helm: add namespaceOverride to deploy into another namespace (#12256)

* helm: add namespaceOverride to deploy into another namespace

When the chart is a subchart of an umbrella chart, every object lands in
the umbrella's release namespace, with no way to give SeaweedFS its own.

namespaceOverride, empty by default, now sets the namespace of every
object through a new seaweedfs.namespace helper, which falls back to the
release namespace. All uses of .Release.Namespace go through it, so the
in-cluster addresses, certificate SANs, ClusterRoleBinding subjects,
HTTPRoute backendRefs and lookups follow the override too. The
self-signed Issuer, the bucket hook Job and the volume resize hook
objects, which had no metadata.namespace, now set it.

With namespaceOverride unset the default render is unchanged. Adds a
helm_ci check that renders with an override and asserts nothing is left
in the release namespace.

* ci: cover the bucket hook Job in the all-in-one namespace test

The all-in-one render set s3.createBuckets, which bucketHookEnabled
ignores in allInOne mode, so the Job never rendered and the namespace
check could not see it. Use allInOne.s3.createBuckets and assert the
Job is present.

* helm: fail on an invalid namespaceOverride instead of reshaping it

Truncating and trimming could silently map an override onto a different
existing namespace and deploy into it. Validate against the DNS-1123
namespace rules and fail the render instead.

* helm: bound the master data volume name at 63 characters

data-<namespace> can exceed the Kubernetes name limit when the release
or override namespace is near 63 characters; truncate the composed name
and trim a trailing hyphen like the other name helpers.

* helm: quote the rendered namespace in YAML fields

* helm: warn that changing namespaceOverride strands claims and data

* helm: say namespaceOverride only moves namespaced objects

* helm: retrigger the PR head sync (no changes)

* helm: warn that secrets and hook resources do not follow namespaceOverride

* helm: warn that hostPath data does not follow namespaceOverride

---------

Co-authored-by: jeffWild <20067853+jeffWild@users.noreply.github.com>
Co-authored-by: chrislusf <chrislusf@users.noreply.github.com>

.github/workflows/helm_ci.yml

@@ -1934,6 +1934,61 @@ jobs:
           PYEOF
           echo "License + master persistence tests passed"
 
+          echo ""
+          echo "=== Testing namespaceOverride ==="
+          NS_ARGS=(
+            --set s3.enabled=true --set s3.enableAuth=true
+            --set 's3.createBuckets[0].name=data'
+            --set sftp.enabled=true --set sftp.enableAuth=true
+            --set admin.enabled=true --set admin.secret.adminPassword=ci
+            --set worker.enabled=true
+            --set cosi.enabled=true --set cosi.bucketClassName=seaweedfs
+            --set global.seaweedfs.enableSecurity=true
+            --set global.seaweedfs.monitoring.enabled=true
+            --set networkPolicy.enabled=true
+            --set volumes.extra.replicas=1
+          )
+          helm template test $CHART_DIR --namespace release-ns "${NS_ARGS[@]}" \
+            --set namespaceOverride=other-ns > /tmp/ns-override.yaml
+          helm template test $CHART_DIR --namespace release-ns \
+            --set allInOne.enabled=true --set allInOne.s3.enabled=true \
+            --set master.enabled=false --set volume.enabled=false --set filer.enabled=false \
+            --set 'allInOne.s3.createBuckets[0].name=data' \
+            --set global.seaweedfs.enableSecurity=true \
+            --set namespaceOverride=other-ns > /tmp/ns-override-aio.yaml
+          grep -q 'kind: Job' /tmp/ns-override-aio.yaml
+          python3 - /tmp/ns-override.yaml /tmp/ns-override-aio.yaml <<'PYEOF'
+          import sys, yaml
+          CLUSTER_SCOPED = {"ClusterRole", "ClusterRoleBinding", "BucketClass", "BucketAccessClass"}
+          failed = []
+          for path in sys.argv[1:]:
+              text = open(path).read()
+              if "release-ns" in text:
+                  failed.append(f"{path}: release namespace still rendered")
+              for d in yaml.safe_load_all(text):
+                  if not d:
+                      continue
+                  kind, md = d["kind"], d["metadata"]
+                  if kind in CLUSTER_SCOPED:
+                      for s in d.get("subjects") or []:
+                          if s.get("namespace") != "other-ns":
+                              failed.append(f"{path}: {kind}/{md['name']} subject in {s.get('namespace')!r}")
+                  elif md.get("namespace") != "other-ns":
+                      failed.append(f"{path}: {kind}/{md['name']} in {md.get('namespace')!r}")
+          if failed:
+              print("\n".join(failed), file=sys.stderr)
+              sys.exit(1)
+          PYEOF
+          grep -q -- '-filer=test-seaweedfs-filer-client.other-ns:' /tmp/ns-override.yaml
+          grep -q 'test-seaweedfs-master-0.test-seaweedfs-master.other-ns:' /tmp/ns-override.yaml
+          grep -qF "'*.other-ns.svc.cluster.local'" /tmp/ns-override.yaml
+          # Setting it to the release namespace changes nothing.
+          helm template test $CHART_DIR --namespace release-ns > /tmp/ns-default.yaml
+          helm template test $CHART_DIR --namespace release-ns \
+            --set namespaceOverride=release-ns > /tmp/ns-same.yaml
+          diff /tmp/ns-default.yaml /tmp/ns-same.yaml
+          echo "namespaceOverride moves every namespaced object and address"
+
           echo "All template rendering tests passed!"
 
       - name: Resolve an image tag that is published

k8s/charts/seaweedfs/README.md

@@ -545,6 +545,10 @@ helm install seaweedfs-worker-vacuum seaweedfs/seaweedfs -f values-worker-vacuum
 helm install seaweedfs-worker-balance seaweedfs/seaweedfs -f values-worker-balance.yaml
 ```
 
+## Deploying into another namespace
+
+`namespaceOverride` deploys every namespaced object into an existing namespace other than the release namespace, for instance when the chart is a subchart. In-cluster addresses follow it. Set it before the first install: changing it later moves regular namespaced objects only — claims and their data do not move, hook resources such as the resize hook's ServiceAccount, Role, RoleBinding, and NetworkPolicy stay behind in the old namespace, and generated Secrets are not recreated in the new one. Migrate claims by hand and clean up the old hook resources. If the release uses generated S3 credentials, copy `<fullname>-s3-secret`, including its key fields, into the new namespace before the upgrade — otherwise the chart generates new keys and clients on the old ones fail authentication (explicit `s3.credentials` and `credentials.*.existingSecret` values do not use this generation path). With the default MySQL setup, also copy `<fullname>-db-secret` — a `pre-install` hook only, so it never reaches the new namespace — or pass `WEED_MYSQL_USERNAME` and `WEED_MYSQL_PASSWORD` through `filer.extraEnvironmentVars`. With the default `hostPath` storage the data is node-local too: stop the old workloads and plan the hostPath migration first, or the new pods can come up empty on other nodes or share the same directories concurrently.
+
 ## Gateway API
 
 Every component with an `ingress` block (master, volume, filer, s3 and admin) can also be exposed through a [Gateway API](https://gateway-api.sigs.k8s.io/) `HTTPRoute`, for clusters that route through a Gateway instead of an Ingress controller. `<component>.httpRoute` sits next to `<component>.ingress` and is disabled by default. The chart does not create the Gateway, so point `parentRefs` at one that already exists, and the `gateway.networking.k8s.io/v1` CRDs must be installed.

k8s/charts/seaweedfs/templates/admin/admin-httproute.yaml

@@ -3,7 +3,7 @@ apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
   name: {{ include "seaweedfs.componentName" (list . "admin") }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   {{- with .Values.admin.httpRoute.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}
@@ -35,7 +35,7 @@ spec:
         - group: ""
           kind: Service
           name: {{ include "seaweedfs.componentName" (list $ "admin") }}
-          namespace: {{ $.Release.Namespace }}
+          namespace: {{ include "seaweedfs.namespace" $ | quote }}
           port: {{ $.Values.admin.port }}
           weight: 1
         {{- end }}

k8s/charts/seaweedfs/templates/admin/admin-ingress.yaml

@@ -9,7 +9,7 @@ apiVersion: extensions/v1beta1
 kind: Ingress
 metadata:
   name: ingress-{{ include "seaweedfs.fullname" . }}-admin
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   annotations:
   {{- if and (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) .Values.admin.ingress.className }}
     kubernetes.io/ingress.class: {{ .Values.admin.ingress.className }}

k8s/charts/seaweedfs/templates/admin/admin-secret.yaml

@@ -4,7 +4,7 @@ kind: Secret
 type: Opaque
 metadata:
   name: {{ include "seaweedfs.fullname" . }}-admin-secret
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   annotations:
     "helm.sh/resource-policy": keep
     "helm.sh/hook": "pre-install,pre-upgrade"

k8s/charts/seaweedfs/templates/admin/admin-service.yaml

@@ -3,7 +3,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: {{ include "seaweedfs.componentName" (list . "admin") }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}

k8s/charts/seaweedfs/templates/admin/admin-servicemonitor.yaml

@@ -5,7 +5,7 @@ apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
   name: {{ include "seaweedfs.fullname" . }}-admin
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}

k8s/charts/seaweedfs/templates/admin/admin-statefulset.yaml

@@ -15,7 +15,7 @@ apiVersion: apps/v1
 kind: StatefulSet
 metadata:
   name: {{ include "seaweedfs.componentName" (list . "admin") }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
@@ -185,7 +185,7 @@ spec:
               {{- else if .Values.global.seaweedfs.masterServer }}
               -masters={{ .Values.global.seaweedfs.masterServer }} \
               {{- else }}
-              -masters={{ range $index := until (.Values.master.replicas | int) }}${SEAWEEDFS_FULLNAME}-master-{{ $index }}.${SEAWEEDFS_FULLNAME}-master.{{ $.Release.Namespace }}:{{ $.Values.master.port }}{{ if lt $index (sub ($.Values.master.replicas | int) 1) }},{{ end }}{{ end }} \
+              -masters={{ range $index := until (.Values.master.replicas | int) }}${SEAWEEDFS_FULLNAME}-master-{{ $index }}.${SEAWEEDFS_FULLNAME}-master.{{ include "seaweedfs.namespace" $ }}:{{ $.Values.master.port }}{{ if lt $index (sub ($.Values.master.replicas | int) 1) }},{{ end }}{{ end }} \
               {{- end }}
               {{- if $urlPrefix }}
               -urlPrefix={{ $urlPrefix }} \

k8s/charts/seaweedfs/templates/all-in-one/all-in-one-deployment.yaml

@@ -4,7 +4,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ include "seaweedfs.fullname" . }}-all-in-one
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
@@ -40,7 +40,7 @@ spec:
       {{- $podAnnotations := mergeOverwrite (deepCopy (.Values.podAnnotations | default dict)) (.Values.allInOne.podAnnotations | default dict) }}
       {{- $existingS3ConfigSecret := or .Values.allInOne.s3.existingConfigSecret .Values.s3.existingConfigSecret .Values.filer.s3.existingConfigSecret }}
       {{- if $existingS3ConfigSecret }}
-      {{- $configSecret := (lookup "v1" "Secret" .Release.Namespace $existingS3ConfigSecret) | default dict }}
+      {{- $configSecret := (lookup "v1" "Secret" (include "seaweedfs.namespace" .) $existingS3ConfigSecret) | default dict }}
       {{- $_ := set $podAnnotations "checksum/s3config" ($configSecret | toYaml | sha256sum) }}
       {{- else }}
       {{- $_ := set $podAnnotations "checksum/s3config" (include "seaweedfs.s3.configChecksum" .) }}

k8s/charts/seaweedfs/templates/all-in-one/all-in-one-pvc.yaml

@@ -4,7 +4,7 @@ apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: {{ include "seaweedfs.fullname" . }}-all-in-one-data
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}

k8s/charts/seaweedfs/templates/all-in-one/all-in-one-service.yml

@@ -3,7 +3,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: {{ include "seaweedfs.componentName" (list . "all-in-one") }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}

k8s/charts/seaweedfs/templates/all-in-one/all-in-one-servicemonitor.yaml

@@ -5,7 +5,7 @@ apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
   name: {{ include "seaweedfs.fullname" . }}-all-in-one
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}

k8s/charts/seaweedfs/templates/cert/admin-cert.yaml

@@ -4,7 +4,7 @@ apiVersion: cert-manager.io/v1{{ if .Values.global.seaweedfs.certificates.alphac
 kind: Certificate
 metadata:
   name: {{ include "seaweedfs.fullname" . }}-admin-cert
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
@@ -26,13 +26,13 @@ spec:
     - "SeaweedFS CA"
   dnsNames:
     - '{{ include "seaweedfs.fullname" . }}-admin'
-    - '{{ include "seaweedfs.fullname" . }}-admin.{{ .Release.Namespace }}'
-    - '{{ include "seaweedfs.fullname" . }}-admin.{{ .Release.Namespace }}.svc'
-    - '{{ include "seaweedfs.fullname" . }}-admin.{{ .Release.Namespace }}.svc.cluster.local'
+    - '{{ include "seaweedfs.fullname" . }}-admin.{{ include "seaweedfs.namespace" . }}'
+    - '{{ include "seaweedfs.fullname" . }}-admin.{{ include "seaweedfs.namespace" . }}.svc'
+    - '{{ include "seaweedfs.fullname" . }}-admin.{{ include "seaweedfs.namespace" . }}.svc.cluster.local'
     - '*.{{ include "seaweedfs.fullname" . }}-admin'
-    - '*.{{ include "seaweedfs.fullname" . }}-admin.{{ .Release.Namespace }}'
-    - '*.{{ include "seaweedfs.fullname" . }}-admin.{{ .Release.Namespace }}.svc'
-    - '*.{{ include "seaweedfs.fullname" . }}-admin.{{ .Release.Namespace }}.svc.cluster.local'
+    - '*.{{ include "seaweedfs.fullname" . }}-admin.{{ include "seaweedfs.namespace" . }}'
+    - '*.{{ include "seaweedfs.fullname" . }}-admin.{{ include "seaweedfs.namespace" . }}.svc'
+    - '*.{{ include "seaweedfs.fullname" . }}-admin.{{ include "seaweedfs.namespace" . }}.svc.cluster.local'
 {{- if .Values.certificates.dnsNames }}
 {{- range .Values.certificates.dnsNames }}
     - {{ . | quote }}

k8s/charts/seaweedfs/templates/cert/ca-cert.yaml

@@ -4,7 +4,7 @@ apiVersion: cert-manager.io/v1{{ if .Values.global.seaweedfs.certificates.alphac
 kind: Certificate
 metadata:
   name: {{ include "seaweedfs.fullname" . }}-ca-cert
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}

k8s/charts/seaweedfs/templates/cert/cert-caissuer.yaml

@@ -4,7 +4,7 @@ apiVersion: cert-manager.io/v1{{ if .Values.global.seaweedfs.certificates.alphac
 kind: Issuer
 metadata:
   name: {{ include "seaweedfs.fullname" . }}-ca-issuer
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}

k8s/charts/seaweedfs/templates/cert/cert-issuer.yaml

@@ -4,6 +4,7 @@ apiVersion: cert-manager.io/v1{{ if .Values.global.seaweedfs.certificates.alphac
 kind: Issuer
 metadata:
   name: {{ include "seaweedfs.fullname" . }}-issuer
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}

k8s/charts/seaweedfs/templates/cert/client-cert.yaml

@@ -4,7 +4,7 @@ apiVersion: cert-manager.io/v1{{ if .Values.global.seaweedfs.certificates.alphac
 kind: Certificate
 metadata:
   name: {{ include "seaweedfs.fullname" . }}-client-cert
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
@@ -20,18 +20,18 @@ spec:
     organizations:
     - "SeaweedFS CA"
   dnsNames:
-    - '*.{{ .Release.Namespace }}'
-    - '*.{{ .Release.Namespace }}.svc'
-    - '*.{{ .Release.Namespace }}.svc.cluster.local'
+    - '*.{{ include "seaweedfs.namespace" . }}'
+    - '*.{{ include "seaweedfs.namespace" . }}.svc'
+    - '*.{{ include "seaweedfs.namespace" . }}.svc.cluster.local'
 {{- if .Values.certificates.dnsNames }}
 {{- range .Values.certificates.dnsNames }}
     - {{ . | quote }}
 {{- end }}
 {{- end }}
     - '*.{{ include "seaweedfs.fullname" . }}-master'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc.cluster.local'
+    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ include "seaweedfs.namespace" . }}'
+    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ include "seaweedfs.namespace" . }}.svc'
+    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ include "seaweedfs.namespace" . }}.svc.cluster.local'
 {{- if .Values.certificates.ipAddresses }}
   ipAddresses:
     {{- range .Values.certificates.ipAddresses }}

k8s/charts/seaweedfs/templates/cert/filer-cert.yaml

@@ -4,7 +4,7 @@ apiVersion: cert-manager.io/v1{{ if .Values.global.seaweedfs.certificates.alphac
 kind: Certificate
 metadata:
   name: {{ include "seaweedfs.fullname" . }}-filer-cert
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
@@ -25,18 +25,18 @@ spec:
     organizations:
     - "SeaweedFS CA"
   dnsNames:
-    - '*.{{ .Release.Namespace }}'
-    - '*.{{ .Release.Namespace }}.svc'
-    - '*.{{ .Release.Namespace }}.svc.cluster.local'
+    - '*.{{ include "seaweedfs.namespace" . }}'
+    - '*.{{ include "seaweedfs.namespace" . }}.svc'
+    - '*.{{ include "seaweedfs.namespace" . }}.svc.cluster.local'
 {{- if .Values.certificates.dnsNames }}
 {{- range .Values.certificates.dnsNames }}
     - {{ . | quote }}
 {{- end }}
 {{- end }}
     - '*.{{ include "seaweedfs.fullname" . }}-master'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc.cluster.local'
+    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ include "seaweedfs.namespace" . }}'
+    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ include "seaweedfs.namespace" . }}.svc'
+    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ include "seaweedfs.namespace" . }}.svc.cluster.local'
 {{- if .Values.certificates.ipAddresses }}
   ipAddresses:
     {{- range .Values.certificates.ipAddresses }}

k8s/charts/seaweedfs/templates/cert/master-cert.yaml

@@ -4,7 +4,7 @@ apiVersion: cert-manager.io/v1{{ if .Values.global.seaweedfs.certificates.alphac
 kind: Certificate
 metadata:
   name: {{ include "seaweedfs.fullname" . }}-master-cert
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
@@ -25,18 +25,18 @@ spec:
     organizations:
     - "SeaweedFS CA"
   dnsNames:
-    - '*.{{ .Release.Namespace }}'
-    - '*.{{ .Release.Namespace }}.svc'
-    - '*.{{ .Release.Namespace }}.svc.cluster.local'
+    - '*.{{ include "seaweedfs.namespace" . }}'
+    - '*.{{ include "seaweedfs.namespace" . }}.svc'
+    - '*.{{ include "seaweedfs.namespace" . }}.svc.cluster.local'
 {{- if .Values.certificates.dnsNames }}
 {{- range .Values.certificates.dnsNames }}
     - {{ . | quote }}
 {{- end }}
 {{- end }}
     - '*.{{ include "seaweedfs.fullname" . }}-master'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc.cluster.local'
+    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ include "seaweedfs.namespace" . }}'
+    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ include "seaweedfs.namespace" . }}.svc'
+    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ include "seaweedfs.namespace" . }}.svc.cluster.local'
 {{- if .Values.certificates.ipAddresses }}
   ipAddresses:
     {{- range .Values.certificates.ipAddresses }}

k8s/charts/seaweedfs/templates/cert/volume-cert.yaml

@@ -4,7 +4,7 @@ apiVersion: cert-manager.io/v1{{ if .Values.global.seaweedfs.certificates.alphac
 kind: Certificate
 metadata:
   name: {{ include "seaweedfs.fullname" . }}-volume-cert
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
@@ -25,18 +25,18 @@ spec:
     organizations:
     - "SeaweedFS CA"
   dnsNames:
-    - '*.{{ .Release.Namespace }}'
-    - '*.{{ .Release.Namespace }}.svc'
-    - '*.{{ .Release.Namespace }}.svc.cluster.local'
+    - '*.{{ include "seaweedfs.namespace" . }}'
+    - '*.{{ include "seaweedfs.namespace" . }}.svc'
+    - '*.{{ include "seaweedfs.namespace" . }}.svc.cluster.local'
 {{- if .Values.certificates.dnsNames }}
 {{- range .Values.certificates.dnsNames }}
     - {{ . | quote }}
 {{- end }}
 {{- end }}
     - '*.{{ include "seaweedfs.fullname" . }}-master'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc'
-    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc.cluster.local'
+    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ include "seaweedfs.namespace" . }}'
+    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ include "seaweedfs.namespace" . }}.svc'
+    - '*.{{ include "seaweedfs.fullname" . }}-master.{{ include "seaweedfs.namespace" . }}.svc.cluster.local'
 {{- if .Values.certificates.ipAddresses }}
   ipAddresses:
     {{- range .Values.certificates.ipAddresses }}

k8s/charts/seaweedfs/templates/cert/worker-cert.yaml

@@ -4,7 +4,7 @@ apiVersion: cert-manager.io/v1{{ if .Values.global.seaweedfs.certificates.alphac
 kind: Certificate
 metadata:
   name: {{ include "seaweedfs.fullname" . }}-worker-cert
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
@@ -26,9 +26,9 @@ spec:
     - "SeaweedFS CA"
   dnsNames:
     - '*.{{ include "seaweedfs.fullname" . }}-worker'
-    - '*.{{ include "seaweedfs.fullname" . }}-worker.{{ .Release.Namespace }}'
-    - '*.{{ include "seaweedfs.fullname" . }}-worker.{{ .Release.Namespace }}.svc'
-    - '*.{{ include "seaweedfs.fullname" . }}-worker.{{ .Release.Namespace }}.svc.cluster.local'
+    - '*.{{ include "seaweedfs.fullname" . }}-worker.{{ include "seaweedfs.namespace" . }}'
+    - '*.{{ include "seaweedfs.fullname" . }}-worker.{{ include "seaweedfs.namespace" . }}.svc'
+    - '*.{{ include "seaweedfs.fullname" . }}-worker.{{ include "seaweedfs.namespace" . }}.svc.cluster.local'
 {{- if .Values.certificates.dnsNames }}
 {{- range .Values.certificates.dnsNames }}
     - {{ . | quote }}

k8s/charts/seaweedfs/templates/cosi/cosi-cluster-role.yaml

@@ -69,7 +69,7 @@ metadata:
 subjects:
   - kind: ServiceAccount
     name: {{ include "seaweedfs.serviceAccountName" . }}-objectstorage-provisioner
-    namespace: {{ .Release.Namespace }}
+    namespace: {{ include "seaweedfs.namespace" . | quote }}
 roleRef:
   kind: ClusterRole
   name: {{ include "seaweedfs.fullname" . }}-objectstorage-provisioner

k8s/charts/seaweedfs/templates/cosi/cosi-deployment.yaml

@@ -4,7 +4,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ include "seaweedfs.fullname" . }}-objectstorage-provisioner
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
@@ -82,9 +82,9 @@ spec:
               {{- else if .Values.s3.ingress.enabled }}
               value: "{{ printf "https://%s" .Values.s3.ingress.host }}"
               {{- else if .Values.s3.enabled }}
-              value: "{{ printf "https://%s.%s.svc" (include "seaweedfs.componentName" (list . "s3")) .Release.Namespace }}"
+              value: "{{ printf "https://%s.%s.svc" (include "seaweedfs.componentName" (list . "s3")) (include "seaweedfs.namespace" .) }}"
               {{- else }}
-              value: "{{ printf "https://%s.%s.svc" (include "seaweedfs.componentName" (list . "filer")) .Release.Namespace }}"
+              value: "{{ printf "https://%s.%s.svc" (include "seaweedfs.componentName" (list . "filer")) (include "seaweedfs.namespace" .) }}"
               {{- end }}
             {{- with .Values.cosi.region }}
             - name: REGION

k8s/charts/seaweedfs/templates/cosi/cosi-service-account.yaml

@@ -4,7 +4,7 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: {{ include "seaweedfs.serviceAccountName" . }}-objectstorage-provisioner
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}

k8s/charts/seaweedfs/templates/filer/filer-grpc-ingressroutetcp.yaml

@@ -17,7 +17,7 @@ apiVersion: traefik.io/v1alpha1
 kind: IngressRouteTCP
 metadata:
   name: {{ include "seaweedfs.fullname" . }}-filer-grpc
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}

k8s/charts/seaweedfs/templates/filer/filer-httproute.yaml

@@ -5,7 +5,7 @@ apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
   name: {{ include "seaweedfs.componentName" (list . "filer") }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   {{- with .Values.filer.httpRoute.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}
@@ -37,7 +37,7 @@ spec:
         - group: ""
           kind: Service
           name: {{ $serviceName }}
-          namespace: {{ $.Release.Namespace }}
+          namespace: {{ include "seaweedfs.namespace" $ | quote }}
           port: {{ $.Values.filer.port }}
           weight: 1
         {{- end }}

k8s/charts/seaweedfs/templates/filer/filer-ingress.yaml

@@ -15,7 +15,7 @@ apiVersion: extensions/v1beta1
 kind: Ingress
 metadata:
   name: ingress-{{ include "seaweedfs.fullname" . }}-filer-http
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   annotations:
   {{- if and (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) .Values.filer.ingresses.http.className }}
     kubernetes.io/ingress.class: {{ .Values.filer.ingresses.http.className }}
@@ -76,7 +76,7 @@ apiVersion: extensions/v1beta1
 kind: Ingress
 metadata:
   name: ingress-{{ include "seaweedfs.fullname" . }}-filer-grpc
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   annotations:
   {{- if and (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) .Values.filer.ingresses.grpc.className }}
     kubernetes.io/ingress.class: {{ .Values.filer.ingresses.grpc.className }}

k8s/charts/seaweedfs/templates/filer/filer-service-client.yaml

@@ -3,7 +3,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: {{ include "seaweedfs.componentName" (list . "filer-client") }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}

k8s/charts/seaweedfs/templates/filer/filer-service.yaml

@@ -3,7 +3,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: {{ include "seaweedfs.componentName" (list . "filer") }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}

k8s/charts/seaweedfs/templates/filer/filer-servicemonitor.yaml

@@ -6,7 +6,7 @@ apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
   name: {{ include "seaweedfs.fullname" . }}-filer
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}

k8s/charts/seaweedfs/templates/filer/filer-statefulset.yaml

@@ -4,7 +4,7 @@ apiVersion: apps/v1
 kind: StatefulSet
 metadata:
   name: {{ include "seaweedfs.componentName" (list . "filer") }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
@@ -45,7 +45,7 @@ spec:
       {{- end }}
       {{- $podAnnotations := mergeOverwrite (deepCopy (.Values.podAnnotations | default dict)) (.Values.filer.podAnnotations | default dict) }}
       {{- if .Values.filer.s3.existingConfigSecret }}
-      {{- $configSecret := (lookup "v1" "Secret" .Release.Namespace .Values.filer.s3.existingConfigSecret) | default dict }}
+      {{- $configSecret := (lookup "v1" "Secret" (include "seaweedfs.namespace" .) .Values.filer.s3.existingConfigSecret) | default dict }}
       {{- $_ := set $podAnnotations "checksum/s3config" ($configSecret | toYaml | sha256sum) }}
       {{- else }}
       {{- $_ := set $podAnnotations "checksum/s3config" (include "seaweedfs.s3.configChecksum" .) }}

k8s/charts/seaweedfs/templates/master/master-configmap.yaml

@@ -3,7 +3,7 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: {{ include "seaweedfs.fullname" . }}-master-config
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}

k8s/charts/seaweedfs/templates/master/master-httproute.yaml

@@ -5,7 +5,7 @@ apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
   name: {{ include "seaweedfs.componentName" (list . "master") }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   {{- with .Values.master.httpRoute.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}
@@ -37,7 +37,7 @@ spec:
         - group: ""
           kind: Service
           name: {{ $serviceName }}
-          namespace: {{ $.Release.Namespace }}
+          namespace: {{ include "seaweedfs.namespace" $ | quote }}
           port: {{ $.Values.master.port }}
           weight: 1
         {{- end }}

k8s/charts/seaweedfs/templates/master/master-ingress.yaml

@@ -10,7 +10,7 @@ apiVersion: extensions/v1beta1
 kind: Ingress
 metadata:
   name: ingress-{{ include "seaweedfs.fullname" . }}-master
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   {{- with .Values.master.ingress.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}

k8s/charts/seaweedfs/templates/master/master-service.yaml

@@ -3,7 +3,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: {{ include "seaweedfs.componentName" (list . "master") }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     app.kubernetes.io/component: master

k8s/charts/seaweedfs/templates/master/master-servicemonitor.yaml

@@ -6,7 +6,7 @@ apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
   name: {{ include "seaweedfs.fullname" . }}-master
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}

k8s/charts/seaweedfs/templates/master/master-statefulset.yaml

@@ -4,7 +4,7 @@ apiVersion: apps/v1
 kind: StatefulSet
 metadata:
   name: {{ include "seaweedfs.componentName" (list . "master") }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
@@ -175,14 +175,14 @@ spec:
               {{- if .Values.master.garbageThreshold }}
               -garbageThreshold={{ .Values.master.garbageThreshold }} \
               {{- end }}
-              -ip=${POD_NAME}.{{ include "seaweedfs.componentName" (list . "master") }}.{{ .Release.Namespace }} \
+              -ip=${POD_NAME}.{{ include "seaweedfs.componentName" (list . "master") }}.{{ include "seaweedfs.namespace" . }} \
               -peers={{ include "seaweedfs.masterServers" . }} \
               {{- range .Values.master.extraArgs }}
               {{ . }} \
               {{- end }}
           volumeMounts:
             {{- include "seaweedfs.tmpDirVolumeMount" (list . .Values.master.containerSecurityContext (tpl (.Values.master.extraVolumeMounts | default "") .) (tpl (.Values.master.extraVolumes | default "") .)) | nindent 12 }}
-            - name : data-{{ .Release.Namespace }}
+            - name : {{ printf "data-%s" (include "seaweedfs.namespace" .) | trunc 63 | trimSuffix "-" }}
               mountPath: /data
             {{- if or (eq .Values.master.logs.type "hostPath") (eq .Values.master.logs.type "persistentVolumeClaim") (eq .Values.master.logs.type "emptyDir") (eq .Values.master.logs.type "existingClaim") }}
             - name: seaweedfs-master-log-volume
@@ -279,18 +279,18 @@ spec:
           emptyDir: {}
         {{- end }}
         {{- if eq .Values.master.data.type "hostPath" }}
-        - name: data-{{ .Release.Namespace }}
+        - name: {{ printf "data-%s" (include "seaweedfs.namespace" .) | trunc 63 | trimSuffix "-" }}
           hostPath:
             path: {{ .Values.master.data.hostPathPrefix }}/seaweed-master/
             type: DirectoryOrCreate
         {{- end }}
         {{- if eq .Values.master.data.type "existingClaim" }}
-        - name: data-{{ .Release.Namespace }}
+        - name: {{ printf "data-%s" (include "seaweedfs.namespace" .) | trunc 63 | trimSuffix "-" }}
           persistentVolumeClaim:
             claimName: {{ .Values.master.data.claimName }}
         {{- end }}
         {{- if eq .Values.master.data.type "emptyDir" }}
-        - name: data-{{ .Release.Namespace }}
+        - name: {{ printf "data-%s" (include "seaweedfs.namespace" .) | trunc 63 | trimSuffix "-" }}
           emptyDir: {}
         {{- end }}
         - name: master-config
@@ -330,7 +330,7 @@ spec:
     - apiVersion: v1
       kind: PersistentVolumeClaim
       metadata:
-        name: data-{{ .Release.Namespace }}
+        name: {{ printf "data-%s" (include "seaweedfs.namespace" .) | trunc 63 | trimSuffix "-" }}
         {{- with .Values.master.data.annotations }}
         annotations:
           {{- toYaml . | nindent 10 }}

k8s/charts/seaweedfs/templates/s3/s3-deployment.yaml

@@ -4,7 +4,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ include "seaweedfs.fullname" . }}-s3
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
@@ -41,7 +41,7 @@ spec:
       {{- end }}
       {{- $podAnnotations := mergeOverwrite (deepCopy (.Values.podAnnotations | default dict)) (.Values.s3.podAnnotations | default dict) }}
       {{- if .Values.s3.existingConfigSecret }}
-      {{- $configSecret := (lookup "v1" "Secret" .Release.Namespace .Values.s3.existingConfigSecret) | default dict }}
+      {{- $configSecret := (lookup "v1" "Secret" (include "seaweedfs.namespace" .) .Values.s3.existingConfigSecret) | default dict }}
       {{- $_ := set $podAnnotations "checksum/s3config" ($configSecret | toYaml | sha256sum) }}
       {{- else }}
       {{- $_ := set $podAnnotations "checksum/s3config" (include "seaweedfs.s3.configChecksum" .) }}
@@ -153,7 +153,7 @@ spec:
               {{- if .Values.s3.auditLogConfig }}
               -auditLogConfig=/etc/sw/s3_auditLogConfig.json \
               {{- end }}
-              -filer={{ include "seaweedfs.componentName" (list . "filer-client") }}.{{ .Release.Namespace }}:{{ .Values.filer.port }} \
+              -filer={{ include "seaweedfs.componentName" (list . "filer-client") }}.{{ include "seaweedfs.namespace" . }}:{{ .Values.filer.port }} \
               {{- if .Values.s3.icebergPort }}
               -port.iceberg={{ .Values.s3.icebergPort }} \
               {{- end }}

k8s/charts/seaweedfs/templates/s3/s3-httproute.yaml

@@ -12,7 +12,7 @@ apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
   name: {{ include "seaweedfs.componentName" (list . "s3") }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   {{- with .Values.s3.httpRoute.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}
@@ -44,7 +44,7 @@ spec:
         - group: ""
           kind: Service
           name: {{ $serviceName }}
-          namespace: {{ $.Release.Namespace }}
+          namespace: {{ include "seaweedfs.namespace" $ | quote }}
           port: {{ $s3Port }}
           weight: 1
         {{- end }}

k8s/charts/seaweedfs/templates/s3/s3-iceberg-ingress.yaml

@@ -30,7 +30,7 @@ apiVersion: extensions/v1beta1
 kind: Ingress
 metadata:
   name: ingress-{{ include "seaweedfs.fullname" . }}-s3-iceberg
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   {{- with .Values.s3.icebergIngress.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}

k8s/charts/seaweedfs/templates/s3/s3-ingress.yaml

@@ -21,7 +21,7 @@ apiVersion: extensions/v1beta1
 kind: Ingress
 metadata:
   name: ingress-{{ include "seaweedfs.fullname" . }}-s3
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   {{- with .Values.s3.ingress.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}

k8s/charts/seaweedfs/templates/s3/s3-lance-ingress.yaml

@@ -30,7 +30,7 @@ apiVersion: extensions/v1beta1
 kind: Ingress
 metadata:
   name: ingress-{{ include "seaweedfs.fullname" . }}-s3-lance
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   {{- with .Values.s3.lanceIngress.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}

k8s/charts/seaweedfs/templates/s3/s3-secret.yaml

@@ -8,7 +8,7 @@
 {{- if .Values.s3.reuseLegacySecret }}
 {{-   $lookupName = default $legacySecretName .Values.s3.legacySecretName }}
 {{- end }}
-{{- $existingSecret := lookup "v1" "Secret" .Release.Namespace $lookupName }}
+{{- $existingSecret := lookup "v1" "Secret" (include "seaweedfs.namespace" .) $lookupName }}
 {{- $reuse := false }}
 {{- if and .Values.s3.reuseLegacySecret $existingSecret }}
 {{- $reuse = true }}
@@ -21,8 +21,8 @@
   {{- $access_key_admin = printf "${%s}" (include "seaweedfs.s3.credentialEnvName" (list "admin" "accessKey")) -}}
   {{- $secret_key_admin = printf "${%s}" (include "seaweedfs.s3.credentialEnvName" (list "admin" "secretKey")) -}}
 {{- else if not (and $access_key_admin $secret_key_admin) -}}
-  {{- $access_key_admin = include "seaweedfs.getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "admin_access_key_id" "length" 20 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
-  {{- $secret_key_admin = include "seaweedfs.getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "admin_secret_access_key" "length" 40 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
+  {{- $access_key_admin = include "seaweedfs.getOrGeneratePassword" (dict "namespace" (include "seaweedfs.namespace" .) "secretName" $secretName "key" "admin_access_key_id" "length" 20 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
+  {{- $secret_key_admin = include "seaweedfs.getOrGeneratePassword" (dict "namespace" (include "seaweedfs.namespace" .) "secretName" $secretName "key" "admin_secret_access_key" "length" 40 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
 {{- end -}}
 {{- $readCreds := $creds.read | default dict -}}
 {{- $access_key_read := $readCreds.accessKey -}}
@@ -31,15 +31,15 @@
   {{- $access_key_read = printf "${%s}" (include "seaweedfs.s3.credentialEnvName" (list "read" "accessKey")) -}}
   {{- $secret_key_read = printf "${%s}" (include "seaweedfs.s3.credentialEnvName" (list "read" "secretKey")) -}}
 {{- else if not (and $access_key_read $secret_key_read) -}}
-  {{- $access_key_read = include "seaweedfs.getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "read_access_key_id" "length" 20 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
-  {{- $secret_key_read = include "seaweedfs.getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "read_secret_access_key" "length" 40 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
+  {{- $access_key_read = include "seaweedfs.getOrGeneratePassword" (dict "namespace" (include "seaweedfs.namespace" .) "secretName" $secretName "key" "read_access_key_id" "length" 20 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
+  {{- $secret_key_read = include "seaweedfs.getOrGeneratePassword" (dict "namespace" (include "seaweedfs.namespace" .) "secretName" $secretName "key" "read_secret_access_key" "length" 40 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
 {{- end -}}
 apiVersion: v1
 kind: Secret
 type: Opaque
 metadata:
   name: {{ $secretName }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   annotations:
     "helm.sh/resource-policy": keep
     "helm.sh/hook": "pre-install,pre-upgrade"

k8s/charts/seaweedfs/templates/s3/s3-service.yaml

@@ -3,7 +3,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: {{ include "seaweedfs.componentName" (list . "s3") }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     app.kubernetes.io/component: s3

k8s/charts/seaweedfs/templates/s3/s3-servicemonitor.yaml

@@ -9,7 +9,7 @@ apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
   name: {{ include "seaweedfs.fullname" . }}-s3
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}

k8s/charts/seaweedfs/templates/sftp/sftp-ca-secret.yaml

@@ -27,7 +27,7 @@ kind: Secret
 type: Opaque
 metadata:
   name: {{ include "seaweedfs.fullname" . }}-sftp-ca-secret
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}

k8s/charts/seaweedfs/templates/sftp/sftp-deployment.yaml

@@ -4,7 +4,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ include "seaweedfs.fullname" . }}-sftp
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
@@ -170,7 +170,7 @@ spec:
               -key.file=/usr/local/share/ca-certificates/client/tls.key \
               {{- end }}
               -userStoreFile=/etc/sw/seaweedfs_sftp_config \
-              -filer={{ include "seaweedfs.componentName" (list . "filer-client") }}.{{ .Release.Namespace }}:{{ .Values.filer.port }}
+              -filer={{ include "seaweedfs.componentName" (list . "filer-client") }}.{{ include "seaweedfs.namespace" . }}:{{ .Values.filer.port }}
           volumeMounts:
             {{- include "seaweedfs.tmpDirVolumeMount" (list . .Values.sftp.containerSecurityContext (tpl (.Values.sftp.extraVolumeMounts | default "") .) (tpl (.Values.sftp.extraVolumes | default "") .)) | nindent 12 }}
             {{- if or (eq .Values.sftp.logs.type "hostPath") (eq .Values.sftp.logs.type "emptyDir") }}

k8s/charts/seaweedfs/templates/sftp/sftp-secret.yaml

@@ -1,10 +1,10 @@
 {{- if or .Values.sftp.enabled .Values.allInOne.enabled }}
 {{- $secretName := printf "%s-sftp-secret" (include "seaweedfs.fullname" .) }}
-{{- $admin_pwd := include "seaweedfs.getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "admin_password" "length" 20) -}}
-{{- $read_user_pwd := include "seaweedfs.getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "readonly_password" "length" 20) -}}
-{{- $public_user_pwd := include "seaweedfs.getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "public_user_password" "length" 20) -}}
+{{- $admin_pwd := include "seaweedfs.getOrGeneratePassword" (dict "namespace" (include "seaweedfs.namespace" .) "secretName" $secretName "key" "admin_password" "length" 20) -}}
+{{- $read_user_pwd := include "seaweedfs.getOrGeneratePassword" (dict "namespace" (include "seaweedfs.namespace" .) "secretName" $secretName "key" "readonly_password" "length" 20) -}}
+{{- $public_user_pwd := include "seaweedfs.getOrGeneratePassword" (dict "namespace" (include "seaweedfs.namespace" .) "secretName" $secretName "key" "public_user_password" "length" 20) -}}
 {{- $ssh_private_key := "" -}}
-{{- $existingSecret := lookup "v1" "Secret" .Release.Namespace $secretName -}}
+{{- $existingSecret := lookup "v1" "Secret" (include "seaweedfs.namespace" .) $secretName -}}
 {{- if and $existingSecret (index $existingSecret.data "seaweedfs_sftp_ssh_private_key") -}}
 {{- $ssh_private_key = index $existingSecret.data "seaweedfs_sftp_ssh_private_key" | b64dec | trim -}}
 {{- end -}}
@@ -17,7 +17,7 @@ kind: Secret
 type: Opaque
 metadata:
   name: {{ $secretName }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   annotations:
     "helm.sh/resource-policy": keep
     "helm.sh/hook": "pre-install,pre-upgrade"

k8s/charts/seaweedfs/templates/sftp/sftp-service.yaml

@@ -3,7 +3,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: {{ include "seaweedfs.componentName" (list . "sftp") }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     app.kubernetes.io/instance: {{ .Release.Name }}

k8s/charts/seaweedfs/templates/sftp/sftp-servicemonitor.yaml

@@ -6,7 +6,7 @@ apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
   name: {{ include "seaweedfs.fullname" . }}-sftp
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}

k8s/charts/seaweedfs/templates/sftp/sftp-ssh-secret.yaml

@@ -2,7 +2,7 @@
 {{/* Host keys mounted at sftp.hostKeysFolder; existing keys are kept across upgrades, except the key earlier chart versions bundled. */}}
 {{- $secretName := printf "%s-sftp-ssh-secret" (include "seaweedfs.fullname" .) }}
 {{- $hostKeys := dict }}
-{{- $existingSecret := lookup "v1" "Secret" .Release.Namespace $secretName }}
+{{- $existingSecret := lookup "v1" "Secret" (include "seaweedfs.namespace" .) $secretName }}
 {{- if $existingSecret }}
 {{- range $name, $value := $existingSecret.data }}
 {{- if not (contains "H4McwcDphteXVullu6q7ephEN1N60z" (b64dec $value)) }}
@@ -18,7 +18,7 @@ kind: Secret
 type: Opaque
 metadata:
   name: {{ $secretName }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   annotations:
     "helm.sh/resource-policy": keep
     "helm.sh/hook": "pre-install,pre-upgrade"

k8s/charts/seaweedfs/templates/shared/_helpers.tpl

@@ -47,6 +47,16 @@ Expand the name of the chart.
 {{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
 {{- end -}}
 
+{{/* namespaceOverride, or the release namespace */}}
+{{- define "seaweedfs.namespace" -}}
+{{- if .Values.namespaceOverride -}}
+{{-   if or (gt (len .Values.namespaceOverride) 63) (not (regexMatch "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$" .Values.namespaceOverride)) -}}
+{{-     fail (printf "namespaceOverride %q is not a valid namespace name" .Values.namespaceOverride) -}}
+{{-   end -}}
+{{- end -}}
+{{- default .Release.Namespace .Values.namespaceOverride -}}
+{{- end -}}
+
 {{/*
 Inject extra environment vars in the format key:value, if populated
 */}}
@@ -227,7 +237,7 @@ true
 {{- if .Values.worker.namespaceUrl -}}
 {{- .Values.worker.namespaceUrl -}}
 {{- else if and .Values.s3.enabled .Values.s3.lancePort -}}
-{{- printf "http://%s.%s:%d" (include "seaweedfs.componentName" (list . "s3")) .Release.Namespace (int .Values.s3.lancePort) -}}
+{{- printf "http://%s.%s:%d" (include "seaweedfs.componentName" (list . "s3")) (include "seaweedfs.namespace" .) (int .Values.s3.lancePort) -}}
 {{- end -}}
 {{- end -}}
 
@@ -388,7 +398,7 @@ If allInOne is enabled, point to the all-in-one service; otherwise, point to the
 */}}
 {{- define "seaweedfs.cluster.masterAddress" -}}
 {{- $component := ternary "all-in-one" "master" .Values.allInOne.enabled -}}
-{{- printf "%s.%s:%d" (include "seaweedfs.componentName" (list . $component)) .Release.Namespace (int .Values.master.port) -}}
+{{- printf "%s.%s:%d" (include "seaweedfs.componentName" (list . $component)) (include "seaweedfs.namespace" .) (int .Values.master.port) -}}
 {{- end -}}
 
 {{/*
@@ -397,7 +407,7 @@ If allInOne is enabled, point to the all-in-one service; otherwise, point to the
 */}}
 {{- define "seaweedfs.cluster.filerAddress" -}}
 {{- $component := ternary "all-in-one" "filer-client" .Values.allInOne.enabled -}}
-{{- printf "%s.%s:%d" (include "seaweedfs.componentName" (list . $component)) .Release.Namespace (int .Values.filer.port) -}}
+{{- printf "%s.%s:%d" (include "seaweedfs.componentName" (list . $component)) (include "seaweedfs.namespace" .) (int .Values.filer.port) -}}
 {{- end -}}
 
 {{/*
@@ -409,7 +419,7 @@ Output example: my-release-master-0.my-release-master.namespace:9333,my-release-
 {{- $masterName := include "seaweedfs.componentName" (list . "master") -}}
 {{- range $index := until (.Values.master.replicas | int) -}}
 {{- if $index }},{{ end -}}
-{{ $masterName }}-{{ $index }}.{{ $masterName }}.{{ $.Release.Namespace }}:{{ $.Values.master.port }}
+{{ $masterName }}-{{ $index }}.{{ $masterName }}.{{ include "seaweedfs.namespace" $ }}:{{ $.Values.master.port }}
 {{- end -}}
 {{- end -}}
 
@@ -522,7 +532,7 @@ true
 {{-     if $volume.enabled }}
 {{-       $replicas := int $volume.replicas }}
 {{-       $statefulsetName := printf "%s-%s" $seaweedfsName $volumeName }}
-{{-       $statefulset := (lookup "apps/v1" "StatefulSet" $.Release.Namespace $statefulsetName) }}
+{{-       $statefulset := (lookup "apps/v1" "StatefulSet" (include "seaweedfs.namespace" $) $statefulsetName) }}
 {{- /* Check for changes in volumeClaimTemplates */}}
 {{-       if $statefulset }}
 {{-         range $dir := $volume.dataDirs }}
@@ -542,7 +552,7 @@ true
 {{-           $desiredSize := .size }}
 {{-           range $i, $e := until $replicas }}
 {{-             $pvcName := printf "%s-%s-%s-%d" $dir.name $seaweedfsName $volumeName $e }}
-{{-             $currentPVC := (lookup "v1" "PersistentVolumeClaim" $.Release.Namespace $pvcName) }}
+{{-             $currentPVC := (lookup "v1" "PersistentVolumeClaim" (include "seaweedfs.namespace" $) $pvcName) }}
 {{-             if $currentPVC }}
 {{- /* include returns a string such as "6.442450944e+10"; convert back to a number, or gt compares lexically */}}
 {{-               $oldSize := include "seaweedfs.resource-quantity" $currentPVC.spec.resources.requests.storage | float64 }}

k8s/charts/seaweedfs/templates/shared/cluster-role.yaml

@@ -28,7 +28,7 @@ metadata:
 subjects:
   - kind: ServiceAccount
     name: {{ include "seaweedfs.serviceAccountName" . }}
-    namespace: {{ .Release.Namespace }}
+    namespace: {{ include "seaweedfs.namespace" . | quote }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole

k8s/charts/seaweedfs/templates/shared/networkpolicy.yaml

@@ -161,7 +161,7 @@ apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
   name: {{ include "seaweedfs.componentName" (list $ ($target.name | default $component)) }}
-  namespace: {{ $.Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" $ | quote }}
   labels:
     app.kubernetes.io/name: {{ include "seaweedfs.name" $ | quote }}
     helm.sh/chart: {{ $.Chart.Name }}-{{ $.Chart.Version | replace "+" "_" }}

k8s/charts/seaweedfs/templates/shared/notification-configmap.yaml

@@ -3,7 +3,7 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: {{ include "seaweedfs.fullname" . }}-notification-config
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}

k8s/charts/seaweedfs/templates/shared/post-install-bucket-hook.yaml

@@ -63,6 +63,7 @@ apiVersion: batch/v1
 kind: Job
 metadata:
   name: "{{ $.Release.Name }}-bucket-hook"
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}

k8s/charts/seaweedfs/templates/shared/seaweedfs-grafana-dashboard.yaml

@@ -9,7 +9,7 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: {{ include "seaweedfs.fullname" $ }}-{{ printf "%s" $dashboardName | lower | replace "_" "-" }}
-  namespace: {{ $.Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" $ | quote }}
   labels:
     grafana_dashboard: "1"
 data:

k8s/charts/seaweedfs/templates/shared/secret-seaweedfs-db.yaml

@@ -1,14 +1,14 @@
 {{- if and .Values.filer.enabled (include "seaweedfs.filer.mysqlEnabled" .) }}
 {{- /* Kept on uninstall, but the pre-install hook recreates it on the next install:
        reuse the stored user and password so the filer can still log in. */}}
-{{- $existing := lookup "v1" "Secret" .Release.Namespace (printf "%s-db-secret" (include "seaweedfs.fullname" .)) }}
+{{- $existing := lookup "v1" "Secret" (include "seaweedfs.namespace" .) (printf "%s-db-secret" (include "seaweedfs.fullname" .)) }}
 {{- $data := ($existing | default dict).data | default dict }}
 apiVersion: v1
 kind: Secret
 type: Opaque
 metadata:
   name: {{ include "seaweedfs.fullname" . }}-db-secret
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   annotations:
     "helm.sh/resource-policy": keep
     "helm.sh/hook": "pre-install"

k8s/charts/seaweedfs/templates/shared/security-configmap.yaml

@@ -4,7 +4,7 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: {{ include "seaweedfs.fullname" . }}-security-config
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
@@ -13,10 +13,10 @@ metadata:
 data:
   {{- $fullname := include "seaweedfs.fullname" . }}
   {{- $securityConfigName := printf "%s-security-config" $fullname }}
-  {{- $existing := lookup "v1" "ConfigMap" .Release.Namespace $securityConfigName }}
+  {{- $existing := lookup "v1" "ConfigMap" (include "seaweedfs.namespace" .) $securityConfigName }}
   {{- if not $existing }}
   {{- $legacyName := printf "%s-%s" (include "seaweedfs.name" .) "security-config" }}
-  {{- $existing = lookup "v1" "ConfigMap" .Release.Namespace $legacyName }}
+  {{- $existing = lookup "v1" "ConfigMap" (include "seaweedfs.namespace" .) $legacyName }}
   {{- end }}
   {{- $existingToml := dig "data" "security.toml" "" $existing }}
   {{- $securityConfigValues := .Values.global.seaweedfs.securityConfig | default dict }}

k8s/charts/seaweedfs/templates/shared/service-account.yaml

@@ -3,7 +3,7 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: {{ include "seaweedfs.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   {{- with .Values.global.seaweedfs.serviceAccountAnnotations }}
   annotations:
     {{- toYaml . | nindent 4 }}

k8s/charts/seaweedfs/templates/volume/volume-httproute.yaml

@@ -5,7 +5,7 @@ apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
   name: {{ include "seaweedfs.componentName" (list . "volume") }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   {{- with .Values.volume.httpRoute.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}
@@ -37,7 +37,7 @@ spec:
         - group: ""
           kind: Service
           name: {{ $serviceName }}
-          namespace: {{ $.Release.Namespace }}
+          namespace: {{ include "seaweedfs.namespace" $ | quote }}
           port: {{ $.Values.volume.port }}
           weight: 1
         {{- end }}

k8s/charts/seaweedfs/templates/volume/volume-ingress.yaml

@@ -13,7 +13,7 @@ apiVersion: extensions/v1beta1
 kind: Ingress
 metadata:
   name: ingress-{{ include "seaweedfs.fullname" . }}-volume
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   annotations:
   {{- if and (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) .Values.volume.ingress.className }}
     kubernetes.io/ingress.class: {{ .Values.volume.ingress.className }}

k8s/charts/seaweedfs/templates/volume/volume-resize-hook.yaml

@@ -9,6 +9,7 @@ apiVersion: batch/v1
 kind: Job
 metadata:
   name: "{{ $seaweedfsName }}-volume-resize-hook"
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
@@ -75,6 +76,7 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: {{ $seaweedfsName }}-volume-resize-hook
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   annotations:
     helm.sh/hook: pre-install,pre-upgrade
     helm.sh/hook-weight: "-5"
@@ -84,6 +86,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   name: {{ $seaweedfsName }}-volume-resize-hook
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   annotations:
     helm.sh/hook: pre-install,pre-upgrade
     helm.sh/hook-weight: "-5"
@@ -100,6 +103,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   name: {{ $seaweedfsName }}-volume-resize-hook
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   annotations:
     helm.sh/hook: pre-install,pre-upgrade
     helm.sh/hook-weight: "-5"

k8s/charts/seaweedfs/templates/volume/volume-service.yaml

@@ -9,7 +9,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: {{ include "seaweedfs.componentName" (list $ $volumeName) }}
-  namespace: {{ $.Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" $ | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" $ }}
     app.kubernetes.io/instance: {{ $.Release.Name }}

k8s/charts/seaweedfs/templates/volume/volume-servicemonitor.yaml

@@ -12,7 +12,7 @@ apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
   name: {{ include "seaweedfs.fullname" $ }}-{{ $volumeName }}
-  namespace: {{ $.Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" $ | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" $ }}
     helm.sh/chart: {{ $.Chart.Name }}-{{ $.Chart.Version | replace "+" "_" }}

k8s/charts/seaweedfs/templates/volume/volume-statefulset.yaml

@@ -14,7 +14,7 @@ apiVersion: apps/v1
 kind: StatefulSet
 metadata:
   name: {{ include "seaweedfs.componentName" (list $ $volumeName) }}
-  namespace: {{ $.Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" $ | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" $ }}
     helm.sh/chart: {{ $.Chart.Name }}-{{ $.Chart.Version | replace "+" "_" }}
@@ -220,7 +220,7 @@ spec:
                 -fileSizeLimitMB={{ $volume.fileSizeLimitMB }} \
                 {{- end }}
                 -minFreeSpacePercent={{ $volume.minFreeSpacePercent }} \
-                -ip=${POD_NAME}.{{ include "seaweedfs.componentName" (list $ $volumeName) }}.{{ $.Release.Namespace }} \
+                -ip=${POD_NAME}.{{ include "seaweedfs.componentName" (list $ $volumeName) }}.{{ include "seaweedfs.namespace" $ }} \
                 -compactionMBps={{ $volume.compactionMBps }} \
                 -master={{ include "seaweedfs.masterServerArg" $ }} \
                 {{- range $volume.extraArgs }}

k8s/charts/seaweedfs/templates/worker/worker-deployment.yaml

@@ -7,7 +7,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ include "seaweedfs.fullname" . }}-worker
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
@@ -130,7 +130,7 @@ spec:
               {{- if .Values.worker.adminServer }}
               -admin={{ .Values.worker.adminServer }} \
               {{- else }}
-              -admin={{ template "seaweedfs.fullname" . }}-admin.{{ .Release.Namespace }}:{{ .Values.admin.port }}{{ if .Values.admin.grpcPort }}.{{ .Values.admin.grpcPort }}{{ end }} \
+              -admin={{ template "seaweedfs.fullname" . }}-admin.{{ include "seaweedfs.namespace" . }}:{{ .Values.admin.port }}{{ if .Values.admin.grpcPort }}.{{ .Values.admin.grpcPort }}{{ end }} \
               {{- end }}
               -jobType={{ .Values.worker.jobType }} \
               -maxDetect={{ .Values.worker.maxDetect }} \
@@ -252,7 +252,7 @@ spec:
               {{- if .Values.worker.adminServer }}
               --admin={{ .Values.worker.adminServer }} \
               {{- else }}
-              --admin={{ template "seaweedfs.fullname" . }}-admin.{{ .Release.Namespace }}:{{ .Values.admin.port }}{{ if .Values.admin.grpcPort }}.{{ .Values.admin.grpcPort }}{{ end }} \
+              --admin={{ template "seaweedfs.fullname" . }}-admin.{{ include "seaweedfs.namespace" . }}:{{ .Values.admin.port }}{{ if .Values.admin.grpcPort }}.{{ .Values.admin.grpcPort }}{{ end }} \
               {{- end }}
               --namespace="$LANCE_NAMESPACE_URL" \
               {{- if .Values.global.seaweedfs.enableSecurity }}

k8s/charts/seaweedfs/templates/worker/worker-service.yaml

@@ -3,7 +3,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: {{ include "seaweedfs.componentName" (list . "worker") }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}

k8s/charts/seaweedfs/templates/worker/worker-servicemonitor.yaml

@@ -7,7 +7,7 @@ apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
   name: {{ include "seaweedfs.fullname" . }}-worker
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "seaweedfs.namespace" . | quote }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}

k8s/charts/seaweedfs/values.yaml

@@ -74,6 +74,17 @@ global:
       #     name: seaweedfs-signing-key
       #     key: signingKey
 
+# Deploy every namespaced object into this existing namespace instead of the
+# release one. Changing it on an installed release moves regular namespaced
+# objects only: claims and the data behind them are left behind or deleted,
+# hook resources stay in the old namespace, and the generated S3 and DB
+# Secrets are not recreated — migrate claims, copy the Secrets, and clean up
+# the old hook resources by hand first. The default hostPath storage is
+# node-local as well: stop the old workloads and plan the hostPath data
+# migration, or the new pods can come up empty on other nodes or share the
+# same directories concurrently.
+namespaceOverride: ""
+
 image:
   registry: ""
   repository: ""