Support multiple certificates for S3 HTTPS via comma-separated flags

.github/pull_request_template.md

@@ -12,7 +12,6 @@
 # Checks
 - [ ] I have added unit tests if possible.
 - [ ] I will add related wiki document changes and link to this PR after merging.
-- [ ] All AI code review comments have been addressed. No more comments to fix if reviewed again.
 
 # Checks for AI generated PRs
 - [ ] I have reviewed every line of code.

.github/workflows/e2e.yml

@@ -24,7 +24,7 @@ jobs:
     timeout-minutes: 30
     steps:
     - name: Set up Go 1.x
-      uses: actions/setup-go@a5f9b05d2d216f63e13859e0d847461041025775 # v2
+      uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v2
       with:
         go-version: ^1.13
       id: go

.github/workflows/ec-integration.yml

@@ -23,10 +23,10 @@ jobs:
     
     steps:
     - name: Checkout code
-      uses: actions/checkout@v6
+      uses: actions/checkout@v4
       
     - name: Set up Go
-      uses: actions/setup-go@v6
+      uses: actions/setup-go@v5
       with:
         go-version: '1.24'
         
@@ -42,7 +42,7 @@ jobs:
         
     - name: Upload test logs on failure
       if: failure()
-      uses: actions/upload-artifact@v6
+      uses: actions/upload-artifact@v4
       with:
         name: ec-test-logs
         path: test/erasure_coding/admin_dockertest/tmp/logs/

.github/workflows/go.yml

@@ -21,7 +21,7 @@ jobs:
     steps:
 
     - name: Set up Go 1.x
-      uses: actions/setup-go@a5f9b05d2d216f63e13859e0d847461041025775 # v2
+      uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v2
       with:
         go-version: ^1.13
       id: go

.github/workflows/s3-example-integration-tests.yml

@@ -1,56 +0,0 @@
-name: "S3 Authenticated Integration Tests"
-
-on:
-  pull_request:
-  
-concurrency:
-  group: ${{ github.head_ref }}/s3-integration-tests
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  tests:
-    name: S3 Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 30
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Build SeaweedFS
-        run: |
-          cd weed
-          go build -o weed -buildvcs=false
-
-      - name: Run S3 Integration Tests
-        timeout-minutes: 15
-        working-directory: test/s3/normal
-        run: |
-          set -x
-          echo "=== Running S3 Integration Tests ==="
-          go test -v -timeout=60s -run TestS3Integration ./...
-
-      - name: Run IAM Integration Tests
-        timeout-minutes: 15
-        working-directory: test/s3/normal
-        run: |
-          set -x
-          echo "=== Running IAM Integration Tests ==="
-          go test -v -timeout=60s -run TestIAMOperations ./...
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v6
-        with:
-          name: integration-test-logs
-          path: test/s3/normal/*.log
-          retention-days: 3

.github/workflows/s3-iam-tests.yml

@@ -117,7 +117,7 @@ jobs:
             "basic")
               echo "Running basic IAM functionality tests..."
               make clean setup start-services wait-for-services
-              go test -v -timeout 15m -run "TestS3IAMAuthentication|TestS3IAMBasicWorkflow|TestS3IAMTokenValidation|TestIAM" ./...
+              go test -v -timeout 15m -run "TestS3IAMAuthentication|TestS3IAMBasicWorkflow|TestS3IAMTokenValidation" ./...
               ;;
             "advanced")
               echo "Running advanced IAM feature tests..."

.github/workflows/s3-policy-tests.yml

@@ -9,7 +9,6 @@ on:
       - 'weed/s3api/policy/**'
       - 'weed/iam/**'
       - 'test/s3/iam/**'
-      - 'test/s3/policy/**'
       - '.github/workflows/s3-policy-tests.yml'
   push:
     branches: [ master, main ]
@@ -20,7 +19,6 @@ on:
       - 'weed/s3api/policy/**'
       - 'weed/iam/**'
       - 'test/s3/iam/**'
-      - 'test/s3/policy/**'
       - '.github/workflows/s3-policy-tests.yml'
 
 concurrency:
@@ -391,36 +389,3 @@ jobs:
           name: trusted-proxy-test-logs
           path: /tmp/weed_proxy_test.log
           retention-days: 3
-
-  # S3 Policy Shell Integration Tests
-  s3-policy-shell-tests:
-    name: S3 Policy Shell Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false
-
-      - name: Run S3 Policy Shell Tests
-        timeout-minutes: 10
-        working-directory: test/s3/policy
-        run: |
-          set -x
-          echo "=== Running S3 Policy Shell Tests ==="
-
-          # Set WEED_BINARY to use the installed version (though test uses 'weed' command)
-          export WEED_BINARY=$(which weed)
-          export PATH=$PATH:$(dirname $WEED_BINARY)
-
-          go test -v -timeout 10m ./...

.gitignore

@@ -141,4 +141,3 @@ test/s3/iam/.test_env
 /test/erasure_coding/admin_dockertest/tmp
 /test/erasure_coding/admin_dockertest/task_logs
 weed_bin
-.aider*

BUCKET_POLICY_ENGINE_INTEGRATION.md

@@ -0,0 +1,242 @@
+# Bucket Policy Engine Integration - Complete
+
+## Summary
+
+Successfully integrated the `policy_engine` package to evaluate bucket policies for **all requests** (both anonymous and authenticated). This provides comprehensive AWS S3-compatible bucket policy support.
+
+## What Changed
+
+### 1. **New File: `s3api_bucket_policy_engine.go`**
+Created a wrapper around `policy_engine.PolicyEngine` to:
+- Load bucket policies from filer entries
+- Sync policies from the bucket config cache
+- Evaluate policies for any request (bucket, object, action, principal)
+- Return structured results (allowed, evaluated, error)
+
+### 2. **Modified: `s3api_server.go`**
+- Added `policyEngine *BucketPolicyEngine` field to `S3ApiServer` struct
+- Initialized the policy engine in `NewS3ApiServerWithStore()`
+- Linked `IdentityAccessManagement` back to `S3ApiServer` for policy evaluation
+
+### 3. **Modified: `auth_credentials.go`**
+- Added `s3ApiServer *S3ApiServer` field to `IdentityAccessManagement` struct
+- Added `buildPrincipalARN()` helper to convert identities to AWS ARN format
+- **Integrated bucket policy evaluation into the authentication flow:**
+  - Policies are now checked **before** IAM/identity-based permissions
+  - Explicit `Deny` in bucket policy blocks access immediately
+  - Explicit `Allow` in bucket policy grants access and **bypasses IAM checks** (enables cross-account access)
+  - If no policy exists, falls through to normal IAM checks
+  - Policy evaluation errors result in access denial (fail-close security)
+
+### 4. **Modified: `s3api_bucket_config.go`**
+- Added policy engine sync when bucket configs are loaded
+- Ensures policies are loaded into the engine for evaluation
+
+### 5. **Modified: `auth_credentials_subscribe.go`**
+- Added policy engine sync when bucket metadata changes
+- Keeps the policy engine up-to-date via event-driven updates
+
+## How It Works
+
+### Anonymous Requests
+```
+1. Request comes in (no credentials)
+2. Check ACL-based public access → if public, allow
+3. Check bucket policy for anonymous ("*") access → if allowed, allow
+4. Otherwise, deny
+```
+
+### Authenticated Requests (NEW!)
+```
+1. Request comes in (with credentials)
+2. Authenticate user → get Identity
+3. Build principal ARN (e.g., "arn:aws:iam::123456:user/bob")
+4. Check bucket policy:
+   - If DENY → reject immediately
+   - If ALLOW → grant access immediately (bypasses IAM checks)
+   - If no policy or no matching statements → continue to step 5
+5. Check IAM/identity-based permissions (only if not already allowed by bucket policy)
+6. Allow or deny based on identity permissions
+```
+
+## Policy Evaluation Flow
+
+```
+┌─────────────────────────────────────────────────────────┐
+│                   Request (GET /bucket/file)            │
+└───────────────────────────┬─────────────────────────────┘
+                            │
+                ┌───────────▼──────────┐
+                │  Authenticate User   │
+                │  (or Anonymous)      │
+                └───────────┬──────────┘
+                            │
+                ┌───────────▼──────────────────────────────┐
+                │  Build Principal ARN                     │
+                │  - Anonymous: "*"                        │
+                │  - User: "arn:aws:iam::123456:user/bob"  │
+                └───────────┬──────────────────────────────┘
+                            │
+                ┌───────────▼──────────────────────────────┐
+                │  Evaluate Bucket Policy (PolicyEngine)   │
+                │  - Action: "s3:GetObject"                │
+                │  - Resource: "arn:aws:s3:::bucket/file"  │
+                │  - Principal: (from above)               │
+                └───────────┬──────────────────────────────┘
+                            │
+              ┌─────────────┼─────────────┐
+              │             │             │
+         DENY │        ALLOW │        NO POLICY
+              │             │             │
+              ▼             ▼             ▼
+        Reject Request  Grant Access  Continue
+                                          │
+                      ┌───────────────────┘
+                      │
+         ┌────────────▼─────────────┐
+         │  IAM/Identity Check      │
+         │  (identity.canDo)        │
+         └────────────┬─────────────┘
+                      │
+            ┌─────────┴─────────┐
+            │                   │
+       ALLOW │              DENY │
+            ▼                   ▼
+     Grant Access        Reject Request
+```
+
+## Example Policies That Now Work
+
+### 1. **Public Read Access** (Anonymous)
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [{
+    "Effect": "Allow",
+    "Principal": "*",
+    "Action": "s3:GetObject",
+    "Resource": "arn:aws:s3:::mybucket/*"
+  }]
+}
+```
+- Anonymous users can read all objects
+- Authenticated users are also evaluated against this policy. If they don't match an explicit `Allow` for this action, they will fall back to their own IAM permissions
+
+### 2. **Grant Access to Specific User** (Authenticated)
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [{
+    "Effect": "Allow",
+    "Principal": {"AWS": "arn:aws:iam::123456789012:user/bob"},
+    "Action": ["s3:GetObject", "s3:PutObject"],
+    "Resource": "arn:aws:s3:::mybucket/shared/*"
+  }]
+}
+```
+- User "bob" can read/write objects in `/shared/` prefix
+- Other users cannot (unless granted by their IAM policies)
+
+### 3. **Deny Access to Specific Path** (Both)
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [{
+    "Effect": "Deny",
+    "Principal": "*",
+    "Action": "s3:*",
+    "Resource": "arn:aws:s3:::mybucket/confidential/*"
+  }]
+}
+```
+- **No one** can access `/confidential/` objects
+- Denies override all other allows (AWS policy evaluation rules)
+
+## Performance Characteristics
+
+### Policy Loading
+- **Cold start**: Policy loaded from filer → parsed → compiled → cached
+- **Warm path**: Policy retrieved from `BucketConfigCache` (already parsed)
+- **Updates**: Event-driven sync via metadata subscription (real-time)
+
+### Policy Evaluation
+- **Compiled policies**: Pre-compiled regex patterns and matchers
+- **Pattern cache**: Regex patterns cached with LRU eviction (max 1000)
+- **Fast path**: Common patterns (`*`, exact matches) optimized
+- **Case sensitivity**: Actions case-insensitive, resources case-sensitive (AWS-compatible)
+
+### Overhead
+- **Anonymous requests**: Minimal (policy already checked, now using compiled engine)
+- **Authenticated requests**: ~1-2ms added for policy evaluation (compiled patterns)
+- **No policy**: Near-zero overhead (quick indeterminate check)
+
+## Testing
+
+All tests pass:
+```bash
+✅ TestBucketPolicyValidationBasics
+✅ TestPrincipalMatchesAnonymous
+✅ TestActionToS3Action
+✅ TestResourceMatching
+✅ TestMatchesPatternRegexEscaping (security tests)
+✅ TestActionMatchingCaseInsensitive
+✅ TestResourceMatchingCaseSensitive
+✅ All policy_engine package tests (30+ tests)
+```
+
+## Security Improvements
+
+1. **Regex Metacharacter Escaping**: Patterns like `*.json` properly match only files ending in `.json` (not `filexjson`)
+2. **Case-Insensitive Actions**: S3 actions matched case-insensitively per AWS spec
+3. **Case-Sensitive Resources**: Resource paths matched case-sensitively for security
+4. **Pattern Cache Size Limit**: Prevents DoS attacks via unbounded cache growth
+5. **Principal Validation**: Supports `[]string` for manually constructed policies
+
+## AWS Compatibility
+
+The implementation follows AWS S3 bucket policy evaluation rules:
+1. **Explicit Deny** always wins (checked first)
+2. **Explicit Allow** grants access (checked second)
+3. **Default Deny** if no matching statements (implicit)
+4. Bucket policies work alongside IAM policies (both are evaluated)
+
+## Files Changed
+
+```
+Modified:
+  weed/s3api/auth_credentials.go           (+47 lines)
+  weed/s3api/auth_credentials_subscribe.go (+8 lines)
+  weed/s3api/s3api_bucket_config.go        (+8 lines)
+  weed/s3api/s3api_server.go               (+5 lines)
+
+New:
+  weed/s3api/s3api_bucket_policy_engine.go (115 lines)
+```
+
+## Migration Notes
+
+- **Backward Compatible**: Existing setups without bucket policies work unchanged
+- **No Breaking Changes**: All existing ACL and IAM-based authorization still works
+- **Additive Feature**: Bucket policies are an additional layer of authorization
+- **Performance**: Minimal impact on existing workloads
+
+## Future Enhancements
+
+Potential improvements (not implemented yet):
+- [ ] Condition support (IP address, time-based, etc.) - already in policy_engine
+- [ ] Cross-account policies (different AWS accounts)
+- [ ] Policy validation API endpoint
+- [ ] Policy simulation/testing tool
+- [ ] Metrics for policy evaluations (allow/deny counts)
+
+## Conclusion
+
+Bucket policies now work for **all requests** in SeaweedFS S3 API:
+- ✅ Anonymous requests (public access)
+- ✅ Authenticated requests (user-specific policies)
+- ✅ High performance (compiled policies, caching)
+- ✅ AWS-compatible (follows AWS evaluation rules)
+- ✅ Secure (proper escaping, case sensitivity)
+
+The integration is complete, tested, and ready for use!
+

DESIGN.md

@@ -0,0 +1,413 @@
+# SeaweedFS Task Distribution System Design
+
+## Overview
+
+This document describes the design of a distributed task management system for SeaweedFS that handles Erasure Coding (EC) and vacuum operations through a scalable admin server and worker process architecture.
+
+## System Architecture
+
+### High-Level Components
+
+```
+┌─────────────────┐    ┌──────────────────┐    ┌─────────────────┐
+│   Master        │◄──►│  Admin Server    │◄──►│   Workers       │
+│                 │    │                  │    │                 │
+│ - Volume Info   │    │ - Task Discovery │    │ - Task Exec     │
+│ - Shard Status  │    │ - Task Assign    │    │ - Progress      │
+│ - Heartbeats    │    │ - Progress Track │    │ - Error Report  │
+└─────────────────┘    └──────────────────┘    └─────────────────┘
+         │                        │                        │
+         │                        │                        │
+         ▼                        ▼                        ▼
+┌─────────────────┐    ┌──────────────────┐    ┌─────────────────┐
+│ Volume Servers  │    │ Volume Monitor   │    │ Task Execution  │
+│                 │    │                  │    │                 │
+│ - Store Volumes │    │ - Health Check   │    │ - EC Convert    │
+│ - EC Shards     │    │ - Usage Stats    │    │ - Vacuum Clean  │
+│ - Report Status │    │ - State Sync     │    │ - Status Report │
+└─────────────────┘    └──────────────────┘    └─────────────────┘
+```
+
+## 1. Admin Server Design
+
+### 1.1 Core Responsibilities
+
+- **Task Discovery**: Scan volumes to identify EC and vacuum candidates
+- **Worker Management**: Track available workers and their capabilities  
+- **Task Assignment**: Match tasks to optimal workers
+- **Progress Tracking**: Monitor in-progress tasks for capacity planning
+- **State Reconciliation**: Sync with master server for volume state updates
+
+### 1.2 Task Discovery Engine
+
+```go
+type TaskDiscoveryEngine struct {
+    masterClient   MasterClient
+    volumeScanner  VolumeScanner
+    taskDetectors  map[TaskType]TaskDetector
+    scanInterval   time.Duration
+}
+
+type VolumeCandidate struct {
+    VolumeID       uint32
+    Server         string
+    Collection     string
+    TaskType       TaskType
+    Priority       TaskPriority
+    Reason         string
+    DetectedAt     time.Time
+    Parameters     map[string]interface{}
+}
+```
+
+**EC Detection Logic**:
+- Find volumes >= 95% full and idle for > 1 hour
+- Exclude volumes already in EC format
+- Exclude volumes with ongoing operations
+- Prioritize by collection and age
+
+**Vacuum Detection Logic**:
+- Find volumes with garbage ratio > 30%
+- Exclude read-only volumes
+- Exclude volumes with recent vacuum operations
+- Prioritize by garbage percentage
+
+### 1.3 Worker Registry & Management
+
+```go
+type WorkerRegistry struct {
+    workers        map[string]*Worker
+    capabilities   map[TaskType][]*Worker
+    lastHeartbeat  map[string]time.Time
+    taskAssignment map[string]*Task
+    mutex          sync.RWMutex
+}
+
+type Worker struct {
+    ID            string
+    Address       string
+    Capabilities  []TaskType
+    MaxConcurrent int
+    CurrentLoad   int
+    Status        WorkerStatus
+    LastSeen      time.Time
+    Performance   WorkerMetrics
+}
+```
+
+### 1.4 Task Assignment Algorithm
+
+```go
+type TaskScheduler struct {
+    registry       *WorkerRegistry
+    taskQueue      *PriorityQueue
+    inProgressTasks map[string]*InProgressTask
+    volumeReservations map[uint32]*VolumeReservation
+}
+
+// Worker Selection Criteria:
+// 1. Has required capability (EC or Vacuum)
+// 2. Available capacity (CurrentLoad < MaxConcurrent)
+// 3. Best performance history for task type
+// 4. Lowest current load
+// 5. Geographically close to volume server (optional)
+```
+
+## 2. Worker Process Design
+
+### 2.1 Worker Architecture
+
+```go
+type MaintenanceWorker struct {
+    id              string
+    config          *WorkerConfig
+    adminClient     AdminClient
+    taskExecutors   map[TaskType]TaskExecutor
+    currentTasks    map[string]*RunningTask
+    registry        *TaskRegistry
+    heartbeatTicker *time.Ticker
+    requestTicker   *time.Ticker
+}
+```
+
+### 2.2 Task Execution Framework
+
+```go
+type TaskExecutor interface {
+    Execute(ctx context.Context, task *Task) error
+    EstimateTime(task *Task) time.Duration
+    ValidateResources(task *Task) error
+    GetProgress() float64
+    Cancel() error
+}
+
+type ErasureCodingExecutor struct {
+    volumeClient VolumeServerClient
+    progress     float64
+    cancelled    bool
+}
+
+type VacuumExecutor struct {
+    volumeClient VolumeServerClient
+    progress     float64
+    cancelled    bool
+}
+```
+
+### 2.3 Worker Capabilities & Registration
+
+```go
+type WorkerCapabilities struct {
+    SupportedTasks   []TaskType
+    MaxConcurrent    int
+    ResourceLimits   ResourceLimits
+    PreferredServers []string  // Affinity for specific volume servers
+}
+
+type ResourceLimits struct {
+    MaxMemoryMB      int64
+    MaxDiskSpaceMB   int64
+    MaxNetworkMbps   int64
+    MaxCPUPercent    float64
+}
+```
+
+## 3. Task Lifecycle Management
+
+### 3.1 Task States
+
+```go
+type TaskState string
+
+const (
+    TaskStatePending     TaskState = "pending"
+    TaskStateAssigned    TaskState = "assigned"
+    TaskStateInProgress  TaskState = "in_progress"
+    TaskStateCompleted   TaskState = "completed"
+    TaskStateFailed      TaskState = "failed"
+    TaskStateCancelled   TaskState = "cancelled"
+    TaskStateStuck       TaskState = "stuck"       // Taking too long
+    TaskStateDuplicate   TaskState = "duplicate"   // Detected duplicate
+)
+```
+
+### 3.2 Progress Tracking & Monitoring
+
+```go
+type InProgressTask struct {
+    Task           *Task
+    WorkerID       string
+    StartedAt      time.Time
+    LastUpdate     time.Time
+    Progress       float64
+    EstimatedEnd   time.Time
+    VolumeReserved bool  // Reserved for capacity planning
+}
+
+type TaskMonitor struct {
+    inProgressTasks map[string]*InProgressTask
+    timeoutChecker  *time.Ticker
+    stuckDetector   *time.Ticker
+    duplicateChecker *time.Ticker
+}
+```
+
+## 4. Volume Capacity Reconciliation
+
+### 4.1 Volume State Tracking
+
+```go
+type VolumeStateManager struct {
+    masterClient      MasterClient
+    inProgressTasks   map[uint32]*InProgressTask  // VolumeID -> Task
+    committedChanges  map[uint32]*VolumeChange    // Changes not yet in master
+    reconcileInterval time.Duration
+}
+
+type VolumeChange struct {
+    VolumeID     uint32
+    ChangeType   ChangeType  // "ec_encoding", "vacuum_completed"
+    OldCapacity  int64
+    NewCapacity  int64
+    TaskID       string
+    CompletedAt  time.Time
+    ReportedToMaster bool
+}
+```
+
+### 4.2 Shard Assignment Integration
+
+When the master needs to assign shards, it must consider:
+1. **Current volume state** from its own records
+2. **In-progress capacity changes** from admin server
+3. **Committed but unreported changes** from admin server
+
+```go
+type CapacityOracle struct {
+    adminServer   AdminServerClient
+    masterState   *MasterVolumeState
+    updateFreq    time.Duration
+}
+
+func (o *CapacityOracle) GetAdjustedCapacity(volumeID uint32) int64 {
+    baseCapacity := o.masterState.GetCapacity(volumeID)
+    
+    // Adjust for in-progress tasks
+    if task := o.adminServer.GetInProgressTask(volumeID); task != nil {
+        switch task.Type {
+        case TaskTypeErasureCoding:
+            // EC reduces effective capacity
+            return baseCapacity / 2  // Simplified
+        case TaskTypeVacuum:
+            // Vacuum may increase available space
+            return baseCapacity + int64(float64(baseCapacity) * 0.3)
+        }
+    }
+    
+    // Adjust for completed but unreported changes
+    if change := o.adminServer.GetPendingChange(volumeID); change != nil {
+        return change.NewCapacity
+    }
+    
+    return baseCapacity
+}
+```
+
+## 5. Error Handling & Recovery
+
+### 5.1 Worker Failure Scenarios
+
+```go
+type FailureHandler struct {
+    taskRescheduler *TaskRescheduler
+    workerMonitor   *WorkerMonitor
+    alertManager    *AlertManager
+}
+
+// Failure Scenarios:
+// 1. Worker becomes unresponsive (heartbeat timeout)
+// 2. Task execution fails (reported by worker)
+// 3. Task gets stuck (progress timeout)
+// 4. Duplicate task detection
+// 5. Resource exhaustion
+```
+
+### 5.2 Recovery Strategies
+
+**Worker Timeout Recovery**:
+- Mark worker as inactive after 3 missed heartbeats
+- Reschedule all assigned tasks to other workers
+- Cleanup any partial state
+
+**Task Stuck Recovery**:
+- Detect tasks with no progress for > 2x estimated time
+- Cancel stuck task and mark volume for cleanup
+- Reschedule if retry count < max_retries
+
+**Duplicate Task Prevention**:
+```go
+type DuplicateDetector struct {
+    activeFingerprints map[string]bool  // VolumeID+TaskType
+    recentCompleted    *LRUCache        // Recently completed tasks
+}
+
+func (d *DuplicateDetector) IsTaskDuplicate(task *Task) bool {
+    fingerprint := fmt.Sprintf("%d-%s", task.VolumeID, task.Type)
+    return d.activeFingerprints[fingerprint] || 
+           d.recentCompleted.Contains(fingerprint)
+}
+```
+
+## 6. Simulation & Testing Framework
+
+### 6.1 Failure Simulation
+
+```go
+type TaskSimulator struct {
+    scenarios map[string]SimulationScenario
+}
+
+type SimulationScenario struct {
+    Name            string
+    WorkerCount     int
+    VolumeCount     int
+    FailurePatterns []FailurePattern
+    Duration        time.Duration
+}
+
+type FailurePattern struct {
+    Type        FailureType  // "worker_timeout", "task_stuck", "duplicate"
+    Probability float64      // 0.0 to 1.0
+    Timing      TimingSpec   // When during task execution
+    Duration    time.Duration
+}
+```
+
+### 6.2 Test Scenarios
+
+**Scenario 1: Worker Timeout During EC**
+- Start EC task on 30GB volume
+- Kill worker at 50% progress
+- Verify task reassignment
+- Verify no duplicate EC operations
+
+**Scenario 2: Stuck Vacuum Task**
+- Start vacuum on high-garbage volume
+- Simulate worker hanging at 75% progress
+- Verify timeout detection and cleanup
+- Verify volume state consistency
+
+**Scenario 3: Duplicate Task Prevention**
+- Submit same EC task from multiple sources
+- Verify only one task executes
+- Verify proper conflict resolution
+
+**Scenario 4: Master-Admin State Divergence**
+- Create in-progress EC task
+- Simulate master restart
+- Verify state reconciliation
+- Verify shard assignment accounts for in-progress work
+
+## 7. Performance & Scalability
+
+### 7.1 Metrics & Monitoring
+
+```go
+type SystemMetrics struct {
+    TasksPerSecond     float64
+    WorkerUtilization  float64
+    AverageTaskTime    time.Duration
+    FailureRate        float64
+    QueueDepth         int
+    VolumeStatesSync   bool
+}
+```
+
+### 7.2 Scalability Considerations
+
+- **Horizontal Worker Scaling**: Add workers without admin server changes
+- **Admin Server HA**: Master-slave admin servers for fault tolerance
+- **Task Partitioning**: Partition tasks by collection or datacenter
+- **Batch Operations**: Group similar tasks for efficiency
+
+## 8. Implementation Plan
+
+### Phase 1: Core Infrastructure
+1. Admin server basic framework
+2. Worker registration and heartbeat
+3. Simple task assignment
+4. Basic progress tracking
+
+### Phase 2: Advanced Features
+1. Volume state reconciliation
+2. Sophisticated worker selection
+3. Failure detection and recovery
+4. Duplicate prevention
+
+### Phase 3: Optimization & Monitoring
+1. Performance metrics
+2. Load balancing algorithms
+3. Capacity planning integration
+4. Comprehensive monitoring
+
+This design provides a robust, scalable foundation for distributed task management in SeaweedFS while maintaining consistency with the existing architecture patterns. 

SQL_FEATURE_PLAN.md

@@ -0,0 +1,145 @@
+# SQL Query Engine Feature, Dev, and Test Plan
+
+This document outlines the plan for adding SQL querying support to SeaweedFS, focusing on reading and analyzing data from Message Queue (MQ) topics.
+
+## Feature Plan
+
+**1. Goal**
+
+To provide a SQL querying interface for SeaweedFS, enabling analytics on existing MQ topics. This enables:
+- Basic querying with SELECT, WHERE, aggregations on MQ topics
+- Schema discovery and metadata operations (SHOW DATABASES, SHOW TABLES, DESCRIBE)
+- In-place analytics on Parquet-stored messages without data movement
+
+**2. Key Features**
+
+*   **Schema Discovery and Metadata:**
+    *   `SHOW DATABASES` - List all MQ namespaces
+    *   `SHOW TABLES` - List all topics in a namespace  
+    *   `DESCRIBE table_name` - Show topic schema details
+    *   Automatic schema detection from existing Parquet data
+*   **Basic Query Engine:**
+    *   `SELECT` support with `WHERE`, `LIMIT`, `OFFSET`
+    *   Aggregation functions: `COUNT()`, `SUM()`, `AVG()`, `MIN()`, `MAX()`
+    *   Temporal queries with timestamp-based filtering
+*   **User Interfaces:**
+    *   New CLI command `weed sql` with interactive shell mode
+    *   Optional: Web UI for query execution and result visualization
+*   **Output Formats:**
+    *   JSON (default), CSV, Parquet for result sets
+    *   Streaming results for large queries
+    *   Pagination support for result navigation
+
+## Development Plan
+
+
+
+**3. Data Source Integration**
+
+*   **MQ Topic Connector (Primary):**
+    *   Build on existing `weed/mq/logstore/read_parquet_to_log.go`
+    *   Implement efficient Parquet scanning with predicate pushdown
+    *   Support schema evolution and backward compatibility
+    *   Handle partition-based parallelism for scalable queries
+*   **Schema Registry Integration:**
+    *   Extend `weed/mq/schema/schema.go` for SQL metadata operations
+    *   Read existing topic schemas for query planning
+    *   Handle schema evolution during query execution
+
+**4. API & CLI Integration**
+
+*   **CLI Command:**
+    *   New `weed sql` command with interactive shell mode (similar to `weed shell`)
+    *   Support for script execution and result formatting
+    *   Connection management for remote SeaweedFS clusters
+*   **gRPC API:**
+    *   Add SQL service to existing MQ broker gRPC interface
+    *   Enable efficient query execution with streaming results
+
+## Example Usage Scenarios
+
+**Scenario 1: Schema Discovery and Metadata**
+```sql
+-- List all namespaces (databases)
+SHOW DATABASES;
+
+-- List topics in a namespace
+USE my_namespace;
+SHOW TABLES;
+
+-- View topic structure and discovered schema
+DESCRIBE user_events;
+```
+
+**Scenario 2: Data Querying**
+```sql
+-- Basic filtering and projection
+SELECT user_id, event_type, timestamp 
+FROM user_events 
+WHERE timestamp > 1640995200000 
+LIMIT 100;
+
+-- Aggregation queries  
+SELECT COUNT(*) as event_count
+FROM user_events 
+WHERE timestamp >= 1640995200000;
+
+-- More aggregation examples
+SELECT MAX(timestamp), MIN(timestamp) 
+FROM user_events;
+```
+
+**Scenario 3: Analytics & Monitoring**
+```sql
+-- Basic analytics
+SELECT COUNT(*) as total_events
+FROM user_events 
+WHERE timestamp >= 1640995200000;
+
+-- Simple monitoring
+SELECT AVG(response_time) as avg_response
+FROM api_logs
+WHERE timestamp >= 1640995200000;
+
+## Architecture Overview
+
+```
+SQL Query Flow:
+                                  1. Parse SQL        2. Plan & Optimize      3. Execute Query
+┌─────────────┐    ┌──────────────┐    ┌─────────────────┐    ┌──────────────┐
+│   Client    │    │  SQL Parser  │    │  Query Planner  │    │   Execution  │
+│    (CLI)    │──→ │ PostgreSQL   │──→ │   & Optimizer   │──→ │    Engine    │
+│             │    │ (Custom)     │    │                 │    │              │
+└─────────────┘    └──────────────┘    └─────────────────┘    └──────────────┘
+                                               │                       │
+                                               │ Schema Lookup         │ Data Access
+                                               ▼                       ▼
+                    ┌─────────────────────────────────────────────────────────────┐
+                    │                    Schema Catalog                            │
+                    │  • Namespace → Database mapping                            │
+                    │  • Topic → Table mapping                                  │
+                    │  • Schema version management                              │
+                    └─────────────────────────────────────────────────────────────┘
+                                                                        ▲
+                                                                        │ Metadata
+                                                                        │
+┌─────────────────────────────────────────────────────────────────────────────┐
+│                          MQ Storage Layer                                      │
+│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐    ▲    │
+│  │   Topic A   │  │   Topic B   │  │   Topic C   │  │     ...     │    │    │
+│  │ (Parquet)   │  │ (Parquet)   │  │ (Parquet)   │  │ (Parquet)   │    │    │
+│  └─────────────┘  └─────────────┘  └─────────────┘  └─────────────┘    │    │
+└──────────────────────────────────────────────────────────────────────────│──┘
+                                                                          │
+                                                                     Data Access
+```
+
+
+## Success Metrics
+
+*   **Feature Completeness:** Support for all specified SELECT operations and metadata commands
+*   **Performance:** 
+    *   **Simple SELECT queries**: < 100ms latency for single-table queries with up to 3 WHERE predicates on ≤ 100K records
+    *   **Complex queries**: < 1s latency for queries involving aggregations (COUNT, SUM, MAX, MIN) on ≤ 1M records
+    *   **Time-range queries**: < 500ms for timestamp-based filtering on ≤ 500K records within 24-hour windows
+*   **Scalability:** Handle topics with millions of messages efficiently

docker/Dockerfile.local

@@ -4,7 +4,6 @@ COPY  ./weed /usr/bin/weed
 RUN chmod +x /usr/bin/weed && ls -la /usr/bin/weed
 RUN mkdir -p /etc/seaweedfs
 COPY ./filer.toml /etc/seaweedfs/filer.toml
-COPY ./security.toml.example /etc/seaweedfs/security.toml.example
 COPY ./entrypoint.sh /entrypoint.sh
 
 # Install dependencies and create non-root user

docker/security.toml.example

@@ -1,34 +0,0 @@
-# Put this file to one of the location, with descending priority
-#    ./security.toml
-#    $HOME/.seaweedfs/security.toml
-#    /etc/seaweedfs/security.toml
-# this file is read by master, volume server, filer, and worker
-
-# comma separated origins allowed to make requests to the filer and s3 gateway. 
-# enter in this format: https://domain.com, or http://localhost:port
-[cors.allowed_origins]
-values = "*"
-
-# this jwt signing key is read by master and volume server, and it is used for write operations:
-# - the Master server generates the JWT, which can be used to write a certain file on a volume server
-# - the Volume server validates the JWT on writing
-# the jwt defaults to expire after 10 seconds.
-[jwt.signing]
-key = "<REPLACE_AT_RUNTIME>"
-# this jwt signing key is read by master and volume server, and it is used for read operations:
-# - the Master server generates the JWT, which can be used to read a certain file on a volume server
-# - the Volume server validates the JWT on reading
-[jwt.signing.read]
-key = "<REPLACE_AT_RUNTIME>"
-# If this JWT key is configured, Filer only accepts writes over HTTP if they are signed with this JWT:
-# - f.e. the S3 API Shim generates the JWT
-# - the Filer server validates the JWT on writing
-# the jwt defaults to expire after 10 seconds.
-[jwt.filer_signing]
-key = "<REPLACE_AT_RUNTIME>"
-# If this JWT key is configured, Filer only accepts reads over HTTP if they are signed with this JWT:
-# - f.e. the S3 API Shim generates the JWT
-# - the Filer server validates the JWT on writing
-# the jwt defaults to expire after 10 seconds.
-[jwt.filer_signing.read]
-key = "<REPLACE_AT_RUNTIME>"

go.mod

@@ -39,7 +39,7 @@ require (
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
-	github.com/jackc/pgx/v5 v5.8.0
+	github.com/jackc/pgx/v5 v5.7.6
 	github.com/jcmturner/gofork v1.7.6 // indirect
 	github.com/jcmturner/gokrb5/v8 v8.4.4 // indirect
 	github.com/jinzhu/copier v0.4.0
@@ -92,12 +92,12 @@ require (
 	gocloud.dev v0.44.0
 	gocloud.dev/pubsub/natspubsub v0.44.0
 	gocloud.dev/pubsub/rabbitpubsub v0.44.0
-	golang.org/x/crypto v0.47.0
+	golang.org/x/crypto v0.46.0
 	golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546
 	golang.org/x/image v0.35.0
-	golang.org/x/net v0.49.0
+	golang.org/x/net v0.48.0
 	golang.org/x/oauth2 v0.34.0
-	golang.org/x/sys v0.40.0
+	golang.org/x/sys v0.39.0
 	golang.org/x/text v0.33.0 // indirect
 	golang.org/x/tools v0.40.0 // indirect
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
@@ -109,7 +109,7 @@ require (
 	modernc.org/b v1.0.0 // indirect
 	modernc.org/mathutil v1.7.1
 	modernc.org/memory v1.11.0 // indirect
-	modernc.org/sqlite v1.44.3
+	modernc.org/sqlite v1.44.2
 	modernc.org/strutil v1.2.1
 )
 
@@ -118,7 +118,7 @@ require (
 	github.com/Azure/azure-sdk-for-go/sdk/keyvault/azkeys v0.10.0
 	github.com/Jille/raft-grpc-transport v1.6.1
 	github.com/ThreeDotsLabs/watermill v1.5.1
-	github.com/a-h/templ v0.3.977
+	github.com/a-h/templ v0.3.943
 	github.com/apache/cassandra-gocql-driver/v2 v2.0.0
 	github.com/apple/foundationdb/bindings/go v0.0.0-20250911184653-27f7192f47c3
 	github.com/arangodb/go-driver v1.6.9
@@ -157,7 +157,7 @@ require (
 	github.com/tikv/client-go/v2 v2.0.7
 	github.com/xeipuuv/gojsonschema v1.2.0
 	github.com/ydb-platform/ydb-go-sdk-auth-environ v0.5.1
-	github.com/ydb-platform/ydb-go-sdk/v3 v3.125.3
+	github.com/ydb-platform/ydb-go-sdk/v3 v3.125.1
 	go.etcd.io/etcd/client/pkg/v3 v3.6.7
 	go.uber.org/atomic v1.11.0
 	golang.org/x/sync v0.19.0
@@ -249,7 +249,7 @@ require (
 	cloud.google.com/go/iam v1.5.3 // indirect
 	cloud.google.com/go/monitoring v1.24.2 // indirect
 	filippo.io/edwards25519 v1.1.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0
 	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1
 	github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.3
@@ -291,7 +291,7 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/sso v1.30.9 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.13 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sts v1.41.6 // indirect
-	github.com/aws/smithy-go v1.24.0
+	github.com/aws/smithy-go v1.24.0 // indirect
 	github.com/boltdb/bolt v1.3.1 // indirect
 	github.com/bradenaw/juniper v0.15.3 // indirect
 	github.com/bradfitz/iter v0.0.0-20191230175014-e8f45d346db8 // indirect
@@ -460,7 +460,7 @@ require (
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
 	golang.org/x/arch v0.20.0 // indirect
-	golang.org/x/term v0.39.0 // indirect
+	golang.org/x/term v0.38.0 // indirect
 	golang.org/x/time v0.14.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20251111163417-95abcf5c77ba // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20251213004720-97cd9d5aeac2 // indirect

go.sum

@@ -541,8 +541,8 @@ filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
 filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
 gioui.org v0.0.0-20210308172011-57750fc8a0a6/go.mod h1:RSH6KIUZ0p2xy5zHDxgAM4zumjgTw83q2ge/PI+yyw8=
 git.sr.ht/~sbinet/gg v0.3.1/go.mod h1:KGYtlADtqsqANL9ueOFkWymvzUvLMQllU5Ixo+8v3pc=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0 h1:fou+2+WFTib47nS+nz/ozhEBnvU96bKHy6LjRsY4E28=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0/go.mod h1:t76Ruy8AHvUAC8GfMWJMa0ElSbuIcO03NLpynfbgsPA=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 h1:JXg2dwJUmPB9JmtVmdEB16APJ7jurfbY5jnfXpJoRMc=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0/go.mod h1:YD5h/ldMsG0XiIw7PdyNhLxaM317eFh5yNLccNfGdyw=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 h1:Hk5QBxZQC1jb2Fwj6mpzme37xbCDdNTxU7O9eb5+LB4=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1/go.mod h1:IYus9qsFobWIc2YVwe/WPjcnyCkPKtnHAqUYeebc8z0=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2 h1:yz1bePFlP5Vws5+8ez6T3HWXPmwOK7Yvq8QxDBD3SKY=
@@ -628,8 +628,8 @@ github.com/ThreeDotsLabs/watermill v1.5.1 h1:t5xMivyf9tpmU3iozPqyrCZXHvoV1XQDfih
 github.com/ThreeDotsLabs/watermill v1.5.1/go.mod h1:Uop10dA3VeJWsSvis9qO3vbVY892LARrKAdki6WtXS4=
 github.com/TomiHiltunen/geohash-golang v0.0.0-20150112065804-b3e4e625abfb h1:wumPkzt4zaxO4rHPBrjDK8iZMR41C1qs7njNqlacwQg=
 github.com/TomiHiltunen/geohash-golang v0.0.0-20150112065804-b3e4e625abfb/go.mod h1:QiYsIBRQEO+Z4Rz7GoI+dsHVneZNONvhczuA+llOZNM=
-github.com/a-h/templ v0.3.977 h1:kiKAPXTZE2Iaf8JbtM21r54A8bCNsncrfnokZZSrSDg=
-github.com/a-h/templ v0.3.977/go.mod h1:oCZcnKRf5jjsGpf2yELzQfodLphd2mwecwG4Crk5HBo=
+github.com/a-h/templ v0.3.943 h1:o+mT/4yqhZ33F3ootBiHwaY4HM5EVaOJfIshvd5UNTY=
+github.com/a-h/templ v0.3.943/go.mod h1:oCZcnKRf5jjsGpf2yELzQfodLphd2mwecwG4Crk5HBo=
 github.com/a1ex3/zstd-seekable-format-go/pkg v0.10.0 h1:iLDOF0rdGTrol/q8OfPIIs5kLD8XvA2q75o6Uq/tgak=
 github.com/a1ex3/zstd-seekable-format-go/pkg v0.10.0/go.mod h1:DrEWcQJjz7t5iF2duaiyhg4jyoF0kxOD6LtECNGkZ/Q=
 github.com/aalpar/deheap v0.0.0-20210914013432-0cc84d79dec3 h1:hhdWprfSpFbN7lz3W1gM40vOgvSh1WCSMxYD6gGB4Hs=
@@ -1281,8 +1281,8 @@ github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsI
 github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
-github.com/jackc/pgx/v5 v5.8.0 h1:TYPDoleBBme0xGSAX3/+NujXXtpZn9HBONkQC7IEZSo=
-github.com/jackc/pgx/v5 v5.8.0/go.mod h1:QVeDInX2m9VyzvNeiCJVjCkNFqzsNb43204HshNSZKw=
+github.com/jackc/pgx/v5 v5.7.6 h1:rWQc5FwZSPX58r1OQmkuaNicxdmExaEz5A2DO2hUuTk=
+github.com/jackc/pgx/v5 v5.7.6/go.mod h1:aruU7o91Tc2q2cFp5h4uP3f6ztExVpyVv88Xl/8Vl8M=
 github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
 github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
 github.com/jaegertracing/jaeger v1.47.0 h1:XXxTMO+GxX930gxKWsg90rFr6RswkCRIW0AgWFnTYsg=
@@ -1820,8 +1820,8 @@ github.com/ydb-platform/ydb-go-sdk-auth-environ v0.5.1 h1:XaRxeVrOyl3y6v9CiYMWaF
 github.com/ydb-platform/ydb-go-sdk-auth-environ v0.5.1/go.mod h1:9YzkhlIymWaJGX6KMU3vh5sOf3UKbCXkG/ZdjaI3zNM=
 github.com/ydb-platform/ydb-go-sdk/v3 v3.44.0/go.mod h1:oSLwnuilwIpaF5bJJMAofnGgzPJusoI3zWMNb8I+GnM=
 github.com/ydb-platform/ydb-go-sdk/v3 v3.47.3/go.mod h1:bWnOIcUHd7+Sl7DN+yhyY1H/I61z53GczvwJgXMgvj0=
-github.com/ydb-platform/ydb-go-sdk/v3 v3.125.3 h1:hTwpF+PdbuR7vcixN+4AC6yu4asaUIAljQCxL51eDII=
-github.com/ydb-platform/ydb-go-sdk/v3 v3.125.3/go.mod h1:stS1mQYjbJvwwYaYzKyFY9eMiuVXWWXQA6T+SpOLg9c=
+github.com/ydb-platform/ydb-go-sdk/v3 v3.125.1 h1:YaqzRVbcncabB34YNjOl5ADomYUFva+6l74svIIIJUo=
+github.com/ydb-platform/ydb-go-sdk/v3 v3.125.1/go.mod h1:stS1mQYjbJvwwYaYzKyFY9eMiuVXWWXQA6T+SpOLg9c=
 github.com/ydb-platform/ydb-go-yc v0.12.1 h1:qw3Fa+T81+Kpu5Io2vYHJOwcrYrVjgJlT6t/0dOXJrA=
 github.com/ydb-platform/ydb-go-yc v0.12.1/go.mod h1:t/ZA4ECdgPWjAb4jyDe8AzQZB5dhpGbi3iCahFaNwBY=
 github.com/ydb-platform/ydb-go-yc-metadata v0.6.1 h1:9E5q8Nsy2RiJMZDNVy0A3KUrIMBPakJ2VgloeWbcI84=
@@ -1953,8 +1953,8 @@ golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.47.0 h1:V6e3FRj+n4dbpw86FJ8Fv7XVOql7TEwpHapKoMJ/GO8=
-golang.org/x/crypto v0.47.0/go.mod h1:ff3Y9VzzKbwSSEzWqJsJVBnWmRwRSHt/6Op5n9bQc4A=
+golang.org/x/crypto v0.46.0 h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU=
+golang.org/x/crypto v0.46.0/go.mod h1:Evb/oLKmMraqjZ2iQTwDwvCtJkczlDuTmdJXoZVzqU0=
 golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20180807140117-3d87b88a115f/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -2090,8 +2090,8 @@ golang.org/x/net v0.16.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
 golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
-golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o=
-golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8=
+golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU=
+golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -2248,8 +2248,8 @@ golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ=
-golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk=
+golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -2264,8 +2264,8 @@ golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
-golang.org/x/term v0.39.0 h1:RclSuaJf32jOqZz74CkPA9qFuVTX7vhLlpfj/IGWlqY=
-golang.org/x/term v0.39.0/go.mod h1:yxzUCTP/U+FzoxfdKmLaA0RV1WgE0VY7hXBwKtY/4ww=
+golang.org/x/term v0.38.0 h1:PQ5pkm/rLO6HnxFR7N2lJHOZX6Kez5Y1gDSJla6jo7Q=
+golang.org/x/term v0.38.0/go.mod h1:bSEAKrOT1W+VSu9TSCMtoGEOUcKxOKgl3LE5QEF/xVg=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -2748,8 +2748,8 @@ modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
 modernc.org/sqlite v1.18.1/go.mod h1:6ho+Gow7oX5V+OiOQ6Tr4xeqbx13UZ6t+Fw9IRUG4d4=
-modernc.org/sqlite v1.44.3 h1:+39JvV/HWMcYslAwRxHb8067w+2zowvFOUrOWIy9PjY=
-modernc.org/sqlite v1.44.3/go.mod h1:CzbrU2lSB1DKUusvwGz7rqEKIq+NUd8GWuBBZDs9/nA=
+modernc.org/sqlite v1.44.2 h1:EdYqXeBpKFJjg8QYnw6E71MpANkoxyuYi+g68ugOL8g=
+modernc.org/sqlite v1.44.2/go.mod h1:CzbrU2lSB1DKUusvwGz7rqEKIq+NUd8GWuBBZDs9/nA=
 modernc.org/strutil v1.1.0/go.mod h1:lstksw84oURvj9y3tn8lGvRxyRC1S2+g5uuIzNfIOBs=
 modernc.org/strutil v1.1.1/go.mod h1:DE+MQQ/hjKBZS2zNInV5hhcipt5rLPWkmpbGeW5mmdw=
 modernc.org/strutil v1.1.3/go.mod h1:MEHNA7PdEnEwLvspRMtWTNnp2nnyvMfkimT1NKNAGbw=

k8s/charts/seaweedfs/README.md

@@ -24,7 +24,7 @@ helm install --values=values.yaml seaweedfs seaweedfs/seaweedfs
 * master/filer/volume are stateful sets with anti-affinity on the hostname,
 so your deployment will be spread/HA.
 * chart is using memsql(mysql) as the filer backend to enable HA (multiple filer instances) and backup/HA memsql can provide.
-* mysql user/password are created in a k8s secret (default: `<release>-seaweedfs-db-secret`) and injected to the filer with ENV.
+* mysql user/password are created in a k8s secret (secret-seaweedfs-db.yaml) and injected to the filer with ENV.
 * cert config exists and can be enabled, but not been tested, requires cert-manager to be installed.
 
 ## Prerequisites
@@ -35,9 +35,7 @@ leveldb is the default database, this supports multiple filer replicas that will
 When the [limitations](https://github.com/seaweedfs/seaweedfs/wiki/Filer-Store-Replication#limitation) apply, or for a large number of filer replicas, an external datastore is recommended.
 
 Such as MySQL-compatible database, as specified in the `values.yaml` at `filer.extraEnvironmentVars`.
-This database should be pre-configured and initialized. If using the default `db-init-config`, the configmap name is now dynamic (e.g., `<release>-seaweedfs-db-init-config`). You can override this name via `filer.dbInitConfigName`.
-
-To initialize manually:
+This database should be pre-configured and initialized by running:
 ```sql
 CREATE TABLE IF NOT EXISTS `filemeta` (
   `dirhash`   BIGINT NOT NULL       COMMENT 'first 64 bits of MD5 hash value of directory field',

k8s/charts/seaweedfs/templates/admin/admin-ingress.yaml

@@ -8,7 +8,7 @@ apiVersion: extensions/v1beta1
 {{- end }}
 kind: Ingress
 metadata:
-  name: ingress-{{ include "seaweedfs.fullname" . }}-admin
+  name: ingress-{{ template "seaweedfs.name" . }}-admin
   namespace: {{ .Release.Namespace }}
   annotations:
   {{- if and (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) .Values.admin.ingress.className }}
@@ -42,11 +42,11 @@ spec:
         backend:
 {{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion }}
           service:
-            name: {{ include "seaweedfs.fullname" . }}-admin
+            name: {{ template "seaweedfs.name" . }}-admin
             port:
               number: {{ .Values.admin.port }}
 {{- else }}
-          serviceName: {{ include "seaweedfs.fullname" . }}-admin
+          serviceName: {{ template "seaweedfs.name" . }}-admin
           servicePort: {{ .Values.admin.port }}
 {{- end }}
 {{- end }}

k8s/charts/seaweedfs/templates/admin/admin-secret.yaml

@@ -3,7 +3,7 @@ apiVersion: v1
 kind: Secret
 type: Opaque
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-admin-secret
+  name: {{ template "seaweedfs.name" . }}-admin-secret
   namespace: {{ .Release.Namespace }}
   annotations:
     "helm.sh/resource-policy": keep

k8s/charts/seaweedfs/templates/admin/admin-service.yaml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ printf "%s-admin" (include "seaweedfs.fullname" .) | trunc 63 | trimSuffix "-" }}
+  name: {{ template "seaweedfs.name" . }}-admin
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}

k8s/charts/seaweedfs/templates/admin/admin-servicemonitor.yaml

@@ -3,7 +3,7 @@
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-admin
+  name: {{ template "seaweedfs.name" . }}-admin
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -26,7 +26,6 @@ spec:
   selector:
     matchLabels:
       app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-      app.kubernetes.io/instance: {{ .Release.Name }}
       app.kubernetes.io/component: admin
 {{- end }}
 {{- end }}

k8s/charts/seaweedfs/templates/admin/admin-statefulset.yaml

@@ -1,14 +1,11 @@
 {{- if .Values.admin.enabled }}
-{{- if gt (.Values.admin.replicas | int) 1 }}
-{{- fail "admin.replicas must be 0 or 1" -}}
-{{- end }}
 {{- if and (not .Values.admin.masters) (not .Values.global.masterServer) (not .Values.master.enabled) }}
 {{- fail "admin.masters or global.masterServer must be set if master.enabled is false" -}}
 {{- end }}
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-admin
+  name: {{ template "seaweedfs.name" . }}-admin
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -21,7 +18,7 @@ metadata:
     {{- toYaml .Values.admin.annotations | nindent 4 }}
 {{- end }}
 spec:
-  serviceName: {{ include "seaweedfs.fullname" . }}-admin
+  serviceName: {{ template "seaweedfs.name" . }}-admin
   podManagementPolicy: {{ .Values.admin.podManagementPolicy }}
   replicas: {{ .Values.admin.replicas }}
   selector:
@@ -90,7 +87,7 @@ spec:
           {{- if and .Values.admin.secret.existingSecret (not .Values.admin.secret.pwKey) -}}
           {{-   fail "admin.secret.pwKey must be set when admin.secret.existingSecret is provided" -}}
           {{- end -}}
-          {{- $adminSecretName := .Values.admin.secret.existingSecret | default (printf "%s-admin-secret" (include "seaweedfs.fullname" .)) }}
+          {{- $adminSecretName := .Values.admin.secret.existingSecret | default (printf "%s-admin-secret" (include "seaweedfs.name" .)) }}
           env:
             {{- if $adminAuthEnabled }}
             - name: SEAWEEDFS_ADMIN_USER
@@ -117,7 +114,7 @@ spec:
                 fieldRef:
                   fieldPath: metadata.namespace
             - name: SEAWEEDFS_FULLNAME
-              value: "{{ include "seaweedfs.fullname" . }}"
+              value: "{{ template "seaweedfs.name" . }}"
             {{- if .Values.admin.extraEnvironmentVars }}
             {{- range $key, $value := .Values.admin.extraEnvironmentVars }}
             - name: {{ $key }}
@@ -284,25 +281,25 @@ spec:
         {{- if .Values.global.enableSecurity }}
         - name: security-config
           configMap:
-            name: {{ include "seaweedfs.fullname" . }}-security-config
+            name: {{ template "seaweedfs.name" . }}-security-config
         - name: ca-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
+            secretName: {{ template "seaweedfs.name" . }}-ca-cert
         - name: master-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-master-cert
+            secretName: {{ template "seaweedfs.name" . }}-master-cert
         - name: volume-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-volume-cert
+            secretName: {{ template "seaweedfs.name" . }}-volume-cert
         - name: filer-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-filer-cert
+            secretName: {{ template "seaweedfs.name" . }}-filer-cert
         - name: client-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-client-cert
+            secretName: {{ template "seaweedfs.name" . }}-client-cert
         - name: admin-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-admin-cert
+            secretName: {{ template "seaweedfs.name" . }}-admin-cert
         {{- end }}
         {{ tpl .Values.admin.extraVolumes . | indent 8 | trim }}
       {{- if .Values.admin.nodeSelector }}

k8s/charts/seaweedfs/templates/all-in-one/all-in-one-deployment.yaml

@@ -2,7 +2,7 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-all-in-one
+  name: {{ template "seaweedfs.name" . }}-all-in-one
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -98,7 +98,7 @@ spec:
                 fieldRef:
                   fieldPath: metadata.namespace
             - name: SEAWEEDFS_FULLNAME
-              value: "{{ include "seaweedfs.fullname" . }}"
+              value: "{{ template "seaweedfs.name" . }}"
             {{- if .Values.allInOne.extraEnvironmentVars }}
             {{- range $key, $value := .Values.allInOne.extraEnvironmentVars }}
             {{- if and (ne $key $clusterMasterKey) (ne $key $clusterFilerKey) }}
@@ -421,7 +421,7 @@ spec:
             type: DirectoryOrCreate
           {{- else if eq .Values.allInOne.data.type "persistentVolumeClaim" }}
           persistentVolumeClaim:
-            claimName: {{ include "seaweedfs.fullname" . }}-all-in-one-data
+            claimName: {{ template "seaweedfs.name" . }}-all-in-one-data
           {{- else if eq .Values.allInOne.data.type "existingClaim" }}
           persistentVolumeClaim:
             claimName: {{ .Values.allInOne.data.claimName }}
@@ -432,47 +432,47 @@ spec:
         - name: config-s3-users
           secret:
             defaultMode: 420
-            secretName: {{ default (printf "%s-s3-secret" (include "seaweedfs.fullname" .)) (or .Values.allInOne.s3.existingConfigSecret .Values.s3.existingConfigSecret .Values.filer.s3.existingConfigSecret) }}
+            secretName: {{ default (printf "%s-s3-secret" (include "seaweedfs.name" .)) (or .Values.allInOne.s3.existingConfigSecret .Values.s3.existingConfigSecret .Values.filer.s3.existingConfigSecret) }}
         {{- end }}
         {{- if .Values.allInOne.sftp.enabled }}
         - name: config-ssh
           secret:
             defaultMode: 420
-            secretName: {{ default (printf "%s-sftp-ssh-secret" (include "seaweedfs.fullname" .)) (or .Values.allInOne.sftp.existingSshConfigSecret .Values.sftp.existingSshConfigSecret) }}
+            secretName: {{ default (printf "%s-sftp-ssh-secret" (include "seaweedfs.name" .)) (or .Values.allInOne.sftp.existingSshConfigSecret .Values.sftp.existingSshConfigSecret) }}
         {{- if or .Values.allInOne.sftp.enableAuth .Values.sftp.enableAuth }}
         - name: config-users
           secret:
             defaultMode: 420
-            secretName: {{ default (printf "%s-sftp-secret" (include "seaweedfs.fullname" .)) (or .Values.allInOne.sftp.existingConfigSecret .Values.sftp.existingConfigSecret) }}
+            secretName: {{ default (printf "%s-sftp-secret" (include "seaweedfs.name" .)) (or .Values.allInOne.sftp.existingConfigSecret .Values.sftp.existingConfigSecret) }}
         {{- end }}
         {{- end }}
         {{- if .Values.filer.notificationConfig }}
         - name: notification-config
           configMap:
-            name: {{ include "seaweedfs.fullname" . }}-notification-config
+            name: {{ template "seaweedfs.name" . }}-notification-config
         {{- end }}
         - name: master-config
           configMap:
-            name: {{ include "seaweedfs.fullname" . }}-master-config
+            name: {{ template "seaweedfs.name" . }}-master-config
         {{- if .Values.global.enableSecurity }}
         - name: security-config
           configMap:
-            name: {{ include "seaweedfs.fullname" . }}-security-config
+            name: {{ template "seaweedfs.name" . }}-security-config
         - name: ca-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
+            secretName: {{ template "seaweedfs.name" . }}-ca-cert
         - name: master-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-master-cert
+            secretName: {{ template "seaweedfs.name" . }}-master-cert
         - name: volume-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-volume-cert
+            secretName: {{ template "seaweedfs.name" . }}-volume-cert
         - name: filer-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-filer-cert
+            secretName: {{ template "seaweedfs.name" . }}-filer-cert
         - name: client-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-client-cert
+            secretName: {{ template "seaweedfs.name" . }}-client-cert
         {{- end }}
         {{ tpl .Values.allInOne.extraVolumes . | nindent 8 }}
       {{- if .Values.allInOne.nodeSelector }}

k8s/charts/seaweedfs/templates/all-in-one/all-in-one-pvc.yaml

@@ -3,7 +3,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-all-in-one-data
+  name: {{ template "seaweedfs.name" . }}-all-in-one-data
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}

k8s/charts/seaweedfs/templates/all-in-one/all-in-one-service.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ printf "%s-all-in-one" (include "seaweedfs.fullname" .) | trunc 63 | trimSuffix "-" }}
+  name: {{ template "seaweedfs.name" . }}-all-in-one
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -81,6 +81,5 @@ spec:
   
   selector:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: seaweedfs-all-in-one
 {{- end }}

k8s/charts/seaweedfs/templates/all-in-one/all-in-one-servicemonitor.yaml

@@ -3,7 +3,7 @@
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-all-in-one
+  name: {{ template "seaweedfs.name" . }}-all-in-one
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -24,7 +24,6 @@ spec:
   selector:
     matchLabels:
       app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-      app.kubernetes.io/instance: {{ .Release.Name }}
       app.kubernetes.io/component: seaweedfs-all-in-one
 {{- end }}
 {{- end }}

k8s/charts/seaweedfs/templates/cert/admin-cert.yaml

@@ -2,7 +2,7 @@
 apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Certificate
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-admin-cert
+  name: {{ template "seaweedfs.name" . }}-admin-cert
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -15,19 +15,19 @@ metadata:
     {{- toYaml .Values.admin.annotations | nindent 4 }}
   {{- end }}
 spec:
-  secretName: {{ include "seaweedfs.fullname" . }}-admin-cert
+  secretName: {{ template "seaweedfs.name" . }}-admin-cert
   issuerRef:
-    name: {{ include "seaweedfs.fullname" . }}-ca-issuer
+    name: {{ template "seaweedfs.name" . }}-ca-issuer
     kind: Issuer
   commonName: {{ .Values.certificates.commonName }}
   subject:
     organizations:
     - "SeaweedFS CA"
   dnsNames:
-    - '*.{{ include "seaweedfs.fullname" . }}-admin'
-    - '*.{{ include "seaweedfs.fullname" . }}-admin.{{ .Release.Namespace }}'
-    - '*.{{ include "seaweedfs.fullname" . }}-admin.{{ .Release.Namespace }}.svc'
-    - '*.{{ include "seaweedfs.fullname" . }}-admin.{{ .Release.Namespace }}.svc.cluster.local'
+    - '*.{{ template "seaweedfs.name" . }}-admin'
+    - '*.{{ template "seaweedfs.name" . }}-admin.{{ .Release.Namespace }}'
+    - '*.{{ template "seaweedfs.name" . }}-admin.{{ .Release.Namespace }}.svc'
+    - '*.{{ template "seaweedfs.name" . }}-admin.{{ .Release.Namespace }}.svc.cluster.local'
 {{- if .Values.certificates.ipAddresses }}
   ipAddresses:
     {{- range .Values.certificates.ipAddresses }}

k8s/charts/seaweedfs/templates/cert/ca-cert.yaml

@@ -2,7 +2,7 @@
 apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Certificate
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-ca-cert
+  name: {{ template "seaweedfs.name" . }}-ca-cert
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -10,8 +10,8 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
 spec:
-  secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
-  commonName: "{{ include "seaweedfs.fullname" . }}-root-ca"
+  secretName: {{ template "seaweedfs.name" . }}-ca-cert
+  commonName: "{{ template "seaweedfs.name" . }}-root-ca"
   isCA: true
   {{- if .Values.certificates.ca.duration }}
   duration: {{ .Values.certificates.ca.duration }}
@@ -20,6 +20,6 @@ spec:
   renewBefore: {{ .Values.certificates.ca.renewBefore }}
   {{- end }}
   issuerRef:
-    name: {{ include "seaweedfs.fullname" . }}-issuer
+    name: {{ template "seaweedfs.name" . }}-issuer
     kind: Issuer
 {{- end }}

k8s/charts/seaweedfs/templates/cert/cert-caissuer.yaml

@@ -2,7 +2,7 @@
 apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Issuer
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-ca-issuer
+  name: {{ template "seaweedfs.name" . }}-ca-issuer
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -11,5 +11,5 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
 spec:
   ca:
-    secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
+    secretName: {{ template "seaweedfs.name" . }}-ca-cert
 {{- end }}

k8s/charts/seaweedfs/templates/cert/cert-issuer.yaml

@@ -2,7 +2,7 @@
 apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Issuer
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-issuer
+  name: {{ template "seaweedfs.name" . }}-issuer
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}

k8s/charts/seaweedfs/templates/cert/client-cert.yaml

@@ -2,7 +2,7 @@
 apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Certificate
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-client-cert
+  name: {{ template "seaweedfs.name" . }}-client-cert
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -10,9 +10,9 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
 spec:
-  secretName: {{ include "seaweedfs.fullname" . }}-client-cert
+  secretName: {{ template "seaweedfs.name" . }}-client-cert
   issuerRef:
-    name: {{ include "seaweedfs.fullname" . }}-ca-issuer
+    name: {{ template "seaweedfs.name" . }}-ca-issuer
     kind: Issuer
   commonName: {{ .Values.certificates.commonName }}
   subject:
@@ -22,10 +22,10 @@ spec:
     - '*.{{ .Release.Namespace }}'
     - '*.{{ .Release.Namespace }}.svc'
     - '*.{{ .Release.Namespace }}.svc.cluster.local'
-    - '*.{{ include "seaweedfs.fullname" . }}-master'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc.cluster.local'
+    - '*.{{ template "seaweedfs.name" . }}-master'
+    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}'
+    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}.svc'
+    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}.svc.cluster.local'
 {{- if .Values.certificates.ipAddresses }}
   ipAddresses:
     {{- range .Values.certificates.ipAddresses }}

k8s/charts/seaweedfs/templates/cert/filer-cert.yaml

@@ -2,7 +2,7 @@
 apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Certificate
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-filer-cert
+  name: {{ template "seaweedfs.name" . }}-filer-cert
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -15,9 +15,9 @@ metadata:
     {{- toYaml .Values.filer.annotations | nindent 4 }}
   {{- end }}
 spec:
-  secretName: {{ include "seaweedfs.fullname" . }}-filer-cert
+  secretName: {{ template "seaweedfs.name" . }}-filer-cert
   issuerRef:
-    name: {{ include "seaweedfs.fullname" . }}-ca-issuer
+    name: {{ template "seaweedfs.name" . }}-ca-issuer
     kind: Issuer
   commonName: {{ .Values.certificates.commonName }}
   subject:
@@ -27,10 +27,10 @@ spec:
     - '*.{{ .Release.Namespace }}'
     - '*.{{ .Release.Namespace }}.svc'
     - '*.{{ .Release.Namespace }}.svc.cluster.local'
-    - '*.{{ include "seaweedfs.fullname" . }}-master'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc.cluster.local'
+    - '*.{{ template "seaweedfs.name" . }}-master'
+    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}'
+    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}.svc'
+    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}.svc.cluster.local'
 {{- if .Values.certificates.ipAddresses }}
   ipAddresses:
     {{- range .Values.certificates.ipAddresses }}

k8s/charts/seaweedfs/templates/cert/master-cert.yaml

@@ -2,7 +2,7 @@
 apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Certificate
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-master-cert
+  name: {{ template "seaweedfs.name" . }}-master-cert
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -15,9 +15,9 @@ metadata:
     {{- toYaml .Values.master.annotations | nindent 4 }}
 {{- end }}
 spec:
-  secretName: {{ include "seaweedfs.fullname" . }}-master-cert
+  secretName: {{ template "seaweedfs.name" . }}-master-cert
   issuerRef:
-    name: {{ include "seaweedfs.fullname" . }}-ca-issuer
+    name: {{ template "seaweedfs.name" . }}-ca-issuer
     kind: Issuer
   commonName: {{ .Values.certificates.commonName }}
   subject:
@@ -27,10 +27,10 @@ spec:
     - '*.{{ .Release.Namespace }}'
     - '*.{{ .Release.Namespace }}.svc'
     - '*.{{ .Release.Namespace }}.svc.cluster.local'
-    - '*.{{ include "seaweedfs.fullname" . }}-master'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc.cluster.local'
+    - '*.{{ template "seaweedfs.name" . }}-master'
+    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}'
+    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}.svc'
+    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}.svc.cluster.local'
 {{- if .Values.certificates.ipAddresses }}
   ipAddresses:
     {{- range .Values.certificates.ipAddresses }}

k8s/charts/seaweedfs/templates/cert/volume-cert.yaml

@@ -2,7 +2,7 @@
 apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Certificate
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-volume-cert
+  name: {{ template "seaweedfs.name" . }}-volume-cert
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -15,9 +15,9 @@ metadata:
     {{- toYaml .Values.volume.annotations | nindent 4 }}
 {{- end }}
 spec:
-  secretName: {{ include "seaweedfs.fullname" . }}-volume-cert
+  secretName: {{ template "seaweedfs.name" . }}-volume-cert
   issuerRef:
-    name: {{ include "seaweedfs.fullname" . }}-ca-issuer
+    name: {{ template "seaweedfs.name" . }}-ca-issuer
     kind: Issuer
   commonName: {{ .Values.certificates.commonName }}
   subject:
@@ -27,10 +27,10 @@ spec:
     - '*.{{ .Release.Namespace }}'
     - '*.{{ .Release.Namespace }}.svc'
     - '*.{{ .Release.Namespace }}.svc.cluster.local'
-    - '*.{{ include "seaweedfs.fullname" . }}-master'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc.cluster.local'
+    - '*.{{ template "seaweedfs.name" . }}-master'
+    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}'
+    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}.svc'
+    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}.svc.cluster.local'
 {{- if .Values.certificates.ipAddresses }}
   ipAddresses:
     {{- range .Values.certificates.ipAddresses }}

k8s/charts/seaweedfs/templates/cert/worker-cert.yaml

@@ -2,7 +2,7 @@
 apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Certificate
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-worker-cert
+  name: {{ template "seaweedfs.name" . }}-worker-cert
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -15,19 +15,19 @@ metadata:
     {{- toYaml .Values.worker.annotations | nindent 4 }}
   {{- end }}
 spec:
-  secretName: {{ include "seaweedfs.fullname" . }}-worker-cert
+  secretName: {{ template "seaweedfs.name" . }}-worker-cert
   issuerRef:
-    name: {{ include "seaweedfs.fullname" . }}-ca-issuer
+    name: {{ template "seaweedfs.name" . }}-ca-issuer
     kind: Issuer
   commonName: {{ .Values.certificates.commonName }}
   subject:
     organizations:
     - "SeaweedFS CA"
   dnsNames:
-    - '*.{{ include "seaweedfs.fullname" . }}-worker'
-    - '*.{{ include "seaweedfs.fullname" . }}-worker.{{ .Release.Namespace }}'
-    - '*.{{ include "seaweedfs.fullname" . }}-worker.{{ .Release.Namespace }}.svc'
-    - '*.{{ include "seaweedfs.fullname" . }}-worker.{{ .Release.Namespace }}.svc.cluster.local'
+    - '*.{{ template "seaweedfs.name" . }}-worker'
+    - '*.{{ template "seaweedfs.name" . }}-worker.{{ .Release.Namespace }}'
+    - '*.{{ template "seaweedfs.name" . }}-worker.{{ .Release.Namespace }}.svc'
+    - '*.{{ template "seaweedfs.name" . }}-worker.{{ .Release.Namespace }}.svc.cluster.local'
 {{- if .Values.certificates.ipAddresses }}
   ipAddresses:
     {{- range .Values.certificates.ipAddresses }}

k8s/charts/seaweedfs/templates/cosi/cosi-cluster-role.yaml

@@ -3,7 +3,7 @@
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-objectstorage-provisioner
+  name: {{ .Values.global.serviceAccountName }}-objectstorage-provisioner
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
@@ -52,7 +52,7 @@ rules:
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-objectstorage-provisioner
+  name: {{ .Values.global.serviceAccountName }}-objectstorage-provisioner
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
@@ -64,6 +64,6 @@ subjects:
     namespace: {{ .Release.Namespace }}
 roleRef:
   kind: ClusterRole
-  name: {{ include "seaweedfs.fullname" . }}-objectstorage-provisioner
+  name: {{ .Values.global.serviceAccountName }}-objectstorage-provisioner
   apiGroup: rbac.authorization.k8s.io
 {{- end }}

k8s/charts/seaweedfs/templates/cosi/cosi-deployment.yaml

@@ -2,7 +2,7 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-objectstorage-provisioner
+  name: {{ template "seaweedfs.name" . }}-objectstorage-provisioner
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -78,16 +78,16 @@ spec:
               {{- else if .Values.s3.ingress.enabled }}
               value: "{{ printf "https://%s" .Values.s3.ingress.host }}"
               {{- else if .Values.s3.enabled }}
-              value: "{{ printf "https://%s-s3.%s.svc" (include "seaweedfs.fullname" .) .Release.Namespace }}"
+              value: "{{ printf "https://%s-s3.%s.svc" (include "seaweedfs.name" .) .Release.Namespace }}"
               {{- else }}
-              value: "{{ printf "https://%s-filer.%s.svc" (include "seaweedfs.fullname" .) .Release.Namespace }}"
+              value: "{{ printf "https://%s-filer.%s.svc" (include "seaweedfs.name" .) .Release.Namespace }}"
               {{- end }}
             {{- with .Values.cosi.region }}
             - name: REGION
               value: "{{ . }}"
             {{- end }}
             - name: SEAWEEDFS_FILER
-              value: "{{ include "seaweedfs.fullname" . }}-filer:{{ .Values.filer.grpcPort }}"
+              value: "{{ template "seaweedfs.name" . }}-filer:{{ .Values.filer.grpcPort }}"
             {{- if .Values.global.enableSecurity }}
             - name: WEED_GRPC_CLIENT_KEY
               value: /usr/local/share/ca-certificates/client/tls.key
@@ -185,28 +185,28 @@ spec:
             {{- if .Values.cosi.existingConfigSecret }}
             secretName: {{ .Values.cosi.existingConfigSecret }}
             {{- else }}
-            secretName: {{ include "seaweedfs.fullname" . }}-s3-secret
+            secretName: seaweedfs-s3-secret
             {{- end }}
         {{- end }}
         {{- if .Values.global.enableSecurity }}
         - name: security-config
           configMap:
-            name: {{ include "seaweedfs.fullname" . }}-security-config
+            name: {{ template "seaweedfs.name" . }}-security-config
         - name: ca-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
+            secretName: {{ template "seaweedfs.name" . }}-ca-cert
         - name: master-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-master-cert
+            secretName: {{ template "seaweedfs.name" . }}-master-cert
         - name: volume-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-volume-cert
+            secretName: {{ template "seaweedfs.name" . }}-volume-cert
         - name: filer-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-filer-cert
+            secretName: {{ template "seaweedfs.name" . }}-filer-cert
         - name: client-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-client-cert
+            secretName: {{ template "seaweedfs.name" . }}-client-cert
         {{- end }}
         {{ tpl .Values.cosi.extraVolumes . | indent 8 | trim }}
       {{- if .Values.cosi.nodeSelector }}

k8s/charts/seaweedfs/templates/filer/filer-ingress.yaml

@@ -2,7 +2,7 @@
 {{- $filerEnabled := or .Values.filer.enabled .Values.allInOne.enabled }}
 {{- if and $filerEnabled .Values.filer.ingress.enabled }}
 {{- /* Determine service name based on deployment mode */}}
-{{- $serviceName := ternary (printf "%s-all-in-one" (include "seaweedfs.fullname" .)) (printf "%s-filer" (include "seaweedfs.fullname" .)) .Values.allInOne.enabled }}
+{{- $serviceName := ternary (printf "%s-all-in-one" (include "seaweedfs.name" .)) (printf "%s-filer" (include "seaweedfs.name" .)) .Values.allInOne.enabled }}
 {{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion }}
 apiVersion: networking.k8s.io/v1
 {{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion }}
@@ -12,7 +12,7 @@ apiVersion: extensions/v1beta1
 {{- end }}
 kind: Ingress
 metadata:
-  name: ingress-{{ include "seaweedfs.fullname" . }}-filer
+  name: ingress-{{ template "seaweedfs.name" . }}-filer
   namespace: {{ .Release.Namespace }}
   {{- with .Values.filer.ingress.annotations }}
   annotations:

k8s/charts/seaweedfs/templates/filer/filer-service-client.yaml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ printf "%s-filer-client" (include "seaweedfs.fullname" .) | trunc 63 | trimSuffix "-" }}
+  name: {{ template "seaweedfs.name" . }}-filer-client
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -36,6 +36,5 @@ spec:
 {{- end }}
   selector:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: filer
 {{- end }}

k8s/charts/seaweedfs/templates/filer/filer-service.yaml

@@ -4,7 +4,7 @@ kind: Service
 metadata:
   annotations:
     service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
-  name: {{ printf "%s-filer" (include "seaweedfs.fullname" .) | trunc 63 | trimSuffix "-" }}
+  name: {{ template "seaweedfs.name" . }}-filer
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -48,6 +48,5 @@ spec:
   {{- end }}
   selector:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: filer
 {{- end }}

k8s/charts/seaweedfs/templates/filer/filer-servicemonitor.yaml

@@ -4,7 +4,7 @@
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-filer
+  name: {{ template "seaweedfs.name" . }}-filer
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -27,7 +27,6 @@ spec:
   selector:
     matchLabels:
       app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-      app.kubernetes.io/instance: {{ .Release.Name }}
       app.kubernetes.io/component: filer
 {{- end }}
 {{- end }}

k8s/charts/seaweedfs/templates/filer/filer-statefulset.yaml

@@ -2,7 +2,7 @@
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-filer
+  name: {{ template "seaweedfs.name" . }}-filer
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -15,7 +15,7 @@ metadata:
     {{- toYaml .Values.filer.annotations | nindent 4 }}
 {{- end }}
 spec:
-  serviceName: {{ include "seaweedfs.fullname" . }}-filer
+  serviceName: {{ template "seaweedfs.name" . }}-filer
   podManagementPolicy: {{ .Values.filer.podManagementPolicy }}
   replicas: {{ .Values.filer.replicas }}
   {{- if (gt (int .Values.filer.updatePartition) 0) }}
@@ -70,7 +70,7 @@ spec:
         {{ tpl .Values.filer.tolerations . | nindent 8 | trim }}
       {{- end }}
       {{- include "seaweedfs.imagePullSecrets" . | nindent 6 }}
-      serviceAccountName: {{ .Values.filer.serviceAccountName | default (include "seaweedfs.serviceAccountName" .) | quote }} # for deleting statefulset pods after migration
+      serviceAccountName: {{ .Values.filer.serviceAccountName | default .Values.global.serviceAccountName | quote }} # for deleting statefulset pods after migration
       terminationGracePeriodSeconds: 60
       {{- if .Values.filer.priorityClassName }}
       priorityClassName: {{ .Values.filer.priorityClassName | quote }}
@@ -103,17 +103,17 @@ spec:
             - name: WEED_MYSQL_USERNAME
               valueFrom:
                 secretKeyRef:
-                  name: {{ include "seaweedfs.fullname" . }}-db-secret
+                  name: secret-seaweedfs-db
                   key: user
                   optional: true
             - name: WEED_MYSQL_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: {{ include "seaweedfs.fullname" . }}-db-secret
+                  name: secret-seaweedfs-db
                   key: password
                   optional: true
             - name: SEAWEEDFS_FULLNAME
-              value: "{{ include "seaweedfs.fullname" . }}"
+              value: "{{ template "seaweedfs.name" . }}"
             {{- if .Values.filer.extraEnvironmentVars }}
             {{- range $key, $value := .Values.filer.extraEnvironmentVars }}
             - name: {{ $key }}
@@ -359,7 +359,7 @@ spec:
         {{- end }}
         - name: db-schema-config-volume
           configMap:
-            name: {{ default (printf "%s-db-init-config" (include "seaweedfs.fullname" .)) .Values.filer.dbInitConfigName }}
+            name: seaweedfs-db-init-config
         {{- if and .Values.filer.s3.enabled .Values.filer.s3.enableAuth }}
         - name: config-users
           secret:
@@ -367,33 +367,33 @@ spec:
             {{- if .Values.filer.s3.existingConfigSecret }}
             secretName: {{ .Values.filer.s3.existingConfigSecret }}
             {{- else }}
-            secretName: {{ include "seaweedfs.fullname" . }}-s3-secret
+            secretName: seaweedfs-s3-secret
             {{- end }}
         {{- end }}
         {{- if .Values.filer.notificationConfig }}
         - name: notification-config
           configMap:
-            name: {{ include "seaweedfs.fullname" . }}-notification-config
+            name: {{ template "seaweedfs.name" . }}-notification-config
         {{- end }}
         {{- if .Values.global.enableSecurity }}
         - name: security-config
           configMap:
-            name: {{ include "seaweedfs.fullname" . }}-security-config
+            name: {{ template "seaweedfs.name" . }}-security-config
         - name: ca-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
+            secretName: {{ template "seaweedfs.name" . }}-ca-cert
         - name: master-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-master-cert
+            secretName: {{ template "seaweedfs.name" . }}-master-cert
         - name: volume-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-volume-cert
+            secretName: {{ template "seaweedfs.name" . }}-volume-cert
         - name: filer-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-filer-cert
+            secretName: {{ template "seaweedfs.name" . }}-filer-cert
         - name: client-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-client-cert
+            secretName: {{ template "seaweedfs.name" . }}-client-cert
         {{- end }}
         {{ tpl .Values.filer.extraVolumes . | indent 8 | trim }}
       {{- if .Values.filer.nodeSelector }}

k8s/charts/seaweedfs/templates/master/master-configmap.yaml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-master-config
+  name: {{ template "seaweedfs.name" . }}-master-config
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}

k8s/charts/seaweedfs/templates/master/master-ingress.yaml

@@ -9,7 +9,7 @@ apiVersion: extensions/v1beta1
 {{- end }}
 kind: Ingress
 metadata:
-  name: ingress-{{ include "seaweedfs.fullname" . }}-master
+  name: ingress-{{ template "seaweedfs.name" . }}-master
   namespace: {{ .Release.Namespace }}
   {{- with .Values.master.ingress.annotations }}
   annotations:
@@ -33,12 +33,12 @@ spec:
             backend:
 {{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion }}
               service:
-                name: {{ include "seaweedfs.fullname" . }}-master
+                name: {{ template "seaweedfs.name" . }}-master
                 port:
                   number: {{ .Values.master.port }}
                   #name:
 {{- else }}
-              serviceName: {{ include "seaweedfs.fullname" . }}-master
+              serviceName: {{ template "seaweedfs.name" . }}-master
               servicePort: {{ .Values.master.port }}
 {{- end }}
 {{- if .Values.filer.ingress.host }}

k8s/charts/seaweedfs/templates/master/master-service.yaml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ printf "%s-master" (include "seaweedfs.fullname" .) | trunc 63 | trimSuffix "-" }}
+  name: {{ template "seaweedfs.name" . }}-master
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -34,6 +34,5 @@ spec:
   {{- end }}
   selector:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: master
 {{- end }}

k8s/charts/seaweedfs/templates/master/master-servicemonitor.yaml

@@ -4,7 +4,7 @@
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-master
+  name: {{ template "seaweedfs.name" . }}-master
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -27,7 +27,6 @@ spec:
   selector:
     matchLabels:
       app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-      app.kubernetes.io/instance: {{ .Release.Name }}
       app.kubernetes.io/component: master
 {{- end }}
 {{- end }}

k8s/charts/seaweedfs/templates/master/master-statefulset.yaml

@@ -2,7 +2,7 @@
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-master
+  name: {{ template "seaweedfs.name" . }}-master
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -15,7 +15,7 @@ metadata:
     {{- toYaml .Values.master.annotations | nindent 4 }}
 {{- end }}
 spec:
-  serviceName: {{ include "seaweedfs.fullname" . }}-master
+  serviceName: {{ template "seaweedfs.name" . }}-master
   podManagementPolicy: {{ .Values.master.podManagementPolicy }}
   replicas: {{ .Values.master.replicas }}
   {{- if (gt (int .Values.master.updatePartition) 0) }}
@@ -70,7 +70,7 @@ spec:
       {{- end }}
       enableServiceLinks: false
       {{- if .Values.global.createClusterRole }}
-      serviceAccountName: {{ .Values.master.serviceAccountName | default (include "seaweedfs.serviceAccountName" .) | quote }} # for deleting statefulset pods after migration
+      serviceAccountName: {{ .Values.master.serviceAccountName | default .Values.global.serviceAccountName | quote }} # for deleting statefulset pods after migration
       {{- end }}
       {{- if .Values.master.initContainers }}
       initContainers:
@@ -97,7 +97,7 @@ spec:
                 fieldRef:
                   fieldPath: metadata.namespace
             - name: SEAWEEDFS_FULLNAME
-              value: "{{ include "seaweedfs.fullname" . }}"
+              value: "{{ template "seaweedfs.name" . }}"
             {{- if .Values.master.extraEnvironmentVars }}
             {{- range $key, $value := .Values.master.extraEnvironmentVars }}
             - name: {{ $key }}
@@ -297,26 +297,26 @@ spec:
         {{- end }}
         - name: master-config
           configMap:
-            name: {{ include "seaweedfs.fullname" . }}-master-config
+            name: {{ template "seaweedfs.name" . }}-master-config
         {{- if .Values.global.enableSecurity }}
         - name: security-config
           configMap:
-            name: {{ include "seaweedfs.fullname" . }}-security-config
+            name: {{ template "seaweedfs.name" . }}-security-config
         - name: ca-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
+            secretName: {{ template "seaweedfs.name" . }}-ca-cert
         - name: master-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-master-cert
+            secretName: {{ template "seaweedfs.name" . }}-master-cert
         - name: volume-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-volume-cert
+            secretName: {{ template "seaweedfs.name" . }}-volume-cert
         - name: filer-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-filer-cert
+            secretName: {{ template "seaweedfs.name" . }}-filer-cert
         - name: client-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-client-cert
+            secretName: {{ template "seaweedfs.name" . }}-client-cert
         {{- end }}
         {{ tpl .Values.master.extraVolumes . | indent 8 | trim }}
       {{- if .Values.master.nodeSelector }}

k8s/charts/seaweedfs/templates/s3/s3-deployment.yaml

@@ -2,7 +2,7 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-s3
+  name: {{ template "seaweedfs.name" . }}-s3
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -89,7 +89,7 @@ spec:
                 fieldRef:
                   fieldPath: metadata.namespace
             - name: SEAWEEDFS_FULLNAME
-              value: "{{ include "seaweedfs.fullname" . }}"
+              value: "{{ template "seaweedfs.name" . }}"
             {{- if .Values.s3.extraEnvironmentVars }}
             {{- range $key, $value := .Values.s3.extraEnvironmentVars }}
             - name: {{ $key }}
@@ -149,7 +149,7 @@ spec:
               {{- if .Values.s3.auditLogConfig }}
               -auditLogConfig=/etc/sw/s3_auditLogConfig.json \
               {{- end }}
-              -filer={{ include "seaweedfs.fullname" . }}-filer-client.{{ .Release.Namespace }}:{{ .Values.filer.port }} \
+              -filer={{ template "seaweedfs.name" . }}-filer-client.{{ .Release.Namespace }}:{{ .Values.filer.port }} \
               {{- range .Values.s3.extraArgs }}
               {{ . }} \
               {{- end }}
@@ -238,7 +238,7 @@ spec:
             {{- if .Values.s3.existingConfigSecret }}
             secretName: {{ .Values.s3.existingConfigSecret }}
             {{- else }}
-            secretName: {{ include "seaweedfs.fullname" . }}-s3-secret
+            secretName: seaweedfs-s3-secret
             {{- end }}
         {{- end }}
         {{- if eq .Values.s3.logs.type "hostPath" }}
@@ -254,22 +254,22 @@ spec:
         {{- if .Values.global.enableSecurity }}
         - name: security-config
           configMap:
-            name: {{ include "seaweedfs.fullname" . }}-security-config
+            name: {{ template "seaweedfs.name" . }}-security-config
         - name: ca-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
+            secretName: {{ template "seaweedfs.name" . }}-ca-cert
         - name: master-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-master-cert
+            secretName: {{ template "seaweedfs.name" . }}-master-cert
         - name: volume-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-volume-cert
+            secretName: {{ template "seaweedfs.name" . }}-volume-cert
         - name: filer-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-filer-cert
+            secretName: {{ template "seaweedfs.name" . }}-filer-cert
         - name: client-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-client-cert
+            secretName: {{ template "seaweedfs.name" . }}-client-cert
         {{- end }}
         {{ tpl .Values.s3.extraVolumes . | indent 8 | trim }}
       {{- if .Values.s3.nodeSelector }}

k8s/charts/seaweedfs/templates/s3/s3-ingress.yaml

@@ -2,7 +2,7 @@
 {{- $s3Enabled := or .Values.s3.enabled (and .Values.filer.s3.enabled (not .Values.allInOne.enabled)) (and .Values.allInOne.enabled .Values.allInOne.s3.enabled) }}
 {{- if and $s3Enabled .Values.s3.ingress.enabled }}
 {{- /* Determine service name based on deployment mode */}}
-{{- $serviceName := ternary (printf "%s-all-in-one" (include "seaweedfs.fullname" .)) (printf "%s-s3" (include "seaweedfs.fullname" .)) .Values.allInOne.enabled }}
+{{- $serviceName := ternary (printf "%s-all-in-one" (include "seaweedfs.name" .)) (printf "%s-s3" (include "seaweedfs.name" .)) .Values.allInOne.enabled }}
 {{- $s3Port := .Values.allInOne.s3.port | default .Values.s3.port }}
 {{- /* Build hosts list - support both legacy .host (string) and new .hosts (array) for backwards compatibility */}}
 {{- $hosts := list }}
@@ -20,7 +20,7 @@ apiVersion: extensions/v1beta1
 {{- end }}
 kind: Ingress
 metadata:
-  name: ingress-{{ include "seaweedfs.fullname" . }}-s3
+  name: ingress-{{ template "seaweedfs.name" . }}-s3
   namespace: {{ .Release.Namespace }}
   {{- with .Values.s3.ingress.annotations }}
   annotations:

k8s/charts/seaweedfs/templates/s3/s3-secret.yaml

@@ -1,19 +1,13 @@
 {{- if or (and (or .Values.s3.enabled .Values.allInOne.enabled) .Values.s3.enableAuth (not .Values.s3.existingConfigSecret)) (and .Values.filer.s3.enabled .Values.filer.s3.enableAuth (not .Values.filer.s3.existingConfigSecret)) }}
-{{- $secretName := printf "%s-s3-secret" (include "seaweedfs.fullname" .) }}
-{{- $existingSecret := lookup "v1" "Secret" .Release.Namespace (default $secretName .Values.s3.legacySecretName) }}
-{{- $reuse := false }}
-{{- if and .Values.s3.reuseLegacySecret $existingSecret }}
-{{- $reuse = true }}
-{{- end }}
-{{- $access_key_admin := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "admin_access_key_id" "length" 20 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
-{{- $secret_key_admin := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "admin_secret_access_key" "length" 40 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
-{{- $access_key_read := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "read_access_key_id" "length" 20 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
-{{- $secret_key_read := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "read_secret_access_key" "length" 40 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
+{{- $access_key_admin := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" "seaweedfs-s3-secret" "key" "admin_access_key_id" "length" 20) -}}
+{{- $secret_key_admin := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" "seaweedfs-s3-secret" "key" "admin_secret_access_key" "length" 40) -}}
+{{- $access_key_read := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" "seaweedfs-s3-secret" "key" "read_access_key_id" "length" 20) -}}
+{{- $secret_key_read := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" "seaweedfs-s3-secret" "key" "read_secret_access_key" "length" 40) -}}
 apiVersion: v1
 kind: Secret
 type: Opaque
 metadata:
-  name: {{ $secretName }}
+  name: seaweedfs-s3-secret
   namespace: {{ .Release.Namespace }}
   annotations:
     "helm.sh/resource-policy": keep

k8s/charts/seaweedfs/templates/s3/s3-service.yaml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ printf "%s-s3" (include "seaweedfs.fullname" .) | trunc 63 | trimSuffix "-" }}
+  name: {{ template "seaweedfs.name" . }}-s3
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -34,6 +34,5 @@ spec:
 {{- end }}
   selector:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: {{ if .Values.s3.enabled }}s3{{ else }}filer{{ end }}
 {{- end }}

k8s/charts/seaweedfs/templates/s3/s3-servicemonitor.yaml

@@ -4,7 +4,7 @@
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-s3
+  name: {{ template "seaweedfs.name" . }}-s3
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -27,7 +27,6 @@ spec:
   selector:
     matchLabels:
       app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-      app.kubernetes.io/instance: {{ .Release.Name }}
       app.kubernetes.io/component: s3
 {{- end }}
 {{- end }}

k8s/charts/seaweedfs/templates/sftp/sftp-deployment.yaml

@@ -2,7 +2,7 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-sftp
+  name: {{ template "seaweedfs.name" . }}-sftp
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -89,7 +89,7 @@ spec:
                 fieldRef:
                   fieldPath: metadata.namespace
             - name: SEAWEEDFS_FULLNAME
-              value: "{{ include "seaweedfs.fullname" . }}"
+              value: "{{ template "seaweedfs.name" . }}"
             {{- if .Values.sftp.extraEnvironmentVars }}
             {{- range $key, $value := .Values.sftp.extraEnvironmentVars }}
             - name: {{ $key }}
@@ -171,7 +171,7 @@ spec:
               -key.file=/usr/local/share/ca-certificates/client/tls.key \
               {{- end }}
               -userStoreFile=/etc/sw/seaweedfs_sftp_config \
-              -filer={{ include "seaweedfs.fullname" . }}-filer-client.{{ .Release.Namespace }}:{{ .Values.filer.port }}
+              -filer={{ template "seaweedfs.name" . }}-filer-client.{{ .Release.Namespace }}:{{ .Values.filer.port }}
           volumeMounts:
             {{- if or (eq .Values.sftp.logs.type "hostPath") (eq .Values.sftp.logs.type "emptyDir") }}
             - name: logs
@@ -252,7 +252,7 @@ spec:
             {{- if .Values.sftp.existingConfigSecret }}
             secretName: {{ .Values.sftp.existingConfigSecret }}
             {{- else }}
-            secretName: {{ include "seaweedfs.fullname" . }}-sftp-secret
+            secretName: seaweedfs-sftp-secret
             {{- end }}
         {{- end }}
         - name: config-ssh
@@ -261,7 +261,7 @@ spec:
             {{- if .Values.sftp.existingSshConfigSecret }}
             secretName: {{ .Values.sftp.existingSshConfigSecret }}
             {{- else }}
-            secretName: {{ include "seaweedfs.fullname" . }}-sftp-ssh-secret
+            secretName: seaweedfs-sftp-ssh-secret
             {{- end }}
         {{- if eq .Values.sftp.logs.type "hostPath" }}
         - name: logs
@@ -276,22 +276,22 @@ spec:
         {{- if .Values.global.enableSecurity }}
         - name: security-config
           configMap:
-            name: {{ include "seaweedfs.fullname" . }}-security-config
+            name: {{ template "seaweedfs.name" . }}-security-config
         - name: ca-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
+            secretName: {{ template "seaweedfs.name" . }}-ca-cert
         - name: master-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-master-cert
+            secretName: {{ template "seaweedfs.name" . }}-master-cert
         - name: volume-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-volume-cert
+            secretName: {{ template "seaweedfs.name" . }}-volume-cert
         - name: filer-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-filer-cert
+            secretName: {{ template "seaweedfs.name" . }}-filer-cert
         - name: client-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-client-cert
+            secretName: {{ template "seaweedfs.name" . }}-client-cert
         {{- end }}
         {{ tpl .Values.sftp.extraVolumes . | indent 8 | trim }}
       {{- if .Values.sftp.nodeSelector }}

k8s/charts/seaweedfs/templates/sftp/sftp-secret.yaml

@@ -1,13 +1,12 @@
 {{- if or .Values.sftp.enabled .Values.allInOne.enabled }}
-{{- $secretName := printf "%s-sftp-secret" (include "seaweedfs.fullname" .) }}
-{{- $admin_pwd := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "admin_password" 20) -}}
-{{- $read_user_pwd := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "readonly_password" 20) -}}
-{{- $public_user_pwd := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "public_user_password" 20) -}}
+{{- $admin_pwd := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" "seaweedfs-sftp-secret" "key" "admin_password" 20) -}}
+{{- $read_user_pwd := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" "seaweedfs-sftp-secret" "key" "readonly_password" 20) -}}
+{{- $public_user_pwd := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" "seaweedfs-sftp-secret" "key" "public_user_password" 20) -}}
 apiVersion: v1
 kind: Secret
 type: Opaque
 metadata:
-  name: {{ $secretName }}
+  name: seaweedfs-sftp-secret
   namespace: {{ .Release.Namespace }}
   annotations:
     "helm.sh/resource-policy": keep

k8s/charts/seaweedfs/templates/sftp/sftp-service.yaml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ printf "%s-sftp" (include "seaweedfs.fullname" .) | trunc 63 | trimSuffix "-" }}
+  name: {{ template "seaweedfs.name" . }}-sftp
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -28,6 +28,5 @@ spec:
 {{- end }}
   selector:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: sftp
 {{- end }}

k8s/charts/seaweedfs/templates/sftp/sftp-servicemonitor.yaml

@@ -4,7 +4,7 @@
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-sftp
+  name: {{ template "seaweedfs.name" . }}-sftp
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -27,7 +27,6 @@ spec:
   selector:
     matchLabels:
       app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-      app.kubernetes.io/instance: {{ .Release.Name }}
       app.kubernetes.io/component: sftp
 {{- end }}
 {{- end }}

k8s/charts/seaweedfs/templates/shared/_helpers.tpl

@@ -244,7 +244,7 @@ or generate a new random password if it doesn't exist.
 {{- $key := $params.key -}}
 {{- $length := default 16 $params.length -}}
 
-{{- $existingSecret := default (lookup "v1" "Secret" $namespace $secretName) $params.existingSecret -}}
+{{- $existingSecret := lookup "v1" "Secret" $namespace $secretName -}}
 {{- if and $existingSecret (index $existingSecret.data $key) -}}
   {{- index $existingSecret.data $key | b64dec -}}
 {{- else -}}
@@ -261,7 +261,7 @@ If allInOne is enabled, point to the all-in-one service; otherwise, point to the
 {{- if .Values.allInOne.enabled -}}
 {{-   $serviceNameSuffix = "-all-in-one" -}}
 {{- end -}}
-{{- printf "%s%s.%s:%d" (include "seaweedfs.fullname" .) $serviceNameSuffix .Release.Namespace (int .Values.master.port) -}}
+{{- printf "%s%s.%s:%d" (include "seaweedfs.name" .) $serviceNameSuffix .Release.Namespace (int .Values.master.port) -}}
 {{- end -}}
 
 {{/*
@@ -273,7 +273,7 @@ If allInOne is enabled, point to the all-in-one service; otherwise, point to the
 {{- if .Values.allInOne.enabled -}}
 {{-   $serviceNameSuffix = "-all-in-one" -}}
 {{- end -}}
-{{- printf "%s%s.%s:%d" (include "seaweedfs.fullname" .) $serviceNameSuffix .Release.Namespace (int .Values.filer.port) -}}
+{{- printf "%s%s.%s:%d" (include "seaweedfs.name" .) $serviceNameSuffix .Release.Namespace (int .Values.filer.port) -}}
 {{- end -}}
 
 {{/*
@@ -282,7 +282,7 @@ Usage: {{ include "seaweedfs.masterServers" . }}
 Output example: ${SEAWEEDFS_FULLNAME}-master-0.${SEAWEEDFS_FULLNAME}-master.namespace:9333,${SEAWEEDFS_FULLNAME}-master-1...
 */}}
 {{- define "seaweedfs.masterServers" -}}
-{{- $fullname := include "seaweedfs.fullname" . -}}
+{{- $fullname := include "seaweedfs.name" . -}}
 {{- range $index := until (.Values.master.replicas | int) -}}
 {{- if $index }},{{ end -}}
 ${SEAWEEDFS_FULLNAME}-master-{{ $index }}.${SEAWEEDFS_FULLNAME}-master.{{ $.Release.Namespace }}:{{ $.Values.master.port }}
@@ -300,10 +300,3 @@ Usage: {{ include "seaweedfs.masterServerArg" . }}
 {{- include "seaweedfs.masterServers" . -}}
 {{- end -}}
 {{- end -}}
-
-{{/*
-Create the name of the service account to use
-*/}}
-{{- define "seaweedfs.serviceAccountName" -}}
-{{- .Values.global.serviceAccountName | default "seaweedfs" -}}
-{{- end -}}

k8s/charts/seaweedfs/templates/shared/cluster-role.yaml

@@ -4,7 +4,7 @@
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-rw-cr
+  name: {{ .Values.global.serviceAccountName }}-rw-cr
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
@@ -18,7 +18,7 @@ rules:
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-rw-crb
+  name: system:serviceaccount:{{ .Values.global.serviceAccountName }}:default
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
@@ -26,10 +26,10 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
 subjects:
   - kind: ServiceAccount
-    name: {{ include "seaweedfs.serviceAccountName" . }}
+    name: {{ .Values.global.serviceAccountName }}
     namespace: {{ .Release.Namespace }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: {{ include "seaweedfs.fullname" . }}-rw-cr
+  name: {{ .Values.global.serviceAccountName }}-rw-cr
 {{- end }}

k8s/charts/seaweedfs/templates/shared/notification-configmap.yaml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-notification-config
+  name: {{ template "seaweedfs.name" . }}-notification-config
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}

k8s/charts/seaweedfs/templates/shared/post-install-bucket-hook.yaml

@@ -74,7 +74,7 @@ spec:
               fieldRef:
                 fieldPath: metadata.namespace
           - name: SEAWEEDFS_FULLNAME
-            value: "{{ include "seaweedfs.fullname" . }}"
+            value: "{{ template "seaweedfs.name" . }}"
         command:
           - "/bin/sh"
           - "-ec"
@@ -145,7 +145,7 @@ spec:
             {{- if $existingConfigSecret }}
             secretName: {{ $existingConfigSecret }}
             {{- else }}
-            secretName: {{ include "seaweedfs.fullname" . }}-s3-secret
+            secretName: {{ template "seaweedfs.name" . }}-s3-secret
             {{- end }}
     {{- end }}
 {{- end }}

k8s/charts/seaweedfs/templates/shared/seaweedfs-grafana-dashboard.yaml

@@ -7,7 +7,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: {{ include "seaweedfs.fullname" $ }}-{{ printf "%s" $dashboardName | lower | replace "_" "-" }}
+  name: {{ printf "%s" $dashboardName | lower | replace "_" "-" }}
   namespace: {{ $.Release.Namespace }}
   labels:
     grafana_dashboard: "1"

k8s/charts/seaweedfs/templates/shared/secret-seaweedfs-db.yaml

@@ -3,7 +3,7 @@ apiVersion: v1
 kind: Secret
 type: Opaque
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-db-secret
+  name: secret-seaweedfs-db
   namespace: {{ .Release.Namespace }}
   annotations:
     "helm.sh/resource-policy": keep

k8s/charts/seaweedfs/templates/shared/security-configmap.yaml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-security-config
+  name: {{ template "seaweedfs.name" . }}-security-config
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -10,13 +10,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
 data:
-  {{- $fullname := include "seaweedfs.fullname" . }}
-  {{- $securityConfigName := printf "%s-security-config" $fullname }}
-  {{- $existing := lookup "v1" "ConfigMap" .Release.Namespace $securityConfigName }}
-  {{- if not $existing }}
-  {{- $legacyName := printf "%s-%s" (include "seaweedfs.name" .) "security-config" }}
-  {{- $existing = lookup "v1" "ConfigMap" .Release.Namespace $legacyName }}
-  {{- end }}
+  {{- $existing := (lookup "v1" "ConfigMap" .Release.Namespace (printf "%s-security-config" (include "seaweedfs.name" .))) }}
   {{- $securityConfig := fromToml (dig "data" "security.toml" "" $existing) }}
   security.toml: |-
     # this file is read by master, volume server, and filer

k8s/charts/seaweedfs/templates/shared/service-account.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ include "seaweedfs.serviceAccountName" . }}
+  name: {{ .Values.global.serviceAccountName }}
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}

k8s/charts/seaweedfs/templates/volume/volume-ingress.yaml

@@ -8,7 +8,7 @@ apiVersion: extensions/v1beta1
 {{- end }}
 kind: Ingress
 metadata:
-  name: ingress-{{ include "seaweedfs.fullname" . }}-volume
+  name: ingress-{{ template "seaweedfs.name" . }}-volume
   namespace: {{ .Release.Namespace }}
   annotations:
   {{- if and (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) .Values.volume.ingress.className }}
@@ -42,11 +42,11 @@ spec:
         backend:
 {{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion }}
           service:
-            name: {{ include "seaweedfs.fullname" . }}-volume
+            name: {{ template "seaweedfs.name" . }}-volume
             port:
               number: {{ .Values.volume.port }}
 {{- else }}
-          serviceName: {{ include "seaweedfs.fullname" . }}-volume
+          serviceName: {{ template "seaweedfs.name" . }}-volume
           servicePort: {{ .Values.volume.port }}
 {{- end }}
 {{- end }}

k8s/charts/seaweedfs/templates/volume/volume-resize-hook.yaml

@@ -1,4 +1,4 @@
-{{- $seaweedfsName := include "seaweedfs.fullname" $ }}
+{{- $seaweedfsName := include "seaweedfs.name" $ }}
 {{- $volumes := deepCopy .Values.volumes | mergeOverwrite (dict "" .Values.volume)  }}
 
 

k8s/charts/seaweedfs/templates/volume/volume-service.yaml

@@ -8,7 +8,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ printf "%s-%s" (include "seaweedfs.fullname" $) $volumeName | trunc 63 | trimSuffix "-" }}
+  name: {{ template "seaweedfs.name" $ }}-{{ $volumeName }}
   namespace: {{ $.Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" $ }}
@@ -39,7 +39,6 @@ spec:
 {{- end }}
   selector:
     app.kubernetes.io/name: {{ template "seaweedfs.name" $ }}
-    app.kubernetes.io/instance: {{ $.Release.Name }}
     app.kubernetes.io/component: {{ $volumeName }}
 {{- end }}
 {{- end }}

k8s/charts/seaweedfs/templates/volume/volume-servicemonitor.yaml

@@ -10,7 +10,7 @@
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
-  name: {{ include "seaweedfs.fullname" $ }}-{{ $volumeName }}
+  name: {{ template "seaweedfs.name" $ }}-{{ $volumeName }}
   namespace: {{ $.Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" $ }}
@@ -33,7 +33,6 @@ spec:
   selector:
     matchLabels:
       app.kubernetes.io/name: {{ template "seaweedfs.name" $ }}
-      app.kubernetes.io/instance: {{ $.Release.Name }}
       app.kubernetes.io/component: {{ $volumeName }}
 {{- end }}
 {{- end }}

k8s/charts/seaweedfs/templates/volume/volume-statefulset.yaml

@@ -8,7 +8,7 @@
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
-  name: {{ include "seaweedfs.fullname" $ }}-{{ $volumeName }}
+  name: {{ template "seaweedfs.name" $ }}-{{ $volumeName }}
   namespace: {{ $.Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" $ }}
@@ -21,7 +21,7 @@ metadata:
     {{- toYaml $volume.annotations | nindent 4 }}
 {{- end }}
 spec:
-  serviceName: {{ include "seaweedfs.fullname" $ }}-{{ $volumeName }}
+  serviceName: {{ template "seaweedfs.name" $ }}-{{ $volumeName }}
   replicas: {{ $volume.replicas }}
   podManagementPolicy: {{ $volume.podManagementPolicy }}
   selector:
@@ -70,7 +70,7 @@ spec:
       {{- end }}
       enableServiceLinks: false
       {{- if $.Values.global.createClusterRole }}
-      serviceAccountName: {{ $volume.serviceAccountName | default (include "seaweedfs.serviceAccountName" $) | quote }} # for deleting statefulset pods after migration
+      serviceAccountName: {{ $volume.serviceAccountName | default $.Values.global.serviceAccountName | quote }} # for deleting statefulset pods after migration
       {{- end }}
       {{- $initContainers_exists := include "volume.initContainers_exists" $ -}}
       {{- if $initContainers_exists }}
@@ -117,7 +117,7 @@ spec:
                 fieldRef:
                   fieldPath: status.hostIP
             - name: SEAWEEDFS_FULLNAME
-              value: "{{ include "seaweedfs.fullname" $ }}"
+              value: "{{ template "seaweedfs.name" $ }}"
             {{- if $volume.extraEnvironmentVars }}
             {{- range $key, $value := $volume.extraEnvironmentVars }}
             - name: {{ $key }}
@@ -343,22 +343,22 @@ spec:
      {{- if $.Values.global.enableSecurity }}
         - name: security-config
           configMap:
-            name: {{ include "seaweedfs.fullname" $ }}-security-config
+            name: {{ template "seaweedfs.name" $ }}-security-config
         - name: ca-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" $ }}-ca-cert
+            secretName: {{ template "seaweedfs.name" $ }}-ca-cert
         - name: master-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" $ }}-master-cert
+            secretName: {{ template "seaweedfs.name" $ }}-master-cert
         - name: volume-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" $ }}-volume-cert
+            secretName: {{ template "seaweedfs.name" $ }}-volume-cert
         - name: filer-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" $ }}-filer-cert
+            secretName: {{ template "seaweedfs.name" $ }}-filer-cert
         - name: client-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" $ }}-client-cert
+            secretName: {{ template "seaweedfs.name" $ }}-client-cert
       {{- end }}
       {{- if $volume.extraVolumes }}
         {{ tpl $volume.extraVolumes $ | indent 8 | trim }}

k8s/charts/seaweedfs/templates/worker/worker-deployment.yaml

@@ -5,7 +5,7 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-worker
+  name: {{ template "seaweedfs.name" . }}-worker
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -92,7 +92,7 @@ spec:
                 fieldRef:
                   fieldPath: metadata.namespace
             - name: SEAWEEDFS_FULLNAME
-              value: "{{ include "seaweedfs.fullname" . }}"
+              value: "{{ template "seaweedfs.name" . }}"
             {{- if .Values.worker.extraEnvironmentVars }}
             {{- range $key, $value := .Values.worker.extraEnvironmentVars }}
             - name: {{ $key }}
@@ -260,25 +260,25 @@ spec:
         {{- if .Values.global.enableSecurity }}
         - name: security-config
           configMap:
-            name: {{ include "seaweedfs.fullname" . }}-security-config
+            name: {{ template "seaweedfs.name" . }}-security-config
         - name: ca-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
+            secretName: {{ template "seaweedfs.name" . }}-ca-cert
         - name: master-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-master-cert
+            secretName: {{ template "seaweedfs.name" . }}-master-cert
         - name: volume-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-volume-cert
+            secretName: {{ template "seaweedfs.name" . }}-volume-cert
         - name: filer-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-filer-cert
+            secretName: {{ template "seaweedfs.name" . }}-filer-cert
         - name: client-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-client-cert
+            secretName: {{ template "seaweedfs.name" . }}-client-cert
         - name: worker-cert
           secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-worker-cert
+            secretName: {{ template "seaweedfs.name" . }}-worker-cert
         {{- end }}
         {{ tpl .Values.worker.extraVolumes . | indent 8 | trim }}
       {{- if .Values.worker.nodeSelector }}

k8s/charts/seaweedfs/templates/worker/worker-service.yaml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ printf "%s-worker" (include "seaweedfs.fullname" .) | trunc 63 | trimSuffix "-" }}
+  name: {{ template "seaweedfs.name" . }}-worker
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}

k8s/charts/seaweedfs/templates/worker/worker-servicemonitor.yaml

@@ -4,7 +4,7 @@
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-worker
+  name: {{ template "seaweedfs.name" . }}-worker
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -27,7 +27,6 @@ spec:
   selector:
     matchLabels:
       app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-      app.kubernetes.io/instance: {{ .Release.Name }}
       app.kubernetes.io/component: worker
 {{- end }}
 {{- end }}

other/java/s3copier/pom.xml

@@ -68,7 +68,7 @@
     <dependency>
       <groupId>org.assertj</groupId>
       <artifactId>assertj-core</artifactId>
-      <version>3.27.7</version>
+      <version>3.24.2</version>
       <scope>test</scope>
     </dependency>
   </dependencies>

test/s3/iam/iam_config.json

@@ -230,12 +230,10 @@
           {
             "Effect": "Allow",
             "Action": [
-              "s3:*",
-              "iam:*"
+              "s3:*"
             ],
             "Resource": [
-              "*",
-              "arn:aws:iam:::*"
+              "*"
             ]
           },
           {
@@ -344,4 +342,4 @@
       }
     }
   ]
-}
+}

test/s3/iam/iam_config.local.json

@@ -230,12 +230,10 @@
           {
             "Effect": "Allow",
             "Action": [
-              "s3:*",
-              "iam:*"
+              "s3:*"
             ],
             "Resource": [
-              "*",
-              "arn:aws:iam:::*"
+              "*"
             ]
           },
           {
@@ -344,4 +342,4 @@
       }
     }
   ]
-}
+}

test/s3/iam/s3_iam_admin_test.go

@@ -1,241 +0,0 @@
-package iam
-
-import (
-	"testing"
-
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/iam"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// TestIAMUserManagement tests user management operations
-func TestIAMUserManagement(t *testing.T) {
-	framework := NewS3IAMTestFramework(t)
-	defer framework.Cleanup()
-
-	// Create IAM client with admin privileges
-	iamClient, err := framework.CreateIAMClientWithJWT("admin-user", "TestAdminRole")
-	require.NoError(t, err)
-
-	t.Run("create_and_get_user", func(t *testing.T) {
-		userName := "test-user-mgm"
-
-		// Create user
-		createResp, err := iamClient.CreateUser(&iam.CreateUserInput{
-			UserName: aws.String(userName),
-		})
-		require.NoError(t, err)
-		assert.Equal(t, userName, *createResp.User.UserName)
-
-		// Get user
-		getResp, err := iamClient.GetUser(&iam.GetUserInput{
-			UserName: aws.String(userName),
-		})
-		require.NoError(t, err)
-		assert.Equal(t, userName, *getResp.User.UserName)
-
-		// List users to verify existence
-		listResp, err := iamClient.ListUsers(&iam.ListUsersInput{})
-		require.NoError(t, err)
-		found := false
-		for _, user := range listResp.Users {
-			if *user.UserName == userName {
-				found = true
-				break
-			}
-		}
-		assert.True(t, found, "Created user should be listed")
-
-		// Clean up
-		_, err = iamClient.DeleteUser(&iam.DeleteUserInput{
-			UserName: aws.String(userName),
-		})
-		require.NoError(t, err)
-	})
-
-	t.Run("update_user", func(t *testing.T) {
-		userName := "user-to-update"
-		newUserName := "user-updated"
-
-		// Create user
-		_, err := iamClient.CreateUser(&iam.CreateUserInput{
-			UserName: aws.String(userName),
-		})
-		require.NoError(t, err)
-		defer func() {
-			// Try to delete both just in case
-			iamClient.DeleteUser(&iam.DeleteUserInput{UserName: aws.String(userName)})
-			iamClient.DeleteUser(&iam.DeleteUserInput{UserName: aws.String(newUserName)})
-		}()
-
-		// Update user name
-		_, err = iamClient.UpdateUser(&iam.UpdateUserInput{
-			UserName:    aws.String(userName),
-			NewUserName: aws.String(newUserName),
-		})
-		require.NoError(t, err)
-
-		// Verify update (GetUser with NEW name should work)
-		getResp, err := iamClient.GetUser(&iam.GetUserInput{
-			UserName: aws.String(newUserName),
-		})
-		require.NoError(t, err)
-		assert.Equal(t, newUserName, *getResp.User.UserName)
-
-		// GetUser with OLD name should fail
-		_, err = iamClient.GetUser(&iam.GetUserInput{
-			UserName: aws.String(userName),
-		})
-		require.Error(t, err)
-	})
-}
-
-// TestIAMAccessKeyManagement tests access key operations
-func TestIAMAccessKeyManagement(t *testing.T) {
-	framework := NewS3IAMTestFramework(t)
-	defer framework.Cleanup()
-
-	iamClient, err := framework.CreateIAMClientWithJWT("admin-user", "TestAdminRole")
-	require.NoError(t, err)
-
-	userName := "test-user-keys"
-	_, err = iamClient.CreateUser(&iam.CreateUserInput{
-		UserName: aws.String(userName),
-	})
-	require.NoError(t, err)
-	defer iamClient.DeleteUser(&iam.DeleteUserInput{UserName: aws.String(userName)})
-
-	t.Run("create_list_delete_access_key", func(t *testing.T) {
-		// Create access key
-		createResp, err := iamClient.CreateAccessKey(&iam.CreateAccessKeyInput{
-			UserName: aws.String(userName),
-		})
-		require.NoError(t, err)
-		assert.NotEmpty(t, *createResp.AccessKey.AccessKeyId)
-		assert.NotEmpty(t, *createResp.AccessKey.SecretAccessKey)
-		assert.Equal(t, "Active", *createResp.AccessKey.Status)
-
-		// List access keys
-		listResp, err := iamClient.ListAccessKeys(&iam.ListAccessKeysInput{
-			UserName: aws.String(userName),
-		})
-		require.NoError(t, err)
-		assert.Equal(t, 1, len(listResp.AccessKeyMetadata))
-		assert.Equal(t, *createResp.AccessKey.AccessKeyId, *listResp.AccessKeyMetadata[0].AccessKeyId)
-
-		// Delete access key
-		_, err = iamClient.DeleteAccessKey(&iam.DeleteAccessKeyInput{
-			UserName:    aws.String(userName),
-			AccessKeyId: createResp.AccessKey.AccessKeyId,
-		})
-		require.NoError(t, err)
-
-		// Verify deletion
-		listResp, err = iamClient.ListAccessKeys(&iam.ListAccessKeysInput{
-			UserName: aws.String(userName),
-		})
-		require.NoError(t, err)
-		assert.Equal(t, 0, len(listResp.AccessKeyMetadata))
-	})
-
-	t.Run("update_access_key_status", func(t *testing.T) {
-		// Create access key
-		createResp, err := iamClient.CreateAccessKey(&iam.CreateAccessKeyInput{
-			UserName: aws.String(userName),
-		})
-		require.NoError(t, err)
-		defer iamClient.DeleteAccessKey(&iam.DeleteAccessKeyInput{
-			UserName:    aws.String(userName),
-			AccessKeyId: createResp.AccessKey.AccessKeyId,
-		})
-
-		// Update to Inactive
-		_, err = iamClient.UpdateAccessKey(&iam.UpdateAccessKeyInput{
-			UserName:    aws.String(userName),
-			AccessKeyId: createResp.AccessKey.AccessKeyId,
-			Status:      aws.String("Inactive"),
-		})
-		require.NoError(t, err)
-
-		// Verify update in ListAccessKeys
-		listResp, err := iamClient.ListAccessKeys(&iam.ListAccessKeysInput{
-			UserName: aws.String(userName),
-		})
-		require.NoError(t, err)
-		found := false
-		for _, key := range listResp.AccessKeyMetadata {
-			if *key.AccessKeyId == *createResp.AccessKey.AccessKeyId {
-				assert.Equal(t, "Inactive", *key.Status)
-				found = true
-				break
-			}
-		}
-		assert.True(t, found)
-	})
-}
-
-// TestIAMPolicyManagement tests policy operations
-func TestIAMPolicyManagement(t *testing.T) {
-	framework := NewS3IAMTestFramework(t)
-	defer framework.Cleanup()
-
-	iamClient, err := framework.CreateIAMClientWithJWT("admin-user", "TestAdminRole")
-	require.NoError(t, err)
-
-	t.Run("create_managed_policy", func(t *testing.T) {
-		policyName := "test-managed-policy"
-		policyDoc := `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:ListBucket","Resource":"*"}]}`
-
-		createResp, err := iamClient.CreatePolicy(&iam.CreatePolicyInput{
-			PolicyName:     aws.String(policyName),
-			PolicyDocument: aws.String(policyDoc),
-		})
-		require.NoError(t, err)
-		assert.Equal(t, policyName, *createResp.Policy.PolicyName)
-		assert.NotEmpty(t, *createResp.Policy.Arn)
-
-		t.Cleanup(func() {
-			_, _ = iamClient.DeletePolicy(&iam.DeletePolicyInput{
-				PolicyArn: createResp.Policy.Arn,
-			})
-		})
-	})
-
-	t.Run("user_inline_policy", func(t *testing.T) {
-		userName := "test-user-policy"
-		_, err := iamClient.CreateUser(&iam.CreateUserInput{
-			UserName: aws.String(userName),
-		})
-		require.NoError(t, err)
-		defer iamClient.DeleteUser(&iam.DeleteUserInput{UserName: aws.String(userName)})
-
-		policyName := "test-inline-policy"
-		policyDoc := `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::*"}]}`
-
-		// Put user policy
-		_, err = iamClient.PutUserPolicy(&iam.PutUserPolicyInput{
-			UserName:       aws.String(userName),
-			PolicyName:     aws.String(policyName),
-			PolicyDocument: aws.String(policyDoc),
-		})
-		require.NoError(t, err)
-
-		// Get user policy
-		getResp, err := iamClient.GetUserPolicy(&iam.GetUserPolicyInput{
-			UserName:   aws.String(userName),
-			PolicyName: aws.String(policyName),
-		})
-		require.NoError(t, err)
-		assert.Equal(t, userName, *getResp.UserName)
-		assert.Equal(t, policyName, *getResp.PolicyName)
-		assert.Contains(t, *getResp.PolicyDocument, "s3:Get")
-
-		// Delete user policy
-		_, err = iamClient.DeleteUserPolicy(&iam.DeleteUserPolicyInput{
-			UserName:   aws.String(userName),
-			PolicyName: aws.String(policyName),
-		})
-		require.NoError(t, err)
-	})
-}

test/s3/iam/s3_iam_framework.go

@@ -21,7 +21,6 @@ import (
 	"github.com/aws/aws-sdk-go/aws/awserr"
 	"github.com/aws/aws-sdk-go/aws/credentials"
 	"github.com/aws/aws-sdk-go/aws/session"
-	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/aws/aws-sdk-go/service/s3"
 	"github.com/golang-jwt/jwt/v5"
 	"github.com/stretchr/testify/require"
@@ -684,13 +683,13 @@ func (f *S3IAMTestFramework) GenerateUniqueBucketName(prefix string) string {
 	randomSuffix := mathrand.Intn(10000)
 
 	bucketName := fmt.Sprintf("%s-%s-%d", prefix, testName, randomSuffix)
-
+	
 	// Ensure final name is valid
 	if len(bucketName) > 63 {
 		// Truncate further if necessary
 		bucketName = bucketName[:63]
 	}
-
+	
 	return bucketName
 }
 
@@ -905,49 +904,3 @@ func (f *S3IAMTestFramework) WaitForS3ServiceSimple() error {
 	// The full implementation would be in the Makefile's wait-for-services target
 	return nil
 }
-
-// CreateIAMClientWithJWT creates an IAM client authenticated with a JWT token for the specified role
-func (f *S3IAMTestFramework) CreateIAMClientWithJWT(username, roleName string) (*iam.IAM, error) {
-	return f.CreateIAMClientWithCustomClaims(username, roleName, "", nil)
-}
-
-// CreateIAMClientWithCustomClaims creates an IAM client with specific account ID and custom claims
-func (f *S3IAMTestFramework) CreateIAMClientWithCustomClaims(username, roleName, account string, claims map[string]interface{}) (*iam.IAM, error) {
-	var token string
-	var err error
-
-	if f.useKeycloak && claims == nil && account == "" {
-		// Use real Keycloak authentication if no custom requirements
-		token, err = f.getKeycloakToken(username)
-		if err != nil {
-			return nil, fmt.Errorf("failed to get Keycloak token: %v", err)
-		}
-	} else {
-		// Generate STS session token (mock mode or custom requirements)
-		token, err = f.generateSTSSessionToken(username, roleName, time.Hour, account, claims)
-		if err != nil {
-			return nil, fmt.Errorf("failed to generate STS session token: %v", err)
-		}
-	}
-
-	// Create custom HTTP client with Bearer token transport
-	httpClient := &http.Client{
-		Transport: &BearerTokenTransport{
-			Token: token,
-		},
-	}
-
-	sess, err := session.NewSession(&aws.Config{
-		Region:     aws.String(TestRegion),
-		Endpoint:   aws.String(TestS3Endpoint),
-		HTTPClient: httpClient,
-		// Use anonymous credentials to avoid AWS signature generation
-		Credentials: credentials.AnonymousCredentials,
-		DisableSSL:  aws.Bool(true),
-	})
-	if err != nil {
-		return nil, fmt.Errorf("failed to create AWS session: %v", err)
-	}
-
-	return iam.New(sess), nil
-}

test/s3/iam/test_config.json

@@ -8,35 +8,270 @@
           "secretKey": "test-secret-key"
         }
       ],
-      "actions": [
-        "Admin"
-      ]
+      "actions": ["Admin"]
     },
     {
-      "name": "readonlyuser",
+      "name": "readonlyuser", 
       "credentials": [
         {
           "accessKey": "readonly-access-key",
           "secretKey": "readonly-secret-key"
         }
       ],
-      "actions": [
-        "Read"
-      ]
+      "actions": ["Read"]
     },
     {
       "name": "writeonlyuser",
       "credentials": [
         {
-          "accessKey": "writeonly-access-key",
+          "accessKey": "writeonly-access-key", 
           "secretKey": "writeonly-secret-key"
         }
       ],
-      "actions": [
-        "Write"
-      ]
+      "actions": ["Write"]
     }
   ],
+  "iam": {
+    "enabled": true,
+    "sts": {
+      "tokenDuration": "15m",
+      "issuer": "seaweedfs-sts",
+      "signingKey": "dGVzdC1zaWduaW5nLWtleS0zMi1jaGFyYWN0ZXJzLWxvbmc="
+    },
+    "policy": {
+      "defaultEffect": "Deny"
+    },
+    "providers": {
+      "oidc": {
+        "test-oidc": {
+          "issuer": "http://localhost:8080/.well-known/openid_configuration",
+          "clientId": "test-client-id",
+          "jwksUri": "http://localhost:8080/jwks",
+          "userInfoUri": "http://localhost:8080/userinfo",
+          "roleMapping": {
+            "rules": [
+              {
+                "claim": "groups",
+                "claimValue": "admins", 
+                "roleName": "S3AdminRole"
+              },
+              {
+                "claim": "groups",
+                "claimValue": "users",
+                "roleName": "S3ReadOnlyRole"
+              },
+              {
+                "claim": "groups",
+                "claimValue": "writers",
+                "roleName": "S3WriteOnlyRole"
+              }
+            ]
+          },
+          "claimsMapping": {
+            "email": "email",
+            "displayName": "name",
+            "groups": "groups"
+          }
+        }
+      },
+      "ldap": {
+        "test-ldap": {
+          "server": "ldap://localhost:389",
+          "baseDN": "dc=example,dc=com",
+          "bindDN": "cn=admin,dc=example,dc=com", 
+          "bindPassword": "admin-password",
+          "userFilter": "(uid=%s)",
+          "groupFilter": "(memberUid=%s)",
+          "attributes": {
+            "email": "mail",
+            "displayName": "cn", 
+            "groups": "memberOf"
+          },
+          "roleMapping": {
+            "rules": [
+              {
+                "claim": "groups",
+                "claimValue": "cn=admins,ou=groups,dc=example,dc=com",
+                "roleName": "S3AdminRole"
+              },
+              {
+                "claim": "groups", 
+                "claimValue": "cn=users,ou=groups,dc=example,dc=com",
+                "roleName": "S3ReadOnlyRole"
+              }
+            ]
+          }
+        }
+      }
+    },
+    "policyStore": {}
+  },
+  "roles": {
+    "S3AdminRole": {
+      "trustPolicy": {
+        "Version": "2012-10-17",
+        "Statement": [
+          {
+            "Effect": "Allow",
+            "Principal": {
+              "Federated": ["test-oidc", "test-ldap"]
+            },
+            "Action": "sts:AssumeRoleWithWebIdentity"
+          }
+        ]
+      },
+      "attachedPolicies": ["S3AdminPolicy"],
+      "description": "Full administrative access to S3 resources"
+    },
+    "S3ReadOnlyRole": {
+      "trustPolicy": {
+        "Version": "2012-10-17",
+        "Statement": [
+          {
+            "Effect": "Allow", 
+            "Principal": {
+              "Federated": ["test-oidc", "test-ldap"]
+            },
+            "Action": "sts:AssumeRoleWithWebIdentity"
+          }
+        ]
+      },
+      "attachedPolicies": ["S3ReadOnlyPolicy"],
+      "description": "Read-only access to S3 resources"
+    },
+    "S3WriteOnlyRole": {
+      "trustPolicy": {
+        "Version": "2012-10-17",
+        "Statement": [
+          {
+            "Effect": "Allow",
+            "Principal": {
+              "Federated": ["test-oidc", "test-ldap"] 
+            },
+            "Action": "sts:AssumeRoleWithWebIdentity"
+          }
+        ]
+      },
+      "attachedPolicies": ["S3WriteOnlyPolicy"],
+      "description": "Write-only access to S3 resources"
+    }
+  },
+  "policies": {
+    "S3AdminPolicy": {
+      "Version": "2012-10-17",
+      "Statement": [
+        {
+          "Effect": "Allow",
+          "Action": ["s3:*"],
+          "Resource": [
+            "arn:aws:s3:::*",
+            "arn:aws:s3:::*/*"
+          ]
+        }
+      ]
+    },
+    "S3ReadOnlyPolicy": {
+      "Version": "2012-10-17", 
+      "Statement": [
+        {
+          "Effect": "Allow",
+          "Action": [
+            "s3:GetObject",
+            "s3:GetObjectVersion", 
+            "s3:ListBucket",
+            "s3:ListBucketVersions",
+            "s3:GetBucketLocation",
+            "s3:GetBucketVersioning"
+          ],
+          "Resource": [
+            "arn:aws:s3:::*",
+            "arn:aws:s3:::*/*"
+          ]
+        }
+      ]
+    },
+    "S3WriteOnlyPolicy": {
+      "Version": "2012-10-17",
+      "Statement": [
+        {
+          "Effect": "Allow",
+          "Action": [
+            "s3:PutObject",
+            "s3:PutObjectAcl",
+            "s3:DeleteObject",
+            "s3:DeleteObjectVersion",
+            "s3:InitiateMultipartUpload",
+            "s3:UploadPart", 
+            "s3:CompleteMultipartUpload",
+            "s3:AbortMultipartUpload",
+            "s3:ListMultipartUploadParts"
+          ],
+          "Resource": [
+            "arn:aws:s3:::*/*"
+          ]
+        }
+      ]
+    },
+    "S3BucketManagementPolicy": {
+      "Version": "2012-10-17",
+      "Statement": [
+        {
+          "Effect": "Allow",
+          "Action": [
+            "s3:CreateBucket",
+            "s3:DeleteBucket", 
+            "s3:GetBucketPolicy",
+            "s3:PutBucketPolicy",
+            "s3:DeleteBucketPolicy",
+            "s3:GetBucketVersioning",
+            "s3:PutBucketVersioning"
+          ],
+          "Resource": [
+            "arn:aws:s3:::*"
+          ]
+        }
+      ]
+    },
+    "S3IPRestrictedPolicy": {
+      "Version": "2012-10-17",
+      "Statement": [
+        {
+          "Effect": "Allow",
+          "Action": ["s3:*"],
+          "Resource": [
+            "arn:aws:s3:::*",
+            "arn:aws:s3:::*/*"
+          ],
+          "Condition": {
+            "IpAddress": {
+              "aws:SourceIp": ["192.168.1.0/24", "10.0.0.0/8"]
+            }
+          }
+        }
+      ]
+    },
+    "S3TimeBasedPolicy": {
+      "Version": "2012-10-17",
+      "Statement": [
+        {
+          "Effect": "Allow", 
+          "Action": ["s3:GetObject", "s3:ListBucket"],
+          "Resource": [
+            "arn:aws:s3:::*",
+            "arn:aws:s3:::*/*"
+          ],
+          "Condition": {
+            "DateGreaterThan": {
+              "aws:CurrentTime": "2023-01-01T00:00:00Z"
+            },
+            "DateLessThan": {
+              "aws:CurrentTime": "2025-12-31T23:59:59Z" 
+            }
+          }
+        }
+      ]
+    }
+  },
   "bucketPolicyExamples": {
     "PublicReadPolicy": {
       "Version": "2012-10-17",
@@ -45,7 +280,7 @@
           "Sid": "PublicReadGetObject",
           "Effect": "Allow",
           "Principal": "*",
-          "Action": "s3:GetObject",
+          "Action": "s3:GetObject", 
           "Resource": "arn:aws:s3:::example-bucket/*"
         }
       ]
@@ -57,10 +292,7 @@
           "Sid": "DenyDeleteOperations",
           "Effect": "Deny",
           "Principal": "*",
-          "Action": [
-            "s3:DeleteObject",
-            "s3:DeleteBucket"
-          ],
+          "Action": ["s3:DeleteObject", "s3:DeleteBucket"],
           "Resource": [
             "arn:aws:s3:::example-bucket",
             "arn:aws:s3:::example-bucket/*"
@@ -73,22 +305,17 @@
       "Statement": [
         {
           "Sid": "IPRestrictedAccess",
-          "Effect": "Allow",
+          "Effect": "Allow", 
           "Principal": "*",
-          "Action": [
-            "s3:GetObject",
-            "s3:PutObject"
-          ],
+          "Action": ["s3:GetObject", "s3:PutObject"],
           "Resource": "arn:aws:s3:::example-bucket/*",
           "Condition": {
             "IpAddress": {
-              "aws:SourceIp": [
-                "203.0.113.0/24"
-              ]
+              "aws:SourceIp": ["203.0.113.0/24"]
             }
           }
         }
       ]
     }
   }
-}
+}

test/s3/normal/iam_test.go

@@ -1,158 +0,0 @@
-package example
-
-import (
-	"os"
-	"testing"
-	"time"
-
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/credentials"
-	"github.com/aws/aws-sdk-go/aws/session"
-	"github.com/aws/aws-sdk-go/service/iam"
-	"github.com/stretchr/testify/require"
-)
-
-// TestIAMOperations tests authenticated IAM operations with AWS Signature V4
-// All IAM operations require proper authentication.
-func TestIAMOperations(t *testing.T) {
-	if testing.Short() {
-		t.Skip("Skipping integration test in short mode")
-	}
-
-	// Set credentials before starting cluster
-	accessKey := "testkey123"
-	secretKey := "testsecret456"
-	os.Setenv("AWS_ACCESS_KEY_ID", accessKey)
-	os.Setenv("AWS_SECRET_ACCESS_KEY", secretKey)
-	defer os.Unsetenv("AWS_ACCESS_KEY_ID")
-	defer os.Unsetenv("AWS_SECRET_ACCESS_KEY")
-
-	// Create and start test cluster
-	cluster, err := startMiniCluster(t)
-	require.NoError(t, err)
-	defer cluster.Stop()
-
-	// Wait for services to be fully ready
-	time.Sleep(500 * time.Millisecond)
-
-	// Create IAM client with credentials
-	sess, err := session.NewSession(&aws.Config{
-		Region:           aws.String("us-west-2"),
-		Endpoint:         aws.String(cluster.s3Endpoint),
-		DisableSSL:       aws.Bool(true),
-		Credentials:      credentials.NewStaticCredentials(accessKey, secretKey, ""),
-		S3ForcePathStyle: aws.Bool(true),
-	})
-	require.NoError(t, err)
-
-	iamClient := iam.New(sess)
-
-	// Run all IAM tests with authentication
-	t.Run("CreateUser", func(t *testing.T) {
-		testCreateUserAuthenticated(t, iamClient)
-	})
-
-	t.Run("ListUsers", func(t *testing.T) {
-		testListUsersAuthenticated(t, iamClient)
-	})
-
-	t.Run("GetUser", func(t *testing.T) {
-		testGetUserAuthenticated(t, iamClient)
-	})
-
-	t.Run("DeleteUser", func(t *testing.T) {
-		testDeleteUserAuthenticated(t, iamClient)
-	})
-}
-
-// testCreateUserAuthenticated tests CreateUser with AWS Signature V4 authentication
-func testCreateUserAuthenticated(t *testing.T, iamClient *iam.IAM) {
-	userName := "alice-" + randomString(8)
-
-	input := &iam.CreateUserInput{
-		UserName: aws.String(userName),
-	}
-
-	result, err := iamClient.CreateUser(input)
-	require.NoError(t, err, "Authenticated CreateUser should succeed")
-	require.NotNil(t, result.User)
-	require.Equal(t, userName, *result.User.UserName)
-
-	t.Logf("✓ Created user with authentication: %s", userName)
-}
-
-// testListUsersAuthenticated tests ListUsers with authentication
-func testListUsersAuthenticated(t *testing.T, iamClient *iam.IAM) {
-	// First create a user
-	userName := "listauth-" + randomString(8)
-	_, err := iamClient.CreateUser(&iam.CreateUserInput{
-		UserName: aws.String(userName),
-	})
-	require.NoError(t, err)
-
-	// Wait for user to be persisted
-	time.Sleep(100 * time.Millisecond)
-
-	// List users
-	result, err := iamClient.ListUsers(&iam.ListUsersInput{})
-	require.NoError(t, err, "Authenticated ListUsers should succeed")
-	require.NotNil(t, result.Users)
-
-	// Verify our user is in the list
-	found := false
-	for _, user := range result.Users {
-		if *user.UserName == userName {
-			found = true
-			break
-		}
-	}
-	require.True(t, found, "Created user should be in the list")
-
-	t.Logf("✓ Listed %d users with authentication", len(result.Users))
-}
-
-// testGetUserAuthenticated tests GetUser with authentication
-func testGetUserAuthenticated(t *testing.T, iamClient *iam.IAM) {
-	userName := "getauth-" + randomString(8)
-
-	// Create user
-	_, err := iamClient.CreateUser(&iam.CreateUserInput{
-		UserName: aws.String(userName),
-	})
-	require.NoError(t, err)
-
-	// Wait for user to be persisted
-	time.Sleep(100 * time.Millisecond)
-
-	// Get user
-	result, err := iamClient.GetUser(&iam.GetUserInput{
-		UserName: aws.String(userName),
-	})
-	require.NoError(t, err, "Authenticated GetUser should succeed")
-	require.NotNil(t, result.User)
-	require.Equal(t, userName, *result.User.UserName)
-
-	t.Logf("✓ Got user with authentication: %s", userName)
-}
-
-// testDeleteUserAuthenticated tests DeleteUser with authentication
-func testDeleteUserAuthenticated(t *testing.T, iamClient *iam.IAM) {
-	userName := "delauth-" + randomString(8)
-
-	// Create user
-	_, err := iamClient.CreateUser(&iam.CreateUserInput{
-		UserName: aws.String(userName),
-	})
-	require.NoError(t, err)
-
-	// Wait for user to be persisted
-	time.Sleep(100 * time.Millisecond)
-
-	// Delete user
-	_, err = iamClient.DeleteUser(&iam.DeleteUserInput{
-		UserName: aws.String(userName),
-	})
-	require.NoError(t, err, "Authenticated DeleteUser should succeed")
-
-	t.Logf("✓ Deleted user with authentication: %s", userName)
-}

test/s3/normal/s3_integration_test.go

@@ -1,487 +0,0 @@
-package example
-
-import (
-	"bytes"
-	"context"
-	"fmt"
-	"math/rand"
-	"net"
-	"net/http"
-	"os"
-	"path/filepath"
-	"strconv"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/credentials"
-	"github.com/aws/aws-sdk-go/aws/session"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/seaweedfs/seaweedfs/weed/command"
-	"github.com/seaweedfs/seaweedfs/weed/glog"
-	flag "github.com/seaweedfs/seaweedfs/weed/util/fla9"
-)
-
-const (
-	testRegion    = "us-west-2"
-	testAccessKey = "admin"
-	testSecretKey = "admin"
-)
-
-// TestCluster manages the weed mini instance for integration testing
-type TestCluster struct {
-	dataDir      string
-	ctx          context.Context
-	cancel       context.CancelFunc
-	s3Client     *s3.S3
-	isRunning    bool
-	startOnce    sync.Once
-	wg           sync.WaitGroup
-	masterPort   int
-	volumePort   int
-	filerPort    int
-	s3Port       int
-	s3Endpoint   string
-}
-
-// TestS3Integration demonstrates basic S3 operations against a running weed mini instance
-func TestS3Integration(t *testing.T) {
-	if testing.Short() {
-		t.Skip("Skipping integration test in short mode")
-	}
-
-	// Create and start test cluster
-	cluster, err := startMiniCluster(t)
-	require.NoError(t, err)
-	defer cluster.Stop()
-
-	// Run test suite
-	t.Run("CreateBucket", func(t *testing.T) {
-		testCreateBucket(t, cluster)
-	})
-
-	t.Run("PutObject", func(t *testing.T) {
-		testPutObject(t, cluster)
-	})
-
-	t.Run("GetObject", func(t *testing.T) {
-		testGetObject(t, cluster)
-	})
-
-	t.Run("ListObjects", func(t *testing.T) {
-		testListObjects(t, cluster)
-	})
-
-	t.Run("DeleteObject", func(t *testing.T) {
-		testDeleteObject(t, cluster)
-	})
-
-	t.Run("DeleteBucket", func(t *testing.T) {
-		testDeleteBucket(t, cluster)
-	})
-}
-
-// findAvailablePort finds an available port by binding to port 0
-func findAvailablePort() (int, error) {
-	listener, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		return 0, err
-	}
-	defer listener.Close()
-
-	addr := listener.Addr().(*net.TCPAddr)
-	return addr.Port, nil
-}
-
-// startMiniCluster starts a weed mini instance directly without exec
-func startMiniCluster(t *testing.T) (*TestCluster, error) {
-	// Find available ports
-	masterPort, err := findAvailablePort()
-	if err != nil {
-		return nil, fmt.Errorf("failed to find master port: %v", err)
-	}
-	volumePort, err := findAvailablePort()
-	if err != nil {
-		return nil, fmt.Errorf("failed to find volume port: %v", err)
-	}
-	filerPort, err := findAvailablePort()
-	if err != nil {
-		return nil, fmt.Errorf("failed to find filer port: %v", err)
-	}
-	s3Port, err := findAvailablePort()
-	if err != nil {
-		return nil, fmt.Errorf("failed to find s3 port: %v", err)
-	}
-	// Create temporary directory for test data
-	testDir := t.TempDir()
-
-	// Ensure no configuration file from previous runs
-	configFile := filepath.Join(testDir, "mini.options")
-	_ = os.Remove(configFile)
-
-	// Create context with timeout
-	ctx, cancel := context.WithCancel(context.Background())
-
-	s3Endpoint := fmt.Sprintf("http://127.0.0.1:%d", s3Port)
-	cluster := &TestCluster{
-		dataDir:    testDir,
-		ctx:        ctx,
-		cancel:     cancel,
-		masterPort: masterPort,
-		volumePort: volumePort,
-		filerPort:  filerPort,
-		s3Port:     s3Port,
-		s3Endpoint: s3Endpoint,
-	}
-
-	// Create empty security.toml to disable JWT authentication in tests
-	securityToml := filepath.Join(testDir, "security.toml")
-	err = os.WriteFile(securityToml, []byte("# Empty security config for testing\n"), 0644)
-	if err != nil {
-		cancel()
-		return nil, fmt.Errorf("failed to create security.toml: %v", err)
-	}
-
-	// Start weed mini in a goroutine by calling the command directly
-	cluster.wg.Add(1)
-	go func() {
-		defer cluster.wg.Done()
-
-		// Save current directory and args
-		oldDir, _ := os.Getwd()
-		oldArgs := os.Args
-		defer func() {
-			os.Chdir(oldDir)
-			os.Args = oldArgs
-		}()
-
-		// Change to test directory so mini picks up security.toml
-		os.Chdir(testDir)
-
-		// Configure args for mini command
-		// Note: When running via 'go test', os.Args[0] is the test binary
-		// We need to make it look like we're running 'weed mini'
-		os.Args = []string{
-			"weed",
-			"-dir=" + testDir,
-			"-master.port=" + strconv.Itoa(masterPort),
-			"-volume.port=" + strconv.Itoa(volumePort),
-			"-filer.port=" + strconv.Itoa(filerPort),
-			"-s3.port=" + strconv.Itoa(s3Port),
-			"-webdav.port=0", // Disable WebDAV
-			"-admin.ui=false", // Disable admin UI
-			"-master.volumeSizeLimitMB=32", // Small volumes for testing
-			"-ip=127.0.0.1",
-			"-master.peers=none", // Faster startup
-		}
-
-		// Suppress most logging during tests
-		glog.MaxSize = 1024 * 1024
-
-		// Find and run the mini command
-		// We simulate how main.go executes commands
-		for _, cmd := range command.Commands {
-			if cmd.Name() == "mini" && cmd.Run != nil {
-				// Parse the flags for the mini command
-				// Don't include "weed" in the args
-				cmd.Flag.Parse(os.Args[1:])
-				args := cmd.Flag.Args()
-				cmd.Run(cmd, args)
-				return
-			}
-		}
-	}()
-
-	// Wait for S3 service to be ready
-	err = waitForS3Ready(cluster.s3Endpoint, 30*time.Second)
-	if err != nil {
-		cancel()
-		return nil, fmt.Errorf("S3 service failed to start: %v", err)
-	}
-
-	cluster.isRunning = true
-
-	// Create S3 client
-	sess, err := session.NewSession(&aws.Config{
-		Region:           aws.String(testRegion),
-		Endpoint:         aws.String(cluster.s3Endpoint),
-		DisableSSL:       aws.Bool(true),
-		S3ForcePathStyle: aws.Bool(true),
-		Credentials:      credentials.NewStaticCredentials(testAccessKey, testSecretKey, ""),
-	})
-	if err != nil {
-		cancel()
-		return nil, fmt.Errorf("failed to create AWS session: %v", err)
-	}
-
-	cluster.s3Client = s3.New(sess)
-
-	t.Logf("Test cluster started successfully at %s", cluster.s3Endpoint)
-	return cluster, nil
-}
-
-// Stop stops the test cluster
-func (c *TestCluster) Stop() {
-	if c.cancel != nil {
-		c.cancel()
-	}
-	// Give services time to shut down gracefully
-	if c.isRunning {
-		time.Sleep(500 * time.Millisecond)
-	}
-	// Wait for the mini goroutine to finish
-	done := make(chan struct{})
-	go func() {
-		c.wg.Wait()
-		close(done)
-	}()
-	select {
-	case <-done:
-		// Goroutine finished
-	case <-time.After(2 * time.Second):
-		// Timeout - goroutine doesn't respond to context cancel
-	}
-	
-	// Reset the global cmdMini flags to prevent state leakage to other tests
-	for _, cmd := range command.Commands {
-		if cmd.Name() == "mini" {
-			// Reset flags to defaults
-			cmd.Flag.VisitAll(func(f *flag.Flag) {
-				// Reset to default value
-				f.Value.Set(f.DefValue)
-			})
-			break
-		}
-	}
-}
-
-// waitForS3Ready waits for the S3 service to be ready
-func waitForS3Ready(endpoint string, timeout time.Duration) error {
-	client := &http.Client{Timeout: 1 * time.Second}
-	deadline := time.Now().Add(timeout)
-
-	for time.Now().Before(deadline) {
-		resp, err := client.Get(endpoint)
-		if err == nil {
-			resp.Body.Close()
-			// Wait a bit more to ensure service is fully ready
-			time.Sleep(500 * time.Millisecond)
-			return nil
-		}
-		time.Sleep(200 * time.Millisecond)
-	}
-
-	return fmt.Errorf("timeout waiting for S3 service at %s", endpoint)
-}
-
-// Test functions
-
-func testCreateBucket(t *testing.T, cluster *TestCluster) {
-	bucketName := "test-bucket-" + randomString(8)
-
-	_, err := cluster.s3Client.CreateBucket(&s3.CreateBucketInput{
-		Bucket: aws.String(bucketName),
-	})
-	require.NoError(t, err, "Failed to create bucket")
-
-	// Wait a bit for bucket to be fully created
-	time.Sleep(100 * time.Millisecond)
-
-	// Verify bucket exists by trying to head it
-	// Note: ListBuckets may not immediately show new buckets in SeaweedFS
-	_, err = cluster.s3Client.HeadBucket(&s3.HeadBucketInput{
-		Bucket: aws.String(bucketName),
-	})
-	require.NoError(t, err, "Bucket should be accessible via HeadBucket")
-
-	t.Logf("✓ Created bucket: %s", bucketName)
-}
-
-func testPutObject(t *testing.T, cluster *TestCluster) {
-	bucketName := "test-put-" + randomString(8)
-	objectKey := "test-object.txt"
-	objectData := "Hello, SeaweedFS S3!"
-
-	// Create bucket
-	_, err := cluster.s3Client.CreateBucket(&s3.CreateBucketInput{
-		Bucket: aws.String(bucketName),
-	})
-	require.NoError(t, err)
-
-	// Wait a bit for bucket to be fully created
-	time.Sleep(100 * time.Millisecond)
-
-	// Put object
-	_, err = cluster.s3Client.PutObject(&s3.PutObjectInput{
-		Bucket: aws.String(bucketName),
-		Key:    aws.String(objectKey),
-		Body:   bytes.NewReader([]byte(objectData)),
-	})
-	require.NoError(t, err, "Failed to put object")
-
-	// Verify object exists
-	headResp, err := cluster.s3Client.HeadObject(&s3.HeadObjectInput{
-		Bucket: aws.String(bucketName),
-		Key:    aws.String(objectKey),
-	})
-	require.NoError(t, err)
-	assert.NotNil(t, headResp.ContentLength)
-	assert.Equal(t, int64(len(objectData)), aws.Int64Value(headResp.ContentLength))
-
-	t.Logf("✓ Put object: %s/%s (%d bytes)", bucketName, objectKey, len(objectData))
-}
-
-func testGetObject(t *testing.T, cluster *TestCluster) {
-	bucketName := "test-get-" + randomString(8)
-	objectKey := "test-data.txt"
-	objectData := "This is test data for GET operation"
-
-	// Create bucket and put object
-	_, err := cluster.s3Client.CreateBucket(&s3.CreateBucketInput{
-		Bucket: aws.String(bucketName),
-	})
-	require.NoError(t, err)
-
-	// Wait a bit for bucket to be fully created
-	time.Sleep(200 * time.Millisecond)
-
-	_, err = cluster.s3Client.PutObject(&s3.PutObjectInput{
-		Bucket: aws.String(bucketName),
-		Key:    aws.String(objectKey),
-		Body:   bytes.NewReader([]byte(objectData)),
-	})
-	require.NoError(t, err)
-
-	// Wait a bit for object to be fully written
-	time.Sleep(300 * time.Millisecond)
-
-	// Verify object metadata via HeadObject (more reliable than GetObject in mini mode)
-	headResp, err := cluster.s3Client.HeadObject(&s3.HeadObjectInput{
-		Bucket: aws.String(bucketName),
-		Key:    aws.String(objectKey),
-	})
-	require.NoError(t, err, "Failed to head object")
-	assert.NotNil(t, headResp.ContentLength)
-	assert.Equal(t, int64(len(objectData)), aws.Int64Value(headResp.ContentLength))
-
-	t.Logf("✓ Got object metadata: %s/%s (verified %d bytes via HEAD)", bucketName, objectKey, len(objectData))
-	
-	// Note: GetObject can sometimes have volume location issues in mini mode during tests
-	// The object is correctly stored (as verified by HEAD), which demonstrates S3 functionality
-}
-
-func testListObjects(t *testing.T, cluster *TestCluster) {
-	bucketName := "test-list-" + randomString(8)
-
-	// Create bucket
-	_, err := cluster.s3Client.CreateBucket(&s3.CreateBucketInput{
-		Bucket: aws.String(bucketName),
-	})
-	require.NoError(t, err)
-
-	// Put multiple objects
-	objectKeys := []string{"file1.txt", "file2.txt", "file3.txt"}
-	for _, key := range objectKeys {
-		_, err = cluster.s3Client.PutObject(&s3.PutObjectInput{
-			Bucket: aws.String(bucketName),
-			Key:    aws.String(key),
-			Body:   bytes.NewReader([]byte("test data for " + key)),
-		})
-		require.NoError(t, err)
-	}
-
-	// List objects
-	listResp, err := cluster.s3Client.ListObjectsV2(&s3.ListObjectsV2Input{
-		Bucket: aws.String(bucketName),
-	})
-	require.NoError(t, err, "Failed to list objects")
-
-	// Verify all objects are listed
-	assert.Equal(t, len(objectKeys), len(listResp.Contents), "Should list all objects")
-
-	foundKeys := make(map[string]bool)
-	for _, obj := range listResp.Contents {
-		foundKeys[aws.StringValue(obj.Key)] = true
-	}
-
-	for _, key := range objectKeys {
-		assert.True(t, foundKeys[key], "Object %s should be in list", key)
-	}
-
-	t.Logf("✓ Listed %d objects in bucket: %s", len(listResp.Contents), bucketName)
-}
-
-func testDeleteObject(t *testing.T, cluster *TestCluster) {
-	bucketName := "test-delete-" + randomString(8)
-	objectKey := "to-be-deleted.txt"
-
-	// Create bucket and put object
-	_, err := cluster.s3Client.CreateBucket(&s3.CreateBucketInput{
-		Bucket: aws.String(bucketName),
-	})
-	require.NoError(t, err)
-
-	_, err = cluster.s3Client.PutObject(&s3.PutObjectInput{
-		Bucket: aws.String(bucketName),
-		Key:    aws.String(objectKey),
-		Body:   bytes.NewReader([]byte("This will be deleted")),
-	})
-	require.NoError(t, err)
-
-	// Delete object
-	_, err = cluster.s3Client.DeleteObject(&s3.DeleteObjectInput{
-		Bucket: aws.String(bucketName),
-		Key:    aws.String(objectKey),
-	})
-	require.NoError(t, err, "Failed to delete object")
-
-	// Verify object is gone
-	_, err = cluster.s3Client.HeadObject(&s3.HeadObjectInput{
-		Bucket: aws.String(bucketName),
-		Key:    aws.String(objectKey),
-	})
-	assert.Error(t, err, "Object should not exist after deletion")
-
-	t.Logf("✓ Deleted object: %s/%s", bucketName, objectKey)
-}
-
-func testDeleteBucket(t *testing.T, cluster *TestCluster) {
-	bucketName := "test-delete-bucket-" + randomString(8)
-
-	// Create bucket
-	_, err := cluster.s3Client.CreateBucket(&s3.CreateBucketInput{
-		Bucket: aws.String(bucketName),
-	})
-	require.NoError(t, err)
-
-	// Delete bucket
-	_, err = cluster.s3Client.DeleteBucket(&s3.DeleteBucketInput{
-		Bucket: aws.String(bucketName),
-	})
-	require.NoError(t, err, "Failed to delete bucket")
-
-	// Verify bucket is gone
-	resp, err := cluster.s3Client.ListBuckets(&s3.ListBucketsInput{})
-	require.NoError(t, err)
-
-	for _, bucket := range resp.Buckets {
-		assert.NotEqual(t, bucketName, aws.StringValue(bucket.Name), "Bucket should not exist after deletion")
-	}
-
-	t.Logf("✓ Deleted bucket: %s", bucketName)
-}
-
-// randomString generates a random string for unique naming
-func randomString(length int) string {
-	const charset = "abcdefghijklmnopqrstuvwxyz0123456789"
-	rng := rand.New(rand.NewSource(time.Now().UnixNano()))
-	b := make([]byte, length)
-	for i := range b {
-		b[i] = charset[rng.Intn(len(charset))]
-	}
-	return string(b)
-}

test/s3/policy/policy_test.go

@@ -1,296 +0,0 @@
-package policy
-
-import (
-	"context"
-	"fmt"
-	"net"
-	"net/http"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strconv"
-	"strings"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/seaweedfs/seaweedfs/weed/command"
-	"github.com/seaweedfs/seaweedfs/weed/glog"
-	flag "github.com/seaweedfs/seaweedfs/weed/util/fla9"
-	"github.com/stretchr/testify/require"
-)
-
-// TestCluster manages the weed mini instance for integration testing
-type TestCluster struct {
-	dataDir    string
-	ctx        context.Context
-	cancel     context.CancelFunc
-	isRunning  bool
-	wg         sync.WaitGroup
-	masterPort int
-	volumePort int
-	filerPort  int
-	s3Port     int
-	s3Endpoint string
-}
-
-func TestS3PolicyShellRevised(t *testing.T) {
-	if testing.Short() {
-		t.Skip("Skipping integration test in short mode")
-	}
-	cluster, err := startMiniCluster(t)
-	require.NoError(t, err)
-	defer cluster.Stop()
-
-	policyContent := `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"*","Resource":"*"}]}`
-	tmpPolicyFile, err := os.CreateTemp("", "test_policy_*.json")
-	if err != nil {
-		t.Fatalf("Failed to create temp policy file: %v", err)
-	}
-	defer os.Remove(tmpPolicyFile.Name())
-	_, err = tmpPolicyFile.WriteString(policyContent)
-	require.NoError(t, err)
-	require.NoError(t, tmpPolicyFile.Close())
-
-	weedCmd := "weed"
-	masterAddr := fmt.Sprintf("127.0.0.1:%d", cluster.masterPort)
-	filerAddr := fmt.Sprintf("127.0.0.1:%d", cluster.filerPort)
-
-	// Put
-	execShell(t, weedCmd, masterAddr, filerAddr, fmt.Sprintf("s3.policy -put -name=testpolicy -file=%s", tmpPolicyFile.Name()))
-
-	// List
-	out := execShell(t, weedCmd, masterAddr, filerAddr, "s3.policy -list")
-	if !contains(out, "Name: testpolicy") {
-		t.Errorf("List failed: %s", out)
-	}
-
-	// Get
-	out = execShell(t, weedCmd, masterAddr, filerAddr, "s3.policy -get -name=testpolicy")
-	if !contains(out, "Statement") {
-		t.Errorf("Get failed: %s", out)
-	}
-
-	// Delete
-	execShell(t, weedCmd, masterAddr, filerAddr, "s3.policy -delete -name=testpolicy")
-
-	// Verify
-	out = execShell(t, weedCmd, masterAddr, filerAddr, "s3.policy -list")
-	if contains(out, "Name: testpolicy") {
-		t.Errorf("delete failed, policy 'testpolicy' should not be in the list: %s", out)
-	}
-	// Verify s3.configure linking policies
-	execShell(t, weedCmd, masterAddr, filerAddr, "s3.configure -user=test -actions=Read -policies=testpolicy -apply")
-	out = execShell(t, weedCmd, masterAddr, filerAddr, "s3.configure")
-	if !contains(out, "\"policyNames\": [\n    \"testpolicy\"\n  ]") {
-		// relaxed check
-		if !contains(out, "\"testpolicy\"") || !contains(out, "policyNames") {
-			t.Errorf("s3.configure failed to link policy: %s", out)
-		}
-	}
-
-	// 1. Update User: Add Write action
-	execShell(t, weedCmd, masterAddr, filerAddr, "s3.configure -user=test -actions=Write -apply")
-	out = execShell(t, weedCmd, masterAddr, filerAddr, "s3.configure")
-	if !contains(out, "Write") {
-		t.Errorf("s3.configure failed to add Write action: %s", out)
-	}
-
-	// 2. Granular Delete: Delete Read action
-	execShell(t, weedCmd, masterAddr, filerAddr, "s3.configure -user=test -actions=Read -delete -apply")
-	out = execShell(t, weedCmd, masterAddr, filerAddr, "s3.configure")
-	if contains(out, "\"Read\"") { // Quote to avoid matching partial words if any
-		t.Errorf("s3.configure failed to delete Read action: %s", out)
-	}
-	if !contains(out, "Write") {
-		t.Errorf("s3.configure deleted Write action unnecessarily: %s", out)
-	}
-
-	// 3. Access Key Management
-	execShell(t, weedCmd, masterAddr, filerAddr, "s3.configure -user=test -access_key=testkey -secret_key=testsecret -apply")
-	out = execShell(t, weedCmd, masterAddr, filerAddr, "s3.configure")
-	if !contains(out, "testkey") {
-		t.Errorf("s3.configure failed to add access key: %s", out)
-	}
-
-	execShell(t, weedCmd, masterAddr, filerAddr, "s3.configure -user=test -access_key=testkey -delete -apply")
-	out = execShell(t, weedCmd, masterAddr, filerAddr, "s3.configure")
-	if contains(out, "testkey") {
-		t.Errorf("s3.configure failed to delete access key: %s", out)
-	}
-
-	// 4. Delete User
-	execShell(t, weedCmd, masterAddr, filerAddr, "s3.configure -user=test -delete -apply")
-	out = execShell(t, weedCmd, masterAddr, filerAddr, "s3.configure")
-	if contains(out, "\"Name\": \"test\"") {
-		t.Errorf("s3.configure failed to delete user: %s", out)
-	}
-}
-
-func execShell(t *testing.T, weedCmd, master, filer, shellCmd string) string {
-	// weed shell -master=... -filer=...
-	args := []string{"shell", "-master=" + master, "-filer=" + filer}
-	t.Logf("Running: %s %v <<< %s", weedCmd, args, shellCmd)
-
-	cmd := exec.Command(weedCmd, args...)
-	cmd.Stdin = strings.NewReader(shellCmd + "\n")
-
-	out, err := cmd.CombinedOutput()
-	if err != nil {
-		t.Fatalf("Failed to run %s: %v\nOutput: %s", shellCmd, err, string(out))
-	}
-	return string(out)
-}
-
-// --- Test setup helpers ---
-
-func findAvailablePort() (int, error) {
-	listener, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		return 0, err
-	}
-	defer listener.Close()
-	addr := listener.Addr().(*net.TCPAddr)
-	return addr.Port, nil
-}
-
-// findAvailablePortPair finds an available http port P such that P and P+10000 (grpc) are both available
-func findAvailablePortPair() (int, int, error) {
-	for i := 0; i < 100; i++ {
-		httpPort, err := findAvailablePort()
-		if err != nil {
-			return 0, 0, err
-		}
-		grpcPort := httpPort + 10000
-
-		// check if grpc port is available
-		listener, err := net.Listen("tcp", fmt.Sprintf("127.0.0.1:%d", grpcPort))
-		if err == nil {
-			listener.Close()
-			return httpPort, grpcPort, nil
-		}
-	}
-	return 0, 0, fmt.Errorf("failed to find available port pair")
-}
-
-func startMiniCluster(t *testing.T) (*TestCluster, error) {
-	masterPort, masterGrpcPort, err := findAvailablePortPair()
-	require.NoError(t, err)
-	volumePort, volumeGrpcPort, err := findAvailablePortPair()
-	require.NoError(t, err)
-	filerPort, filerGrpcPort, err := findAvailablePortPair()
-	require.NoError(t, err)
-	s3Port, s3GrpcPort, err := findAvailablePortPair()
-	require.NoError(t, err)
-
-	testDir := t.TempDir()
-
-	ctx, cancel := context.WithCancel(context.Background())
-	s3Endpoint := fmt.Sprintf("http://127.0.0.1:%d", s3Port)
-	cluster := &TestCluster{
-		dataDir:    testDir,
-		ctx:        ctx,
-		cancel:     cancel,
-		masterPort: masterPort,
-		volumePort: volumePort,
-		filerPort:  filerPort,
-		s3Port:     s3Port,
-		s3Endpoint: s3Endpoint,
-	}
-
-	// Disable authentication for tests
-	securityToml := filepath.Join(testDir, "security.toml")
-	err = os.WriteFile(securityToml, []byte("# Empty security config\n"), 0644)
-	require.NoError(t, err)
-
-	// Configure credential store for IAM tests
-	credentialToml := filepath.Join(testDir, "credential.toml")
-	credentialConfig := `
-[credential.memory]
-enabled = true
-`
-	err = os.WriteFile(credentialToml, []byte(credentialConfig), 0644)
-	require.NoError(t, err)
-
-	cluster.wg.Add(1)
-	go func() {
-		defer cluster.wg.Done()
-		oldDir, _ := os.Getwd()
-		oldArgs := os.Args
-		defer func() {
-			os.Chdir(oldDir)
-			os.Args = oldArgs
-		}()
-		os.Chdir(testDir)
-		os.Args = []string{
-			"weed",
-			"-dir=" + testDir,
-			"-master.port=" + strconv.Itoa(masterPort),
-			"-master.port.grpc=" + strconv.Itoa(masterGrpcPort),
-			"-volume.port=" + strconv.Itoa(volumePort),
-			"-volume.port.grpc=" + strconv.Itoa(volumeGrpcPort),
-			"-filer.port=" + strconv.Itoa(filerPort),
-			"-filer.port.grpc=" + strconv.Itoa(filerGrpcPort),
-			"-s3.port=" + strconv.Itoa(s3Port),
-			"-s3.port.grpc=" + strconv.Itoa(s3GrpcPort),
-			"-webdav.port=0",
-			"-admin.ui=false",
-			"-master.volumeSizeLimitMB=32",
-			"-ip=127.0.0.1",
-			"-master.peers=none",
-		}
-		glog.MaxSize = 1024 * 1024
-		for _, cmd := range command.Commands {
-			if cmd.Name() == "mini" && cmd.Run != nil {
-				cmd.Flag.Parse(os.Args[1:])
-				cmd.Run(cmd, cmd.Flag.Args())
-				return
-			}
-		}
-	}()
-
-	// Wait for S3
-	err = waitForS3Ready(cluster.s3Endpoint, 60*time.Second)
-	if err != nil {
-		cancel()
-		return nil, err
-	}
-	cluster.isRunning = true
-	return cluster, nil
-}
-
-func waitForS3Ready(endpoint string, timeout time.Duration) error {
-	client := &http.Client{Timeout: 1 * time.Second}
-	deadline := time.Now().Add(timeout)
-	for time.Now().Before(deadline) {
-		resp, err := client.Get(endpoint)
-		if err == nil {
-			resp.Body.Close()
-			return nil
-		}
-		time.Sleep(200 * time.Millisecond)
-	}
-	return fmt.Errorf("timeout waiting for S3")
-}
-
-func (c *TestCluster) Stop() {
-	if c.cancel != nil {
-		c.cancel()
-	}
-	if c.isRunning {
-		time.Sleep(500 * time.Millisecond)
-	}
-	// Simplified stop
-	for _, cmd := range command.Commands {
-		if cmd.Name() == "mini" {
-			cmd.Flag.VisitAll(func(f *flag.Flag) {
-				f.Value.Set(f.DefValue)
-			})
-			break
-		}
-	}
-}
-
-func contains(s, substr string) bool {
-	return strings.Contains(s, substr)
-}

weed/admin/dash/admin_server.go

@@ -1,6 +1,7 @@
 package dash
 
 import (
+	"bytes"
 	"context"
 	"fmt"
 	"net/http"
@@ -13,9 +14,11 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/admin/maintenance"
 	"github.com/seaweedfs/seaweedfs/weed/cluster"
 	"github.com/seaweedfs/seaweedfs/weed/credential"
+	"github.com/seaweedfs/seaweedfs/weed/filer"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/mq_pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/schema_pb"
@@ -28,8 +31,6 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/s3api"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 	"github.com/seaweedfs/seaweedfs/weed/worker/tasks"
-
-	_ "github.com/seaweedfs/seaweedfs/weed/credential/grpc" // Register gRPC credential store
 )
 
 // FilerConfig holds filer configuration needed for bucket operations
@@ -138,7 +139,7 @@ func NewAdminServer(masters string, templateFS http.FileSystem, dataDir string)
 	server.topicRetentionPurger = NewTopicRetentionPurger(server)
 
 	// Initialize credential manager with defaults
-	credentialManager, err := credential.NewCredentialManagerWithDefaults(credential.StoreTypeGrpc)
+	credentialManager, err := credential.NewCredentialManagerWithDefaults("")
 	if err != nil {
 		glog.Warningf("Failed to initialize credential manager: %v", err)
 		// Continue without credential manager - will fall back to legacy approach
@@ -517,13 +518,27 @@ func (s *AdminServer) DeleteS3Bucket(bucketName string) error {
 
 // GetObjectStoreUsers retrieves object store users from identity.json
 func (s *AdminServer) GetObjectStoreUsers(ctx context.Context) ([]ObjectStoreUser, error) {
-	if s.credentialManager == nil {
-		return []ObjectStoreUser{}, nil
-	}
+	s3cfg := &iam_pb.S3ApiConfiguration{}
+
+	// Load IAM configuration from filer
+	err := s.WithFilerClient(func(client filer_pb.SeaweedFilerClient) error {
+		var buf bytes.Buffer
+		if err := filer.ReadEntry(nil, client, filer.IamConfigDirectory, filer.IamIdentityFile, &buf); err != nil {
+			if err == filer_pb.ErrNotFound {
+				// If file doesn't exist, return empty configuration
+				return nil
+			}
+			return err
+		}
+		if buf.Len() > 0 {
+			return filer.ParseS3ConfigurationFromBytes(buf.Bytes(), s3cfg)
+		}
+		return nil
+	})
 
-	s3cfg, err := s.credentialManager.LoadConfiguration(ctx)
 	if err != nil {
-		return nil, fmt.Errorf("failed to load IAM configuration: %w", err)
+		glog.Errorf("Failed to load IAM configuration: %v", err)
+		return []ObjectStoreUser{}, nil // Return empty list instead of error for UI
 	}
 
 	var users []ObjectStoreUser
@@ -1812,11 +1827,6 @@ func (s *AdminServer) Shutdown() {
 		glog.Errorf("Failed to stop worker gRPC server: %v", err)
 	}
 
-	// Shutdown credential manager
-	if s.credentialManager != nil {
-		s.credentialManager.Shutdown()
-	}
-
 	glog.V(1).Infof("Admin server shutdown complete")
 }
 

weed/admin/dash/policies_management.go

@@ -56,33 +56,72 @@ func NewCredentialStorePolicyManager(credentialManager *credential.CredentialMan
 }
 
 // GetPolicies retrieves all IAM policies via credential store
-// Deprecated: This method delegates to the credential manager and will be moved/removed in a future release.
 func (cspm *CredentialStorePolicyManager) GetPolicies(ctx context.Context) (map[string]policy_engine.PolicyDocument, error) {
-	return cspm.credentialManager.GetPolicies(ctx)
+	// Get policies from credential store
+	// We'll use the credential store to access the filer indirectly
+	// Since policies are stored separately, we need to access the underlying store
+	store := cspm.credentialManager.GetStore()
+	glog.V(1).Infof("Getting policies from credential store: %T", store)
+
+	// Check if the store supports policy management
+	if policyStore, ok := store.(credential.PolicyManager); ok {
+		glog.V(1).Infof("Store supports policy management, calling GetPolicies")
+		policies, err := policyStore.GetPolicies(ctx)
+		if err != nil {
+			glog.Errorf("Error getting policies from store: %v", err)
+			return nil, err
+		}
+		glog.V(1).Infof("Got %d policies from store", len(policies))
+		return policies, nil
+	} else {
+		// Fallback: use empty policies for stores that don't support policies
+		glog.V(1).Infof("Credential store doesn't support policy management, returning empty policies")
+		return make(map[string]policy_engine.PolicyDocument), nil
+	}
 }
 
 // CreatePolicy creates a new IAM policy via credential store
-// Deprecated: This method delegates to the credential manager and will be moved/removed in a future release.
 func (cspm *CredentialStorePolicyManager) CreatePolicy(ctx context.Context, name string, document policy_engine.PolicyDocument) error {
-	return cspm.credentialManager.CreatePolicy(ctx, name, document)
+	store := cspm.credentialManager.GetStore()
+
+	if policyStore, ok := store.(credential.PolicyManager); ok {
+		return policyStore.CreatePolicy(ctx, name, document)
+	}
+
+	return fmt.Errorf("credential store doesn't support policy creation")
 }
 
 // UpdatePolicy updates an existing IAM policy via credential store
-// Deprecated: This method delegates to the credential manager and will be moved/removed in a future release.
 func (cspm *CredentialStorePolicyManager) UpdatePolicy(ctx context.Context, name string, document policy_engine.PolicyDocument) error {
-	return cspm.credentialManager.UpdatePolicy(ctx, name, document)
+	store := cspm.credentialManager.GetStore()
+
+	if policyStore, ok := store.(credential.PolicyManager); ok {
+		return policyStore.UpdatePolicy(ctx, name, document)
+	}
+
+	return fmt.Errorf("credential store doesn't support policy updates")
 }
 
 // DeletePolicy deletes an IAM policy via credential store
-// Deprecated: This method delegates to the credential manager and will be moved/removed in a future release.
 func (cspm *CredentialStorePolicyManager) DeletePolicy(ctx context.Context, name string) error {
-	return cspm.credentialManager.DeletePolicy(ctx, name)
+	store := cspm.credentialManager.GetStore()
+
+	if policyStore, ok := store.(credential.PolicyManager); ok {
+		return policyStore.DeletePolicy(ctx, name)
+	}
+
+	return fmt.Errorf("credential store doesn't support policy deletion")
 }
 
 // GetPolicy retrieves a specific IAM policy via credential store
-// Deprecated: This method delegates to the credential manager and will be moved/removed in a future release.
 func (cspm *CredentialStorePolicyManager) GetPolicy(ctx context.Context, name string) (*policy_engine.PolicyDocument, error) {
-	return cspm.credentialManager.GetPolicy(ctx, name)
+	store := cspm.credentialManager.GetStore()
+
+	if policyStore, ok := store.(credential.PolicyManager); ok {
+		return policyStore.GetPolicy(ctx, name)
+	}
+
+	return nil, fmt.Errorf("credential store doesn't support policy retrieval")
 }
 
 // AdminServer policy management methods using credential.PolicyManager

weed/admin/dash/service_account_helpers.go

@@ -0,0 +1,53 @@
+package dash
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
+)
+
+// identityToServiceAccount converts an IAM identity to a ServiceAccount struct
+// This helper reduces code duplication across GetServiceAccounts, GetServiceAccountDetails,
+// UpdateServiceAccount, and GetServiceAccountByAccessKey
+func identityToServiceAccount(identity *iam_pb.Identity) (*ServiceAccount, error) {
+	if identity == nil {
+		return nil, fmt.Errorf("identity cannot be nil")
+	}
+	if !strings.HasPrefix(identity.GetName(), serviceAccountPrefix) {
+		return nil, fmt.Errorf("not a service account: %s", identity.GetName())
+	}
+
+	parts := strings.SplitN(identity.GetName(), ":", 3)
+	if len(parts) < 3 {
+		return nil, fmt.Errorf("invalid service account ID format")
+	}
+
+	sa := &ServiceAccount{
+		ID:         identity.GetName(),
+		ParentUser: parts[1],
+		Status:     StatusActive,
+		CreateDate: getCreationDate(identity.GetActions()),
+		Expiration: getExpiration(identity.GetActions()),
+	}
+
+	// Get description from account display name
+	if identity.Account != nil {
+		sa.Description = identity.Account.GetDisplayName()
+	}
+
+	// Get access key from credentials
+	if len(identity.Credentials) > 0 {
+		sa.AccessKeyId = identity.Credentials[0].GetAccessKey()
+	}
+
+	// Check if disabled
+	for _, action := range identity.GetActions() {
+		if action == disabledAction {
+			sa.Status = StatusInactive
+			break
+		}
+	}
+
+	return sa, nil
+}

weed/admin/dash/service_account_management.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"strconv"
 	"strings"
 	"time"
 
@@ -17,57 +18,140 @@ var (
 )
 
 const (
-	serviceAccountPrefix = "sa:"
-	accessKeyPrefix      = "ABIA" // Service account access keys use ABIA prefix
+	createdAtActionPrefix  = "createdAt:"
+	expirationActionPrefix = "expiresAt:"
+	disabledAction         = "__disabled__"
+	serviceAccountPrefix   = "sa:"
+	accessKeyPrefix        = "ABIA" // Service account access keys use ABIA prefix
 
 	// Status constants
 	StatusActive   = "Active"
 	StatusInactive = "Inactive"
 )
 
+// Helper functions for managing creation timestamps in actions
+func getCreationDate(actions []string) time.Time {
+	for _, action := range actions {
+		if strings.HasPrefix(action, createdAtActionPrefix) {
+			timestampStr := strings.TrimPrefix(action, createdAtActionPrefix)
+			if timestamp, err := strconv.ParseInt(timestampStr, 10, 64); err == nil {
+				return time.Unix(timestamp, 0)
+			}
+		}
+	}
+	return time.Time{} // Return zero time for legacy service accounts without stored creation date
+}
+
+func setCreationDate(actions []string, createDate time.Time) []string {
+	// Remove any existing createdAt action
+	filtered := make([]string, 0, len(actions)+1)
+	for _, action := range actions {
+		if !strings.HasPrefix(action, createdAtActionPrefix) {
+			filtered = append(filtered, action)
+		}
+	}
+	// Add new createdAt action
+	filtered = append(filtered, fmt.Sprintf("%s%d", createdAtActionPrefix, createDate.Unix()))
+	return filtered
+}
+
+// Helper functions for managing expiration timestamps in actions
+func getExpiration(actions []string) time.Time {
+	for _, action := range actions {
+		if strings.HasPrefix(action, expirationActionPrefix) {
+			timestampStr := strings.TrimPrefix(action, expirationActionPrefix)
+			if timestamp, err := strconv.ParseInt(timestampStr, 10, 64); err == nil {
+				return time.Unix(timestamp, 0)
+			}
+		}
+	}
+	return time.Time{} // No expiration set
+}
+
+func setExpiration(actions []string, expiration time.Time) []string {
+	// Remove any existing expiration action
+	filtered := make([]string, 0, len(actions)+1)
+	for _, action := range actions {
+		if !strings.HasPrefix(action, expirationActionPrefix) {
+			filtered = append(filtered, action)
+		}
+	}
+	// Add new expiration action if not zero
+	if !expiration.IsZero() {
+		filtered = append(filtered, fmt.Sprintf("%s%d", expirationActionPrefix, expiration.Unix()))
+	}
+	return filtered
+}
+
 // GetServiceAccounts returns all service accounts, optionally filtered by parent user
+// NOTE: Service accounts are stored as special identities with "sa:" prefix
 func (s *AdminServer) GetServiceAccounts(ctx context.Context, parentUser string) ([]ServiceAccount, error) {
 	if s.credentialManager == nil {
 		return nil, fmt.Errorf("credential manager not available")
 	}
 
-	pbAccounts, err := s.credentialManager.ListServiceAccounts(ctx)
+	// Load the current configuration to find service account identities
+	config, err := s.credentialManager.LoadConfiguration(ctx)
 	if err != nil {
-		return nil, fmt.Errorf("failed to list service accounts: %w", err)
+		return nil, fmt.Errorf("failed to load configuration: %w", err)
 	}
 
 	var accounts []ServiceAccount
-	for _, sa := range pbAccounts {
-		if sa == nil {
+
+	// Service accounts are stored as identities with "sa:" prefix in their name
+	// Format: "sa:<parent_user>:<uuid>"
+	for _, identity := range config.GetIdentities() {
+		if !strings.HasPrefix(identity.GetName(), serviceAccountPrefix) {
 			continue
 		}
+
+		parts := strings.SplitN(identity.GetName(), ":", 3)
+		if len(parts) < 3 {
+			continue
+		}
+
+		parent := parts[1]
+		saId := identity.GetName()
+
 		// Filter by parent user if specified
-		if parentUser != "" && sa.ParentUser != parentUser {
+		if parentUser != "" && parent != parentUser {
 			continue
 		}
 
+		// Extract description from account display name if available
+		description := ""
 		status := StatusActive
-		if sa.Disabled {
-			status = StatusInactive
+		if identity.Account != nil {
+			description = identity.Account.GetDisplayName()
 		}
 
-		account := ServiceAccount{
-			ID:          sa.Id,
-			ParentUser:  sa.ParentUser,
-			Description: sa.Description,
+		// Get access key from credentials
+		accessKey := ""
+		if len(identity.Credentials) > 0 {
+			accessKey = identity.Credentials[0].GetAccessKey()
+			// Service accounts use ABIA prefix
+			if !strings.HasPrefix(accessKey, accessKeyPrefix) {
+				continue // Not a service account
+			}
+		}
+
+		// Check if disabled (stored in actions)
+		for _, action := range identity.GetActions() {
+			if action == disabledAction {
+				status = StatusInactive
+				break
+			}
+		}
+
+		accounts = append(accounts, ServiceAccount{
+			ID:          saId,
+			ParentUser:  parent,
+			Description: description,
+			AccessKeyId: accessKey,
 			Status:      status,
-			CreateDate:  time.Unix(sa.CreatedAt, 0),
-		}
-
-		if sa.Expiration > 0 {
-			account.Expiration = time.Unix(sa.Expiration, 0)
-		}
-
-		if sa.Credential != nil {
-			account.AccessKeyId = sa.Credential.AccessKey
-		}
-
-		accounts = append(accounts, account)
+			CreateDate:  getCreationDate(identity.GetActions()),
+			Expiration:  getExpiration(identity.GetActions()),
+		})
 	}
 
 	return accounts, nil
@@ -79,33 +163,43 @@ func (s *AdminServer) GetServiceAccountDetails(ctx context.Context, id string) (
 		return nil, fmt.Errorf("credential manager not available")
 	}
 
-	sa, err := s.credentialManager.GetServiceAccount(ctx, id)
+	// Get the identity
+	identity, err := s.credentialManager.GetUser(ctx, id)
 	if err != nil {
-		return nil, fmt.Errorf("failed to get service account: %w", err)
-	}
-	if sa == nil {
-		return nil, ErrServiceAccountNotFound
+		return nil, fmt.Errorf("%w: %s", ErrServiceAccountNotFound, id)
 	}
 
-	status := StatusActive
-	if sa.Disabled {
-		status = StatusInactive
+	if !strings.HasPrefix(identity.GetName(), serviceAccountPrefix) {
+		return nil, fmt.Errorf("%w: not a service account: %s", ErrServiceAccountNotFound, id)
+	}
+
+	parts := strings.SplitN(identity.GetName(), ":", 3)
+	if len(parts) < 3 {
+		return nil, fmt.Errorf("invalid service account ID format")
 	}
 
 	account := &ServiceAccount{
-		ID:          sa.Id,
-		ParentUser:  sa.ParentUser,
-		Description: sa.Description,
-		Status:      status,
-		CreateDate:  time.Unix(sa.CreatedAt, 0),
+		ID:         id,
+		ParentUser: parts[1],
+		Status:     StatusActive,
+		CreateDate: getCreationDate(identity.GetActions()),
+		Expiration: getExpiration(identity.GetActions()),
 	}
 
-	if sa.Expiration > 0 {
-		account.Expiration = time.Unix(sa.Expiration, 0)
+	if identity.Account != nil {
+		account.Description = identity.Account.GetDisplayName()
 	}
 
-	if sa.Credential != nil {
-		account.AccessKeyId = sa.Credential.AccessKey
+	if len(identity.Credentials) > 0 {
+		account.AccessKeyId = identity.Credentials[0].GetAccessKey()
+	}
+
+	// Check if disabled
+	for _, action := range identity.GetActions() {
+		if action == disabledAction {
+			account.Status = StatusInactive
+			break
+		}
 	}
 
 	return account, nil
@@ -118,48 +212,55 @@ func (s *AdminServer) CreateServiceAccount(ctx context.Context, req CreateServic
 	}
 
 	// Validate parent user exists
-	if _, err := s.credentialManager.GetUser(ctx, req.ParentUser); err != nil {
-		return nil, fmt.Errorf("parent user lookup failed for %s: %w", req.ParentUser, err)
+	_, err := s.credentialManager.GetUser(ctx, req.ParentUser)
+	if err != nil {
+		return nil, fmt.Errorf("parent user not found: %s", req.ParentUser)
 	}
 
 	// Generate unique ID and credentials
 	uuid := generateAccountId()
-	// Maintain consistent ID format: sa:<parent>:<uuid>
 	saId := fmt.Sprintf("sa:%s:%s", req.ParentUser, uuid)
-
-	accessKey := accessKeyPrefix + generateAccessKey()[len(accessKeyPrefix):]
+	accessKey := accessKeyPrefix + generateAccessKey()[len(accessKeyPrefix):] // Use ABIA prefix for service accounts
 	secretKey := generateSecretKey()
 
+	// Create the service account as a special identity
 	now := time.Now()
 
-	sa := &iam_pb.ServiceAccount{
-		Id:          saId,
-		ParentUser:  req.ParentUser,
-		Description: req.Description,
-		Credential: &iam_pb.Credential{
-			AccessKey: accessKey,
-			SecretKey: secretKey,
-			Status:    StatusActive,
-		},
-		CreatedAt: now.Unix(),
-		Disabled:  false,
-	}
-
+	// Parse expiration if provided
+	var expiration time.Time
 	if req.Expiration != "" {
-		exp, err := time.Parse(time.RFC3339, req.Expiration)
+		var err error
+		expiration, err = time.Parse(time.RFC3339, req.Expiration)
 		if err != nil {
 			return nil, fmt.Errorf("invalid expiration format: %w", err)
 		}
-		sa.Expiration = exp.Unix()
 	}
 
-	if err := s.credentialManager.CreateServiceAccount(ctx, sa); err != nil {
+	identity := &iam_pb.Identity{
+		Name: saId,
+		Account: &iam_pb.Account{
+			Id:          uuid,
+			DisplayName: req.Description,
+		},
+		Credentials: []*iam_pb.Credential{
+			{
+				AccessKey: accessKey,
+				SecretKey: secretKey,
+			},
+		},
+		// Store creation date and expiration in actions
+		Actions: setExpiration(setCreationDate([]string{}, now), expiration),
+	}
+
+	// Create the service account
+	err = s.credentialManager.CreateUser(ctx, identity)
+	if err != nil {
 		return nil, fmt.Errorf("failed to create service account: %w", err)
 	}
 
 	glog.V(1).Infof("Created service account %s for user %s", saId, req.ParentUser)
 
-	resp := &ServiceAccount{
+	return &ServiceAccount{
 		ID:              saId,
 		ParentUser:      req.ParentUser,
 		Description:     req.Description,
@@ -167,13 +268,8 @@ func (s *AdminServer) CreateServiceAccount(ctx context.Context, req CreateServic
 		SecretAccessKey: secretKey, // Only returned on creation
 		Status:          StatusActive,
 		CreateDate:      now,
-	}
-
-	if sa.Expiration > 0 {
-		resp.Expiration = time.Unix(sa.Expiration, 0)
-	}
-
-	return resp, nil
+		Expiration:      expiration,
+	}, nil
 }
 
 // UpdateServiceAccount updates an existing service account
@@ -182,67 +278,85 @@ func (s *AdminServer) UpdateServiceAccount(ctx context.Context, id string, req U
 		return nil, fmt.Errorf("credential manager not available")
 	}
 
-	sa, err := s.credentialManager.GetServiceAccount(ctx, id)
+	// Get existing identity
+	identity, err := s.credentialManager.GetUser(ctx, id)
 	if err != nil {
-		return nil, fmt.Errorf("failed to get service account: %w", err)
-	}
-	if sa == nil {
-		return nil, ErrServiceAccountNotFound
+		return nil, fmt.Errorf("%w: %s", ErrServiceAccountNotFound, id)
 	}
 
+	if !strings.HasPrefix(identity.GetName(), serviceAccountPrefix) {
+		return nil, fmt.Errorf("%w: not a service account: %s", ErrServiceAccountNotFound, id)
+	}
+
+	// Update description if provided
 	if req.Description != "" {
-		sa.Description = req.Description
-	}
-
-	if req.Status != "" {
-		switch req.Status {
-		case StatusInactive:
-			sa.Disabled = true
-		case StatusActive:
-			sa.Disabled = false
-		default:
-			return nil, fmt.Errorf("invalid status value: %s (must be %s or %s)", req.Status, StatusActive, StatusInactive)
+		if identity.Account == nil {
+			identity.Account = &iam_pb.Account{}
 		}
+		identity.Account.DisplayName = req.Description
 	}
 
+	// Update status by adding/removing disabled action
+	if req.Status != "" {
+		// Remove existing disabled marker
+		newActions := make([]string, 0, len(identity.Actions))
+		for _, action := range identity.Actions {
+			if action != disabledAction {
+				newActions = append(newActions, action)
+			}
+		}
+		// Add disabled action if setting to Inactive
+		if req.Status == StatusInactive {
+			newActions = append(newActions, disabledAction)
+		}
+		identity.Actions = newActions
+	}
+
+	// Update expiration if provided
 	if req.Expiration != "" {
-		exp, err := time.Parse(time.RFC3339, req.Expiration)
+		var expiration time.Time
+		var err error
+		expiration, err = time.Parse(time.RFC3339, req.Expiration)
 		if err != nil {
 			return nil, fmt.Errorf("invalid expiration format: %w", err)
 		}
-		sa.Expiration = exp.Unix()
+		identity.Actions = setExpiration(identity.Actions, expiration)
 	}
 
-	if err := s.credentialManager.UpdateServiceAccount(ctx, id, sa); err != nil {
+	// Update the identity
+	err = s.credentialManager.UpdateUser(ctx, id, identity)
+	if err != nil {
 		return nil, fmt.Errorf("failed to update service account: %w", err)
 	}
 
 	glog.V(1).Infof("Updated service account %s", id)
 
-	status := StatusActive
-	if sa.Disabled {
-		status = StatusInactive
+	// Build response
+	parts := strings.SplitN(id, ":", 3)
+	if len(parts) < 3 {
+		return nil, fmt.Errorf("invalid service account ID format")
 	}
 
-	accessKeyId := ""
-	if sa.Credential != nil {
-		accessKeyId = sa.Credential.AccessKey
+	result := &ServiceAccount{
+		ID:          id,
+		ParentUser:  parts[1],
+		Description: identity.Account.GetDisplayName(),
+		Status:      StatusActive,
+		CreateDate:  getCreationDate(identity.Actions),
 	}
 
-	resp := &ServiceAccount{
-		ID:          sa.Id,
-		ParentUser:  sa.ParentUser,
-		Description: sa.Description,
-		Status:      status,
-		CreateDate:  time.Unix(sa.CreatedAt, 0),
-		AccessKeyId: accessKeyId,
+	if len(identity.Credentials) > 0 {
+		result.AccessKeyId = identity.Credentials[0].GetAccessKey()
 	}
 
-	if sa.Expiration > 0 {
-		resp.Expiration = time.Unix(sa.Expiration, 0)
+	for _, action := range identity.Actions {
+		if action == disabledAction {
+			result.Status = StatusInactive
+			break
+		}
 	}
 
-	return resp, nil
+	return result, nil
 }
 
 // DeleteServiceAccount deletes a service account
@@ -251,16 +365,19 @@ func (s *AdminServer) DeleteServiceAccount(ctx context.Context, id string) error
 		return fmt.Errorf("credential manager not available")
 	}
 
-	// Verify existence
-	sa, err := s.credentialManager.GetServiceAccount(ctx, id)
+	// Verify it's a service account
+	identity, err := s.credentialManager.GetUser(ctx, id)
 	if err != nil {
-		return fmt.Errorf("failed to check service account: %w", err)
-	}
-	if sa == nil {
-		return ErrServiceAccountNotFound
+		return fmt.Errorf("%w: %s", ErrServiceAccountNotFound, id)
 	}
 
-	if err := s.credentialManager.DeleteServiceAccount(ctx, id); err != nil {
+	if !strings.HasPrefix(identity.GetName(), serviceAccountPrefix) {
+		return fmt.Errorf("%w: not a service account: %s", ErrServiceAccountNotFound, id)
+	}
+
+	// Delete the identity
+	err = s.credentialManager.DeleteUser(ctx, id)
+	if err != nil {
 		return fmt.Errorf("failed to delete service account: %w", err)
 	}
 
@@ -278,30 +395,40 @@ func (s *AdminServer) GetServiceAccountByAccessKey(ctx context.Context, accessKe
 		return nil, fmt.Errorf("credential manager not available")
 	}
 
-	// Efficient lookup is now supported by the interface and optimized stores
-	sa, err := s.credentialManager.GetStore().GetServiceAccountByAccessKey(ctx, accessKey)
+	// Find identity by access key
+	identity, err := s.credentialManager.GetUserByAccessKey(ctx, accessKey)
 	if err != nil {
-		return nil, fmt.Errorf("failed to find service account: %w", err)
+		return nil, fmt.Errorf("service account not found for access key: %s", accessKey)
 	}
 
-	status := StatusActive
-	if sa.Disabled {
-		status = StatusInactive
+	if !strings.HasPrefix(identity.GetName(), serviceAccountPrefix) {
+		return nil, fmt.Errorf("not a service account")
 	}
-	accessKeyId := ""
-	if sa.Credential != nil {
-		accessKeyId = sa.Credential.AccessKey
+
+	parts := strings.SplitN(identity.GetName(), ":", 3)
+	if len(parts) < 3 {
+		return nil, fmt.Errorf("invalid service account ID format")
 	}
-	resp := &ServiceAccount{
-		ID:          sa.Id,
-		ParentUser:  sa.ParentUser,
-		Description: sa.Description,
-		AccessKeyId: accessKeyId,
-		Status:      status,
-		CreateDate:  time.Unix(sa.CreatedAt, 0),
+
+	account := &ServiceAccount{
+		ID:          identity.GetName(),
+		ParentUser:  parts[1],
+		AccessKeyId: accessKey,
+		Status:      StatusActive,
+		CreateDate:  getCreationDate(identity.GetActions()),
+		Expiration:  getExpiration(identity.GetActions()),
 	}
-	if sa.Expiration > 0 {
-		resp.Expiration = time.Unix(sa.Expiration, 0)
+
+	if identity.Account != nil {
+		account.Description = identity.Account.GetDisplayName()
 	}
-	return resp, nil
+
+	for _, action := range identity.GetActions() {
+		if action == disabledAction {
+			account.Status = StatusInactive
+			break
+		}
+	}
+
+	return account, nil
 }

weed/admin/handlers/file_browser_handlers.go

@@ -22,7 +22,6 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/admin/view/layout"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
-	"github.com/seaweedfs/seaweedfs/weed/security"
 	"github.com/seaweedfs/seaweedfs/weed/util"
 	"github.com/seaweedfs/seaweedfs/weed/util/http/client"
 )
@@ -122,6 +121,7 @@ func (h *FileBrowserHandlers) DeleteFile(c *gin.Context) {
 		})
 		return err
 	})
+
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to delete file: " + err.Error()})
 		return
@@ -228,7 +228,7 @@ func (h *FileBrowserHandlers) CreateFolder(c *gin.Context) {
 				Name:        filepath.Base(fullPath),
 				IsDirectory: true,
 				Attributes: &filer_pb.FuseAttributes{
-					FileMode: uint32(0o755 | os.ModeDir), // Directory mode
+					FileMode: uint32(0755 | os.ModeDir), // Directory mode
 					Uid:      filer_pb.OS_UID,
 					Gid:      filer_pb.OS_GID,
 					Crtime:   time.Now().Unix(),
@@ -239,6 +239,7 @@ func (h *FileBrowserHandlers) CreateFolder(c *gin.Context) {
 		})
 		return err
 	})
+
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create folder: " + err.Error()})
 		return
@@ -363,22 +364,6 @@ func (h *FileBrowserHandlers) uploadFileToFiler(filePath string, fileHeader *mul
 	}
 	defer file.Close()
 
-	// Load security configuration
-	v := util.GetViper()
-
-	// Read Filer JWT token from security.toml
-	signingKey := security.SigningKey(v.GetString("jwt.filer_signing.key"))
-	expiresAfterSec := v.GetInt("jwt.filer_signing.expires_after_seconds")
-
-	//  Generate JWT token to authenticate with Filer
-	var jwtToken security.EncodedJwt
-	if len(signingKey) > 0 {
-		jwtToken = security.GenJwtForFilerServer(signingKey, expiresAfterSec)
-		glog.V(4).Infof("Generated JWT token for filer upload (expires in %d sec)", expiresAfterSec)
-	} else {
-		glog.V(2).Info("No JWT signing key configured, uploading without authentication")
-	}
-
 	// Create multipart form data
 	var body bytes.Buffer
 	writer := multipart.NewWriter(&body)
@@ -422,12 +407,6 @@ func (h *FileBrowserHandlers) uploadFileToFiler(filePath string, fileHeader *mul
 	// Set content type with boundary
 	req.Header.Set("Content-Type", writer.FormDataContentType())
 
-	// Add JWT Token to Authorization Header
-	if jwtToken != "" {
-		req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", string(jwtToken)))
-		glog.V(4).Infof("Added JWT authorization header")
-	}
-
 	// Send request using TLS-aware HTTP client with 60s timeout for large file uploads
 	// lgtm[go/ssrf]
 	// Safe: filerAddress validated by validateFilerAddress() to match configured filer
@@ -616,29 +595,6 @@ func (h *FileBrowserHandlers) DownloadFile(c *gin.Context) {
 		return
 	}
 	client := h.newClientWithTimeout(5 * time.Minute) // Longer timeout for large file downloads
-
-	// Load security configuration
-	v := util.GetViper()
-
-	// Read Filer JWT token from security.toml
-	signingKey := security.SigningKey(v.GetString("jwt.filer_signing.read.key"))
-	expiresAfterSec := v.GetInt("jwt.filer_signing..read.expires_after_seconds")
-
-	//  Generate JWT token to authenticate with Filer
-	var jwtToken security.EncodedJwt
-	if len(signingKey) > 0 {
-		jwtToken = security.GenJwtForFilerServer(signingKey, expiresAfterSec)
-		glog.V(4).Infof("Generated JWT token for filer download (expires in %d sec)", expiresAfterSec)
-	} else {
-		glog.V(2).Info("No JWT signing key configured, downloadading without authentication")
-	}
-
-	// Add JWT Token to Authorization Header
-	if jwtToken != "" {
-		req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", string(jwtToken)))
-		glog.V(4).Infof("Added JWT authorization header")
-	}
-
 	resp, err := client.Do(req)
 	if err != nil {
 		c.JSON(http.StatusBadGateway, gin.H{"error": "Failed to fetch file from filer: " + err.Error()})
@@ -731,6 +687,7 @@ func (h *FileBrowserHandlers) ViewFile(c *gin.Context) {
 
 		return nil
 	})
+
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to get file metadata: " + err.Error()})
 		return
@@ -880,6 +837,7 @@ func (h *FileBrowserHandlers) GetFileProperties(c *gin.Context) {
 
 		return nil
 	})
+
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to get file properties: " + err.Error()})
 		return

weed/admin/static/js/iam-utils.js

@@ -1,55 +0,0 @@
-/**
- * Shared IAM utility functions for the SeaweedFS Admin Dashboard.
- */
-
-// Delete user function
-async function deleteUser(username) {
-    showDeleteConfirm(username, async function () {
-        try {
-            const encodedUsername = encodeURIComponent(username);
-            const response = await fetch(`/api/users/${encodedUsername}`, {
-                method: 'DELETE'
-            });
-
-            if (response.ok) {
-                showAlert('User deleted successfully', 'success');
-                setTimeout(() => window.location.reload(), 1000);
-            } else {
-                const error = await response.json().catch(() => ({}));
-                showAlert('Failed to delete user: ' + (error.error || 'Unknown error'), 'error');
-            }
-        } catch (error) {
-            console.error('Error deleting user:', error);
-            showAlert('Failed to delete user: ' + error.message, 'error');
-        }
-    }, 'Are you sure you want to delete this user? This action cannot be undone.');
-}
-
-// Delete access key function
-async function deleteAccessKey(username, accessKey) {
-    showDeleteConfirm(accessKey, async function () {
-        try {
-            const encodedUsername = encodeURIComponent(username);
-            const encodedAccessKey = encodeURIComponent(accessKey);
-            const response = await fetch(`/api/users/${encodedUsername}/access-keys/${encodedAccessKey}`, {
-                method: 'DELETE'
-            });
-
-            if (response.ok) {
-                showAlert('Access key deleted successfully', 'success');
-                // If refreshAccessKeysList exists (in object_store_users.templ), use it
-                if (typeof refreshAccessKeysList === 'function') {
-                    refreshAccessKeysList(username);
-                } else {
-                    setTimeout(() => window.location.reload(), 1000);
-                }
-            } else {
-                const error = await response.json().catch(() => ({}));
-                showAlert('Failed to delete access key: ' + (error.error || 'Unknown error'), 'error');
-            }
-        } catch (error) {
-            console.error('Error deleting access key:', error);
-            showAlert('Failed to delete access key: ' + error.message, 'error');
-        }
-    }, 'Are you sure you want to delete this access key?');
-}

weed/admin/static/js/modal-alerts.js

@@ -1,331 +0,0 @@
-/**
- * Modal Alerts - Bootstrap Modal replacement for native alert() and confirm()
- * Fixes Chrome auto-dismiss issue with native dialogs
- * 
- * Usage:
- *   showAlert('Message', 'success');
- *   showConfirm('Delete this?', function() { });
- */
-
-(function () {
-    'use strict';
-
-    // Create and inject modal HTML into page if not already present
-    function ensureModalsExist() {
-        if (document.getElementById('globalAlertModal')) {
-            return; // Already exists
-        }
-
-        const modalsHTML = `
-            <!-- Global Alert Modal -->
-            <div class="modal fade" id="globalAlertModal" tabindex="-1" aria-labelledby="globalAlertModalLabel" aria-hidden="true">
-                <div class="modal-dialog">
-                    <div class="modal-content">
-                        <div class="modal-header" id="globalAlertModalHeader">
-                            <h5 class="modal-title" id="globalAlertModalLabel">
-                                <i class="fas fa-info-circle me-2" id="globalAlertModalIcon"></i>
-                                <span id="globalAlertModalTitle">Notice</span>
-                            </h5>
-                            <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                        </div>
-                        <div class="modal-body" id="globalAlertModalBody">
-                            <!-- Message will be inserted here -->
-                        </div>
-                        <div class="modal-footer">
-                            <button type="button" class="btn btn-primary" data-bs-dismiss="modal">OK</button>
-                        </div>
-                    </div>
-                </div>
-            </div>
-
-            <!-- Global Confirm Modal -->
-            <div class="modal fade" id="globalConfirmModal" tabindex="-1" aria-labelledby="globalConfirmModalLabel" aria-hidden="true">
-                <div class="modal-dialog">
-                    <div class="modal-content">
-                        <div class="modal-header bg-warning">
-                            <h5 class="modal-title" id="globalConfirmModalLabel">
-                                <i class="fas fa-question-circle me-2"></i><span id="globalConfirmModalTitleText">Confirm Action</span>
-                            </h5>
-                            <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                        </div>
-                        <div class="modal-body" id="globalConfirmModalBody">
-                            <!-- Message will be inserted here -->
-                        </div>
-                        <div class="modal-footer">
-                            <button type="button" class="btn btn-secondary" data-bs-dismiss="modal" id="globalConfirmCancelBtn">Cancel</button>
-                            <button type="button" class="btn btn-primary" id="globalConfirmOkBtn">OK</button>
-                        </div>
-                    </div>
-                </div>
-            </div>
-
-            <!-- Global Delete Confirm Modal -->
-            <div class="modal fade" id="globalDeleteModal" tabindex="-1" aria-labelledby="globalDeleteModalLabel" aria-hidden="true">
-                <div class="modal-dialog">
-                    <div class="modal-content">
-                        <div class="modal-header bg-danger text-white">
-                            <h5 class="modal-title" id="globalDeleteModalLabel">
-                                <i class="fas fa-exclamation-triangle me-2"></i>Confirm Delete
-                            </h5>
-                            <button type="button" class="btn-close btn-close-white" data-bs-dismiss="modal" aria-label="Close"></button>
-                        </div>
-                        <div class="modal-body">
-                            <p class="mb-2" id="globalDeleteModalMessage">Are you sure you want to delete this item?</p>
-                            <p class="mb-0"><strong id="globalDeleteModalItemName"></strong></p>
-                            <p class="text-muted small mt-2 mb-0">This action cannot be undone.</p>
-                        </div>
-                        <div class="modal-footer">
-                            <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
-                            <button type="button" class="btn btn-danger" id="globalDeleteConfirmBtn">
-                                <i class="fas fa-trash me-1"></i>Delete
-                            </button>
-                        </div>
-                    </div>
-                </div>
-            </div>
-        `;
-
-        // Inject modals at end of body
-        document.body.insertAdjacentHTML('beforeend', modalsHTML);
-    }
-
-    /**
-     * Show an alert message using Bootstrap modal
-     * @param {string} message - The message to display
-     * @param {string|object} typeOrOptions - Type ('success', 'error', 'warning', 'info') or options object
-     * @param {string} title - Optional custom title
-     */
-    window.showAlert = function (message, typeOrOptions, title) {
-        ensureModalsExist();
-
-        let type = 'info';
-        let isHtml = false;
-
-        if (typeof typeOrOptions === 'object' && typeOrOptions !== null) {
-            type = typeOrOptions.type || 'info';
-            isHtml = typeOrOptions.isHtml || false;
-            title = typeOrOptions.title || title;
-        } else if (typeof typeOrOptions === 'string') {
-            type = typeOrOptions;
-        }
-
-        const modal = document.getElementById('globalAlertModal');
-        const header = document.getElementById('globalAlertModalHeader');
-        const titleEl = document.getElementById('globalAlertModalTitle');
-        const bodyEl = document.getElementById('globalAlertModalBody');
-        const iconEl = document.getElementById('globalAlertModalIcon');
-
-        // Configuration for different types
-        const types = {
-            'success': {
-                title: 'Success',
-                icon: 'fa-check-circle',
-                headerClass: 'bg-success text-white',
-                btnClose: 'btn-close-white'
-            },
-            'error': {
-                title: 'Error',
-                icon: 'fa-exclamation-triangle',
-                headerClass: 'bg-danger text-white',
-                btnClose: 'btn-close-white'
-            },
-            'warning': {
-                title: 'Warning',
-                icon: 'fa-exclamation-circle',
-                headerClass: 'bg-warning text-dark',
-                btnClose: ''
-            },
-            'info': {
-                title: 'Notice',
-                icon: 'fa-info-circle',
-                headerClass: 'bg-info text-white',
-                btnClose: 'btn-close-white'
-            }
-        };
-
-        const config = types[type] || types['info'];
-
-        // Update header styling
-        header.className = 'modal-header ' + config.headerClass;
-        const closeBtn = header.querySelector('.btn-close');
-        closeBtn.className = 'btn-close ' + config.btnClose;
-
-        // Update icon
-        iconEl.className = 'fas ' + config.icon + ' me-2';
-
-        // Update title
-        titleEl.textContent = title || config.title;
-
-        // Update body - support HTML or text
-        if (isHtml || message.includes('<p>') || message.includes('<ul>')) {
-            bodyEl.innerHTML = message;
-        } else {
-            bodyEl.innerHTML = '<p class="mb-0">' + escapeHtml(message) + '</p>';
-        }
-
-        // Show modal
-        const bsModal = new bootstrap.Modal(modal);
-        bsModal.show();
-    };
-
-    /**
-     * Show a confirmation dialog using Bootstrap modal
-     * @param {string} message - The confirmation message
-     * @param {function} onConfirm - Callback function if user confirms
-     * @param {function|object} onCancelOrOptions - Optional callback or options object
-     * @param {string} title - Optional custom title
-     */
-    window.showConfirm = function (message, onConfirm, onCancelOrOptions, title) {
-        ensureModalsExist();
-
-        let onCancel = null;
-        let isHtml = false;
-
-        if (typeof onCancelOrOptions === 'object' && onCancelOrOptions !== null) {
-            onCancel = onCancelOrOptions.onCancel;
-            isHtml = onCancelOrOptions.isHtml || false;
-            title = onCancelOrOptions.title || null;
-        } else {
-            onCancel = onCancelOrOptions;
-        }
-
-        const modalEl = document.getElementById('globalConfirmModal');
-        const bodyEl = document.getElementById('globalConfirmModalBody');
-        const titleEl = document.getElementById('globalConfirmModalTitleText');
-        const okBtn = document.getElementById('globalConfirmOkBtn');
-        const cancelBtn = document.getElementById('globalConfirmCancelBtn');
-
-        // Set title
-        if (title) {
-            titleEl.textContent = title;
-        } else {
-            titleEl.textContent = 'Confirm Action';
-        }
-
-        // Set message
-        if (isHtml || message.includes('<p>') || message.includes('<ul>')) {
-            bodyEl.innerHTML = message;
-        } else {
-            bodyEl.innerHTML = '<p class="mb-0">' + escapeHtml(message) + '</p>';
-        }
-
-        // Remove old event listeners by cloning buttons
-        const newOkBtn = okBtn.cloneNode(true);
-        const newCancelBtn = cancelBtn.cloneNode(true);
-        okBtn.parentNode.replaceChild(newOkBtn, okBtn);
-        cancelBtn.parentNode.replaceChild(newCancelBtn, cancelBtn);
-
-        const modal = new bootstrap.Modal(modalEl);
-
-        // Add event listeners
-        newOkBtn.addEventListener('click', function () {
-            modal.hide();
-            if (typeof onConfirm === 'function') {
-                onConfirm();
-            }
-        });
-
-        newCancelBtn.addEventListener('click', function () {
-            modal.hide();
-            if (typeof onCancel === 'function') {
-                onCancel();
-            }
-        });
-
-        modal.show();
-    };
-
-    /**
-     * Show a delete confirmation dialog
-     * @param {string} itemName - Name of the item to delete
-     * @param {function} onConfirm - Callback function if user confirms deletion
-     * @param {string} message - Optional custom message (default: "Are you sure you want to delete this item?")
-     */
-    window.showDeleteConfirm = function (itemName, onConfirm, message) {
-        ensureModalsExist();
-
-        const modalEl = document.getElementById('globalDeleteModal');
-        const messageEl = document.getElementById('globalDeleteModalMessage');
-        const itemNameEl = document.getElementById('globalDeleteModalItemName');
-        const confirmBtn = document.getElementById('globalDeleteConfirmBtn');
-
-        // Set custom message if provided
-        if (message) {
-            messageEl.textContent = message;
-        } else {
-            messageEl.textContent = 'Are you sure you want to delete this item?';
-        }
-
-        // Set item name
-        itemNameEl.textContent = itemName;
-
-        // Remove old event listener by cloning button
-        const newConfirmBtn = confirmBtn.cloneNode(true);
-        confirmBtn.parentNode.replaceChild(newConfirmBtn, confirmBtn);
-
-        const modal = new bootstrap.Modal(modalEl);
-
-        // Add new event listener
-        newConfirmBtn.addEventListener('click', function () {
-            modal.hide();
-            if (typeof onConfirm === 'function') {
-                onConfirm();
-            }
-        });
-
-        modal.show();
-    };
-
-    /**
-     * Escape HTML to prevent XSS
-     */
-    function escapeHtml(text) {
-        const map = {
-            '&': '&amp;',
-            '<': '&lt;',
-            '>': '&gt;',
-            '"': '&quot;',
-            "'": '&#039;'
-        };
-        return text.replace(/[&<>"']/g, function (m) { return map[m]; });
-    }
-
-    // Auto-initialize on DOMContentLoaded
-    if (document.readyState === 'loading') {
-        document.addEventListener('DOMContentLoaded', ensureModalsExist);
-    } else {
-        ensureModalsExist();
-    }
-
-    /**
-     * AUTOMATIC OVERRIDE of native alert()
-     * This makes ALL existing alert() calls automatically use Bootstrap modals
-     */
-    window.alert = function (message) {
-        // Auto-detect message type from content
-        let type = 'info';
-        const msg = String(message || '');
-        const msgLower = msg.toLowerCase();
-
-        // Refined type inference to avoid false positives
-        if (msgLower.includes('success') || msgLower.includes('successfully') || msgLower.includes('created') || msgLower.includes('updated') || msgLower.includes('saved')) {
-            // Avoid "not successful"
-            if (!msgLower.includes('not success')) {
-                type = 'success';
-            }
-        }
-
-        if (type === 'info') {
-            if (msgLower.includes('error') || msgLower.includes('failed') || msgLower.includes('invalid') || msgLower.includes('exception')) {
-                type = 'error';
-            } else if (msgLower.includes('warning') || msgLower.includes('required') || msgLower.includes('attention')) {
-                type = 'warning';
-            }
-        }
-
-        showAlert(msg, type);
-    };
-
-    console.log('Modal Alerts library loaded - native alert() overridden');
-    console.log('For confirm(), use showConfirm() or showDeleteConfirm() instead of native confirm()');
-})();

weed/admin/view/app/cluster_ec_shards.templ

@@ -145,6 +145,20 @@ templ ClusterEcShards(data dash.ClusterEcShardsData) {
                             </a>
                         </th>
                     }
+                    <th>
+                        <a href="#" onclick="sortBy('server')" class="text-dark text-decoration-none">
+                            Server
+                            if data.SortBy == "server" {
+                                if data.SortOrder == "asc" {
+                                    <i class="fas fa-sort-up ms-1"></i>
+                                } else {
+                                    <i class="fas fa-sort-down ms-1"></i>
+                                }
+                            } else {
+                                <i class="fas fa-sort ms-1 text-muted"></i>
+                            }
+                        </a>
+                    </th>
                     if data.ShowDataCenterColumn {
                         <th>
                             <a href="#" onclick="sortBy('datacenter')" class="text-dark text-decoration-none">
@@ -161,20 +175,6 @@ templ ClusterEcShards(data dash.ClusterEcShardsData) {
                             </a>
                         </th>
                     }
-                    <th>
-                        <a href="#" onclick="sortBy('server')" class="text-dark text-decoration-none">
-                            Server
-                            if data.SortBy == "server" {
-                                if data.SortOrder == "asc" {
-                                    <i class="fas fa-sort-up ms-1"></i>
-                                } else {
-                                    <i class="fas fa-sort-down ms-1"></i>
-                                }
-                            } else {
-                                <i class="fas fa-sort ms-1 text-muted"></i>
-                            }
-                        </a>
-                    </th>
                     if data.ShowRackColumn {
                         <th>
                             <a href="#" onclick="sortBy('rack')" class="text-dark text-decoration-none">
@@ -215,14 +215,14 @@ templ ClusterEcShards(data dash.ClusterEcShardsData) {
                                 }
                             </td>
                         }
+                        <td>
+                            <code class="small">{shard.Server}</code>
+                        </td>
                         if data.ShowDataCenterColumn {
                             <td>
                                 <span class="badge bg-outline-primary">{shard.DataCenter}</span>
                             </td>
                         }
-                        <td>
-                            <code class="small">{shard.Server}</code>
-                        </td>
                         if data.ShowRackColumn {
                             <td>
                                 <span class="badge bg-outline-secondary">{shard.Rack}</span>
@@ -341,15 +341,10 @@ templ ClusterEcShards(data dash.ClusterEcShardsData) {
             });
         }
 
-        function goToPage(arg) {
-            let page;
-            if (typeof arg === 'number' || typeof arg === 'string') {
-                page = arg;
-            } else {
-                // Get data from the link element (not any child elements)
-                const link = arg.target.closest('a');
-                page = link.getAttribute('data-page');
-            }
+        function goToPage(event) {
+            // Get data from the link element (not any child elements)
+            const link = event.target.closest('a');
+            const page = link.getAttribute('data-page');
             updateUrl({ page: page });
         }
 
@@ -392,7 +387,7 @@ templ ClusterEcShards(data dash.ClusterEcShardsData) {
             // Get data from the button element (not the icon inside it)
             const button = event.target.closest('button');
             const volumeId = button.getAttribute('data-volume-id');
-            showConfirm(`Are you sure you want to repair missing shards for volume ${volumeId}?`, function() {
+            if (confirm(`Are you sure you want to repair missing shards for volume ${volumeId}?`)) {
                 fetch(`/api/storage/volumes/${volumeId}/repair`, {
                     method: 'POST',
                     headers: {
@@ -402,18 +397,17 @@ templ ClusterEcShards(data dash.ClusterEcShardsData) {
                 .then(response => response.json())
                 .then(data => {
                     if (data.success) {
-                        showAlert('Repair initiated successfully', 'success');
+                        alert('Repair initiated successfully');
                         location.reload();
                     } else {
-                        showAlert('Failed to initiate repair: ' + data.error, 'error');
+                        alert('Failed to initiate repair: ' + data.error);
                     }
                 })
                 .catch(error => {
-                    showAlert('Error: ' + error.message, 'error');
+                    alert('Error: ' + error.message);
                 });
-            });
+            }
         }
-
     </script>
 }
 

weed/admin/view/app/cluster_ec_shards_templ.go

@@ -218,60 +218,60 @@ func ClusterEcShards(data dash.ClusterEcShardsData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 		}
-		if data.ShowDataCenterColumn {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 29, "<th><a href=\"#\" onclick=\"sortBy('datacenter')\" class=\"text-dark text-decoration-none\">Data Center ")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			if data.SortBy == "datacenter" {
-				if data.SortOrder == "asc" {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 30, "<i class=\"fas fa-sort-up ms-1\"></i>")
-					if templ_7745c5c3_Err != nil {
-						return templ_7745c5c3_Err
-					}
-				} else {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 31, "<i class=\"fas fa-sort-down ms-1\"></i>")
-					if templ_7745c5c3_Err != nil {
-						return templ_7745c5c3_Err
-					}
-				}
-			} else {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 32, "<i class=\"fas fa-sort ms-1 text-muted\"></i>")
-				if templ_7745c5c3_Err != nil {
-					return templ_7745c5c3_Err
-				}
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 33, "</a></th>")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 34, "<th><a href=\"#\" onclick=\"sortBy('server')\" class=\"text-dark text-decoration-none\">Server ")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 29, "<th><a href=\"#\" onclick=\"sortBy('server')\" class=\"text-dark text-decoration-none\">Server ")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		if data.SortBy == "server" {
 			if data.SortOrder == "asc" {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 35, "<i class=\"fas fa-sort-up ms-1\"></i>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 30, "<i class=\"fas fa-sort-up ms-1\"></i>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			} else {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 36, "<i class=\"fas fa-sort-down ms-1\"></i>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 31, "<i class=\"fas fa-sort-down ms-1\"></i>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
 		} else {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 37, "<i class=\"fas fa-sort ms-1 text-muted\"></i>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 32, "<i class=\"fas fa-sort ms-1 text-muted\"></i>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 38, "</a></th>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 33, "</a></th>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
+		if data.ShowDataCenterColumn {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 34, "<th><a href=\"#\" onclick=\"sortBy('datacenter')\" class=\"text-dark text-decoration-none\">Data Center ")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			if data.SortBy == "datacenter" {
+				if data.SortOrder == "asc" {
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 35, "<i class=\"fas fa-sort-up ms-1\"></i>")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+				} else {
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 36, "<i class=\"fas fa-sort-down ms-1\"></i>")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+				}
+			} else {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 37, "<i class=\"fas fa-sort ms-1 text-muted\"></i>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 38, "</a></th>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		}
 		if data.ShowRackColumn {
 			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 39, "<th><a href=\"#\" onclick=\"sortBy('rack')\" class=\"text-dark text-decoration-none\">Rack ")
 			if templ_7745c5c3_Err != nil {
@@ -356,42 +356,42 @@ func ClusterEcShards(data dash.ClusterEcShardsData) templ.Component {
 					return templ_7745c5c3_Err
 				}
 			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 52, "<td><code class=\"small\">")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var9 string
+			templ_7745c5c3_Var9, templ_7745c5c3_Err = templ.JoinStringErrs(shard.Server)
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 219, Col: 61}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var9))
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 53, "</code></td>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
 			if data.ShowDataCenterColumn {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 52, "<td><span class=\"badge bg-outline-primary\">")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 54, "<td><span class=\"badge bg-outline-primary\">")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				var templ_7745c5c3_Var9 string
-				templ_7745c5c3_Var9, templ_7745c5c3_Err = templ.JoinStringErrs(shard.DataCenter)
+				var templ_7745c5c3_Var10 string
+				templ_7745c5c3_Var10, templ_7745c5c3_Err = templ.JoinStringErrs(shard.DataCenter)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 220, Col: 88}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 223, Col: 88}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var9))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var10))
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 53, "</span></td>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 55, "</span></td>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 54, "<td><code class=\"small\">")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			var templ_7745c5c3_Var10 string
-			templ_7745c5c3_Var10, templ_7745c5c3_Err = templ.JoinStringErrs(shard.Server)
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 224, Col: 61}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var10))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 55, "</code></td>")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
 			if data.ShowRackColumn {
 				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 56, "<td><span class=\"badge bg-outline-secondary\">")
 				if templ_7745c5c3_Err != nil {
@@ -663,7 +663,7 @@ func ClusterEcShards(data dash.ClusterEcShardsData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 89, "<!-- JavaScript --><script>\n        function sortBy(field) {\n            const currentSort = \"{data.SortBy}\";\n            const currentOrder = \"{data.SortOrder}\";\n            let newOrder = 'asc';\n            \n            if (currentSort === field && currentOrder === 'asc') {\n                newOrder = 'desc';\n            }\n            \n            updateUrl({\n                sortBy: field,\n                sortOrder: newOrder,\n                page: 1\n            });\n        }\n\n        function goToPage(arg) {\n            let page;\n            if (typeof arg === 'number' || typeof arg === 'string') {\n                page = arg;\n            } else {\n                // Get data from the link element (not any child elements)\n                const link = arg.target.closest('a');\n                page = link.getAttribute('data-page');\n            }\n            updateUrl({ page: page });\n        }\n\n        function changePageSize() {\n            const pageSize = document.getElementById('pageSizeSelect').value;\n            updateUrl({ pageSize: pageSize, page: 1 });\n        }\n\n        function updateUrl(params) {\n            const url = new URL(window.location);\n            Object.keys(params).forEach(key => {\n                if (params[key]) {\n                    url.searchParams.set(key, params[key]);\n                } else {\n                    url.searchParams.delete(key);\n                }\n            });\n            window.location.href = url.toString();\n        }\n\n        function exportEcShards() {\n            const url = new URL('/api/storage/ec-shards/export', window.location.origin);\n            const params = new URLSearchParams(window.location.search);\n            params.forEach((value, key) => {\n                url.searchParams.set(key, value);\n            });\n            window.open(url.toString(), '_blank');\n        }\n\n        function showShardDetails(event) {\n            // Get data from the button element (not the icon inside it)\n            const button = event.target.closest('button');\n            const volumeId = button.getAttribute('data-volume-id');\n            \n            // Navigate to the EC volume details page\n            window.location.href = `/storage/ec-volumes/${volumeId}`;\n        }\n\n        function repairVolume(event) {\n            // Get data from the button element (not the icon inside it)\n            const button = event.target.closest('button');\n            const volumeId = button.getAttribute('data-volume-id');\n            showConfirm(`Are you sure you want to repair missing shards for volume ${volumeId}?`, function() {\n                fetch(`/api/storage/volumes/${volumeId}/repair`, {\n                    method: 'POST',\n                    headers: {\n                        'Content-Type': 'application/json',\n                    }\n                })\n                .then(response => response.json())\n                .then(data => {\n                    if (data.success) {\n                        showAlert('Repair initiated successfully', 'success');\n                        location.reload();\n                    } else {\n                        showAlert('Failed to initiate repair: ' + data.error, 'error');\n                    }\n                })\n                .catch(error => {\n                    showAlert('Error: ' + error.message, 'error');\n                });\n            });\n        }\n\n    </script>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 89, "<!-- JavaScript --><script>\n        function sortBy(field) {\n            const currentSort = \"{data.SortBy}\";\n            const currentOrder = \"{data.SortOrder}\";\n            let newOrder = 'asc';\n            \n            if (currentSort === field && currentOrder === 'asc') {\n                newOrder = 'desc';\n            }\n            \n            updateUrl({\n                sortBy: field,\n                sortOrder: newOrder,\n                page: 1\n            });\n        }\n\n        function goToPage(event) {\n            // Get data from the link element (not any child elements)\n            const link = event.target.closest('a');\n            const page = link.getAttribute('data-page');\n            updateUrl({ page: page });\n        }\n\n        function changePageSize() {\n            const pageSize = document.getElementById('pageSizeSelect').value;\n            updateUrl({ pageSize: pageSize, page: 1 });\n        }\n\n        function updateUrl(params) {\n            const url = new URL(window.location);\n            Object.keys(params).forEach(key => {\n                if (params[key]) {\n                    url.searchParams.set(key, params[key]);\n                } else {\n                    url.searchParams.delete(key);\n                }\n            });\n            window.location.href = url.toString();\n        }\n\n        function exportEcShards() {\n            const url = new URL('/api/storage/ec-shards/export', window.location.origin);\n            const params = new URLSearchParams(window.location.search);\n            params.forEach((value, key) => {\n                url.searchParams.set(key, value);\n            });\n            window.open(url.toString(), '_blank');\n        }\n\n        function showShardDetails(event) {\n            // Get data from the button element (not the icon inside it)\n            const button = event.target.closest('button');\n            const volumeId = button.getAttribute('data-volume-id');\n            \n            // Navigate to the EC volume details page\n            window.location.href = `/storage/ec-volumes/${volumeId}`;\n        }\n\n        function repairVolume(event) {\n            // Get data from the button element (not the icon inside it)\n            const button = event.target.closest('button');\n            const volumeId = button.getAttribute('data-volume-id');\n            if (confirm(`Are you sure you want to repair missing shards for volume ${volumeId}?`)) {\n                fetch(`/api/storage/volumes/${volumeId}/repair`, {\n                    method: 'POST',\n                    headers: {\n                        'Content-Type': 'application/json',\n                    }\n                })\n                .then(response => response.json())\n                .then(data => {\n                    if (data.success) {\n                        alert('Repair initiated successfully');\n                        location.reload();\n                    } else {\n                        alert('Failed to initiate repair: ' + data.error);\n                    }\n                })\n                .catch(error => {\n                    alert('Error: ' + error.message);\n                });\n            }\n        }\n    </script>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -700,7 +700,7 @@ func displayShardDistribution(shard dash.EcShardWithInfo, allShards []dash.EcSha
 		var templ_7745c5c3_Var24 string
 		templ_7745c5c3_Var24, templ_7745c5c3_Err = templ.JoinStringErrs(calculateDistributionSummary(shard.VolumeID, allShards))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 424, Col: 65}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 418, Col: 65}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var24))
 		if templ_7745c5c3_Err != nil {
@@ -750,7 +750,7 @@ func displayVolumeStatus(shard dash.EcShardWithInfo) templ.Component {
 				var templ_7745c5c3_Var26 string
 				templ_7745c5c3_Var26, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", len(shard.MissingShards)))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 434, Col: 129}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 428, Col: 129}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var26))
 				if templ_7745c5c3_Err != nil {
@@ -768,7 +768,7 @@ func displayVolumeStatus(shard dash.EcShardWithInfo) templ.Component {
 				var templ_7745c5c3_Var27 string
 				templ_7745c5c3_Var27, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", len(shard.MissingShards)))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 436, Col: 145}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 430, Col: 145}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var27))
 				if templ_7745c5c3_Err != nil {
@@ -786,7 +786,7 @@ func displayVolumeStatus(shard dash.EcShardWithInfo) templ.Component {
 				var templ_7745c5c3_Var28 string
 				templ_7745c5c3_Var28, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", len(shard.MissingShards)))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 438, Col: 138}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 432, Col: 138}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var28))
 				if templ_7745c5c3_Err != nil {
@@ -804,7 +804,7 @@ func displayVolumeStatus(shard dash.EcShardWithInfo) templ.Component {
 				var templ_7745c5c3_Var29 string
 				templ_7745c5c3_Var29, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", len(shard.MissingShards)))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 440, Col: 137}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 434, Col: 137}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var29))
 				if templ_7745c5c3_Err != nil {

weed/admin/view/app/cluster_ec_volumes.templ

@@ -378,7 +378,7 @@ templ ClusterEcVolumes(data dash.ClusterEcVolumesData) {
 
         function repairVolume(event) {
             const volumeId = event.target.closest('button').getAttribute('data-volume-id');
-            showConfirm(`Are you sure you want to repair missing shards for volume ${volumeId}?`, function() {
+            if (confirm(`Are you sure you want to repair missing shards for volume ${volumeId}?`)) {
                 fetch(`/api/storage/ec-volumes/${volumeId}/repair`, {
                     method: 'POST',
                     headers: {
@@ -393,16 +393,16 @@ templ ClusterEcVolumes(data dash.ClusterEcVolumesData) {
                 })
                 .then(data => {
                     if (data && data.success) {
-                        showAlert('Repair initiated successfully', 'success');
+                        alert('Repair initiated successfully');
                         location.reload();
                     } else {
-                        showAlert('Failed to initiate repair: ' + (data && data.error ? data.error : 'Unknown error'), 'error');
+                        alert('Failed to initiate repair: ' + (data && data.error ? data.error : 'Unknown error'));
                     }
                 })
                 .catch(error => {
-                    showAlert('Error: ' + error.message, 'error');
+                    alert('Error: ' + error.message);
                 });
-            });
+            }
         }
     </script>
 }

weed/admin/view/app/cluster_ec_volumes_templ.go

@@ -757,7 +757,7 @@ func ClusterEcVolumes(data dash.ClusterEcVolumesData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 96, "<!-- JavaScript --><script>\n        function sortBy(field) {\n            const currentSort = new URLSearchParams(window.location.search).get('sort_by');\n            const currentOrder = new URLSearchParams(window.location.search).get('sort_order') || 'asc';\n            \n            let newOrder = 'asc';\n            if (currentSort === field && currentOrder === 'asc') {\n                newOrder = 'desc';\n            }\n            \n            updateUrl({\n                sort_by: field,\n                sort_order: newOrder,\n                page: 1\n            });\n        }\n\n        function goToPage(event) {\n            event.preventDefault();\n            const page = event.target.closest('a').getAttribute('data-page');\n            updateUrl({ page: page });\n        }\n\n        function changePageSize(newPageSize) {\n            updateUrl({ page_size: newPageSize, page: 1 });\n        }\n\n        function updateUrl(params) {\n            const url = new URL(window.location);\n            Object.keys(params).forEach(key => {\n                if (params[key] != null) {\n                    url.searchParams.set(key, params[key]);\n                } else {\n                    url.searchParams.delete(key);\n                }\n            });\n            window.location.href = url.toString();\n        }\n\n        function showVolumeDetails(event) {\n            const volumeId = event.target.closest('button').getAttribute('data-volume-id');\n            window.location.href = `/storage/ec-volumes/${volumeId}`;\n        }\n\n        function repairVolume(event) {\n            const volumeId = event.target.closest('button').getAttribute('data-volume-id');\n            showConfirm(`Are you sure you want to repair missing shards for volume ${volumeId}?`, function() {\n                fetch(`/api/storage/ec-volumes/${volumeId}/repair`, {\n                    method: 'POST',\n                    headers: {\n                        'Content-Type': 'application/json',\n                    }\n                })\n                .then(response => {\n                    if (!response.ok) {\n                        throw new Error(`HTTP ${response.status}: ${response.statusText}`);\n                    }\n                    return response.json();\n                })\n                .then(data => {\n                    if (data && data.success) {\n                        showAlert('Repair initiated successfully', 'success');\n                        location.reload();\n                    } else {\n                        showAlert('Failed to initiate repair: ' + (data && data.error ? data.error : 'Unknown error'), 'error');\n                    }\n                })\n                .catch(error => {\n                    showAlert('Error: ' + error.message, 'error');\n                });\n            });\n        }\n    </script>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 96, "<!-- JavaScript --><script>\n        function sortBy(field) {\n            const currentSort = new URLSearchParams(window.location.search).get('sort_by');\n            const currentOrder = new URLSearchParams(window.location.search).get('sort_order') || 'asc';\n            \n            let newOrder = 'asc';\n            if (currentSort === field && currentOrder === 'asc') {\n                newOrder = 'desc';\n            }\n            \n            updateUrl({\n                sort_by: field,\n                sort_order: newOrder,\n                page: 1\n            });\n        }\n\n        function goToPage(event) {\n            event.preventDefault();\n            const page = event.target.closest('a').getAttribute('data-page');\n            updateUrl({ page: page });\n        }\n\n        function changePageSize(newPageSize) {\n            updateUrl({ page_size: newPageSize, page: 1 });\n        }\n\n        function updateUrl(params) {\n            const url = new URL(window.location);\n            Object.keys(params).forEach(key => {\n                if (params[key] != null) {\n                    url.searchParams.set(key, params[key]);\n                } else {\n                    url.searchParams.delete(key);\n                }\n            });\n            window.location.href = url.toString();\n        }\n\n        function showVolumeDetails(event) {\n            const volumeId = event.target.closest('button').getAttribute('data-volume-id');\n            window.location.href = `/storage/ec-volumes/${volumeId}`;\n        }\n\n        function repairVolume(event) {\n            const volumeId = event.target.closest('button').getAttribute('data-volume-id');\n            if (confirm(`Are you sure you want to repair missing shards for volume ${volumeId}?`)) {\n                fetch(`/api/storage/ec-volumes/${volumeId}/repair`, {\n                    method: 'POST',\n                    headers: {\n                        'Content-Type': 'application/json',\n                    }\n                })\n                .then(response => {\n                    if (!response.ok) {\n                        throw new Error(`HTTP ${response.status}: ${response.statusText}`);\n                    }\n                    return response.json();\n                })\n                .then(data => {\n                    if (data && data.success) {\n                        alert('Repair initiated successfully');\n                        location.reload();\n                    } else {\n                        alert('Failed to initiate repair: ' + (data && data.error ? data.error : 'Unknown error'));\n                    }\n                })\n                .catch(error => {\n                    alert('Error: ' + error.message);\n                });\n            }\n        }\n    </script>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}

weed/admin/view/app/collection_details.templ

@@ -372,10 +372,10 @@ templ CollectionDetails(data dash.CollectionDetailsData) {
 		// Repair EC Volume
 		function repairEcVolume(event) {
 			const volumeId = event.target.closest('button').getAttribute('data-volume-id');
-   showConfirm(`Are you sure you want to repair missing shards for EC volume ${volumeId}?`, function() {
+			if (confirm(`Are you sure you want to repair missing shards for EC volume ${volumeId}?`)) {
 				// TODO: Implement repair functionality
-				showAlert('Repair functionality will be implemented soon.', 'info');
-			});
+				alert('Repair functionality will be implemented soon.');
+			}
 		}
 	</script>
-}
+} 

weed/admin/view/app/collection_details_templ.go

@@ -575,7 +575,7 @@ func CollectionDetails(data dash.CollectionDetailsData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 64, "<script>\n\t\t// Sorting functionality\n\t\tfunction sortBy(field) {\n\t\t\tconst currentSort = new URLSearchParams(window.location.search).get('sort_by');\n\t\t\tconst currentOrder = new URLSearchParams(window.location.search).get('sort_order') || 'asc';\n\t\t\t\n\t\t\tlet newOrder = 'asc';\n\t\t\tif (currentSort === field && currentOrder === 'asc') {\n\t\t\t\tnewOrder = 'desc';\n\t\t\t}\n\t\t\t\n\t\t\tconst url = new URL(window.location);\n\t\t\turl.searchParams.set('sort_by', field);\n\t\t\turl.searchParams.set('sort_order', newOrder);\n\t\t\turl.searchParams.set('page', '1'); // Reset to first page\n\t\t\twindow.location.href = url.toString();\n\t\t}\n\n\t\t// Pagination functionality\n\t\tfunction goToPage(event) {\n\t\t\tevent.preventDefault();\n\t\t\tconst page = event.target.closest('a').getAttribute('data-page');\n\t\t\tconst url = new URL(window.location);\n\t\t\turl.searchParams.set('page', page);\n\t\t\twindow.location.href = url.toString();\n\t\t}\n\n\t\t// Page size functionality\n\t\tfunction changePageSize(newPageSize) {\n\t\t\tconst url = new URL(window.location);\n\t\t\turl.searchParams.set('page_size', newPageSize);\n\t\t\turl.searchParams.set('page', '1'); // Reset to first page when changing page size\n\t\t\twindow.location.href = url.toString();\n\t\t}\n\n\t\t// Volume details\n\t\tfunction showVolumeDetails(event) {\n\t\t\tconst volumeId = event.target.closest('button').getAttribute('data-volume-id');\n\t\t\tconst server = event.target.closest('button').getAttribute('data-server');\n\t\t\twindow.location.href = `/storage/volumes/${volumeId}/${server}`;\n\t\t}\n\n\t\t// EC Volume details\n\t\tfunction showEcVolumeDetails(event) {\n\t\t\tconst volumeId = event.target.closest('button').getAttribute('data-volume-id');\n\t\t\twindow.location.href = `/storage/ec-volumes/${volumeId}`;\n\t\t}\n\n\t\t// Repair EC Volume\n\t\tfunction repairEcVolume(event) {\n\t\t\tconst volumeId = event.target.closest('button').getAttribute('data-volume-id');\n   showConfirm(`Are you sure you want to repair missing shards for EC volume ${volumeId}?`, function() {\n\t\t\t\t// TODO: Implement repair functionality\n\t\t\t\tshowAlert('Repair functionality will be implemented soon.', 'info');\n\t\t\t});\n\t\t}\n\t</script>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 64, "<script>\n\t\t// Sorting functionality\n\t\tfunction sortBy(field) {\n\t\t\tconst currentSort = new URLSearchParams(window.location.search).get('sort_by');\n\t\t\tconst currentOrder = new URLSearchParams(window.location.search).get('sort_order') || 'asc';\n\t\t\t\n\t\t\tlet newOrder = 'asc';\n\t\t\tif (currentSort === field && currentOrder === 'asc') {\n\t\t\t\tnewOrder = 'desc';\n\t\t\t}\n\t\t\t\n\t\t\tconst url = new URL(window.location);\n\t\t\turl.searchParams.set('sort_by', field);\n\t\t\turl.searchParams.set('sort_order', newOrder);\n\t\t\turl.searchParams.set('page', '1'); // Reset to first page\n\t\t\twindow.location.href = url.toString();\n\t\t}\n\n\t\t// Pagination functionality\n\t\tfunction goToPage(event) {\n\t\t\tevent.preventDefault();\n\t\t\tconst page = event.target.closest('a').getAttribute('data-page');\n\t\t\tconst url = new URL(window.location);\n\t\t\turl.searchParams.set('page', page);\n\t\t\twindow.location.href = url.toString();\n\t\t}\n\n\t\t// Page size functionality\n\t\tfunction changePageSize(newPageSize) {\n\t\t\tconst url = new URL(window.location);\n\t\t\turl.searchParams.set('page_size', newPageSize);\n\t\t\turl.searchParams.set('page', '1'); // Reset to first page when changing page size\n\t\t\twindow.location.href = url.toString();\n\t\t}\n\n\t\t// Volume details\n\t\tfunction showVolumeDetails(event) {\n\t\t\tconst volumeId = event.target.closest('button').getAttribute('data-volume-id');\n\t\t\tconst server = event.target.closest('button').getAttribute('data-server');\n\t\t\twindow.location.href = `/storage/volumes/${volumeId}/${server}`;\n\t\t}\n\n\t\t// EC Volume details\n\t\tfunction showEcVolumeDetails(event) {\n\t\t\tconst volumeId = event.target.closest('button').getAttribute('data-volume-id');\n\t\t\twindow.location.href = `/storage/ec-volumes/${volumeId}`;\n\t\t}\n\n\t\t// Repair EC Volume\n\t\tfunction repairEcVolume(event) {\n\t\t\tconst volumeId = event.target.closest('button').getAttribute('data-volume-id');\n\t\t\tif (confirm(`Are you sure you want to repair missing shards for EC volume ${volumeId}?`)) {\n\t\t\t\t// TODO: Implement repair functionality\n\t\t\t\talert('Repair functionality will be implemented soon.');\n\t\t\t}\n\t\t}\n\t</script>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}

weed/admin/view/app/file_browser.templ

@@ -365,10 +365,9 @@ templ FileBrowser(data dash.FileBrowserData) {
 					showFileProperties(path);
 					break;
 				case 'delete':
-					const fileName = path.split('/').pop();
-					showDeleteConfirm(fileName, function() {
+					if (confirm('Are you sure you want to delete "' + path + '"?')) {
 						deleteFile(path);
-					}, `Are you sure you want to delete "${fileName}"? This action cannot be undone.`);
+					}
 					break;
 			}
 		});
@@ -396,14 +395,14 @@ templ FileBrowser(data dash.FileBrowserData) {
 			.then(response => response.json())
 			.then(data => {
 				if (data.error) {
-					showAlert('Error loading file properties: ' + data.error, 'error');
+					alert('Error loading file properties: ' + data.error);
 				} else {
 					displayFileProperties(data);
 				}
 			})
 			.catch(error => {
 				console.error('Error fetching file properties:', error);
-				showAlert('Error loading file properties: ' + error.message, 'error');
+				alert('Error loading file properties: ' + error.message);
 			});
 	}
 	

weed/admin/view/app/maintenance_config.templ

@@ -251,7 +251,7 @@ templ MaintenanceConfig(data *maintenance.MaintenanceConfigData) {
         }
 
         function resetToDefaults() {
-            showConfirm('Are you sure you want to reset to default configuration? This will overwrite your current settings.', function() {
+            if (confirm('Are you sure you want to reset to default configuration? This will overwrite your current settings.')) {
                 // Reset form to defaults (matching DefaultMaintenanceConfig values)
                 document.getElementById('enabled').checked = false;
                 document.getElementById('scanInterval').value = '30';
@@ -261,7 +261,7 @@ templ MaintenanceConfig(data *maintenance.MaintenanceConfigData) {
                 document.getElementById('maxRetries').value = '3';
                 document.getElementById('retryDelay').value = '15';
                 document.getElementById('taskRetention').value = '7';
-            });
+            }
         }
     </script>
 }