Update SeaweedFS v4.02 - #1725

Reviewing files that changed from the base of the PR and between 1f0b5ff and 1805be3.

• packages/system/seaweedfs/Makefile (0 hunks)
• packages/system/seaweedfs/charts/seaweedfs/Chart.yaml (1 hunks)
• packages/system/seaweedfs/charts/seaweedfs/templates/all-in-one/all-in-one-deployment.yaml (9 hunks)
• packages/system/seaweedfs/charts/seaweedfs/templates/all-in-one/all-in-one-pvc.yaml (1 hunks)
• packages/system/seaweedfs/charts/seaweedfs/templates/all-in-one/all-in-one-service.yml (3 hunks)
• packages/system/seaweedfs/charts/seaweedfs/templates/cert/ca-cert.yaml (1 hunks)
• packages/system/seaweedfs/charts/seaweedfs/templates/filer/filer-ingress.yaml (2 hunks)
• packages/system/seaweedfs/charts/seaweedfs/templates/filer/filer-statefulset.yaml (5 hunks)
• packages/system/seaweedfs/charts/seaweedfs/templates/master/master-statefulset.yaml (4 hunks)
• packages/system/seaweedfs/charts/seaweedfs/templates/s3/s3-deployment.yaml (2 hunks)
• packages/system/seaweedfs/charts/seaweedfs/templates/s3/s3-ingress.yaml (2 hunks)
• packages/system/seaweedfs/charts/seaweedfs/templates/shared/post-install-bucket-hook.yaml (4 hunks)
• packages/system/seaweedfs/charts/seaweedfs/templates/volume/volume-statefulset.yaml (2 hunks)
• packages/system/seaweedfs/charts/seaweedfs/values.yaml (13 hunks)
• packages/system/seaweedfs/images/seaweedfs/Dockerfile (1 hunks)
• packages/system/seaweedfs/patches/long-term-ca.diff (0 hunks)

• packages/system/seaweedfs/Makefile
• packages/system/seaweedfs/patches/long-term-ca.diff

• GitHub Check: Build

packages/system/seaweedfs/images/seaweedfs/Dockerfile (1)

1-2: LGTM. Version bump is clean and correctly referenced in the FROM statement.

packages/system/seaweedfs/charts/seaweedfs/Chart.yaml (1)

1-6: Verify chart vendoring compliance. Per coding guidelines, charts in the charts/ directory should use the umbrella pattern and vendor upstream charts rather than directly modifying them. Please confirm whether this chart is a custom cozystack chart for SeaweedFS or a vendored upstream chart that should follow the vendoring approach.

packages/system/seaweedfs/charts/seaweedfs/templates/filer/filer-statefulset.yaml (2)

289-289: Verify probe configuration paths in values.yaml. Lines 289 and 301 reference .Values.filer.readinessProbe.httpGet.scheme and .Values.filer.livenessProbe.httpGet.scheme, indicating a restructured probe configuration. This change pattern appears across all statefulset templates. Ensure values.yaml has been updated to provide these nested paths; otherwise, templates will fail at render time with undefined variable errors.

Also applies to: 301-301

---

392-408: Correct Kubernetes PVC object structure. The volumeClaimTemplates entries now explicitly include apiVersion: v1 and kind: PersistentVolumeClaim, which properly aligns with Kubernetes object specifications. This is correct and consistent with the updated master and volume statefulset templates.

Also applies to: 413-427, 429-443

packages/system/seaweedfs/charts/seaweedfs/templates/cert/ca-cert.yaml (1)

16-21: Conditional certificate duration is correct. The optional rendering of duration and renewBefore aligns with the removal of the long-term-ca.diff patch and makes these fields configurable. Verify that values.yaml properly defines .Values.certificates.ca.duration and .Values.certificates.ca.renewBefore with sensible defaults or clear documentation marking them as optional.

packages/system/seaweedfs/charts/seaweedfs/templates/s3/s3-deployment.yaml (1)

204-204: Probe scheme paths consistent across templates. The httpGet.scheme references match the pattern applied to filer, volume, and master components. Ensure that probe configuration restructuring has been applied uniformly to values.yaml.

Also applies to: 216-216

packages/system/seaweedfs/charts/seaweedfs/templates/volume/volume-statefulset.yaml (1)

254-254: Probe scheme references consistent. The httpGet.scheme references follow the pattern applied uniformly across all statefulset templates. This consistency is good for maintainability.

Also applies to: 266-266

packages/system/seaweedfs/charts/seaweedfs/templates/master/master-statefulset.yaml (2)

238-238: Probe scheme references consistent across components. The httpGet.scheme pattern is uniformly applied. This consistency improves maintainability.

Also applies to: 250-250

---

330-331: Correct PVC object structure. The explicit apiVersion: v1 and kind: PersistentVolumeClaim headers are correct and consistent with filer-statefulset updates.

Also applies to: 346-347

packages/system/seaweedfs/charts/seaweedfs/templates/filer/filer-ingress.yaml (3)

1-5: Dynamic service naming enables all-in-one mode support. Lines 1–5 introduce logic to support both standard filer and all-in-one deployment modes via a computed service name. The ternary operator correctly selects the service name (-all-in-one vs. -filer) based on deployment mode. Verify that values.yaml defines allInOne.enabled with appropriate defaults and that the all-in-one deployment creates a service using the expected naming convention.

---

39-39: Service name resolution applied consistently across API versions. The computed $serviceName is correctly used in both modern (>=1.19) and legacy Kubernetes API versions, ensuring consistent behavior across clusters.

Also applies to: 43-43

---

1-1: YAMLlint syntax warning is a false positive. The static analysis tool flagged a syntax error on line 1, but the {{- Helm template syntax (with - for whitespace trimming) is valid YAML template syntax. This warning can be safely ignored or suppressed in the linter configuration.

packages/system/seaweedfs/charts/seaweedfs/templates/all-in-one/all-in-one-service.yml (3)

18-20: Service type and update policy correctly configured with defaults.

Default values align with Kubernetes conventions (ClusterIP, Cluster traffic policy).

---

54-62: Port resolution pattern is clean and consistent.

S3 and SFTP port handling properly chains allInOne.* values with fallbacks to global s3.* and sftp.* values. Temporary variable $httpsPort is well-scoped and only rendered when set.

---

1-1: No action required. This is a custom Helm chart implementation, not a vendored upstream chart. The vendoring concern does not apply.

Likely an incorrect or invalid review comment.

packages/system/seaweedfs/charts/seaweedfs/templates/s3/s3-ingress.yaml (2)

1-6: Deployment-mode aware ingress gate and service naming is well-structured.

The three-way OR condition properly handles: standalone S3, S3-on-Filer (non-allInOne), and allInOne modes. Service name ternary cleanly switches between -s3 and -all-in-one suffixes. Port resolution chains allInOne.s3.port → s3.port.

---

38-46: Backend service references correctly use computed variables.

Kubernetes version checks (≥1.19, ≥1.14, <1.14) properly branch between service.name/port.number and serviceName/servicePort formats. Both branches use the same $serviceName and $s3Port variables, ensuring consistency.

packages/system/seaweedfs/charts/seaweedfs/templates/all-in-one/all-in-one-pvc.yaml (2)

1-2: Nested conditionals correctly guard PVC creation.

PVC only renders when allInOne is both enabled and configured for persistentVolumeClaim storage type. Proper gating prevents orphaned resources.

---

14-26: Storage configuration with sensible defaults.

Annotations and accessModes handle nil/empty values gracefully. Storage size defaults to "10Gi" when unspecified—a reasonable default for all-in-one deployments. StorageClass conditional (lines 21-23) prevents empty string values from being rendered.

packages/system/seaweedfs/charts/seaweedfs/templates/shared/post-install-bucket-hook.yaml (4)

1-27: Mode-agnostic bucket initialization with cascading fallbacks.

Initialization correctly:

1. Prefers allInOne mode if enabled, with fallbacks to s3 and filer.s3 values
2. Falls back to standalone filer mode if allInOne is disabled
3. Uses OR logic for enableAuth and existingConfigSecret to try allInOne first, then global s3, then filer.s3

This allows flexible override hierarchies without repetition.

---

61-63: Address resolution via template includes is clean and reusable.

Using include "seaweedfs.cluster.masterAddress" and include "seaweedfs.cluster.filerAddress" is better than inline string templates. This centralizes address logic and makes it easier to update in one place.

---

100-106: Readiness probe paths correctly switch based on deployment mode.

When allInOne is enabled, probes use allInOne.readinessProbe.httpGet.path. Otherwise, they fall back to master.readinessProbe.httpGet.path and filer.readinessProbe.httpGet.path. This ensures the Job waits for the correct service to be ready.

---

107-121: Bucket creation loop is simplified and consistent.

Iteration over $createBuckets collection by .name eliminates nested region-based conditionals. Anonymous read configuration correctly checks the .anonymousRead flag per bucket.

packages/system/seaweedfs/charts/seaweedfs/templates/all-in-one/all-in-one-deployment.yaml (6)

18-20: Replicas and update strategy properly configured with safe defaults.

Single replica default with "Recreate" strategy aligns with comment about data conflict risks in multi-replica setups. RollingUpdate would require shared storage (ReadWriteMany), which is noted in values.yaml.

---

83-139: Environment variable handling correctly prevents conflicts and merges sources.

Complex logic at lines 84-87 extracts cluster endpoint keys from merged global/allInOne vars to avoid duplication, then iterates both sources (lines 102-127) skipping those keys. secretExtraEnvironmentVars (lines 133-139) properly unpacks valueFrom references. This prevents accidental overrides and supports both direct values and secret references.

---

236-255: S3 configuration cascades cleanly through allInOne → s3 → filer.s3 fallbacks.

Port, domain, HTTPS port, auth check, and audit log config all use consistent temporary-variable or OR-chain patterns to prefer allInOne values first. This allows per-deployment-mode tuning without code duplication.

---

259-295: SFTP configuration is comprehensive with consistent fallback patterns.

All SFTP options (port, SSH key, host keys folder, auth methods, etc.) use cascading defaults from allInOne → sftp global values. Allows granular per-feature override. enableAuth logic correctly ORs allInOne and sftp flags (line 292).

---

296-299: extraArgs rendering uses add1 for proper backslash continuation.

Line continuation logic (checking if add1 $i equals total count) correctly adds backslash between args but not after the last one. Fragile if someone uses multiline args, but acceptable for typical use cases.

---

386-386: Probe schemes are properly defined in values.yaml.

Both readiness and liveness probes reference .Values.allInOne.readinessProbe.httpGet.scheme and .Values.allInOne.livenessProbe.httpGet.scheme, which are correctly configured in values.yaml with the value "HTTP".

packages/system/seaweedfs/charts/seaweedfs/values.yaml (3)

25-26: Global certificate and monitoring configuration properly extended.

New global.certificates.duration/renewBefore (10yr/30d) and certificates.ca section align with certificate-manager best practices. global.monitoring fields (gatewayHost, gatewayPort, additionalLabels) add optional Prometheus configuration. All default to null/empty for opt-in behavior.

Also applies to: 30-32, 1343-1345

---

1096-1096: allInOne deployment mode configuration is comprehensive and well-documented.

Replicas, updateStrategy, S3/SFTP subsections all use null-defaults for inheritance from global settings, allowing deployment-mode-specific overrides. Comments explain multi-replica storage requirements. Probe configs (lines 1194-1206) match deployment template references. Safe defaults (disabled features, empty auth, emptyDir storage).

Also applies to: 1113-1113, 1121-1163

---

240-240: These are upstream SeaweedFS v4.0.402 defaults, not direct chart modifications. The vendoring approach is correctly implemented—the Makefile downloads the upstream chart and applies selective template patches. The chart's default className: "" and s3.enabled: false are properly overridden by the parent values.yaml (lines 78 and 102), which sets s3.enabled: true and className: "tenant-root" for actual deployment. No changes needed.

Likely an incorrect or invalid review comment.