feat(seaweedfs): bump chart to 4.34 - #2918
Conversation
|
Note Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported. |
📝 WalkthroughWalkthroughHelm chart bumped from 4.31 to 4.34. Adds configurable JWT token expiry per operation in ChangesSeaweedFS Helm Chart 4.34 Feature Update
Sequence Diagram(s)sequenceDiagram
participant HelmTemplate as Helm Renderer
participant ValuesYAML as values.yaml
participant SftpCaSecret as sftp-ca-secret.yaml
participant SftpDeployment as sftp-deployment.yaml
participant K8s as Kubernetes
HelmTemplate->>ValuesYAML: read sftp.authMethods, trustedUserCAKeys, existingCAKeysSecret
ValuesYAML-->>HelmTemplate: authMethods includes "certificate"
HelmTemplate->>SftpCaSecret: evaluate inline key conditions
SftpCaSecret->>K8s: create Secret <fullname>-sftp-ca-secret (ca_user.pub)
HelmTemplate->>SftpDeployment: render with certificate auth
SftpDeployment->>K8s: Deployment with -trustedUserCAKeysFile arg, /etc/sw/sftp_ca mount, config-sftp-ca volume
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 Trivy (0.69.3)Trivy execution failed: 2026-06-15T07:50:52Z FATAL Fatal error run error: fs scan error: scan error: scan failed: failed analysis: post analysis error: post analysis error: azure-arm scan error: fs filter error: fs filter error: walk error range error: stat smartylint.json: no such file or directory: range error: stat smartylint.json: no such file or directory Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
packages/system/seaweedfs/charts/seaweedfs/templates/all-in-one/all-in-one-deployment.yaml (1)
329-333:⚠️ Potential issue | 🟠 MajorRemove
subPathmount forsecurity.tomlto enable hot-reload of security configuration.The current
subPathmount at line 331 prevents Kubernetes from refreshing ConfigMap files when they change, causingkill -HUPto fail to reload updated JWT keys and preserving the401: wrong jwtfailure mode. This issue affects all SeaweedFS consumer components (all-in-one, filer, master, volume, worker, s3, sftp, cosi, and admin). Rework this in the upstream SeaweedFS chart to mount a projected or directory volume path forsecurity.tomlinstead, then re-vendor the chart viamake update.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/system/seaweedfs/charts/seaweedfs/templates/all-in-one/all-in-one-deployment.yaml` around lines 329 - 333, The subPath mount in the volumeMount named security-config prevents Kubernetes from hot-reloading updated ConfigMap files, blocking the kill -HUP reload mechanism for security configuration. Remove the subPath: security.toml line from this volumeMount and instead rework the volume mount configuration to use a projected or directory volume path that can detect and refresh ConfigMap changes. This change needs to be implemented in the upstream SeaweedFS chart, then the chart should be re-vendored using make update.Source: Learnings
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In
`@packages/system/seaweedfs/charts/seaweedfs/templates/all-in-one/all-in-one-deployment.yaml`:
- Around line 329-333: The subPath mount in the volumeMount named
security-config prevents Kubernetes from hot-reloading updated ConfigMap files,
blocking the kill -HUP reload mechanism for security configuration. Remove the
subPath: security.toml line from this volumeMount and instead rework the volume
mount configuration to use a projected or directory volume path that can detect
and refresh ConfigMap changes. This change needs to be implemented in the
upstream SeaweedFS chart, then the chart should be re-vendored using make
update.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 4a24752a-1091-4348-bdee-531d50c3e54f
📒 Files selected for processing (9)
packages/system/seaweedfs/charts/seaweedfs/Chart.yamlpackages/system/seaweedfs/charts/seaweedfs/dashboards/seaweedfs-grafana-dashboard.jsonpackages/system/seaweedfs/charts/seaweedfs/templates/all-in-one/all-in-one-deployment.yamlpackages/system/seaweedfs/charts/seaweedfs/templates/sftp/sftp-ca-secret.yamlpackages/system/seaweedfs/charts/seaweedfs/templates/sftp/sftp-deployment.yamlpackages/system/seaweedfs/charts/seaweedfs/templates/shared/_helpers.tplpackages/system/seaweedfs/charts/seaweedfs/templates/shared/post-install-bucket-hook.yamlpackages/system/seaweedfs/charts/seaweedfs/templates/shared/security-configmap.yamlpackages/system/seaweedfs/charts/seaweedfs/values.yaml
Aleksei Sviridkin (lexfrei)
left a comment
There was a problem hiding this comment.
LGTM — faithful, complete make update to upstream SeaweedFS 4.34 with both cozystack patches reapplied cleanly and no customizations lost.
This vendored bump refreshes packages/system/seaweedfs/charts/seaweedfs from 4.31 to 4.34: SIGHUP hot-reload of JWT signing keys, configurable expires_after_seconds (superseding the closed #2911), SFTP certificate auth, a Grafana filer-object-size panel, and a bucket-versioning Suspended fix. I checked the bump against pristine upstream and against the cozystack integration layer.
- Faithful, complete bump. Every changed template (
all-in-one-deployment.yaml,sftp-deployment.yaml,sftp-ca-secret.yaml,shared/_helpers.tpl,shared/post-install-bucket-hook.yaml,shared/security-configmap.yaml) andChart.yamlis byte-identical to upstream tag 4.34 — no partial cherry-pick, no stray hand-edits. Evidence:diffof each file vsraw.githubusercontent.com/seaweedfs/seaweedfs/4.34/k8s/charts/seaweedfs/...reports identical. - Customizations preserved. The two active patches are the only deviations from upstream:
templates/volume/volume-resize-hook.yamlkeepspolicy.cozystack.io/allow-to-apiserver: "true"andtemplates/cert/ca-cert.yamlkeepsprivateKey.rotationPolicy: Never. Evidence:diffvs upstream 4.34 shows exactly those additions (3 lines / 2 lines) and nothing else; both appear inhelm templateoutput. - Durable, not hand-edited. cozystack customizations live in
patches/*.{diff,patch}(re-applied by themake updatetarget) and in the non-vendoredvalues.yaml/templates//tests/— none of which this PR touches. Evidence: the PR diff is confined tocharts/seaweedfs/**;patches/resize-api-server-annotation.diffandpatches/disable-ca-key-rotation.patchare present and consistent with the rendered output. - No breaking changes for cozystack. New keys (
securityConfig.jwtSigning.expiresAfterSeconds.*,sftp.trustedUserCAKeys,sftp.existingCAKeysSecret, and theallInOnemirrors) all ship safe defaults (0/""/null); the newfailguards fire only whencertificateis inauthMethods, which cozystack does not set, and both SFTP and allInOne are disabled in cozystack's values, so the new logic is dormant. Evidence:packages/system/seaweedfs/values.yamlconfigures separate master/volume/filer/s3/cosi withenableSecurity: trueand nosftp/allInOneblock. - Renders and tests pass.
helm templateof the package exits 0 (with theallow-to-apiserverpatch visible) andhelm unittestpasses 3/3. Evidence: local run, exit 0;tests/s3_traffic_distribution_test.yamlgreen.
Non-blocking:
- The package
Makefileupdatetarget resolves the upstream version to the newest tag at run time (git ls-remote --tags --sort="v:refname" ... END{print}) rather than a pinned4.34. Upstream is already at 4.35, so re-runningmake updatetoday advances past 4.34 instead of reproducing this bump. A pinned target version would make vendored bumps reproducible. Pre-existing, not introduced here. Evidence:packages/system/seaweedfs/Makefileupdatetarget; upstreamChart.yamlat tag 4.35 reportsversion: 4.35.0.
Pulls in upstream SeaweedFS 4.34, which includes: - SIGHUP-based hot-reload of JWT signing keys (seaweedfs/seaweedfs#9826, fixing seaweedfs/seaweedfs#9823). Operators recovering from key rotation or mismatch no longer need to restart 'weed' processes — kill -HUP is enough. - Native 'expires_after_seconds' values for jwt.signing / jwt.signing.read / jwt.filer_signing / jwt.filer_signing.read, exposed under global.seaweedfs.securityConfig.jwtSigning.expiresAfterSeconds. This supersedes the patch in the now-closed cozystack#2911. 'make update' driven; patches in 'patches/' reapplied cleanly. Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
c692a16 to
2261e3b
Compare
Summary
Pulls in upstream SeaweedFS 4.34, which includes:
weedprocesses —kill -HUPis enough.expires_after_secondsvalues forjwt.signing/jwt.signing.read/jwt.filer_signing/jwt.filer_signing.read, exposed underglobal.seaweedfs.securityConfig.jwtSigning.expiresAfterSeconds. This supersedes the patch attempted in the now-closed feat(seaweedfs): expose JWTexpires_after_secondsvia values #2911.make updatedriven; patches inpatches/(resize-api-server-annotation, disable-ca-key-rotation) reapply cleanly against 4.34.Supersedes #2913.
Test plan
Summary by CodeRabbit
New Features
Bug Fixes
Chores