diff --git a/.github/workflows/helm_ci.yml b/.github/workflows/helm_ci.yml
index 3c830fc8f1..44c3f15754 100644
--- a/.github/workflows/helm_ci.yml
+++ b/.github/workflows/helm_ci.yml
@@ -1934,6 +1934,121 @@ jobs:
           PYEOF
           echo "License + master persistence tests passed"
 
+          echo ""
+          echo "=== Testing commonLabels ==="
+          python3 - "$CHART_DIR" <<'PYEOF'
+          import copy, subprocess, sys, yaml
+          chart = sys.argv[1]
+
+          class NoDuplicates(yaml.SafeLoader):
+              pass
+          def mapping(loader, node, deep=False):
+              keys = [loader.construct_object(k, deep=deep) for k, _ in node.value]
+              dups = {k for k in keys if keys.count(k) > 1}
+              if dups:
+                  raise ValueError(f"duplicate keys {dups} at line {node.start_mark.line + 1}")
+              return yaml.SafeLoader.construct_mapping(loader, node, deep)
+          NoDuplicates.add_constructor(yaml.resolver.BaseResolver.DEFAULT_MAPPING_TAG, mapping)
+
+          BASE = [
+              "--set", "global.seaweedfs.enableSecurity=true",
+              "--set", "global.seaweedfs.monitoring.enabled=true",
+              "--set", "global.seaweedfs.monitoring.additionalLabels.release=prometheus",
+              "--set", "master.data.type=persistentVolumeClaim",
+              "--set", "master.ingress.enabled=true",
+              "--set", "master.ingress.labels.team=ingress",
+              "--set", "filer.data.type=persistentVolumeClaim",
+              "--set", "filer.ingresses.http.enabled=true",
+              "--set", "s3.enabled=true", "--set", "s3.enableAuth=true",
+              "--set", "s3.httpRoute.enabled=true",
+              "--set", "sftp.enabled=true", "--set", "worker.enabled=true",
+              "--set", "admin.enabled=true", "--set", "admin.secret.adminPassword=ci",
+              "--set", "cosi.enabled=true", "--set", "networkPolicy.enabled=true",
+              "--set", "volumes.dc2.replicas=1",
+              # render the security ConfigMap without its generated jwt key
+              "--set", "global.seaweedfs.enableSecurity=true",
+              "--set", "global.seaweedfs.securityConfig.jwtSigning.volumeWrite=false",
+          ]
+          LABELS = "/tmp/common-labels-values.yaml"
+          with open(LABELS, "w") as f:
+              yaml.safe_dump({"commonLabels": {
+                  "example.com/team": "storage",
+                  "example.com/release": "{{ .Release.Name }}",
+                  "team": "common",     # also set by master.ingress.labels
+                  "release": "common",  # also set by monitoring.additionalLabels
+                  "app.kubernetes.io/component": "hijack",
+                  "app.kubernetes.io/instance": "hijack",
+              }}, f)
+          EXPECTED = {
+              "example.com/team": "storage",
+              "example.com/release": "test",
+              "team": "common",
+              "release": "common",
+          }
+
+          def render(extra):
+              out = subprocess.check_output(["helm", "template", "test", chart] + BASE + extra, text=True)
+              docs = {}
+              for d in yaml.load_all(out, Loader=NoDuplicates):
+                  if not d:
+                      continue
+                  # generated credentials differ between renders
+                  if d["kind"] == "Secret" and d["metadata"]["name"].endswith(
+                      ("-s3-secret", "-sftp-secret", "-sftp-ssh-secret")
+                  ):
+                      d.pop("data", None)
+                      d.pop("stringData", None)
+                  docs[(d["kind"], d["metadata"]["name"])] = d
+              return docs
+
+          plain, labelled = render([]), render(["-f", LABELS])
+          failed = []
+          if set(plain) != set(labelled):
+              failed.append(f"commonLabels changed the set of objects: {set(plain) ^ set(labelled)}")
+          for key, d in labelled.items():
+              if key not in plain:
+                  continue
+              before = plain[key]["metadata"].get("labels") or {}
+              labels = d["metadata"].get("labels") or {}
+              for k, v in EXPECTED.items():
+                  if k in before:
+                      continue
+                  if labels.get(k) != v:
+                      failed.append(f"{key}: {k}={labels.get(k)!r}, want {v!r}")
+              # labels the chart or an object-specific value sets are never overridden
+              for k, v in before.items():
+                  if labels.get(k) != v:
+                      failed.append(f"{key}: {k} changed from {v!r} to {labels.get(k)!r}")
+              # nothing else changes: selectors, pod templates, volumeClaimTemplates, checksums
+              stripped = copy.deepcopy(d)
+              rest = {k: v for k, v in labels.items() if k in before}
+              if rest or "labels" in plain[key]["metadata"]:
+                  stripped["metadata"]["labels"] = rest
+              else:
+                  stripped["metadata"].pop("labels", None)
+              if stripped != plain[key]:
+                  failed.append(f"{key}: commonLabels changed more than metadata.labels")
+
+          if failed:
+              print("\nFAIL:", file=sys.stderr)
+              for f in failed:
+                  print(f"  - {f}", file=sys.stderr)
+              sys.exit(1)
+          print(f"{len(labelled)} objects carry commonLabels and are otherwise unchanged")
+          PYEOF
+          # an empty value renders exactly like the default
+          helm template test $CHART_DIR --set-string 'commonLabels=' > /tmp/common-labels-empty.yaml
+          cmp /tmp/default.yaml /tmp/common-labels-empty.yaml
+          # the whole value may be a template rendering to a map, e.g. a parent chart's labels
+          echo "commonLabels: 'example.com/owner: {{ .Release.Name }}'" > /tmp/common-labels-string-values.yaml
+          helm template test $CHART_DIR --show-only templates/master/master-service.yaml \
+            -f /tmp/common-labels-string-values.yaml > /tmp/common-labels-string.yaml
+          grep -q "^    example.com/owner: test$" /tmp/common-labels-string.yaml
+          if helm template test $CHART_DIR --set-json 'commonLabels=["a"]' > /dev/null 2>&1; then
+            echo "a commonLabels that is not a map must fail the render"; exit 1
+          fi
+          echo "commonLabels tests passed"
+
           echo ""
           echo "=== Testing namespaceOverride ==="
           NS_ARGS=(
diff --git a/k8s/charts/seaweedfs/README.md b/k8s/charts/seaweedfs/README.md
index 3f0811e83d..02139d8989 100644
--- a/k8s/charts/seaweedfs/README.md
+++ b/k8s/charts/seaweedfs/README.md
@@ -610,6 +610,10 @@ Two things worth knowing before you turn this on:
 
 The DNS selectors default to CoreDNS as kubeadm, kind and the managed offerings from AWS, Google and Azure install it. On OpenShift, override `egress.dnsNamespaceSelector` and `egress.dnsPodSelector` to match `openshift-dns`; see the comment in `values.yaml`.
 
+## Common labels
+
+`commonLabels` adds labels to the metadata of every object the chart creates. It may be a map or a template string rendering to one. The chart's own labels cannot be overridden, and pods (see `podLabels`) and `volumeClaimTemplates` are left unchanged.
+
 ## Pod and container security contexts
 
 Pod and container security contexts are configurable independently for every built-in workload and remain empty by default for backwards compatibility. The examples in `values.yaml` show how to enable a `RuntimeDefault` seccomp profile, disable privilege escalation and privileged mode, drop all Linux capabilities, and use a read-only root filesystem.
diff --git a/k8s/charts/seaweedfs/templates/admin/admin-httproute.yaml b/k8s/charts/seaweedfs/templates/admin/admin-httproute.yaml
index 41f5dc6825..7ac153bad0 100644
--- a/k8s/charts/seaweedfs/templates/admin/admin-httproute.yaml
+++ b/k8s/charts/seaweedfs/templates/admin/admin-httproute.yaml
@@ -17,6 +17,7 @@ metadata:
     {{- with .Values.admin.httpRoute.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.admin.httpRoute.labels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   {{- with .Values.admin.httpRoute.parentRefs }}
   parentRefs:
diff --git a/k8s/charts/seaweedfs/templates/admin/admin-ingress.yaml b/k8s/charts/seaweedfs/templates/admin/admin-ingress.yaml
index bacfa2eda1..568cca1149 100644
--- a/k8s/charts/seaweedfs/templates/admin/admin-ingress.yaml
+++ b/k8s/charts/seaweedfs/templates/admin/admin-ingress.yaml
@@ -26,6 +26,7 @@ metadata:
     {{- with .Values.admin.ingress.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.admin.ingress.labels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   {{- if and (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) .Values.admin.ingress.className }}
   ingressClassName: {{ .Values.admin.ingress.className | quote }}
diff --git a/k8s/charts/seaweedfs/templates/admin/admin-secret.yaml b/k8s/charts/seaweedfs/templates/admin/admin-secret.yaml
index a58ff8b0e4..d41d2c54ab 100644
--- a/k8s/charts/seaweedfs/templates/admin/admin-secret.yaml
+++ b/k8s/charts/seaweedfs/templates/admin/admin-secret.yaml
@@ -14,6 +14,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: admin
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 data:
   adminUser: {{ .Values.admin.secret.adminUser | b64enc }}
   adminPassword: {{ .Values.admin.secret.adminPassword | b64enc }}
diff --git a/k8s/charts/seaweedfs/templates/admin/admin-service.yaml b/k8s/charts/seaweedfs/templates/admin/admin-service.yaml
index ca101bbf45..f7911ea950 100644
--- a/k8s/charts/seaweedfs/templates/admin/admin-service.yaml
+++ b/k8s/charts/seaweedfs/templates/admin/admin-service.yaml
@@ -10,6 +10,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: admin
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.admin.service.annotations }}
   annotations:
     {{- toYaml .Values.admin.service.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/admin/admin-servicemonitor.yaml b/k8s/charts/seaweedfs/templates/admin/admin-servicemonitor.yaml
index f064eaf353..bb9868817b 100644
--- a/k8s/charts/seaweedfs/templates/admin/admin-servicemonitor.yaml
+++ b/k8s/charts/seaweedfs/templates/admin/admin-servicemonitor.yaml
@@ -15,6 +15,7 @@ metadata:
     {{- with .Values.global.seaweedfs.monitoring.additionalLabels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.global.seaweedfs.monitoring.additionalLabels) }}{{ . | nindent 4 }}{{ end }}
 {{- with .Values.admin.serviceMonitor.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/admin/admin-statefulset.yaml b/k8s/charts/seaweedfs/templates/admin/admin-statefulset.yaml
index ccfd714786..6c379c20e4 100644
--- a/k8s/charts/seaweedfs/templates/admin/admin-statefulset.yaml
+++ b/k8s/charts/seaweedfs/templates/admin/admin-statefulset.yaml
@@ -22,6 +22,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: admin
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.admin.annotations }}
   annotations:
     {{- toYaml .Values.admin.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-deployment.yaml b/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-deployment.yaml
index 01a4ca27e5..1497bb4b45 100644
--- a/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-deployment.yaml
+++ b/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-deployment.yaml
@@ -11,6 +11,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: seaweedfs-all-in-one
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
   {{- if .Values.allInOne.annotations }}
   annotations:
     {{- toYaml .Values.allInOne.annotations | nindent 4 }}
@@ -45,7 +46,7 @@ spec:
       {{- else }}
       {{- $_ := set $podAnnotations "checksum/s3config" (include "seaweedfs.s3.configChecksum" .) }}
       {{- end }}
-      {{- $_ := set $podAnnotations "checksum/master-config" (include (print .Template.BasePath "/master/master-configmap.yaml") . | sha256sum) }}
+      {{- $_ := set $podAnnotations "checksum/master-config" (include "seaweedfs.master.configChecksum" .) }}
       annotations:
         {{- toYaml $podAnnotations | nindent 8 }}
     spec:
diff --git a/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-pvc.yaml b/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-pvc.yaml
index 67fa3e9b9a..af7e5dbe82 100644
--- a/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-pvc.yaml
+++ b/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-pvc.yaml
@@ -11,6 +11,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: seaweedfs-all-in-one
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
   {{- with .Values.allInOne.data.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-service.yml b/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-service.yml
index 56ef03ad88..414aebb61f 100644
--- a/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-service.yml
+++ b/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-service.yml
@@ -10,6 +10,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: seaweedfs-all-in-one
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
   {{- if .Values.allInOne.service.annotations }}
   annotations:
     {{- toYaml .Values.allInOne.service.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-servicemonitor.yaml b/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-servicemonitor.yaml
index 45e566f6c5..756e0e1eba 100644
--- a/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-servicemonitor.yaml
+++ b/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-servicemonitor.yaml
@@ -15,6 +15,7 @@ metadata:
     {{- with .Values.global.seaweedfs.monitoring.additionalLabels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.global.seaweedfs.monitoring.additionalLabels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   endpoints:
     {{- if .Values.allInOne.metricsPort }}
diff --git a/k8s/charts/seaweedfs/templates/cert/admin-cert.yaml b/k8s/charts/seaweedfs/templates/cert/admin-cert.yaml
index c282ba42e4..9433e6a963 100644
--- a/k8s/charts/seaweedfs/templates/cert/admin-cert.yaml
+++ b/k8s/charts/seaweedfs/templates/cert/admin-cert.yaml
@@ -11,6 +11,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: admin
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
   {{- if .Values.admin.annotations }}
   annotations:
     {{- toYaml .Values.admin.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/cert/ca-cert.yaml b/k8s/charts/seaweedfs/templates/cert/ca-cert.yaml
index 757b2ee549..64a8f41f35 100644
--- a/k8s/charts/seaweedfs/templates/cert/ca-cert.yaml
+++ b/k8s/charts/seaweedfs/templates/cert/ca-cert.yaml
@@ -10,6 +10,7 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 spec:
   secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
   commonName: "{{ include "seaweedfs.fullname" . }}-root-ca"
diff --git a/k8s/charts/seaweedfs/templates/cert/cert-caissuer.yaml b/k8s/charts/seaweedfs/templates/cert/cert-caissuer.yaml
index 45a4a2803f..93e707ee38 100644
--- a/k8s/charts/seaweedfs/templates/cert/cert-caissuer.yaml
+++ b/k8s/charts/seaweedfs/templates/cert/cert-caissuer.yaml
@@ -10,6 +10,7 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 spec:
   ca:
     secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
diff --git a/k8s/charts/seaweedfs/templates/cert/cert-issuer.yaml b/k8s/charts/seaweedfs/templates/cert/cert-issuer.yaml
index 08767e22ad..d541a78d0d 100644
--- a/k8s/charts/seaweedfs/templates/cert/cert-issuer.yaml
+++ b/k8s/charts/seaweedfs/templates/cert/cert-issuer.yaml
@@ -10,6 +10,7 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 spec:
   selfSigned: {}
 {{- end }}
diff --git a/k8s/charts/seaweedfs/templates/cert/client-cert.yaml b/k8s/charts/seaweedfs/templates/cert/client-cert.yaml
index 2b78c81974..57572ba57a 100644
--- a/k8s/charts/seaweedfs/templates/cert/client-cert.yaml
+++ b/k8s/charts/seaweedfs/templates/cert/client-cert.yaml
@@ -10,6 +10,7 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 spec:
   secretName: {{ include "seaweedfs.fullname" . }}-client-cert
   issuerRef:
diff --git a/k8s/charts/seaweedfs/templates/cert/filer-cert.yaml b/k8s/charts/seaweedfs/templates/cert/filer-cert.yaml
index d04605bc5f..7e409a1cc6 100644
--- a/k8s/charts/seaweedfs/templates/cert/filer-cert.yaml
+++ b/k8s/charts/seaweedfs/templates/cert/filer-cert.yaml
@@ -11,6 +11,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: filer
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
   {{- if .Values.filer.annotations }}
   annotations:
     {{- toYaml .Values.filer.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/cert/master-cert.yaml b/k8s/charts/seaweedfs/templates/cert/master-cert.yaml
index c55f6930d3..16435ec0b4 100644
--- a/k8s/charts/seaweedfs/templates/cert/master-cert.yaml
+++ b/k8s/charts/seaweedfs/templates/cert/master-cert.yaml
@@ -11,6 +11,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: master
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.master.annotations }}
   annotations:
     {{- toYaml .Values.master.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/cert/volume-cert.yaml b/k8s/charts/seaweedfs/templates/cert/volume-cert.yaml
index 20c287f6cf..7e3c3d15e8 100644
--- a/k8s/charts/seaweedfs/templates/cert/volume-cert.yaml
+++ b/k8s/charts/seaweedfs/templates/cert/volume-cert.yaml
@@ -11,6 +11,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: volume
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.volume.annotations }}
   annotations:
     {{- toYaml .Values.volume.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/cert/worker-cert.yaml b/k8s/charts/seaweedfs/templates/cert/worker-cert.yaml
index b70747e08c..d3efd5ad03 100644
--- a/k8s/charts/seaweedfs/templates/cert/worker-cert.yaml
+++ b/k8s/charts/seaweedfs/templates/cert/worker-cert.yaml
@@ -11,6 +11,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: worker
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
   {{- if .Values.worker.annotations }}
   annotations:
     {{- toYaml .Values.worker.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/cosi/cosi-bucket-class.yaml b/k8s/charts/seaweedfs/templates/cosi/cosi-bucket-class.yaml
index 4d19cc1285..a3a558a589 100644
--- a/k8s/charts/seaweedfs/templates/cosi/cosi-bucket-class.yaml
+++ b/k8s/charts/seaweedfs/templates/cosi/cosi-bucket-class.yaml
@@ -4,6 +4,10 @@ kind: BucketClass
 apiVersion: objectstorage.k8s.io/v1alpha1
 metadata:
   name: {{ .Values.cosi.bucketClassName }}
+  {{- with include "seaweedfs.commonLabels" $ }}
+  labels:
+    {{- . | nindent 4 }}
+  {{- end }}
 driverName: {{ .Values.cosi.driverName }}
 deletionPolicy: Delete
 {{- with .Values.cosi.bucketClassParameters }}
@@ -15,6 +19,10 @@ kind: BucketAccessClass
 apiVersion: objectstorage.k8s.io/v1alpha1
 metadata:
   name: {{ .Values.cosi.bucketClassName }}
+  {{- with include "seaweedfs.commonLabels" $ }}
+  labels:
+    {{- . | nindent 4 }}
+  {{- end }}
 driverName: {{ .Values.cosi.driverName }}
 authenticationType: KEY
 {{- end }}
diff --git a/k8s/charts/seaweedfs/templates/cosi/cosi-cluster-role.yaml b/k8s/charts/seaweedfs/templates/cosi/cosi-cluster-role.yaml
index 5fb77f0d9d..afc6611861 100644
--- a/k8s/charts/seaweedfs/templates/cosi/cosi-cluster-role.yaml
+++ b/k8s/charts/seaweedfs/templates/cosi/cosi-cluster-role.yaml
@@ -10,6 +10,7 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 rules:
 - apiGroups: ["objectstorage.k8s.io"]
   resources:
@@ -66,6 +67,7 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 subjects:
   - kind: ServiceAccount
     name: {{ include "seaweedfs.serviceAccountName" . }}-objectstorage-provisioner
diff --git a/k8s/charts/seaweedfs/templates/cosi/cosi-deployment.yaml b/k8s/charts/seaweedfs/templates/cosi/cosi-deployment.yaml
index 04877e8d46..fa8ce557c3 100644
--- a/k8s/charts/seaweedfs/templates/cosi/cosi-deployment.yaml
+++ b/k8s/charts/seaweedfs/templates/cosi/cosi-deployment.yaml
@@ -11,6 +11,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: objectstorage-provisioner
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 spec:
   replicas: {{ .Values.cosi.replicas }}
   selector:
diff --git a/k8s/charts/seaweedfs/templates/cosi/cosi-service-account.yaml b/k8s/charts/seaweedfs/templates/cosi/cosi-service-account.yaml
index 624800ef76..0b796e77cd 100644
--- a/k8s/charts/seaweedfs/templates/cosi/cosi-service-account.yaml
+++ b/k8s/charts/seaweedfs/templates/cosi/cosi-service-account.yaml
@@ -10,5 +10,6 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 automountServiceAccountToken: {{ .Values.global.seaweedfs.automountServiceAccountToken }}
 {{- end }}
diff --git a/k8s/charts/seaweedfs/templates/filer/filer-grpc-ingressroutetcp.yaml b/k8s/charts/seaweedfs/templates/filer/filer-grpc-ingressroutetcp.yaml
index f1e9143f27..f213e1e6c6 100644
--- a/k8s/charts/seaweedfs/templates/filer/filer-grpc-ingressroutetcp.yaml
+++ b/k8s/charts/seaweedfs/templates/filer/filer-grpc-ingressroutetcp.yaml
@@ -27,6 +27,7 @@ metadata:
     {{- with .Values.filer.ingresses.grpc.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.filer.ingresses.grpc.labels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   {{- if $securityEnabled }}
   tls:
diff --git a/k8s/charts/seaweedfs/templates/filer/filer-httproute.yaml b/k8s/charts/seaweedfs/templates/filer/filer-httproute.yaml
index f5d776a5eb..eeac5b153f 100644
--- a/k8s/charts/seaweedfs/templates/filer/filer-httproute.yaml
+++ b/k8s/charts/seaweedfs/templates/filer/filer-httproute.yaml
@@ -19,6 +19,7 @@ metadata:
     {{- with .Values.filer.httpRoute.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.filer.httpRoute.labels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   {{- with .Values.filer.httpRoute.parentRefs }}
   parentRefs:
diff --git a/k8s/charts/seaweedfs/templates/filer/filer-ingress.yaml b/k8s/charts/seaweedfs/templates/filer/filer-ingress.yaml
index a57538b6d9..ed9c085aae 100644
--- a/k8s/charts/seaweedfs/templates/filer/filer-ingress.yaml
+++ b/k8s/charts/seaweedfs/templates/filer/filer-ingress.yaml
@@ -32,6 +32,7 @@ metadata:
     {{- with .Values.filer.ingresses.http.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.filer.ingresses.http.labels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   {{- if and (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) .Values.filer.ingresses.http.className }}
   ingressClassName: {{ .Values.filer.ingresses.http.className | quote }}
@@ -93,6 +94,7 @@ metadata:
     {{- with .Values.filer.ingresses.grpc.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.filer.ingresses.grpc.labels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   {{- if and (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) .Values.filer.ingresses.grpc.className }}
   ingressClassName: {{ .Values.filer.ingresses.grpc.className | quote }}
diff --git a/k8s/charts/seaweedfs/templates/filer/filer-service-client.yaml b/k8s/charts/seaweedfs/templates/filer/filer-service-client.yaml
index 8ef3935dca..cf87e12fee 100644
--- a/k8s/charts/seaweedfs/templates/filer/filer-service-client.yaml
+++ b/k8s/charts/seaweedfs/templates/filer/filer-service-client.yaml
@@ -10,6 +10,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: filer
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.filer.annotations }}
   annotations:
     {{- toYaml .Values.filer.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/filer/filer-service.yaml b/k8s/charts/seaweedfs/templates/filer/filer-service.yaml
index 3cad8dea03..c8a1b80423 100644
--- a/k8s/charts/seaweedfs/templates/filer/filer-service.yaml
+++ b/k8s/charts/seaweedfs/templates/filer/filer-service.yaml
@@ -10,6 +10,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: filer
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" (ternary (dict "monitoring" "true") dict (not (empty $.Values.filer.metricsPort)))) }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.filer.metricsPort }}
     monitoring: "true"
 {{- end }}
diff --git a/k8s/charts/seaweedfs/templates/filer/filer-servicemonitor.yaml b/k8s/charts/seaweedfs/templates/filer/filer-servicemonitor.yaml
index e51ceb1a21..5a5b35cd77 100644
--- a/k8s/charts/seaweedfs/templates/filer/filer-servicemonitor.yaml
+++ b/k8s/charts/seaweedfs/templates/filer/filer-servicemonitor.yaml
@@ -16,6 +16,7 @@ metadata:
     {{- with .Values.global.seaweedfs.monitoring.additionalLabels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.global.seaweedfs.monitoring.additionalLabels) }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.filer.annotations }}
   annotations:
     {{- toYaml .Values.filer.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/filer/filer-statefulset.yaml b/k8s/charts/seaweedfs/templates/filer/filer-statefulset.yaml
index 8a05de2d7a..d32da770cb 100644
--- a/k8s/charts/seaweedfs/templates/filer/filer-statefulset.yaml
+++ b/k8s/charts/seaweedfs/templates/filer/filer-statefulset.yaml
@@ -11,6 +11,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: filer
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.filer.annotations }}
   annotations:
     {{- toYaml .Values.filer.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/master/master-configmap.yaml b/k8s/charts/seaweedfs/templates/master/master-configmap.yaml
index 1e3501dcad..48fe191f2b 100644
--- a/k8s/charts/seaweedfs/templates/master/master-configmap.yaml
+++ b/k8s/charts/seaweedfs/templates/master/master-configmap.yaml
@@ -9,6 +9,7 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.master.annotations }}
   annotations:
     {{- toYaml .Values.master.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/master/master-httproute.yaml b/k8s/charts/seaweedfs/templates/master/master-httproute.yaml
index 5d339c39cd..15bf81454d 100644
--- a/k8s/charts/seaweedfs/templates/master/master-httproute.yaml
+++ b/k8s/charts/seaweedfs/templates/master/master-httproute.yaml
@@ -19,6 +19,7 @@ metadata:
     {{- with .Values.master.httpRoute.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.master.httpRoute.labels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   {{- with .Values.master.httpRoute.parentRefs }}
   parentRefs:
diff --git a/k8s/charts/seaweedfs/templates/master/master-ingress.yaml b/k8s/charts/seaweedfs/templates/master/master-ingress.yaml
index 440fd617d1..8fe0417175 100644
--- a/k8s/charts/seaweedfs/templates/master/master-ingress.yaml
+++ b/k8s/charts/seaweedfs/templates/master/master-ingress.yaml
@@ -24,6 +24,7 @@ metadata:
     {{- with .Values.master.ingress.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.master.ingress.labels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   ingressClassName: {{ .Values.master.ingress.className | quote }}
   tls:
diff --git a/k8s/charts/seaweedfs/templates/master/master-service.yaml b/k8s/charts/seaweedfs/templates/master/master-service.yaml
index e78cf7638f..b62c6a247a 100644
--- a/k8s/charts/seaweedfs/templates/master/master-service.yaml
+++ b/k8s/charts/seaweedfs/templates/master/master-service.yaml
@@ -10,6 +10,7 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
   annotations:
     service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
 {{- if .Values.master.annotations }}
diff --git a/k8s/charts/seaweedfs/templates/master/master-servicemonitor.yaml b/k8s/charts/seaweedfs/templates/master/master-servicemonitor.yaml
index 305ef5fb7f..03e2204712 100644
--- a/k8s/charts/seaweedfs/templates/master/master-servicemonitor.yaml
+++ b/k8s/charts/seaweedfs/templates/master/master-servicemonitor.yaml
@@ -16,6 +16,7 @@ metadata:
     {{- with .Values.global.seaweedfs.monitoring.additionalLabels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.global.seaweedfs.monitoring.additionalLabels) }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.master.annotations }}
   annotations:
     {{- toYaml .Values.master.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/master/master-statefulset.yaml b/k8s/charts/seaweedfs/templates/master/master-statefulset.yaml
index 26a7e7822b..c7574d3f51 100644
--- a/k8s/charts/seaweedfs/templates/master/master-statefulset.yaml
+++ b/k8s/charts/seaweedfs/templates/master/master-statefulset.yaml
@@ -11,6 +11,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: master
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.master.annotations }}
   annotations:
     {{- toYaml .Values.master.annotations | nindent 4 }}
@@ -44,7 +45,7 @@ spec:
       {{- toYaml . | nindent 8 }}
       {{- end }}
       {{- $podAnnotations := mergeOverwrite (deepCopy (.Values.podAnnotations | default dict)) (.Values.master.podAnnotations | default dict) }}
-      {{- $_ := set $podAnnotations "checksum/master-config" (include (print .Template.BasePath "/master/master-configmap.yaml") . | sha256sum) }}
+      {{- $_ := set $podAnnotations "checksum/master-config" (include "seaweedfs.master.configChecksum" .) }}
       annotations:
         {{- toYaml $podAnnotations | nindent 8 }}
     spec:
diff --git a/k8s/charts/seaweedfs/templates/s3/s3-deployment.yaml b/k8s/charts/seaweedfs/templates/s3/s3-deployment.yaml
index ec4854f9d9..c546dd5d40 100644
--- a/k8s/charts/seaweedfs/templates/s3/s3-deployment.yaml
+++ b/k8s/charts/seaweedfs/templates/s3/s3-deployment.yaml
@@ -11,6 +11,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: s3
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.s3.annotations }}
   annotations:
     {{- toYaml .Values.s3.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/s3/s3-httproute.yaml b/k8s/charts/seaweedfs/templates/s3/s3-httproute.yaml
index bcc6fda9b8..4a23c302b5 100644
--- a/k8s/charts/seaweedfs/templates/s3/s3-httproute.yaml
+++ b/k8s/charts/seaweedfs/templates/s3/s3-httproute.yaml
@@ -26,6 +26,7 @@ metadata:
     {{- with .Values.s3.httpRoute.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.s3.httpRoute.labels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   {{- with .Values.s3.httpRoute.parentRefs }}
   parentRefs:
diff --git a/k8s/charts/seaweedfs/templates/s3/s3-iceberg-ingress.yaml b/k8s/charts/seaweedfs/templates/s3/s3-iceberg-ingress.yaml
index 79f512d311..3509142c30 100644
--- a/k8s/charts/seaweedfs/templates/s3/s3-iceberg-ingress.yaml
+++ b/k8s/charts/seaweedfs/templates/s3/s3-iceberg-ingress.yaml
@@ -44,6 +44,7 @@ metadata:
     {{- with .Values.s3.icebergIngress.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.s3.icebergIngress.labels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   {{- if .Values.s3.icebergIngress.className }}
   ingressClassName: {{ .Values.s3.icebergIngress.className | quote }}
diff --git a/k8s/charts/seaweedfs/templates/s3/s3-ingress.yaml b/k8s/charts/seaweedfs/templates/s3/s3-ingress.yaml
index e32d581786..bab3e9fe41 100644
--- a/k8s/charts/seaweedfs/templates/s3/s3-ingress.yaml
+++ b/k8s/charts/seaweedfs/templates/s3/s3-ingress.yaml
@@ -35,6 +35,7 @@ metadata:
     {{- with .Values.s3.ingress.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.s3.ingress.labels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   ingressClassName: {{ .Values.s3.ingress.className | quote }}
   tls:
diff --git a/k8s/charts/seaweedfs/templates/s3/s3-lance-ingress.yaml b/k8s/charts/seaweedfs/templates/s3/s3-lance-ingress.yaml
index fb96553f74..e1e75ea942 100644
--- a/k8s/charts/seaweedfs/templates/s3/s3-lance-ingress.yaml
+++ b/k8s/charts/seaweedfs/templates/s3/s3-lance-ingress.yaml
@@ -44,6 +44,7 @@ metadata:
     {{- with .Values.s3.lanceIngress.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.s3.lanceIngress.labels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   {{- if .Values.s3.lanceIngress.className }}
   ingressClassName: {{ .Values.s3.lanceIngress.className | quote }}
diff --git a/k8s/charts/seaweedfs/templates/s3/s3-secret.yaml b/k8s/charts/seaweedfs/templates/s3/s3-secret.yaml
index 411577dc63..85ac9af15c 100644
--- a/k8s/charts/seaweedfs/templates/s3/s3-secret.yaml
+++ b/k8s/charts/seaweedfs/templates/s3/s3-secret.yaml
@@ -49,6 +49,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: s3
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 stringData:
   {{- /* An identity read from an existing Secret keeps its keys there; the
          config below names the environment variables carrying them. */}}
diff --git a/k8s/charts/seaweedfs/templates/s3/s3-service.yaml b/k8s/charts/seaweedfs/templates/s3/s3-service.yaml
index 4549cdcdd7..5b5357d581 100644
--- a/k8s/charts/seaweedfs/templates/s3/s3-service.yaml
+++ b/k8s/charts/seaweedfs/templates/s3/s3-service.yaml
@@ -10,6 +10,7 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.s3.annotations }}
   annotations:
     {{- toYaml .Values.s3.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/s3/s3-servicemonitor.yaml b/k8s/charts/seaweedfs/templates/s3/s3-servicemonitor.yaml
index 613fe4f2fc..60420c8b6f 100644
--- a/k8s/charts/seaweedfs/templates/s3/s3-servicemonitor.yaml
+++ b/k8s/charts/seaweedfs/templates/s3/s3-servicemonitor.yaml
@@ -19,6 +19,7 @@ metadata:
     {{- with .Values.global.seaweedfs.monitoring.additionalLabels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.global.seaweedfs.monitoring.additionalLabels) }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.s3.annotations }}
   annotations:
     {{- toYaml .Values.s3.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/sftp/sftp-ca-secret.yaml b/k8s/charts/seaweedfs/templates/sftp/sftp-ca-secret.yaml
index 4ea7611a58..efe909d502 100644
--- a/k8s/charts/seaweedfs/templates/sftp/sftp-ca-secret.yaml
+++ b/k8s/charts/seaweedfs/templates/sftp/sftp-ca-secret.yaml
@@ -34,6 +34,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: sftp
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 stringData:
   ca_user.pub: |
 {{ $inlineCAKeys | indent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/sftp/sftp-deployment.yaml b/k8s/charts/seaweedfs/templates/sftp/sftp-deployment.yaml
index 322db9c5ba..5078b799e2 100644
--- a/k8s/charts/seaweedfs/templates/sftp/sftp-deployment.yaml
+++ b/k8s/charts/seaweedfs/templates/sftp/sftp-deployment.yaml
@@ -11,6 +11,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: sftp
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.sftp.annotations }}
   annotations:
     {{- toYaml .Values.sftp.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/sftp/sftp-secret.yaml b/k8s/charts/seaweedfs/templates/sftp/sftp-secret.yaml
index cf3ad915de..b7e6dad9ea 100644
--- a/k8s/charts/seaweedfs/templates/sftp/sftp-secret.yaml
+++ b/k8s/charts/seaweedfs/templates/sftp/sftp-secret.yaml
@@ -27,6 +27,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: sftp
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 stringData:
   admin_password: {{ $admin_pwd }}
   readonly_password: {{ $read_user_pwd }}
diff --git a/k8s/charts/seaweedfs/templates/sftp/sftp-service.yaml b/k8s/charts/seaweedfs/templates/sftp/sftp-service.yaml
index 6bd1138caf..b3f56a9645 100644
--- a/k8s/charts/seaweedfs/templates/sftp/sftp-service.yaml
+++ b/k8s/charts/seaweedfs/templates/sftp/sftp-service.yaml
@@ -10,6 +10,7 @@ metadata:
     app.kubernetes.io/component: sftp
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.sftp.annotations }}
   annotations:
     {{- toYaml .Values.sftp.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/sftp/sftp-servicemonitor.yaml b/k8s/charts/seaweedfs/templates/sftp/sftp-servicemonitor.yaml
index 329bed1993..41787b6820 100644
--- a/k8s/charts/seaweedfs/templates/sftp/sftp-servicemonitor.yaml
+++ b/k8s/charts/seaweedfs/templates/sftp/sftp-servicemonitor.yaml
@@ -16,6 +16,7 @@ metadata:
     {{- with .Values.global.seaweedfs.monitoring.additionalLabels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.global.seaweedfs.monitoring.additionalLabels) }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.sftp.annotations }}
   annotations:
     {{- toYaml .Values.sftp.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/sftp/sftp-ssh-secret.yaml b/k8s/charts/seaweedfs/templates/sftp/sftp-ssh-secret.yaml
index 81b6f35115..aa5c670f27 100644
--- a/k8s/charts/seaweedfs/templates/sftp/sftp-ssh-secret.yaml
+++ b/k8s/charts/seaweedfs/templates/sftp/sftp-ssh-secret.yaml
@@ -28,6 +28,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: sftp
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 data:
 {{- range $name, $value := $hostKeys }}
   {{ $name }}: {{ $value }}
diff --git a/k8s/charts/seaweedfs/templates/shared/_helpers.tpl b/k8s/charts/seaweedfs/templates/shared/_helpers.tpl
index e438166eac..8df5ab1e0e 100644
--- a/k8s/charts/seaweedfs/templates/shared/_helpers.tpl
+++ b/k8s/charts/seaweedfs/templates/shared/_helpers.tpl
@@ -57,6 +57,43 @@ Expand the name of the chart.
 {{- default .Release.Namespace .Values.namespaceOverride -}}
 {{- end -}}
 
+{{/*
+commonLabels without the chart's own keys. Takes the root context, or a dict
+with "context" and "exclude" (labels the object already sets).
+*/}}
+{{- define "seaweedfs.commonLabels" -}}
+{{- $context := . -}}
+{{- $exclude := dict -}}
+{{- if hasKey . "context" -}}
+{{-   $context = .context -}}
+{{-   $exclude = .exclude | default dict -}}
+{{- end -}}
+{{- with $context.Values.commonLabels -}}
+{{-   $labels := include "seaweedfs.tplvalues.render" (dict "value" . "context" $context) | fromYaml -}}
+{{-   $err := get $labels "Error" -}}
+{{-   if and (not (kindIs "map" .)) (eq (len $labels) 1) (kindIs "string" $err) (hasPrefix "error " $err) -}}
+{{-     fail (printf "commonLabels must render to a map of labels: %s" $err) -}}
+{{-   end -}}
+{{-   $labels = omit $labels "app.kubernetes.io/name" "app.kubernetes.io/instance" "app.kubernetes.io/component" "app.kubernetes.io/managed-by" "helm.sh/chart" -}}
+{{-   range $key, $_ := $exclude -}}
+{{-     $_ := unset $labels $key -}}
+{{-   end -}}
+{{-   $rendered := dict -}}
+{{-   range $key, $value := $labels -}}
+{{-     if not (kindIs "invalid" $value) -}}
+{{-       $s := toString $value -}}
+{{-       if and (kindIs "float64" $value) (eq $value (floor $value)) (lt $value 9.2e18) (gt $value -9.2e18) -}}
+{{-         $s = toString (int64 $value) -}}
+{{-       end -}}
+{{-       $_ := set $rendered $key $s -}}
+{{-     end -}}
+{{-   end -}}
+{{-   if $rendered -}}
+{{-     toYaml $rendered | trim -}}
+{{-   end -}}
+{{- end -}}
+{{- end -}}
+
 {{/*
 Inject extra environment vars in the format key:value, if populated
 */}}
@@ -727,3 +764,9 @@ on install.
   "auditLogConfig" (list .Values.s3.auditLogConfig .Values.filer.s3.auditLogConfig)
   | toJson | sha256sum -}}
 {{- end -}}
+
+{{/* Master ConfigMap checksum, ignoring commonLabels so labels do not roll the pods */}}
+{{- define "seaweedfs.master.configChecksum" -}}
+{{- $context := merge (dict "Values" (omit .Values "commonLabels")) (omit . "Values") -}}
+{{- include (print .Template.BasePath "/master/master-configmap.yaml") $context | sha256sum -}}
+{{- end -}}
diff --git a/k8s/charts/seaweedfs/templates/shared/cluster-role.yaml b/k8s/charts/seaweedfs/templates/shared/cluster-role.yaml
index f6a8bc9395..1ae6d6c30a 100644
--- a/k8s/charts/seaweedfs/templates/shared/cluster-role.yaml
+++ b/k8s/charts/seaweedfs/templates/shared/cluster-role.yaml
@@ -11,6 +11,7 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 rules:
   - apiGroups: [""]
     resources: ["pods"]
@@ -25,6 +26,7 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 subjects:
   - kind: ServiceAccount
     name: {{ include "seaweedfs.serviceAccountName" . }}
diff --git a/k8s/charts/seaweedfs/templates/shared/networkpolicy.yaml b/k8s/charts/seaweedfs/templates/shared/networkpolicy.yaml
index 11153ce9e3..4af04ea38a 100644
--- a/k8s/charts/seaweedfs/templates/shared/networkpolicy.yaml
+++ b/k8s/charts/seaweedfs/templates/shared/networkpolicy.yaml
@@ -168,6 +168,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ $.Release.Service | quote }}
     app.kubernetes.io/instance: {{ $.Release.Name | quote }}
     app.kubernetes.io/component: {{ $component | quote }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if $target.hook }}
   annotations:
     {{- /* Only before-hook-creation: the policy has to outlive the Job it
diff --git a/k8s/charts/seaweedfs/templates/shared/notification-configmap.yaml b/k8s/charts/seaweedfs/templates/shared/notification-configmap.yaml
index 8be18261c0..6b4db386c8 100644
--- a/k8s/charts/seaweedfs/templates/shared/notification-configmap.yaml
+++ b/k8s/charts/seaweedfs/templates/shared/notification-configmap.yaml
@@ -9,6 +9,7 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.filer.annotations }}
   annotations:
     {{- toYaml .Values.filer.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/shared/post-install-bucket-hook.yaml b/k8s/charts/seaweedfs/templates/shared/post-install-bucket-hook.yaml
index 695a557fc2..2a88b6018d 100644
--- a/k8s/charts/seaweedfs/templates/shared/post-install-bucket-hook.yaml
+++ b/k8s/charts/seaweedfs/templates/shared/post-install-bucket-hook.yaml
@@ -70,6 +70,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
     app.kubernetes.io/instance: {{ .Release.Name | quote }}
     app.kubernetes.io/component: bucket-hook
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
   annotations:
     "helm.sh/hook": post-install,post-upgrade
     "helm.sh/hook-weight": "-5"
diff --git a/k8s/charts/seaweedfs/templates/shared/seaweedfs-grafana-dashboard.yaml b/k8s/charts/seaweedfs/templates/shared/seaweedfs-grafana-dashboard.yaml
index 129a3403d0..c36dde32dc 100644
--- a/k8s/charts/seaweedfs/templates/shared/seaweedfs-grafana-dashboard.yaml
+++ b/k8s/charts/seaweedfs/templates/shared/seaweedfs-grafana-dashboard.yaml
@@ -12,6 +12,7 @@ metadata:
   namespace: {{ include "seaweedfs.namespace" $ | quote }}
   labels:
     grafana_dashboard: "1"
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" (dict "grafana_dashboard" "1")) }}{{ . | nindent 4 }}{{ end }}
 data:
   {{ $dashboardName }}.json: |-
 {{ toString $file | indent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/shared/secret-seaweedfs-db.yaml b/k8s/charts/seaweedfs/templates/shared/secret-seaweedfs-db.yaml
index c693b96052..39940a947e 100644
--- a/k8s/charts/seaweedfs/templates/shared/secret-seaweedfs-db.yaml
+++ b/k8s/charts/seaweedfs/templates/shared/secret-seaweedfs-db.yaml
@@ -18,6 +18,7 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 stringData:
   user: {{ if $data.user }}{{ b64dec $data.user | quote }}{{ else }}"YourSWUser"{{ end }}
   # generated on first install, reused afterwards
diff --git a/k8s/charts/seaweedfs/templates/shared/security-configmap.yaml b/k8s/charts/seaweedfs/templates/shared/security-configmap.yaml
index 364675f8bb..f5e7e4a67f 100644
--- a/k8s/charts/seaweedfs/templates/shared/security-configmap.yaml
+++ b/k8s/charts/seaweedfs/templates/shared/security-configmap.yaml
@@ -10,6 +10,7 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 data:
   {{- $fullname := include "seaweedfs.fullname" . }}
   {{- $securityConfigName := printf "%s-security-config" $fullname }}
diff --git a/k8s/charts/seaweedfs/templates/shared/service-account.yaml b/k8s/charts/seaweedfs/templates/shared/service-account.yaml
index 8b05b17e65..22aeda32b7 100644
--- a/k8s/charts/seaweedfs/templates/shared/service-account.yaml
+++ b/k8s/charts/seaweedfs/templates/shared/service-account.yaml
@@ -13,4 +13,5 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 automountServiceAccountToken: {{ .Values.global.seaweedfs.automountServiceAccountToken }}
\ No newline at end of file
diff --git a/k8s/charts/seaweedfs/templates/volume/volume-httproute.yaml b/k8s/charts/seaweedfs/templates/volume/volume-httproute.yaml
index 0caacec9ef..1880a83cf2 100644
--- a/k8s/charts/seaweedfs/templates/volume/volume-httproute.yaml
+++ b/k8s/charts/seaweedfs/templates/volume/volume-httproute.yaml
@@ -19,6 +19,7 @@ metadata:
     {{- with .Values.volume.httpRoute.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.volume.httpRoute.labels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   {{- with .Values.volume.httpRoute.parentRefs }}
   parentRefs:
diff --git a/k8s/charts/seaweedfs/templates/volume/volume-ingress.yaml b/k8s/charts/seaweedfs/templates/volume/volume-ingress.yaml
index ee08cad1d3..6d8b5369de 100644
--- a/k8s/charts/seaweedfs/templates/volume/volume-ingress.yaml
+++ b/k8s/charts/seaweedfs/templates/volume/volume-ingress.yaml
@@ -30,6 +30,7 @@ metadata:
     {{- with .Values.volume.ingress.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.volume.ingress.labels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   {{- if and (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) .Values.volume.ingress.className }}
   ingressClassName: {{ .Values.volume.ingress.className | quote }}
diff --git a/k8s/charts/seaweedfs/templates/volume/volume-resize-hook.yaml b/k8s/charts/seaweedfs/templates/volume/volume-resize-hook.yaml
index 7f657da64b..6b7b1bcc65 100644
--- a/k8s/charts/seaweedfs/templates/volume/volume-resize-hook.yaml
+++ b/k8s/charts/seaweedfs/templates/volume/volume-resize-hook.yaml
@@ -16,6 +16,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
     app.kubernetes.io/instance: {{ .Release.Name | quote }}
     app.kubernetes.io/component: volume-resize-hook
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
   annotations:
     helm.sh/hook: pre-install,pre-upgrade
     helm.sh/hook-weight: "0"
@@ -77,6 +78,10 @@ kind: ServiceAccount
 metadata:
   name: {{ $seaweedfsName }}-volume-resize-hook
   namespace: {{ include "seaweedfs.namespace" . | quote }}
+  {{- with include "seaweedfs.commonLabels" $ }}
+  labels:
+    {{- . | nindent 4 }}
+  {{- end }}
   annotations:
     helm.sh/hook: pre-install,pre-upgrade
     helm.sh/hook-weight: "-5"
@@ -87,6 +92,10 @@ kind: Role
 metadata:
   name: {{ $seaweedfsName }}-volume-resize-hook
   namespace: {{ include "seaweedfs.namespace" . | quote }}
+  {{- with include "seaweedfs.commonLabels" $ }}
+  labels:
+    {{- . | nindent 4 }}
+  {{- end }}
   annotations:
     helm.sh/hook: pre-install,pre-upgrade
     helm.sh/hook-weight: "-5"
@@ -104,6 +113,10 @@ kind: RoleBinding
 metadata:
   name: {{ $seaweedfsName }}-volume-resize-hook
   namespace: {{ include "seaweedfs.namespace" . | quote }}
+  {{- with include "seaweedfs.commonLabels" $ }}
+  labels:
+    {{- . | nindent 4 }}
+  {{- end }}
   annotations:
     helm.sh/hook: pre-install,pre-upgrade
     helm.sh/hook-weight: "-5"
diff --git a/k8s/charts/seaweedfs/templates/volume/volume-service.yaml b/k8s/charts/seaweedfs/templates/volume/volume-service.yaml
index 78dd9a0312..0840ccfb9a 100644
--- a/k8s/charts/seaweedfs/templates/volume/volume-service.yaml
+++ b/k8s/charts/seaweedfs/templates/volume/volume-service.yaml
@@ -16,6 +16,7 @@ metadata:
     app.kubernetes.io/component: {{ $volumeName }}
     helm.sh/chart: {{ $.Chart.Name }}-{{ $.Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if $volume.annotations }}
   annotations:
     {{- toYaml $volume.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/volume/volume-servicemonitor.yaml b/k8s/charts/seaweedfs/templates/volume/volume-servicemonitor.yaml
index 21f29b9069..965bee114a 100644
--- a/k8s/charts/seaweedfs/templates/volume/volume-servicemonitor.yaml
+++ b/k8s/charts/seaweedfs/templates/volume/volume-servicemonitor.yaml
@@ -22,6 +22,7 @@ metadata:
     {{- with $.Values.global.seaweedfs.monitoring.additionalLabels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.global.seaweedfs.monitoring.additionalLabels) }}{{ . | nindent 4 }}{{ end }}
 {{- with $volume.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/volume/volume-statefulset.yaml b/k8s/charts/seaweedfs/templates/volume/volume-statefulset.yaml
index 561f2056b7..b49000cb18 100644
--- a/k8s/charts/seaweedfs/templates/volume/volume-statefulset.yaml
+++ b/k8s/charts/seaweedfs/templates/volume/volume-statefulset.yaml
@@ -21,6 +21,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/instance: {{ $.Release.Name }}
     app.kubernetes.io/component: {{ $volumeName }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if $volume.annotations }}
   annotations:
     {{- toYaml $volume.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/worker/worker-deployment.yaml b/k8s/charts/seaweedfs/templates/worker/worker-deployment.yaml
index ade4ee675b..2e7f4432be 100644
--- a/k8s/charts/seaweedfs/templates/worker/worker-deployment.yaml
+++ b/k8s/charts/seaweedfs/templates/worker/worker-deployment.yaml
@@ -14,6 +14,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: worker
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.worker.annotations }}
   annotations:
     {{- toYaml .Values.worker.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/worker/worker-service.yaml b/k8s/charts/seaweedfs/templates/worker/worker-service.yaml
index 0adeff3dc1..9ffc46968a 100644
--- a/k8s/charts/seaweedfs/templates/worker/worker-service.yaml
+++ b/k8s/charts/seaweedfs/templates/worker/worker-service.yaml
@@ -10,6 +10,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: worker
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 spec:
   clusterIP: None  # Headless service
   {{- $lanceMetrics := and .Values.worker.lanceMetricsPort (include "seaweedfs.worker.lanceNamespaceUrl" .) }}
diff --git a/k8s/charts/seaweedfs/templates/worker/worker-servicemonitor.yaml b/k8s/charts/seaweedfs/templates/worker/worker-servicemonitor.yaml
index 212de65bcc..e5a8cd2403 100644
--- a/k8s/charts/seaweedfs/templates/worker/worker-servicemonitor.yaml
+++ b/k8s/charts/seaweedfs/templates/worker/worker-servicemonitor.yaml
@@ -17,6 +17,7 @@ metadata:
     {{- with .Values.global.seaweedfs.monitoring.additionalLabels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.global.seaweedfs.monitoring.additionalLabels) }}{{ . | nindent 4 }}{{ end }}
 {{- with .Values.worker.serviceMonitor.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/values.yaml b/k8s/charts/seaweedfs/values.yaml
index 34fb60aa82..5b1b5ece04 100644
--- a/k8s/charts/seaweedfs/values.yaml
+++ b/k8s/charts/seaweedfs/values.yaml
@@ -2239,6 +2239,9 @@ certificates:
     # seaweedfs-master-cert, seaweedfs-filer-cert, etc. Can see any statefulset definition to see secret names
     enabled: false
 
+# Labels added to the metadata of every object, except pods and volumeClaimTemplates.
+# A map, or a template string rendering to one.
+commonLabels: {}
 # Labels to be added to all the created pods
 podLabels: {}
 # Annotations to be added to all the created pods