helm: add commonLabels to the metadata of every object (#12257)

* helm: add commonLabels to the metadata of every object

The chart lets users label pods (podLabels, <component>.podLabels) and
annotate workloads, but offers no way to label the objects themselves.
Backup, ownership and cost policies usually select StatefulSets,
Deployments, Services, PVCs or Secrets by label, and umbrella charts
that set such labels on all their workloads have to patch this chart
to do it.

commonLabels is added to the metadata labels of every object the chart
renders, through one seaweedfs.commonLabels helper. Values may hold
templates, and the whole value may be a template string rendering to a
map, so a parent chart can pass its own labels down. The chart's
app.kubernetes.io/{name,instance,component,managed-by} and helm.sh/chart
keys are dropped, and keys an object already sets (ingress.labels,
httpRoute.labels, monitoring.additionalLabels, grafana_dashboard) win,
so selectors never change and no key renders twice.

Pod templates are left alone (podLabels covers them, and a label change
would roll the pods), as are volumeClaimTemplates, which cannot change
on an existing StatefulSet. checksum/master-config now hashes the master
ConfigMap as rendered without commonLabels, so labels do not roll the
masters either; its value is unchanged.

With commonLabels empty, the default, every template renders exactly as
before. Adds a helm_ci check that labels a release with most components
on and asserts every object carries the labels and nothing else changes.

* helm: do not reject a commonLabels key literally named Error

fromYaml reports parse failures as an {"Error": msg} map, so checking
for that key also matches a user-supplied label of the same name. Only
treat Error as a parse failure when the raw value was not already a
map, so {Error: tracked} renders while non-map input still fails.

* helm: exclude the filer monitoring label from commonLabels

filer.metricsPort adds a hardcoded monitoring: "true" label, which
collided with a monitoring key in commonLabels and rendered a duplicate
map key. Exclude it while metricsPort is set so the object's label wins,
and keep the user's label when it is not.

* helm: accept a templated commonLabels string with an Error key

fromYaml reports a parse failure as a one-key map {Error: "error ..."}, so a
templated string such as 'Error: x' was taken for a parse error. Only fail
when the value is not a map and fromYaml returned its error shape.

* helm ci: keep ConfigMap data in the commonLabels render comparison

Generated Secrets still need normalizing, but the security ConfigMap was
only non-deterministic because of its default jwt signing key. Disable
that key for this render and compare ConfigMap payloads like everything
else so a commonLabels regression in data is caught.

* helm ci: render the security ConfigMap in the commonLabels comparison

Disabling jwtSigning.volumeWrite alone makes securityConfigEnabled false,
so the ConfigMap was absent from the render instead of compared. Enable
mTLS without the generated key so the object is rendered deterministically
and both its labels and data are covered.

* helm ci: strip only generated-credential secret payloads in the commonLabels comparison

* helm ci: assert the effective non-reserved commonLabels

* helm: render integral numeric commonLabels without exponent

---------

Co-authored-by: jeffWild <20067853+jeffWild@users.noreply.github.com>
Co-authored-by: chrislusf <chrislusf@users.noreply.github.com>
Co-authored-by: Chris Lu <chris.lu@gmail.com>

.github/workflows/helm_ci.yml

@@ -1934,6 +1934,121 @@ jobs:
           PYEOF
           echo "License + master persistence tests passed"
 
+          echo ""
+          echo "=== Testing commonLabels ==="
+          python3 - "$CHART_DIR" <<'PYEOF'
+          import copy, subprocess, sys, yaml
+          chart = sys.argv[1]
+
+          class NoDuplicates(yaml.SafeLoader):
+              pass
+          def mapping(loader, node, deep=False):
+              keys = [loader.construct_object(k, deep=deep) for k, _ in node.value]
+              dups = {k for k in keys if keys.count(k) > 1}
+              if dups:
+                  raise ValueError(f"duplicate keys {dups} at line {node.start_mark.line + 1}")
+              return yaml.SafeLoader.construct_mapping(loader, node, deep)
+          NoDuplicates.add_constructor(yaml.resolver.BaseResolver.DEFAULT_MAPPING_TAG, mapping)
+
+          BASE = [
+              "--set", "global.seaweedfs.enableSecurity=true",
+              "--set", "global.seaweedfs.monitoring.enabled=true",
+              "--set", "global.seaweedfs.monitoring.additionalLabels.release=prometheus",
+              "--set", "master.data.type=persistentVolumeClaim",
+              "--set", "master.ingress.enabled=true",
+              "--set", "master.ingress.labels.team=ingress",
+              "--set", "filer.data.type=persistentVolumeClaim",
+              "--set", "filer.ingresses.http.enabled=true",
+              "--set", "s3.enabled=true", "--set", "s3.enableAuth=true",
+              "--set", "s3.httpRoute.enabled=true",
+              "--set", "sftp.enabled=true", "--set", "worker.enabled=true",
+              "--set", "admin.enabled=true", "--set", "admin.secret.adminPassword=ci",
+              "--set", "cosi.enabled=true", "--set", "networkPolicy.enabled=true",
+              "--set", "volumes.dc2.replicas=1",
+              # render the security ConfigMap without its generated jwt key
+              "--set", "global.seaweedfs.enableSecurity=true",
+              "--set", "global.seaweedfs.securityConfig.jwtSigning.volumeWrite=false",
+          ]
+          LABELS = "/tmp/common-labels-values.yaml"
+          with open(LABELS, "w") as f:
+              yaml.safe_dump({"commonLabels": {
+                  "example.com/team": "storage",
+                  "example.com/release": "{{ .Release.Name }}",
+                  "team": "common",     # also set by master.ingress.labels
+                  "release": "common",  # also set by monitoring.additionalLabels
+                  "app.kubernetes.io/component": "hijack",
+                  "app.kubernetes.io/instance": "hijack",
+              }}, f)
+          EXPECTED = {
+              "example.com/team": "storage",
+              "example.com/release": "test",
+              "team": "common",
+              "release": "common",
+          }
+
+          def render(extra):
+              out = subprocess.check_output(["helm", "template", "test", chart] + BASE + extra, text=True)
+              docs = {}
+              for d in yaml.load_all(out, Loader=NoDuplicates):
+                  if not d:
+                      continue
+                  # generated credentials differ between renders
+                  if d["kind"] == "Secret" and d["metadata"]["name"].endswith(
+                      ("-s3-secret", "-sftp-secret", "-sftp-ssh-secret")
+                  ):
+                      d.pop("data", None)
+                      d.pop("stringData", None)
+                  docs[(d["kind"], d["metadata"]["name"])] = d
+              return docs
+
+          plain, labelled = render([]), render(["-f", LABELS])
+          failed = []
+          if set(plain) != set(labelled):
+              failed.append(f"commonLabels changed the set of objects: {set(plain) ^ set(labelled)}")
+          for key, d in labelled.items():
+              if key not in plain:
+                  continue
+              before = plain[key]["metadata"].get("labels") or {}
+              labels = d["metadata"].get("labels") or {}
+              for k, v in EXPECTED.items():
+                  if k in before:
+                      continue
+                  if labels.get(k) != v:
+                      failed.append(f"{key}: {k}={labels.get(k)!r}, want {v!r}")
+              # labels the chart or an object-specific value sets are never overridden
+              for k, v in before.items():
+                  if labels.get(k) != v:
+                      failed.append(f"{key}: {k} changed from {v!r} to {labels.get(k)!r}")
+              # nothing else changes: selectors, pod templates, volumeClaimTemplates, checksums
+              stripped = copy.deepcopy(d)
+              rest = {k: v for k, v in labels.items() if k in before}
+              if rest or "labels" in plain[key]["metadata"]:
+                  stripped["metadata"]["labels"] = rest
+              else:
+                  stripped["metadata"].pop("labels", None)
+              if stripped != plain[key]:
+                  failed.append(f"{key}: commonLabels changed more than metadata.labels")
+
+          if failed:
+              print("\nFAIL:", file=sys.stderr)
+              for f in failed:
+                  print(f"  - {f}", file=sys.stderr)
+              sys.exit(1)
+          print(f"{len(labelled)} objects carry commonLabels and are otherwise unchanged")
+          PYEOF
+          # an empty value renders exactly like the default
+          helm template test $CHART_DIR --set-string 'commonLabels=' > /tmp/common-labels-empty.yaml
+          cmp /tmp/default.yaml /tmp/common-labels-empty.yaml
+          # the whole value may be a template rendering to a map, e.g. a parent chart's labels
+          echo "commonLabels: 'example.com/owner: {{ .Release.Name }}'" > /tmp/common-labels-string-values.yaml
+          helm template test $CHART_DIR --show-only templates/master/master-service.yaml \
+            -f /tmp/common-labels-string-values.yaml > /tmp/common-labels-string.yaml
+          grep -q "^    example.com/owner: test$" /tmp/common-labels-string.yaml
+          if helm template test $CHART_DIR --set-json 'commonLabels=["a"]' > /dev/null 2>&1; then
+            echo "a commonLabels that is not a map must fail the render"; exit 1
+          fi
+          echo "commonLabels tests passed"
+
           echo ""
           echo "=== Testing namespaceOverride ==="
           NS_ARGS=(

k8s/charts/seaweedfs/README.md

@@ -610,6 +610,10 @@ Two things worth knowing before you turn this on:
 
 The DNS selectors default to CoreDNS as kubeadm, kind and the managed offerings from AWS, Google and Azure install it. On OpenShift, override `egress.dnsNamespaceSelector` and `egress.dnsPodSelector` to match `openshift-dns`; see the comment in `values.yaml`.
 
+## Common labels
+
+`commonLabels` adds labels to the metadata of every object the chart creates. It may be a map or a template string rendering to one. The chart's own labels cannot be overridden, and pods (see `podLabels`) and `volumeClaimTemplates` are left unchanged.
+
 ## Pod and container security contexts
 
 Pod and container security contexts are configurable independently for every built-in workload and remain empty by default for backwards compatibility. The examples in `values.yaml` show how to enable a `RuntimeDefault` seccomp profile, disable privilege escalation and privileged mode, drop all Linux capabilities, and use a read-only root filesystem.

k8s/charts/seaweedfs/templates/admin/admin-httproute.yaml

@@ -17,6 +17,7 @@ metadata:
     {{- with .Values.admin.httpRoute.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.admin.httpRoute.labels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   {{- with .Values.admin.httpRoute.parentRefs }}
   parentRefs:

k8s/charts/seaweedfs/templates/admin/admin-ingress.yaml

@@ -26,6 +26,7 @@ metadata:
     {{- with .Values.admin.ingress.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.admin.ingress.labels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   {{- if and (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) .Values.admin.ingress.className }}
   ingressClassName: {{ .Values.admin.ingress.className | quote }}

k8s/charts/seaweedfs/templates/admin/admin-secret.yaml

@@ -14,6 +14,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: admin
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 data:
   adminUser: {{ .Values.admin.secret.adminUser | b64enc }}
   adminPassword: {{ .Values.admin.secret.adminPassword | b64enc }}

k8s/charts/seaweedfs/templates/admin/admin-service.yaml

@@ -10,6 +10,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: admin
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.admin.service.annotations }}
   annotations:
     {{- toYaml .Values.admin.service.annotations | nindent 4 }}

k8s/charts/seaweedfs/templates/admin/admin-servicemonitor.yaml

@@ -15,6 +15,7 @@ metadata:
     {{- with .Values.global.seaweedfs.monitoring.additionalLabels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.global.seaweedfs.monitoring.additionalLabels) }}{{ . | nindent 4 }}{{ end }}
 {{- with .Values.admin.serviceMonitor.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}

k8s/charts/seaweedfs/templates/admin/admin-statefulset.yaml

@@ -22,6 +22,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: admin
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.admin.annotations }}
   annotations:
     {{- toYaml .Values.admin.annotations | nindent 4 }}

k8s/charts/seaweedfs/templates/all-in-one/all-in-one-deployment.yaml

@@ -11,6 +11,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: seaweedfs-all-in-one
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
   {{- if .Values.allInOne.annotations }}
   annotations:
     {{- toYaml .Values.allInOne.annotations | nindent 4 }}
@@ -45,7 +46,7 @@ spec:
       {{- else }}
       {{- $_ := set $podAnnotations "checksum/s3config" (include "seaweedfs.s3.configChecksum" .) }}
       {{- end }}
-      {{- $_ := set $podAnnotations "checksum/master-config" (include (print .Template.BasePath "/master/master-configmap.yaml") . | sha256sum) }}
+      {{- $_ := set $podAnnotations "checksum/master-config" (include "seaweedfs.master.configChecksum" .) }}
       annotations:
         {{- toYaml $podAnnotations | nindent 8 }}
     spec:

k8s/charts/seaweedfs/templates/all-in-one/all-in-one-pvc.yaml

@@ -11,6 +11,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: seaweedfs-all-in-one
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
   {{- with .Values.allInOne.data.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}

k8s/charts/seaweedfs/templates/all-in-one/all-in-one-service.yml

@@ -10,6 +10,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: seaweedfs-all-in-one
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
   {{- if .Values.allInOne.service.annotations }}
   annotations:
     {{- toYaml .Values.allInOne.service.annotations | nindent 4 }}

k8s/charts/seaweedfs/templates/all-in-one/all-in-one-servicemonitor.yaml

@@ -15,6 +15,7 @@ metadata:
     {{- with .Values.global.seaweedfs.monitoring.additionalLabels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.global.seaweedfs.monitoring.additionalLabels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   endpoints:
     {{- if .Values.allInOne.metricsPort }}

k8s/charts/seaweedfs/templates/cert/admin-cert.yaml

@@ -11,6 +11,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: admin
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
   {{- if .Values.admin.annotations }}
   annotations:
     {{- toYaml .Values.admin.annotations | nindent 4 }}

k8s/charts/seaweedfs/templates/cert/ca-cert.yaml

@@ -10,6 +10,7 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 spec:
   secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
   commonName: "{{ include "seaweedfs.fullname" . }}-root-ca"

k8s/charts/seaweedfs/templates/cert/cert-caissuer.yaml

@@ -10,6 +10,7 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 spec:
   ca:
     secretName: {{ include "seaweedfs.fullname" . }}-ca-cert

k8s/charts/seaweedfs/templates/cert/cert-issuer.yaml

@@ -10,6 +10,7 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 spec:
   selfSigned: {}
 {{- end }}

k8s/charts/seaweedfs/templates/cert/client-cert.yaml

@@ -10,6 +10,7 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 spec:
   secretName: {{ include "seaweedfs.fullname" . }}-client-cert
   issuerRef:

k8s/charts/seaweedfs/templates/cert/filer-cert.yaml

@@ -11,6 +11,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: filer
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
   {{- if .Values.filer.annotations }}
   annotations:
     {{- toYaml .Values.filer.annotations | nindent 4 }}

k8s/charts/seaweedfs/templates/cert/master-cert.yaml

@@ -11,6 +11,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: master
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.master.annotations }}
   annotations:
     {{- toYaml .Values.master.annotations | nindent 4 }}

k8s/charts/seaweedfs/templates/cert/volume-cert.yaml

@@ -11,6 +11,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: volume
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.volume.annotations }}
   annotations:
     {{- toYaml .Values.volume.annotations | nindent 4 }}

k8s/charts/seaweedfs/templates/cert/worker-cert.yaml

@@ -11,6 +11,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: worker
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
   {{- if .Values.worker.annotations }}
   annotations:
     {{- toYaml .Values.worker.annotations | nindent 4 }}

k8s/charts/seaweedfs/templates/cosi/cosi-bucket-class.yaml

@@ -4,6 +4,10 @@ kind: BucketClass
 apiVersion: objectstorage.k8s.io/v1alpha1
 metadata:
   name: {{ .Values.cosi.bucketClassName }}
+  {{- with include "seaweedfs.commonLabels" $ }}
+  labels:
+    {{- . | nindent 4 }}
+  {{- end }}
 driverName: {{ .Values.cosi.driverName }}
 deletionPolicy: Delete
 {{- with .Values.cosi.bucketClassParameters }}
@@ -15,6 +19,10 @@ kind: BucketAccessClass
 apiVersion: objectstorage.k8s.io/v1alpha1
 metadata:
   name: {{ .Values.cosi.bucketClassName }}
+  {{- with include "seaweedfs.commonLabels" $ }}
+  labels:
+    {{- . | nindent 4 }}
+  {{- end }}
 driverName: {{ .Values.cosi.driverName }}
 authenticationType: KEY
 {{- end }}

k8s/charts/seaweedfs/templates/cosi/cosi-cluster-role.yaml

@@ -10,6 +10,7 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 rules:
 - apiGroups: ["objectstorage.k8s.io"]
   resources:
@@ -66,6 +67,7 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 subjects:
   - kind: ServiceAccount
     name: {{ include "seaweedfs.serviceAccountName" . }}-objectstorage-provisioner

k8s/charts/seaweedfs/templates/cosi/cosi-deployment.yaml

@@ -11,6 +11,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: objectstorage-provisioner
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 spec:
   replicas: {{ .Values.cosi.replicas }}
   selector:

k8s/charts/seaweedfs/templates/cosi/cosi-service-account.yaml

@@ -10,5 +10,6 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 automountServiceAccountToken: {{ .Values.global.seaweedfs.automountServiceAccountToken }}
 {{- end }}

k8s/charts/seaweedfs/templates/filer/filer-grpc-ingressroutetcp.yaml

@@ -27,6 +27,7 @@ metadata:
     {{- with .Values.filer.ingresses.grpc.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.filer.ingresses.grpc.labels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   {{- if $securityEnabled }}
   tls:

k8s/charts/seaweedfs/templates/filer/filer-httproute.yaml

@@ -19,6 +19,7 @@ metadata:
     {{- with .Values.filer.httpRoute.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.filer.httpRoute.labels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   {{- with .Values.filer.httpRoute.parentRefs }}
   parentRefs:

k8s/charts/seaweedfs/templates/filer/filer-ingress.yaml

@@ -32,6 +32,7 @@ metadata:
     {{- with .Values.filer.ingresses.http.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.filer.ingresses.http.labels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   {{- if and (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) .Values.filer.ingresses.http.className }}
   ingressClassName: {{ .Values.filer.ingresses.http.className | quote }}
@@ -93,6 +94,7 @@ metadata:
     {{- with .Values.filer.ingresses.grpc.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.filer.ingresses.grpc.labels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   {{- if and (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) .Values.filer.ingresses.grpc.className }}
   ingressClassName: {{ .Values.filer.ingresses.grpc.className | quote }}

k8s/charts/seaweedfs/templates/filer/filer-service-client.yaml

@@ -10,6 +10,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: filer
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.filer.annotations }}
   annotations:
     {{- toYaml .Values.filer.annotations | nindent 4 }}

k8s/charts/seaweedfs/templates/filer/filer-service.yaml

@@ -10,6 +10,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: filer
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" (ternary (dict "monitoring" "true") dict (not (empty $.Values.filer.metricsPort)))) }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.filer.metricsPort }}
     monitoring: "true"
 {{- end }}

k8s/charts/seaweedfs/templates/filer/filer-servicemonitor.yaml

@@ -16,6 +16,7 @@ metadata:
     {{- with .Values.global.seaweedfs.monitoring.additionalLabels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.global.seaweedfs.monitoring.additionalLabels) }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.filer.annotations }}
   annotations:
     {{- toYaml .Values.filer.annotations | nindent 4 }}

k8s/charts/seaweedfs/templates/filer/filer-statefulset.yaml

@@ -11,6 +11,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: filer
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.filer.annotations }}
   annotations:
     {{- toYaml .Values.filer.annotations | nindent 4 }}

k8s/charts/seaweedfs/templates/master/master-configmap.yaml

@@ -9,6 +9,7 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.master.annotations }}
   annotations:
     {{- toYaml .Values.master.annotations | nindent 4 }}

k8s/charts/seaweedfs/templates/master/master-httproute.yaml

@@ -19,6 +19,7 @@ metadata:
     {{- with .Values.master.httpRoute.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.master.httpRoute.labels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   {{- with .Values.master.httpRoute.parentRefs }}
   parentRefs:

k8s/charts/seaweedfs/templates/master/master-ingress.yaml

@@ -24,6 +24,7 @@ metadata:
     {{- with .Values.master.ingress.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.master.ingress.labels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   ingressClassName: {{ .Values.master.ingress.className | quote }}
   tls:

k8s/charts/seaweedfs/templates/master/master-service.yaml

@@ -10,6 +10,7 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
   annotations:
     service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
 {{- if .Values.master.annotations }}

k8s/charts/seaweedfs/templates/master/master-servicemonitor.yaml

@@ -16,6 +16,7 @@ metadata:
     {{- with .Values.global.seaweedfs.monitoring.additionalLabels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.global.seaweedfs.monitoring.additionalLabels) }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.master.annotations }}
   annotations:
     {{- toYaml .Values.master.annotations | nindent 4 }}

k8s/charts/seaweedfs/templates/master/master-statefulset.yaml

@@ -11,6 +11,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: master
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.master.annotations }}
   annotations:
     {{- toYaml .Values.master.annotations | nindent 4 }}
@@ -44,7 +45,7 @@ spec:
       {{- toYaml . | nindent 8 }}
       {{- end }}
       {{- $podAnnotations := mergeOverwrite (deepCopy (.Values.podAnnotations | default dict)) (.Values.master.podAnnotations | default dict) }}
-      {{- $_ := set $podAnnotations "checksum/master-config" (include (print .Template.BasePath "/master/master-configmap.yaml") . | sha256sum) }}
+      {{- $_ := set $podAnnotations "checksum/master-config" (include "seaweedfs.master.configChecksum" .) }}
       annotations:
         {{- toYaml $podAnnotations | nindent 8 }}
     spec:

k8s/charts/seaweedfs/templates/s3/s3-deployment.yaml

@@ -11,6 +11,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: s3
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.s3.annotations }}
   annotations:
     {{- toYaml .Values.s3.annotations | nindent 4 }}

k8s/charts/seaweedfs/templates/s3/s3-httproute.yaml

@@ -26,6 +26,7 @@ metadata:
     {{- with .Values.s3.httpRoute.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.s3.httpRoute.labels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   {{- with .Values.s3.httpRoute.parentRefs }}
   parentRefs:

k8s/charts/seaweedfs/templates/s3/s3-iceberg-ingress.yaml

@@ -44,6 +44,7 @@ metadata:
     {{- with .Values.s3.icebergIngress.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.s3.icebergIngress.labels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   {{- if .Values.s3.icebergIngress.className }}
   ingressClassName: {{ .Values.s3.icebergIngress.className | quote }}

k8s/charts/seaweedfs/templates/s3/s3-ingress.yaml

@@ -35,6 +35,7 @@ metadata:
     {{- with .Values.s3.ingress.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.s3.ingress.labels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   ingressClassName: {{ .Values.s3.ingress.className | quote }}
   tls:

k8s/charts/seaweedfs/templates/s3/s3-lance-ingress.yaml

@@ -44,6 +44,7 @@ metadata:
     {{- with .Values.s3.lanceIngress.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.s3.lanceIngress.labels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   {{- if .Values.s3.lanceIngress.className }}
   ingressClassName: {{ .Values.s3.lanceIngress.className | quote }}

k8s/charts/seaweedfs/templates/s3/s3-secret.yaml

@@ -49,6 +49,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: s3
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 stringData:
   {{- /* An identity read from an existing Secret keeps its keys there; the
          config below names the environment variables carrying them. */}}

k8s/charts/seaweedfs/templates/s3/s3-service.yaml

@@ -10,6 +10,7 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.s3.annotations }}
   annotations:
     {{- toYaml .Values.s3.annotations | nindent 4 }}

k8s/charts/seaweedfs/templates/s3/s3-servicemonitor.yaml

@@ -19,6 +19,7 @@ metadata:
     {{- with .Values.global.seaweedfs.monitoring.additionalLabels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.global.seaweedfs.monitoring.additionalLabels) }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.s3.annotations }}
   annotations:
     {{- toYaml .Values.s3.annotations | nindent 4 }}

k8s/charts/seaweedfs/templates/sftp/sftp-ca-secret.yaml

@@ -34,6 +34,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: sftp
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 stringData:
   ca_user.pub: |
 {{ $inlineCAKeys | indent 4 }}

k8s/charts/seaweedfs/templates/sftp/sftp-deployment.yaml

@@ -11,6 +11,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: sftp
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.sftp.annotations }}
   annotations:
     {{- toYaml .Values.sftp.annotations | nindent 4 }}

k8s/charts/seaweedfs/templates/sftp/sftp-secret.yaml

@@ -27,6 +27,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: sftp
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 stringData:
   admin_password: {{ $admin_pwd }}
   readonly_password: {{ $read_user_pwd }}

k8s/charts/seaweedfs/templates/sftp/sftp-service.yaml

@@ -10,6 +10,7 @@ metadata:
     app.kubernetes.io/component: sftp
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.sftp.annotations }}
   annotations:
     {{- toYaml .Values.sftp.annotations | nindent 4 }}

k8s/charts/seaweedfs/templates/sftp/sftp-servicemonitor.yaml

@@ -16,6 +16,7 @@ metadata:
     {{- with .Values.global.seaweedfs.monitoring.additionalLabels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.global.seaweedfs.monitoring.additionalLabels) }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.sftp.annotations }}
   annotations:
     {{- toYaml .Values.sftp.annotations | nindent 4 }}

k8s/charts/seaweedfs/templates/sftp/sftp-ssh-secret.yaml

@@ -28,6 +28,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: sftp
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 data:
 {{- range $name, $value := $hostKeys }}
   {{ $name }}: {{ $value }}

k8s/charts/seaweedfs/templates/shared/_helpers.tpl

@@ -57,6 +57,43 @@ Expand the name of the chart.
 {{- default .Release.Namespace .Values.namespaceOverride -}}
 {{- end -}}
 
+{{/*
+commonLabels without the chart's own keys. Takes the root context, or a dict
+with "context" and "exclude" (labels the object already sets).
+*/}}
+{{- define "seaweedfs.commonLabels" -}}
+{{- $context := . -}}
+{{- $exclude := dict -}}
+{{- if hasKey . "context" -}}
+{{-   $context = .context -}}
+{{-   $exclude = .exclude | default dict -}}
+{{- end -}}
+{{- with $context.Values.commonLabels -}}
+{{-   $labels := include "seaweedfs.tplvalues.render" (dict "value" . "context" $context) | fromYaml -}}
+{{-   $err := get $labels "Error" -}}
+{{-   if and (not (kindIs "map" .)) (eq (len $labels) 1) (kindIs "string" $err) (hasPrefix "error " $err) -}}
+{{-     fail (printf "commonLabels must render to a map of labels: %s" $err) -}}
+{{-   end -}}
+{{-   $labels = omit $labels "app.kubernetes.io/name" "app.kubernetes.io/instance" "app.kubernetes.io/component" "app.kubernetes.io/managed-by" "helm.sh/chart" -}}
+{{-   range $key, $_ := $exclude -}}
+{{-     $_ := unset $labels $key -}}
+{{-   end -}}
+{{-   $rendered := dict -}}
+{{-   range $key, $value := $labels -}}
+{{-     if not (kindIs "invalid" $value) -}}
+{{-       $s := toString $value -}}
+{{-       if and (kindIs "float64" $value) (eq $value (floor $value)) (lt $value 9.2e18) (gt $value -9.2e18) -}}
+{{-         $s = toString (int64 $value) -}}
+{{-       end -}}
+{{-       $_ := set $rendered $key $s -}}
+{{-     end -}}
+{{-   end -}}
+{{-   if $rendered -}}
+{{-     toYaml $rendered | trim -}}
+{{-   end -}}
+{{- end -}}
+{{- end -}}
+
 {{/*
 Inject extra environment vars in the format key:value, if populated
 */}}
@@ -727,3 +764,9 @@ on install.
   "auditLogConfig" (list .Values.s3.auditLogConfig .Values.filer.s3.auditLogConfig)
   | toJson | sha256sum -}}
 {{- end -}}
+
+{{/* Master ConfigMap checksum, ignoring commonLabels so labels do not roll the pods */}}
+{{- define "seaweedfs.master.configChecksum" -}}
+{{- $context := merge (dict "Values" (omit .Values "commonLabels")) (omit . "Values") -}}
+{{- include (print .Template.BasePath "/master/master-configmap.yaml") $context | sha256sum -}}
+{{- end -}}

k8s/charts/seaweedfs/templates/shared/cluster-role.yaml

@@ -11,6 +11,7 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 rules:
   - apiGroups: [""]
     resources: ["pods"]
@@ -25,6 +26,7 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 subjects:
   - kind: ServiceAccount
     name: {{ include "seaweedfs.serviceAccountName" . }}

k8s/charts/seaweedfs/templates/shared/networkpolicy.yaml

@@ -168,6 +168,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ $.Release.Service | quote }}
     app.kubernetes.io/instance: {{ $.Release.Name | quote }}
     app.kubernetes.io/component: {{ $component | quote }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if $target.hook }}
   annotations:
     {{- /* Only before-hook-creation: the policy has to outlive the Job it

k8s/charts/seaweedfs/templates/shared/notification-configmap.yaml

@@ -9,6 +9,7 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.filer.annotations }}
   annotations:
     {{- toYaml .Values.filer.annotations | nindent 4 }}

k8s/charts/seaweedfs/templates/shared/post-install-bucket-hook.yaml

@@ -70,6 +70,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
     app.kubernetes.io/instance: {{ .Release.Name | quote }}
     app.kubernetes.io/component: bucket-hook
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
   annotations:
     "helm.sh/hook": post-install,post-upgrade
     "helm.sh/hook-weight": "-5"

k8s/charts/seaweedfs/templates/shared/seaweedfs-grafana-dashboard.yaml

@@ -12,6 +12,7 @@ metadata:
   namespace: {{ include "seaweedfs.namespace" $ | quote }}
   labels:
     grafana_dashboard: "1"
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" (dict "grafana_dashboard" "1")) }}{{ . | nindent 4 }}{{ end }}
 data:
   {{ $dashboardName }}.json: |-
 {{ toString $file | indent 4 }}

k8s/charts/seaweedfs/templates/shared/secret-seaweedfs-db.yaml

@@ -18,6 +18,7 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 stringData:
   user: {{ if $data.user }}{{ b64dec $data.user | quote }}{{ else }}"YourSWUser"{{ end }}
   # generated on first install, reused afterwards

k8s/charts/seaweedfs/templates/shared/security-configmap.yaml

@@ -10,6 +10,7 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 data:
   {{- $fullname := include "seaweedfs.fullname" . }}
   {{- $securityConfigName := printf "%s-security-config" $fullname }}

k8s/charts/seaweedfs/templates/shared/service-account.yaml

@@ -13,4 +13,5 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 automountServiceAccountToken: {{ .Values.global.seaweedfs.automountServiceAccountToken }}

k8s/charts/seaweedfs/templates/volume/volume-httproute.yaml

@@ -19,6 +19,7 @@ metadata:
     {{- with .Values.volume.httpRoute.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.volume.httpRoute.labels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   {{- with .Values.volume.httpRoute.parentRefs }}
   parentRefs:

k8s/charts/seaweedfs/templates/volume/volume-ingress.yaml

@@ -30,6 +30,7 @@ metadata:
     {{- with .Values.volume.ingress.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.volume.ingress.labels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   {{- if and (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) .Values.volume.ingress.className }}
   ingressClassName: {{ .Values.volume.ingress.className | quote }}

k8s/charts/seaweedfs/templates/volume/volume-resize-hook.yaml

@@ -16,6 +16,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
     app.kubernetes.io/instance: {{ .Release.Name | quote }}
     app.kubernetes.io/component: volume-resize-hook
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
   annotations:
     helm.sh/hook: pre-install,pre-upgrade
     helm.sh/hook-weight: "0"
@@ -77,6 +78,10 @@ kind: ServiceAccount
 metadata:
   name: {{ $seaweedfsName }}-volume-resize-hook
   namespace: {{ include "seaweedfs.namespace" . | quote }}
+  {{- with include "seaweedfs.commonLabels" $ }}
+  labels:
+    {{- . | nindent 4 }}
+  {{- end }}
   annotations:
     helm.sh/hook: pre-install,pre-upgrade
     helm.sh/hook-weight: "-5"
@@ -87,6 +92,10 @@ kind: Role
 metadata:
   name: {{ $seaweedfsName }}-volume-resize-hook
   namespace: {{ include "seaweedfs.namespace" . | quote }}
+  {{- with include "seaweedfs.commonLabels" $ }}
+  labels:
+    {{- . | nindent 4 }}
+  {{- end }}
   annotations:
     helm.sh/hook: pre-install,pre-upgrade
     helm.sh/hook-weight: "-5"
@@ -104,6 +113,10 @@ kind: RoleBinding
 metadata:
   name: {{ $seaweedfsName }}-volume-resize-hook
   namespace: {{ include "seaweedfs.namespace" . | quote }}
+  {{- with include "seaweedfs.commonLabels" $ }}
+  labels:
+    {{- . | nindent 4 }}
+  {{- end }}
   annotations:
     helm.sh/hook: pre-install,pre-upgrade
     helm.sh/hook-weight: "-5"

k8s/charts/seaweedfs/templates/volume/volume-service.yaml

@@ -16,6 +16,7 @@ metadata:
     app.kubernetes.io/component: {{ $volumeName }}
     helm.sh/chart: {{ $.Chart.Name }}-{{ $.Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if $volume.annotations }}
   annotations:
     {{- toYaml $volume.annotations | nindent 4 }}

k8s/charts/seaweedfs/templates/volume/volume-servicemonitor.yaml

@@ -22,6 +22,7 @@ metadata:
     {{- with $.Values.global.seaweedfs.monitoring.additionalLabels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.global.seaweedfs.monitoring.additionalLabels) }}{{ . | nindent 4 }}{{ end }}
 {{- with $volume.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}

k8s/charts/seaweedfs/templates/volume/volume-statefulset.yaml

@@ -21,6 +21,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/instance: {{ $.Release.Name }}
     app.kubernetes.io/component: {{ $volumeName }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if $volume.annotations }}
   annotations:
     {{- toYaml $volume.annotations | nindent 4 }}

k8s/charts/seaweedfs/templates/worker/worker-deployment.yaml

@@ -14,6 +14,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: worker
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.worker.annotations }}
   annotations:
     {{- toYaml .Values.worker.annotations | nindent 4 }}

k8s/charts/seaweedfs/templates/worker/worker-service.yaml

@@ -10,6 +10,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: worker
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 spec:
   clusterIP: None  # Headless service
   {{- $lanceMetrics := and .Values.worker.lanceMetricsPort (include "seaweedfs.worker.lanceNamespaceUrl" .) }}

k8s/charts/seaweedfs/templates/worker/worker-servicemonitor.yaml

@@ -17,6 +17,7 @@ metadata:
     {{- with .Values.global.seaweedfs.monitoring.additionalLabels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.global.seaweedfs.monitoring.additionalLabels) }}{{ . | nindent 4 }}{{ end }}
 {{- with .Values.worker.serviceMonitor.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}

k8s/charts/seaweedfs/values.yaml

@@ -2239,6 +2239,9 @@ certificates:
     # seaweedfs-master-cert, seaweedfs-filer-cert, etc. Can see any statefulset definition to see secret names
     enabled: false
 
+# Labels added to the metadata of every object, except pods and volumeClaimTemplates.
+# A map, or a template string rendering to one.
+commonLabels: {}
 # Labels to be added to all the created pods
 podLabels: {}
 # Annotations to be added to all the created pods