Skip to content

feat(helm)!: Update chart kube-prometheus-stack ( 88.3.0 → 90.0.0 ) - #3093

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/kube-prometheus-stack-90.x
Open

feat(helm)!: Update chart kube-prometheus-stack ( 88.3.0 → 90.0.0 )#3093
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/kube-prometheus-stack-90.x

Conversation

@renovate

@renovate renovate Bot commented Sep 7, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Update Change
kube-prometheus-stack (source) major 88.3.0 → 90.0.0

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

prometheus-community/helm-charts (kube-prometheus-stack)

v90.0.0

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

New Contributors

Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-89.2.4...kube-prometheus-stack-90.0.0

v89.2.4

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

Full Changelog: prometheus-community/helm-charts@prometheus-stackdriver-exporter-5.0.1...kube-prometheus-stack-89.2.4

v89.2.3

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

  • [kube-prometheus-stack] Update kube-state-metrics Docker tag to v8.4.2 by @​renovate[bot] in #​7240

Full Changelog: prometheus-community/helm-charts@prometheus-29.27.2...kube-prometheus-stack-89.2.3

v89.2.2

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-89.2.1...kube-prometheus-stack-89.2.2

v89.2.1

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

  • [kube-prometheus-stack] Set a default commonName for prometheus cert-… by @​maarous in #​7234

Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-89.2.0...kube-prometheus-stack-89.2.1

v89.2.0

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-89.1.0...kube-prometheus-stack-89.2.0

v89.1.0

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

  • [kube-prometheus-stack] Update kube-prometheus-stack dependency non-major updates by @​renovate[bot] in #​7232

Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-89.0.0...kube-prometheus-stack-89.1.0

v89.0.0

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-88.6.5...kube-prometheus-stack-89.0.0

v88.6.5

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

  • [kube-prometheus-stack] Make cert-manager private key configurable by @​maarous in #​7216

New Contributors

Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-88.6.4...kube-prometheus-stack-88.6.5

v88.6.4

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

New Contributors

Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-88.6.3...kube-prometheus-stack-88.6.4

v88.6.3

Compare Source

v88.6.2

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

  • [kube-prometheus-stack] Update Helm release prometheus-node-exporter to v4.56.3 by @​renovate[bot] in #​7226

Full Changelog: prometheus-community/helm-charts@prometheus-blackbox-exporter-11.18.0...kube-prometheus-stack-88.6.2

v88.6.1

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

  • [kube-prometheus-stack] Update kube-prometheus-stack dependency non-major updates by @​renovate[bot] in #​7223

Full Changelog: prometheus-community/helm-charts@prometheus-operator-admission-webhook-0.43.3...kube-prometheus-stack-88.6.1

v88.6.0

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

Full Changelog: prometheus-community/helm-charts@prometheus-redis-exporter-6.30.0...kube-prometheus-stack-88.6.0

v88.5.4

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

Full Changelog: prometheus-community/helm-charts@prometheus-ipmi-exporter-0.8.2...kube-prometheus-stack-88.5.4

v88.5.3

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

  • [kube-prometheus-stack] Update ghcr.io/jkroepke/kube-webhook-certgen Docker tag to v1.8.7 by @​renovate[bot] in #​7208

Full Changelog: prometheus-community/helm-charts@prometheus-operator-admission-webhook-0.43.2...kube-prometheus-stack-88.5.3

v88.5.2

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

  • [kube-prometheus-stack] Update quay.io/oauth2-proxy/oauth2-proxy Docker tag to v7.15.4 by @​renovate[bot] in #​7204

Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-88.5.1...kube-prometheus-stack-88.5.2

v88.5.1

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

  • [kube-prometheus-stack] Update kube-prometheus-stack dependency non-major updates by @​renovate[bot] in #​7203

Full Changelog: prometheus-community/helm-charts@prometheus-nats-exporter-2.23.2...kube-prometheus-stack-88.5.1

v88.5.0

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

  • [kube-prometheus-stack] Update Helm release kube-state-metrics to v8.4.0 by @​renovate[bot] in #​7199

Full Changelog: prometheus-community/helm-charts@prometheus-kafka-exporter-3.1.1...kube-prometheus-stack-88.5.0

v88.4.0

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

  • [kube-prometheus-stack] Update kube-prometheus-stack dependency non-major updates by @​renovate[bot] in #​7196

Full Changelog: prometheus-community/helm-charts@kube-state-metrics-8.4.0...kube-prometheus-stack-88.4.0

Configuration

📅 Schedule: (in timezone Europe/Moscow)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
feat(helm)!: Update chart kube-prometheus-stack ( 88.3.0 → 90.0.0 )
ed09555 
| datasource | package               | from   | to     |
| ---------- | --------------------- | ------ | ------ |
| helm       | kube-prometheus-stack | 88.3.0 | 90.0.0 |
@mglants-bot

mglants-bot Bot commented Sep 7, 2026

Copy link
Copy Markdown 
--- HelmRelease: monitoring/kube-prometheus-stack Deployment: monitoring/kube-prometheus-stack-kube-state-metrics

+++ HelmRelease: monitoring/kube-prometheus-stack Deployment: monitoring/kube-prometheus-stack-kube-state-metrics

@@ -45,13 +45,13 @@

       - name: kube-state-metrics
         args:
         - --port=8080
         - --resources=certificatesigningrequests,configmaps,cronjobs,daemonsets,deployments,endpointslices,horizontalpodautoscalers,ingresses,jobs,leases,limitranges,mutatingwebhookconfigurations,namespaces,networkpolicies,nodes,persistentvolumeclaims,persistentvolumes,poddisruptionbudgets,pods,replicasets,replicationcontrollers,resourcequotas,secrets,services,statefulsets,storageclasses,validatingwebhookconfigurations,volumeattachments
         - --metric-labels-allowlist=persistentvolumeclaims=[*]
         imagePullPolicy: IfNotPresent
-        image: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1
+        image: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0
         ports:
         - containerPort: 8080
           name: http
         - containerPort: 8081
           name: metrics
         livenessProbe:
--- HelmRelease: monitoring/kube-prometheus-stack Deployment: monitoring/kube-prometheus-stack-operator

+++ HelmRelease: monitoring/kube-prometheus-stack Deployment: monitoring/kube-prometheus-stack-operator

@@ -31,26 +31,26 @@

         app: kube-prometheus-stack-operator
         app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
         app.kubernetes.io/component: prometheus-operator
     spec:
       containers:
       - name: kube-prometheus-stack
-        image: quay.io/prometheus-operator/prometheus-operator:v0.93.0
+        image: quay.io/prometheus-operator/prometheus-operator:v0.93.1
         imagePullPolicy: IfNotPresent
         args:
         - --kubelet-service=kube-system/kube-prometheus-stack-kubelet
         - --kubelet-endpoints=true
         - --kubelet-endpointslice=false
         - --localhost=127.0.0.1
-        - --prometheus-config-reloader=quay.io/prometheus-operator/prometheus-config-reloader:v0.93.0
+        - --prometheus-config-reloader=quay.io/prometheus-operator/prometheus-config-reloader:v0.93.1
         - --config-reloader-cpu-request=5m
         - --config-reloader-cpu-limit=0
         - --config-reloader-memory-request=32M
         - --config-reloader-memory-limit=32M
         - --thanos-default-base-image=quay.io/thanos/thanos:v0.42.4
-        - --secret-field-selector=type!=kubernetes.io/dockercfg,type!=kubernetes.io/service-account-token,type!=helm.sh/release.v1
+        - --secret-field-selector=type!=kubernetes.io/dockercfg,type!=helm.sh/release.v1
         - --web.enable-tls=true
         - --web.cert-file=/cert/cert
         - --web.key-file=/cert/key
         - --web.listen-address=:10250
         - --web.tls-min-version=VersionTLS13
         ports:
--- HelmRelease: monitoring/kube-prometheus-stack Prometheus: monitoring/kube-prometheus-stack-prometheus

+++ HelmRelease: monitoring/kube-prometheus-stack Prometheus: monitoring/kube-prometheus-stack-prometheus

@@ -16,15 +16,15 @@

   alerting:
     alertmanagers:
     - apiVersion: v2
       name: alertmanager
       namespace: monitoring
       port: 9093
-  image: quay.io/prometheus/prometheus:v3.13.2-distroless
+  image: quay.io/prometheus/prometheus:v3.14.0-distroless
   imagePullPolicy: IfNotPresent
-  version: v3.13.2-distroless
+  version: v3.14.0-distroless
   externalLabels:
     cluster: sweethome
   replicaExternalLabelName: __replica__
   externalUrl: http://prometheus.home/
   paused: false
   replicas: 1
--- HelmRelease: monitoring/kube-prometheus-stack ServiceMonitor: monitoring/kube-prometheus-stack-coredns

+++ HelmRelease: monitoring/kube-prometheus-stack ServiceMonitor: monitoring/kube-prometheus-stack-coredns

@@ -19,8 +19,12 @@

       release: kube-prometheus-stack
   namespaceSelector:
     matchNames:
     - kube-system
   endpoints:
   - port: http-metrics
-    bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+    authorization:
+      credentials:
+        key: token
+        name: kube-prometheus-stack-prometheus-token
+      type: Bearer
 
--- HelmRelease: monitoring/kube-prometheus-stack ServiceMonitor: monitoring/kube-prometheus-stack-apiserver

+++ HelmRelease: monitoring/kube-prometheus-stack ServiceMonitor: monitoring/kube-prometheus-stack-apiserver

@@ -10,15 +10,19 @@

     app.kubernetes.io/instance: kube-prometheus-stack
     app.kubernetes.io/part-of: kube-prometheus-stack
     release: kube-prometheus-stack
     heritage: Helm
 spec:
   endpoints:
-  - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
-    port: https
+  - port: https
     scheme: https
+    authorization:
+      credentials:
+        key: token
+        name: kube-prometheus-stack-prometheus-token
+      type: Bearer
     metricRelabelings:
     - action: keep
       regex: (aggregator_openapi|aggregator_unavailable|apiextensions_openapi|apiserver_admission|apiserver_audit|apiserver_cache|apiserver_cel|apiserver_client|apiserver_crd|apiserver_current|apiserver_envelope|apiserver_flowcontrol|apiserver_init|apiserver_kube|apiserver_longrunning|apiserver_request|apiserver_requested|apiserver_response|apiserver_selfrequest|apiserver_storage|apiserver_terminated|apiserver_tls|apiserver_watch|apiserver_webhooks|authenticated_user|authentication|disabled_metric|etcd_bookmark|etcd_lease|etcd_request|field_validation|get_token|go|grpc_client|hidden_metric|kube_apiserver|kubernetes_build|kubernetes_feature|node_authorizer|pod_security|process_cpu|process_max|process_open|process_resident|process_start|process_virtual|registered_metric|rest_client|scrape_duration|scrape_samples|scrape_series|serviceaccount_legacy|serviceaccount_stale|serviceaccount_valid|watch_cache|workqueue)_(.+)
       sourceLabels:
       - __name__
     - action: drop
@@ -27,15 +31,18 @@

       - __name__
     - action: drop
       regex: (apiserver_response_sizes_bucket|apiserver_watch_events_sizes_bucket)
       sourceLabels:
       - __name__
     tlsConfig:
-      caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+      ca:
+        configMap:
+          key: ca.crt
+          name: kube-root-ca.crt
+      insecureSkipVerify: false
       serverName: kubernetes
-      insecureSkipVerify: false
   jobLabel: component
   namespaceSelector:
     matchNames:
     - default
   selector:
     matchLabels:
--- HelmRelease: monitoring/kube-prometheus-stack ServiceMonitor: monitoring/kube-prometheus-stack-kube-etcd

+++ HelmRelease: monitoring/kube-prometheus-stack ServiceMonitor: monitoring/kube-prometheus-stack-kube-etcd

@@ -19,8 +19,12 @@

       release: kube-prometheus-stack
   namespaceSelector:
     matchNames:
     - kube-system
   endpoints:
   - port: http-metrics
-    bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+    authorization:
+      credentials:
+        key: token
+        name: kube-prometheus-stack-prometheus-token
+      type: Bearer
 
--- HelmRelease: monitoring/kube-prometheus-stack ServiceMonitor: monitoring/kube-prometheus-stack-kubelet

+++ HelmRelease: monitoring/kube-prometheus-stack ServiceMonitor: monitoring/kube-prometheus-stack-kubelet

@@ -23,15 +23,22 @@

       app.kubernetes.io/name: kubelet
       k8s-app: kubelet
   endpoints:
   - port: https-metrics
     scheme: https
     tlsConfig:
-      caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+      ca:
+        configMap:
+          key: ca.crt
+          name: kube-root-ca.crt
       insecureSkipVerify: true
-    bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+    authorization:
+      credentials:
+        key: token
+        name: kube-prometheus-stack-prometheus-token
+      type: Bearer
     honorLabels: true
     honorTimestamps: true
     metricRelabelings:
     - action: keep
       regex: (apiserver_audit|apiserver_client|apiserver_delegated|apiserver_envelope|apiserver_storage|apiserver_webhooks|authentication_token|cadvisor_version|container_blkio|container_cpu|container_fs|container_last|container_memory|container_network|container_oom|container_processes|container|csi_operations|disabled_metric|get_token|go|hidden_metric|kubelet_certificate|kubelet_cgroup|kubelet_container|kubelet_containers|kubelet_cpu|kubelet_device|kubelet_graceful|kubelet_http|kubelet_lifecycle|kubelet_managed|kubelet_node|kubelet_pleg|kubelet_pod|kubelet_run|kubelet_running|kubelet_runtime|kubelet_server|kubelet_started|kubelet_volume|kubernetes_build|kubernetes_feature|machine_cpu|machine_memory|machine_nvm|machine_scrape|node_namespace|plugin_manager|prober_probe|process_cpu|process_max|process_open|process_resident|process_start|process_virtual|registered_metric|rest_client|scrape_duration|scrape_samples|scrape_series|storage_operation|volume_manager|volume_operation|workqueue)_(.+)
       sourceLabels:
@@ -50,15 +57,22 @@

     path: /metrics/cadvisor
     interval: 10s
     honorLabels: true
     honorTimestamps: true
     trackTimestampsStaleness: true
     tlsConfig:
-      caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+      ca:
+        configMap:
+          key: ca.crt
+          name: kube-root-ca.crt
       insecureSkipVerify: true
-    bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+    authorization:
+      credentials:
+        key: token
+        name: kube-prometheus-stack-prometheus-token
+      type: Bearer
     metricRelabelings:
     - action: drop
       regex: container_cpu_(cfs_throttled_seconds_total|load_average_10s|system_seconds_total|user_seconds_total)
       sourceLabels:
       - __name__
     - action: drop
@@ -100,15 +114,22 @@

   - port: https-metrics
     scheme: https
     path: /metrics/probes
     honorLabels: true
     honorTimestamps: true
     tlsConfig:
-      caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+      ca:
+        configMap:
+          key: ca.crt
+          name: kube-root-ca.crt
       insecureSkipVerify: true
-    bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+    authorization:
+      credentials:
+        key: token
+        name: kube-prometheus-stack-prometheus-token
+      type: Bearer
     relabelings:
     - action: replace
       sourceLabels:
       - __metrics_path__
       targetLabel: metrics_path
 
--- HelmRelease: monitoring/kube-prometheus-stack Job: monitoring/kube-prometheus-stack-admission-create

+++ HelmRelease: monitoring/kube-prometheus-stack Job: monitoring/kube-prometheus-stack-admission-create

@@ -30,13 +30,13 @@

         heritage: Helm
         app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
         app.kubernetes.io/component: prometheus-operator-webhook
     spec:
       containers:
       - name: create
-        image: ghcr.io/jkroepke/kube-webhook-certgen:1.8.5
+        image: ghcr.io/jkroepke/kube-webhook-certgen:1.8.8
         imagePullPolicy: IfNotPresent
         args:
         - create
         - --host=kube-prometheus-stack-operator,kube-prometheus-stack-operator.monitoring.svc
         - --namespace=monitoring
         - --secret-name=kube-prometheus-stack-admission
--- HelmRelease: monitoring/kube-prometheus-stack Job: monitoring/kube-prometheus-stack-admission-patch

+++ HelmRelease: monitoring/kube-prometheus-stack Job: monitoring/kube-prometheus-stack-admission-patch

@@ -30,13 +30,13 @@

         heritage: Helm
         app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
         app.kubernetes.io/component: prometheus-operator-webhook
     spec:
       containers:
       - name: patch
-        image: ghcr.io/jkroepke/kube-webhook-certgen:1.8.5
+        image: ghcr.io/jkroepke/kube-webhook-certgen:1.8.8
         imagePullPolicy: IfNotPresent
         args:
         - patch
         - --webhook-name=kube-prometheus-stack-admission
         - --namespace=monitoring
         - --secret-name=kube-prometheus-stack-admission

@mglants-bot

mglants-bot Bot commented Sep 7, 2026

Copy link
Copy Markdown 
--- kubernetes/subterra/apps/monitoring/kube-prometheus-stack/app Kustomization: flux-system/cluster-apps-kube-prometheus-stack HelmRelease: monitoring/kube-prometheus-stack

+++ kubernetes/subterra/apps/monitoring/kube-prometheus-stack/app Kustomization: flux-system/cluster-apps-kube-prometheus-stack HelmRelease: monitoring/kube-prometheus-stack

@@ -13,13 +13,13 @@

       chart: kube-prometheus-stack
       interval: 5m
       sourceRef:
         kind: HelmRepository
         name: prometheus-community-charts
         namespace: flux-system
-      version: 88.3.0
+      version: 90.0.0
   install:
     crds: CreateReplace
   interval: 5m
   postRenderers:
   - kustomize:
       patches:

@mglants-bot

mglants-bot Bot commented Sep 7, 2026

Copy link
Copy Markdown 
--- HelmRelease: monitoring/kube-prometheus-stack Deployment: monitoring/kube-prometheus-stack-kube-state-metrics

+++ HelmRelease: monitoring/kube-prometheus-stack Deployment: monitoring/kube-prometheus-stack-kube-state-metrics

@@ -45,13 +45,13 @@

       - name: kube-state-metrics
         args:
         - --port=8080
         - --resources=certificatesigningrequests,configmaps,cronjobs,daemonsets,deployments,endpointslices,horizontalpodautoscalers,ingresses,jobs,leases,limitranges,mutatingwebhookconfigurations,namespaces,networkpolicies,nodes,persistentvolumeclaims,persistentvolumes,poddisruptionbudgets,pods,replicasets,replicationcontrollers,resourcequotas,secrets,services,statefulsets,storageclasses,validatingwebhookconfigurations,volumeattachments
         - --metric-labels-allowlist=persistentvolumeclaims=[*]
         imagePullPolicy: IfNotPresent
-        image: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1
+        image: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0
         ports:
         - containerPort: 8080
           name: http
         - containerPort: 8081
           name: metrics
         livenessProbe:
--- HelmRelease: monitoring/kube-prometheus-stack Deployment: monitoring/kube-prometheus-stack-operator

+++ HelmRelease: monitoring/kube-prometheus-stack Deployment: monitoring/kube-prometheus-stack-operator

@@ -31,26 +31,26 @@

         app: kube-prometheus-stack-operator
         app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
         app.kubernetes.io/component: prometheus-operator
     spec:
       containers:
       - name: kube-prometheus-stack
-        image: quay.io/prometheus-operator/prometheus-operator:v0.93.0
+        image: quay.io/prometheus-operator/prometheus-operator:v0.93.1
         imagePullPolicy: IfNotPresent
         args:
         - --kubelet-service=kube-system/kube-prometheus-stack-kubelet
         - --kubelet-endpoints=true
         - --kubelet-endpointslice=false
         - --localhost=127.0.0.1
-        - --prometheus-config-reloader=quay.io/prometheus-operator/prometheus-config-reloader:v0.93.0
+        - --prometheus-config-reloader=quay.io/prometheus-operator/prometheus-config-reloader:v0.93.1
         - --config-reloader-cpu-request=5m
         - --config-reloader-cpu-limit=0
         - --config-reloader-memory-request=32M
         - --config-reloader-memory-limit=32M
         - --thanos-default-base-image=quay.io/thanos/thanos:v0.42.4
-        - --secret-field-selector=type!=kubernetes.io/dockercfg,type!=kubernetes.io/service-account-token,type!=helm.sh/release.v1
+        - --secret-field-selector=type!=kubernetes.io/dockercfg,type!=helm.sh/release.v1
         - --web.enable-tls=true
         - --web.cert-file=/cert/cert
         - --web.key-file=/cert/key
         - --web.listen-address=:10250
         - --web.tls-min-version=VersionTLS13
         ports:
--- HelmRelease: monitoring/kube-prometheus-stack Prometheus: monitoring/kube-prometheus-stack-prometheus

+++ HelmRelease: monitoring/kube-prometheus-stack Prometheus: monitoring/kube-prometheus-stack-prometheus

@@ -16,15 +16,15 @@

   alerting:
     alertmanagers:
     - apiVersion: v2
       name: alertmanager
       namespace: monitoring
       port: 9093
-  image: quay.io/prometheus/prometheus:v3.13.2-distroless
+  image: quay.io/prometheus/prometheus:v3.14.0-distroless
   imagePullPolicy: IfNotPresent
-  version: v3.13.2-distroless
+  version: v3.14.0-distroless
   externalLabels:
     cluster: subterra
   replicaExternalLabelName: __replica__
   externalUrl: http://prometheus.ur30.ru/
   paused: false
   replicas: 1
--- HelmRelease: monitoring/kube-prometheus-stack ServiceMonitor: monitoring/kube-prometheus-stack-coredns

+++ HelmRelease: monitoring/kube-prometheus-stack ServiceMonitor: monitoring/kube-prometheus-stack-coredns

@@ -19,8 +19,12 @@

       release: kube-prometheus-stack
   namespaceSelector:
     matchNames:
     - kube-system
   endpoints:
   - port: http-metrics
-    bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+    authorization:
+      credentials:
+        key: token
+        name: kube-prometheus-stack-prometheus-token
+      type: Bearer
 
--- HelmRelease: monitoring/kube-prometheus-stack ServiceMonitor: monitoring/kube-prometheus-stack-apiserver

+++ HelmRelease: monitoring/kube-prometheus-stack ServiceMonitor: monitoring/kube-prometheus-stack-apiserver

@@ -10,15 +10,19 @@

     app.kubernetes.io/instance: kube-prometheus-stack
     app.kubernetes.io/part-of: kube-prometheus-stack
     release: kube-prometheus-stack
     heritage: Helm
 spec:
   endpoints:
-  - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
-    port: https
+  - port: https
     scheme: https
+    authorization:
+      credentials:
+        key: token
+        name: kube-prometheus-stack-prometheus-token
+      type: Bearer
     metricRelabelings:
     - action: keep
       regex: (aggregator_openapi|aggregator_unavailable|apiextensions_openapi|apiserver_admission|apiserver_audit|apiserver_cache|apiserver_cel|apiserver_client|apiserver_crd|apiserver_current|apiserver_envelope|apiserver_flowcontrol|apiserver_init|apiserver_kube|apiserver_longrunning|apiserver_request|apiserver_requested|apiserver_response|apiserver_selfrequest|apiserver_storage|apiserver_terminated|apiserver_tls|apiserver_watch|apiserver_webhooks|authenticated_user|authentication|disabled_metric|etcd_bookmark|etcd_lease|etcd_request|field_validation|get_token|go|grpc_client|hidden_metric|kube_apiserver|kubernetes_build|kubernetes_feature|node_authorizer|pod_security|process_cpu|process_max|process_open|process_resident|process_start|process_virtual|registered_metric|rest_client|scrape_duration|scrape_samples|scrape_series|serviceaccount_legacy|serviceaccount_stale|serviceaccount_valid|watch_cache|workqueue)_(.+)
       sourceLabels:
       - __name__
     - action: drop
@@ -27,15 +31,18 @@

       - __name__
     - action: drop
       regex: (apiserver_response_sizes_bucket|apiserver_watch_events_sizes_bucket)
       sourceLabels:
       - __name__
     tlsConfig:
-      caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+      ca:
+        configMap:
+          key: ca.crt
+          name: kube-root-ca.crt
+      insecureSkipVerify: false
       serverName: kubernetes
-      insecureSkipVerify: false
   jobLabel: component
   namespaceSelector:
     matchNames:
     - default
   selector:
     matchLabels:
--- HelmRelease: monitoring/kube-prometheus-stack ServiceMonitor: monitoring/kube-prometheus-stack-kube-etcd

+++ HelmRelease: monitoring/kube-prometheus-stack ServiceMonitor: monitoring/kube-prometheus-stack-kube-etcd

@@ -19,8 +19,12 @@

       release: kube-prometheus-stack
   namespaceSelector:
     matchNames:
     - kube-system
   endpoints:
   - port: http-metrics
-    bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+    authorization:
+      credentials:
+        key: token
+        name: kube-prometheus-stack-prometheus-token
+      type: Bearer
 
--- HelmRelease: monitoring/kube-prometheus-stack ServiceMonitor: monitoring/kube-prometheus-stack-kubelet

+++ HelmRelease: monitoring/kube-prometheus-stack ServiceMonitor: monitoring/kube-prometheus-stack-kubelet

@@ -23,15 +23,22 @@

       app.kubernetes.io/name: kubelet
       k8s-app: kubelet
   endpoints:
   - port: https-metrics
     scheme: https
     tlsConfig:
-      caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+      ca:
+        configMap:
+          key: ca.crt
+          name: kube-root-ca.crt
       insecureSkipVerify: true
-    bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+    authorization:
+      credentials:
+        key: token
+        name: kube-prometheus-stack-prometheus-token
+      type: Bearer
     honorLabels: true
     honorTimestamps: true
     metricRelabelings:
     - action: keep
       regex: (apiserver_audit|apiserver_client|apiserver_delegated|apiserver_envelope|apiserver_storage|apiserver_webhooks|authentication_token|cadvisor_version|container_blkio|container_cpu|container_fs|container_last|container_memory|container_network|container_oom|container_processes|container|csi_operations|disabled_metric|get_token|go|hidden_metric|kubelet_certificate|kubelet_cgroup|kubelet_container|kubelet_containers|kubelet_cpu|kubelet_device|kubelet_graceful|kubelet_http|kubelet_lifecycle|kubelet_managed|kubelet_node|kubelet_pleg|kubelet_pod|kubelet_run|kubelet_running|kubelet_runtime|kubelet_server|kubelet_started|kubelet_volume|kubernetes_build|kubernetes_feature|machine_cpu|machine_memory|machine_nvm|machine_scrape|node_namespace|plugin_manager|prober_probe|process_cpu|process_max|process_open|process_resident|process_start|process_virtual|registered_metric|rest_client|scrape_duration|scrape_samples|scrape_series|storage_operation|volume_manager|volume_operation|workqueue)_(.+)
       sourceLabels:
@@ -50,15 +57,22 @@

     path: /metrics/cadvisor
     interval: 10s
     honorLabels: true
     honorTimestamps: true
     trackTimestampsStaleness: true
     tlsConfig:
-      caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+      ca:
+        configMap:
+          key: ca.crt
+          name: kube-root-ca.crt
       insecureSkipVerify: true
-    bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+    authorization:
+      credentials:
+        key: token
+        name: kube-prometheus-stack-prometheus-token
+      type: Bearer
     metricRelabelings:
     - action: drop
       regex: container_cpu_(cfs_throttled_seconds_total|load_average_10s|system_seconds_total|user_seconds_total)
       sourceLabels:
       - __name__
     - action: drop
@@ -100,15 +114,22 @@

   - port: https-metrics
     scheme: https
     path: /metrics/probes
     honorLabels: true
     honorTimestamps: true
     tlsConfig:
-      caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+      ca:
+        configMap:
+          key: ca.crt
+          name: kube-root-ca.crt
       insecureSkipVerify: true
-    bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+    authorization:
+      credentials:
+        key: token
+        name: kube-prometheus-stack-prometheus-token
+      type: Bearer
     relabelings:
     - action: replace
       sourceLabels:
       - __metrics_path__
       targetLabel: metrics_path
 
--- HelmRelease: monitoring/kube-prometheus-stack Job: monitoring/kube-prometheus-stack-admission-create

+++ HelmRelease: monitoring/kube-prometheus-stack Job: monitoring/kube-prometheus-stack-admission-create

@@ -30,13 +30,13 @@

         heritage: Helm
         app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
         app.kubernetes.io/component: prometheus-operator-webhook
     spec:
       containers:
       - name: create
-        image: ghcr.io/jkroepke/kube-webhook-certgen:1.8.5
+        image: ghcr.io/jkroepke/kube-webhook-certgen:1.8.8
         imagePullPolicy: IfNotPresent
         args:
         - create
         - --host=kube-prometheus-stack-operator,kube-prometheus-stack-operator.monitoring.svc
         - --namespace=monitoring
         - --secret-name=kube-prometheus-stack-admission
--- HelmRelease: monitoring/kube-prometheus-stack Job: monitoring/kube-prometheus-stack-admission-patch

+++ HelmRelease: monitoring/kube-prometheus-stack Job: monitoring/kube-prometheus-stack-admission-patch

@@ -30,13 +30,13 @@

         heritage: Helm
         app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
         app.kubernetes.io/component: prometheus-operator-webhook
     spec:
       containers:
       - name: patch
-        image: ghcr.io/jkroepke/kube-webhook-certgen:1.8.5
+        image: ghcr.io/jkroepke/kube-webhook-certgen:1.8.8
         imagePullPolicy: IfNotPresent
         args:
         - patch
         - --webhook-name=kube-prometheus-stack-admission
         - --namespace=monitoring
         - --secret-name=kube-prometheus-stack-admission

@mglants-bot

mglants-bot Bot commented Sep 7, 2026

Copy link
Copy Markdown 
--- kubernetes/berries/apps/monitoring/kube-prometheus-stack/app Kustomization: flux-system/cluster-apps-kube-prometheus-stack HelmRelease: monitoring/kube-prometheus-stack

+++ kubernetes/berries/apps/monitoring/kube-prometheus-stack/app Kustomization: flux-system/cluster-apps-kube-prometheus-stack HelmRelease: monitoring/kube-prometheus-stack

@@ -13,13 +13,13 @@

       chart: kube-prometheus-stack
       interval: 5m
       sourceRef:
         kind: HelmRepository
         name: prometheus-community-charts
         namespace: flux-system
-      version: 88.3.0
+      version: 90.0.0
   install:
     crds: CreateReplace
   interval: 5m
   postRenderers:
   - kustomize:
       patches:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

area/kubernetes cluster/berries cluster/subterra renovate/helm type/major

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants