.cosi.extraVolumes . | indent 8 | trim }}
      {{- if .Values.cosi.nodeSelector }}
@@ -2,7 +2,7 @@
 {{- $filerEnabled := or .Values.filer.enabled .Values.allInOne.enabled }}
 {{- if and $filerEnabled .Values.filer.ingress.enabled }}
 {{- /* Determine service name based on deployment mode */}}
-{{- $serviceName := ternary (printf "%s-all-in-one" (include "seaweedfs.name" .)) (printf "%s-filer" (include "seaweedfs.name" .)) .Values.allInOne.enabled }}
+{{- $serviceName := ternary (include "seaweedfs.componentName" (list . "all-in-one")) (include "seaweedfs.componentName" (list . "filer")) .Values.allInOne.enabled }}
 {{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion }}
 apiVersion: networking.k8s.io/v1
 {{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion }}
@@ -12,7 +12,7 @@ apiVersion: extensions/v1beta1
 {{- end }}
 kind: Ingress
 metadata:
-  name: ingress-{{ template "seaweedfs.name" . }}-filer
+  name: ingress-{{ include "seaweedfs.fullname" . }}-filer
  namespace: {{ .Release.Namespace }}
  {{- with .Values.filer.ingress.annotations }}
  annotations:
@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ template "seaweedfs.name" . }}-filer-client
+  name: {{ printf "%s-filer-client" (include "seaweedfs.fullname" .) | trunc 63 | trimSuffix "-" }}
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -36,5 +36,6 @@ spec:
 {{- end }}
  selector:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: filer
 {{- end }}
@@ -4,7 +4,7 @@ kind: Service
 metadata:
  annotations:
    service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
-  name: {{ template "seaweedfs.name" . }}-filer
+  name: {{ printf "%s-filer" (include "seaweedfs.fullname" .) | trunc 63 | trimSuffix "-" }}
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -48,5 +48,6 @@ spec:
  {{- end }}
  selector:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: filer
 {{- end }}
@@ -4,7 +4,7 @@
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
-  name: {{ template "seaweedfs.name" . }}-filer
+  name: {{ include "seaweedfs.fullname" . }}-filer
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -27,6 +27,7 @@ spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
      app.kubernetes.io/component: filer
 {{- end }}
 {{- end }}
@@ -2,7 +2,7 @@
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
-  name: {{ template "seaweedfs.name" . }}-filer
+  name: {{ include "seaweedfs.componentName" (list . "filer") }}
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -15,7 +15,7 @@ metadata:
    {{- toYaml .Values.filer.annotations | nindent 4 }}
 {{- end }}
 spec:
-  serviceName: {{ template "seaweedfs.name" . }}-filer
+  serviceName: {{ include "seaweedfs.componentName" (list . "filer") }}
  podManagementPolicy: {{ .Values.filer.podManagementPolicy }}
  replicas: {{ .Values.filer.replicas }}
  {{- if (gt (int .Values.filer.updatePartition) 0) }}
@@ -70,7 +70,7 @@ spec:
        {{ tpl .Values.filer.tolerations . | nindent 8 | trim }}
      {{- end }}
      {{- include "seaweedfs.imagePullSecrets" . | nindent 6 }}
-      serviceAccountName: {{ .Values.filer.serviceAccountName | default .Values.global.serviceAccountName | quote }} # for deleting statefulset pods after migration
+      serviceAccountName: {{ .Values.filer.serviceAccountName | default (include "seaweedfs.serviceAccountName" .) | quote }} # for deleting statefulset pods after migration
      terminationGracePeriodSeconds: 60
      {{- if .Values.filer.priorityClassName }}
      priorityClassName: {{ .Values.filer.priorityClassName | quote }}
@@ -103,17 +103,17 @@ spec:
            - name: WEED_MYSQL_USERNAME
              valueFrom:
                secretKeyRef:
-                  name: secret-seaweedfs-db
+                  name: {{ include "seaweedfs.fullname" . }}-db-secret
                  key: user
                  optional: true
            - name: WEED_MYSQL_PASSWORD
              valueFrom:
                secretKeyRef:
-                  name: secret-seaweedfs-db
+                  name: {{ include "seaweedfs.fullname" . }}-db-secret
                  key: password
                  optional: true
            - name: SEAWEEDFS_FULLNAME
-              value: "{{ template "seaweedfs.name" . }}"
+              value: "{{ include "seaweedfs.fullname" . }}"
            {{- if .Values.filer.extraEnvironmentVars }}
            {{- range $key, $value := .Values.filer.extraEnvironmentVars }}
            - name: {{ $key }}
@@ -359,7 +359,7 @@ spec:
        {{- end }}
        - name: db-schema-config-volume
          configMap:
-            name: seaweedfs-db-init-config
+            name: {{ default (printf "%s-db-init-config" (include "seaweedfs.fullname" .)) .Values.filer.dbInitConfigName }}
        {{- if and .Values.filer.s3.enabled .Values.filer.s3.enableAuth }}
        - name: config-users
          secret:
@@ -367,33 +367,33 @@ spec:
            {{- if .Values.filer.s3.existingConfigSecret }}
            secretName: {{ .Values.filer.s3.existingConfigSecret }}
            {{- else }}
-            secretName: seaweedfs-s3-secret
+            secretName: {{ include "seaweedfs.fullname" . }}-s3-secret
            {{- end }}
        {{- end }}
        {{- if .Values.filer.notificationConfig }}
        - name: notification-config
          configMap:
-            name: {{ template "seaweedfs.name" . }}-notification-config
+            name: {{ include "seaweedfs.fullname" . }}-notification-config
        {{- end }}
        {{- if .Values.global.enableSecurity }}
        - name: security-config
          configMap:
-            name: {{ template "seaweedfs.name" . }}-security-config
+            name: {{ include "seaweedfs.fullname" . }}-security-config
        - name: ca-cert
          secret:
-            secretName: {{ template "seaweedfs.name" . }}-ca-cert
+            secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
        - name: master-cert
          secret:
-            secretName: {{ template "seaweedfs.name" . }}-master-cert
+            secretName: {{ include "seaweedfs.fullname" . }}-master-cert
        - name: volume-cert
          secret:
-            secretName: {{ template "seaweedfs.name" . }}-volume-cert
+            secretName: {{ include "seaweedfs.fullname" . }}-volume-cert
        - name: filer-cert
          secret:
-            secretName: {{ template "seaweedfs.name" . }}-filer-cert
+            secretName: {{ include "seaweedfs.fullname" . }}-filer-cert
        - name: client-cert
          secret:
-            secretName: {{ template "seaweedfs.name" . }}-client-cert
+            secretName: {{ include "seaweedfs.fullname" . }}-client-cert
        {{- end }}
        {{ tpl .Values.filer.extraVolumes . | indent 8 | trim }}
      {{- if .Values.filer.nodeSelector }}
@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: {{ template "seaweedfs.name" . }}-master-config
+  name: {{ include "seaweedfs.fullname" . }}-master-config
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -9,7 +9,7 @@ apiVersion: extensions/v1beta1
 {{- end }}
 kind: Ingress
 metadata:
-  name: ingress-{{ template "seaweedfs.name" . }}-master
+  name: ingress-{{ include "seaweedfs.fullname" . }}-master
  namespace: {{ .Release.Namespace }}
  {{- with .Values.master.ingress.annotations }}
  annotations:
@@ -33,15 +33,15 @@ spec:
            backend:
 {{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion }}
              service:
-                name: {{ template "seaweedfs.name" . }}-master
+                name: {{ include "seaweedfs.componentName" (list . "master") }}
                port:
                  number: {{ .Values.master.port }}
                  #name:
 {{- else }}
-              serviceName: {{ template "seaweedfs.name" . }}-master
+              serviceName: {{ include "seaweedfs.componentName" (list . "master") }}
              servicePort: {{ .Values.master.port }}
 {{- end }}
-{{- if .Values.filer.ingress.host }}
+{{- if .Values.master.ingress.host }}
      host: {{ .Values.master.ingress.host }}
 {{- end }}
 {{- end }}
@@ -2,13 +2,14 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ template "seaweedfs.name" . }}-master
+  name: {{ printf "%s-master" (include "seaweedfs.fullname" .) | trunc 63 | trimSuffix "-" }}
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
    app.kubernetes.io/component: master
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
  annotations:
    service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
 {{- if .Values.master.annotations }}
@@ -34,5 +35,6 @@ spec:
  {{- end }}
  selector:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: master
 {{- end }}
@@ -4,7 +4,7 @@
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
-  name: {{ template "seaweedfs.name" . }}-master
+  name: {{ include "seaweedfs.fullname" . }}-master
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -27,6 +27,7 @@ spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
      app.kubernetes.io/component: master
 {{- end }}
 {{- end }}
@@ -2,7 +2,7 @@
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
-  name: {{ template "seaweedfs.name" . }}-master
+  name: {{ include "seaweedfs.componentName" (list . "master") }}
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -15,7 +15,7 @@ metadata:
    {{- toYaml .Values.master.annotations | nindent 4 }}
 {{- end }}
 spec:
-  serviceName: {{ template "seaweedfs.name" . }}-master
+  serviceName: {{ include "seaweedfs.componentName" (list . "master") }}
  podManagementPolicy: {{ .Values.master.podManagementPolicy }}
  replicas: {{ .Values.master.replicas }}
  {{- if (gt (int .Values.master.updatePartition) 0) }}
@@ -70,7 +70,7 @@ spec:
      {{- end }}
      enableServiceLinks: false
      {{- if .Values.global.createClusterRole }}
-      serviceAccountName: {{ .Values.master.serviceAccountName | default .Values.global.serviceAccountName | quote }} # for deleting statefulset pods after migration
+      serviceAccountName: {{ .Values.master.serviceAccountName | default (include "seaweedfs.serviceAccountName" .) | quote }} # for deleting statefulset pods after migration
      {{- end }}
      {{- if .Values.master.initContainers }}
      initContainers:
@@ -97,7 +97,7 @@ spec:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: SEAWEEDFS_FULLNAME
-              value: "{{ template "seaweedfs.name" . }}"
+              value: "{{ include "seaweedfs.fullname" . }}"
            {{- if .Values.master.extraEnvironmentVars }}
            {{- range $key, $value := .Values.master.extraEnvironmentVars }}
            - name: {{ $key }}
@@ -183,7 +183,7 @@ spec:
              {{- if .Values.master.garbageThreshold }}
              -garbageThreshold={{ .Values.master.garbageThreshold }} \
              {{- end }}
-              -ip=${POD_NAME}.${SEAWEEDFS_FULLNAME}-master.{{ .Release.Namespace }} \
+              -ip=${POD_NAME}.{{ include "seaweedfs.componentName" (list . "master") }}.{{ .Release.Namespace }} \
              -peers={{ include "seaweedfs.masterServers" . }} \
              {{- range .Values.master.extraArgs }}
              {{ . }} \
@@ -297,26 +297,26 @@ spec:
        {{- end }}
        - name: master-config
          configMap:
-            name: {{ template "seaweedfs.name" . }}-master-config
+            name: {{ include "seaweedfs.fullname" . }}-master-config
        {{- if .Values.global.enableSecurity }}
        - name: security-config
          configMap:
-            name: {{ template "seaweedfs.name" . }}-security-config
+            name: {{ include "seaweedfs.fullname" . }}-security-config
        - name: ca-cert
          secret:
-            secretName: {{ template "seaweedfs.name" . }}-ca-cert
+            secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
        - name: master-cert
          secret:
-            secretName: {{ template "seaweedfs.name" . }}-master-cert
+            secretName: {{ include "seaweedfs.fullname" . }}-master-cert
        - name: volume-cert
          secret:
-            secretName: {{ template "seaweedfs.name" . }}-volume-cert
+            secretName: {{ include "seaweedfs.fullname" . }}-volume-cert
        - name: filer-cert
          secret:
-            secretName: {{ template "seaweedfs.name" . }}-filer-cert
+            secretName: {{ include "seaweedfs.fullname" . }}-filer-cert
        - name: client-cert
          secret:
-            secretName: {{ template "seaweedfs.name" . }}-client-cert
+            secretName: {{ include "seaweedfs.fullname" . }}-client-cert
        {{- end }}
        {{ tpl .Values.master.extraVolumes . | indent 8 | trim }}
      {{- if .Values.master.nodeSelector }}
@@ -2,7 +2,7 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ template "seaweedfs.name" . }}-s3
+  name: {{ include "seaweedfs.fullname" . }}-s3
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -89,7 +89,7 @@ spec:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: SEAWEEDFS_FULLNAME
-              value: "{{ template "seaweedfs.name" . }}"
+              value: "{{ include "seaweedfs.fullname" . }}"
            {{- if .Values.s3.extraEnvironmentVars }}
            {{- range $key, $value := .Values.s3.extraEnvironmentVars }}
            - name: {{ $key }}
@@ -149,7 +149,10 @@ spec:
              {{- if .Values.s3.auditLogConfig }}
              -auditLogConfig=/etc/sw/s3_auditLogConfig.json \
              {{- end }}
-              -filer={{ template "seaweedfs.name" . }}-filer-client.{{ .Release.Namespace }}:{{ .Values.filer.port }} \
+              -filer={{ include "seaweedfs.componentName" (list . "filer-client") }}.{{ .Release.Namespace }}:{{ .Values.filer.port }} \
+              {{- if .Values.s3.icebergPort }}
+              -port.iceberg={{ .Values.s3.icebergPort }} \
+              {{- end }}
              {{- range .Values.s3.extraArgs }}
              {{ . }} \
              {{- end }}
@@ -192,6 +195,10 @@ spec:
            - containerPort: {{ .Values.s3.httpsPort }}
              name: swfs-s3-tls
            {{- end }}
+            {{- if .Values.s3.icebergPort }}
+            - containerPort: {{ .Values.s3.icebergPort }}
+              name: swfs-iceberg
+            {{- end }}
            {{- if .Values.s3.metricsPort }}
            - containerPort: {{ .Values.s3.metricsPort }}
              name: metrics
@@ -238,7 +245,7 @@ spec:
            {{- if .Values.s3.existingConfigSecret }}
            secretName: {{ .Values.s3.existingConfigSecret }}
            {{- else }}
-            secretName: seaweedfs-s3-secret
+            secretName: {{ include "seaweedfs.fullname" . }}-s3-secret
            {{- end }}
        {{- end }}
        {{- if eq .Values.s3.logs.type "hostPath" }}
@@ -254,22 +261,22 @@ spec:
        {{- if .Values.global.enableSecurity }}
        - name: security-config
          configMap:
-            name: {{ template "seaweedfs.name" . }}-security-config
+            name: {{ include "seaweedfs.fullname" . }}-security-config
        - name: ca-cert
          secret:
-            secretName: {{ template "seaweedfs.name" . }}-ca-cert
+            secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
        - name: master-cert
          secret:
-            secretName: {{ template "seaweedfs.name" . }}-master-cert
+            secretName: {{ include "seaweedfs.fullname" . }}-master-cert
        - name: volume-cert
          secret:
-            secretName: {{ template "seaweedfs.name" . }}-volume-cert
+            secretName: {{ include "seaweedfs.fullname" . }}-volume-cert
        - name: filer-cert
          secret:
-            secretName: {{ template "seaweedfs.name" . }}-filer-cert
+            secretName: {{ include "seaweedfs.fullname" . }}-filer-cert
        - name: client-cert
          secret:
-            secretName: {{ template "seaweedfs.name" . }}-client-cert
+            secretName: {{ include "seaweedfs.fullname" . }}-client-cert
        {{- end }}
        {{ tpl .Values.s3.extraVolumes . | indent 8 | trim }}
      {{- if .Values.s3.nodeSelector }}
@@ -0,0 +1,61 @@
+{{- define "seaweedfs.s3.iceberg.ingress.paths" -}}
+paths:
+- path: {{ .Values.s3.icebergIngress.path | quote }}
+  pathType: {{ .Values.s3.icebergIngress.pathType | quote }}
+  backend:
+    {{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion }}
+    service:
+      name: {{ include "seaweedfs.componentName" (list . "s3") }}
+      port:
+        number: {{ .Values.s3.icebergPort }}
+    {{- else }}
+    serviceName: {{ include "seaweedfs.componentName" (list . "s3") }}
+    servicePort: {{ .Values.s3.icebergPort }}
+    {{- end }}
+{{- end -}}
+{{- if and .Values.s3.enabled .Values.s3.icebergPort .Values.s3.icebergIngress.enabled }}
+{{- $hosts := list }}
+{{- if kindIs "slice" .Values.s3.icebergIngress.host }}
+  {{- $hosts = .Values.s3.icebergIngress.host }}
+{{- else if .Values.s3.icebergIngress.host }}
+  {{- $hosts = list .Values.s3.icebergIngress.host }}
+{{- end }}
+{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion }}
+apiVersion: networking.k8s.io/v1
+{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion }}
+apiVersion: networking.k8s.io/v1beta1
+{{- else }}
+apiVersion: extensions/v1beta1
+{{- end }}
+kind: Ingress
+metadata:
+  name: ingress-{{ include "seaweedfs.fullname" . }}-s3-iceberg
+  namespace: {{ .Release.Namespace }}
+  {{- with .Values.s3.icebergIngress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  labels:
+    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: s3-iceberg
+spec:
+  {{- if .Values.s3.icebergIngress.className }}
+  ingressClassName: {{ .Values.s3.icebergIngress.className | quote }}
+  {{- end }}
+  tls:
+    {{ .Values.s3.icebergIngress.tls | default list | toYaml | nindent 6}}
+  rules:
+{{- if $hosts }}
+{{- range $host := $hosts }}
+  - host: {{ $host | quote }}
+    http:
+      {{- include "seaweedfs.s3.iceberg.ingress.paths" $ | nindent 6 }}
+{{- end }}
+{{- else }}
+  - http:
+      {{- include "seaweedfs.s3.iceberg.ingress.paths" . | nindent 4 }}
+{{- end }}
+{{- end }}
@@ -2,7 +2,7 @@
 {{- $s3Enabled := or .Values.s3.enabled (and .Values.filer.s3.enabled (not .Values.allInOne.enabled)) (and .Values.allInOne.enabled .Values.allInOne.s3.enabled) }}
 {{- if and $s3Enabled .Values.s3.ingress.enabled }}
 {{- /* Determine service name based on deployment mode */}}
-{{- $serviceName := ternary (printf "%s-all-in-one" (include "seaweedfs.name" .)) (printf "%s-s3" (include "seaweedfs.name" .)) .Values.allInOne.enabled }}
+{{- $serviceName := ternary (include "seaweedfs.componentName" (list . "all-in-one")) (include "seaweedfs.componentName" (list . "s3")) .Values.allInOne.enabled }}
 {{- $s3Port := .Values.allInOne.s3.port | default .Values.s3.port }}
 {{- /* Build hosts list - support both legacy .host (string) and new .hosts (array) for backwards compatibility */}}
 {{- $hosts := list }}
@@ -20,7 +20,7 @@ apiVersion: extensions/v1beta1
 {{- end }}
 kind: Ingress
 metadata:
-  name: ingress-{{ template "seaweedfs.name" . }}-s3
+  name: ingress-{{ include "seaweedfs.fullname" . }}-s3
  namespace: {{ .Release.Namespace }}
  {{- with .Values.s3.ingress.annotations }}
  annotations:
@@ -1,13 +1,35 @@
 {{- if or (and (or .Values.s3.enabled .Values.allInOne.enabled) .Values.s3.enableAuth (not .Values.s3.existingConfigSecret)) (and .Values.filer.s3.enabled .Values.filer.s3.enableAuth (not .Values.filer.s3.existingConfigSecret)) }}
-{{- $access_key_admin := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" "seaweedfs-s3-secret" "key" "admin_access_key_id" "length" 20) -}}
-{{- $secret_key_admin := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" "seaweedfs-s3-secret" "key" "admin_secret_access_key" "length" 40) -}}
-{{- $access_key_read := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" "seaweedfs-s3-secret" "key" "read_access_key_id" "length" 20) -}}
-{{- $secret_key_read := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" "seaweedfs-s3-secret" "key" "read_secret_access_key" "length" 40) -}}
+{{- $secretName := printf "%s-s3-secret" (include "seaweedfs.fullname" .) }}
+{{- $legacySecretName := "seaweedfs-s3-secret" }}
+{{- $lookupName := $secretName }}
+{{- if .Values.s3.reuseLegacySecret }}
+{{-   $lookupName = default $legacySecretName .Values.s3.legacySecretName }}
+{{- end }}
+{{- $existingSecret := lookup "v1" "Secret" .Release.Namespace $lookupName }}
+{{- $reuse := false }}
+{{- if and .Values.s3.reuseLegacySecret $existingSecret }}
+{{- $reuse = true }}
+{{- end }}
+{{- $creds := .Values.s3.credentials | default dict -}}
+{{- $adminCreds := $creds.admin | default dict -}}
+{{- $access_key_admin := $adminCreds.accessKey -}}
+{{- $secret_key_admin := $adminCreds.secretKey -}}
+{{- if not (and $access_key_admin $secret_key_admin) -}}
+  {{- $access_key_admin = include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "admin_access_key_id" "length" 20 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
+  {{- $secret_key_admin = include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "admin_secret_access_key" "length" 40 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
+{{- end -}}
+{{- $readCreds := $creds.read | default dict -}}
+{{- $access_key_read := $readCreds.accessKey -}}
+{{- $secret_key_read := $readCreds.secretKey -}}
+{{- if not (and $access_key_read $secret_key_read) -}}
+  {{- $access_key_read = include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "read_access_key_id" "length" 20 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
+  {{- $secret_key_read = include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "read_secret_access_key" "length" 40 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
+{{- end -}}
 apiVersion: v1
 kind: Secret
 type: Opaque
 metadata:
-  name: seaweedfs-s3-secret
+  name: {{ $secretName }}
  namespace: {{ .Release.Namespace }}
  annotations:
    "helm.sh/resource-policy": keep
@@ -32,4 +54,4 @@ stringData:
  s3_auditLogConfig.json: |
    {{ toJson .Values.s3.auditLogConfig | nindent 4 }}
  {{- end }}
-{{- end }}
+{{- end }}
@@ -2,24 +2,34 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ template "seaweedfs.name" . }}-s3
+  name: {{ printf "%s-s3" (include "seaweedfs.fullname" .) | trunc 63 | trimSuffix "-" }}
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
    app.kubernetes.io/component: s3
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
 {{- if .Values.s3.annotations }}
  annotations:
    {{- toYaml .Values.s3.annotations | nindent 4 }}
 {{- end }}
 spec:
  internalTrafficPolicy: {{ .Values.s3.internalTrafficPolicy | default "Cluster" }}
+  {{- if and (semverCompare ">=1.31-0" .Capabilities.KubeVersion.GitVersion) (or .Values.s3.trafficDistribution .Values.filer.s3.trafficDistribution) }}
+  trafficDistribution: {{ include "seaweedfs.trafficDistribution" . }}
+  {{- end }}
  ports:
  - name: "swfs-s3"
    port: {{ if .Values.s3.enabled }}{{ .Values.s3.port }}{{ else }}{{ .Values.filer.s3.port }}{{ end }}
    targetPort: {{ if .Values.s3.enabled }}{{ .Values.s3.port }}{{ else }}{{ .Values.filer.s3.port }}{{ end }}
    protocol: TCP
+{{- if and .Values.s3.enabled .Values.s3.icebergPort }}
+  - name: "swfs-iceberg"
+    port: {{ .Values.s3.icebergPort }}
+    targetPort: {{ .Values.s3.icebergPort }}
+    protocol: TCP
+{{- end }}
 {{- if and .Values.s3.enabled .Values.s3.httpsPort }}
  - name: "swfs-s3-tls"
    port: {{ .Values.s3.httpsPort }}
@@ -34,5 +44,6 @@ spec:
 {{- end }}
  selector:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: {{ if .Values.s3.enabled }}s3{{ else }}filer{{ end }}
 {{- end }}
@@ -4,7 +4,7 @@
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
-  name: {{ template "seaweedfs.name" . }}-s3
+  name: {{ include "seaweedfs.fullname" . }}-s3
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -27,6 +27,7 @@ spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
      app.kubernetes.io/component: s3
 {{- end }}
 {{- end }}
@@ -2,7 +2,7 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ template "seaweedfs.name" . }}-sftp
+  name: {{ include "seaweedfs.fullname" . }}-sftp
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -89,7 +89,7 @@ spec:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: SEAWEEDFS_FULLNAME
-              value: "{{ template "seaweedfs.name" . }}"
+              value: "{{ include "seaweedfs.fullname" . }}"
            {{- if .Values.sftp.extraEnvironmentVars }}
            {{- range $key, $value := .Values.sftp.extraEnvironmentVars }}
            - name: {{ $key }}
@@ -171,7 +171,7 @@ spec:
              -key.file=/usr/local/share/ca-certificates/client/tls.key \
              {{- end }}
              -userStoreFile=/etc/sw/seaweedfs_sftp_config \
-              -filer={{ template "seaweedfs.name" . }}-filer-client.{{ .Release.Namespace }}:{{ .Values.filer.port }}
+              -filer={{ include "seaweedfs.componentName" (list . "filer-client") }}.{{ .Release.Namespace }}:{{ .Values.filer.port }}
          volumeMounts:
            {{- if or (eq .Values.sftp.logs.type "hostPath") (eq .Values.sftp.logs.type "emptyDir") }}
            - name: logs
@@ -252,7 +252,7 @@ spec:
            {{- if .Values.sftp.existingConfigSecret }}
            secretName: {{ .Values.sftp.existingConfigSecret }}
            {{- else }}
-            secretName: seaweedfs-sftp-secret
+            secretName: {{ include "seaweedfs.fullname" . }}-sftp-secret
            {{- end }}
        {{- end }}
        - name: config-ssh
@@ -261,7 +261,7 @@ spec:
            {{- if .Values.sftp.existingSshConfigSecret }}
            secretName: {{ .Values.sftp.existingSshConfigSecret }}
            {{- else }}
-            secretName: seaweedfs-sftp-ssh-secret
+            secretName: {{ include "seaweedfs.fullname" . }}-sftp-ssh-secret
            {{- end }}
        {{- if eq .Values.sftp.logs.type "hostPath" }}
        - name: logs
@@ -276,22 +276,22 @@ spec:
        {{- if .Values.global.enableSecurity }}
        - name: security-config
          configMap:
-            name: {{ template "seaweedfs.name" . }}-security-config
+            name: {{ include "seaweedfs.fullname" . }}-security-config
        - name: ca-cert
          secret:
-            secretName: {{ template "seaweedfs.name" . }}-ca-cert
+            secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
        - name: master-cert
          secret:
-            secretName: {{ template "seaweedfs.name" . }}-master-cert
+            secretName: {{ include "seaweedfs.fullname" . }}-master-cert
        - name: volume-cert
          secret:
-            secretName: {{ template "seaweedfs.name" . }}-volume-cert
+            secretName: {{ include "seaweedfs.fullname" . }}-volume-cert
        - name: filer-cert
          secret:
-            secretName: {{ template "seaweedfs.name" . }}-filer-cert
+            secretName: {{ include "seaweedfs.fullname" . }}-filer-cert
        - name: client-cert
          secret:
-            secretName: {{ template "seaweedfs.name" . }}-client-cert
+            secretName: {{ include "seaweedfs.fullname" . }}-client-cert
        {{- end }}
        {{ tpl .Values.sftp.extraVolumes . | indent 8 | trim }}
      {{- if .Values.sftp.nodeSelector }}
@@ -1,12 +1,13 @@
 {{- if or .Values.sftp.enabled .Values.allInOne.enabled }}
-{{- $admin_pwd := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" "seaweedfs-sftp-secret" "key" "admin_password" 20) -}}
-{{- $read_user_pwd := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" "seaweedfs-sftp-secret" "key" "readonly_password" 20) -}}
-{{- $public_user_pwd := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" "seaweedfs-sftp-secret" "key" "public_user_password" 20) -}}
+{{- $secretName := printf "%s-sftp-secret" (include "seaweedfs.fullname" .) }}
+{{- $admin_pwd := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "admin_password" 20) -}}
+{{- $read_user_pwd := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "readonly_password" 20) -}}
+{{- $public_user_pwd := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "public_user_password" 20) -}}
 apiVersion: v1
 kind: Secret
 type: Opaque
 metadata:
-  name: seaweedfs-sftp-secret
+  name: {{ $secretName }}
  namespace: {{ .Release.Namespace }}
  annotations:
    "helm.sh/resource-policy": keep
@@ -2,10 +2,11 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ template "seaweedfs.name" . }}-sftp
+  name: {{ printf "%s-sftp" (include "seaweedfs.fullname" .) | trunc 63 | trimSuffix "-" }}
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: sftp
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
@@ -28,5 +29,6 @@ spec:
 {{- end }}
  selector:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: sftp
 {{- end }}
@@ -4,7 +4,7 @@
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
-  name: {{ template "seaweedfs.name" . }}-sftp
+  name: {{ include "seaweedfs.fullname" . }}-sftp
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -27,6 +27,7 @@ spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
      app.kubernetes.io/component: sftp
 {{- end }}
 {{- end }}
@@ -17,6 +17,22 @@ be used as a full name.
 {{- end -}}
 {{- end -}}

+{{/*
+Create a truncated component name.
+Usage: {{ include "seaweedfs.componentName" (list . "component-suffix") }}
+*/}}
+{{- define "seaweedfs.componentName" -}}
+{{- $context := index . 0 -}}
+{{- $suffix := index . 1 -}}
+{{- if gt (len $suffix) 61 -}}
+{{-   fail (printf "Suffix '%s' is too long for componentName helper. Max length is 61." $suffix) -}}
+{{- end -}}
+{{- $fullname := include "seaweedfs.fullname" $context -}}
+{{- $maxLen := sub 62 (len $suffix) | int -}}
+{{- $truncatedFullname := trunc $maxLen $fullname | trimSuffix "-" -}}
+{{- printf "%s-%s" $truncatedFullname $suffix -}}
+{{- end -}}
+
 {{/*
 Create chart name and version as used by the chart label.
 */}}
@@ -119,7 +135,9 @@ Inject extra environment vars in the format key:value, if populated
 {{- $repositoryName := default .Values.image.repository .Values.global.repository | toString -}}
 {{- $name := .Values.global.imageName | toString -}}
 {{- $tag := default .Chart.AppVersion .Values.image.tag  | toString -}}
-{{- if $repositoryName -}}
+{{- if .Values.image.repository -}}
+{{-   $name = $repositoryName -}}
+{{- else if $repositoryName -}}
 {{-   $name = printf "%s/%s" (trimSuffix "/" $repositoryName) (base $name) -}}
 {{- end -}}
 {{- if $registryName -}}
@@ -244,7 +262,7 @@ or generate a new random password if it doesn't exist.
 {{- $key := $params.key -}}
 {{- $length := default 16 $params.length -}}

-{{- $existingSecret := lookup "v1" "Secret" $namespace $secretName -}}
+{{- $existingSecret := default (lookup "v1" "Secret" $namespace $secretName) $params.existingSecret -}}
 {{- if and $existingSecret (index $existingSecret.data $key) -}}
  {{- index $existingSecret.data $key | b64dec -}}
 {{- else -}}
@@ -261,7 +279,7 @@ If allInOne is enabled, point to the all-in-one service; otherwise, point to the
 {{- if .Values.allInOne.enabled -}}
 {{-   $serviceNameSuffix = "-all-in-one" -}}
 {{- end -}}
-{{- printf "%s%s.%s:%d" (include "seaweedfs.name" .) $serviceNameSuffix .Release.Namespace (int .Values.master.port) -}}
+{{- printf "%s.%s:%d" (printf "%s%s" (include "seaweedfs.fullname" .) $serviceNameSuffix | trunc 63 | trimSuffix "-") .Release.Namespace (int .Values.master.port) -}}
 {{- end -}}

 {{/*
@@ -273,19 +291,19 @@ If allInOne is enabled, point to the all-in-one service; otherwise, point to the
 {{- if .Values.allInOne.enabled -}}
 {{-   $serviceNameSuffix = "-all-in-one" -}}
 {{- end -}}
-{{- printf "%s%s.%s:%d" (include "seaweedfs.name" .) $serviceNameSuffix .Release.Namespace (int .Values.filer.port) -}}
+{{- printf "%s.%s:%d" (printf "%s%s" (include "seaweedfs.fullname" .) $serviceNameSuffix | trunc 63 | trimSuffix "-") .Release.Namespace (int .Values.filer.port) -}}
 {{- end -}}

 {{/*
 Generate comma-separated list of master server addresses.
 Usage: {{ include "seaweedfs.masterServers" . }}
-Output example: ${SEAWEEDFS_FULLNAME}-master-0.${SEAWEEDFS_FULLNAME}-master.namespace:9333,${SEAWEEDFS_FULLNAME}-master-1...
+Output example: my-release-master-0.my-release-master.namespace:9333,my-release-master-1...
 */}}
 {{- define "seaweedfs.masterServers" -}}
-{{- $fullname := include "seaweedfs.name" . -}}
+{{- $masterName := include "seaweedfs.componentName" (list . "master") -}}
 {{- range $index := until (.Values.master.replicas | int) -}}
 {{- if $index }},{{ end -}}
-${SEAWEEDFS_FULLNAME}-master-{{ $index }}.${SEAWEEDFS_FULLNAME}-master.{{ $.Release.Namespace }}:{{ $.Values.master.port }}
+{{ $masterName }}-{{ $index }}.{{ $masterName }}.{{ $.Release.Namespace }}:{{ $.Values.master.port }}
 {{- end -}}
 {{- end -}}

@@ -300,3 +318,19 @@ Usage: {{ include "seaweedfs.masterServerArg" . }}
 {{- include "seaweedfs.masterServers" . -}}
 {{- end -}}
 {{- end -}}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "seaweedfs.serviceAccountName" -}}
+{{- .Values.global.serviceAccountName | default "seaweedfs" -}}
+{{- end -}}
+
+{{/* Generate a compatible trafficDistribution value due to "PreferClose" fast deprecation in k8s v1.35 */}}
+{{- define "seaweedfs.trafficDistribution" -}}
+{{- if .Values.s3.trafficDistribution -}}
+{{- and (eq .Values.s3.trafficDistribution "PreferClose") (semverCompare ">=1.35-0" .Capabilities.KubeVersion.GitVersion) | ternary "PreferSameZone" .Values.s3.trafficDistribution -}}
+{{- else if .Values.filer.s3.trafficDistribution -}}
+{{- and (eq .Values.filer.s3.trafficDistribution "PreferClose") (semverCompare ">=1.35-0" .Capabilities.KubeVersion.GitVersion) | ternary "PreferSameZone" .Values.filer.s3.trafficDistribution -}}
+{{- end -}}
+{{- end -}}
@@ -4,7 +4,7 @@
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: {{ .Values.global.serviceAccountName }}-rw-cr
+  name: {{ include "seaweedfs.fullname" . }}-rw-cr
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
@@ -18,7 +18,7 @@ rules:
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: system:serviceaccount:{{ .Values.global.serviceAccountName }}:default
+  name: {{ include "seaweedfs.fullname" . }}-rw-crb
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
@@ -26,10 +26,10 @@ metadata:
    app.kubernetes.io/instance: {{ .Release.Name }}
 subjects:
  - kind: ServiceAccount
-    name: {{ .Values.global.serviceAccountName }}
+    name: {{ include "seaweedfs.serviceAccountName" . }}
    namespace: {{ .Release.Namespace }}
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
-  name: {{ .Values.global.serviceAccountName }}-rw-cr
+  name: {{ include "seaweedfs.fullname" . }}-rw-cr
 {{- end }}
@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: {{ template "seaweedfs.name" . }}-notification-config
+  name: {{ include "seaweedfs.fullname" . }}-notification-config
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -3,6 +3,15 @@
 {{- $s3Enabled := false }}
 {{- $enableAuth := false }}
 {{- $existingConfigSecret := "" }}
+{{- $bucketsFolder := "/buckets" }}
+{{- $bucketEnvVars := merge (dict) (.Values.global.extraEnvironmentVars | default dict) }}
+{{- if .Values.allInOne.enabled }}
+  {{- $bucketEnvVars = merge (.Values.allInOne.extraEnvironmentVars | default dict) $bucketEnvVars }}
+{{- else }}
+  {{- $bucketEnvVars = merge (.Values.filer.extraEnvironmentVars | default dict) $bucketEnvVars }}
+{{- end }}
+{{- $bucketsFolder = default $bucketsFolder (get $bucketEnvVars "WEED_FILER_BUCKETS_FOLDER") }}
+{{- $bucketsFolder = trimSuffix "/" $bucketsFolder }}

 {{- /* Check allInOne mode first */}}
 {{- if .Values.allInOne.enabled }}
@@ -15,14 +24,18 @@
    {{- $existingConfigSecret = or .Values.allInOne.s3.existingConfigSecret .Values.s3.existingConfigSecret .Values.filer.s3.existingConfigSecret }}
  {{- end }}
 {{- else if .Values.master.enabled }}
-  {{- /* Check standalone filer.s3 mode */}}
-  {{- if .Values.filer.s3.enabled }}
+  {{- /* Check if embedded (in filer) or standalone S3 gateway is enabled */}}
+  {{- if or .Values.filer.s3.enabled .Values.s3.enabled }}
    {{- $s3Enabled = true }}
-    {{- if .Values.filer.s3.createBuckets }}
+    {{- if .Values.s3.createBuckets }}
+      {{- $createBuckets = .Values.s3.createBuckets }}
+      {{- $enableAuth = .Values.s3.enableAuth }}
+      {{- $existingConfigSecret = .Values.s3.existingConfigSecret }}
+    {{- else if .Values.filer.s3.createBuckets }}
      {{- $createBuckets = .Values.filer.s3.createBuckets }}
+      {{- $enableAuth = .Values.filer.s3.enableAuth }}
+      {{- $existingConfigSecret = .Values.filer.s3.existingConfigSecret }}
    {{- end }}
-    {{- $enableAuth = .Values.filer.s3.enableAuth }}
-    {{- $existingConfigSecret = .Values.filer.s3.existingConfigSecret }}
  {{- end }}
 {{- end }}

@@ -36,7 +49,7 @@ metadata:
    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
    app.kubernetes.io/instance: {{ .Release.Name | quote }}
  annotations:
-    "helm.sh/hook": post-install
+    "helm.sh/hook": post-install,post-upgrade
    "helm.sh/hook-weight": "-5"
    "helm.sh/hook-delete-policy": hook-succeeded
 spec:
@@ -74,7 +87,7 @@ spec:
              fieldRef:
                fieldPath: metadata.namespace
          - name: SEAWEEDFS_FULLNAME
-            value: "{{ template "seaweedfs.name" . }}"
+            value: "{{ include "seaweedfs.fullname" . }}"
        command:
          - "/bin/sh"
          - "-ec"
@@ -104,10 +117,50 @@ spec:
            wait_for_service "http://$WEED_CLUSTER_SW_MASTER{{ .Values.master.readinessProbe.httpGet.path }}"
            wait_for_service "http://$WEED_CLUSTER_SW_FILER{{ .Values.filer.readinessProbe.httpGet.path }}"
            {{- end }}
+          set -o pipefail
          {{- range $createBuckets }}
-            /bin/echo \
-            "s3.bucket.create --name {{ .name }}" |\
-            /usr/bin/weed shell
+            {{- $bucketName := .name }}
+            {{- $bucketLock := or .lock .objectLock .withLock }}
+            bucket_list=$(/bin/echo 's3.bucket.list' | /usr/bin/weed shell) || { echo "Error listing s3 buckets"; exit 1; }
+            if echo "$bucket_list" | awk '{print $1}' | grep -Fxq "{{ $bucketName }}"; then
+              echo "Bucket '{{ $bucketName }}' already exists, skipping creation."
+            else
+              echo "Creating bucket '{{ $bucketName }}'..."
+              /bin/echo 's3.bucket.create --name {{ $bucketName }}{{- if $bucketLock }} --withLock{{- end }}' | /usr/bin/weed shell
+            fi
+          {{- end }}
+          {{- range $createBuckets }}
+          {{- $bucketLock := or .lock .objectLock .withLock }}
+          {{- if $bucketLock }}
+            /bin/echo 's3.bucket.lock -name {{ .name }} -enable' | /usr/bin/weed shell
+          {{- end }}
+          {{- end }}
+          {{- range $createBuckets }}
+          {{- $bucketVersioning := "" }}
+          {{- if kindIs "bool" .versioning }}
+            {{- if .versioning }}
+              {{- $bucketVersioning = "Enabled" }}
+            {{- end }}
+          {{- else if kindIs "string" .versioning }}
+            {{- $versioningLower := lower .versioning }}
+            {{- if eq $versioningLower "enabled" "enable" "true" }}
+              {{- $bucketVersioning = "Enabled" }}
+            {{- else if eq $versioningLower "suspended" "disable" "false" }}
+              {{- $bucketVersioning = "Suspended" }}
+            {{- else if or (eq .versioning "Enabled") (eq .versioning "Suspended") }}
+              {{- $bucketVersioning = .versioning }}
+            {{- else }}
+              {{- fail (printf "Invalid versioning value for bucket %s: %s. Must be 'Enabled' or 'Suspended'" .name .versioning) }}
+            {{- end }}
+          {{- end }}
+          {{- if $bucketVersioning }}
+            /bin/echo 's3.bucket.versioning -name {{ .name }} -status {{ $bucketVersioning }}' | /usr/bin/weed shell
+          {{- end }}
+          {{- end }}
+          {{- range $createBuckets }}
+          {{- if .ttl }}
+            /bin/echo 'fs.configure -locationPrefix={{ $bucketsFolder }}/{{ .name }}/ -ttl={{ .ttl }} -apply' | /usr/bin/weed shell
+          {{- end }}
          {{- end }}
          {{- range $createBuckets }}
          {{- if .anonymousRead }}
@@ -145,7 +198,7 @@ spec:
            {{- if $existingConfigSecret }}
            secretName: {{ $existingConfigSecret }}
            {{- else }}
-            secretName: {{ template "seaweedfs.name" . }}-s3-secret
+            secretName: {{ include "seaweedfs.fullname" . }}-s3-secret
            {{- end }}
    {{- end }}
 {{- end }}
@@ -7,7 +7,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: {{ printf "%s" $dashboardName | lower | replace "_" "-" }}
+  name: {{ include "seaweedfs.fullname" $ }}-{{ printf "%s" $dashboardName | lower | replace "_" "-" }}
  namespace: {{ $.Release.Namespace }}
  labels:
    grafana_dashboard: "1"
@@ -3,7 +3,7 @@ apiVersion: v1
 kind: Secret
 type: Opaque
 metadata:
-  name: secret-seaweedfs-db
+  name: {{ include "seaweedfs.fullname" . }}-db-secret
  namespace: {{ .Release.Namespace }}
  annotations:
    "helm.sh/resource-policy": keep
@@ -15,7 +15,6 @@ metadata:
    app.kubernetes.io/instance: {{ .Release.Name }}
 stringData:
  user: "YourSWUser"
-  password: "HardCodedPassword"
-  # better to random generate and create in DB
-  # password: {{ randAlphaNum 10 | sha256sum | b64enc | trunc 32 }}
+  # auto-generated password
+  password: {{ randAlphaNum 10 | sha256sum | b64enc | trunc 32 }}
 {{- end }}
@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: {{ template "seaweedfs.name" . }}-security-config
+  name: {{ include "seaweedfs.fullname" . }}-security-config
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -10,7 +10,13 @@ metadata:
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
 data:
-  {{- $existing := (lookup "v1" "ConfigMap" .Release.Namespace (printf "%s-security-config" (include "seaweedfs.name" .))) }}
+  {{- $fullname := include "seaweedfs.fullname" . }}
+  {{- $securityConfigName := printf "%s-security-config" $fullname }}
+  {{- $existing := lookup "v1" "ConfigMap" .Release.Namespace $securityConfigName }}
+  {{- if not $existing }}
+  {{- $legacyName := printf "%s-%s" (include "seaweedfs.name" .) "security-config" }}
+  {{- $existing = lookup "v1" "ConfigMap" .Release.Namespace $legacyName }}
+  {{- end }}
  {{- $securityConfig := fromToml (dig "data" "security.toml" "" $existing) }}
  security.toml: |-
    # this file is read by master, volume server, and filer
@@ -42,7 +48,7 @@ data:
    {{- if .Values.global.securityConfig.jwtSigning.filerRead }}
    # If this JWT key is configured, Filer only accepts reads over HTTP if they are signed with this JWT:
    # - f.e. the S3 API Shim generates the JWT
-    # - the Filer server validates the JWT on writing
+    # - the Filer server validates the JWT on reading
    # the jwt defaults to expire after 10 seconds.
    [jwt.filer_signing.read]
    key = "{{ dig "jwt" "filer_signing" "read" "key" (randAlphaNum 10 | b64enc) $securityConfig }}"
@@ -1,8 +1,12 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ .Values.global.serviceAccountName }}
+  name: {{ include "seaweedfs.serviceAccountName" . }}
  namespace: {{ .Release.Namespace }}
+  {{- with .Values.global.serviceAccountAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
--- a/Show More
+++ b/Show More