From c147b775f9fee42e46f868ee8a62167e907facec Mon Sep 17 00:00:00 2001 From: Chris Lu Date: Sun, 8 Nov 2026 09:19:51 -0800 Subject: [PATCH] helm: say what the Lance worker needs from security.toml (#12489) * helm: say what the Lance worker needs from security.toml Since #12470 the Lance namespace authenticates weed-worker by a token derived from jwt.filer_signing.key, which the chart renders only with securityConfig.jwtSigning.filerWrite. Without it, a gateway with identities lists the worker no tables, and the lance_* jobs silently find nothing to do. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_011UpvafvK8JpagF94MHWqwK * helm: warn that filerWrite also requires signed filer HTTP writes Co-Authored-By: Claude Opus 5.5 --------- Co-authored-by: Claude Opus 5.5 --- k8s/charts/seaweedfs/values.yaml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/k8s/charts/seaweedfs/values.yaml b/k8s/charts/seaweedfs/values.yaml index 5b1b5ece04..51df7ca9a8 100644 --- a/k8s/charts/seaweedfs/values.yaml +++ b/k8s/charts/seaweedfs/values.yaml @@ -1744,6 +1744,14 @@ worker: # The lance_* jobs run in their own container, /usr/bin/weed-worker. # amd64/arm64 only; pin mixed clusters with worker.affinity/nodeSelector. + # It keeps tables through the filers the masters list and reads + # security.toml. The Lance namespace knows it by a token derived from + # jwt.filer_signing.key, which the chart renders only with + # global.seaweedfs.securityConfig.jwtSigning.filerWrite: true. When S3 has + # identities, set it, or the namespace lists the worker no tables and the + # lance_* jobs find nothing to do. It also makes the filer accept only signed + # HTTP writes, so clients writing to the filer's HTTP API directly need a JWT + # signed with that key. # Lance namespace URL override; empty derives it from s3.lancePort. namespaceUrl: ""