[miki3421]

Summary

• make the SeaweedFS service cluster-internal instead of exposing S3, Filer, and Master as NodePorts
• allow tenant workloads to keep using authenticated S3 on port 9000 while restricting Filer 9090 and Master 9333 to trusted non-action pods
• remove legacy Filer ingress resources and reconcile the boundary on operator resume/update
• prevent action label impersonation by excluding pods carrying the user-action-pod marker from trusted peers

Compatibility

• authenticated tenant S3 traffic remains available on port 9000
• the existing S3 ingress remains supported
• operator access to Filer and Master remains available
• existing installations are migrated during operator resume without recreating SeaweedFS or tenant data
• the legacy console configuration field remains accepted, but the unauthenticated Filer API is no longer published

Validation

• git diff --check
• changed Python modules compile successfully
• full Python unit suite: 126 tests passed
• clean 0.9.0 operator image build completed successfully
• verified on the baseline K3s lab with real synthetic Alpha and Beta actions:
  • before the change, an Alpha action reached ports 9000, 9090, and 9333
  • after the change, the same action reached 9000 but was blocked from 9090 and 9333, including when attempting to copy the operator label
  • the operator still received HTTP 200 from 9090 and 9333
  • Alpha and Beta retained access to their own S3 buckets and received AccessDenied for the peer bucket
  • anonymous data bucket access remained HTTP 403 and public web bucket access remained HTTP 200

No existing tenant data was modified or removed by the migration.