config: set ServiceAccountsDirectory to /etc/iam/service_accounts

refactor: standardize Service Accounts as distinct store entities and fix Admin Server persistence
refactor: remove configuration.json and migrate Service Accounts to multi-file layout
2026-10-15 19:15:51 +00:00 · 2026-01-25 19:10:14 -08:00 · 2026-01-25 19:08:18 -08:00 · 2026-01-25 18:52:43 -08:00 · 2026-01-25 18:43:05 -08:00 · 2026-01-25 14:32:55 -08:00
138 changed files with 2673 additions and 4183 deletions
@@ -24,7 +24,7 @@ jobs:
    timeout-minutes: 30
    steps:
    - name: Set up Go 1.x
-      uses: actions/setup-go@a5f9b05d2d216f63e13859e0d847461041025775 # v2
+      uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v2
      with:
        go-version: ^1.13
      id: go
@@ -23,10 +23,10 @@ jobs:
    
    steps:
    - name: Checkout code
-      uses: actions/checkout@v6
+      uses: actions/checkout@v4
      
    - name: Set up Go
-      uses: actions/setup-go@v6
+      uses: actions/setup-go@v5
      with:
        go-version: '1.24'
        
@@ -42,7 +42,7 @@ jobs:
        
    - name: Upload test logs on failure
      if: failure()
-      uses: actions/upload-artifact@v6
+      uses: actions/upload-artifact@v4
      with:
        name: ec-test-logs
        path: test/erasure_coding/admin_dockertest/tmp/logs/
@@ -21,7 +21,7 @@ jobs:
    steps:

    - name: Set up Go 1.x
-      uses: actions/setup-go@a5f9b05d2d216f63e13859e0d847461041025775 # v2
+      uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v2
      with:
        go-version: ^1.13
      id: go
@@ -141,4 +141,3 @@ test/s3/iam/.test_env
 /test/erasure_coding/admin_dockertest/tmp
 /test/erasure_coding/admin_dockertest/task_logs
 weed_bin
-.aider*
@@ -4,7 +4,6 @@ COPY  ./weed /usr/bin/weed
 RUN chmod +x /usr/bin/weed && ls -la /usr/bin/weed
 RUN mkdir -p /etc/seaweedfs
 COPY ./filer.toml /etc/seaweedfs/filer.toml
-COPY ./security.toml.example /etc/seaweedfs/security.toml.example
 COPY ./entrypoint.sh /entrypoint.sh

 # Install dependencies and create non-root user
@@ -1,34 +0,0 @@
-# Put this file to one of the location, with descending priority
-#    ./security.toml
-#    $HOME/.seaweedfs/security.toml
-#    /etc/seaweedfs/security.toml
-# this file is read by master, volume server, filer, and worker
-
-# comma separated origins allowed to make requests to the filer and s3 gateway. 
-# enter in this format: https://domain.com, or http://localhost:port
-[cors.allowed_origins]
-values = "*"
-
-# this jwt signing key is read by master and volume server, and it is used for write operations:
-# - the Master server generates the JWT, which can be used to write a certain file on a volume server
-# - the Volume server validates the JWT on writing
-# the jwt defaults to expire after 10 seconds.
-[jwt.signing]
-key = "<REPLACE_AT_RUNTIME>"
-# this jwt signing key is read by master and volume server, and it is used for read operations:
-# - the Master server generates the JWT, which can be used to read a certain file on a volume server
-# - the Volume server validates the JWT on reading
-[jwt.signing.read]
-key = "<REPLACE_AT_RUNTIME>"
-# If this JWT key is configured, Filer only accepts writes over HTTP if they are signed with this JWT:
-# - f.e. the S3 API Shim generates the JWT
-# - the Filer server validates the JWT on writing
-# the jwt defaults to expire after 10 seconds.
-[jwt.filer_signing]
-key = "<REPLACE_AT_RUNTIME>"
-# If this JWT key is configured, Filer only accepts reads over HTTP if they are signed with this JWT:
-# - f.e. the S3 API Shim generates the JWT
-# - the Filer server validates the JWT on writing
-# the jwt defaults to expire after 10 seconds.
-[jwt.filer_signing.read]
-key = "<REPLACE_AT_RUNTIME>"
@@ -39,7 +39,7 @@ require (
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
-	github.com/jackc/pgx/v5 v5.8.0
+	github.com/jackc/pgx/v5 v5.7.6
 	github.com/jcmturner/gofork v1.7.6 // indirect
 	github.com/jcmturner/gokrb5/v8 v8.4.4 // indirect
 	github.com/jinzhu/copier v0.4.0
@@ -92,12 +92,12 @@ require (
 	gocloud.dev v0.44.0
 	gocloud.dev/pubsub/natspubsub v0.44.0
 	gocloud.dev/pubsub/rabbitpubsub v0.44.0
-	golang.org/x/crypto v0.47.0
+	golang.org/x/crypto v0.46.0
 	golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546
 	golang.org/x/image v0.35.0
-	golang.org/x/net v0.49.0
+	golang.org/x/net v0.48.0
 	golang.org/x/oauth2 v0.34.0
-	golang.org/x/sys v0.40.0
+	golang.org/x/sys v0.39.0
 	golang.org/x/text v0.33.0 // indirect
 	golang.org/x/tools v0.40.0 // indirect
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
@@ -109,7 +109,7 @@ require (
 	modernc.org/b v1.0.0 // indirect
 	modernc.org/mathutil v1.7.1
 	modernc.org/memory v1.11.0 // indirect
-	modernc.org/sqlite v1.44.3
+	modernc.org/sqlite v1.44.2
 	modernc.org/strutil v1.2.1
 )

@@ -118,7 +118,7 @@ require (
 	github.com/Azure/azure-sdk-for-go/sdk/keyvault/azkeys v0.10.0
 	github.com/Jille/raft-grpc-transport v1.6.1
 	github.com/ThreeDotsLabs/watermill v1.5.1
-	github.com/a-h/templ v0.3.977
+	github.com/a-h/templ v0.3.943
 	github.com/apache/cassandra-gocql-driver/v2 v2.0.0
 	github.com/apple/foundationdb/bindings/go v0.0.0-20250911184653-27f7192f47c3
 	github.com/arangodb/go-driver v1.6.9
@@ -157,7 +157,7 @@ require (
 	github.com/tikv/client-go/v2 v2.0.7
 	github.com/xeipuuv/gojsonschema v1.2.0
 	github.com/ydb-platform/ydb-go-sdk-auth-environ v0.5.1
-	github.com/ydb-platform/ydb-go-sdk/v3 v3.125.3
+	github.com/ydb-platform/ydb-go-sdk/v3 v3.125.1
 	go.etcd.io/etcd/client/pkg/v3 v3.6.7
 	go.uber.org/atomic v1.11.0
 	golang.org/x/sync v0.19.0
@@ -249,7 +249,7 @@ require (
 	cloud.google.com/go/iam v1.5.3 // indirect
 	cloud.google.com/go/monitoring v1.24.2 // indirect
 	filippo.io/edwards25519 v1.1.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0
 	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1
 	github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.3
@@ -291,7 +291,7 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/sso v1.30.9 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.13 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sts v1.41.6 // indirect
-	github.com/aws/smithy-go v1.24.0
+	github.com/aws/smithy-go v1.24.0 // indirect
 	github.com/boltdb/bolt v1.3.1 // indirect
 	github.com/bradenaw/juniper v0.15.3 // indirect
 	github.com/bradfitz/iter v0.0.0-20191230175014-e8f45d346db8 // indirect
@@ -460,7 +460,7 @@ require (
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
 	golang.org/x/arch v0.20.0 // indirect
-	golang.org/x/term v0.39.0 // indirect
+	golang.org/x/term v0.38.0 // indirect
 	golang.org/x/time v0.14.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20251111163417-95abcf5c77ba // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20251213004720-97cd9d5aeac2 // indirect
@@ -541,8 +541,8 @@ filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
 filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
 gioui.org v0.0.0-20210308172011-57750fc8a0a6/go.mod h1:RSH6KIUZ0p2xy5zHDxgAM4zumjgTw83q2ge/PI+yyw8=
 git.sr.ht/~sbinet/gg v0.3.1/go.mod h1:KGYtlADtqsqANL9ueOFkWymvzUvLMQllU5Ixo+8v3pc=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0 h1:fou+2+WFTib47nS+nz/ozhEBnvU96bKHy6LjRsY4E28=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0/go.mod h1:t76Ruy8AHvUAC8GfMWJMa0ElSbuIcO03NLpynfbgsPA=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 h1:JXg2dwJUmPB9JmtVmdEB16APJ7jurfbY5jnfXpJoRMc=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0/go.mod h1:YD5h/ldMsG0XiIw7PdyNhLxaM317eFh5yNLccNfGdyw=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 h1:Hk5QBxZQC1jb2Fwj6mpzme37xbCDdNTxU7O9eb5+LB4=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1/go.mod h1:IYus9qsFobWIc2YVwe/WPjcnyCkPKtnHAqUYeebc8z0=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2 h1:yz1bePFlP5Vws5+8ez6T3HWXPmwOK7Yvq8QxDBD3SKY=
@@ -628,8 +628,8 @@ github.com/ThreeDotsLabs/watermill v1.5.1 h1:t5xMivyf9tpmU3iozPqyrCZXHvoV1XQDfih
 github.com/ThreeDotsLabs/watermill v1.5.1/go.mod h1:Uop10dA3VeJWsSvis9qO3vbVY892LARrKAdki6WtXS4=
 github.com/TomiHiltunen/geohash-golang v0.0.0-20150112065804-b3e4e625abfb h1:wumPkzt4zaxO4rHPBrjDK8iZMR41C1qs7njNqlacwQg=
 github.com/TomiHiltunen/geohash-golang v0.0.0-20150112065804-b3e4e625abfb/go.mod h1:QiYsIBRQEO+Z4Rz7GoI+dsHVneZNONvhczuA+llOZNM=
-github.com/a-h/templ v0.3.977 h1:kiKAPXTZE2Iaf8JbtM21r54A8bCNsncrfnokZZSrSDg=
-github.com/a-h/templ v0.3.977/go.mod h1:oCZcnKRf5jjsGpf2yELzQfodLphd2mwecwG4Crk5HBo=
+github.com/a-h/templ v0.3.943 h1:o+mT/4yqhZ33F3ootBiHwaY4HM5EVaOJfIshvd5UNTY=
+github.com/a-h/templ v0.3.943/go.mod h1:oCZcnKRf5jjsGpf2yELzQfodLphd2mwecwG4Crk5HBo=
 github.com/a1ex3/zstd-seekable-format-go/pkg v0.10.0 h1:iLDOF0rdGTrol/q8OfPIIs5kLD8XvA2q75o6Uq/tgak=
 github.com/a1ex3/zstd-seekable-format-go/pkg v0.10.0/go.mod h1:DrEWcQJjz7t5iF2duaiyhg4jyoF0kxOD6LtECNGkZ/Q=
 github.com/aalpar/deheap v0.0.0-20210914013432-0cc84d79dec3 h1:hhdWprfSpFbN7lz3W1gM40vOgvSh1WCSMxYD6gGB4Hs=
@@ -1281,8 +1281,8 @@ github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsI
 github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
-github.com/jackc/pgx/v5 v5.8.0 h1:TYPDoleBBme0xGSAX3/+NujXXtpZn9HBONkQC7IEZSo=
-github.com/jackc/pgx/v5 v5.8.0/go.mod h1:QVeDInX2m9VyzvNeiCJVjCkNFqzsNb43204HshNSZKw=
+github.com/jackc/pgx/v5 v5.7.6 h1:rWQc5FwZSPX58r1OQmkuaNicxdmExaEz5A2DO2hUuTk=
+github.com/jackc/pgx/v5 v5.7.6/go.mod h1:aruU7o91Tc2q2cFp5h4uP3f6ztExVpyVv88Xl/8Vl8M=
 github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
 github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
 github.com/jaegertracing/jaeger v1.47.0 h1:XXxTMO+GxX930gxKWsg90rFr6RswkCRIW0AgWFnTYsg=
@@ -1820,8 +1820,8 @@ github.com/ydb-platform/ydb-go-sdk-auth-environ v0.5.1 h1:XaRxeVrOyl3y6v9CiYMWaF
 github.com/ydb-platform/ydb-go-sdk-auth-environ v0.5.1/go.mod h1:9YzkhlIymWaJGX6KMU3vh5sOf3UKbCXkG/ZdjaI3zNM=
 github.com/ydb-platform/ydb-go-sdk/v3 v3.44.0/go.mod h1:oSLwnuilwIpaF5bJJMAofnGgzPJusoI3zWMNb8I+GnM=
 github.com/ydb-platform/ydb-go-sdk/v3 v3.47.3/go.mod h1:bWnOIcUHd7+Sl7DN+yhyY1H/I61z53GczvwJgXMgvj0=
-github.com/ydb-platform/ydb-go-sdk/v3 v3.125.3 h1:hTwpF+PdbuR7vcixN+4AC6yu4asaUIAljQCxL51eDII=
-github.com/ydb-platform/ydb-go-sdk/v3 v3.125.3/go.mod h1:stS1mQYjbJvwwYaYzKyFY9eMiuVXWWXQA6T+SpOLg9c=
+github.com/ydb-platform/ydb-go-sdk/v3 v3.125.1 h1:YaqzRVbcncabB34YNjOl5ADomYUFva+6l74svIIIJUo=
+github.com/ydb-platform/ydb-go-sdk/v3 v3.125.1/go.mod h1:stS1mQYjbJvwwYaYzKyFY9eMiuVXWWXQA6T+SpOLg9c=
 github.com/ydb-platform/ydb-go-yc v0.12.1 h1:qw3Fa+T81+Kpu5Io2vYHJOwcrYrVjgJlT6t/0dOXJrA=
 github.com/ydb-platform/ydb-go-yc v0.12.1/go.mod h1:t/ZA4ECdgPWjAb4jyDe8AzQZB5dhpGbi3iCahFaNwBY=
 github.com/ydb-platform/ydb-go-yc-metadata v0.6.1 h1:9E5q8Nsy2RiJMZDNVy0A3KUrIMBPakJ2VgloeWbcI84=
@@ -1953,8 +1953,8 @@ golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.47.0 h1:V6e3FRj+n4dbpw86FJ8Fv7XVOql7TEwpHapKoMJ/GO8=
-golang.org/x/crypto v0.47.0/go.mod h1:ff3Y9VzzKbwSSEzWqJsJVBnWmRwRSHt/6Op5n9bQc4A=
+golang.org/x/crypto v0.46.0 h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU=
+golang.org/x/crypto v0.46.0/go.mod h1:Evb/oLKmMraqjZ2iQTwDwvCtJkczlDuTmdJXoZVzqU0=
 golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20180807140117-3d87b88a115f/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -2090,8 +2090,8 @@ golang.org/x/net v0.16.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
 golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
-golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o=
-golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8=
+golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU=
+golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -2248,8 +2248,8 @@ golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ=
-golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk=
+golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -2264,8 +2264,8 @@ golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
-golang.org/x/term v0.39.0 h1:RclSuaJf32jOqZz74CkPA9qFuVTX7vhLlpfj/IGWlqY=
-golang.org/x/term v0.39.0/go.mod h1:yxzUCTP/U+FzoxfdKmLaA0RV1WgE0VY7hXBwKtY/4ww=
+golang.org/x/term v0.38.0 h1:PQ5pkm/rLO6HnxFR7N2lJHOZX6Kez5Y1gDSJla6jo7Q=
+golang.org/x/term v0.38.0/go.mod h1:bSEAKrOT1W+VSu9TSCMtoGEOUcKxOKgl3LE5QEF/xVg=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -2748,8 +2748,8 @@ modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
 modernc.org/sqlite v1.18.1/go.mod h1:6ho+Gow7oX5V+OiOQ6Tr4xeqbx13UZ6t+Fw9IRUG4d4=
-modernc.org/sqlite v1.44.3 h1:+39JvV/HWMcYslAwRxHb8067w+2zowvFOUrOWIy9PjY=
-modernc.org/sqlite v1.44.3/go.mod h1:CzbrU2lSB1DKUusvwGz7rqEKIq+NUd8GWuBBZDs9/nA=
+modernc.org/sqlite v1.44.2 h1:EdYqXeBpKFJjg8QYnw6E71MpANkoxyuYi+g68ugOL8g=
+modernc.org/sqlite v1.44.2/go.mod h1:CzbrU2lSB1DKUusvwGz7rqEKIq+NUd8GWuBBZDs9/nA=
 modernc.org/strutil v1.1.0/go.mod h1:lstksw84oURvj9y3tn8lGvRxyRC1S2+g5uuIzNfIOBs=
 modernc.org/strutil v1.1.1/go.mod h1:DE+MQQ/hjKBZS2zNInV5hhcipt5rLPWkmpbGeW5mmdw=
 modernc.org/strutil v1.1.3/go.mod h1:MEHNA7PdEnEwLvspRMtWTNnp2nnyvMfkimT1NKNAGbw=
@@ -24,7 +24,7 @@ helm install --values=values.yaml seaweedfs seaweedfs/seaweedfs
 * master/filer/volume are stateful sets with anti-affinity on the hostname,
 so your deployment will be spread/HA.
 * chart is using memsql(mysql) as the filer backend to enable HA (multiple filer instances) and backup/HA memsql can provide.
-* mysql user/password are created in a k8s secret (default: `<release>-seaweedfs-db-secret`) and injected to the filer with ENV.
+* mysql user/password are created in a k8s secret (secret-seaweedfs-db.yaml) and injected to the filer with ENV.
 * cert config exists and can be enabled, but not been tested, requires cert-manager to be installed.

 ## Prerequisites
@@ -35,9 +35,7 @@ leveldb is the default database, this supports multiple filer replicas that will
 When the [limitations](https://github.com/seaweedfs/seaweedfs/wiki/Filer-Store-Replication#limitation) apply, or for a large number of filer replicas, an external datastore is recommended.

 Such as MySQL-compatible database, as specified in the `values.yaml` at `filer.extraEnvironmentVars`.
-This database should be pre-configured and initialized. If using the default `db-init-config`, the configmap name is now dynamic (e.g., `<release>-seaweedfs-db-init-config`). You can override this name via `filer.dbInitConfigName`.
-
-To initialize manually:
+This database should be pre-configured and initialized by running:
 ```sql
 CREATE TABLE IF NOT EXISTS `filemeta` (
  `dirhash`   BIGINT NOT NULL       COMMENT 'first 64 bits of MD5 hash value of directory field',
@@ -8,7 +8,7 @@ apiVersion: extensions/v1beta1
 {{- end }}
 kind: Ingress
 metadata:
-  name: ingress-{{ include "seaweedfs.fullname" . }}-admin
+  name: ingress-{{ template "seaweedfs.name" . }}-admin
  namespace: {{ .Release.Namespace }}
  annotations:
  {{- if and (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) .Values.admin.ingress.className }}
@@ -42,11 +42,11 @@ spec:
        backend:
 {{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion }}
          service:
-            name: {{ include "seaweedfs.fullname" . }}-admin
+            name: {{ template "seaweedfs.name" . }}-admin
            port:
              number: {{ .Values.admin.port }}
 {{- else }}
-          serviceName: {{ include "seaweedfs.fullname" . }}-admin
+          serviceName: {{ template "seaweedfs.name" . }}-admin
          servicePort: {{ .Values.admin.port }}
 {{- end }}
 {{- end }}
@@ -3,7 +3,7 @@ apiVersion: v1
 kind: Secret
 type: Opaque
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-admin-secret
+  name: {{ template "seaweedfs.name" . }}-admin-secret
  namespace: {{ .Release.Namespace }}
  annotations:
    "helm.sh/resource-policy": keep
@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ printf "%s-admin" (include "seaweedfs.fullname" .) | trunc 63 | trimSuffix "-" }}
+  name: {{ template "seaweedfs.name" . }}-admin
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -3,7 +3,7 @@
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-admin
+  name: {{ template "seaweedfs.name" . }}-admin
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -26,7 +26,6 @@ spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-      app.kubernetes.io/instance: {{ .Release.Name }}
      app.kubernetes.io/component: admin
 {{- end }}
 {{- end }}
@@ -8,7 +8,7 @@
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-admin
+  name: {{ template "seaweedfs.name" . }}-admin
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -21,7 +21,7 @@ metadata:
    {{- toYaml .Values.admin.annotations | nindent 4 }}
 {{- end }}
 spec:
-  serviceName: {{ include "seaweedfs.fullname" . }}-admin
+  serviceName: {{ template "seaweedfs.name" . }}-admin
  podManagementPolicy: {{ .Values.admin.podManagementPolicy }}
  replicas: {{ .Values.admin.replicas }}
  selector:
@@ -90,7 +90,7 @@ spec:
          {{- if and .Values.admin.secret.existingSecret (not .Values.admin.secret.pwKey) -}}
          {{-   fail "admin.secret.pwKey must be set when admin.secret.existingSecret is provided" -}}
          {{- end -}}
-          {{- $adminSecretName := .Values.admin.secret.existingSecret | default (printf "%s-admin-secret" (include "seaweedfs.fullname" .)) }}
+          {{- $adminSecretName := .Values.admin.secret.existingSecret | default (printf "%s-admin-secret" (include "seaweedfs.name" .)) }}
          env:
            {{- if $adminAuthEnabled }}
            - name: SEAWEEDFS_ADMIN_USER
@@ -117,7 +117,7 @@ spec:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: SEAWEEDFS_FULLNAME
-              value: "{{ include "seaweedfs.fullname" . }}"
+              value: "{{ template "seaweedfs.name" . }}"
            {{- if .Values.admin.extraEnvironmentVars }}
            {{- range $key, $value := .Values.admin.extraEnvironmentVars }}
            - name: {{ $key }}
@@ -284,25 +284,25 @@ spec:
        {{- if .Values.global.enableSecurity }}
        - name: security-config
          configMap:
-            name: {{ include "seaweedfs.fullname" . }}-security-config
+            name: {{ template "seaweedfs.name" . }}-security-config
        - name: ca-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
+            secretName: {{ template "seaweedfs.name" . }}-ca-cert
        - name: master-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-master-cert
+            secretName: {{ template "seaweedfs.name" . }}-master-cert
        - name: volume-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-volume-cert
+            secretName: {{ template "seaweedfs.name" . }}-volume-cert
        - name: filer-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-filer-cert
+            secretName: {{ template "seaweedfs.name" . }}-filer-cert
        - name: client-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-client-cert
+            secretName: {{ template "seaweedfs.name" . }}-client-cert
        - name: admin-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-admin-cert
+            secretName: {{ template "seaweedfs.name" . }}-admin-cert
        {{- end }}
        {{ tpl .Values.admin.extraVolumes . | indent 8 | trim }}
      {{- if .Values.admin.nodeSelector }}
@@ -2,7 +2,7 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-all-in-one
+  name: {{ template "seaweedfs.name" . }}-all-in-one
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -98,7 +98,7 @@ spec:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: SEAWEEDFS_FULLNAME
-              value: "{{ include "seaweedfs.fullname" . }}"
+              value: "{{ template "seaweedfs.name" . }}"
            {{- if .Values.allInOne.extraEnvironmentVars }}
            {{- range $key, $value := .Values.allInOne.extraEnvironmentVars }}
            {{- if and (ne $key $clusterMasterKey) (ne $key $clusterFilerKey) }}
@@ -421,7 +421,7 @@ spec:
            type: DirectoryOrCreate
          {{- else if eq .Values.allInOne.data.type "persistentVolumeClaim" }}
          persistentVolumeClaim:
-            claimName: {{ include "seaweedfs.fullname" . }}-all-in-one-data
+            claimName: {{ template "seaweedfs.name" . }}-all-in-one-data
          {{- else if eq .Values.allInOne.data.type "existingClaim" }}
          persistentVolumeClaim:
            claimName: {{ .Values.allInOne.data.claimName }}
@@ -432,47 +432,47 @@ spec:
        - name: config-s3-users
          secret:
            defaultMode: 420
-            secretName: {{ default (printf "%s-s3-secret" (include "seaweedfs.fullname" .)) (or .Values.allInOne.s3.existingConfigSecret .Values.s3.existingConfigSecret .Values.filer.s3.existingConfigSecret) }}
+            secretName: {{ default (printf "%s-s3-secret" (include "seaweedfs.name" .)) (or .Values.allInOne.s3.existingConfigSecret .Values.s3.existingConfigSecret .Values.filer.s3.existingConfigSecret) }}
        {{- end }}
        {{- if .Values.allInOne.sftp.enabled }}
        - name: config-ssh
          secret:
            defaultMode: 420
-            secretName: {{ default (printf "%s-sftp-ssh-secret" (include "seaweedfs.fullname" .)) (or .Values.allInOne.sftp.existingSshConfigSecret .Values.sftp.existingSshConfigSecret) }}
+            secretName: {{ default (printf "%s-sftp-ssh-secret" (include "seaweedfs.name" .)) (or .Values.allInOne.sftp.existingSshConfigSecret .Values.sftp.existingSshConfigSecret) }}
        {{- if or .Values.allInOne.sftp.enableAuth .Values.sftp.enableAuth }}
        - name: config-users
          secret:
            defaultMode: 420
-            secretName: {{ default (printf "%s-sftp-secret" (include "seaweedfs.fullname" .)) (or .Values.allInOne.sftp.existingConfigSecret .Values.sftp.existingConfigSecret) }}
+            secretName: {{ default (printf "%s-sftp-secret" (include "seaweedfs.name" .)) (or .Values.allInOne.sftp.existingConfigSecret .Values.sftp.existingConfigSecret) }}
        {{- end }}
        {{- end }}
        {{- if .Values.filer.notificationConfig }}
        - name: notification-config
          configMap:
-            name: {{ include "seaweedfs.fullname" . }}-notification-config
+            name: {{ template "seaweedfs.name" . }}-notification-config
        {{- end }}
        - name: master-config
          configMap:
-            name: {{ include "seaweedfs.fullname" . }}-master-config
+            name: {{ template "seaweedfs.name" . }}-master-config
        {{- if .Values.global.enableSecurity }}
        - name: security-config
          configMap:
-            name: {{ include "seaweedfs.fullname" . }}-security-config
+            name: {{ template "seaweedfs.name" . }}-security-config
        - name: ca-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
+            secretName: {{ template "seaweedfs.name" . }}-ca-cert
        - name: master-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-master-cert
+            secretName: {{ template "seaweedfs.name" . }}-master-cert
        - name: volume-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-volume-cert
+            secretName: {{ template "seaweedfs.name" . }}-volume-cert
        - name: filer-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-filer-cert
+            secretName: {{ template "seaweedfs.name" . }}-filer-cert
        - name: client-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-client-cert
+            secretName: {{ template "seaweedfs.name" . }}-client-cert
        {{- end }}
        {{ tpl .Values.allInOne.extraVolumes . | nindent 8 }}
      {{- if .Values.allInOne.nodeSelector }}
@@ -3,7 +3,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-all-in-one-data
+  name: {{ template "seaweedfs.name" . }}-all-in-one-data
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ printf "%s-all-in-one" (include "seaweedfs.fullname" .) | trunc 63 | trimSuffix "-" }}
+  name: {{ template "seaweedfs.name" . }}-all-in-one
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -81,6 +81,5 @@ spec:
  
  selector:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: seaweedfs-all-in-one
 {{- end }}
@@ -3,7 +3,7 @@
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-all-in-one
+  name: {{ template "seaweedfs.name" . }}-all-in-one
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -24,7 +24,6 @@ spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-      app.kubernetes.io/instance: {{ .Release.Name }}
      app.kubernetes.io/component: seaweedfs-all-in-one
 {{- end }}
 {{- end }}
@@ -2,7 +2,7 @@
 apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Certificate
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-admin-cert
+  name: {{ template "seaweedfs.name" . }}-admin-cert
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -15,19 +15,19 @@ metadata:
    {{- toYaml .Values.admin.annotations | nindent 4 }}
  {{- end }}
 spec:
-  secretName: {{ include "seaweedfs.fullname" . }}-admin-cert
+  secretName: {{ template "seaweedfs.name" . }}-admin-cert
  issuerRef:
-    name: {{ include "seaweedfs.fullname" . }}-ca-issuer
+    name: {{ template "seaweedfs.name" . }}-ca-issuer
    kind: Issuer
  commonName: {{ .Values.certificates.commonName }}
  subject:
    organizations:
    - "SeaweedFS CA"
  dnsNames:
-    - '*.{{ include "seaweedfs.fullname" . }}-admin'
-    - '*.{{ include "seaweedfs.fullname" . }}-admin.{{ .Release.Namespace }}'
-    - '*.{{ include "seaweedfs.fullname" . }}-admin.{{ .Release.Namespace }}.svc'
-    - '*.{{ include "seaweedfs.fullname" . }}-admin.{{ .Release.Namespace }}.svc.cluster.local'
+    - '*.{{ template "seaweedfs.name" . }}-admin'
+    - '*.{{ template "seaweedfs.name" . }}-admin.{{ .Release.Namespace }}'
+    - '*.{{ template "seaweedfs.name" . }}-admin.{{ .Release.Namespace }}.svc'
+    - '*.{{ template "seaweedfs.name" . }}-admin.{{ .Release.Namespace }}.svc.cluster.local'
 {{- if .Values.certificates.ipAddresses }}
  ipAddresses:
    {{- range .Values.certificates.ipAddresses }}
@@ -2,7 +2,7 @@
 apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Certificate
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-ca-cert
+  name: {{ template "seaweedfs.name" . }}-ca-cert
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -10,8 +10,8 @@ metadata:
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
 spec:
-  secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
-  commonName: "{{ include "seaweedfs.fullname" . }}-root-ca"
+  secretName: {{ template "seaweedfs.name" . }}-ca-cert
+  commonName: "{{ template "seaweedfs.name" . }}-root-ca"
  isCA: true
  {{- if .Values.certificates.ca.duration }}
  duration: {{ .Values.certificates.ca.duration }}
@@ -20,6 +20,6 @@ spec:
  renewBefore: {{ .Values.certificates.ca.renewBefore }}
  {{- end }}
  issuerRef:
-    name: {{ include "seaweedfs.fullname" . }}-issuer
+    name: {{ template "seaweedfs.name" . }}-issuer
    kind: Issuer
 {{- end }}
@@ -2,7 +2,7 @@
 apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Issuer
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-ca-issuer
+  name: {{ template "seaweedfs.name" . }}-ca-issuer
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -11,5 +11,5 @@ metadata:
    app.kubernetes.io/instance: {{ .Release.Name }}
 spec:
  ca:
-    secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
+    secretName: {{ template "seaweedfs.name" . }}-ca-cert
 {{- end }}
@@ -2,7 +2,7 @@
 apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Issuer
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-issuer
+  name: {{ template "seaweedfs.name" . }}-issuer
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
@@ -2,7 +2,7 @@
 apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Certificate
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-client-cert
+  name: {{ template "seaweedfs.name" . }}-client-cert
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -10,9 +10,9 @@ metadata:
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
 spec:
-  secretName: {{ include "seaweedfs.fullname" . }}-client-cert
+  secretName: {{ template "seaweedfs.name" . }}-client-cert
  issuerRef:
-    name: {{ include "seaweedfs.fullname" . }}-ca-issuer
+    name: {{ template "seaweedfs.name" . }}-ca-issuer
    kind: Issuer
  commonName: {{ .Values.certificates.commonName }}
  subject:
@@ -22,10 +22,10 @@ spec:
    - '*.{{ .Release.Namespace }}'
    - '*.{{ .Release.Namespace }}.svc'
    - '*.{{ .Release.Namespace }}.svc.cluster.local'
-    - '*.{{ include "seaweedfs.fullname" . }}-master'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc.cluster.local'
+    - '*.{{ template "seaweedfs.name" . }}-master'
+    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}'
+    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}.svc'
+    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}.svc.cluster.local'
 {{- if .Values.certificates.ipAddresses }}
  ipAddresses:
    {{- range .Values.certificates.ipAddresses }}
@@ -2,7 +2,7 @@
 apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Certificate
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-filer-cert
+  name: {{ template "seaweedfs.name" . }}-filer-cert
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -15,9 +15,9 @@ metadata:
    {{- toYaml .Values.filer.annotations | nindent 4 }}
  {{- end }}
 spec:
-  secretName: {{ include "seaweedfs.fullname" . }}-filer-cert
+  secretName: {{ template "seaweedfs.name" . }}-filer-cert
  issuerRef:
-    name: {{ include "seaweedfs.fullname" . }}-ca-issuer
+    name: {{ template "seaweedfs.name" . }}-ca-issuer
    kind: Issuer
  commonName: {{ .Values.certificates.commonName }}
  subject:
@@ -27,10 +27,10 @@ spec:
    - '*.{{ .Release.Namespace }}'
    - '*.{{ .Release.Namespace }}.svc'
    - '*.{{ .Release.Namespace }}.svc.cluster.local'
-    - '*.{{ include "seaweedfs.fullname" . }}-master'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc.cluster.local'
+    - '*.{{ template "seaweedfs.name" . }}-master'
+    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}'
+    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}.svc'
+    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}.svc.cluster.local'
 {{- if .Values.certificates.ipAddresses }}
  ipAddresses:
    {{- range .Values.certificates.ipAddresses }}
@@ -2,7 +2,7 @@
 apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Certificate
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-master-cert
+  name: {{ template "seaweedfs.name" . }}-master-cert
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -15,9 +15,9 @@ metadata:
    {{- toYaml .Values.master.annotations | nindent 4 }}
 {{- end }}
 spec:
-  secretName: {{ include "seaweedfs.fullname" . }}-master-cert
+  secretName: {{ template "seaweedfs.name" . }}-master-cert
  issuerRef:
-    name: {{ include "seaweedfs.fullname" . }}-ca-issuer
+    name: {{ template "seaweedfs.name" . }}-ca-issuer
    kind: Issuer
  commonName: {{ .Values.certificates.commonName }}
  subject:
@@ -27,10 +27,10 @@ spec:
    - '*.{{ .Release.Namespace }}'
    - '*.{{ .Release.Namespace }}.svc'
    - '*.{{ .Release.Namespace }}.svc.cluster.local'
-    - '*.{{ include "seaweedfs.fullname" . }}-master'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc.cluster.local'
+    - '*.{{ template "seaweedfs.name" . }}-master'
+    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}'
+    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}.svc'
+    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}.svc.cluster.local'
 {{- if .Values.certificates.ipAddresses }}
  ipAddresses:
    {{- range .Values.certificates.ipAddresses }}
@@ -2,7 +2,7 @@
 apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Certificate
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-volume-cert
+  name: {{ template "seaweedfs.name" . }}-volume-cert
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -15,9 +15,9 @@ metadata:
    {{- toYaml .Values.volume.annotations | nindent 4 }}
 {{- end }}
 spec:
-  secretName: {{ include "seaweedfs.fullname" . }}-volume-cert
+  secretName: {{ template "seaweedfs.name" . }}-volume-cert
  issuerRef:
-    name: {{ include "seaweedfs.fullname" . }}-ca-issuer
+    name: {{ template "seaweedfs.name" . }}-ca-issuer
    kind: Issuer
  commonName: {{ .Values.certificates.commonName }}
  subject:
@@ -27,10 +27,10 @@ spec:
    - '*.{{ .Release.Namespace }}'
    - '*.{{ .Release.Namespace }}.svc'
    - '*.{{ .Release.Namespace }}.svc.cluster.local'
-    - '*.{{ include "seaweedfs.fullname" . }}-master'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc.cluster.local'
+    - '*.{{ template "seaweedfs.name" . }}-master'
+    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}'
+    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}.svc'
+    - '*.{{ template "seaweedfs.name" . }}-master.{{ .Release.Namespace }}.svc.cluster.local'
 {{- if .Values.certificates.ipAddresses }}
  ipAddresses:
    {{- range .Values.certificates.ipAddresses }}
@@ -2,7 +2,7 @@
 apiVersion: cert-manager.io/v1{{ if .Values.global.certificates.alphacrds }}alpha1{{ end }}
 kind: Certificate
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-worker-cert
+  name: {{ template "seaweedfs.name" . }}-worker-cert
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -15,19 +15,19 @@ metadata:
    {{- toYaml .Values.worker.annotations | nindent 4 }}
  {{- end }}
 spec:
-  secretName: {{ include "seaweedfs.fullname" . }}-worker-cert
+  secretName: {{ template "seaweedfs.name" . }}-worker-cert
  issuerRef:
-    name: {{ include "seaweedfs.fullname" . }}-ca-issuer
+    name: {{ template "seaweedfs.name" . }}-ca-issuer
    kind: Issuer
  commonName: {{ .Values.certificates.commonName }}
  subject:
    organizations:
    - "SeaweedFS CA"
  dnsNames:
-    - '*.{{ include "seaweedfs.fullname" . }}-worker'
-    - '*.{{ include "seaweedfs.fullname" . }}-worker.{{ .Release.Namespace }}'
-    - '*.{{ include "seaweedfs.fullname" . }}-worker.{{ .Release.Namespace }}.svc'
-    - '*.{{ include "seaweedfs.fullname" . }}-worker.{{ .Release.Namespace }}.svc.cluster.local'
+    - '*.{{ template "seaweedfs.name" . }}-worker'
+    - '*.{{ template "seaweedfs.name" . }}-worker.{{ .Release.Namespace }}'
+    - '*.{{ template "seaweedfs.name" . }}-worker.{{ .Release.Namespace }}.svc'
+    - '*.{{ template "seaweedfs.name" . }}-worker.{{ .Release.Namespace }}.svc.cluster.local'
 {{- if .Values.certificates.ipAddresses }}
  ipAddresses:
    {{- range .Values.certificates.ipAddresses }}
@@ -3,7 +3,7 @@
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-objectstorage-provisioner
+  name: {{ .Values.global.serviceAccountName }}-objectstorage-provisioner
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
@@ -52,7 +52,7 @@ rules:
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-objectstorage-provisioner
+  name: {{ .Values.global.serviceAccountName }}-objectstorage-provisioner
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
@@ -64,6 +64,6 @@ subjects:
    namespace: {{ .Release.Namespace }}
 roleRef:
  kind: ClusterRole
-  name: {{ include "seaweedfs.fullname" . }}-objectstorage-provisioner
+  name: {{ .Values.global.serviceAccountName }}-objectstorage-provisioner
  apiGroup: rbac.authorization.k8s.io
 {{- end }}
@@ -2,7 +2,7 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-objectstorage-provisioner
+  name: {{ template "seaweedfs.name" . }}-objectstorage-provisioner
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -78,16 +78,16 @@ spec:
              {{- else if .Values.s3.ingress.enabled }}
              value: "{{ printf "https://%s" .Values.s3.ingress.host }}"
              {{- else if .Values.s3.enabled }}
-              value: "{{ printf "https://%s-s3.%s.svc" (include "seaweedfs.fullname" .) .Release.Namespace }}"
+              value: "{{ printf "https://%s-s3.%s.svc" (include "seaweedfs.name" .) .Release.Namespace }}"
              {{- else }}
-              value: "{{ printf "https://%s-filer.%s.svc" (include "seaweedfs.fullname" .) .Release.Namespace }}"
+              value: "{{ printf "https://%s-filer.%s.svc" (include "seaweedfs.name" .) .Release.Namespace }}"
              {{- end }}
            {{- with .Values.cosi.region }}
            - name: REGION
              value: "{{ . }}"
            {{- end }}
            - name: SEAWEEDFS_FILER
-              value: "{{ include "seaweedfs.fullname" . }}-filer:{{ .Values.filer.grpcPort }}"
+              value: "{{ template "seaweedfs.name" . }}-filer:{{ .Values.filer.grpcPort }}"
            {{- if .Values.global.enableSecurity }}
            - name: WEED_GRPC_CLIENT_KEY
              value: /usr/local/share/ca-certificates/client/tls.key
@@ -185,28 +185,28 @@ spec:
            {{- if .Values.cosi.existingConfigSecret }}
            secretName: {{ .Values.cosi.existingConfigSecret }}
            {{- else }}
-            secretName: {{ include "seaweedfs.fullname" . }}-s3-secret
+            secretName: seaweedfs-s3-secret
            {{- end }}
        {{- end }}
        {{- if .Values.global.enableSecurity }}
        - name: security-config
          configMap:
-            name: {{ include "seaweedfs.fullname" . }}-security-config
+            name: {{ template "seaweedfs.name" . }}-security-config
        - name: ca-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
+            secretName: {{ template "seaweedfs.name" . }}-ca-cert
        - name: master-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-master-cert
+            secretName: {{ template "seaweedfs.name" . }}-master-cert
        - name: volume-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-volume-cert
+            secretName: {{ template "seaweedfs.name" . }}-volume-cert
        - name: filer-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-filer-cert
+            secretName: {{ template "seaweedfs.name" . }}-filer-cert
        - name: client-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-client-cert
+            secretName: {{ template "seaweedfs.name" . }}-client-cert
        {{- end }}
        {{ tpl .Values.cosi.extraVolumes . | indent 8 | trim }}
      {{- if .Values.cosi.nodeSelector }}
@@ -2,7 +2,7 @@
 {{- $filerEnabled := or .Values.filer.enabled .Values.allInOne.enabled }}
 {{- if and $filerEnabled .Values.filer.ingress.enabled }}
 {{- /* Determine service name based on deployment mode */}}
-{{- $serviceName := ternary (printf "%s-all-in-one" (include "seaweedfs.fullname" .)) (printf "%s-filer" (include "seaweedfs.fullname" .)) .Values.allInOne.enabled }}
+{{- $serviceName := ternary (printf "%s-all-in-one" (include "seaweedfs.name" .)) (printf "%s-filer" (include "seaweedfs.name" .)) .Values.allInOne.enabled }}
 {{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion }}
 apiVersion: networking.k8s.io/v1
 {{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion }}
@@ -12,7 +12,7 @@ apiVersion: extensions/v1beta1
 {{- end }}
 kind: Ingress
 metadata:
-  name: ingress-{{ include "seaweedfs.fullname" . }}-filer
+  name: ingress-{{ template "seaweedfs.name" . }}-filer
  namespace: {{ .Release.Namespace }}
  {{- with .Values.filer.ingress.annotations }}
  annotations:
@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ printf "%s-filer-client" (include "seaweedfs.fullname" .) | trunc 63 | trimSuffix "-" }}
+  name: {{ template "seaweedfs.name" . }}-filer-client
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -36,6 +36,5 @@ spec:
 {{- end }}
  selector:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: filer
 {{- end }}
@@ -4,7 +4,7 @@ kind: Service
 metadata:
  annotations:
    service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
-  name: {{ printf "%s-filer" (include "seaweedfs.fullname" .) | trunc 63 | trimSuffix "-" }}
+  name: {{ template "seaweedfs.name" . }}-filer
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -48,6 +48,5 @@ spec:
  {{- end }}
  selector:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: filer
 {{- end }}
@@ -4,7 +4,7 @@
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-filer
+  name: {{ template "seaweedfs.name" . }}-filer
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -27,7 +27,6 @@ spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-      app.kubernetes.io/instance: {{ .Release.Name }}
      app.kubernetes.io/component: filer
 {{- end }}
 {{- end }}
@@ -2,7 +2,7 @@
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-filer
+  name: {{ template "seaweedfs.name" . }}-filer
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -15,7 +15,7 @@ metadata:
    {{- toYaml .Values.filer.annotations | nindent 4 }}
 {{- end }}
 spec:
-  serviceName: {{ include "seaweedfs.fullname" . }}-filer
+  serviceName: {{ template "seaweedfs.name" . }}-filer
  podManagementPolicy: {{ .Values.filer.podManagementPolicy }}
  replicas: {{ .Values.filer.replicas }}
  {{- if (gt (int .Values.filer.updatePartition) 0) }}
@@ -70,7 +70,7 @@ spec:
        {{ tpl .Values.filer.tolerations . | nindent 8 | trim }}
      {{- end }}
      {{- include "seaweedfs.imagePullSecrets" . | nindent 6 }}
-      serviceAccountName: {{ .Values.filer.serviceAccountName | default (include "seaweedfs.serviceAccountName" .) | quote }} # for deleting statefulset pods after migration
+      serviceAccountName: {{ .Values.filer.serviceAccountName | default .Values.global.serviceAccountName | quote }} # for deleting statefulset pods after migration
      terminationGracePeriodSeconds: 60
      {{- if .Values.filer.priorityClassName }}
      priorityClassName: {{ .Values.filer.priorityClassName | quote }}
@@ -103,17 +103,17 @@ spec:
            - name: WEED_MYSQL_USERNAME
              valueFrom:
                secretKeyRef:
-                  name: {{ include "seaweedfs.fullname" . }}-db-secret
+                  name: secret-seaweedfs-db
                  key: user
                  optional: true
            - name: WEED_MYSQL_PASSWORD
              valueFrom:
                secretKeyRef:
-                  name: {{ include "seaweedfs.fullname" . }}-db-secret
+                  name: secret-seaweedfs-db
                  key: password
                  optional: true
            - name: SEAWEEDFS_FULLNAME
-              value: "{{ include "seaweedfs.fullname" . }}"
+              value: "{{ template "seaweedfs.name" . }}"
            {{- if .Values.filer.extraEnvironmentVars }}
            {{- range $key, $value := .Values.filer.extraEnvironmentVars }}
            - name: {{ $key }}
@@ -359,7 +359,7 @@ spec:
        {{- end }}
        - name: db-schema-config-volume
          configMap:
-            name: {{ default (printf "%s-db-init-config" (include "seaweedfs.fullname" .)) .Values.filer.dbInitConfigName }}
+            name: seaweedfs-db-init-config
        {{- if and .Values.filer.s3.enabled .Values.filer.s3.enableAuth }}
        - name: config-users
          secret:
@@ -367,33 +367,33 @@ spec:
            {{- if .Values.filer.s3.existingConfigSecret }}
            secretName: {{ .Values.filer.s3.existingConfigSecret }}
            {{- else }}
-            secretName: {{ include "seaweedfs.fullname" . }}-s3-secret
+            secretName: seaweedfs-s3-secret
            {{- end }}
        {{- end }}
        {{- if .Values.filer.notificationConfig }}
        - name: notification-config
          configMap:
-            name: {{ include "seaweedfs.fullname" . }}-notification-config
+            name: {{ template "seaweedfs.name" . }}-notification-config
        {{- end }}
        {{- if .Values.global.enableSecurity }}
        - name: security-config
          configMap:
-            name: {{ include "seaweedfs.fullname" . }}-security-config
+            name: {{ template "seaweedfs.name" . }}-security-config
        - name: ca-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
+            secretName: {{ template "seaweedfs.name" . }}-ca-cert
        - name: master-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-master-cert
+            secretName: {{ template "seaweedfs.name" . }}-master-cert
        - name: volume-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-volume-cert
+            secretName: {{ template "seaweedfs.name" . }}-volume-cert
        - name: filer-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-filer-cert
+            secretName: {{ template "seaweedfs.name" . }}-filer-cert
        - name: client-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-client-cert
+            secretName: {{ template "seaweedfs.name" . }}-client-cert
        {{- end }}
        {{ tpl .Values.filer.extraVolumes . | indent 8 | trim }}
      {{- if .Values.filer.nodeSelector }}
@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-master-config
+  name: {{ template "seaweedfs.name" . }}-master-config
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -9,7 +9,7 @@ apiVersion: extensions/v1beta1
 {{- end }}
 kind: Ingress
 metadata:
-  name: ingress-{{ include "seaweedfs.fullname" . }}-master
+  name: ingress-{{ template "seaweedfs.name" . }}-master
  namespace: {{ .Release.Namespace }}
  {{- with .Values.master.ingress.annotations }}
  annotations:
@@ -33,12 +33,12 @@ spec:
            backend:
 {{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion }}
              service:
-                name: {{ include "seaweedfs.fullname" . }}-master
+                name: {{ template "seaweedfs.name" . }}-master
                port:
                  number: {{ .Values.master.port }}
                  #name:
 {{- else }}
-              serviceName: {{ include "seaweedfs.fullname" . }}-master
+              serviceName: {{ template "seaweedfs.name" . }}-master
              servicePort: {{ .Values.master.port }}
 {{- end }}
 {{- if .Values.filer.ingress.host }}
@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ printf "%s-master" (include "seaweedfs.fullname" .) | trunc 63 | trimSuffix "-" }}
+  name: {{ template "seaweedfs.name" . }}-master
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -34,6 +34,5 @@ spec:
  {{- end }}
  selector:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: master
 {{- end }}
@@ -4,7 +4,7 @@
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-master
+  name: {{ template "seaweedfs.name" . }}-master
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -27,7 +27,6 @@ spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-      app.kubernetes.io/instance: {{ .Release.Name }}
      app.kubernetes.io/component: master
 {{- end }}
 {{- end }}
@@ -2,7 +2,7 @@
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-master
+  name: {{ template "seaweedfs.name" . }}-master
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -15,7 +15,7 @@ metadata:
    {{- toYaml .Values.master.annotations | nindent 4 }}
 {{- end }}
 spec:
-  serviceName: {{ include "seaweedfs.fullname" . }}-master
+  serviceName: {{ template "seaweedfs.name" . }}-master
  podManagementPolicy: {{ .Values.master.podManagementPolicy }}
  replicas: {{ .Values.master.replicas }}
  {{- if (gt (int .Values.master.updatePartition) 0) }}
@@ -70,7 +70,7 @@ spec:
      {{- end }}
      enableServiceLinks: false
      {{- if .Values.global.createClusterRole }}
-      serviceAccountName: {{ .Values.master.serviceAccountName | default (include "seaweedfs.serviceAccountName" .) | quote }} # for deleting statefulset pods after migration
+      serviceAccountName: {{ .Values.master.serviceAccountName | default .Values.global.serviceAccountName | quote }} # for deleting statefulset pods after migration
      {{- end }}
      {{- if .Values.master.initContainers }}
      initContainers:
@@ -97,7 +97,7 @@ spec:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: SEAWEEDFS_FULLNAME
-              value: "{{ include "seaweedfs.fullname" . }}"
+              value: "{{ template "seaweedfs.name" . }}"
            {{- if .Values.master.extraEnvironmentVars }}
            {{- range $key, $value := .Values.master.extraEnvironmentVars }}
            - name: {{ $key }}
@@ -297,26 +297,26 @@ spec:
        {{- end }}
        - name: master-config
          configMap:
-            name: {{ include "seaweedfs.fullname" . }}-master-config
+            name: {{ template "seaweedfs.name" . }}-master-config
        {{- if .Values.global.enableSecurity }}
        - name: security-config
          configMap:
-            name: {{ include "seaweedfs.fullname" . }}-security-config
+            name: {{ template "seaweedfs.name" . }}-security-config
        - name: ca-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
+            secretName: {{ template "seaweedfs.name" . }}-ca-cert
        - name: master-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-master-cert
+            secretName: {{ template "seaweedfs.name" . }}-master-cert
        - name: volume-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-volume-cert
+            secretName: {{ template "seaweedfs.name" . }}-volume-cert
        - name: filer-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-filer-cert
+            secretName: {{ template "seaweedfs.name" . }}-filer-cert
        - name: client-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-client-cert
+            secretName: {{ template "seaweedfs.name" . }}-client-cert
        {{- end }}
        {{ tpl .Values.master.extraVolumes . | indent 8 | trim }}
      {{- if .Values.master.nodeSelector }}
@@ -2,7 +2,7 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-s3
+  name: {{ template "seaweedfs.name" . }}-s3
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -89,7 +89,7 @@ spec:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: SEAWEEDFS_FULLNAME
-              value: "{{ include "seaweedfs.fullname" . }}"
+              value: "{{ template "seaweedfs.name" . }}"
            {{- if .Values.s3.extraEnvironmentVars }}
            {{- range $key, $value := .Values.s3.extraEnvironmentVars }}
            - name: {{ $key }}
@@ -149,7 +149,7 @@ spec:
              {{- if .Values.s3.auditLogConfig }}
              -auditLogConfig=/etc/sw/s3_auditLogConfig.json \
              {{- end }}
-              -filer={{ include "seaweedfs.fullname" . }}-filer-client.{{ .Release.Namespace }}:{{ .Values.filer.port }} \
+              -filer={{ template "seaweedfs.name" . }}-filer-client.{{ .Release.Namespace }}:{{ .Values.filer.port }} \
              {{- range .Values.s3.extraArgs }}
              {{ . }} \
              {{- end }}
@@ -238,7 +238,7 @@ spec:
            {{- if .Values.s3.existingConfigSecret }}
            secretName: {{ .Values.s3.existingConfigSecret }}
            {{- else }}
-            secretName: {{ include "seaweedfs.fullname" . }}-s3-secret
+            secretName: seaweedfs-s3-secret
            {{- end }}
        {{- end }}
        {{- if eq .Values.s3.logs.type "hostPath" }}
@@ -254,22 +254,22 @@ spec:
        {{- if .Values.global.enableSecurity }}
        - name: security-config
          configMap:
-            name: {{ include "seaweedfs.fullname" . }}-security-config
+            name: {{ template "seaweedfs.name" . }}-security-config
        - name: ca-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
+            secretName: {{ template "seaweedfs.name" . }}-ca-cert
        - name: master-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-master-cert
+            secretName: {{ template "seaweedfs.name" . }}-master-cert
        - name: volume-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-volume-cert
+            secretName: {{ template "seaweedfs.name" . }}-volume-cert
        - name: filer-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-filer-cert
+            secretName: {{ template "seaweedfs.name" . }}-filer-cert
        - name: client-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-client-cert
+            secretName: {{ template "seaweedfs.name" . }}-client-cert
        {{- end }}
        {{ tpl .Values.s3.extraVolumes . | indent 8 | trim }}
      {{- if .Values.s3.nodeSelector }}
@@ -2,7 +2,7 @@
 {{- $s3Enabled := or .Values.s3.enabled (and .Values.filer.s3.enabled (not .Values.allInOne.enabled)) (and .Values.allInOne.enabled .Values.allInOne.s3.enabled) }}
 {{- if and $s3Enabled .Values.s3.ingress.enabled }}
 {{- /* Determine service name based on deployment mode */}}
-{{- $serviceName := ternary (printf "%s-all-in-one" (include "seaweedfs.fullname" .)) (printf "%s-s3" (include "seaweedfs.fullname" .)) .Values.allInOne.enabled }}
+{{- $serviceName := ternary (printf "%s-all-in-one" (include "seaweedfs.name" .)) (printf "%s-s3" (include "seaweedfs.name" .)) .Values.allInOne.enabled }}
 {{- $s3Port := .Values.allInOne.s3.port | default .Values.s3.port }}
 {{- /* Build hosts list - support both legacy .host (string) and new .hosts (array) for backwards compatibility */}}
 {{- $hosts := list }}
@@ -20,7 +20,7 @@ apiVersion: extensions/v1beta1
 {{- end }}
 kind: Ingress
 metadata:
-  name: ingress-{{ include "seaweedfs.fullname" . }}-s3
+  name: ingress-{{ template "seaweedfs.name" . }}-s3
  namespace: {{ .Release.Namespace }}
  {{- with .Values.s3.ingress.annotations }}
  annotations:
@@ -1,19 +1,13 @@
 {{- if or (and (or .Values.s3.enabled .Values.allInOne.enabled) .Values.s3.enableAuth (not .Values.s3.existingConfigSecret)) (and .Values.filer.s3.enabled .Values.filer.s3.enableAuth (not .Values.filer.s3.existingConfigSecret)) }}
-{{- $secretName := printf "%s-s3-secret" (include "seaweedfs.fullname" .) }}
-{{- $existingSecret := lookup "v1" "Secret" .Release.Namespace (default $secretName .Values.s3.legacySecretName) }}
-{{- $reuse := false }}
-{{- if and .Values.s3.reuseLegacySecret $existingSecret }}
-{{- $reuse = true }}
-{{- end }}
-{{- $access_key_admin := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "admin_access_key_id" "length" 20 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
-{{- $secret_key_admin := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "admin_secret_access_key" "length" 40 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
-{{- $access_key_read := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "read_access_key_id" "length" 20 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
-{{- $secret_key_read := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "read_secret_access_key" "length" 40 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
+{{- $access_key_admin := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" "seaweedfs-s3-secret" "key" "admin_access_key_id" "length" 20) -}}
+{{- $secret_key_admin := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" "seaweedfs-s3-secret" "key" "admin_secret_access_key" "length" 40) -}}
+{{- $access_key_read := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" "seaweedfs-s3-secret" "key" "read_access_key_id" "length" 20) -}}
+{{- $secret_key_read := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" "seaweedfs-s3-secret" "key" "read_secret_access_key" "length" 40) -}}
 apiVersion: v1
 kind: Secret
 type: Opaque
 metadata:
-  name: {{ $secretName }}
+  name: seaweedfs-s3-secret
  namespace: {{ .Release.Namespace }}
  annotations:
    "helm.sh/resource-policy": keep
@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ printf "%s-s3" (include "seaweedfs.fullname" .) | trunc 63 | trimSuffix "-" }}
+  name: {{ template "seaweedfs.name" . }}-s3
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -34,6 +34,5 @@ spec:
 {{- end }}
  selector:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: {{ if .Values.s3.enabled }}s3{{ else }}filer{{ end }}
 {{- end }}
@@ -4,7 +4,7 @@
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-s3
+  name: {{ template "seaweedfs.name" . }}-s3
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -27,7 +27,6 @@ spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-      app.kubernetes.io/instance: {{ .Release.Name }}
      app.kubernetes.io/component: s3
 {{- end }}
 {{- end }}
@@ -2,7 +2,7 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-sftp
+  name: {{ template "seaweedfs.name" . }}-sftp
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -89,7 +89,7 @@ spec:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: SEAWEEDFS_FULLNAME
-              value: "{{ include "seaweedfs.fullname" . }}"
+              value: "{{ template "seaweedfs.name" . }}"
            {{- if .Values.sftp.extraEnvironmentVars }}
            {{- range $key, $value := .Values.sftp.extraEnvironmentVars }}
            - name: {{ $key }}
@@ -171,7 +171,7 @@ spec:
              -key.file=/usr/local/share/ca-certificates/client/tls.key \
              {{- end }}
              -userStoreFile=/etc/sw/seaweedfs_sftp_config \
-              -filer={{ include "seaweedfs.fullname" . }}-filer-client.{{ .Release.Namespace }}:{{ .Values.filer.port }}
+              -filer={{ template "seaweedfs.name" . }}-filer-client.{{ .Release.Namespace }}:{{ .Values.filer.port }}
          volumeMounts:
            {{- if or (eq .Values.sftp.logs.type "hostPath") (eq .Values.sftp.logs.type "emptyDir") }}
            - name: logs
@@ -252,7 +252,7 @@ spec:
            {{- if .Values.sftp.existingConfigSecret }}
            secretName: {{ .Values.sftp.existingConfigSecret }}
            {{- else }}
-            secretName: {{ include "seaweedfs.fullname" . }}-sftp-secret
+            secretName: seaweedfs-sftp-secret
            {{- end }}
        {{- end }}
        - name: config-ssh
@@ -261,7 +261,7 @@ spec:
            {{- if .Values.sftp.existingSshConfigSecret }}
            secretName: {{ .Values.sftp.existingSshConfigSecret }}
            {{- else }}
-            secretName: {{ include "seaweedfs.fullname" . }}-sftp-ssh-secret
+            secretName: seaweedfs-sftp-ssh-secret
            {{- end }}
        {{- if eq .Values.sftp.logs.type "hostPath" }}
        - name: logs
@@ -276,22 +276,22 @@ spec:
        {{- if .Values.global.enableSecurity }}
        - name: security-config
          configMap:
-            name: {{ include "seaweedfs.fullname" . }}-security-config
+            name: {{ template "seaweedfs.name" . }}-security-config
        - name: ca-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
+            secretName: {{ template "seaweedfs.name" . }}-ca-cert
        - name: master-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-master-cert
+            secretName: {{ template "seaweedfs.name" . }}-master-cert
        - name: volume-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-volume-cert
+            secretName: {{ template "seaweedfs.name" . }}-volume-cert
        - name: filer-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-filer-cert
+            secretName: {{ template "seaweedfs.name" . }}-filer-cert
        - name: client-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-client-cert
+            secretName: {{ template "seaweedfs.name" . }}-client-cert
        {{- end }}
        {{ tpl .Values.sftp.extraVolumes . | indent 8 | trim }}
      {{- if .Values.sftp.nodeSelector }}
@@ -1,13 +1,12 @@
 {{- if or .Values.sftp.enabled .Values.allInOne.enabled }}
-{{- $secretName := printf "%s-sftp-secret" (include "seaweedfs.fullname" .) }}
-{{- $admin_pwd := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "admin_password" 20) -}}
-{{- $read_user_pwd := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "readonly_password" 20) -}}
-{{- $public_user_pwd := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "public_user_password" 20) -}}
+{{- $admin_pwd := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" "seaweedfs-sftp-secret" "key" "admin_password" 20) -}}
+{{- $read_user_pwd := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" "seaweedfs-sftp-secret" "key" "readonly_password" 20) -}}
+{{- $public_user_pwd := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" "seaweedfs-sftp-secret" "key" "public_user_password" 20) -}}
 apiVersion: v1
 kind: Secret
 type: Opaque
 metadata:
-  name: {{ $secretName }}
+  name: seaweedfs-sftp-secret
  namespace: {{ .Release.Namespace }}
  annotations:
    "helm.sh/resource-policy": keep
@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ printf "%s-sftp" (include "seaweedfs.fullname" .) | trunc 63 | trimSuffix "-" }}
+  name: {{ template "seaweedfs.name" . }}-sftp
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -28,6 +28,5 @@ spec:
 {{- end }}
  selector:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: sftp
 {{- end }}
@@ -4,7 +4,7 @@
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-sftp
+  name: {{ template "seaweedfs.name" . }}-sftp
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -27,7 +27,6 @@ spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-      app.kubernetes.io/instance: {{ .Release.Name }}
      app.kubernetes.io/component: sftp
 {{- end }}
 {{- end }}
@@ -244,7 +244,7 @@ or generate a new random password if it doesn't exist.
 {{- $key := $params.key -}}
 {{- $length := default 16 $params.length -}}

-{{- $existingSecret := default (lookup "v1" "Secret" $namespace $secretName) $params.existingSecret -}}
+{{- $existingSecret := lookup "v1" "Secret" $namespace $secretName -}}
 {{- if and $existingSecret (index $existingSecret.data $key) -}}
  {{- index $existingSecret.data $key | b64dec -}}
 {{- else -}}
@@ -261,7 +261,7 @@ If allInOne is enabled, point to the all-in-one service; otherwise, point to the
 {{- if .Values.allInOne.enabled -}}
 {{-   $serviceNameSuffix = "-all-in-one" -}}
 {{- end -}}
-{{- printf "%s%s.%s:%d" (include "seaweedfs.fullname" .) $serviceNameSuffix .Release.Namespace (int .Values.master.port) -}}
+{{- printf "%s%s.%s:%d" (include "seaweedfs.name" .) $serviceNameSuffix .Release.Namespace (int .Values.master.port) -}}
 {{- end -}}

 {{/*
@@ -273,7 +273,7 @@ If allInOne is enabled, point to the all-in-one service; otherwise, point to the
 {{- if .Values.allInOne.enabled -}}
 {{-   $serviceNameSuffix = "-all-in-one" -}}
 {{- end -}}
-{{- printf "%s%s.%s:%d" (include "seaweedfs.fullname" .) $serviceNameSuffix .Release.Namespace (int .Values.filer.port) -}}
+{{- printf "%s%s.%s:%d" (include "seaweedfs.name" .) $serviceNameSuffix .Release.Namespace (int .Values.filer.port) -}}
 {{- end -}}

 {{/*
@@ -282,7 +282,7 @@ Usage: {{ include "seaweedfs.masterServers" . }}
 Output example: ${SEAWEEDFS_FULLNAME}-master-0.${SEAWEEDFS_FULLNAME}-master.namespace:9333,${SEAWEEDFS_FULLNAME}-master-1...
 */}}
 {{- define "seaweedfs.masterServers" -}}
-{{- $fullname := include "seaweedfs.fullname" . -}}
+{{- $fullname := include "seaweedfs.name" . -}}
 {{- range $index := until (.Values.master.replicas | int) -}}
 {{- if $index }},{{ end -}}
 ${SEAWEEDFS_FULLNAME}-master-{{ $index }}.${SEAWEEDFS_FULLNAME}-master.{{ $.Release.Namespace }}:{{ $.Values.master.port }}
@@ -300,10 +300,3 @@ Usage: {{ include "seaweedfs.masterServerArg" . }}
 {{- include "seaweedfs.masterServers" . -}}
 {{- end -}}
 {{- end -}}
-
-{{/*
-Create the name of the service account to use
-*/}}
-{{- define "seaweedfs.serviceAccountName" -}}
-{{- .Values.global.serviceAccountName | default "seaweedfs" -}}
-{{- end -}}
@@ -4,7 +4,7 @@
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-rw-cr
+  name: {{ .Values.global.serviceAccountName }}-rw-cr
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
@@ -18,7 +18,7 @@ rules:
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-rw-crb
+  name: system:serviceaccount:{{ .Values.global.serviceAccountName }}:default
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
@@ -26,10 +26,10 @@ metadata:
    app.kubernetes.io/instance: {{ .Release.Name }}
 subjects:
  - kind: ServiceAccount
-    name: {{ include "seaweedfs.serviceAccountName" . }}
+    name: {{ .Values.global.serviceAccountName }}
    namespace: {{ .Release.Namespace }}
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
-  name: {{ include "seaweedfs.fullname" . }}-rw-cr
+  name: {{ .Values.global.serviceAccountName }}-rw-cr
 {{- end }}
@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-notification-config
+  name: {{ template "seaweedfs.name" . }}-notification-config
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -74,7 +74,7 @@ spec:
              fieldRef:
                fieldPath: metadata.namespace
          - name: SEAWEEDFS_FULLNAME
-            value: "{{ include "seaweedfs.fullname" . }}"
+            value: "{{ template "seaweedfs.name" . }}"
        command:
          - "/bin/sh"
          - "-ec"
@@ -145,7 +145,7 @@ spec:
            {{- if $existingConfigSecret }}
            secretName: {{ $existingConfigSecret }}
            {{- else }}
-            secretName: {{ include "seaweedfs.fullname" . }}-s3-secret
+            secretName: {{ template "seaweedfs.name" . }}-s3-secret
            {{- end }}
    {{- end }}
 {{- end }}
@@ -7,7 +7,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: {{ include "seaweedfs.fullname" $ }}-{{ printf "%s" $dashboardName | lower | replace "_" "-" }}
+  name: {{ printf "%s" $dashboardName | lower | replace "_" "-" }}
  namespace: {{ $.Release.Namespace }}
  labels:
    grafana_dashboard: "1"
@@ -3,7 +3,7 @@ apiVersion: v1
 kind: Secret
 type: Opaque
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-db-secret
+  name: secret-seaweedfs-db
  namespace: {{ .Release.Namespace }}
  annotations:
    "helm.sh/resource-policy": keep
@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-security-config
+  name: {{ template "seaweedfs.name" . }}-security-config
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -10,13 +10,7 @@ metadata:
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
 data:
-  {{- $fullname := include "seaweedfs.fullname" . }}
-  {{- $securityConfigName := printf "%s-security-config" $fullname }}
-  {{- $existing := lookup "v1" "ConfigMap" .Release.Namespace $securityConfigName }}
-  {{- if not $existing }}
-  {{- $legacyName := printf "%s-%s" (include "seaweedfs.name" .) "security-config" }}
-  {{- $existing = lookup "v1" "ConfigMap" .Release.Namespace $legacyName }}
-  {{- end }}
+  {{- $existing := (lookup "v1" "ConfigMap" .Release.Namespace (printf "%s-security-config" (include "seaweedfs.name" .))) }}
  {{- $securityConfig := fromToml (dig "data" "security.toml" "" $existing) }}
  security.toml: |-
    # this file is read by master, volume server, and filer
@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ include "seaweedfs.serviceAccountName" . }}
+  name: {{ .Values.global.serviceAccountName }}
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -8,7 +8,7 @@ apiVersion: extensions/v1beta1
 {{- end }}
 kind: Ingress
 metadata:
-  name: ingress-{{ include "seaweedfs.fullname" . }}-volume
+  name: ingress-{{ template "seaweedfs.name" . }}-volume
  namespace: {{ .Release.Namespace }}
  annotations:
  {{- if and (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) .Values.volume.ingress.className }}
@@ -42,11 +42,11 @@ spec:
        backend:
 {{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion }}
          service:
-            name: {{ include "seaweedfs.fullname" . }}-volume
+            name: {{ template "seaweedfs.name" . }}-volume
            port:
              number: {{ .Values.volume.port }}
 {{- else }}
-          serviceName: {{ include "seaweedfs.fullname" . }}-volume
+          serviceName: {{ template "seaweedfs.name" . }}-volume
          servicePort: {{ .Values.volume.port }}
 {{- end }}
 {{- end }}
@@ -1,4 +1,4 @@
-{{- $seaweedfsName := include "seaweedfs.fullname" $ }}
+{{- $seaweedfsName := include "seaweedfs.name" $ }}
 {{- $volumes := deepCopy .Values.volumes | mergeOverwrite (dict "" .Values.volume)  }}


@@ -8,7 +8,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ printf "%s-%s" (include "seaweedfs.fullname" $) $volumeName | trunc 63 | trimSuffix "-" }}
+  name: {{ template "seaweedfs.name" $ }}-{{ $volumeName }}
  namespace: {{ $.Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" $ }}
@@ -39,7 +39,6 @@ spec:
 {{- end }}
  selector:
    app.kubernetes.io/name: {{ template "seaweedfs.name" $ }}
-    app.kubernetes.io/instance: {{ $.Release.Name }}
    app.kubernetes.io/component: {{ $volumeName }}
 {{- end }}
 {{- end }}
@@ -10,7 +10,7 @@
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
-  name: {{ include "seaweedfs.fullname" $ }}-{{ $volumeName }}
+  name: {{ template "seaweedfs.name" $ }}-{{ $volumeName }}
  namespace: {{ $.Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" $ }}
@@ -33,7 +33,6 @@ spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: {{ template "seaweedfs.name" $ }}
-      app.kubernetes.io/instance: {{ $.Release.Name }}
      app.kubernetes.io/component: {{ $volumeName }}
 {{- end }}
 {{- end }}
@@ -8,7 +8,7 @@
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
-  name: {{ include "seaweedfs.fullname" $ }}-{{ $volumeName }}
+  name: {{ template "seaweedfs.name" $ }}-{{ $volumeName }}
  namespace: {{ $.Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" $ }}
@@ -21,7 +21,7 @@ metadata:
    {{- toYaml $volume.annotations | nindent 4 }}
 {{- end }}
 spec:
-  serviceName: {{ include "seaweedfs.fullname" $ }}-{{ $volumeName }}
+  serviceName: {{ template "seaweedfs.name" $ }}-{{ $volumeName }}
  replicas: {{ $volume.replicas }}
  podManagementPolicy: {{ $volume.podManagementPolicy }}
  selector:
@@ -70,7 +70,7 @@ spec:
      {{- end }}
      enableServiceLinks: false
      {{- if $.Values.global.createClusterRole }}
-      serviceAccountName: {{ $volume.serviceAccountName | default (include "seaweedfs.serviceAccountName" $) | quote }} # for deleting statefulset pods after migration
+      serviceAccountName: {{ $volume.serviceAccountName | default $.Values.global.serviceAccountName | quote }} # for deleting statefulset pods after migration
      {{- end }}
      {{- $initContainers_exists := include "volume.initContainers_exists" $ -}}
      {{- if $initContainers_exists }}
@@ -117,7 +117,7 @@ spec:
                fieldRef:
                  fieldPath: status.hostIP
            - name: SEAWEEDFS_FULLNAME
-              value: "{{ include "seaweedfs.fullname" $ }}"
+              value: "{{ template "seaweedfs.name" $ }}"
            {{- if $volume.extraEnvironmentVars }}
            {{- range $key, $value := $volume.extraEnvironmentVars }}
            - name: {{ $key }}
@@ -343,22 +343,22 @@ spec:
     {{- if $.Values.global.enableSecurity }}
        - name: security-config
          configMap:
-            name: {{ include "seaweedfs.fullname" $ }}-security-config
+            name: {{ template "seaweedfs.name" $ }}-security-config
        - name: ca-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" $ }}-ca-cert
+            secretName: {{ template "seaweedfs.name" $ }}-ca-cert
        - name: master-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" $ }}-master-cert
+            secretName: {{ template "seaweedfs.name" $ }}-master-cert
        - name: volume-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" $ }}-volume-cert
+            secretName: {{ template "seaweedfs.name" $ }}-volume-cert
        - name: filer-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" $ }}-filer-cert
+            secretName: {{ template "seaweedfs.name" $ }}-filer-cert
        - name: client-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" $ }}-client-cert
+            secretName: {{ template "seaweedfs.name" $ }}-client-cert
      {{- end }}
      {{- if $volume.extraVolumes }}
        {{ tpl $volume.extraVolumes $ | indent 8 | trim }}
@@ -5,7 +5,7 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-worker
+  name: {{ template "seaweedfs.name" . }}-worker
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -92,7 +92,7 @@ spec:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: SEAWEEDFS_FULLNAME
-              value: "{{ include "seaweedfs.fullname" . }}"
+              value: "{{ template "seaweedfs.name" . }}"
            {{- if .Values.worker.extraEnvironmentVars }}
            {{- range $key, $value := .Values.worker.extraEnvironmentVars }}
            - name: {{ $key }}
@@ -260,25 +260,25 @@ spec:
        {{- if .Values.global.enableSecurity }}
        - name: security-config
          configMap:
-            name: {{ include "seaweedfs.fullname" . }}-security-config
+            name: {{ template "seaweedfs.name" . }}-security-config
        - name: ca-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
+            secretName: {{ template "seaweedfs.name" . }}-ca-cert
        - name: master-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-master-cert
+            secretName: {{ template "seaweedfs.name" . }}-master-cert
        - name: volume-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-volume-cert
+            secretName: {{ template "seaweedfs.name" . }}-volume-cert
        - name: filer-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-filer-cert
+            secretName: {{ template "seaweedfs.name" . }}-filer-cert
        - name: client-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-client-cert
+            secretName: {{ template "seaweedfs.name" . }}-client-cert
        - name: worker-cert
          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-worker-cert
+            secretName: {{ template "seaweedfs.name" . }}-worker-cert
        {{- end }}
        {{ tpl .Values.worker.extraVolumes . | indent 8 | trim }}
      {{- if .Values.worker.nodeSelector }}
@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ printf "%s-worker" (include "seaweedfs.fullname" .) | trunc 63 | trimSuffix "-" }}
+  name: {{ template "seaweedfs.name" . }}-worker
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -4,7 +4,7 @@
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
-  name: {{ include "seaweedfs.fullname" . }}-worker
+  name: {{ template "seaweedfs.name" . }}-worker
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -27,7 +27,6 @@ spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-      app.kubernetes.io/instance: {{ .Release.Name }}
      app.kubernetes.io/component: worker
 {{- end }}
 {{- end }}
@@ -68,7 +68,7 @@
    <dependency>
      <groupId>org.assertj</groupId>
      <artifactId>assertj-core</artifactId>
-      <version>3.27.7</version>
+      <version>3.24.2</version>
      <scope>test</scope>
    </dependency>
  </dependencies>
@@ -37,6 +37,274 @@
      ]
    }
  ],
+  "iam": {
+    "enabled": true,
+    "sts": {
+      "tokenDuration": "15m",
+      "issuer": "seaweedfs-sts",
+      "signingKey": "dGVzdC1zaWduaW5nLWtleS0zMi1jaGFyYWN0ZXJzLWxvbmc="
+    },
+    "policy": {
+      "defaultEffect": "Deny"
+    },
+    "providers": {
+      "oidc": {
+        "test-oidc": {
+          "issuer": "http://localhost:8080/.well-known/openid_configuration",
+          "clientId": "test-client-id",
+          "jwksUri": "http://localhost:8080/jwks",
+          "userInfoUri": "http://localhost:8080/userinfo",
+          "roleMapping": {
+            "rules": [
+              {
+                "claim": "groups",
+                "claimValue": "admins",
+                "roleName": "S3AdminRole"
+              },
+              {
+                "claim": "groups",
+                "claimValue": "users",
+                "roleName": "S3ReadOnlyRole"
+              },
+              {
+                "claim": "groups",
+                "claimValue": "writers",
+                "roleName": "S3WriteOnlyRole"
+              }
+            ]
+          },
+          "claimsMapping": {
+            "email": "email",
+            "displayName": "name",
+            "groups": "groups"
+          }
+        }
+      },
+      "ldap": {
+        "test-ldap": {
+          "server": "ldap://localhost:389",
+          "baseDN": "dc=example,dc=com",
+          "bindDN": "cn=admin,dc=example,dc=com",
+          "bindPassword": "admin-password",
+          "userFilter": "(uid=%s)",
+          "groupFilter": "(memberUid=%s)",
+          "attributes": {
+            "email": "mail",
+            "displayName": "cn",
+            "groups": "memberOf"
+          },
+          "roleMapping": {
+            "rules": [
+              {
+                "claim": "groups",
+                "claimValue": "cn=admins,ou=groups,dc=example,dc=com",
+                "roleName": "S3AdminRole"
+              },
+              {
+                "claim": "groups",
+                "claimValue": "cn=users,ou=groups,dc=example,dc=com",
+                "roleName": "S3ReadOnlyRole"
+              }
+            ]
+          }
+        }
+      }
+    },
+    "policyStore": {}
+  },
+  "roles": {
+    "S3AdminRole": {
+      "trustPolicy": {
+        "Version": "2012-10-17",
+        "Statement": [
+          {
+            "Effect": "Allow",
+            "Principal": {
+              "Federated": [
+                "test-oidc",
+                "test-ldap"
+              ]
+            },
+            "Action": "sts:AssumeRoleWithWebIdentity"
+          }
+        ]
+      },
+      "attachedPolicies": [
+        "S3AdminPolicy"
+      ],
+      "description": "Full administrative access to S3 resources"
+    },
+    "S3ReadOnlyRole": {
+      "trustPolicy": {
+        "Version": "2012-10-17",
+        "Statement": [
+          {
+            "Effect": "Allow",
+            "Principal": {
+              "Federated": [
+                "test-oidc",
+                "test-ldap"
+              ]
+            },
+            "Action": "sts:AssumeRoleWithWebIdentity"
+          }
+        ]
+      },
+      "attachedPolicies": [
+        "S3ReadOnlyPolicy"
+      ],
+      "description": "Read-only access to S3 resources"
+    },
+    "S3WriteOnlyRole": {
+      "trustPolicy": {
+        "Version": "2012-10-17",
+        "Statement": [
+          {
+            "Effect": "Allow",
+            "Principal": {
+              "Federated": [
+                "test-oidc",
+                "test-ldap"
+              ]
+            },
+            "Action": "sts:AssumeRoleWithWebIdentity"
+          }
+        ]
+      },
+      "attachedPolicies": [
+        "S3WriteOnlyPolicy"
+      ],
+      "description": "Write-only access to S3 resources"
+    }
+  },
+  "policies": {
+    "S3AdminPolicy": {
+      "Version": "2012-10-17",
+      "Statement": [
+        {
+          "Effect": "Allow",
+          "Action": [
+            "s3:*",
+            "iam:*"
+          ],
+          "Resource": [
+            "arn:aws:s3:::*",
+            "arn:aws:s3:::*/*",
+            "arn:aws:iam:::*"
+          ]
+        }
+      ]
+    },
+    "S3ReadOnlyPolicy": {
+      "Version": "2012-10-17",
+      "Statement": [
+        {
+          "Effect": "Allow",
+          "Action": [
+            "s3:GetObject",
+            "s3:GetObjectVersion",
+            "s3:ListBucket",
+            "s3:ListBucketVersions",
+            "s3:GetBucketLocation",
+            "s3:GetBucketVersioning"
+          ],
+          "Resource": [
+            "arn:aws:s3:::*",
+            "arn:aws:s3:::*/*"
+          ]
+        }
+      ]
+    },
+    "S3WriteOnlyPolicy": {
+      "Version": "2012-10-17",
+      "Statement": [
+        {
+          "Effect": "Allow",
+          "Action": [
+            "s3:PutObject",
+            "s3:PutObjectAcl",
+            "s3:DeleteObject",
+            "s3:DeleteObjectVersion",
+            "s3:InitiateMultipartUpload",
+            "s3:UploadPart",
+            "s3:CompleteMultipartUpload",
+            "s3:AbortMultipartUpload",
+            "s3:ListMultipartUploadParts"
+          ],
+          "Resource": [
+            "arn:aws:s3:::*/*"
+          ]
+        }
+      ]
+    },
+    "S3BucketManagementPolicy": {
+      "Version": "2012-10-17",
+      "Statement": [
+        {
+          "Effect": "Allow",
+          "Action": [
+            "s3:CreateBucket",
+            "s3:DeleteBucket",
+            "s3:GetBucketPolicy",
+            "s3:PutBucketPolicy",
+            "s3:DeleteBucketPolicy",
+            "s3:GetBucketVersioning",
+            "s3:PutBucketVersioning"
+          ],
+          "Resource": [
+            "arn:aws:s3:::*"
+          ]
+        }
+      ]
+    },
+    "S3IPRestrictedPolicy": {
+      "Version": "2012-10-17",
+      "Statement": [
+        {
+          "Effect": "Allow",
+          "Action": [
+            "s3:*"
+          ],
+          "Resource": [
+            "arn:aws:s3:::*",
+            "arn:aws:s3:::*/*"
+          ],
+          "Condition": {
+            "IpAddress": {
+              "aws:SourceIp": [
+                "192.168.1.0/24",
+                "10.0.0.0/8"
+              ]
+            }
+          }
+        }
+      ]
+    },
+    "S3TimeBasedPolicy": {
+      "Version": "2012-10-17",
+      "Statement": [
+        {
+          "Effect": "Allow",
+          "Action": [
+            "s3:GetObject",
+            "s3:ListBucket"
+          ],
+          "Resource": [
+            "arn:aws:s3:::*",
+            "arn:aws:s3:::*/*"
+          ],
+          "Condition": {
+            "DateGreaterThan": {
+              "aws:CurrentTime": "2023-01-01T00:00:00Z"
+            },
+            "DateLessThan": {
+              "aws:CurrentTime": "2025-12-31T23:59:59Z"
+            }
+          }
+        }
+      ]
+    }
+  },
  "bucketPolicyExamples": {
    "PublicReadPolicy": {
      "Version": "2012-10-17",
@@ -56,33 +56,72 @@ func NewCredentialStorePolicyManager(credentialManager *credential.CredentialMan
 }

 // GetPolicies retrieves all IAM policies via credential store
-// Deprecated: This method delegates to the credential manager and will be moved/removed in a future release.
 func (cspm *CredentialStorePolicyManager) GetPolicies(ctx context.Context) (map[string]policy_engine.PolicyDocument, error) {
-	return cspm.credentialManager.GetPolicies(ctx)
+	// Get policies from credential store
+	// We'll use the credential store to access the filer indirectly
+	// Since policies are stored separately, we need to access the underlying store
+	store := cspm.credentialManager.GetStore()
+	glog.V(1).Infof("Getting policies from credential store: %T", store)
+
+	// Check if the store supports policy management
+	if policyStore, ok := store.(credential.PolicyManager); ok {
+		glog.V(1).Infof("Store supports policy management, calling GetPolicies")
+		policies, err := policyStore.GetPolicies(ctx)
+		if err != nil {
+			glog.Errorf("Error getting policies from store: %v", err)
+			return nil, err
+		}
+		glog.V(1).Infof("Got %d policies from store", len(policies))
+		return policies, nil
+	} else {
+		// Fallback: use empty policies for stores that don't support policies
+		glog.V(1).Infof("Credential store doesn't support policy management, returning empty policies")
+		return make(map[string]policy_engine.PolicyDocument), nil
+	}
 }

 // CreatePolicy creates a new IAM policy via credential store
-// Deprecated: This method delegates to the credential manager and will be moved/removed in a future release.
 func (cspm *CredentialStorePolicyManager) CreatePolicy(ctx context.Context, name string, document policy_engine.PolicyDocument) error {
-	return cspm.credentialManager.CreatePolicy(ctx, name, document)
+	store := cspm.credentialManager.GetStore()
+
+	if policyStore, ok := store.(credential.PolicyManager); ok {
+		return policyStore.CreatePolicy(ctx, name, document)
+	}
+
+	return fmt.Errorf("credential store doesn't support policy creation")
 }

 // UpdatePolicy updates an existing IAM policy via credential store
-// Deprecated: This method delegates to the credential manager and will be moved/removed in a future release.
 func (cspm *CredentialStorePolicyManager) UpdatePolicy(ctx context.Context, name string, document policy_engine.PolicyDocument) error {
-	return cspm.credentialManager.UpdatePolicy(ctx, name, document)
+	store := cspm.credentialManager.GetStore()
+
+	if policyStore, ok := store.(credential.PolicyManager); ok {
+		return policyStore.UpdatePolicy(ctx, name, document)
+	}
+
+	return fmt.Errorf("credential store doesn't support policy updates")
 }

 // DeletePolicy deletes an IAM policy via credential store
-// Deprecated: This method delegates to the credential manager and will be moved/removed in a future release.
 func (cspm *CredentialStorePolicyManager) DeletePolicy(ctx context.Context, name string) error {
-	return cspm.credentialManager.DeletePolicy(ctx, name)
+	store := cspm.credentialManager.GetStore()
+
+	if policyStore, ok := store.(credential.PolicyManager); ok {
+		return policyStore.DeletePolicy(ctx, name)
+	}
+
+	return fmt.Errorf("credential store doesn't support policy deletion")
 }

 // GetPolicy retrieves a specific IAM policy via credential store
-// Deprecated: This method delegates to the credential manager and will be moved/removed in a future release.
 func (cspm *CredentialStorePolicyManager) GetPolicy(ctx context.Context, name string) (*policy_engine.PolicyDocument, error) {
-	return cspm.credentialManager.GetPolicy(ctx, name)
+	store := cspm.credentialManager.GetStore()
+
+	if policyStore, ok := store.(credential.PolicyManager); ok {
+		return policyStore.GetPolicy(ctx, name)
+	}
+
+	return nil, fmt.Errorf("credential store doesn't support policy retrieval")
 }

 // AdminServer policy management methods using credential.PolicyManager
@@ -70,6 +70,11 @@ func (s *AdminServer) GetServiceAccounts(ctx context.Context, parentUser string)
 		accounts = append(accounts, account)
 	}

+	// For backward compatibility: also list legacy service accounts stored as identities?
+	// The user explicitly wanted to fix the storage location, implies migration or switch.
+	// Mixing both might be confusing but safer.
+	// However, user feedback implies strict "service accounts should be separate". I will rely only on new store.
+
 	return accounts, nil
 }

@@ -119,7 +124,7 @@ func (s *AdminServer) CreateServiceAccount(ctx context.Context, req CreateServic

 	// Validate parent user exists
 	if _, err := s.credentialManager.GetUser(ctx, req.ParentUser); err != nil {
-		return nil, fmt.Errorf("parent user lookup failed for %s: %w", req.ParentUser, err)
+		return nil, fmt.Errorf("parent user not found: %s", req.ParentUser)
 	}

 	// Generate unique ID and credentials
@@ -159,7 +164,7 @@ func (s *AdminServer) CreateServiceAccount(ctx context.Context, req CreateServic

 	glog.V(1).Infof("Created service account %s for user %s", saId, req.ParentUser)

-	resp := &ServiceAccount{
+	return &ServiceAccount{
 		ID:              saId,
 		ParentUser:      req.ParentUser,
 		Description:     req.Description,
@@ -167,13 +172,8 @@ func (s *AdminServer) CreateServiceAccount(ctx context.Context, req CreateServic
 		SecretAccessKey: secretKey, // Only returned on creation
 		Status:          StatusActive,
 		CreateDate:      now,
-	}
-
-	if sa.Expiration > 0 {
-		resp.Expiration = time.Unix(sa.Expiration, 0)
-	}
-
-	return resp, nil
+		Expiration:      time.Unix(sa.Expiration, 0),
+	}, nil
 }

 // UpdateServiceAccount updates an existing service account
@@ -195,13 +195,10 @@ func (s *AdminServer) UpdateServiceAccount(ctx context.Context, id string, req U
 	}

 	if req.Status != "" {
-		switch req.Status {
-		case StatusInactive:
+		if req.Status == StatusInactive {
 			sa.Disabled = true
-		case StatusActive:
+		} else {
 			sa.Disabled = false
-		default:
-			return nil, fmt.Errorf("invalid status value: %s (must be %s or %s)", req.Status, StatusActive, StatusInactive)
 		}
 	}

@@ -224,25 +221,15 @@ func (s *AdminServer) UpdateServiceAccount(ctx context.Context, id string, req U
 		status = StatusInactive
 	}

-	accessKeyId := ""
-	if sa.Credential != nil {
-		accessKeyId = sa.Credential.AccessKey
-	}
-
-	resp := &ServiceAccount{
+	return &ServiceAccount{
 		ID:          sa.Id,
 		ParentUser:  sa.ParentUser,
 		Description: sa.Description,
 		Status:      status,
 		CreateDate:  time.Unix(sa.CreatedAt, 0),
-		AccessKeyId: accessKeyId,
-	}
-
-	if sa.Expiration > 0 {
-		resp.Expiration = time.Unix(sa.Expiration, 0)
-	}
-
-	return resp, nil
+		Expiration:  time.Unix(sa.Expiration, 0),
+		AccessKeyId: sa.Credential.AccessKey,
+	}, nil
 }

 // DeleteServiceAccount deletes a service account
@@ -278,30 +265,29 @@ func (s *AdminServer) GetServiceAccountByAccessKey(ctx context.Context, accessKe
 		return nil, fmt.Errorf("credential manager not available")
 	}

-	// Efficient lookup is now supported by the interface and optimized stores
-	sa, err := s.credentialManager.GetStore().GetServiceAccountByAccessKey(ctx, accessKey)
+	// Efficient lookup is not supported by interface yet, so list and find
+	pbAccounts, err := s.credentialManager.ListServiceAccounts(ctx)
 	if err != nil {
-		return nil, fmt.Errorf("failed to find service account: %w", err)
+		return nil, fmt.Errorf("failed to list service accounts: %w", err)
 	}

-	status := StatusActive
-	if sa.Disabled {
-		status = StatusInactive
+	for _, sa := range pbAccounts {
+		if sa.Credential != nil && sa.Credential.AccessKey == accessKey {
+			status := StatusActive
+			if sa.Disabled {
+				status = StatusInactive
+			}
+			return &ServiceAccount{
+				ID:          sa.Id,
+				ParentUser:  sa.ParentUser,
+				Description: sa.Description,
+				AccessKeyId: sa.Credential.AccessKey,
+				Status:      status,
+				CreateDate:  time.Unix(sa.CreatedAt, 0),
+				Expiration:  time.Unix(sa.Expiration, 0),
+			}, nil
+		}
 	}
-	accessKeyId := ""
-	if sa.Credential != nil {
-		accessKeyId = sa.Credential.AccessKey
-	}
-	resp := &ServiceAccount{
-		ID:          sa.Id,
-		ParentUser:  sa.ParentUser,
-		Description: sa.Description,
-		AccessKeyId: accessKeyId,
-		Status:      status,
-		CreateDate:  time.Unix(sa.CreatedAt, 0),
-	}
-	if sa.Expiration > 0 {
-		resp.Expiration = time.Unix(sa.Expiration, 0)
-	}
-	return resp, nil
+
+	return nil, fmt.Errorf("service account not found for access key: %s", accessKey)
 }
@@ -22,7 +22,6 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/admin/view/layout"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
-	"github.com/seaweedfs/seaweedfs/weed/security"
 	"github.com/seaweedfs/seaweedfs/weed/util"
 	"github.com/seaweedfs/seaweedfs/weed/util/http/client"
 )
@@ -122,6 +121,7 @@ func (h *FileBrowserHandlers) DeleteFile(c *gin.Context) {
 		})
 		return err
 	})
+
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to delete file: " + err.Error()})
 		return
@@ -228,7 +228,7 @@ func (h *FileBrowserHandlers) CreateFolder(c *gin.Context) {
 				Name:        filepath.Base(fullPath),
 				IsDirectory: true,
 				Attributes: &filer_pb.FuseAttributes{
-					FileMode: uint32(0o755 | os.ModeDir), // Directory mode
+					FileMode: uint32(0755 | os.ModeDir), // Directory mode
 					Uid:      filer_pb.OS_UID,
 					Gid:      filer_pb.OS_GID,
 					Crtime:   time.Now().Unix(),
@@ -239,6 +239,7 @@ func (h *FileBrowserHandlers) CreateFolder(c *gin.Context) {
 		})
 		return err
 	})
+
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create folder: " + err.Error()})
 		return
@@ -363,22 +364,6 @@ func (h *FileBrowserHandlers) uploadFileToFiler(filePath string, fileHeader *mul
 	}
 	defer file.Close()

-	// Load security configuration
-	v := util.GetViper()
-
-	// Read Filer JWT token from security.toml
-	signingKey := security.SigningKey(v.GetString("jwt.filer_signing.key"))
-	expiresAfterSec := v.GetInt("jwt.filer_signing.expires_after_seconds")
-
-	//  Generate JWT token to authenticate with Filer
-	var jwtToken security.EncodedJwt
-	if len(signingKey) > 0 {
-		jwtToken = security.GenJwtForFilerServer(signingKey, expiresAfterSec)
-		glog.V(4).Infof("Generated JWT token for filer upload (expires in %d sec)", expiresAfterSec)
-	} else {
-		glog.V(2).Info("No JWT signing key configured, uploading without authentication")
-	}
-
 	// Create multipart form data
 	var body bytes.Buffer
 	writer := multipart.NewWriter(&body)
@@ -422,12 +407,6 @@ func (h *FileBrowserHandlers) uploadFileToFiler(filePath string, fileHeader *mul
 	// Set content type with boundary
 	req.Header.Set("Content-Type", writer.FormDataContentType())

-	// Add JWT Token to Authorization Header
-	if jwtToken != "" {
-		req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", string(jwtToken)))
-		glog.V(4).Infof("Added JWT authorization header")
-	}
-
 	// Send request using TLS-aware HTTP client with 60s timeout for large file uploads
 	// lgtm[go/ssrf]
 	// Safe: filerAddress validated by validateFilerAddress() to match configured filer
@@ -616,29 +595,6 @@ func (h *FileBrowserHandlers) DownloadFile(c *gin.Context) {
 		return
 	}
 	client := h.newClientWithTimeout(5 * time.Minute) // Longer timeout for large file downloads
-
-	// Load security configuration
-	v := util.GetViper()
-
-	// Read Filer JWT token from security.toml
-	signingKey := security.SigningKey(v.GetString("jwt.filer_signing.read.key"))
-	expiresAfterSec := v.GetInt("jwt.filer_signing..read.expires_after_seconds")
-
-	//  Generate JWT token to authenticate with Filer
-	var jwtToken security.EncodedJwt
-	if len(signingKey) > 0 {
-		jwtToken = security.GenJwtForFilerServer(signingKey, expiresAfterSec)
-		glog.V(4).Infof("Generated JWT token for filer download (expires in %d sec)", expiresAfterSec)
-	} else {
-		glog.V(2).Info("No JWT signing key configured, downloadading without authentication")
-	}
-
-	// Add JWT Token to Authorization Header
-	if jwtToken != "" {
-		req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", string(jwtToken)))
-		glog.V(4).Infof("Added JWT authorization header")
-	}
-
 	resp, err := client.Do(req)
 	if err != nil {
 		c.JSON(http.StatusBadGateway, gin.H{"error": "Failed to fetch file from filer: " + err.Error()})
@@ -731,6 +687,7 @@ func (h *FileBrowserHandlers) ViewFile(c *gin.Context) {

 		return nil
 	})
+
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to get file metadata: " + err.Error()})
 		return
@@ -880,6 +837,7 @@ func (h *FileBrowserHandlers) GetFileProperties(c *gin.Context) {

 		return nil
 	})
+
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to get file properties: " + err.Error()})
 		return
@@ -1,55 +0,0 @@
-/**
- * Shared IAM utility functions for the SeaweedFS Admin Dashboard.
- */
-
-// Delete user function
-async function deleteUser(username) {
-    showDeleteConfirm(username, async function () {
-        try {
-            const encodedUsername = encodeURIComponent(username);
-            const response = await fetch(`/api/users/${encodedUsername}`, {
-                method: 'DELETE'
-            });
-
-            if (response.ok) {
-                showAlert('User deleted successfully', 'success');
-                setTimeout(() => window.location.reload(), 1000);
-            } else {
-                const error = await response.json().catch(() => ({}));
-                showAlert('Failed to delete user: ' + (error.error || 'Unknown error'), 'error');
-            }
-        } catch (error) {
-            console.error('Error deleting user:', error);
-            showAlert('Failed to delete user: ' + error.message, 'error');
-        }
-    }, 'Are you sure you want to delete this user? This action cannot be undone.');
-}
-
-// Delete access key function
-async function deleteAccessKey(username, accessKey) {
-    showDeleteConfirm(accessKey, async function () {
-        try {
-            const encodedUsername = encodeURIComponent(username);
-            const encodedAccessKey = encodeURIComponent(accessKey);
-            const response = await fetch(`/api/users/${encodedUsername}/access-keys/${encodedAccessKey}`, {
-                method: 'DELETE'
-            });
-
-            if (response.ok) {
-                showAlert('Access key deleted successfully', 'success');
-                // If refreshAccessKeysList exists (in object_store_users.templ), use it
-                if (typeof refreshAccessKeysList === 'function') {
-                    refreshAccessKeysList(username);
-                } else {
-                    setTimeout(() => window.location.reload(), 1000);
-                }
-            } else {
-                const error = await response.json().catch(() => ({}));
-                showAlert('Failed to delete access key: ' + (error.error || 'Unknown error'), 'error');
-            }
-        } catch (error) {
-            console.error('Error deleting access key:', error);
-            showAlert('Failed to delete access key: ' + error.message, 'error');
-        }
-    }, 'Are you sure you want to delete this access key?');
-}
@@ -1,331 +0,0 @@
-/**
- * Modal Alerts - Bootstrap Modal replacement for native alert() and confirm()
- * Fixes Chrome auto-dismiss issue with native dialogs
- * 
- * Usage:
- *   showAlert('Message', 'success');
- *   showConfirm('Delete this?', function() { });
- */
-
-(function () {
-    'use strict';
-
-    // Create and inject modal HTML into page if not already present
-    function ensureModalsExist() {
-        if (document.getElementById('globalAlertModal')) {
-            return; // Already exists
-        }
-
-        const modalsHTML = `
-            <!-- Global Alert Modal -->
-            <div class="modal fade" id="globalAlertModal" tabindex="-1" aria-labelledby="globalAlertModalLabel" aria-hidden="true">
-                <div class="modal-dialog">
-                    <div class="modal-content">
-                        <div class="modal-header" id="globalAlertModalHeader">
-                            <h5 class="modal-title" id="globalAlertModalLabel">
-                                <i class="fas fa-info-circle me-2" id="globalAlertModalIcon"></i>
-                                <span id="globalAlertModalTitle">Notice</span>
-                            </h5>
-                            <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                        </div>
-                        <div class="modal-body" id="globalAlertModalBody">
-                            <!-- Message will be inserted here -->
-                        </div>
-                        <div class="modal-footer">
-                            <button type="button" class="btn btn-primary" data-bs-dismiss="modal">OK</button>
-                        </div>
-                    </div>
-                </div>
-            </div>
-
-            <!-- Global Confirm Modal -->
-            <div class="modal fade" id="globalConfirmModal" tabindex="-1" aria-labelledby="globalConfirmModalLabel" aria-hidden="true">
-                <div class="modal-dialog">
-                    <div class="modal-content">
-                        <div class="modal-header bg-warning">
-                            <h5 class="modal-title" id="globalConfirmModalLabel">
-                                <i class="fas fa-question-circle me-2"></i><span id="globalConfirmModalTitleText">Confirm Action</span>
-                            </h5>
-                            <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                        </div>
-                        <div class="modal-body" id="globalConfirmModalBody">
-                            <!-- Message will be inserted here -->
-                        </div>
-                        <div class="modal-footer">
-                            <button type="button" class="btn btn-secondary" data-bs-dismiss="modal" id="globalConfirmCancelBtn">Cancel</button>
-                            <button type="button" class="btn btn-primary" id="globalConfirmOkBtn">OK</button>
-                        </div>
-                    </div>
-                </div>
-            </div>
-
-            <!-- Global Delete Confirm Modal -->
-            <div class="modal fade" id="globalDeleteModal" tabindex="-1" aria-labelledby="globalDeleteModalLabel" aria-hidden="true">
-                <div class="modal-dialog">
-                    <div class="modal-content">
-                        <div class="modal-header bg-danger text-white">
-                            <h5 class="modal-title" id="globalDeleteModalLabel">
-                                <i class="fas fa-exclamation-triangle me-2"></i>Confirm Delete
-                            </h5>
-                            <button type="button" class="btn-close btn-close-white" data-bs-dismiss="modal" aria-label="Close"></button>
-                        </div>
-                        <div class="modal-body">
-                            <p class="mb-2" id="globalDeleteModalMessage">Are you sure you want to delete this item?</p>
-                            <p class="mb-0"><strong id="globalDeleteModalItemName"></strong></p>
-                            <p class="text-muted small mt-2 mb-0">This action cannot be undone.</p>
-                        </div>
-                        <div class="modal-footer">
-                            <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
-                            <button type="button" class="btn btn-danger" id="globalDeleteConfirmBtn">
-                                <i class="fas fa-trash me-1"></i>Delete
-                            </button>
-                        </div>
-                    </div>
-                </div>
-            </div>
-        `;
-
-        // Inject modals at end of body
-        document.body.insertAdjacentHTML('beforeend', modalsHTML);
-    }
-
-    /**
-     * Show an alert message using Bootstrap modal
-     * @param {string} message - The message to display
-     * @param {string|object} typeOrOptions - Type ('success', 'error', 'warning', 'info') or options object
-     * @param {string} title - Optional custom title
-     */
-    window.showAlert = function (message, typeOrOptions, title) {
-        ensureModalsExist();
-
-        let type = 'info';
-        let isHtml = false;
-
-        if (typeof typeOrOptions === 'object' && typeOrOptions !== null) {
-            type = typeOrOptions.type || 'info';
-            isHtml = typeOrOptions.isHtml || false;
-            title = typeOrOptions.title || title;
-        } else if (typeof typeOrOptions === 'string') {
-            type = typeOrOptions;
-        }
-
-        const modal = document.getElementById('globalAlertModal');
-        const header = document.getElementById('globalAlertModalHeader');
-        const titleEl = document.getElementById('globalAlertModalTitle');
-        const bodyEl = document.getElementById('globalAlertModalBody');
-        const iconEl = document.getElementById('globalAlertModalIcon');
-
-        // Configuration for different types
-        const types = {
-            'success': {
-                title: 'Success',
-                icon: 'fa-check-circle',
-                headerClass: 'bg-success text-white',
-                btnClose: 'btn-close-white'
-            },
-            'error': {
-                title: 'Error',
-                icon: 'fa-exclamation-triangle',
-                headerClass: 'bg-danger text-white',
-                btnClose: 'btn-close-white'
-            },
-            'warning': {
-                title: 'Warning',
-                icon: 'fa-exclamation-circle',
-                headerClass: 'bg-warning text-dark',
-                btnClose: ''
-            },
-            'info': {
-                title: 'Notice',
-                icon: 'fa-info-circle',
-                headerClass: 'bg-info text-white',
-                btnClose: 'btn-close-white'
-            }
-        };
-
-        const config = types[type] || types['info'];
-
-        // Update header styling
-        header.className = 'modal-header ' + config.headerClass;
-        const closeBtn = header.querySelector('.btn-close');
-        closeBtn.className = 'btn-close ' + config.btnClose;
-
-        // Update icon
-        iconEl.className = 'fas ' + config.icon + ' me-2';
-
-        // Update title
-        titleEl.textContent = title || config.title;
-
-        // Update body - support HTML or text
-        if (isHtml || message.includes('<p>') || message.includes('<ul>')) {
-            bodyEl.innerHTML = message;
-        } else {
-            bodyEl.innerHTML = '<p class="mb-0">' + escapeHtml(message) + '</p>';
-        }
-
-        // Show modal
-        const bsModal = new bootstrap.Modal(modal);
-        bsModal.show();
-    };
-
-    /**
-     * Show a confirmation dialog using Bootstrap modal
-     * @param {string} message - The confirmation message
-     * @param {function} onConfirm - Callback function if user confirms
-     * @param {function|object} onCancelOrOptions - Optional callback or options object
-     * @param {string} title - Optional custom title
-     */
-    window.showConfirm = function (message, onConfirm, onCancelOrOptions, title) {
-        ensureModalsExist();
-
-        let onCancel = null;
-        let isHtml = false;
-
-        if (typeof onCancelOrOptions === 'object' && onCancelOrOptions !== null) {
-            onCancel = onCancelOrOptions.onCancel;
-            isHtml = onCancelOrOptions.isHtml || false;
-            title = onCancelOrOptions.title || null;
-        } else {
-            onCancel = onCancelOrOptions;
-        }
-
-        const modalEl = document.getElementById('globalConfirmModal');
-        const bodyEl = document.getElementById('globalConfirmModalBody');
-        const titleEl = document.getElementById('globalConfirmModalTitleText');
-        const okBtn = document.getElementById('globalConfirmOkBtn');
-        const cancelBtn = document.getElementById('globalConfirmCancelBtn');
-
-        // Set title
-        if (title) {
-            titleEl.textContent = title;
-        } else {
-            titleEl.textContent = 'Confirm Action';
-        }
-
-        // Set message
-        if (isHtml || message.includes('<p>') || message.includes('<ul>')) {
-            bodyEl.innerHTML = message;
-        } else {
-            bodyEl.innerHTML = '<p class="mb-0">' + escapeHtml(message) + '</p>';
-        }
-
-        // Remove old event listeners by cloning buttons
-        const newOkBtn = okBtn.cloneNode(true);
-        const newCancelBtn = cancelBtn.cloneNode(true);
-        okBtn.parentNode.replaceChild(newOkBtn, okBtn);
-        cancelBtn.parentNode.replaceChild(newCancelBtn, cancelBtn);
-
-        const modal = new bootstrap.Modal(modalEl);
-
-        // Add event listeners
-        newOkBtn.addEventListener('click', function () {
-            modal.hide();
-            if (typeof onConfirm === 'function') {
-                onConfirm();
-            }
-        });
-
-        newCancelBtn.addEventListener('click', function () {
-            modal.hide();
-            if (typeof onCancel === 'function') {
-                onCancel();
-            }
-        });
-
-        modal.show();
-    };
-
-    /**
-     * Show a delete confirmation dialog
-     * @param {string} itemName - Name of the item to delete
-     * @param {function} onConfirm - Callback function if user confirms deletion
-     * @param {string} message - Optional custom message (default: "Are you sure you want to delete this item?")
-     */
-    window.showDeleteConfirm = function (itemName, onConfirm, message) {
-        ensureModalsExist();
-
-        const modalEl = document.getElementById('globalDeleteModal');
-        const messageEl = document.getElementById('globalDeleteModalMessage');
-        const itemNameEl = document.getElementById('globalDeleteModalItemName');
-        const confirmBtn = document.getElementById('globalDeleteConfirmBtn');
-
-        // Set custom message if provided
-        if (message) {
-            messageEl.textContent = message;
-        } else {
-            messageEl.textContent = 'Are you sure you want to delete this item?';
-        }
-
-        // Set item name
-        itemNameEl.textContent = itemName;
-
-        // Remove old event listener by cloning button
-        const newConfirmBtn = confirmBtn.cloneNode(true);
-        confirmBtn.parentNode.replaceChild(newConfirmBtn, confirmBtn);
-
-        const modal = new bootstrap.Modal(modalEl);
-
-        // Add new event listener
-        newConfirmBtn.addEventListener('click', function () {
-            modal.hide();
-            if (typeof onConfirm === 'function') {
-                onConfirm();
-            }
-        });
-
-        modal.show();
-    };
-
-    /**
-     * Escape HTML to prevent XSS
-     */
-    function escapeHtml(text) {
-        const map = {
-            '&': '&amp;',
-            '<': '&lt;',
-            '>': '&gt;',
-            '"': '&quot;',
-            "'": '&#039;'
-        };
-        return text.replace(/[&<>"']/g, function (m) { return map[m]; });
-    }
-
-    // Auto-initialize on DOMContentLoaded
-    if (document.readyState === 'loading') {
-        document.addEventListener('DOMContentLoaded', ensureModalsExist);
-    } else {
-        ensureModalsExist();
-    }
-
-    /**
-     * AUTOMATIC OVERRIDE of native alert()
-     * This makes ALL existing alert() calls automatically use Bootstrap modals
-     */
-    window.alert = function (message) {
-        // Auto-detect message type from content
-        let type = 'info';
-        const msg = String(message || '');
-        const msgLower = msg.toLowerCase();
-
-        // Refined type inference to avoid false positives
-        if (msgLower.includes('success') || msgLower.includes('successfully') || msgLower.includes('created') || msgLower.includes('updated') || msgLower.includes('saved')) {
-            // Avoid "not successful"
-            if (!msgLower.includes('not success')) {
-                type = 'success';
-            }
-        }
-
-        if (type === 'info') {
-            if (msgLower.includes('error') || msgLower.includes('failed') || msgLower.includes('invalid') || msgLower.includes('exception')) {
-                type = 'error';
-            } else if (msgLower.includes('warning') || msgLower.includes('required') || msgLower.includes('attention')) {
-                type = 'warning';
-            }
-        }
-
-        showAlert(msg, type);
-    };
-
-    console.log('Modal Alerts library loaded - native alert() overridden');
-    console.log('For confirm(), use showConfirm() or showDeleteConfirm() instead of native confirm()');
-})();
@@ -145,6 +145,20 @@ templ ClusterEcShards(data dash.ClusterEcShardsData) {
                            </a>
                        </th>
                    }
+                    <th>
+                        <a href="#" onclick="sortBy('server')" class="text-dark text-decoration-none">
+                            Server
+                            if data.SortBy == "server" {
+                                if data.SortOrder == "asc" {
+                                    <i class="fas fa-sort-up ms-1"></i>
+                                } else {
+                                    <i class="fas fa-sort-down ms-1"></i>
+                                }
+                            } else {
+                                <i class="fas fa-sort ms-1 text-muted"></i>
+                            }
+                        </a>
+                    </th>
                    if data.ShowDataCenterColumn {
                        <th>
                            <a href="#" onclick="sortBy('datacenter')" class="text-dark text-decoration-none">
@@ -161,20 +175,6 @@ templ ClusterEcShards(data dash.ClusterEcShardsData) {
                            </a>
                        </th>
                    }
-                    <th>
-                        <a href="#" onclick="sortBy('server')" class="text-dark text-decoration-none">
-                            Server
-                            if data.SortBy == "server" {
-                                if data.SortOrder == "asc" {
-                                    <i class="fas fa-sort-up ms-1"></i>
-                                } else {
-                                    <i class="fas fa-sort-down ms-1"></i>
-                                }
-                            } else {
-                                <i class="fas fa-sort ms-1 text-muted"></i>
-                            }
-                        </a>
-                    </th>
                    if data.ShowRackColumn {
                        <th>
                            <a href="#" onclick="sortBy('rack')" class="text-dark text-decoration-none">
@@ -215,14 +215,14 @@ templ ClusterEcShards(data dash.ClusterEcShardsData) {
                                }
                            </td>
                        }
+                        <td>
+                            <code class="small">{shard.Server}</code>
+                        </td>
                        if data.ShowDataCenterColumn {
                            <td>
                                <span class="badge bg-outline-primary">{shard.DataCenter}</span>
                            </td>
                        }
-                        <td>
-                            <code class="small">{shard.Server}</code>
-                        </td>
                        if data.ShowRackColumn {
                            <td>
                                <span class="badge bg-outline-secondary">{shard.Rack}</span>
@@ -341,15 +341,10 @@ templ ClusterEcShards(data dash.ClusterEcShardsData) {
            });
        }

-        function goToPage(arg) {
-            let page;
-            if (typeof arg === 'number' || typeof arg === 'string') {
-                page = arg;
-            } else {
-                // Get data from the link element (not any child elements)
-                const link = arg.target.closest('a');
-                page = link.getAttribute('data-page');
-            }
+        function goToPage(event) {
+            // Get data from the link element (not any child elements)
+            const link = event.target.closest('a');
+            const page = link.getAttribute('data-page');
            updateUrl({ page: page });
        }

@@ -392,7 +387,7 @@ templ ClusterEcShards(data dash.ClusterEcShardsData) {
            // Get data from the button element (not the icon inside it)
            const button = event.target.closest('button');
            const volumeId = button.getAttribute('data-volume-id');
-            showConfirm(`Are you sure you want to repair missing shards for volume ${volumeId}?`, function() {
+            if (confirm(`Are you sure you want to repair missing shards for volume ${volumeId}?`)) {
                fetch(`/api/storage/volumes/${volumeId}/repair`, {
                    method: 'POST',
                    headers: {
@@ -402,18 +397,17 @@ templ ClusterEcShards(data dash.ClusterEcShardsData) {
                .then(response => response.json())
                .then(data => {
                    if (data.success) {
-                        showAlert('Repair initiated successfully', 'success');
+                        alert('Repair initiated successfully');
                        location.reload();
                    } else {
-                        showAlert('Failed to initiate repair: ' + data.error, 'error');
+                        alert('Failed to initiate repair: ' + data.error);
                    }
                })
                .catch(error => {
-                    showAlert('Error: ' + error.message, 'error');
+                    alert('Error: ' + error.message);
                });
-            });
+            }
        }
-
    </script>
 }

@@ -218,60 +218,60 @@ func ClusterEcShards(data dash.ClusterEcShardsData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 		}
-		if data.ShowDataCenterColumn {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 29, "<th><a href=\"#\" onclick=\"sortBy('datacenter')\" class=\"text-dark text-decoration-none\">Data Center ")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			if data.SortBy == "datacenter" {
-				if data.SortOrder == "asc" {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 30, "<i class=\"fas fa-sort-up ms-1\"></i>")
-					if templ_7745c5c3_Err != nil {
-						return templ_7745c5c3_Err
-					}
-				} else {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 31, "<i class=\"fas fa-sort-down ms-1\"></i>")
-					if templ_7745c5c3_Err != nil {
-						return templ_7745c5c3_Err
-					}
-				}
-			} else {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 32, "<i class=\"fas fa-sort ms-1 text-muted\"></i>")
-				if templ_7745c5c3_Err != nil {
-					return templ_7745c5c3_Err
-				}
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 33, "</a></th>")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 34, "<th><a href=\"#\" onclick=\"sortBy('server')\" class=\"text-dark text-decoration-none\">Server ")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 29, "<th><a href=\"#\" onclick=\"sortBy('server')\" class=\"text-dark text-decoration-none\">Server ")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		if data.SortBy == "server" {
 			if data.SortOrder == "asc" {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 35, "<i class=\"fas fa-sort-up ms-1\"></i>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 30, "<i class=\"fas fa-sort-up ms-1\"></i>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			} else {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 36, "<i class=\"fas fa-sort-down ms-1\"></i>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 31, "<i class=\"fas fa-sort-down ms-1\"></i>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
 		} else {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 37, "<i class=\"fas fa-sort ms-1 text-muted\"></i>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 32, "<i class=\"fas fa-sort ms-1 text-muted\"></i>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 38, "</a></th>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 33, "</a></th>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
+		if data.ShowDataCenterColumn {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 34, "<th><a href=\"#\" onclick=\"sortBy('datacenter')\" class=\"text-dark text-decoration-none\">Data Center ")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			if data.SortBy == "datacenter" {
+				if data.SortOrder == "asc" {
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 35, "<i class=\"fas fa-sort-up ms-1\"></i>")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+				} else {
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 36, "<i class=\"fas fa-sort-down ms-1\"></i>")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+				}
+			} else {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 37, "<i class=\"fas fa-sort ms-1 text-muted\"></i>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 38, "</a></th>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		}
 		if data.ShowRackColumn {
 			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 39, "<th><a href=\"#\" onclick=\"sortBy('rack')\" class=\"text-dark text-decoration-none\">Rack ")
 			if templ_7745c5c3_Err != nil {
@@ -356,42 +356,42 @@ func ClusterEcShards(data dash.ClusterEcShardsData) templ.Component {
 					return templ_7745c5c3_Err
 				}
 			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 52, "<td><code class=\"small\">")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var9 string
+			templ_7745c5c3_Var9, templ_7745c5c3_Err = templ.JoinStringErrs(shard.Server)
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 219, Col: 61}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var9))
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 53, "</code></td>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
 			if data.ShowDataCenterColumn {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 52, "<td><span class=\"badge bg-outline-primary\">")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 54, "<td><span class=\"badge bg-outline-primary\">")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				var templ_7745c5c3_Var9 string
-				templ_7745c5c3_Var9, templ_7745c5c3_Err = templ.JoinStringErrs(shard.DataCenter)
+				var templ_7745c5c3_Var10 string
+				templ_7745c5c3_Var10, templ_7745c5c3_Err = templ.JoinStringErrs(shard.DataCenter)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 220, Col: 88}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 223, Col: 88}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var9))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var10))
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 53, "</span></td>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 55, "</span></td>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 54, "<td><code class=\"small\">")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			var templ_7745c5c3_Var10 string
-			templ_7745c5c3_Var10, templ_7745c5c3_Err = templ.JoinStringErrs(shard.Server)
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 224, Col: 61}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var10))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 55, "</code></td>")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
 			if data.ShowRackColumn {
 				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 56, "<td><span class=\"badge bg-outline-secondary\">")
 				if templ_7745c5c3_Err != nil {
@@ -663,7 +663,7 @@ func ClusterEcShards(data dash.ClusterEcShardsData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 89, "<!-- JavaScript --><script>\n        function sortBy(field) {\n            const currentSort = \"{data.SortBy}\";\n            const currentOrder = \"{data.SortOrder}\";\n            let newOrder = 'asc';\n            \n            if (currentSort === field && currentOrder === 'asc') {\n                newOrder = 'desc';\n            }\n            \n            updateUrl({\n                sortBy: field,\n                sortOrder: newOrder,\n                page: 1\n            });\n        }\n\n        function goToPage(arg) {\n            let page;\n            if (typeof arg === 'number' || typeof arg === 'string') {\n                page = arg;\n            } else {\n                // Get data from the link element (not any child elements)\n                const link = arg.target.closest('a');\n                page = link.getAttribute('data-page');\n            }\n            updateUrl({ page: page });\n        }\n\n        function changePageSize() {\n            const pageSize = document.getElementById('pageSizeSelect').value;\n            updateUrl({ pageSize: pageSize, page: 1 });\n        }\n\n        function updateUrl(params) {\n            const url = new URL(window.location);\n            Object.keys(params).forEach(key => {\n                if (params[key]) {\n                    url.searchParams.set(key, params[key]);\n                } else {\n                    url.searchParams.delete(key);\n                }\n            });\n            window.location.href = url.toString();\n        }\n\n        function exportEcShards() {\n            const url = new URL('/api/storage/ec-shards/export', window.location.origin);\n            const params = new URLSearchParams(window.location.search);\n            params.forEach((value, key) => {\n                url.searchParams.set(key, value);\n            });\n            window.open(url.toString(), '_blank');\n        }\n\n        function showShardDetails(event) {\n            // Get data from the button element (not the icon inside it)\n            const button = event.target.closest('button');\n            const volumeId = button.getAttribute('data-volume-id');\n            \n            // Navigate to the EC volume details page\n            window.location.href = `/storage/ec-volumes/${volumeId}`;\n        }\n\n        function repairVolume(event) {\n            // Get data from the button element (not the icon inside it)\n            const button = event.target.closest('button');\n            const volumeId = button.getAttribute('data-volume-id');\n            showConfirm(`Are you sure you want to repair missing shards for volume ${volumeId}?`, function() {\n                fetch(`/api/storage/volumes/${volumeId}/repair`, {\n                    method: 'POST',\n                    headers: {\n                        'Content-Type': 'application/json',\n                    }\n                })\n                .then(response => response.json())\n                .then(data => {\n                    if (data.success) {\n                        showAlert('Repair initiated successfully', 'success');\n                        location.reload();\n                    } else {\n                        showAlert('Failed to initiate repair: ' + data.error, 'error');\n                    }\n                })\n                .catch(error => {\n                    showAlert('Error: ' + error.message, 'error');\n                });\n            });\n        }\n\n    </script>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 89, "<!-- JavaScript --><script>\n        function sortBy(field) {\n            const currentSort = \"{data.SortBy}\";\n            const currentOrder = \"{data.SortOrder}\";\n            let newOrder = 'asc';\n            \n            if (currentSort === field && currentOrder === 'asc') {\n                newOrder = 'desc';\n            }\n            \n            updateUrl({\n                sortBy: field,\n                sortOrder: newOrder,\n                page: 1\n            });\n        }\n\n        function goToPage(event) {\n            // Get data from the link element (not any child elements)\n            const link = event.target.closest('a');\n            const page = link.getAttribute('data-page');\n            updateUrl({ page: page });\n        }\n\n        function changePageSize() {\n            const pageSize = document.getElementById('pageSizeSelect').value;\n            updateUrl({ pageSize: pageSize, page: 1 });\n        }\n\n        function updateUrl(params) {\n            const url = new URL(window.location);\n            Object.keys(params).forEach(key => {\n                if (params[key]) {\n                    url.searchParams.set(key, params[key]);\n                } else {\n                    url.searchParams.delete(key);\n                }\n            });\n            window.location.href = url.toString();\n        }\n\n        function exportEcShards() {\n            const url = new URL('/api/storage/ec-shards/export', window.location.origin);\n            const params = new URLSearchParams(window.location.search);\n            params.forEach((value, key) => {\n                url.searchParams.set(key, value);\n            });\n            window.open(url.toString(), '_blank');\n        }\n\n        function showShardDetails(event) {\n            // Get data from the button element (not the icon inside it)\n            const button = event.target.closest('button');\n            const volumeId = button.getAttribute('data-volume-id');\n            \n            // Navigate to the EC volume details page\n            window.location.href = `/storage/ec-volumes/${volumeId}`;\n        }\n\n        function repairVolume(event) {\n            // Get data from the button element (not the icon inside it)\n            const button = event.target.closest('button');\n            const volumeId = button.getAttribute('data-volume-id');\n            if (confirm(`Are you sure you want to repair missing shards for volume ${volumeId}?`)) {\n                fetch(`/api/storage/volumes/${volumeId}/repair`, {\n                    method: 'POST',\n                    headers: {\n                        'Content-Type': 'application/json',\n                    }\n                })\n                .then(response => response.json())\n                .then(data => {\n                    if (data.success) {\n                        alert('Repair initiated successfully');\n                        location.reload();\n                    } else {\n                        alert('Failed to initiate repair: ' + data.error);\n                    }\n                })\n                .catch(error => {\n                    alert('Error: ' + error.message);\n                });\n            }\n        }\n    </script>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -700,7 +700,7 @@ func displayShardDistribution(shard dash.EcShardWithInfo, allShards []dash.EcSha
 		var templ_7745c5c3_Var24 string
 		templ_7745c5c3_Var24, templ_7745c5c3_Err = templ.JoinStringErrs(calculateDistributionSummary(shard.VolumeID, allShards))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 424, Col: 65}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 418, Col: 65}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var24))
 		if templ_7745c5c3_Err != nil {
@@ -750,7 +750,7 @@ func displayVolumeStatus(shard dash.EcShardWithInfo) templ.Component {
 				var templ_7745c5c3_Var26 string
 				templ_7745c5c3_Var26, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", len(shard.MissingShards)))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 434, Col: 129}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 428, Col: 129}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var26))
 				if templ_7745c5c3_Err != nil {
@@ -768,7 +768,7 @@ func displayVolumeStatus(shard dash.EcShardWithInfo) templ.Component {
 				var templ_7745c5c3_Var27 string
 				templ_7745c5c3_Var27, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", len(shard.MissingShards)))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 436, Col: 145}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 430, Col: 145}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var27))
 				if templ_7745c5c3_Err != nil {
@@ -786,7 +786,7 @@ func displayVolumeStatus(shard dash.EcShardWithInfo) templ.Component {
 				var templ_7745c5c3_Var28 string
 				templ_7745c5c3_Var28, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", len(shard.MissingShards)))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 438, Col: 138}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 432, Col: 138}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var28))
 				if templ_7745c5c3_Err != nil {
@@ -804,7 +804,7 @@ func displayVolumeStatus(shard dash.EcShardWithInfo) templ.Component {
 				var templ_7745c5c3_Var29 string
 				templ_7745c5c3_Var29, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", len(shard.MissingShards)))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 440, Col: 137}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 434, Col: 137}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var29))
 				if templ_7745c5c3_Err != nil {
@@ -378,7 +378,7 @@ templ ClusterEcVolumes(data dash.ClusterEcVolumesData) {

        function repairVolume(event) {
            const volumeId = event.target.closest('button').getAttribute('data-volume-id');
-            showConfirm(`Are you sure you want to repair missing shards for volume ${volumeId}?`, function() {
+            if (confirm(`Are you sure you want to repair missing shards for volume ${volumeId}?`)) {
                fetch(`/api/storage/ec-volumes/${volumeId}/repair`, {
                    method: 'POST',
                    headers: {
@@ -393,16 +393,16 @@ templ ClusterEcVolumes(data dash.ClusterEcVolumesData) {
                })
                .then(data => {
                    if (data && data.success) {
-                        showAlert('Repair initiated successfully', 'success');
+                        alert('Repair initiated successfully');
                        location.reload();
                    } else {
-                        showAlert('Failed to initiate repair: ' + (data && data.error ? data.error : 'Unknown error'), 'error');
+                        alert('Failed to initiate repair: ' + (data && data.error ? data.error : 'Unknown error'));
                    }
                })
                .catch(error => {
-                    showAlert('Error: ' + error.message, 'error');
+                    alert('Error: ' + error.message);
                });
-            });
+            }
        }
    </script>
 }
@@ -757,7 +757,7 @@ func ClusterEcVolumes(data dash.ClusterEcVolumesData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 96, "<!-- JavaScript --><script>\n        function sortBy(field) {\n            const currentSort = new URLSearchParams(window.location.search).get('sort_by');\n            const currentOrder = new URLSearchParams(window.location.search).get('sort_order') || 'asc';\n            \n            let newOrder = 'asc';\n            if (currentSort === field && currentOrder === 'asc') {\n                newOrder = 'desc';\n            }\n            \n            updateUrl({\n                sort_by: field,\n                sort_order: newOrder,\n                page: 1\n            });\n        }\n\n        function goToPage(event) {\n            event.preventDefault();\n            const page = event.target.closest('a').getAttribute('data-page');\n            updateUrl({ page: page });\n        }\n\n        function changePageSize(newPageSize) {\n            updateUrl({ page_size: newPageSize, page: 1 });\n        }\n\n        function updateUrl(params) {\n            const url = new URL(window.location);\n            Object.keys(params).forEach(key => {\n                if (params[key] != null) {\n                    url.searchParams.set(key, params[key]);\n                } else {\n                    url.searchParams.delete(key);\n                }\n            });\n            window.location.href = url.toString();\n        }\n\n        function showVolumeDetails(event) {\n            const volumeId = event.target.closest('button').getAttribute('data-volume-id');\n            window.location.href = `/storage/ec-volumes/${volumeId}`;\n        }\n\n        function repairVolume(event) {\n            const volumeId = event.target.closest('button').getAttribute('data-volume-id');\n            showConfirm(`Are you sure you want to repair missing shards for volume ${volumeId}?`, function() {\n                fetch(`/api/storage/ec-volumes/${volumeId}/repair`, {\n                    method: 'POST',\n                    headers: {\n                        'Content-Type': 'application/json',\n                    }\n                })\n                .then(response => {\n                    if (!response.ok) {\n                        throw new Error(`HTTP ${response.status}: ${response.statusText}`);\n                    }\n                    return response.json();\n                })\n                .then(data => {\n                    if (data && data.success) {\n                        showAlert('Repair initiated successfully', 'success');\n                        location.reload();\n                    } else {\n                        showAlert('Failed to initiate repair: ' + (data && data.error ? data.error : 'Unknown error'), 'error');\n                    }\n                })\n                .catch(error => {\n                    showAlert('Error: ' + error.message, 'error');\n                });\n            });\n        }\n    </script>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 96, "<!-- JavaScript --><script>\n        function sortBy(field) {\n            const currentSort = new URLSearchParams(window.location.search).get('sort_by');\n            const currentOrder = new URLSearchParams(window.location.search).get('sort_order') || 'asc';\n            \n            let newOrder = 'asc';\n            if (currentSort === field && currentOrder === 'asc') {\n                newOrder = 'desc';\n            }\n            \n            updateUrl({\n                sort_by: field,\n                sort_order: newOrder,\n                page: 1\n            });\n        }\n\n        function goToPage(event) {\n            event.preventDefault();\n            const page = event.target.closest('a').getAttribute('data-page');\n            updateUrl({ page: page });\n        }\n\n        function changePageSize(newPageSize) {\n            updateUrl({ page_size: newPageSize, page: 1 });\n        }\n\n        function updateUrl(params) {\n            const url = new URL(window.location);\n            Object.keys(params).forEach(key => {\n                if (params[key] != null) {\n                    url.searchParams.set(key, params[key]);\n                } else {\n                    url.searchParams.delete(key);\n                }\n            });\n            window.location.href = url.toString();\n        }\n\n        function showVolumeDetails(event) {\n            const volumeId = event.target.closest('button').getAttribute('data-volume-id');\n            window.location.href = `/storage/ec-volumes/${volumeId}`;\n        }\n\n        function repairVolume(event) {\n            const volumeId = event.target.closest('button').getAttribute('data-volume-id');\n            if (confirm(`Are you sure you want to repair missing shards for volume ${volumeId}?`)) {\n                fetch(`/api/storage/ec-volumes/${volumeId}/repair`, {\n                    method: 'POST',\n                    headers: {\n                        'Content-Type': 'application/json',\n                    }\n                })\n                .then(response => {\n                    if (!response.ok) {\n                        throw new Error(`HTTP ${response.status}: ${response.statusText}`);\n                    }\n                    return response.json();\n                })\n                .then(data => {\n                    if (data && data.success) {\n                        alert('Repair initiated successfully');\n                        location.reload();\n                    } else {\n                        alert('Failed to initiate repair: ' + (data && data.error ? data.error : 'Unknown error'));\n                    }\n                })\n                .catch(error => {\n                    alert('Error: ' + error.message);\n                });\n            }\n        }\n    </script>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -372,10 +372,10 @@ templ CollectionDetails(data dash.CollectionDetailsData) {
 		// Repair EC Volume
 		function repairEcVolume(event) {
 			const volumeId = event.target.closest('button').getAttribute('data-volume-id');
-   showConfirm(`Are you sure you want to repair missing shards for EC volume ${volumeId}?`, function() {
+			if (confirm(`Are you sure you want to repair missing shards for EC volume ${volumeId}?`)) {
 				// TODO: Implement repair functionality
-				showAlert('Repair functionality will be implemented soon.', 'info');
-			});
+				alert('Repair functionality will be implemented soon.');
+			}
 		}
 	</script>
-}
+} 
@@ -575,7 +575,7 @@ func CollectionDetails(data dash.CollectionDetailsData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 64, "<script>\n\t\t// Sorting functionality\n\t\tfunction sortBy(field) {\n\t\t\tconst currentSort = new URLSearchParams(window.location.search).get('sort_by');\n\t\t\tconst currentOrder = new URLSearchParams(window.location.search).get('sort_order') || 'asc';\n\t\t\t\n\t\t\tlet newOrder = 'asc';\n\t\t\tif (currentSort === field && currentOrder === 'asc') {\n\t\t\t\tnewOrder = 'desc';\n\t\t\t}\n\t\t\t\n\t\t\tconst url = new URL(window.location);\n\t\t\turl.searchParams.set('sort_by', field);\n\t\t\turl.searchParams.set('sort_order', newOrder);\n\t\t\turl.searchParams.set('page', '1'); // Reset to first page\n\t\t\twindow.location.href = url.toString();\n\t\t}\n\n\t\t// Pagination functionality\n\t\tfunction goToPage(event) {\n\t\t\tevent.preventDefault();\n\t\t\tconst page = event.target.closest('a').getAttribute('data-page');\n\t\t\tconst url = new URL(window.location);\n\t\t\turl.searchParams.set('page', page);\n\t\t\twindow.location.href = url.toString();\n\t\t}\n\n\t\t// Page size functionality\n\t\tfunction changePageSize(newPageSize) {\n\t\t\tconst url = new URL(window.location);\n\t\t\turl.searchParams.set('page_size', newPageSize);\n\t\t\turl.searchParams.set('page', '1'); // Reset to first page when changing page size\n\t\t\twindow.location.href = url.toString();\n\t\t}\n\n\t\t// Volume details\n\t\tfunction showVolumeDetails(event) {\n\t\t\tconst volumeId = event.target.closest('button').getAttribute('data-volume-id');\n\t\t\tconst server = event.target.closest('button').getAttribute('data-server');\n\t\t\twindow.location.href = `/storage/volumes/${volumeId}/${server}`;\n\t\t}\n\n\t\t// EC Volume details\n\t\tfunction showEcVolumeDetails(event) {\n\t\t\tconst volumeId = event.target.closest('button').getAttribute('data-volume-id');\n\t\t\twindow.location.href = `/storage/ec-volumes/${volumeId}`;\n\t\t}\n\n\t\t// Repair EC Volume\n\t\tfunction repairEcVolume(event) {\n\t\t\tconst volumeId = event.target.closest('button').getAttribute('data-volume-id');\n   showConfirm(`Are you sure you want to repair missing shards for EC volume ${volumeId}?`, function() {\n\t\t\t\t// TODO: Implement repair functionality\n\t\t\t\tshowAlert('Repair functionality will be implemented soon.', 'info');\n\t\t\t});\n\t\t}\n\t</script>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 64, "<script>\n\t\t// Sorting functionality\n\t\tfunction sortBy(field) {\n\t\t\tconst currentSort = new URLSearchParams(window.location.search).get('sort_by');\n\t\t\tconst currentOrder = new URLSearchParams(window.location.search).get('sort_order') || 'asc';\n\t\t\t\n\t\t\tlet newOrder = 'asc';\n\t\t\tif (currentSort === field && currentOrder === 'asc') {\n\t\t\t\tnewOrder = 'desc';\n\t\t\t}\n\t\t\t\n\t\t\tconst url = new URL(window.location);\n\t\t\turl.searchParams.set('sort_by', field);\n\t\t\turl.searchParams.set('sort_order', newOrder);\n\t\t\turl.searchParams.set('page', '1'); // Reset to first page\n\t\t\twindow.location.href = url.toString();\n\t\t}\n\n\t\t// Pagination functionality\n\t\tfunction goToPage(event) {\n\t\t\tevent.preventDefault();\n\t\t\tconst page = event.target.closest('a').getAttribute('data-page');\n\t\t\tconst url = new URL(window.location);\n\t\t\turl.searchParams.set('page', page);\n\t\t\twindow.location.href = url.toString();\n\t\t}\n\n\t\t// Page size functionality\n\t\tfunction changePageSize(newPageSize) {\n\t\t\tconst url = new URL(window.location);\n\t\t\turl.searchParams.set('page_size', newPageSize);\n\t\t\turl.searchParams.set('page', '1'); // Reset to first page when changing page size\n\t\t\twindow.location.href = url.toString();\n\t\t}\n\n\t\t// Volume details\n\t\tfunction showVolumeDetails(event) {\n\t\t\tconst volumeId = event.target.closest('button').getAttribute('data-volume-id');\n\t\t\tconst server = event.target.closest('button').getAttribute('data-server');\n\t\t\twindow.location.href = `/storage/volumes/${volumeId}/${server}`;\n\t\t}\n\n\t\t// EC Volume details\n\t\tfunction showEcVolumeDetails(event) {\n\t\t\tconst volumeId = event.target.closest('button').getAttribute('data-volume-id');\n\t\t\twindow.location.href = `/storage/ec-volumes/${volumeId}`;\n\t\t}\n\n\t\t// Repair EC Volume\n\t\tfunction repairEcVolume(event) {\n\t\t\tconst volumeId = event.target.closest('button').getAttribute('data-volume-id');\n\t\t\tif (confirm(`Are you sure you want to repair missing shards for EC volume ${volumeId}?`)) {\n\t\t\t\t// TODO: Implement repair functionality\n\t\t\t\talert('Repair functionality will be implemented soon.');\n\t\t\t}\n\t\t}\n\t</script>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -365,10 +365,9 @@ templ FileBrowser(data dash.FileBrowserData) {
 					showFileProperties(path);
 					break;
 				case 'delete':
-					const fileName = path.split('/').pop();
-					showDeleteConfirm(fileName, function() {
+					if (confirm('Are you sure you want to delete "' + path + '"?')) {
 						deleteFile(path);
-					}, `Are you sure you want to delete "${fileName}"? This action cannot be undone.`);
+					}
 					break;
 			}
 		});
@@ -396,14 +395,14 @@ templ FileBrowser(data dash.FileBrowserData) {
 			.then(response => response.json())
 			.then(data => {
 				if (data.error) {
-					showAlert('Error loading file properties: ' + data.error, 'error');
+					alert('Error loading file properties: ' + data.error);
 				} else {
 					displayFileProperties(data);
 				}
 			})
 			.catch(error => {
 				console.error('Error fetching file properties:', error);
-				showAlert('Error loading file properties: ' + error.message, 'error');
+				alert('Error loading file properties: ' + error.message);
 			});
 	}
 	
@@ -251,7 +251,7 @@ templ MaintenanceConfig(data *maintenance.MaintenanceConfigData) {
        }

        function resetToDefaults() {
-            showConfirm('Are you sure you want to reset to default configuration? This will overwrite your current settings.', function() {
+            if (confirm('Are you sure you want to reset to default configuration? This will overwrite your current settings.')) {
                // Reset form to defaults (matching DefaultMaintenanceConfig values)
                document.getElementById('enabled').checked = false;
                document.getElementById('scanInterval').value = '30';
@@ -261,7 +261,7 @@ templ MaintenanceConfig(data *maintenance.MaintenanceConfigData) {
                document.getElementById('maxRetries').value = '3';
                document.getElementById('retryDelay').value = '15';
                document.getElementById('taskRetention').value = '7';
-            });
+            }
        }
    </script>
 } 
@@ -157,10 +157,8 @@ templ MaintenanceConfigSchema(data *maintenance.MaintenanceConfigData, schema *m
            })
            .then(response => {
                if (response.status === 401) {
-                    showAlert('Authentication required. Please log in first.', 'warning');
-                    setTimeout(() => {
-                        window.location.href = '/login';
-                    }, 2000);
+                    alert('Authentication required. Please log in first.');
+                    window.location.href = '/login';
                    return;
                }
                return response.json();
@@ -168,20 +166,20 @@ templ MaintenanceConfigSchema(data *maintenance.MaintenanceConfigData, schema *m
            .then(data => {
                if (!data) return; // Skip if redirected to login
                if (data.success) {
-                    showAlert('Configuration saved successfully!', 'success');
+                    alert('Configuration saved successfully!');
                    location.reload();
                } else {
-                    showAlert('Error saving configuration: ' + (data.error || 'Unknown error'), 'error');
+                    alert('Error saving configuration: ' + (data.error || 'Unknown error'));
                }
            })
            .catch(error => {
                console.error('Error:', error);
-                showAlert('Error saving configuration: ' + error.message, 'error');
+                alert('Error saving configuration: ' + error.message);
            });
        }

        function resetToDefaults() {
-            showConfirm('Are you sure you want to reset to default configuration? This will overwrite your current settings.', function() {
+            if (confirm('Are you sure you want to reset to default configuration? This will overwrite your current settings.')) {
                fetch('/maintenance/config/defaults', {
                    method: 'POST',
                    headers: {
@@ -191,17 +189,17 @@ templ MaintenanceConfigSchema(data *maintenance.MaintenanceConfigData, schema *m
                .then(response => response.json())
                .then(data => {
                    if (data.success) {
-                        showAlert('Configuration reset to defaults!', 'success');
+                        alert('Configuration reset to defaults!');
                        location.reload();
                    } else {
-                        showAlert('Error resetting configuration: ' + (data.error || 'Unknown error'), 'error');
+                        alert('Error resetting configuration: ' + (data.error || 'Unknown error'));
                    }
                })
                .catch(error => {
                    console.error('Error:', error);
-                    showAlert('Error resetting configuration: ' + error.message, 'error');
+                    alert('Error resetting configuration: ' + error.message);
                });
-            });
+            }
        }
    </script>
 }
@@ -273,7 +273,7 @@ func MaintenanceConfig(data *maintenance.MaintenanceConfigData) templ.Component
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 24, "</p></div></div></div></div></div></div></div></div><script>\n        function saveConfiguration() {\n            // First, get current configuration to preserve existing values\n            fetch('/api/maintenance/config')\n                .then(response => response.json())\n                .then(currentConfig => {\n                    // Update only the fields from the form\n                    const updatedConfig = {\n                        ...currentConfig.config, // Preserve existing config\n                        enabled: document.getElementById('enabled').checked,\n                        scan_interval_seconds: parseInt(document.getElementById('scanInterval').value) * 60, // Convert to seconds\n                        worker_timeout_seconds: parseInt(document.getElementById('workerTimeout').value) * 60, // Convert to seconds\n                        task_timeout_seconds: parseInt(document.getElementById('taskTimeout').value) * 3600, // Convert to seconds\n                        retry_delay_seconds: parseInt(document.getElementById('retryDelay').value) * 60, // Convert to seconds\n                        max_retries: parseInt(document.getElementById('maxRetries').value),\n                        task_retention_seconds: parseInt(document.getElementById('taskRetention').value) * 24 * 3600, // Convert to seconds\n                        policy: {\n                            ...currentConfig.config.policy, // Preserve existing policy\n                            global_max_concurrent: parseInt(document.getElementById('globalMaxConcurrent').value)\n                        }\n                    };\n\n                    // Send the updated configuration\n                    return fetch('/api/maintenance/config', {\n                        method: 'PUT',\n                        headers: {\n                            'Content-Type': 'application/json',\n                        },\n                        body: JSON.stringify(updatedConfig)\n                    });\n                })\n                .then(response => response.json())\n                .then(data => {\n                    if (data.success) {\n                        alert('Configuration saved successfully');\n                        location.reload(); // Reload to show updated values\n                    } else {\n                        alert('Failed to save configuration: ' + (data.error || 'Unknown error'));\n                    }\n                })\n                .catch(error => {\n                    alert('Error: ' + error.message);\n                });\n        }\n\n        function resetToDefaults() {\n            showConfirm('Are you sure you want to reset to default configuration? This will overwrite your current settings.', function() {\n                // Reset form to defaults (matching DefaultMaintenanceConfig values)\n                document.getElementById('enabled').checked = false;\n                document.getElementById('scanInterval').value = '30';\n                document.getElementById('workerTimeout').value = '5';\n                document.getElementById('taskTimeout').value = '2';\n                document.getElementById('globalMaxConcurrent').value = '4';\n                document.getElementById('maxRetries').value = '3';\n                document.getElementById('retryDelay').value = '15';\n                document.getElementById('taskRetention').value = '7';\n            });\n        }\n    </script>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 24, "</p></div></div></div></div></div></div></div></div><script>\n        function saveConfiguration() {\n            // First, get current configuration to preserve existing values\n            fetch('/api/maintenance/config')\n                .then(response => response.json())\n                .then(currentConfig => {\n                    // Update only the fields from the form\n                    const updatedConfig = {\n                        ...currentConfig.config, // Preserve existing config\n                        enabled: document.getElementById('enabled').checked,\n                        scan_interval_seconds: parseInt(document.getElementById('scanInterval').value) * 60, // Convert to seconds\n                        worker_timeout_seconds: parseInt(document.getElementById('workerTimeout').value) * 60, // Convert to seconds\n                        task_timeout_seconds: parseInt(document.getElementById('taskTimeout').value) * 3600, // Convert to seconds\n                        retry_delay_seconds: parseInt(document.getElementById('retryDelay').value) * 60, // Convert to seconds\n                        max_retries: parseInt(document.getElementById('maxRetries').value),\n                        task_retention_seconds: parseInt(document.getElementById('taskRetention').value) * 24 * 3600, // Convert to seconds\n                        policy: {\n                            ...currentConfig.config.policy, // Preserve existing policy\n                            global_max_concurrent: parseInt(document.getElementById('globalMaxConcurrent').value)\n                        }\n                    };\n\n                    // Send the updated configuration\n                    return fetch('/api/maintenance/config', {\n                        method: 'PUT',\n                        headers: {\n                            'Content-Type': 'application/json',\n                        },\n                        body: JSON.stringify(updatedConfig)\n                    });\n                })\n                .then(response => response.json())\n                .then(data => {\n                    if (data.success) {\n                        alert('Configuration saved successfully');\n                        location.reload(); // Reload to show updated values\n                    } else {\n                        alert('Failed to save configuration: ' + (data.error || 'Unknown error'));\n                    }\n                })\n                .catch(error => {\n                    alert('Error: ' + error.message);\n                });\n        }\n\n        function resetToDefaults() {\n            if (confirm('Are you sure you want to reset to default configuration? This will overwrite your current settings.')) {\n                // Reset form to defaults (matching DefaultMaintenanceConfig values)\n                document.getElementById('enabled').checked = false;\n                document.getElementById('scanInterval').value = '30';\n                document.getElementById('workerTimeout').value = '5';\n                document.getElementById('taskTimeout').value = '2';\n                document.getElementById('globalMaxConcurrent').value = '4';\n                document.getElementById('maxRetries').value = '3';\n                document.getElementById('retryDelay').value = '15';\n                document.getElementById('taskRetention').value = '7';\n            }\n        }\n    </script>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -247,8 +247,7 @@ templ MaintenanceWorkers(data *dash.MaintenanceWorkersData) {
        var modal = new bootstrap.Modal(document.getElementById('workerDetailsModal'));
        
        // Load worker details
-        const encodedWorkerId = encodeURIComponent(workerID);
-        fetch('/api/maintenance/workers/' + encodedWorkerId)
+        fetch('/api/maintenance/workers/' + workerID)
            .then(response => response.json())
            .then(data => {
                const content = document.getElementById('workerDetailsContent');
@@ -276,7 +275,7 @@ templ MaintenanceWorkers(data *dash.MaintenanceWorkersData) {
                '</div>' +
                '<hr>' +
                '<h6>Current Tasks</h6>' +
-                (data.current_tasks === null || data.current_tasks.length === 0 ?
+                (data.current_tasks.length === 0 ? 
                    '<p class="text-muted">No current tasks</p>' :
                    data.current_tasks.map(task => 
                        '<div class="card mb-2">' +
@@ -303,27 +302,23 @@ templ MaintenanceWorkers(data *dash.MaintenanceWorkersData) {
    function pauseWorker(event) {
        const workerID = event.target.closest('button').getAttribute('data-worker-id');
        
-        showConfirm(`Are you sure you want to pause worker ${workerID}?`, function() {
-            const encodedWorkerId = encodeURIComponent(workerID);
-            fetch('/api/maintenance/workers/' + encodedWorkerId + '/pause', {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json',
-                }
+        if (confirm('Are you sure you want to pause this worker?')) {
+            fetch('/api/maintenance/workers/' + workerID + '/pause', {
+                method: 'POST'
            })
            .then(response => response.json())
            .then(data => {
                if (data.success) {
                    location.reload();
                } else {
-                    showAlert('Failed to pause worker: ' + data.error, 'error');
+                    alert('Failed to pause worker: ' + data.error);
                }
            })
            .catch(error => {
                console.error('Error pausing worker:', error);
-                showAlert('Failed to pause worker', 'error');
+                alert('Failed to pause worker');
            });
-        });
+        }
    }

    function formatDuration(nanoseconds) {
@@ -516,11 +516,11 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
                    }
                } else {
                    const error = await response.json().catch(() => ({}));
-                    showAlert('Failed to load policies: ' + (error.error || 'Unknown error'), 'error');
+                    showErrorMessage('Failed to load policies: ' + (error.error || 'Unknown error'));
                }
            } catch (error) {
                console.error('Error loading policies:', error);
-                showAlert('Failed to load policies: ' + error.message, 'error');
+                showErrorMessage('Failed to load policies: ' + error.message);
            }
        }

@@ -691,27 +691,25 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
        // Show user details modal
        async function showUserDetails(username) {
            try {
-                const encodedUsername = encodeURIComponent(username);
-                const response = await fetch(`/api/users/${encodedUsername}`);
+                const response = await fetch(`/api/users/${username}`);
                if (response.ok) {
                    const user = await response.json();
                    document.getElementById('userDetailsContent').innerHTML = createUserDetailsContent(user);
                    const modal = new bootstrap.Modal(document.getElementById('userDetailsModal'));
                    modal.show();
                } else {
-                    showAlert('Failed to load user details', 'error');
+                    showErrorMessage('Failed to load user details');
                }
            } catch (error) {
                console.error('Error loading user details:', error);
-                showAlert('Failed to load user details', 'error');
+                showErrorMessage('Failed to load user details');
            }
        }

        // Edit user function
        async function editUser(username) {
            try {
-                const encodedUsername = encodeURIComponent(username);
-                const response = await fetch(`/api/users/${encodedUsername}`);
+                const response = await fetch(`/api/users/${username}`);
                if (response.ok) {
                    const user = await response.json();
                    
@@ -775,19 +773,18 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
                    const modal = new bootstrap.Modal(document.getElementById('editUserModal'));
                    modal.show();
                } else {
-                    showAlert('Failed to load user details', 'error');
+                    showErrorMessage('Failed to load user details');
                }
            } catch (error) {
                console.error('Error loading user:', error);
-                showAlert('Failed to load user details', 'error');
+                showErrorMessage('Failed to load user details');
            }
        }

        // Manage access keys function
        async function manageAccessKeys(username) {
            try {
-                const encodedUsername = encodeURIComponent(username);
-                const response = await fetch(`/api/users/${encodedUsername}`);
+                const response = await fetch(`/api/users/${username}`);
                if (response.ok) {
                    const user = await response.json();
                    document.getElementById('accessKeysUsername').textContent = username;
@@ -795,20 +792,19 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
                    const modal = new bootstrap.Modal(document.getElementById('accessKeysModal'));
                    modal.show();
                } else {
-                    showAlert('Failed to load access keys', 'error');
+                    showErrorMessage('Failed to load access keys');
                }
            } catch (error) {
                console.error('Error loading access keys:', error);
-                showAlert('Failed to load access keys', 'error');
+                showErrorMessage('Failed to load access keys');
            }
        }

        // Delete user function
        async function deleteUser(username) {
-            showDeleteConfirm(username, async function() {
+            if (confirm(`Are you sure you want to delete user "${username}"? This action cannot be undone.`)) {
                try {
-                    const encodedUsername = encodeURIComponent(username);
-                    const response = await fetch(`/api/users/${encodedUsername}`, {
+                    const response = await fetch(`/api/users/${username}`, {
                        method: 'DELETE'
                    });
                    
@@ -823,7 +819,7 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
                    console.error('Error deleting user:', error);
                    showErrorMessage('Failed to delete user: ' + error.message);
                }
-            }, 'Are you sure you want to delete this user? This action cannot be undone.');
+            }
        }

        // Handle create user form submission
@@ -867,11 +863,11 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
                    setTimeout(() => window.location.reload(), 1000);
                } else {
                    const error = await response.json();
-                    showAlert('Failed to create user: ' + (error.error || 'Unknown error'), 'error');
+                    showErrorMessage('Failed to create user: ' + (error.error || 'Unknown error'));
                }
            } catch (error) {
                console.error('Error creating user:', error);
-                showAlert('Failed to create user: ' + error.message, 'error');
+                showErrorMessage('Failed to create user: ' + error.message);
            }
        }

@@ -880,7 +876,7 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
        async function handleUpdateUser() {
            const username = document.getElementById('editUsername').value;
            if (!username) {
-                showAlert('Username is required', 'error');
+                showErrorMessage('Username is required');
                return;
            }
            
@@ -889,13 +885,13 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
            
            // Validate that permissions are not empty
            if (!allActions || allActions.length === 0) {
-                showAlert('At least one permission must be selected', 'error');
+                showErrorMessage('At least one permission must be selected');
                return;
            }
            
            // Check for null (validation failure from buildBucketPermissionsNew)
            if (allActions === null) {
-                showAlert('Please select at least one bucket when using specific bucket permissions', 'error');
+                showErrorMessage('Please select at least one bucket when using specific bucket permissions');
                return;
            }
            
@@ -906,8 +902,7 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
            };
            
            try {
-                const encodedUsername = encodeURIComponent(username);
-                const response = await fetch(`/api/users/${encodedUsername}`, {
+                const response = await fetch(`/api/users/${username}`, {
                    method: 'PUT',
                    headers: {
                        'Content-Type': 'application/json',
@@ -924,11 +919,11 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
                    setTimeout(() => window.location.reload(), 1000);
                } else {
                    const error = await response.json();
-                        showAlert('Failed to update user: ' + (error.error || 'Unknown error'), 'error');
+                    showErrorMessage('Failed to update user: ' + (error.error || 'Unknown error'));
                }
            } catch (error) {
                console.error('Error updating user:', error);
-                showAlert('Failed to update user: ' + error.message, 'error');
+                showErrorMessage('Failed to update user: ' + error.message);
            }
        }

@@ -1033,8 +1028,7 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
        // Refresh access keys list content
        async function refreshAccessKeysList(username) {
            try {
-                const encodedUsername = encodeURIComponent(username);
-                const response = await fetch(`/api/users/${encodedUsername}`);
+                const response = await fetch(`/api/users/${username}`);
                if (response.ok) {
                    const user = await response.json();
                    document.getElementById('accessKeysContent').innerHTML = createAccessKeysContent(user);
@@ -1061,12 +1055,12 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
                    refreshAccessKeysList(username);
                } else {
                    const error = await response.json();
-                        showAlert('Failed to update access key status: ' + (error.error || 'Unknown error'), 'error');
+                    showErrorMessage('Failed to update access key status: ' + (error.error || 'Unknown error'));
                    refreshAccessKeysList(username);
                }
            } catch (error) {
                console.error('Error updating access key status:', error);
-                showAlert('Failed to update access key status: ' + error.message, 'error');
+                showErrorMessage('Failed to update access key status: ' + error.message);
                refreshAccessKeysList(username);
            }
        }
@@ -1076,8 +1070,7 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
            const username = document.getElementById('accessKeysUsername').textContent;
            
            try {
-                const encodedUsername = encodeURIComponent(username);
-                const response = await fetch(`/api/users/${encodedUsername}/access-keys`, {
+                const response = await fetch(`/api/users/${username}/access-keys`, {
                    method: 'POST',
                    headers: {
                        'Content-Type': 'application/json',
@@ -1099,21 +1092,19 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
                    refreshAccessKeysList(username);
                } else {
                    const error = await response.json();
-                        showAlert('Failed to create access key: ' + (error.error || 'Unknown error'), 'error');
+                    showErrorMessage('Failed to create access key: ' + (error.error || 'Unknown error'));
                }
            } catch (error) {
                console.error('Error creating access key:', error);
-                showAlert('Failed to create access key: ' + error.message, 'error');
+                showErrorMessage('Failed to create access key: ' + error.message);
            }
        }

        // Delete access key
        async function deleteAccessKey(username, accessKey) {
-            showDeleteConfirm(accessKey, async function() {
+            if (confirm('Are you sure you want to delete this access key?')) {
                try {
-                    const encodedUsername = encodeURIComponent(username);
-                    const encodedAccessKey = encodeURIComponent(accessKey);
-                    const response = await fetch(`/api/users/${encodedUsername}/access-keys/${encodedAccessKey}`, {
+                    const response = await fetch(`/api/users/${username}/access-keys/${accessKey}`, {
                        method: 'DELETE'
                    });
                    
@@ -1130,7 +1121,7 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
                    console.error('Error deleting access key:', error);
                    showErrorMessage('Failed to delete access key: ' + error.message);
                }
-            }, 'Are you sure you want to delete this access key?');
+            }
        }


@@ -1141,7 +1132,8 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
        }

        function showErrorMessage(message) {
-            showAlert(message, 'error');
+            // Simple implementation - could be enhanced with toast notifications
+            alert('Error: ' + message);
        }

        function escapeHtml(text) {
@@ -351,7 +351,7 @@ templ Policies(data dash.PoliciesData) {
        const policyDocumentText = formData.get('document');
        
        if (!policyName || !policyDocumentText) {
-            showAlert('Please fill in all required fields', 'warning');
+            alert('Please fill in all required fields');
            return;
        }
        
@@ -359,7 +359,7 @@ templ Policies(data dash.PoliciesData) {
        try {
            policyDocument = JSON.parse(policyDocumentText);
        } catch (e) {
-            showAlert('Invalid JSON in policy document: ' + e.message, 'error');
+            alert('Invalid JSON in policy document: ' + e.message);
            return;
        }
        
@@ -378,17 +378,17 @@ templ Policies(data dash.PoliciesData) {
        .then(response => response.json())
        .then(data => {
            if (data.success) {
-                showAlert('Policy created successfully!', 'success');
+                alert('Policy created successfully!');
                const modal = bootstrap.Modal.getInstance(document.getElementById('createPolicyModal'));
                if (modal) modal.hide();
                location.reload(); // Refresh the page to show the new policy
            } else {
-                showAlert('Error creating policy: ' + (data.error || 'Unknown error'), 'error');
+                alert('Error creating policy: ' + (data.error || 'Unknown error'));
            }
        })
        .catch(error => {
            console.error('Error:', error);
-            showAlert('Error creating policy: ' + error.message, 'error');
+            alert('Error creating policy: ' + error.message);
        });
    }
    
@@ -507,7 +507,7 @@ templ Policies(data dash.PoliciesData) {
        })
        .catch(error => {
            console.error('Error:', error);
-            showAlert('Error loading policy for editing: ' + error.message, 'error');
+            alert('Error loading policy for editing: ' + error.message);
            const editModal = bootstrap.Modal.getInstance(document.getElementById('editPolicyModal'));
            if (editModal) editModal.hide();
        });
@@ -518,7 +518,7 @@ templ Policies(data dash.PoliciesData) {
        const policyDocumentText = document.getElementById('editPolicyDocument').value;
        
        if (!policyName || !policyDocumentText) {
-            showAlert('Please fill in all required fields', 'warning');
+            alert('Please fill in all required fields');
            return;
        }
        
@@ -526,7 +526,7 @@ templ Policies(data dash.PoliciesData) {
        try {
            policyDocument = JSON.parse(policyDocumentText);
        } catch (e) {
-            showAlert('Invalid JSON in policy document: ' + e.message, 'error');
+            alert('Invalid JSON in policy document: ' + e.message);
            return;
        }
        
@@ -544,17 +544,17 @@ templ Policies(data dash.PoliciesData) {
        .then(response => response.json())
        .then(data => {
            if (data.success) {
-                showAlert('Policy updated successfully!', 'success');
+                alert('Policy updated successfully!');
                const modal = bootstrap.Modal.getInstance(document.getElementById('editPolicyModal'));
                if (modal) modal.hide();
                location.reload(); // Refresh the page to show the updated policy
            } else {
-                showAlert('Error updating policy: ' + (data.error || 'Unknown error'), 'error');
+                alert('Error updating policy: ' + (data.error || 'Unknown error'));
            }
        })
        .catch(error => {
            console.error('Error:', error);
-            showAlert('Error updating policy: ' + error.message, 'error');
+            alert('Error updating policy: ' + error.message);
        });
    }
    
@@ -610,7 +610,7 @@ templ Policies(data dash.PoliciesData) {
    
    function validatePolicyJSON(policyText) {
        if (!policyText) {
-            showAlert('Please enter a policy document first', 'warning');
+            alert('Please enter a policy document first');
            return;
        }
        
@@ -619,40 +619,40 @@ templ Policies(data dash.PoliciesData) {
            
            // Basic validation
            if (!policy.Version) {
-                showAlert('Policy must have a Version field', 'error');
+                alert('Policy must have a Version field');
                return;
            }
            
            if (!policy.Statement || !Array.isArray(policy.Statement)) {
-                showAlert('Policy must have a Statement array', 'error');
+                alert('Policy must have a Statement array');
                return;
            }
            
-            showAlert('Policy document is valid JSON!', 'success');
+            alert('Policy document is valid JSON!');
        } catch (e) {
-            showAlert('Invalid JSON: ' + e.message, 'error');
+            alert('Invalid JSON: ' + e.message);
        }
    }
    
    function deletePolicy(policyName) {
-        showDeleteConfirm(policyName, function() {
+        if (confirm('Are you sure you want to delete policy "' + policyName + '"?')) {
            fetch('/api/object-store/policies/' + encodeURIComponent(policyName), {
                method: 'DELETE'
            })
            .then(response => response.json())
            .then(data => {
                if (data.success) {
-                    showAlert('Policy deleted successfully!', 'success');
-                    location.reload();
+                    alert('Policy deleted successfully!');
+                    location.reload(); // Refresh the page
                } else {
-                    showAlert('Error deleting policy: ' + (data.error || 'Unknown error'), 'error');
+                    alert('Error deleting policy: ' + (data.error || 'Unknown error'));
                }
            })
            .catch(error => {
                console.error('Error:', error);
-                showAlert('Error deleting policy: ' + error.message, 'error');
+                alert('Error deleting policy: ' + error.message);
            });
-        });
+        }
    }
    </script>
 } 
@@ -335,8 +335,7 @@ templ ServiceAccounts(data dash.ServiceAccountsData) {

        async function showSADetails(id) {
            try {
-                const encodedId = encodeURIComponent(id);
-                const response = await fetch(`/api/service-accounts/${encodedId}`);
+                const response = await fetch(`/api/service-accounts/${id}`);
                if (response.ok) {
                    const sa = await response.json();
                    document.getElementById('saDetailsContent').innerHTML = createSADetailsContent(sa);
@@ -354,8 +353,7 @@ templ ServiceAccounts(data dash.ServiceAccountsData) {
        async function toggleSAStatus(id, currentStatus) {
            const newStatus = currentStatus === 'Active' ? 'Inactive' : 'Active';
            try {
-                const encodedId = encodeURIComponent(id);
-                const response = await fetch(`/api/service-accounts/${encodedId}`, {
+                const response = await fetch(`/api/service-accounts/${id}`, {
                    method: 'PUT',
                    headers: { 'Content-Type': 'application/json' },
                    body: JSON.stringify({ status: newStatus })
@@ -375,10 +373,9 @@ templ ServiceAccounts(data dash.ServiceAccountsData) {
        }

        async function deleteSA(id) {
-            showDeleteConfirm(id, async function() {
+            if (confirm('Are you sure you want to delete this service account? This action cannot be undone.')) {
                try {
-                    const encodedId = encodeURIComponent(id);
-                    const response = await fetch(`/api/service-accounts/${encodedId}`, {
+                    const response = await fetch(`/api/service-accounts/${id}`, {
                        method: 'DELETE'
                    });
                    
@@ -393,7 +390,7 @@ templ ServiceAccounts(data dash.ServiceAccountsData) {
                    console.error('Error deleting service account:', error);
                    showErrorMessage('Failed to delete: ' + error.message);
                }
-            }, 'Are you sure you want to delete this service account? This action cannot be undone.');
+            }
        }

        async function handleCreateServiceAccount() {
@@ -104,13 +104,13 @@ templ TaskConfig(data *maintenance.TaskConfigData) {

    <script>
        function resetForm() {
-            showConfirm('Are you sure you want to reset all settings to their default values?', function() {
+            if (confirm('Are you sure you want to reset all settings to their default values?')) {
                // Find all form inputs and reset them
                const form = document.querySelector('form');
                if (form) {
                    form.reset();
                }
-            });
+            }
        }

        // Auto-save form data to localStorage for recovery
@@ -127,7 +127,7 @@ templ TaskConfigSchema(data *maintenance.TaskConfigData, schema *tasks.TaskConfi

    <script>
        function resetToDefaults() {
-            showConfirm('Are you sure you want to reset to default configuration? This will overwrite your current settings.', function() {
+            if (confirm('Are you sure you want to reset to default configuration? This will overwrite your current settings.')) {
                // Reset form fields to their default values
                const form = document.getElementById('taskConfigForm');
                const schemaFields = window.taskConfigSchema ? window.taskConfigSchema.fields : {};
@@ -154,7 +154,7 @@ templ TaskConfigSchema(data *maintenance.TaskConfigData, schema *tasks.TaskConfi
                        }
                    }
                });
-            });
+            }
        }

        function convertSecondsToTaskIntervalValueUnit(totalSeconds) {
@@ -170,7 +170,7 @@ func TaskConfigSchema(data *maintenance.TaskConfigData, schema *tasks.TaskConfig
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 12, "</div></div></div></div></div></div><script>\n        function resetToDefaults() {\n            showConfirm('Are you sure you want to reset to default configuration? This will overwrite your current settings.', function() {\n                // Reset form fields to their default values\n                const form = document.getElementById('taskConfigForm');\n                const schemaFields = window.taskConfigSchema ? window.taskConfigSchema.fields : {};\n                \n                Object.keys(schemaFields).forEach(fieldName => {\n                    const field = schemaFields[fieldName];\n                    const element = document.getElementById(fieldName);\n                    \n                    if (element && field.default_value !== undefined) {\n                        if (field.input_type === 'checkbox') {\n                            element.checked = field.default_value;\n                        } else if (field.input_type === 'interval') {\n                            // Handle interval fields with value and unit\n                            const valueElement = document.getElementById(fieldName + '_value');\n                            const unitElement = document.getElementById(fieldName + '_unit');\n                            if (valueElement && unitElement && field.default_value) {\n                                const defaultSeconds = field.default_value;\n                                const { value, unit } = convertSecondsToTaskIntervalValueUnit(defaultSeconds);\n                                valueElement.value = value;\n                                unitElement.value = unit;\n                            }\n                        } else {\n                            element.value = field.default_value;\n                        }\n                    }\n                });\n            });\n        }\n\n        function convertSecondsToTaskIntervalValueUnit(totalSeconds) {\n            if (totalSeconds === 0) {\n                return { value: 0, unit: 'minutes' };\n            }\n\n            // Check if it's evenly divisible by days\n            if (totalSeconds % (24 * 3600) === 0) {\n                return { value: totalSeconds / (24 * 3600), unit: 'days' };\n            }\n\n            // Check if it's evenly divisible by hours\n            if (totalSeconds % 3600 === 0) {\n                return { value: totalSeconds / 3600, unit: 'hours' };\n            }\n\n            // Default to minutes\n            return { value: totalSeconds / 60, unit: 'minutes' };\n        }\n\n        // Store schema data for JavaScript access (moved to after div is created)\n    </script><!-- Hidden element to store schema data --><div data-task-schema=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 12, "</div></div></div></div></div></div><script>\n        function resetToDefaults() {\n            if (confirm('Are you sure you want to reset to default configuration? This will overwrite your current settings.')) {\n                // Reset form fields to their default values\n                const form = document.getElementById('taskConfigForm');\n                const schemaFields = window.taskConfigSchema ? window.taskConfigSchema.fields : {};\n                \n                Object.keys(schemaFields).forEach(fieldName => {\n                    const field = schemaFields[fieldName];\n                    const element = document.getElementById(fieldName);\n                    \n                    if (element && field.default_value !== undefined) {\n                        if (field.input_type === 'checkbox') {\n                            element.checked = field.default_value;\n                        } else if (field.input_type === 'interval') {\n                            // Handle interval fields with value and unit\n                            const valueElement = document.getElementById(fieldName + '_value');\n                            const unitElement = document.getElementById(fieldName + '_unit');\n                            if (valueElement && unitElement && field.default_value) {\n                                const defaultSeconds = field.default_value;\n                                const { value, unit } = convertSecondsToTaskIntervalValueUnit(defaultSeconds);\n                                valueElement.value = value;\n                                unitElement.value = unit;\n                            }\n                        } else {\n                            element.value = field.default_value;\n                        }\n                    }\n                });\n            }\n        }\n\n        function convertSecondsToTaskIntervalValueUnit(totalSeconds) {\n            if (totalSeconds === 0) {\n                return { value: 0, unit: 'minutes' };\n            }\n\n            // Check if it's evenly divisible by days\n            if (totalSeconds % (24 * 3600) === 0) {\n                return { value: totalSeconds / (24 * 3600), unit: 'days' };\n            }\n\n            // Check if it's evenly divisible by hours\n            if (totalSeconds % 3600 === 0) {\n                return { value: totalSeconds / 3600, unit: 'hours' };\n            }\n\n            // Default to minutes\n            return { value: totalSeconds / 60, unit: 'minutes' };\n        }\n\n        // Store schema data for JavaScript access (moved to after div is created)\n    </script><!-- Hidden element to store schema data --><div data-task-schema=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -163,7 +163,7 @@ func TaskConfig(data *maintenance.TaskConfigData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 12, "</p></div></div></div></div></div></div></div><script>\n        function resetForm() {\n            showConfirm('Are you sure you want to reset all settings to their default values?', function() {\n                // Find all form inputs and reset them\n                const form = document.querySelector('form');\n                if (form) {\n                    form.reset();\n                }\n            });\n        }\n\n        // Auto-save form data to localStorage for recovery\n        document.addEventListener('DOMContentLoaded', function() {\n            const form = document.querySelector('form');\n            if (form) {\n                const taskType = '{string(data.TaskType)}';\n                const storageKey = 'taskConfig_' + taskType;\n\n                // Load saved data\n                const savedData = localStorage.getItem(storageKey);\n                if (savedData) {\n                    try {\n                        const data = JSON.parse(savedData);\n                        Object.keys(data).forEach(key => {\n                            const input = form.querySelector(`[name=\"${key}\"]`);\n                            if (input) {\n                                if (input.type === 'checkbox') {\n                                    input.checked = data[key];\n                                } else {\n                                    input.value = data[key];\n                                }\n                            }\n                        });\n                    } catch (e) {\n                        console.warn('Failed to load saved configuration:', e);\n                    }\n                }\n\n                // Save data on input change\n                form.addEventListener('input', function() {\n                    const formData = new FormData(form);\n                    const data = {};\n                    for (let [key, value] of formData.entries()) {\n                        data[key] = value;\n                    }\n                    localStorage.setItem(storageKey, JSON.stringify(data));\n                });\n\n                // Clear saved data on successful submit\n                form.addEventListener('submit', function() {\n                    localStorage.removeItem(storageKey);\n                });\n            }\n        });\n    </script>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 12, "</p></div></div></div></div></div></div></div><script>\n        function resetForm() {\n            if (confirm('Are you sure you want to reset all settings to their default values?')) {\n                // Find all form inputs and reset them\n                const form = document.querySelector('form');\n                if (form) {\n                    form.reset();\n                }\n            }\n        }\n\n        // Auto-save form data to localStorage for recovery\n        document.addEventListener('DOMContentLoaded', function() {\n            const form = document.querySelector('form');\n            if (form) {\n                const taskType = '{string(data.TaskType)}';\n                const storageKey = 'taskConfig_' + taskType;\n\n                // Load saved data\n                const savedData = localStorage.getItem(storageKey);\n                if (savedData) {\n                    try {\n                        const data = JSON.parse(savedData);\n                        Object.keys(data).forEach(key => {\n                            const input = form.querySelector(`[name=\"${key}\"]`);\n                            if (input) {\n                                if (input.type === 'checkbox') {\n                                    input.checked = data[key];\n                                } else {\n                                    input.value = data[key];\n                                }\n                            }\n                        });\n                    } catch (e) {\n                        console.warn('Failed to load saved configuration:', e);\n                    }\n                }\n\n                // Save data on input change\n                form.addEventListener('input', function() {\n                    const formData = new FormData(form);\n                    const data = {};\n                    for (let [key, value] of formData.entries()) {\n                        data[key] = value;\n                    }\n                    localStorage.setItem(storageKey, JSON.stringify(data));\n                });\n\n                // Clear saved data on successful submit\n                form.addEventListener('submit', function() {\n                    localStorage.removeItem(storageKey);\n                });\n            }\n        });\n    </script>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -121,9 +121,9 @@ templ TaskConfigTempl(data *TaskConfigTemplData) {

        // Reset form function
        function resetForm() {
-            showConfirm('Are you sure you want to reset all changes?', function() {
+            if (confirm('Are you sure you want to reset all changes?')) {
                location.reload();
-            });
+            }
        }

        // Test configuration function
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Chris Lu	d1fd08e31f	config: set ServiceAccountsDirectory to /etc/iam/service_accounts	2026-01-25 19:10:14 -08:00
Chris Lu	2ad1dc29e8	refactor: standardize Service Accounts as distinct store entities and fix Admin Server persistence	2026-01-25 19:08:18 -08:00
Chris Lu	5ba7b88f7e	refactor: remove configuration.json and migrate Service Accounts to multi-file layout	2026-01-25 18:52:43 -08:00
Chris Lu	6977188029	feat: migrate policies to multi-file layout and fix identity duplicated content	2026-01-25 18:43:05 -08:00
Chris Lu	fe6a95c89b	fix: address code review comments for IAM migration	2026-01-25 14:32:55 -08:00
Chris Lu	9fd5ad9a7e	fix: compilation error in DeleteUser	2026-01-25 14:25:01 -08:00