From 468aabc962eaa9678a381ea6299b991a3051dc67 Mon Sep 17 00:00:00 2001
From: jeffWild <geoffrey.sauvage@soprasteria.com>
Date: Sat, 31 Oct 2026 03:53:43 +0100
Subject: [PATCH] helm: add commonLabels to the metadata of every object
 (#12257)

* helm: add commonLabels to the metadata of every object

The chart lets users label pods (podLabels, <component>.podLabels) and
annotate workloads, but offers no way to label the objects themselves.
Backup, ownership and cost policies usually select StatefulSets,
Deployments, Services, PVCs or Secrets by label, and umbrella charts
that set such labels on all their workloads have to patch this chart
to do it.

commonLabels is added to the metadata labels of every object the chart
renders, through one seaweedfs.commonLabels helper. Values may hold
templates, and the whole value may be a template string rendering to a
map, so a parent chart can pass its own labels down. The chart's
app.kubernetes.io/{name,instance,component,managed-by} and helm.sh/chart
keys are dropped, and keys an object already sets (ingress.labels,
httpRoute.labels, monitoring.additionalLabels, grafana_dashboard) win,
so selectors never change and no key renders twice.

Pod templates are left alone (podLabels covers them, and a label change
would roll the pods), as are volumeClaimTemplates, which cannot change
on an existing StatefulSet. checksum/master-config now hashes the master
ConfigMap as rendered without commonLabels, so labels do not roll the
masters either; its value is unchanged.

With commonLabels empty, the default, every template renders exactly as
before. Adds a helm_ci check that labels a release with most components
on and asserts every object carries the labels and nothing else changes.

* helm: do not reject a commonLabels key literally named Error

fromYaml reports parse failures as an {"Error": msg} map, so checking
for that key also matches a user-supplied label of the same name. Only
treat Error as a parse failure when the raw value was not already a
map, so {Error: tracked} renders while non-map input still fails.

* helm: exclude the filer monitoring label from commonLabels

filer.metricsPort adds a hardcoded monitoring: "true" label, which
collided with a monitoring key in commonLabels and rendered a duplicate
map key. Exclude it while metricsPort is set so the object's label wins,
and keep the user's label when it is not.

* helm: accept a templated commonLabels string with an Error key

fromYaml reports a parse failure as a one-key map {Error: "error ..."}, so a
templated string such as 'Error: x' was taken for a parse error. Only fail
when the value is not a map and fromYaml returned its error shape.

* helm ci: keep ConfigMap data in the commonLabels render comparison

Generated Secrets still need normalizing, but the security ConfigMap was
only non-deterministic because of its default jwt signing key. Disable
that key for this render and compare ConfigMap payloads like everything
else so a commonLabels regression in data is caught.

* helm ci: render the security ConfigMap in the commonLabels comparison

Disabling jwtSigning.volumeWrite alone makes securityConfigEnabled false,
so the ConfigMap was absent from the render instead of compared. Enable
mTLS without the generated key so the object is rendered deterministically
and both its labels and data are covered.

* helm ci: strip only generated-credential secret payloads in the commonLabels comparison

* helm ci: assert the effective non-reserved commonLabels

* helm: render integral numeric commonLabels without exponent

---------

Co-authored-by: jeffWild <20067853+jeffWild@users.noreply.github.com>
Co-authored-by: chrislusf <chrislusf@users.noreply.github.com>
Co-authored-by: Chris Lu <chris.lu@gmail.com>
---
 .github/workflows/helm_ci.yml                 | 115 ++++++++++++++++++
 k8s/charts/seaweedfs/README.md                |   4 +
 .../templates/admin/admin-httproute.yaml      |   1 +
 .../templates/admin/admin-ingress.yaml        |   1 +
 .../templates/admin/admin-secret.yaml         |   1 +
 .../templates/admin/admin-service.yaml        |   1 +
 .../templates/admin/admin-servicemonitor.yaml |   1 +
 .../templates/admin/admin-statefulset.yaml    |   1 +
 .../all-in-one/all-in-one-deployment.yaml     |   3 +-
 .../templates/all-in-one/all-in-one-pvc.yaml  |   1 +
 .../all-in-one/all-in-one-service.yml         |   1 +
 .../all-in-one/all-in-one-servicemonitor.yaml |   1 +
 .../seaweedfs/templates/cert/admin-cert.yaml  |   1 +
 .../seaweedfs/templates/cert/ca-cert.yaml     |   1 +
 .../templates/cert/cert-caissuer.yaml         |   1 +
 .../seaweedfs/templates/cert/cert-issuer.yaml |   1 +
 .../seaweedfs/templates/cert/client-cert.yaml |   1 +
 .../seaweedfs/templates/cert/filer-cert.yaml  |   1 +
 .../seaweedfs/templates/cert/master-cert.yaml |   1 +
 .../seaweedfs/templates/cert/volume-cert.yaml |   1 +
 .../seaweedfs/templates/cert/worker-cert.yaml |   1 +
 .../templates/cosi/cosi-bucket-class.yaml     |   8 ++
 .../templates/cosi/cosi-cluster-role.yaml     |   2 +
 .../templates/cosi/cosi-deployment.yaml       |   1 +
 .../templates/cosi/cosi-service-account.yaml  |   1 +
 .../filer/filer-grpc-ingressroutetcp.yaml     |   1 +
 .../templates/filer/filer-httproute.yaml      |   1 +
 .../templates/filer/filer-ingress.yaml        |   2 +
 .../templates/filer/filer-service-client.yaml |   1 +
 .../templates/filer/filer-service.yaml        |   1 +
 .../templates/filer/filer-servicemonitor.yaml |   1 +
 .../templates/filer/filer-statefulset.yaml    |   1 +
 .../templates/master/master-configmap.yaml    |   1 +
 .../templates/master/master-httproute.yaml    |   1 +
 .../templates/master/master-ingress.yaml      |   1 +
 .../templates/master/master-service.yaml      |   1 +
 .../master/master-servicemonitor.yaml         |   1 +
 .../templates/master/master-statefulset.yaml  |   3 +-
 .../seaweedfs/templates/s3/s3-deployment.yaml |   1 +
 .../seaweedfs/templates/s3/s3-httproute.yaml  |   1 +
 .../templates/s3/s3-iceberg-ingress.yaml      |   1 +
 .../seaweedfs/templates/s3/s3-ingress.yaml    |   1 +
 .../templates/s3/s3-lance-ingress.yaml        |   1 +
 .../seaweedfs/templates/s3/s3-secret.yaml     |   1 +
 .../seaweedfs/templates/s3/s3-service.yaml    |   1 +
 .../templates/s3/s3-servicemonitor.yaml       |   1 +
 .../templates/sftp/sftp-ca-secret.yaml        |   1 +
 .../templates/sftp/sftp-deployment.yaml       |   1 +
 .../seaweedfs/templates/sftp/sftp-secret.yaml |   1 +
 .../templates/sftp/sftp-service.yaml          |   1 +
 .../templates/sftp/sftp-servicemonitor.yaml   |   1 +
 .../templates/sftp/sftp-ssh-secret.yaml       |   1 +
 .../seaweedfs/templates/shared/_helpers.tpl   |  43 +++++++
 .../templates/shared/cluster-role.yaml        |   2 +
 .../templates/shared/networkpolicy.yaml       |   1 +
 .../shared/notification-configmap.yaml        |   1 +
 .../shared/post-install-bucket-hook.yaml      |   1 +
 .../shared/seaweedfs-grafana-dashboard.yaml   |   1 +
 .../templates/shared/secret-seaweedfs-db.yaml |   1 +
 .../templates/shared/security-configmap.yaml  |   1 +
 .../templates/shared/service-account.yaml     |   1 +
 .../templates/volume/volume-httproute.yaml    |   1 +
 .../templates/volume/volume-ingress.yaml      |   1 +
 .../templates/volume/volume-resize-hook.yaml  |  13 ++
 .../templates/volume/volume-service.yaml      |   1 +
 .../volume/volume-servicemonitor.yaml         |   1 +
 .../templates/volume/volume-statefulset.yaml  |   1 +
 .../templates/worker/worker-deployment.yaml   |   1 +
 .../templates/worker/worker-service.yaml      |   1 +
 .../worker/worker-servicemonitor.yaml         |   1 +
 k8s/charts/seaweedfs/values.yaml              |   3 +
 71 files changed, 256 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/helm_ci.yml b/.github/workflows/helm_ci.yml
index 3c830fc8f1..44c3f15754 100644
--- a/.github/workflows/helm_ci.yml
+++ b/.github/workflows/helm_ci.yml
@@ -1934,6 +1934,121 @@ jobs:
           PYEOF
           echo "License + master persistence tests passed"
 
+          echo ""
+          echo "=== Testing commonLabels ==="
+          python3 - "$CHART_DIR" <<'PYEOF'
+          import copy, subprocess, sys, yaml
+          chart = sys.argv[1]
+
+          class NoDuplicates(yaml.SafeLoader):
+              pass
+          def mapping(loader, node, deep=False):
+              keys = [loader.construct_object(k, deep=deep) for k, _ in node.value]
+              dups = {k for k in keys if keys.count(k) > 1}
+              if dups:
+                  raise ValueError(f"duplicate keys {dups} at line {node.start_mark.line + 1}")
+              return yaml.SafeLoader.construct_mapping(loader, node, deep)
+          NoDuplicates.add_constructor(yaml.resolver.BaseResolver.DEFAULT_MAPPING_TAG, mapping)
+
+          BASE = [
+              "--set", "global.seaweedfs.enableSecurity=true",
+              "--set", "global.seaweedfs.monitoring.enabled=true",
+              "--set", "global.seaweedfs.monitoring.additionalLabels.release=prometheus",
+              "--set", "master.data.type=persistentVolumeClaim",
+              "--set", "master.ingress.enabled=true",
+              "--set", "master.ingress.labels.team=ingress",
+              "--set", "filer.data.type=persistentVolumeClaim",
+              "--set", "filer.ingresses.http.enabled=true",
+              "--set", "s3.enabled=true", "--set", "s3.enableAuth=true",
+              "--set", "s3.httpRoute.enabled=true",
+              "--set", "sftp.enabled=true", "--set", "worker.enabled=true",
+              "--set", "admin.enabled=true", "--set", "admin.secret.adminPassword=ci",
+              "--set", "cosi.enabled=true", "--set", "networkPolicy.enabled=true",
+              "--set", "volumes.dc2.replicas=1",
+              # render the security ConfigMap without its generated jwt key
+              "--set", "global.seaweedfs.enableSecurity=true",
+              "--set", "global.seaweedfs.securityConfig.jwtSigning.volumeWrite=false",
+          ]
+          LABELS = "/tmp/common-labels-values.yaml"
+          with open(LABELS, "w") as f:
+              yaml.safe_dump({"commonLabels": {
+                  "example.com/team": "storage",
+                  "example.com/release": "{{ .Release.Name }}",
+                  "team": "common",     # also set by master.ingress.labels
+                  "release": "common",  # also set by monitoring.additionalLabels
+                  "app.kubernetes.io/component": "hijack",
+                  "app.kubernetes.io/instance": "hijack",
+              }}, f)
+          EXPECTED = {
+              "example.com/team": "storage",
+              "example.com/release": "test",
+              "team": "common",
+              "release": "common",
+          }
+
+          def render(extra):
+              out = subprocess.check_output(["helm", "template", "test", chart] + BASE + extra, text=True)
+              docs = {}
+              for d in yaml.load_all(out, Loader=NoDuplicates):
+                  if not d:
+                      continue
+                  # generated credentials differ between renders
+                  if d["kind"] == "Secret" and d["metadata"]["name"].endswith(
+                      ("-s3-secret", "-sftp-secret", "-sftp-ssh-secret")
+                  ):
+                      d.pop("data", None)
+                      d.pop("stringData", None)
+                  docs[(d["kind"], d["metadata"]["name"])] = d
+              return docs
+
+          plain, labelled = render([]), render(["-f", LABELS])
+          failed = []
+          if set(plain) != set(labelled):
+              failed.append(f"commonLabels changed the set of objects: {set(plain) ^ set(labelled)}")
+          for key, d in labelled.items():
+              if key not in plain:
+                  continue
+              before = plain[key]["metadata"].get("labels") or {}
+              labels = d["metadata"].get("labels") or {}
+              for k, v in EXPECTED.items():
+                  if k in before:
+                      continue
+                  if labels.get(k) != v:
+                      failed.append(f"{key}: {k}={labels.get(k)!r}, want {v!r}")
+              # labels the chart or an object-specific value sets are never overridden
+              for k, v in before.items():
+                  if labels.get(k) != v:
+                      failed.append(f"{key}: {k} changed from {v!r} to {labels.get(k)!r}")
+              # nothing else changes: selectors, pod templates, volumeClaimTemplates, checksums
+              stripped = copy.deepcopy(d)
+              rest = {k: v for k, v in labels.items() if k in before}
+              if rest or "labels" in plain[key]["metadata"]:
+                  stripped["metadata"]["labels"] = rest
+              else:
+                  stripped["metadata"].pop("labels", None)
+              if stripped != plain[key]:
+                  failed.append(f"{key}: commonLabels changed more than metadata.labels")
+
+          if failed:
+              print("\nFAIL:", file=sys.stderr)
+              for f in failed:
+                  print(f"  - {f}", file=sys.stderr)
+              sys.exit(1)
+          print(f"{len(labelled)} objects carry commonLabels and are otherwise unchanged")
+          PYEOF
+          # an empty value renders exactly like the default
+          helm template test $CHART_DIR --set-string 'commonLabels=' > /tmp/common-labels-empty.yaml
+          cmp /tmp/default.yaml /tmp/common-labels-empty.yaml
+          # the whole value may be a template rendering to a map, e.g. a parent chart's labels
+          echo "commonLabels: 'example.com/owner: {{ .Release.Name }}'" > /tmp/common-labels-string-values.yaml
+          helm template test $CHART_DIR --show-only templates/master/master-service.yaml \
+            -f /tmp/common-labels-string-values.yaml > /tmp/common-labels-string.yaml
+          grep -q "^    example.com/owner: test$" /tmp/common-labels-string.yaml
+          if helm template test $CHART_DIR --set-json 'commonLabels=["a"]' > /dev/null 2>&1; then
+            echo "a commonLabels that is not a map must fail the render"; exit 1
+          fi
+          echo "commonLabels tests passed"
+
           echo ""
           echo "=== Testing namespaceOverride ==="
           NS_ARGS=(
diff --git a/k8s/charts/seaweedfs/README.md b/k8s/charts/seaweedfs/README.md
index 3f0811e83d..02139d8989 100644
--- a/k8s/charts/seaweedfs/README.md
+++ b/k8s/charts/seaweedfs/README.md
@@ -610,6 +610,10 @@ Two things worth knowing before you turn this on:
 
 The DNS selectors default to CoreDNS as kubeadm, kind and the managed offerings from AWS, Google and Azure install it. On OpenShift, override `egress.dnsNamespaceSelector` and `egress.dnsPodSelector` to match `openshift-dns`; see the comment in `values.yaml`.
 
+## Common labels
+
+`commonLabels` adds labels to the metadata of every object the chart creates. It may be a map or a template string rendering to one. The chart's own labels cannot be overridden, and pods (see `podLabels`) and `volumeClaimTemplates` are left unchanged.
+
 ## Pod and container security contexts
 
 Pod and container security contexts are configurable independently for every built-in workload and remain empty by default for backwards compatibility. The examples in `values.yaml` show how to enable a `RuntimeDefault` seccomp profile, disable privilege escalation and privileged mode, drop all Linux capabilities, and use a read-only root filesystem.
diff --git a/k8s/charts/seaweedfs/templates/admin/admin-httproute.yaml b/k8s/charts/seaweedfs/templates/admin/admin-httproute.yaml
index 41f5dc6825..7ac153bad0 100644
--- a/k8s/charts/seaweedfs/templates/admin/admin-httproute.yaml
+++ b/k8s/charts/seaweedfs/templates/admin/admin-httproute.yaml
@@ -17,6 +17,7 @@ metadata:
     {{- with .Values.admin.httpRoute.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.admin.httpRoute.labels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   {{- with .Values.admin.httpRoute.parentRefs }}
   parentRefs:
diff --git a/k8s/charts/seaweedfs/templates/admin/admin-ingress.yaml b/k8s/charts/seaweedfs/templates/admin/admin-ingress.yaml
index bacfa2eda1..568cca1149 100644
--- a/k8s/charts/seaweedfs/templates/admin/admin-ingress.yaml
+++ b/k8s/charts/seaweedfs/templates/admin/admin-ingress.yaml
@@ -26,6 +26,7 @@ metadata:
     {{- with .Values.admin.ingress.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.admin.ingress.labels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   {{- if and (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) .Values.admin.ingress.className }}
   ingressClassName: {{ .Values.admin.ingress.className | quote }}
diff --git a/k8s/charts/seaweedfs/templates/admin/admin-secret.yaml b/k8s/charts/seaweedfs/templates/admin/admin-secret.yaml
index a58ff8b0e4..d41d2c54ab 100644
--- a/k8s/charts/seaweedfs/templates/admin/admin-secret.yaml
+++ b/k8s/charts/seaweedfs/templates/admin/admin-secret.yaml
@@ -14,6 +14,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: admin
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 data:
   adminUser: {{ .Values.admin.secret.adminUser | b64enc }}
   adminPassword: {{ .Values.admin.secret.adminPassword | b64enc }}
diff --git a/k8s/charts/seaweedfs/templates/admin/admin-service.yaml b/k8s/charts/seaweedfs/templates/admin/admin-service.yaml
index ca101bbf45..f7911ea950 100644
--- a/k8s/charts/seaweedfs/templates/admin/admin-service.yaml
+++ b/k8s/charts/seaweedfs/templates/admin/admin-service.yaml
@@ -10,6 +10,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: admin
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.admin.service.annotations }}
   annotations:
     {{- toYaml .Values.admin.service.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/admin/admin-servicemonitor.yaml b/k8s/charts/seaweedfs/templates/admin/admin-servicemonitor.yaml
index f064eaf353..bb9868817b 100644
--- a/k8s/charts/seaweedfs/templates/admin/admin-servicemonitor.yaml
+++ b/k8s/charts/seaweedfs/templates/admin/admin-servicemonitor.yaml
@@ -15,6 +15,7 @@ metadata:
     {{- with .Values.global.seaweedfs.monitoring.additionalLabels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.global.seaweedfs.monitoring.additionalLabels) }}{{ . | nindent 4 }}{{ end }}
 {{- with .Values.admin.serviceMonitor.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/admin/admin-statefulset.yaml b/k8s/charts/seaweedfs/templates/admin/admin-statefulset.yaml
index ccfd714786..6c379c20e4 100644
--- a/k8s/charts/seaweedfs/templates/admin/admin-statefulset.yaml
+++ b/k8s/charts/seaweedfs/templates/admin/admin-statefulset.yaml
@@ -22,6 +22,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: admin
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.admin.annotations }}
   annotations:
     {{- toYaml .Values.admin.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-deployment.yaml b/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-deployment.yaml
index 01a4ca27e5..1497bb4b45 100644
--- a/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-deployment.yaml
+++ b/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-deployment.yaml
@@ -11,6 +11,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: seaweedfs-all-in-one
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
   {{- if .Values.allInOne.annotations }}
   annotations:
     {{- toYaml .Values.allInOne.annotations | nindent 4 }}
@@ -45,7 +46,7 @@ spec:
       {{- else }}
       {{- $_ := set $podAnnotations "checksum/s3config" (include "seaweedfs.s3.configChecksum" .) }}
       {{- end }}
-      {{- $_ := set $podAnnotations "checksum/master-config" (include (print .Template.BasePath "/master/master-configmap.yaml") . | sha256sum) }}
+      {{- $_ := set $podAnnotations "checksum/master-config" (include "seaweedfs.master.configChecksum" .) }}
       annotations:
         {{- toYaml $podAnnotations | nindent 8 }}
     spec:
diff --git a/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-pvc.yaml b/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-pvc.yaml
index 67fa3e9b9a..af7e5dbe82 100644
--- a/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-pvc.yaml
+++ b/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-pvc.yaml
@@ -11,6 +11,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: seaweedfs-all-in-one
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
   {{- with .Values.allInOne.data.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-service.yml b/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-service.yml
index 56ef03ad88..414aebb61f 100644
--- a/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-service.yml
+++ b/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-service.yml
@@ -10,6 +10,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: seaweedfs-all-in-one
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
   {{- if .Values.allInOne.service.annotations }}
   annotations:
     {{- toYaml .Values.allInOne.service.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-servicemonitor.yaml b/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-servicemonitor.yaml
index 45e566f6c5..756e0e1eba 100644
--- a/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-servicemonitor.yaml
+++ b/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-servicemonitor.yaml
@@ -15,6 +15,7 @@ metadata:
     {{- with .Values.global.seaweedfs.monitoring.additionalLabels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.global.seaweedfs.monitoring.additionalLabels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   endpoints:
     {{- if .Values.allInOne.metricsPort }}
diff --git a/k8s/charts/seaweedfs/templates/cert/admin-cert.yaml b/k8s/charts/seaweedfs/templates/cert/admin-cert.yaml
index c282ba42e4..9433e6a963 100644
--- a/k8s/charts/seaweedfs/templates/cert/admin-cert.yaml
+++ b/k8s/charts/seaweedfs/templates/cert/admin-cert.yaml
@@ -11,6 +11,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: admin
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
   {{- if .Values.admin.annotations }}
   annotations:
     {{- toYaml .Values.admin.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/cert/ca-cert.yaml b/k8s/charts/seaweedfs/templates/cert/ca-cert.yaml
index 757b2ee549..64a8f41f35 100644
--- a/k8s/charts/seaweedfs/templates/cert/ca-cert.yaml
+++ b/k8s/charts/seaweedfs/templates/cert/ca-cert.yaml
@@ -10,6 +10,7 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 spec:
   secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
   commonName: "{{ include "seaweedfs.fullname" . }}-root-ca"
diff --git a/k8s/charts/seaweedfs/templates/cert/cert-caissuer.yaml b/k8s/charts/seaweedfs/templates/cert/cert-caissuer.yaml
index 45a4a2803f..93e707ee38 100644
--- a/k8s/charts/seaweedfs/templates/cert/cert-caissuer.yaml
+++ b/k8s/charts/seaweedfs/templates/cert/cert-caissuer.yaml
@@ -10,6 +10,7 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 spec:
   ca:
     secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
diff --git a/k8s/charts/seaweedfs/templates/cert/cert-issuer.yaml b/k8s/charts/seaweedfs/templates/cert/cert-issuer.yaml
index 08767e22ad..d541a78d0d 100644
--- a/k8s/charts/seaweedfs/templates/cert/cert-issuer.yaml
+++ b/k8s/charts/seaweedfs/templates/cert/cert-issuer.yaml
@@ -10,6 +10,7 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 spec:
   selfSigned: {}
 {{- end }}
diff --git a/k8s/charts/seaweedfs/templates/cert/client-cert.yaml b/k8s/charts/seaweedfs/templates/cert/client-cert.yaml
index 2b78c81974..57572ba57a 100644
--- a/k8s/charts/seaweedfs/templates/cert/client-cert.yaml
+++ b/k8s/charts/seaweedfs/templates/cert/client-cert.yaml
@@ -10,6 +10,7 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 spec:
   secretName: {{ include "seaweedfs.fullname" . }}-client-cert
   issuerRef:
diff --git a/k8s/charts/seaweedfs/templates/cert/filer-cert.yaml b/k8s/charts/seaweedfs/templates/cert/filer-cert.yaml
index d04605bc5f..7e409a1cc6 100644
--- a/k8s/charts/seaweedfs/templates/cert/filer-cert.yaml
+++ b/k8s/charts/seaweedfs/templates/cert/filer-cert.yaml
@@ -11,6 +11,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: filer
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
   {{- if .Values.filer.annotations }}
   annotations:
     {{- toYaml .Values.filer.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/cert/master-cert.yaml b/k8s/charts/seaweedfs/templates/cert/master-cert.yaml
index c55f6930d3..16435ec0b4 100644
--- a/k8s/charts/seaweedfs/templates/cert/master-cert.yaml
+++ b/k8s/charts/seaweedfs/templates/cert/master-cert.yaml
@@ -11,6 +11,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: master
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.master.annotations }}
   annotations:
     {{- toYaml .Values.master.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/cert/volume-cert.yaml b/k8s/charts/seaweedfs/templates/cert/volume-cert.yaml
index 20c287f6cf..7e3c3d15e8 100644
--- a/k8s/charts/seaweedfs/templates/cert/volume-cert.yaml
+++ b/k8s/charts/seaweedfs/templates/cert/volume-cert.yaml
@@ -11,6 +11,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: volume
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.volume.annotations }}
   annotations:
     {{- toYaml .Values.volume.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/cert/worker-cert.yaml b/k8s/charts/seaweedfs/templates/cert/worker-cert.yaml
index b70747e08c..d3efd5ad03 100644
--- a/k8s/charts/seaweedfs/templates/cert/worker-cert.yaml
+++ b/k8s/charts/seaweedfs/templates/cert/worker-cert.yaml
@@ -11,6 +11,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: worker
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
   {{- if .Values.worker.annotations }}
   annotations:
     {{- toYaml .Values.worker.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/cosi/cosi-bucket-class.yaml b/k8s/charts/seaweedfs/templates/cosi/cosi-bucket-class.yaml
index 4d19cc1285..a3a558a589 100644
--- a/k8s/charts/seaweedfs/templates/cosi/cosi-bucket-class.yaml
+++ b/k8s/charts/seaweedfs/templates/cosi/cosi-bucket-class.yaml
@@ -4,6 +4,10 @@ kind: BucketClass
 apiVersion: objectstorage.k8s.io/v1alpha1
 metadata:
   name: {{ .Values.cosi.bucketClassName }}
+  {{- with include "seaweedfs.commonLabels" $ }}
+  labels:
+    {{- . | nindent 4 }}
+  {{- end }}
 driverName: {{ .Values.cosi.driverName }}
 deletionPolicy: Delete
 {{- with .Values.cosi.bucketClassParameters }}
@@ -15,6 +19,10 @@ kind: BucketAccessClass
 apiVersion: objectstorage.k8s.io/v1alpha1
 metadata:
   name: {{ .Values.cosi.bucketClassName }}
+  {{- with include "seaweedfs.commonLabels" $ }}
+  labels:
+    {{- . | nindent 4 }}
+  {{- end }}
 driverName: {{ .Values.cosi.driverName }}
 authenticationType: KEY
 {{- end }}
diff --git a/k8s/charts/seaweedfs/templates/cosi/cosi-cluster-role.yaml b/k8s/charts/seaweedfs/templates/cosi/cosi-cluster-role.yaml
index 5fb77f0d9d..afc6611861 100644
--- a/k8s/charts/seaweedfs/templates/cosi/cosi-cluster-role.yaml
+++ b/k8s/charts/seaweedfs/templates/cosi/cosi-cluster-role.yaml
@@ -10,6 +10,7 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 rules:
 - apiGroups: ["objectstorage.k8s.io"]
   resources:
@@ -66,6 +67,7 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 subjects:
   - kind: ServiceAccount
     name: {{ include "seaweedfs.serviceAccountName" . }}-objectstorage-provisioner
diff --git a/k8s/charts/seaweedfs/templates/cosi/cosi-deployment.yaml b/k8s/charts/seaweedfs/templates/cosi/cosi-deployment.yaml
index 04877e8d46..fa8ce557c3 100644
--- a/k8s/charts/seaweedfs/templates/cosi/cosi-deployment.yaml
+++ b/k8s/charts/seaweedfs/templates/cosi/cosi-deployment.yaml
@@ -11,6 +11,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: objectstorage-provisioner
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 spec:
   replicas: {{ .Values.cosi.replicas }}
   selector:
diff --git a/k8s/charts/seaweedfs/templates/cosi/cosi-service-account.yaml b/k8s/charts/seaweedfs/templates/cosi/cosi-service-account.yaml
index 624800ef76..0b796e77cd 100644
--- a/k8s/charts/seaweedfs/templates/cosi/cosi-service-account.yaml
+++ b/k8s/charts/seaweedfs/templates/cosi/cosi-service-account.yaml
@@ -10,5 +10,6 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 automountServiceAccountToken: {{ .Values.global.seaweedfs.automountServiceAccountToken }}
 {{- end }}
diff --git a/k8s/charts/seaweedfs/templates/filer/filer-grpc-ingressroutetcp.yaml b/k8s/charts/seaweedfs/templates/filer/filer-grpc-ingressroutetcp.yaml
index f1e9143f27..f213e1e6c6 100644
--- a/k8s/charts/seaweedfs/templates/filer/filer-grpc-ingressroutetcp.yaml
+++ b/k8s/charts/seaweedfs/templates/filer/filer-grpc-ingressroutetcp.yaml
@@ -27,6 +27,7 @@ metadata:
     {{- with .Values.filer.ingresses.grpc.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.filer.ingresses.grpc.labels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   {{- if $securityEnabled }}
   tls:
diff --git a/k8s/charts/seaweedfs/templates/filer/filer-httproute.yaml b/k8s/charts/seaweedfs/templates/filer/filer-httproute.yaml
index f5d776a5eb..eeac5b153f 100644
--- a/k8s/charts/seaweedfs/templates/filer/filer-httproute.yaml
+++ b/k8s/charts/seaweedfs/templates/filer/filer-httproute.yaml
@@ -19,6 +19,7 @@ metadata:
     {{- with .Values.filer.httpRoute.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.filer.httpRoute.labels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   {{- with .Values.filer.httpRoute.parentRefs }}
   parentRefs:
diff --git a/k8s/charts/seaweedfs/templates/filer/filer-ingress.yaml b/k8s/charts/seaweedfs/templates/filer/filer-ingress.yaml
index a57538b6d9..ed9c085aae 100644
--- a/k8s/charts/seaweedfs/templates/filer/filer-ingress.yaml
+++ b/k8s/charts/seaweedfs/templates/filer/filer-ingress.yaml
@@ -32,6 +32,7 @@ metadata:
     {{- with .Values.filer.ingresses.http.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.filer.ingresses.http.labels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   {{- if and (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) .Values.filer.ingresses.http.className }}
   ingressClassName: {{ .Values.filer.ingresses.http.className | quote }}
@@ -93,6 +94,7 @@ metadata:
     {{- with .Values.filer.ingresses.grpc.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.filer.ingresses.grpc.labels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   {{- if and (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) .Values.filer.ingresses.grpc.className }}
   ingressClassName: {{ .Values.filer.ingresses.grpc.className | quote }}
diff --git a/k8s/charts/seaweedfs/templates/filer/filer-service-client.yaml b/k8s/charts/seaweedfs/templates/filer/filer-service-client.yaml
index 8ef3935dca..cf87e12fee 100644
--- a/k8s/charts/seaweedfs/templates/filer/filer-service-client.yaml
+++ b/k8s/charts/seaweedfs/templates/filer/filer-service-client.yaml
@@ -10,6 +10,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: filer
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.filer.annotations }}
   annotations:
     {{- toYaml .Values.filer.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/filer/filer-service.yaml b/k8s/charts/seaweedfs/templates/filer/filer-service.yaml
index 3cad8dea03..c8a1b80423 100644
--- a/k8s/charts/seaweedfs/templates/filer/filer-service.yaml
+++ b/k8s/charts/seaweedfs/templates/filer/filer-service.yaml
@@ -10,6 +10,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: filer
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" (ternary (dict "monitoring" "true") dict (not (empty $.Values.filer.metricsPort)))) }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.filer.metricsPort }}
     monitoring: "true"
 {{- end }}
diff --git a/k8s/charts/seaweedfs/templates/filer/filer-servicemonitor.yaml b/k8s/charts/seaweedfs/templates/filer/filer-servicemonitor.yaml
index e51ceb1a21..5a5b35cd77 100644
--- a/k8s/charts/seaweedfs/templates/filer/filer-servicemonitor.yaml
+++ b/k8s/charts/seaweedfs/templates/filer/filer-servicemonitor.yaml
@@ -16,6 +16,7 @@ metadata:
     {{- with .Values.global.seaweedfs.monitoring.additionalLabels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.global.seaweedfs.monitoring.additionalLabels) }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.filer.annotations }}
   annotations:
     {{- toYaml .Values.filer.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/filer/filer-statefulset.yaml b/k8s/charts/seaweedfs/templates/filer/filer-statefulset.yaml
index 8a05de2d7a..d32da770cb 100644
--- a/k8s/charts/seaweedfs/templates/filer/filer-statefulset.yaml
+++ b/k8s/charts/seaweedfs/templates/filer/filer-statefulset.yaml
@@ -11,6 +11,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: filer
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.filer.annotations }}
   annotations:
     {{- toYaml .Values.filer.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/master/master-configmap.yaml b/k8s/charts/seaweedfs/templates/master/master-configmap.yaml
index 1e3501dcad..48fe191f2b 100644
--- a/k8s/charts/seaweedfs/templates/master/master-configmap.yaml
+++ b/k8s/charts/seaweedfs/templates/master/master-configmap.yaml
@@ -9,6 +9,7 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.master.annotations }}
   annotations:
     {{- toYaml .Values.master.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/master/master-httproute.yaml b/k8s/charts/seaweedfs/templates/master/master-httproute.yaml
index 5d339c39cd..15bf81454d 100644
--- a/k8s/charts/seaweedfs/templates/master/master-httproute.yaml
+++ b/k8s/charts/seaweedfs/templates/master/master-httproute.yaml
@@ -19,6 +19,7 @@ metadata:
     {{- with .Values.master.httpRoute.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.master.httpRoute.labels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   {{- with .Values.master.httpRoute.parentRefs }}
   parentRefs:
diff --git a/k8s/charts/seaweedfs/templates/master/master-ingress.yaml b/k8s/charts/seaweedfs/templates/master/master-ingress.yaml
index 440fd617d1..8fe0417175 100644
--- a/k8s/charts/seaweedfs/templates/master/master-ingress.yaml
+++ b/k8s/charts/seaweedfs/templates/master/master-ingress.yaml
@@ -24,6 +24,7 @@ metadata:
     {{- with .Values.master.ingress.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.master.ingress.labels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   ingressClassName: {{ .Values.master.ingress.className | quote }}
   tls:
diff --git a/k8s/charts/seaweedfs/templates/master/master-service.yaml b/k8s/charts/seaweedfs/templates/master/master-service.yaml
index e78cf7638f..b62c6a247a 100644
--- a/k8s/charts/seaweedfs/templates/master/master-service.yaml
+++ b/k8s/charts/seaweedfs/templates/master/master-service.yaml
@@ -10,6 +10,7 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
   annotations:
     service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
 {{- if .Values.master.annotations }}
diff --git a/k8s/charts/seaweedfs/templates/master/master-servicemonitor.yaml b/k8s/charts/seaweedfs/templates/master/master-servicemonitor.yaml
index 305ef5fb7f..03e2204712 100644
--- a/k8s/charts/seaweedfs/templates/master/master-servicemonitor.yaml
+++ b/k8s/charts/seaweedfs/templates/master/master-servicemonitor.yaml
@@ -16,6 +16,7 @@ metadata:
     {{- with .Values.global.seaweedfs.monitoring.additionalLabels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.global.seaweedfs.monitoring.additionalLabels) }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.master.annotations }}
   annotations:
     {{- toYaml .Values.master.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/master/master-statefulset.yaml b/k8s/charts/seaweedfs/templates/master/master-statefulset.yaml
index 26a7e7822b..c7574d3f51 100644
--- a/k8s/charts/seaweedfs/templates/master/master-statefulset.yaml
+++ b/k8s/charts/seaweedfs/templates/master/master-statefulset.yaml
@@ -11,6 +11,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: master
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.master.annotations }}
   annotations:
     {{- toYaml .Values.master.annotations | nindent 4 }}
@@ -44,7 +45,7 @@ spec:
       {{- toYaml . | nindent 8 }}
       {{- end }}
       {{- $podAnnotations := mergeOverwrite (deepCopy (.Values.podAnnotations | default dict)) (.Values.master.podAnnotations | default dict) }}
-      {{- $_ := set $podAnnotations "checksum/master-config" (include (print .Template.BasePath "/master/master-configmap.yaml") . | sha256sum) }}
+      {{- $_ := set $podAnnotations "checksum/master-config" (include "seaweedfs.master.configChecksum" .) }}
       annotations:
         {{- toYaml $podAnnotations | nindent 8 }}
     spec:
diff --git a/k8s/charts/seaweedfs/templates/s3/s3-deployment.yaml b/k8s/charts/seaweedfs/templates/s3/s3-deployment.yaml
index ec4854f9d9..c546dd5d40 100644
--- a/k8s/charts/seaweedfs/templates/s3/s3-deployment.yaml
+++ b/k8s/charts/seaweedfs/templates/s3/s3-deployment.yaml
@@ -11,6 +11,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: s3
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.s3.annotations }}
   annotations:
     {{- toYaml .Values.s3.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/s3/s3-httproute.yaml b/k8s/charts/seaweedfs/templates/s3/s3-httproute.yaml
index bcc6fda9b8..4a23c302b5 100644
--- a/k8s/charts/seaweedfs/templates/s3/s3-httproute.yaml
+++ b/k8s/charts/seaweedfs/templates/s3/s3-httproute.yaml
@@ -26,6 +26,7 @@ metadata:
     {{- with .Values.s3.httpRoute.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.s3.httpRoute.labels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   {{- with .Values.s3.httpRoute.parentRefs }}
   parentRefs:
diff --git a/k8s/charts/seaweedfs/templates/s3/s3-iceberg-ingress.yaml b/k8s/charts/seaweedfs/templates/s3/s3-iceberg-ingress.yaml
index 79f512d311..3509142c30 100644
--- a/k8s/charts/seaweedfs/templates/s3/s3-iceberg-ingress.yaml
+++ b/k8s/charts/seaweedfs/templates/s3/s3-iceberg-ingress.yaml
@@ -44,6 +44,7 @@ metadata:
     {{- with .Values.s3.icebergIngress.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.s3.icebergIngress.labels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   {{- if .Values.s3.icebergIngress.className }}
   ingressClassName: {{ .Values.s3.icebergIngress.className | quote }}
diff --git a/k8s/charts/seaweedfs/templates/s3/s3-ingress.yaml b/k8s/charts/seaweedfs/templates/s3/s3-ingress.yaml
index e32d581786..bab3e9fe41 100644
--- a/k8s/charts/seaweedfs/templates/s3/s3-ingress.yaml
+++ b/k8s/charts/seaweedfs/templates/s3/s3-ingress.yaml
@@ -35,6 +35,7 @@ metadata:
     {{- with .Values.s3.ingress.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.s3.ingress.labels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   ingressClassName: {{ .Values.s3.ingress.className | quote }}
   tls:
diff --git a/k8s/charts/seaweedfs/templates/s3/s3-lance-ingress.yaml b/k8s/charts/seaweedfs/templates/s3/s3-lance-ingress.yaml
index fb96553f74..e1e75ea942 100644
--- a/k8s/charts/seaweedfs/templates/s3/s3-lance-ingress.yaml
+++ b/k8s/charts/seaweedfs/templates/s3/s3-lance-ingress.yaml
@@ -44,6 +44,7 @@ metadata:
     {{- with .Values.s3.lanceIngress.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.s3.lanceIngress.labels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   {{- if .Values.s3.lanceIngress.className }}
   ingressClassName: {{ .Values.s3.lanceIngress.className | quote }}
diff --git a/k8s/charts/seaweedfs/templates/s3/s3-secret.yaml b/k8s/charts/seaweedfs/templates/s3/s3-secret.yaml
index 411577dc63..85ac9af15c 100644
--- a/k8s/charts/seaweedfs/templates/s3/s3-secret.yaml
+++ b/k8s/charts/seaweedfs/templates/s3/s3-secret.yaml
@@ -49,6 +49,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: s3
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 stringData:
   {{- /* An identity read from an existing Secret keeps its keys there; the
          config below names the environment variables carrying them. */}}
diff --git a/k8s/charts/seaweedfs/templates/s3/s3-service.yaml b/k8s/charts/seaweedfs/templates/s3/s3-service.yaml
index 4549cdcdd7..5b5357d581 100644
--- a/k8s/charts/seaweedfs/templates/s3/s3-service.yaml
+++ b/k8s/charts/seaweedfs/templates/s3/s3-service.yaml
@@ -10,6 +10,7 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.s3.annotations }}
   annotations:
     {{- toYaml .Values.s3.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/s3/s3-servicemonitor.yaml b/k8s/charts/seaweedfs/templates/s3/s3-servicemonitor.yaml
index 613fe4f2fc..60420c8b6f 100644
--- a/k8s/charts/seaweedfs/templates/s3/s3-servicemonitor.yaml
+++ b/k8s/charts/seaweedfs/templates/s3/s3-servicemonitor.yaml
@@ -19,6 +19,7 @@ metadata:
     {{- with .Values.global.seaweedfs.monitoring.additionalLabels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.global.seaweedfs.monitoring.additionalLabels) }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.s3.annotations }}
   annotations:
     {{- toYaml .Values.s3.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/sftp/sftp-ca-secret.yaml b/k8s/charts/seaweedfs/templates/sftp/sftp-ca-secret.yaml
index 4ea7611a58..efe909d502 100644
--- a/k8s/charts/seaweedfs/templates/sftp/sftp-ca-secret.yaml
+++ b/k8s/charts/seaweedfs/templates/sftp/sftp-ca-secret.yaml
@@ -34,6 +34,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: sftp
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 stringData:
   ca_user.pub: |
 {{ $inlineCAKeys | indent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/sftp/sftp-deployment.yaml b/k8s/charts/seaweedfs/templates/sftp/sftp-deployment.yaml
index 322db9c5ba..5078b799e2 100644
--- a/k8s/charts/seaweedfs/templates/sftp/sftp-deployment.yaml
+++ b/k8s/charts/seaweedfs/templates/sftp/sftp-deployment.yaml
@@ -11,6 +11,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: sftp
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.sftp.annotations }}
   annotations:
     {{- toYaml .Values.sftp.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/sftp/sftp-secret.yaml b/k8s/charts/seaweedfs/templates/sftp/sftp-secret.yaml
index cf3ad915de..b7e6dad9ea 100644
--- a/k8s/charts/seaweedfs/templates/sftp/sftp-secret.yaml
+++ b/k8s/charts/seaweedfs/templates/sftp/sftp-secret.yaml
@@ -27,6 +27,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: sftp
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 stringData:
   admin_password: {{ $admin_pwd }}
   readonly_password: {{ $read_user_pwd }}
diff --git a/k8s/charts/seaweedfs/templates/sftp/sftp-service.yaml b/k8s/charts/seaweedfs/templates/sftp/sftp-service.yaml
index 6bd1138caf..b3f56a9645 100644
--- a/k8s/charts/seaweedfs/templates/sftp/sftp-service.yaml
+++ b/k8s/charts/seaweedfs/templates/sftp/sftp-service.yaml
@@ -10,6 +10,7 @@ metadata:
     app.kubernetes.io/component: sftp
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.sftp.annotations }}
   annotations:
     {{- toYaml .Values.sftp.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/sftp/sftp-servicemonitor.yaml b/k8s/charts/seaweedfs/templates/sftp/sftp-servicemonitor.yaml
index 329bed1993..41787b6820 100644
--- a/k8s/charts/seaweedfs/templates/sftp/sftp-servicemonitor.yaml
+++ b/k8s/charts/seaweedfs/templates/sftp/sftp-servicemonitor.yaml
@@ -16,6 +16,7 @@ metadata:
     {{- with .Values.global.seaweedfs.monitoring.additionalLabels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.global.seaweedfs.monitoring.additionalLabels) }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.sftp.annotations }}
   annotations:
     {{- toYaml .Values.sftp.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/sftp/sftp-ssh-secret.yaml b/k8s/charts/seaweedfs/templates/sftp/sftp-ssh-secret.yaml
index 81b6f35115..aa5c670f27 100644
--- a/k8s/charts/seaweedfs/templates/sftp/sftp-ssh-secret.yaml
+++ b/k8s/charts/seaweedfs/templates/sftp/sftp-ssh-secret.yaml
@@ -28,6 +28,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: sftp
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 data:
 {{- range $name, $value := $hostKeys }}
   {{ $name }}: {{ $value }}
diff --git a/k8s/charts/seaweedfs/templates/shared/_helpers.tpl b/k8s/charts/seaweedfs/templates/shared/_helpers.tpl
index e438166eac..8df5ab1e0e 100644
--- a/k8s/charts/seaweedfs/templates/shared/_helpers.tpl
+++ b/k8s/charts/seaweedfs/templates/shared/_helpers.tpl
@@ -57,6 +57,43 @@ Expand the name of the chart.
 {{- default .Release.Namespace .Values.namespaceOverride -}}
 {{- end -}}
 
+{{/*
+commonLabels without the chart's own keys. Takes the root context, or a dict
+with "context" and "exclude" (labels the object already sets).
+*/}}
+{{- define "seaweedfs.commonLabels" -}}
+{{- $context := . -}}
+{{- $exclude := dict -}}
+{{- if hasKey . "context" -}}
+{{-   $context = .context -}}
+{{-   $exclude = .exclude | default dict -}}
+{{- end -}}
+{{- with $context.Values.commonLabels -}}
+{{-   $labels := include "seaweedfs.tplvalues.render" (dict "value" . "context" $context) | fromYaml -}}
+{{-   $err := get $labels "Error" -}}
+{{-   if and (not (kindIs "map" .)) (eq (len $labels) 1) (kindIs "string" $err) (hasPrefix "error " $err) -}}
+{{-     fail (printf "commonLabels must render to a map of labels: %s" $err) -}}
+{{-   end -}}
+{{-   $labels = omit $labels "app.kubernetes.io/name" "app.kubernetes.io/instance" "app.kubernetes.io/component" "app.kubernetes.io/managed-by" "helm.sh/chart" -}}
+{{-   range $key, $_ := $exclude -}}
+{{-     $_ := unset $labels $key -}}
+{{-   end -}}
+{{-   $rendered := dict -}}
+{{-   range $key, $value := $labels -}}
+{{-     if not (kindIs "invalid" $value) -}}
+{{-       $s := toString $value -}}
+{{-       if and (kindIs "float64" $value) (eq $value (floor $value)) (lt $value 9.2e18) (gt $value -9.2e18) -}}
+{{-         $s = toString (int64 $value) -}}
+{{-       end -}}
+{{-       $_ := set $rendered $key $s -}}
+{{-     end -}}
+{{-   end -}}
+{{-   if $rendered -}}
+{{-     toYaml $rendered | trim -}}
+{{-   end -}}
+{{- end -}}
+{{- end -}}
+
 {{/*
 Inject extra environment vars in the format key:value, if populated
 */}}
@@ -727,3 +764,9 @@ on install.
   "auditLogConfig" (list .Values.s3.auditLogConfig .Values.filer.s3.auditLogConfig)
   | toJson | sha256sum -}}
 {{- end -}}
+
+{{/* Master ConfigMap checksum, ignoring commonLabels so labels do not roll the pods */}}
+{{- define "seaweedfs.master.configChecksum" -}}
+{{- $context := merge (dict "Values" (omit .Values "commonLabels")) (omit . "Values") -}}
+{{- include (print .Template.BasePath "/master/master-configmap.yaml") $context | sha256sum -}}
+{{- end -}}
diff --git a/k8s/charts/seaweedfs/templates/shared/cluster-role.yaml b/k8s/charts/seaweedfs/templates/shared/cluster-role.yaml
index f6a8bc9395..1ae6d6c30a 100644
--- a/k8s/charts/seaweedfs/templates/shared/cluster-role.yaml
+++ b/k8s/charts/seaweedfs/templates/shared/cluster-role.yaml
@@ -11,6 +11,7 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 rules:
   - apiGroups: [""]
     resources: ["pods"]
@@ -25,6 +26,7 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 subjects:
   - kind: ServiceAccount
     name: {{ include "seaweedfs.serviceAccountName" . }}
diff --git a/k8s/charts/seaweedfs/templates/shared/networkpolicy.yaml b/k8s/charts/seaweedfs/templates/shared/networkpolicy.yaml
index 11153ce9e3..4af04ea38a 100644
--- a/k8s/charts/seaweedfs/templates/shared/networkpolicy.yaml
+++ b/k8s/charts/seaweedfs/templates/shared/networkpolicy.yaml
@@ -168,6 +168,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ $.Release.Service | quote }}
     app.kubernetes.io/instance: {{ $.Release.Name | quote }}
     app.kubernetes.io/component: {{ $component | quote }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if $target.hook }}
   annotations:
     {{- /* Only before-hook-creation: the policy has to outlive the Job it
diff --git a/k8s/charts/seaweedfs/templates/shared/notification-configmap.yaml b/k8s/charts/seaweedfs/templates/shared/notification-configmap.yaml
index 8be18261c0..6b4db386c8 100644
--- a/k8s/charts/seaweedfs/templates/shared/notification-configmap.yaml
+++ b/k8s/charts/seaweedfs/templates/shared/notification-configmap.yaml
@@ -9,6 +9,7 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.filer.annotations }}
   annotations:
     {{- toYaml .Values.filer.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/shared/post-install-bucket-hook.yaml b/k8s/charts/seaweedfs/templates/shared/post-install-bucket-hook.yaml
index 695a557fc2..2a88b6018d 100644
--- a/k8s/charts/seaweedfs/templates/shared/post-install-bucket-hook.yaml
+++ b/k8s/charts/seaweedfs/templates/shared/post-install-bucket-hook.yaml
@@ -70,6 +70,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
     app.kubernetes.io/instance: {{ .Release.Name | quote }}
     app.kubernetes.io/component: bucket-hook
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
   annotations:
     "helm.sh/hook": post-install,post-upgrade
     "helm.sh/hook-weight": "-5"
diff --git a/k8s/charts/seaweedfs/templates/shared/seaweedfs-grafana-dashboard.yaml b/k8s/charts/seaweedfs/templates/shared/seaweedfs-grafana-dashboard.yaml
index 129a3403d0..c36dde32dc 100644
--- a/k8s/charts/seaweedfs/templates/shared/seaweedfs-grafana-dashboard.yaml
+++ b/k8s/charts/seaweedfs/templates/shared/seaweedfs-grafana-dashboard.yaml
@@ -12,6 +12,7 @@ metadata:
   namespace: {{ include "seaweedfs.namespace" $ | quote }}
   labels:
     grafana_dashboard: "1"
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" (dict "grafana_dashboard" "1")) }}{{ . | nindent 4 }}{{ end }}
 data:
   {{ $dashboardName }}.json: |-
 {{ toString $file | indent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/shared/secret-seaweedfs-db.yaml b/k8s/charts/seaweedfs/templates/shared/secret-seaweedfs-db.yaml
index c693b96052..39940a947e 100644
--- a/k8s/charts/seaweedfs/templates/shared/secret-seaweedfs-db.yaml
+++ b/k8s/charts/seaweedfs/templates/shared/secret-seaweedfs-db.yaml
@@ -18,6 +18,7 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 stringData:
   user: {{ if $data.user }}{{ b64dec $data.user | quote }}{{ else }}"YourSWUser"{{ end }}
   # generated on first install, reused afterwards
diff --git a/k8s/charts/seaweedfs/templates/shared/security-configmap.yaml b/k8s/charts/seaweedfs/templates/shared/security-configmap.yaml
index 364675f8bb..f5e7e4a67f 100644
--- a/k8s/charts/seaweedfs/templates/shared/security-configmap.yaml
+++ b/k8s/charts/seaweedfs/templates/shared/security-configmap.yaml
@@ -10,6 +10,7 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 data:
   {{- $fullname := include "seaweedfs.fullname" . }}
   {{- $securityConfigName := printf "%s-security-config" $fullname }}
diff --git a/k8s/charts/seaweedfs/templates/shared/service-account.yaml b/k8s/charts/seaweedfs/templates/shared/service-account.yaml
index 8b05b17e65..22aeda32b7 100644
--- a/k8s/charts/seaweedfs/templates/shared/service-account.yaml
+++ b/k8s/charts/seaweedfs/templates/shared/service-account.yaml
@@ -13,4 +13,5 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 automountServiceAccountToken: {{ .Values.global.seaweedfs.automountServiceAccountToken }}
\ No newline at end of file
diff --git a/k8s/charts/seaweedfs/templates/volume/volume-httproute.yaml b/k8s/charts/seaweedfs/templates/volume/volume-httproute.yaml
index 0caacec9ef..1880a83cf2 100644
--- a/k8s/charts/seaweedfs/templates/volume/volume-httproute.yaml
+++ b/k8s/charts/seaweedfs/templates/volume/volume-httproute.yaml
@@ -19,6 +19,7 @@ metadata:
     {{- with .Values.volume.httpRoute.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.volume.httpRoute.labels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   {{- with .Values.volume.httpRoute.parentRefs }}
   parentRefs:
diff --git a/k8s/charts/seaweedfs/templates/volume/volume-ingress.yaml b/k8s/charts/seaweedfs/templates/volume/volume-ingress.yaml
index ee08cad1d3..6d8b5369de 100644
--- a/k8s/charts/seaweedfs/templates/volume/volume-ingress.yaml
+++ b/k8s/charts/seaweedfs/templates/volume/volume-ingress.yaml
@@ -30,6 +30,7 @@ metadata:
     {{- with .Values.volume.ingress.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.volume.ingress.labels) }}{{ . | nindent 4 }}{{ end }}
 spec:
   {{- if and (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) .Values.volume.ingress.className }}
   ingressClassName: {{ .Values.volume.ingress.className | quote }}
diff --git a/k8s/charts/seaweedfs/templates/volume/volume-resize-hook.yaml b/k8s/charts/seaweedfs/templates/volume/volume-resize-hook.yaml
index 7f657da64b..6b7b1bcc65 100644
--- a/k8s/charts/seaweedfs/templates/volume/volume-resize-hook.yaml
+++ b/k8s/charts/seaweedfs/templates/volume/volume-resize-hook.yaml
@@ -16,6 +16,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
     app.kubernetes.io/instance: {{ .Release.Name | quote }}
     app.kubernetes.io/component: volume-resize-hook
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
   annotations:
     helm.sh/hook: pre-install,pre-upgrade
     helm.sh/hook-weight: "0"
@@ -77,6 +78,10 @@ kind: ServiceAccount
 metadata:
   name: {{ $seaweedfsName }}-volume-resize-hook
   namespace: {{ include "seaweedfs.namespace" . | quote }}
+  {{- with include "seaweedfs.commonLabels" $ }}
+  labels:
+    {{- . | nindent 4 }}
+  {{- end }}
   annotations:
     helm.sh/hook: pre-install,pre-upgrade
     helm.sh/hook-weight: "-5"
@@ -87,6 +92,10 @@ kind: Role
 metadata:
   name: {{ $seaweedfsName }}-volume-resize-hook
   namespace: {{ include "seaweedfs.namespace" . | quote }}
+  {{- with include "seaweedfs.commonLabels" $ }}
+  labels:
+    {{- . | nindent 4 }}
+  {{- end }}
   annotations:
     helm.sh/hook: pre-install,pre-upgrade
     helm.sh/hook-weight: "-5"
@@ -104,6 +113,10 @@ kind: RoleBinding
 metadata:
   name: {{ $seaweedfsName }}-volume-resize-hook
   namespace: {{ include "seaweedfs.namespace" . | quote }}
+  {{- with include "seaweedfs.commonLabels" $ }}
+  labels:
+    {{- . | nindent 4 }}
+  {{- end }}
   annotations:
     helm.sh/hook: pre-install,pre-upgrade
     helm.sh/hook-weight: "-5"
diff --git a/k8s/charts/seaweedfs/templates/volume/volume-service.yaml b/k8s/charts/seaweedfs/templates/volume/volume-service.yaml
index 78dd9a0312..0840ccfb9a 100644
--- a/k8s/charts/seaweedfs/templates/volume/volume-service.yaml
+++ b/k8s/charts/seaweedfs/templates/volume/volume-service.yaml
@@ -16,6 +16,7 @@ metadata:
     app.kubernetes.io/component: {{ $volumeName }}
     helm.sh/chart: {{ $.Chart.Name }}-{{ $.Chart.Version | replace "+" "_" }}
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if $volume.annotations }}
   annotations:
     {{- toYaml $volume.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/volume/volume-servicemonitor.yaml b/k8s/charts/seaweedfs/templates/volume/volume-servicemonitor.yaml
index 21f29b9069..965bee114a 100644
--- a/k8s/charts/seaweedfs/templates/volume/volume-servicemonitor.yaml
+++ b/k8s/charts/seaweedfs/templates/volume/volume-servicemonitor.yaml
@@ -22,6 +22,7 @@ metadata:
     {{- with $.Values.global.seaweedfs.monitoring.additionalLabels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.global.seaweedfs.monitoring.additionalLabels) }}{{ . | nindent 4 }}{{ end }}
 {{- with $volume.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/volume/volume-statefulset.yaml b/k8s/charts/seaweedfs/templates/volume/volume-statefulset.yaml
index 561f2056b7..b49000cb18 100644
--- a/k8s/charts/seaweedfs/templates/volume/volume-statefulset.yaml
+++ b/k8s/charts/seaweedfs/templates/volume/volume-statefulset.yaml
@@ -21,6 +21,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/instance: {{ $.Release.Name }}
     app.kubernetes.io/component: {{ $volumeName }}
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if $volume.annotations }}
   annotations:
     {{- toYaml $volume.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/worker/worker-deployment.yaml b/k8s/charts/seaweedfs/templates/worker/worker-deployment.yaml
index ade4ee675b..2e7f4432be 100644
--- a/k8s/charts/seaweedfs/templates/worker/worker-deployment.yaml
+++ b/k8s/charts/seaweedfs/templates/worker/worker-deployment.yaml
@@ -14,6 +14,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: worker
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 {{- if .Values.worker.annotations }}
   annotations:
     {{- toYaml .Values.worker.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/worker/worker-service.yaml b/k8s/charts/seaweedfs/templates/worker/worker-service.yaml
index 0adeff3dc1..9ffc46968a 100644
--- a/k8s/charts/seaweedfs/templates/worker/worker-service.yaml
+++ b/k8s/charts/seaweedfs/templates/worker/worker-service.yaml
@@ -10,6 +10,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: worker
+    {{- with include "seaweedfs.commonLabels" $ }}{{ . | nindent 4 }}{{ end }}
 spec:
   clusterIP: None  # Headless service
   {{- $lanceMetrics := and .Values.worker.lanceMetricsPort (include "seaweedfs.worker.lanceNamespaceUrl" .) }}
diff --git a/k8s/charts/seaweedfs/templates/worker/worker-servicemonitor.yaml b/k8s/charts/seaweedfs/templates/worker/worker-servicemonitor.yaml
index 212de65bcc..e5a8cd2403 100644
--- a/k8s/charts/seaweedfs/templates/worker/worker-servicemonitor.yaml
+++ b/k8s/charts/seaweedfs/templates/worker/worker-servicemonitor.yaml
@@ -17,6 +17,7 @@ metadata:
     {{- with .Values.global.seaweedfs.monitoring.additionalLabels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with include "seaweedfs.commonLabels" (dict "context" $ "exclude" $.Values.global.seaweedfs.monitoring.additionalLabels) }}{{ . | nindent 4 }}{{ end }}
 {{- with .Values.worker.serviceMonitor.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/values.yaml b/k8s/charts/seaweedfs/values.yaml
index 34fb60aa82..5b1b5ece04 100644
--- a/k8s/charts/seaweedfs/values.yaml
+++ b/k8s/charts/seaweedfs/values.yaml
@@ -2239,6 +2239,9 @@ certificates:
     # seaweedfs-master-cert, seaweedfs-filer-cert, etc. Can see any statefulset definition to see secret names
     enabled: false
 
+# Labels added to the metadata of every object, except pods and volumeClaimTemplates.
+# A map, or a template string rendering to one.
+commonLabels: {}
 # Labels to be added to all the created pods
 podLabels: {}
 # Annotations to be added to all the created pods