feat(seaweedfs): bump chart to 4.34 by IvanHunters · Pull Request #2913 · cozystack/cozystack

IvanHunters · 2026-06-12T15:26:03Z

Summary

Pulls in upstream SeaweedFS 4.34, which includes:

SIGHUP-based hot-reload of JWT signing keys (security: hot-reload JWT signing keys on SIGHUP seaweedfs/seaweedfs#9826, fixing JWT signing key is loaded once at startup, never reloaded — recovery from key mismatch requires process restart seaweedfs/seaweedfs#9823). Operators recovering from key rotation or mismatch no longer need to restart weed processes — kill -HUP is enough.
Native expires_after_seconds values for jwt.signing / jwt.signing.read / jwt.filer_signing / jwt.filer_signing.read, exposed under global.seaweedfs.securityConfig.jwtSigning.expiresAfterSeconds. This supersedes the patch attempted in the now-closed feat(seaweedfs): expose JWT expires_after_seconds via values #2911.

`make update` driven; patches in `patches/` (resize-api-server-annotation, disable-ca-key-rotation) reapply cleanly against 4.34.

Test plan

CI green (chart lint + helm unittest + e2e)
Manual: install 4.34 chart in dev cluster, kill -HUP master pod after rotating jwt.signing key in security.toml, verify volume/master/filer pick up new key without restart
Manual: set values.global.seaweedfs.securityConfig.jwtSigning.expiresAfterSeconds.volumeWrite=3600, verify rendered security.toml contains the field

Summary by CodeRabbit

Release Notes – Version 4.34

New Features
- Added SFTP certificate-based user authentication with configurable trusted CA keys
- Introduced JWT token expiration configuration for volume and filer operations
- Added new Grafana dashboard panels for monitoring object size distribution metrics
Improvements
- Enhanced bucket versioning control with suspended state handling
Chores
- Upgraded to version 4.34

gemini-code-assist · 2026-06-12T15:26:09Z

Note

Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported.

coderabbitai · 2026-06-12T15:26:18Z

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 0e256c13-17a5-4700-8418-0511cbc708b9

📥 Commits

Reviewing files that changed from the base of the PR and between d634f11 and c692a16.

📒 Files selected for processing (9)

packages/system/seaweedfs/charts/seaweedfs/Chart.yaml
packages/system/seaweedfs/charts/seaweedfs/dashboards/seaweedfs-grafana-dashboard.json
packages/system/seaweedfs/charts/seaweedfs/templates/all-in-one/all-in-one-deployment.yaml
packages/system/seaweedfs/charts/seaweedfs/templates/sftp/sftp-ca-secret.yaml
packages/system/seaweedfs/charts/seaweedfs/templates/sftp/sftp-deployment.yaml
packages/system/seaweedfs/charts/seaweedfs/templates/shared/_helpers.tpl
packages/system/seaweedfs/charts/seaweedfs/templates/shared/post-install-bucket-hook.yaml
packages/system/seaweedfs/charts/seaweedfs/templates/shared/security-configmap.yaml
packages/system/seaweedfs/charts/seaweedfs/values.yaml

📝 Walkthrough

Walkthrough

SeaweedFS Helm chart bumped from v4.31 to v4.34. SFTP certificate-based authentication added for both standalone and all-in-one deployments, including a new CA Secret template. JWT token expiry is now configurable per signing mode. Two new Grafana panels visualize filer object size distribution. Bucket versioning Suspended case is fixed, and all-in-one extra env var rendering is refactored.

Changes

SeaweedFS Chart v4.34 Updates

Layer / File(s)	Summary
Chart version bump to 4.34 `packages/system/seaweedfs/charts/seaweedfs/Chart.yaml`	`appVersion` and chart `version` bumped from `4.31`/`4.31.0` to `4.34`/`4.34.0`.
JWT token expiry configuration `values.yaml`, `templates/shared/_helpers.tpl`, `templates/shared/security-configmap.yaml`	New `jwtSigning.expiresAfterSeconds` value subtree with per-mode fields; `seaweedfs.securityConfigEnabled` helper expanded for volumeWrite expiry; security configmap conditionally emits `expires_after_seconds` per JWT mode.
SFTP certificate auth values schema `values.yaml`	New `sftp.trustedUserCAKeys`, `sftp.existingCAKeysSecret`, `allInOne.sftp.trustedUserCAKeys`, and `allInOne.sftp.existingCAKeysSecret` keys added; `authMethods` comment updated to document `certificate`.
SFTP CA Secret template `templates/sftp/sftp-ca-secret.yaml`	New Helm template conditionally renders an Opaque Secret containing `ca_user.pub` from inline CA keys, with standalone/all-in-one value resolution.
Standalone SFTP deployment certificate auth `templates/sftp/sftp-deployment.yaml`	Conditionally appends `-trustedUserCAKeysFile` CLI flag, mounts `config-sftp-ca` volume at `/etc/sw/sftp_ca`, and fails rendering if certificate auth is enabled without CA configuration.
All-in-one SFTP cert auth and env var refactor `templates/all-in-one/all-in-one-deployment.yaml`	Adds SFTP cert CLI arg, volume mount, and `config-sftp-ca` volume with fail guard. Refactors extra env var rendering to use `seaweedfs.mergeExtraEnvironmentVars` with sorted key iteration.
Grafana filer object size distribution panels `dashboards/seaweedfs-grafana-dashboard.json`	New "Filer Object Size Distribution" row with a timeseries panel (`rate()` bucket-difference) and a bargauge panel (`increase()` over `[$__range]`) across size thresholds 1KB–>1GB.
Bucket versioning fix and S3 docs cleanup `templates/shared/post-install-bucket-hook.yaml`, `values.yaml`	Bucket hook now explicitly sets `"Suspended"` when `versioning: false`. S3 `versioning` comments updated to specify `bool true/false` format in three sections.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

cozystack/cozystack#2834: Directly touches the same post-install-bucket-hook.yaml template and bucket versioning boolean normalization logic that this PR extends with the "Suspended" case.

Suggested labels

size/L, backport

Suggested reviewers

kvaps
lllamnyp
androndo
sircthulhu

🐇 A hop and a skip, the version is new,
From 4.31 the filer just flew!
Certificates dancing with SSH today,
JWT tokens expire the right way,
And Grafana charts show each object's size play! 🎉

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The pull request title accurately summarizes the main change: bumping the SeaweedFS Helm chart from version 4.31 to 4.33, which is confirmed by the Chart.yaml updates and the overall PR objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Trivy (0.69.3)

Trivy execution failed: 2026-06-15T07:49:39Z FATAL Fatal error run error: fs scan error: scan error: scan failed: failed analysis: post analysis error: post analysis error: kubernetes scan error: fs filter error: fs filter error: walk error range error: stat smartylint.json: no such file or directory: range error: stat smartylint.json: no such file or directory

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@packages/system/seaweedfs/charts/seaweedfs/templates/sftp/sftp-ca-secret.yaml`:
- Around line 10-24: The template is incorrectly reading allInOne.sftp.* when
only allInOne.enabled is true; change each override guard that currently uses
.Values.allInOne.enabled to require both .Values.allInOne.enabled and
.Values.allInOne.sftp.enabled before copying any allInOne.sftp.* values
(specifically the overrides for $authMethods, $inlineCAKeys, and
$existingSecret), and also change the top-level conditional that decides to
render the CA secret to require .Values.allInOne.sftp.enabled in addition to
.Values.allInOne.enabled so generated secrets are only suppressed when the
all-in-one SFTP feature is explicitly enabled; apply the same gating logic
upstream and re-vendor here.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: b95af626-778d-47a3-a5ea-3696ec9c0ce0

📥 Commits

Reviewing files that changed from the base of the PR and between 25a6b56 and d634f11.

📒 Files selected for processing (9)

packages/system/seaweedfs/charts/seaweedfs/Chart.yaml
packages/system/seaweedfs/charts/seaweedfs/dashboards/seaweedfs-grafana-dashboard.json
packages/system/seaweedfs/charts/seaweedfs/templates/all-in-one/all-in-one-deployment.yaml
packages/system/seaweedfs/charts/seaweedfs/templates/cert/ca-cert.yaml
packages/system/seaweedfs/charts/seaweedfs/templates/sftp/sftp-ca-secret.yaml
packages/system/seaweedfs/charts/seaweedfs/templates/sftp/sftp-deployment.yaml
packages/system/seaweedfs/charts/seaweedfs/templates/shared/post-install-bucket-hook.yaml
packages/system/seaweedfs/charts/seaweedfs/templates/volume/volume-resize-hook.yaml
packages/system/seaweedfs/charts/seaweedfs/values.yaml

💤 Files with no reviewable changes (2)

packages/system/seaweedfs/charts/seaweedfs/templates/cert/ca-cert.yaml
packages/system/seaweedfs/charts/seaweedfs/templates/volume/volume-resize-hook.yaml

Andrei Kvapil (kvaps) · 2026-06-13T06:48:27Z

Heads-up: this bump will keep failing E2E the same way #2834 already broke it on main — the failure is not flaky. Two regressions came with chart 4.31 and are still present in 4.33:

S3 serves plain HTTP while our probes expect HTTPS. In 4.05 -cert.file/-key.file were rendered whenever enableSecurity was on, so weed s3 served TLS on the main port (8333) and our readinessProbe.httpGet.scheme: HTTPS matched. Since 4.31 the TLS args are nested inside {{- if .Values.s3.httpsPort }} (templates/s3/s3-deployment.yaml), and we ship s3.httpsPort: 0 — so no TLS args render, s3 serves HTTP, and the probes fail with server gave HTTP response to HTTPS client. Fix direction: render seaweedfs.s3.tlsArgs whenever enableSecurity is set (4.05 semantics), or wire httpsPort through our values.
COSI provisioner ServiceAccount name mismatch (upstream chart bug). cosi-service-account.yaml names the SA {{ .Values.global.seaweedfs.serviceAccountName }}-objectstorage-provisioner while cosi-deployment.yaml references {{ include "seaweedfs.componentName" (list . "objectstorage-provisioner") }} (<release>-objectstorage-provisioner). Whenever serviceAccountName != release name — our case: tenant-root-seaweedfs vs seaweedfs-system — the Deployment can't create pods (serviceaccount "...-objectstorage-provisioner" not found). The two templates must derive the name the same way.
Related: packages/extra/seaweedfs/templates/seaweedfs.yaml:133 still passes the pre-4.18 global.serviceAccountName layout; since 4.31 the chart reads global.seaweedfs.serviceAccountName, so the per-tenant SA override lands in a dead key.

Both (1) and (2) reproduce with a plain helm template of packages/system/seaweedfs — no cluster needed.

Pulls in upstream SeaweedFS 4.34, which includes: - SIGHUP-based hot-reload of JWT signing keys (seaweedfs/seaweedfs#9826, fixing seaweedfs/seaweedfs#9823). Operators recovering from key rotation or mismatch no longer need to restart 'weed' processes — kill -HUP is enough. - Native 'expires_after_seconds' values for jwt.signing / jwt.signing.read / jwt.filer_signing / jwt.filer_signing.read, exposed under global.seaweedfs.securityConfig.jwtSigning.expiresAfterSeconds. This supersedes the patch in the now-closed cozystack#2911. 'make update' driven; patches in 'patches/' reapplied cleanly. Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>

IvanHunters · 2026-06-15T07:50:10Z

Superseded by #2918 (rebased on cleaner branch name feat/bump-seaweedfs-4.34, same commit content).

IvanHunters requested review from Andrey Kolkov (androndo), Andrei Kvapil (kvaps), Aleksei Sviridkin (lexfrei), Timofei Larkin (lllamnyp), myasnikovdaniil and Kirill Ilin (sircthulhu) as code owners June 12, 2026 15:26

github-actions Bot added area/storage Issues or PRs related to storage (linstor, seaweedfs, bucket, velero, harbor) kind/feature Categorizes issue or PR as related to a new feature size/XS This PR changes 0-9 lines, ignoring generated files labels Jun 12, 2026

dosubot Bot added the lifecycle/active Indicates that an issue or PR is actively being worked on by a contributor label Jun 12, 2026

coderabbitai Bot reviewed Jun 12, 2026

View reviewed changes

Comment thread packages/system/seaweedfs/charts/seaweedfs/templates/sftp/sftp-ca-secret.yaml

Andrei Kvapil (kvaps) mentioned this pull request Jun 12, 2026

feat(keycloak): allow overriding the database host/port/properties #2907

Merged

IvanHunters force-pushed the feat/bump-seaweedfs-4.33 branch from d634f11 to c692a16 Compare June 15, 2026 07:48

IvanHunters changed the title ~~feat(seaweedfs): bump chart to 4.33~~ feat(seaweedfs): bump chart to 4.34 Jun 15, 2026

IvanHunters mentioned this pull request Jun 15, 2026

feat(seaweedfs): bump chart to 4.34 #2918

Open

3 tasks

IvanHunters closed this Jun 15, 2026

IvanHunters deleted the feat/bump-seaweedfs-4.33 branch June 15, 2026 07:50

Navigation Menu

Uh oh!

feat(seaweedfs): bump chart to 4.34 - #2913

feat(seaweedfs): bump chart to 4.34#2913
IvanHunters wants to merge 1 commit into
cozystack:mainfrom
IvanHunters:feat/bump-seaweedfs-4.33

IvanHunters commented Jun 12, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

gemini-code-assist Bot commented Jun 12, 2026

Uh oh!

coderabbitai Bot commented Jun 12, 2026 •

edited

Loading

Review failed

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Suggested reviewers

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Andrei Kvapil (kvaps) commented Jun 13, 2026

Uh oh!

IvanHunters commented Jun 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

IvanHunters commented Jun 12, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Summary by CodeRabbit

Release Notes – Version 4.34

Uh oh!

gemini-code-assist Bot commented Jun 12, 2026

Uh oh!

coderabbitai Bot commented Jun 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review failed

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Suggested reviewers

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Andrei Kvapil (kvaps) commented Jun 13, 2026

Uh oh!

IvanHunters commented Jun 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

IvanHunters commented Jun 12, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jun 12, 2026 •

edited

Loading