helm: document admin.allowInsecureBind and drop stale comment

- README and values.yaml now describe the allowInsecureBind escape
  hatch alongside the non-loopback bind guard
- remove a PR reference from the CI test comment

.github/workflows/helm_ci.yml

@@ -118,9 +118,6 @@ jobs:
 
           echo ""
           echo "=== Testing admin.allowInsecureBind satisfies the admin auth render guard ==="
-          # admin.ip defaults to 0.0.0.0 (non-loopback), which weed admin 4.46
-          # refuses to bind without authentication (see PR #11228 for the
-          # -allowInsecureBind opt-out this flag maps to).
           helm template test $CHART_DIR --set admin.enabled=true --set admin.allowInsecureBind=true \
             > /tmp/admin-allow-insecure-bind.yaml
           grep -q -- "-allowInsecureBind" /tmp/admin-allow-insecure-bind.yaml

k8s/charts/seaweedfs/README.md

@@ -376,7 +376,10 @@ start on a non-loopback address without `-adminPassword`, so the chart fails at
 render time if `admin.ip` is non-loopback and authentication is not configured via
 `admin.secret.adminPassword`, `admin.secret.existingSecret`, or
 `WEED_ADMIN_PASSWORD` supplied through `admin.extraEnvironmentVars` /
-`admin.secretExtraEnvironmentVars`. The whole `127.0.0.0/8` range and `::1` are
+`admin.secretExtraEnvironmentVars`. Setting `admin.allowInsecureBind` renders
+`-allowInsecureBind` and bypasses this guard; it leaves the admin API
+unauthenticated on the network, so use it only when access is otherwise
+restricted (e.g. network policies). The whole `127.0.0.0/8` range and `::1` are
 treated as loopback (matching `weed admin`); `localhost` is treated as
 non-loopback. Set `admin.ip` to a loopback address only if you also replace the
 httpGet probes (e.g. with an `exec` probe that checks `127.0.0.1`).

k8s/charts/seaweedfs/templates/shared/_helpers.tpl

@@ -105,13 +105,11 @@ true
 {{- end -}}
 {{- end -}}
 
-{{/* Whether the admin server's non-loopback bind guard is satisfied, from
-     any supported source: admin.secret (adminPassword or existingSecret),
-     WEED_ADMIN_PASSWORD supplied via extraEnvironmentVars /
-     secretExtraEnvironmentVars (which weed admin picks up through viper's
-     AutomaticEnv), or admin.allowInsecureBind (renders -allowInsecureBind,
-     the binary's own explicit opt-out). A secret-backed entry counts as
-     enabled even though the chart cannot read its value. */}}
+{{/* Whether the admin non-loopback bind guard is satisfied: admin.secret
+     (adminPassword or existingSecret), WEED_ADMIN_PASSWORD via
+     extraEnvironmentVars / secretExtraEnvironmentVars, or
+     admin.allowInsecureBind. A secret-backed entry counts as enabled even
+     though the chart cannot read its value. */}}
 {{- define "seaweedfs.admin.authEnabled" -}}
 {{- if or .Values.admin.secret.existingSecret .Values.admin.secret.adminPassword .Values.admin.allowInsecureBind -}}
 true

k8s/charts/seaweedfs/values.yaml

@@ -1339,10 +1339,11 @@ admin:
   # kubelet's httpGet readiness/liveness probes (which dial the pod IP) to ever
   # succeed. "0.0.0.0" restores the pre-4.46 behaviour of listening on all
   # interfaces. A non-loopback address requires authentication: set
-  # admin.secret.adminPassword or admin.secret.existingSecret, or supply
+  # admin.secret.adminPassword or admin.secret.existingSecret, supply
   # WEED_ADMIN_PASSWORD via admin.extraEnvironmentVars /
-  # admin.secretExtraEnvironmentVars; otherwise the admin container will exit
-  # with a clear error rather than silently staying unready. The whole
+  # admin.secretExtraEnvironmentVars, or opt out with admin.allowInsecureBind;
+  # otherwise the admin container will exit with a clear error rather than
+  # silently staying unready. The whole
   # 127.0.0.0/8 range and ::1 are treated as loopback (matching weed admin).
   # Set to a loopback address only if you also replace the httpGet probes.
   # Note: the -ip flag requires SeaweedFS 4.46 or newer; pinning
@@ -1350,8 +1351,7 @@ admin:
   ip: "0.0.0.0"
   loggingOverrideLevel: null
 
-  # Let the admin server bind a non-loopback ip without adminPassword
-  # or mTLS configured.
+  # INSECURE: allow binding a non-loopback ip without authentication.
   allowInsecureBind: false
 
   # Admin authentication