Skip to content

feat(helm)!: Update chart kube-prometheus-stack ( 88.3.0 → 91.8.1 ) - #3099

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/kube-prometheus-stack-91.x
Open

renovate[bot] wants to merge 1 commit into
mainfrom
renovate/kube-prometheus-stack-91.x

Conversation

@renovate

@renovate renovate Bot commented Sep 13, 2026 •

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Update Change
kube-prometheus-stack (source) major 88.3.0 → 91.8.1

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.


Release Notes

prometheus-community/helm-charts (kube-prometheus-stack)

v91.8.1

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

Full Changelog: prometheus-community/helm-charts@prometheus-redis-exporter-6.32.1...kube-prometheus-stack-91.8.1

v91.8.0

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

  • [kube-prometheus-stack] Update prometheus-node-exporter Docker tag to v4.59.0 by @​renovate[bot] in #​7333

Full Changelog: prometheus-community/helm-charts@prometheus-29.35.0...kube-prometheus-stack-91.8.0

v91.7.1

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-91.7.0...kube-prometheus-stack-91.7.1

v91.7.0

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed
  • [kube-prometheus-stack] Update prometheus-node-exporter Docker tag to v4.58.0 by @​renovate[bot] in #​7330

Full Changelog: prometheus-community/helm-charts@prometheus-29.34.0...kube-prometheus-stack-91.7.0

v91.6.0

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

Full Changelog: prometheus-community/helm-charts@prom-label-proxy-0.24.0...kube-prometheus-stack-91.6.0

v91.5.3

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

  • [kube-prometheus-stack] Update kube-prometheus-stack dependency non-major updates by @​renovate[bot] in #​7322

Full Changelog: prometheus-community/helm-charts@prometheus-operator-admission-webhook-0.44.2...kube-prometheus-stack-91.5.3

v91.5.2

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

  • [kube-prometheus-stack] fix(rbac): allow operator to adjust finalizers on configmap/secret ow… by @​adns44 in #​7295

New Contributors

Full Changelog: prometheus-community/helm-charts@prometheus-operator-admission-webhook-0.44.1...kube-prometheus-stack-91.5.2

v91.5.1

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

  • [kube-prometheus-stack] Update dependency prometheus-operator/prometheus-operator to v0.94.1 by @​renovate[bot] in #​7312

Full Changelog: prometheus-community/helm-charts@alertmanager-2.0.1...kube-prometheus-stack-91.5.1

v91.5.0

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

  • [kube-prometheus-stack] Update kube-prometheus-stack dependency non-major updates by @​renovate[bot] in #​7307

Full Changelog: prometheus-community/helm-charts@prometheus-conntrack-stats-exporter-0.5.40...kube-prometheus-stack-91.5.0

v91.4.1

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-91.4.0...kube-prometheus-stack-91.4.1

v91.4.0

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-91.3.0...kube-prometheus-stack-91.4.0

v91.3.0

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

  • [kube-prometheus-stack] Update kube-state-metrics Docker tag to v8.5.0 by @​renovate[bot] in #​7281

Full Changelog: prometheus-community/helm-charts@prometheus-29.30.0...kube-prometheus-stack-91.3.0

v91.2.3

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

New Contributors

Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-91.2.2...kube-prometheus-stack-91.2.3

v91.2.2

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-91.2.1...kube-prometheus-stack-91.2.2

v91.2.1

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-91.2.0...kube-prometheus-stack-91.2.1

v91.2.0

Compare Source

v91.1.0

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-91.0.0...kube-prometheus-stack-91.1.0

v91.0.0

Compare Source

v90.2.0

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

  • [kube-prometheus-stack] Update prometheus-node-exporter Docker tag to v4.57.0 by @​renovate[bot] in #​7267

Full Changelog: prometheus-community/helm-charts@prometheus-29.29.0...kube-prometheus-stack-90.2.0

v90.1.2

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-90.1.1...kube-prometheus-stack-90.1.2

v90.1.1

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-90.1.0...kube-prometheus-stack-90.1.1

v90.1.0

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

  • [kube-prometheus-stack] Update kube-prometheus-stack dependency non-major updates by @​renovate[bot] in #​7262

Full Changelog: prometheus-community/helm-charts@prometheus-kafka-exporter-4.0.0...kube-prometheus-stack-90.1.0

v90.0.0

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

New Contributors

Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-89.2.4...kube-prometheus-stack-90.0.0

v89.2.4

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

Full Changelog: prometheus-community/helm-charts@prometheus-stackdriver-exporter-5.0.1...kube-prometheus-stack-89.2.4

v89.2.3

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

  • [kube-prometheus-stack] Update kube-state-metrics Docker tag to v8.4.2 by @​renovate[bot] in #​7240

Full Changelog: prometheus-community/helm-charts@prometheus-29.27.2...kube-prometheus-stack-89.2.3

v89.2.2

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-89.2.1...kube-prometheus-stack-89.2.2

v89.2.1

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

  • [kube-prometheus-stack] Set a default commonName for prometheus cert-… by @​maarous in #​7234

Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-89.2.0...kube-prometheus-stack-89.2.1

v89.2.0

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-89.1.0...kube-prometheus-stack-89.2.0

v89.1.0

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

  • [kube-prometheus-stack] Update kube-prometheus-stack dependency non-major updates by @​renovate[bot] in #​7232

Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-89.0.0...kube-prometheus-stack-89.1.0

v89.0.0

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-88.6.5...kube-prometheus-stack-89.0.0

v88.6.5

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

  • [kube-prometheus-stack] Make cert-manager private key configurable by @​maarous in #​7216

New Contributors

Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-88.6.4...kube-prometheus-stack-88.6.5

v88.6.4

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

New Contributors

Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-88.6.3...kube-prometheus-stack-88.6.4

v88.6.3

Compare Source

v88.6.2

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

  • [kube-prometheus-stack] Update Helm release prometheus-node-exporter to v4.56.3 by @​renovate[bot] in #​7226

Full Changelog: prometheus-community/helm-charts@prometheus-blackbox-exporter-11.18.0...kube-prometheus-stack-88.6.2

v88.6.1

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

  • [kube-prometheus-stack] Update kube-prometheus-stack dependency non-major updates by @​renovate[bot] in #​7223

Full Changelog: prometheus-community/helm-charts@prometheus-operator-admission-webhook-0.43.3...kube-prometheus-stack-88.6.1

v88.6.0

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

Full Changelog: prometheus-community/helm-charts@prometheus-redis-exporter-6.30.0...kube-prometheus-stack-88.6.0

v88.5.4

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

Full Changelog: prometheus-community/helm-charts@prometheus-ipmi-exporter-0.8.2...kube-prometheus-stack-88.5.4

v88.5.3

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

  • [kube-prometheus-stack] Update ghcr.io/jkroepke/kube-webhook-certgen Docker tag to v1.8.7 by @​renovate[bot] in #​7208

Full Changelog: prometheus-community/helm-charts@prometheus-operator-admission-webhook-0.43.2...kube-prometheus-stack-88.5.3

v88.5.2

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

  • [kube-prometheus-stack] Update quay.io/oauth2-proxy/oauth2-proxy Docker tag to v7.15.4 by @​renovate[bot] in #​7204

Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-88.5.1...kube-prometheus-stack-88.5.2

v88.5.1

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

  • [kube-prometheus-stack] Update kube-prometheus-stack dependency non-major updates by @​renovate[bot] in #​7203

Full Changelog: prometheus-community/helm-charts@prometheus-nats-exporter-2.23.2...kube-prometheus-stack-88.5.1

v88.5.0

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

  • [kube-prometheus-stack] Update Helm release kube-state-metrics to v8.4.0 by @​renovate[bot] in #​7199

Full Changelog: prometheus-community/helm-charts@prometheus-kafka-exporter-3.1.1...kube-prometheus-stack-88.5.0

v88.4.0

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

  • [kube-prometheus-stack] Update kube-prometheus-stack dependency non-major updates by @​renovate[bot] in #​7196

Full Changelog: prometheus-community/helm-charts@kube-state-metrics-8.4.0...kube-prometheus-stack-88.4.0


Configuration

📅 Schedule: (in timezone Europe/Moscow)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@mglants-bot

mglants-bot Bot commented Sep 13, 2026 •

Copy link
Copy Markdown
--- HelmRelease: monitoring/kube-prometheus-stack ClusterRole: monitoring/kube-prometheus-stack-operator

+++ HelmRelease: monitoring/kube-prometheus-stack ClusterRole: monitoring/kube-prometheus-stack-operator

@@ -14,49 +14,84 @@

     app.kubernetes.io/component: prometheus-operator
 rules:
 - apiGroups:
   - monitoring.coreos.com
   resources:
   - alertmanagers
+  - prometheusagents
+  - prometheuses
+  - thanosrulers
+  verbs:
+  - patch
+- apiGroups:
+  - monitoring.coreos.com
+  resources:
+  - alertmanagers/status
+  - podmonitors/status
+  - probes/status
+  - prometheuses/status
+  - prometheusagents/status
+  - prometheusrules/status
+  - scrapeconfigs/status
+  - servicemonitors/status
+  - thanosrulers/status
+  verbs:
+  - create
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - monitoring.coreos.com
+  resources:
   - alertmanagers/finalizers
-  - alertmanagers/status
+  - prometheusagents/finalizers
+  - prometheuses/finalizers
+  - thanosrulers/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - monitoring.coreos.com
+  resources:
+  - alertmanagers
   - alertmanagerconfigs
+  - podmonitors
+  - probes
+  - prometheusagents
   - prometheuses
-  - prometheuses/finalizers
-  - prometheuses/status
-  - prometheusagents
-  - prometheusagents/finalizers
-  - prometheusagents/status
+  - prometheusrules
+  - servicemonitors
+  - scrapeconfigs
   - thanosrulers
-  - thanosrulers/finalizers
-  - thanosrulers/status
-  - scrapeconfigs
-  - scrapeconfigs/status
-  - servicemonitors
-  - servicemonitors/status
-  - podmonitors
-  - podmonitors/status
-  - probes
-  - probes/status
-  - prometheusrules
-  - prometheusrules/status
   verbs:
-  - '*'
+  - get
+  - list
+  - watch
 - apiGroups:
   - apps
   resources:
   - statefulsets
   verbs:
-  - '*'
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+  - delete
 - apiGroups:
   - ''
   resources:
   - configmaps
   - secrets
   verbs:
-  - '*'
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - delete
 - apiGroups:
   - ''
   resources:
   - pods
   verbs:
   - list
--- HelmRelease: monitoring/kube-prometheus-stack Service: monitoring/kube-prometheus-stack-prometheus-node-exporter

+++ HelmRelease: monitoring/kube-prometheus-stack Service: monitoring/kube-prometheus-stack-prometheus-node-exporter

@@ -9,14 +9,12 @@

     app.kubernetes.io/component: metrics
     app.kubernetes.io/part-of: prometheus-node-exporter
     app.kubernetes.io/name: prometheus-node-exporter
     app.kubernetes.io/instance: kube-prometheus-stack
     release: kube-prometheus-stack
     jobLabel: node-exporter
-  annotations:
-    prometheus.io/scrape: 'true'
 spec:
   type: ClusterIP
   ports:
   - port: 9100
     targetPort: 9100
     protocol: TCP
--- HelmRelease: monitoring/kube-prometheus-stack DaemonSet: monitoring/kube-prometheus-stack-prometheus-node-exporter

+++ HelmRelease: monitoring/kube-prometheus-stack DaemonSet: monitoring/kube-prometheus-stack-prometheus-node-exporter

@@ -23,17 +23,17 @@

     type: RollingUpdate
   template:
     metadata:
       annotations:
         cluster-autoscaler.kubernetes.io/safe-to-evict: 'true'
       labels:
+        app.kubernetes.io/component: metrics
+        app.kubernetes.io/instance: kube-prometheus-stack
         app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/component: metrics
+        app.kubernetes.io/name: prometheus-node-exporter
         app.kubernetes.io/part-of: prometheus-node-exporter
-        app.kubernetes.io/name: prometheus-node-exporter
-        app.kubernetes.io/instance: kube-prometheus-stack
         release: kube-prometheus-stack
         jobLabel: node-exporter
     spec:
       automountServiceAccountToken: false
       securityContext:
         fsGroup: 65534
--- HelmRelease: monitoring/kube-prometheus-stack Deployment: monitoring/kube-prometheus-stack-kube-state-metrics

+++ HelmRelease: monitoring/kube-prometheus-stack Deployment: monitoring/kube-prometheus-stack-kube-state-metrics

@@ -20,17 +20,17 @@

   strategy:
     type: RollingUpdate
   revisionHistoryLimit: 10
   template:
     metadata:
       labels:
+        app.kubernetes.io/component: metrics
+        app.kubernetes.io/instance: kube-prometheus-stack
         app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/component: metrics
+        app.kubernetes.io/name: kube-state-metrics
         app.kubernetes.io/part-of: kube-state-metrics
-        app.kubernetes.io/name: kube-state-metrics
-        app.kubernetes.io/instance: kube-prometheus-stack
         release: kube-prometheus-stack
     spec:
       automountServiceAccountToken: true
       hostNetwork: false
       serviceAccountName: kube-prometheus-stack-kube-state-metrics
       securityContext:
@@ -45,13 +45,13 @@

       - name: kube-state-metrics
         args:
         - --port=8080
         - --resources=certificatesigningrequests,configmaps,cronjobs,daemonsets,deployments,endpointslices,horizontalpodautoscalers,ingresses,jobs,leases,limitranges,mutatingwebhookconfigurations,namespaces,networkpolicies,nodes,persistentvolumeclaims,persistentvolumes,poddisruptionbudgets,pods,replicasets,replicationcontrollers,resourcequotas,secrets,services,statefulsets,storageclasses,validatingwebhookconfigurations,volumeattachments
         - --metric-labels-allowlist=persistentvolumeclaims=[*]
         imagePullPolicy: IfNotPresent
-        image: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1
+        image: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0
         ports:
         - containerPort: 8080
           name: http
         - containerPort: 8081
           name: metrics
         livenessProbe:
--- HelmRelease: monitoring/kube-prometheus-stack Deployment: monitoring/kube-prometheus-stack-operator

+++ HelmRelease: monitoring/kube-prometheus-stack Deployment: monitoring/kube-prometheus-stack-operator

@@ -31,26 +31,26 @@

         app: kube-prometheus-stack-operator
         app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
         app.kubernetes.io/component: prometheus-operator
     spec:
       containers:
       - name: kube-prometheus-stack
-        image: quay.io/prometheus-operator/prometheus-operator:v0.93.0
+        image: quay.io/prometheus-operator/prometheus-operator:v0.94.1
         imagePullPolicy: IfNotPresent
         args:
         - --kubelet-service=kube-system/kube-prometheus-stack-kubelet
         - --kubelet-endpoints=true
         - --kubelet-endpointslice=false
         - --localhost=127.0.0.1
-        - --prometheus-config-reloader=quay.io/prometheus-operator/prometheus-config-reloader:v0.93.0
+        - --prometheus-config-reloader=quay.io/prometheus-operator/prometheus-config-reloader:v0.94.1
         - --config-reloader-cpu-request=5m
         - --config-reloader-cpu-limit=0
         - --config-reloader-memory-request=32M
         - --config-reloader-memory-limit=32M
         - --thanos-default-base-image=quay.io/thanos/thanos:v0.42.4
-        - --secret-field-selector=type!=kubernetes.io/dockercfg,type!=kubernetes.io/service-account-token,type!=helm.sh/release.v1
+        - --secret-field-selector=type!=kubernetes.io/dockercfg,type!=helm.sh/release.v1
         - --web.enable-tls=true
         - --web.cert-file=/cert/cert
         - --web.key-file=/cert/key
         - --web.listen-address=:10250
         - --web.tls-min-version=VersionTLS13
         ports:
--- HelmRelease: monitoring/kube-prometheus-stack Prometheus: monitoring/kube-prometheus-stack-prometheus

+++ HelmRelease: monitoring/kube-prometheus-stack Prometheus: monitoring/kube-prometheus-stack-prometheus

@@ -16,15 +16,15 @@

   alerting:
     alertmanagers:
     - apiVersion: v2
       name: alertmanager
       namespace: monitoring
       port: 9093
-  image: quay.io/prometheus/prometheus:v3.13.2-distroless
+  image: quay.io/prometheus/prometheus:v3.15.0-distroless
   imagePullPolicy: IfNotPresent
-  version: v3.13.2-distroless
+  version: v3.15.0-distroless
   externalLabels:
     cluster: sweethome
   replicaExternalLabelName: __replica__
   externalUrl: http://prometheus.home/
   paused: false
   replicas: 1
--- HelmRelease: monitoring/kube-prometheus-stack PrometheusRule: monitoring/kube-prometheus-stack-kube-apiserver-burnrate.rules

+++ HelmRelease: monitoring/kube-prometheus-stack PrometheusRule: monitoring/kube-prometheus-stack-kube-apiserver-burnrate.rules

@@ -16,304 +16,242 @@

   - name: kube-apiserver-burnrate.rules
     rules:
     - expr: |-
         (
           (
             # too slow
-            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[1d]))
-            -
-            (
-              (
-                sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[1d]))
-                or
-                vector(0)
-              )
-              +
-              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[1d]))
-              +
-              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[1d]))
-            )
-          )
-          +
-          # errors
-          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[1d]))
-        )
-        /
-        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET"}[1d]))
-      labels:
-        verb: read
+            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[5m]))
+            -
+            (
+              (
+                sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[5m]))
+                or
+                vector(0)
+              )
+              +
+              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[5m]))
+              +
+              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[5m]))
+            )
+          )
+          +
+          # errors
+          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[5m]))
+        )
+      labels:
+        verb: read
+      record: cluster_verb:apiserver_request_sli_bad_events:rate5m
+    - expr: |-
+        (
+          (
+            # too slow
+            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[5m]))
+            -
+            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[5m]))
+          )
+          +
+          # errors
+          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[5m]))
+        )
+      labels:
+        verb: write
+      record: cluster_verb:apiserver_request_sli_bad_events:rate5m
+    - expr: sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET"}[5m]))
+      labels:
+        verb: read
+      record: cluster_verb:apiserver_request_sli_events:rate5m
+    - expr: sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[5m]))
+      labels:
+        verb: write
+      record: cluster_verb:apiserver_request_sli_events:rate5m
+    - expr: |-
+        cluster_verb:apiserver_request_sli_bad_events:rate5m
+        /
+        cluster_verb:apiserver_request_sli_events:rate5m
+      record: apiserver_request:burnrate5m
+    - expr: |-
+        (
+          (
+            # too slow
+            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[1h]))
+            -
+            (
+              (
+                sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[1h]))
+                or
+                vector(0)
+              )
+              +
+              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[1h]))
+              +
+              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[1h]))
+            )
+          )
+          +
+          # errors
+          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[1h]))
+        )
+        /
+        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET"}[1h]))
+      labels:
+        verb: read
+      record: apiserver_request:burnrate1h
+    - expr: |-
+        (
+          (
+            # too slow
+            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[1h]))
+            -
+            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[1h]))
+          )
+          +
+          # errors
+          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[1h]))
+        )
+        /
+        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[1h]))
+      labels:
+        verb: write
+      record: apiserver_request:burnrate1h
+    - expr: |-
+        (
+          (
+            # too slow
+            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[2h]))
+            -
+            (
+              (
+                sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[2h]))
+                or
+                vector(0)
+              )
+              +
+              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[2h]))
+              +
+              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[2h]))
+            )
+          )
+          +
+          # errors
+          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[2h]))
+        )
+        /
+        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET"}[2h]))
+      labels:
+        verb: read
+      record: apiserver_request:burnrate2h
+    - expr: |-
+        (
+          (
+            # too slow
+            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[2h]))
+            -
+            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[2h]))
+          )
+          +
+          # errors
+          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[2h]))
+        )
+        /
+        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[2h]))
+      labels:
+        verb: write
+      record: apiserver_request:burnrate2h
+    - expr: |-
+        (
+          (
+            # too slow
+            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[30m]))
+            -
+            (
+              (
+                sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[30m]))
+                or
+                vector(0)
+              )
+              +
+              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[30m]))
+              +
+              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[30m]))
+            )
+          )
+          +
+          # errors
+          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[30m]))
+        )
+        /
+        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET"}[30m]))
+      labels:
+        verb: read
+      record: apiserver_request:burnrate30m
+    - expr: |-
+        (
+          (
+            # too slow
[Diff truncated by flux-local]
--- HelmRelease: monitoring/kube-prometheus-stack PrometheusRule: monitoring/kube-prometheus-stack-kubernetes-apps

+++ HelmRelease: monitoring/kube-prometheus-stack PrometheusRule: monitoring/kube-prometheus-stack-kubernetes-apps

@@ -239,12 +239,14 @@

         runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubejobnotcompleted
         summary: Job did not complete in time
       expr: |-
         time() - max by (namespace, job_name, cluster) (kube_job_status_start_time{job="kube-state-metrics", namespace=~".*"}
           and
         kube_job_status_active{job="kube-state-metrics", namespace=~".*"} > 0) > 43200
+          unless on (namespace, job_name, cluster)
+        max by (namespace, job_name, cluster) (kube_job_labels{job="kube-state-metrics", namespace=~".*",label_excluded_from_alerts="true"} == 1)
       labels:
         severity: warning
     - alert: KubeJobFailed
       annotations:
         description: Job {{ $labels.namespace }}/{{ $labels.job_name }} failed to
           complete. Removing failed job after investigation should clear this alert
@@ -311,10 +313,13 @@

         (
           kube_poddisruptionbudget_status_desired_healthy{job="kube-state-metrics", namespace=~".*"}
           -
           kube_poddisruptionbudget_status_current_healthy{job="kube-state-metrics", namespace=~".*"}
         )
         > 0
+        and
+        kube_poddisruptionbudget_status_expected_pods{job="kube-state-metrics", namespace=~".*"}
+        > 0
       for: 15m
       labels:
         severity: warning
 
--- HelmRelease: monitoring/kube-prometheus-stack ServiceMonitor: monitoring/kube-prometheus-stack-coredns

+++ HelmRelease: monitoring/kube-prometheus-stack ServiceMonitor: monitoring/kube-prometheus-stack-coredns

@@ -19,8 +19,12 @@

       release: kube-prometheus-stack
   namespaceSelector:
     matchNames:
     - kube-system
   endpoints:
   - port: http-metrics
-    bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+    authorization:
+      credentials:
+        key: token
+        name: kube-prometheus-stack-prometheus-token
+      type: Bearer
 
--- HelmRelease: monitoring/kube-prometheus-stack ServiceMonitor: monitoring/kube-prometheus-stack-apiserver

+++ HelmRelease: monitoring/kube-prometheus-stack ServiceMonitor: monitoring/kube-prometheus-stack-apiserver

@@ -10,15 +10,19 @@

     app.kubernetes.io/instance: kube-prometheus-stack
     app.kubernetes.io/part-of: kube-prometheus-stack
     release: kube-prometheus-stack
     heritage: Helm
 spec:
   endpoints:
-  - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
-    port: https
+  - port: https
     scheme: https
+    authorization:
+      credentials:
+        key: token
+        name: kube-prometheus-stack-prometheus-token
+      type: Bearer
     metricRelabelings:
     - action: keep
       regex: (aggregator_openapi|aggregator_unavailable|apiextensions_openapi|apiserver_admission|apiserver_audit|apiserver_cache|apiserver_cel|apiserver_client|apiserver_crd|apiserver_current|apiserver_envelope|apiserver_flowcontrol|apiserver_init|apiserver_kube|apiserver_longrunning|apiserver_request|apiserver_requested|apiserver_response|apiserver_selfrequest|apiserver_storage|apiserver_terminated|apiserver_tls|apiserver_watch|apiserver_webhooks|authenticated_user|authentication|disabled_metric|etcd_bookmark|etcd_lease|etcd_request|field_validation|get_token|go|grpc_client|hidden_metric|kube_apiserver|kubernetes_build|kubernetes_feature|node_authorizer|pod_security|process_cpu|process_max|process_open|process_resident|process_start|process_virtual|registered_metric|rest_client|scrape_duration|scrape_samples|scrape_series|serviceaccount_legacy|serviceaccount_stale|serviceaccount_valid|watch_cache|workqueue)_(.+)
       sourceLabels:
       - __name__
     - action: drop
@@ -27,15 +31,18 @@

       - __name__
     - action: drop
       regex: (apiserver_response_sizes_bucket|apiserver_watch_events_sizes_bucket)
       sourceLabels:
       - __name__
     tlsConfig:
-      caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+      ca:
+        configMap:
+          key: ca.crt
+          name: kube-root-ca.crt
+      insecureSkipVerify: false
       serverName: kubernetes
-      insecureSkipVerify: false
   jobLabel: component
   namespaceSelector:
     matchNames:
     - default
   selector:
     matchLabels:
--- HelmRelease: monitoring/kube-prometheus-stack ServiceMonitor: monitoring/kube-prometheus-stack-kube-etcd

+++ HelmRelease: monitoring/kube-prometheus-stack ServiceMonitor: monitoring/kube-prometheus-stack-kube-etcd

@@ -19,8 +19,12 @@

       release: kube-prometheus-stack
   namespaceSelector:
     matchNames:
     - kube-system
   endpoints:
   - port: http-metrics
-    bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+    authorization:
+      credentials:
+        key: token
+        name: kube-prometheus-stack-prometheus-token
+      type: Bearer
 
--- HelmRelease: monitoring/kube-prometheus-stack ServiceMonitor: monitoring/kube-prometheus-stack-kubelet

+++ HelmRelease: monitoring/kube-prometheus-stack ServiceMonitor: monitoring/kube-prometheus-stack-kubelet

@@ -23,15 +23,22 @@

       app.kubernetes.io/name: kubelet
       k8s-app: kubelet
   endpoints:
   - port: https-metrics
     scheme: https
     tlsConfig:
-      caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+      ca:
+        configMap:
+          key: ca.crt
+          name: kube-root-ca.crt
       insecureSkipVerify: true
-    bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+    authorization:
+      credentials:
+        key: token
+        name: kube-prometheus-stack-prometheus-token
+      type: Bearer
     honorLabels: true
     honorTimestamps: true
     metricRelabelings:
     - action: keep
       regex: (apiserver_audit|apiserver_client|apiserver_delegated|apiserver_envelope|apiserver_storage|apiserver_webhooks|authentication_token|cadvisor_version|container_blkio|container_cpu|container_fs|container_last|container_memory|container_network|container_oom|container_processes|container|csi_operations|disabled_metric|get_token|go|hidden_metric|kubelet_certificate|kubelet_cgroup|kubelet_container|kubelet_containers|kubelet_cpu|kubelet_device|kubelet_graceful|kubelet_http|kubelet_lifecycle|kubelet_managed|kubelet_node|kubelet_pleg|kubelet_pod|kubelet_run|kubelet_running|kubelet_runtime|kubelet_server|kubelet_started|kubelet_volume|kubernetes_build|kubernetes_feature|machine_cpu|machine_memory|machine_nvm|machine_scrape|node_namespace|plugin_manager|prober_probe|process_cpu|process_max|process_open|process_resident|process_start|process_virtual|registered_metric|rest_client|scrape_duration|scrape_samples|scrape_series|storage_operation|volume_manager|volume_operation|workqueue)_(.+)
       sourceLabels:
@@ -50,15 +57,22 @@

     path: /metrics/cadvisor
     interval: 10s
     honorLabels: true
     honorTimestamps: true
     trackTimestampsStaleness: true
     tlsConfig:
-      caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+      ca:
+        configMap:
+          key: ca.crt
+          name: kube-root-ca.crt
       insecureSkipVerify: true
-    bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+    authorization:
+      credentials:
+        key: token
+        name: kube-prometheus-stack-prometheus-token
+      type: Bearer
     metricRelabelings:
     - action: drop
       regex: container_cpu_(cfs_throttled_seconds_total|load_average_10s|system_seconds_total|user_seconds_total)
       sourceLabels:
       - __name__
     - action: drop
@@ -100,15 +114,22 @@

   - port: https-metrics
     scheme: https
     path: /metrics/probes
     honorLabels: true
     honorTimestamps: true
     tlsConfig:
-      caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+      ca:
+        configMap:
+          key: ca.crt
+          name: kube-root-ca.crt
       insecureSkipVerify: true
-    bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+    authorization:
+      credentials:
+        key: token
+        name: kube-prometheus-stack-prometheus-token
+      type: Bearer
     relabelings:
     - action: replace
       sourceLabels:
       - __metrics_path__
       targetLabel: metrics_path
 
--- HelmRelease: monitoring/kube-prometheus-stack Job: monitoring/kube-prometheus-stack-admission-create

+++ HelmRelease: monitoring/kube-prometheus-stack Job: monitoring/kube-prometheus-stack-admission-create

@@ -30,13 +30,13 @@

         heritage: Helm
         app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
         app.kubernetes.io/component: prometheus-operator-webhook
     spec:
       containers:
       - name: create
-        image: ghcr.io/jkroepke/kube-webhook-certgen:1.8.5
+        image: ghcr.io/jkroepke/kube-webhook-certgen:1.8.9
         imagePullPolicy: IfNotPresent
         args:
         - create
         - --host=kube-prometheus-stack-operator,kube-prometheus-stack-operator.monitoring.svc
         - --namespace=monitoring
         - --secret-name=kube-prometheus-stack-admission
--- HelmRelease: monitoring/kube-prometheus-stack Job: monitoring/kube-prometheus-stack-admission-patch

+++ HelmRelease: monitoring/kube-prometheus-stack Job: monitoring/kube-prometheus-stack-admission-patch

@@ -30,13 +30,13 @@

         heritage: Helm
         app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
         app.kubernetes.io/component: prometheus-operator-webhook
     spec:
       containers:
       - name: patch
-        image: ghcr.io/jkroepke/kube-webhook-certgen:1.8.5
+        image: ghcr.io/jkroepke/kube-webhook-certgen:1.8.9
         imagePullPolicy: IfNotPresent
         args:
         - patch
         - --webhook-name=kube-prometheus-stack-admission
         - --namespace=monitoring
         - --secret-name=kube-prometheus-stack-admission

@mglants-bot

mglants-bot Bot commented Sep 13, 2026 •

Copy link
Copy Markdown
--- kubernetes/berries/apps/monitoring/kube-prometheus-stack/app Kustomization: flux-system/cluster-apps-kube-prometheus-stack HelmRelease: monitoring/kube-prometheus-stack

+++ kubernetes/berries/apps/monitoring/kube-prometheus-stack/app Kustomization: flux-system/cluster-apps-kube-prometheus-stack HelmRelease: monitoring/kube-prometheus-stack

@@ -13,13 +13,13 @@

       chart: kube-prometheus-stack
       interval: 5m
       sourceRef:
         kind: HelmRepository
         name: prometheus-community-charts
         namespace: flux-system
-      version: 88.3.0
+      version: 91.8.1
   install:
     crds: CreateReplace
   interval: 5m
   postRenderers:
   - kustomize:
       patches:

@mglants-bot

mglants-bot Bot commented Sep 13, 2026 •

Copy link
Copy Markdown
--- HelmRelease: monitoring/kube-prometheus-stack ClusterRole: monitoring/kube-prometheus-stack-operator

+++ HelmRelease: monitoring/kube-prometheus-stack ClusterRole: monitoring/kube-prometheus-stack-operator

@@ -14,49 +14,84 @@

     app.kubernetes.io/component: prometheus-operator
 rules:
 - apiGroups:
   - monitoring.coreos.com
   resources:
   - alertmanagers
+  - prometheusagents
+  - prometheuses
+  - thanosrulers
+  verbs:
+  - patch
+- apiGroups:
+  - monitoring.coreos.com
+  resources:
+  - alertmanagers/status
+  - podmonitors/status
+  - probes/status
+  - prometheuses/status
+  - prometheusagents/status
+  - prometheusrules/status
+  - scrapeconfigs/status
+  - servicemonitors/status
+  - thanosrulers/status
+  verbs:
+  - create
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - monitoring.coreos.com
+  resources:
   - alertmanagers/finalizers
-  - alertmanagers/status
+  - prometheusagents/finalizers
+  - prometheuses/finalizers
+  - thanosrulers/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - monitoring.coreos.com
+  resources:
+  - alertmanagers
   - alertmanagerconfigs
+  - podmonitors
+  - probes
+  - prometheusagents
   - prometheuses
-  - prometheuses/finalizers
-  - prometheuses/status
-  - prometheusagents
-  - prometheusagents/finalizers
-  - prometheusagents/status
+  - prometheusrules
+  - servicemonitors
+  - scrapeconfigs
   - thanosrulers
-  - thanosrulers/finalizers
-  - thanosrulers/status
-  - scrapeconfigs
-  - scrapeconfigs/status
-  - servicemonitors
-  - servicemonitors/status
-  - podmonitors
-  - podmonitors/status
-  - probes
-  - probes/status
-  - prometheusrules
-  - prometheusrules/status
   verbs:
-  - '*'
+  - get
+  - list
+  - watch
 - apiGroups:
   - apps
   resources:
   - statefulsets
   verbs:
-  - '*'
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+  - delete
 - apiGroups:
   - ''
   resources:
   - configmaps
   - secrets
   verbs:
-  - '*'
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - delete
 - apiGroups:
   - ''
   resources:
   - pods
   verbs:
   - list
--- HelmRelease: monitoring/kube-prometheus-stack Service: monitoring/kube-prometheus-stack-prometheus-node-exporter

+++ HelmRelease: monitoring/kube-prometheus-stack Service: monitoring/kube-prometheus-stack-prometheus-node-exporter

@@ -9,14 +9,12 @@

     app.kubernetes.io/component: metrics
     app.kubernetes.io/part-of: prometheus-node-exporter
     app.kubernetes.io/name: prometheus-node-exporter
     app.kubernetes.io/instance: kube-prometheus-stack
     release: kube-prometheus-stack
     jobLabel: node-exporter
-  annotations:
-    prometheus.io/scrape: 'true'
 spec:
   type: ClusterIP
   ports:
   - port: 9100
     targetPort: 9100
     protocol: TCP
--- HelmRelease: monitoring/kube-prometheus-stack DaemonSet: monitoring/kube-prometheus-stack-prometheus-node-exporter

+++ HelmRelease: monitoring/kube-prometheus-stack DaemonSet: monitoring/kube-prometheus-stack-prometheus-node-exporter

@@ -23,17 +23,17 @@

     type: RollingUpdate
   template:
     metadata:
       annotations:
         cluster-autoscaler.kubernetes.io/safe-to-evict: 'true'
       labels:
+        app.kubernetes.io/component: metrics
+        app.kubernetes.io/instance: kube-prometheus-stack
         app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/component: metrics
+        app.kubernetes.io/name: prometheus-node-exporter
         app.kubernetes.io/part-of: prometheus-node-exporter
-        app.kubernetes.io/name: prometheus-node-exporter
-        app.kubernetes.io/instance: kube-prometheus-stack
         release: kube-prometheus-stack
         jobLabel: node-exporter
     spec:
       automountServiceAccountToken: false
       securityContext:
         fsGroup: 65534
--- HelmRelease: monitoring/kube-prometheus-stack Deployment: monitoring/kube-prometheus-stack-kube-state-metrics

+++ HelmRelease: monitoring/kube-prometheus-stack Deployment: monitoring/kube-prometheus-stack-kube-state-metrics

@@ -20,17 +20,17 @@

   strategy:
     type: RollingUpdate
   revisionHistoryLimit: 10
   template:
     metadata:
       labels:
+        app.kubernetes.io/component: metrics
+        app.kubernetes.io/instance: kube-prometheus-stack
         app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/component: metrics
+        app.kubernetes.io/name: kube-state-metrics
         app.kubernetes.io/part-of: kube-state-metrics
-        app.kubernetes.io/name: kube-state-metrics
-        app.kubernetes.io/instance: kube-prometheus-stack
         release: kube-prometheus-stack
     spec:
       automountServiceAccountToken: true
       hostNetwork: false
       serviceAccountName: kube-prometheus-stack-kube-state-metrics
       securityContext:
@@ -45,13 +45,13 @@

       - name: kube-state-metrics
         args:
         - --port=8080
         - --resources=certificatesigningrequests,configmaps,cronjobs,daemonsets,deployments,endpointslices,horizontalpodautoscalers,ingresses,jobs,leases,limitranges,mutatingwebhookconfigurations,namespaces,networkpolicies,nodes,persistentvolumeclaims,persistentvolumes,poddisruptionbudgets,pods,replicasets,replicationcontrollers,resourcequotas,secrets,services,statefulsets,storageclasses,validatingwebhookconfigurations,volumeattachments
         - --metric-labels-allowlist=persistentvolumeclaims=[*]
         imagePullPolicy: IfNotPresent
-        image: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1
+        image: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0
         ports:
         - containerPort: 8080
           name: http
         - containerPort: 8081
           name: metrics
         livenessProbe:
--- HelmRelease: monitoring/kube-prometheus-stack Deployment: monitoring/kube-prometheus-stack-operator

+++ HelmRelease: monitoring/kube-prometheus-stack Deployment: monitoring/kube-prometheus-stack-operator

@@ -31,26 +31,26 @@

         app: kube-prometheus-stack-operator
         app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
         app.kubernetes.io/component: prometheus-operator
     spec:
       containers:
       - name: kube-prometheus-stack
-        image: quay.io/prometheus-operator/prometheus-operator:v0.93.0
+        image: quay.io/prometheus-operator/prometheus-operator:v0.94.1
         imagePullPolicy: IfNotPresent
         args:
         - --kubelet-service=kube-system/kube-prometheus-stack-kubelet
         - --kubelet-endpoints=true
         - --kubelet-endpointslice=false
         - --localhost=127.0.0.1
-        - --prometheus-config-reloader=quay.io/prometheus-operator/prometheus-config-reloader:v0.93.0
+        - --prometheus-config-reloader=quay.io/prometheus-operator/prometheus-config-reloader:v0.94.1
         - --config-reloader-cpu-request=5m
         - --config-reloader-cpu-limit=0
         - --config-reloader-memory-request=32M
         - --config-reloader-memory-limit=32M
         - --thanos-default-base-image=quay.io/thanos/thanos:v0.42.4
-        - --secret-field-selector=type!=kubernetes.io/dockercfg,type!=kubernetes.io/service-account-token,type!=helm.sh/release.v1
+        - --secret-field-selector=type!=kubernetes.io/dockercfg,type!=helm.sh/release.v1
         - --web.enable-tls=true
         - --web.cert-file=/cert/cert
         - --web.key-file=/cert/key
         - --web.listen-address=:10250
         - --web.tls-min-version=VersionTLS13
         ports:
--- HelmRelease: monitoring/kube-prometheus-stack Prometheus: monitoring/kube-prometheus-stack-prometheus

+++ HelmRelease: monitoring/kube-prometheus-stack Prometheus: monitoring/kube-prometheus-stack-prometheus

@@ -16,15 +16,15 @@

   alerting:
     alertmanagers:
     - apiVersion: v2
       name: alertmanager
       namespace: monitoring
       port: 9093
-  image: quay.io/prometheus/prometheus:v3.13.2-distroless
+  image: quay.io/prometheus/prometheus:v3.15.0-distroless
   imagePullPolicy: IfNotPresent
-  version: v3.13.2-distroless
+  version: v3.15.0-distroless
   externalLabels:
     cluster: subterra
   replicaExternalLabelName: __replica__
   externalUrl: http://prometheus.ur30.ru/
   paused: false
   replicas: 1
--- HelmRelease: monitoring/kube-prometheus-stack PrometheusRule: monitoring/kube-prometheus-stack-kube-apiserver-burnrate.rules

+++ HelmRelease: monitoring/kube-prometheus-stack PrometheusRule: monitoring/kube-prometheus-stack-kube-apiserver-burnrate.rules

@@ -16,304 +16,242 @@

   - name: kube-apiserver-burnrate.rules
     rules:
     - expr: |-
         (
           (
             # too slow
-            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[1d]))
-            -
-            (
-              (
-                sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[1d]))
-                or
-                vector(0)
-              )
-              +
-              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[1d]))
-              +
-              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[1d]))
-            )
-          )
-          +
-          # errors
-          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[1d]))
-        )
-        /
-        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET"}[1d]))
-      labels:
-        verb: read
+            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[5m]))
+            -
+            (
+              (
+                sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[5m]))
+                or
+                vector(0)
+              )
+              +
+              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[5m]))
+              +
+              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[5m]))
+            )
+          )
+          +
+          # errors
+          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[5m]))
+        )
+      labels:
+        verb: read
+      record: cluster_verb:apiserver_request_sli_bad_events:rate5m
+    - expr: |-
+        (
+          (
+            # too slow
+            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[5m]))
+            -
+            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[5m]))
+          )
+          +
+          # errors
+          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[5m]))
+        )
+      labels:
+        verb: write
+      record: cluster_verb:apiserver_request_sli_bad_events:rate5m
+    - expr: sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET"}[5m]))
+      labels:
+        verb: read
+      record: cluster_verb:apiserver_request_sli_events:rate5m
+    - expr: sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[5m]))
+      labels:
+        verb: write
+      record: cluster_verb:apiserver_request_sli_events:rate5m
+    - expr: |-
+        cluster_verb:apiserver_request_sli_bad_events:rate5m
+        /
+        cluster_verb:apiserver_request_sli_events:rate5m
+      record: apiserver_request:burnrate5m
+    - expr: |-
+        (
+          (
+            # too slow
+            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[1h]))
+            -
+            (
+              (
+                sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[1h]))
+                or
+                vector(0)
+              )
+              +
+              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[1h]))
+              +
+              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[1h]))
+            )
+          )
+          +
+          # errors
+          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[1h]))
+        )
+        /
+        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET"}[1h]))
+      labels:
+        verb: read
+      record: apiserver_request:burnrate1h
+    - expr: |-
+        (
+          (
+            # too slow
+            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[1h]))
+            -
+            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[1h]))
+          )
+          +
+          # errors
+          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[1h]))
+        )
+        /
+        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[1h]))
+      labels:
+        verb: write
+      record: apiserver_request:burnrate1h
+    - expr: |-
+        (
+          (
+            # too slow
+            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[2h]))
+            -
+            (
+              (
+                sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[2h]))
+                or
+                vector(0)
+              )
+              +
+              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[2h]))
+              +
+              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[2h]))
+            )
+          )
+          +
+          # errors
+          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[2h]))
+        )
+        /
+        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET"}[2h]))
+      labels:
+        verb: read
+      record: apiserver_request:burnrate2h
+    - expr: |-
+        (
+          (
+            # too slow
+            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[2h]))
+            -
+            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[2h]))
+          )
+          +
+          # errors
+          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[2h]))
+        )
+        /
+        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[2h]))
+      labels:
+        verb: write
+      record: apiserver_request:burnrate2h
+    - expr: |-
+        (
+          (
+            # too slow
+            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[30m]))
+            -
+            (
+              (
+                sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[30m]))
+                or
+                vector(0)
+              )
+              +
+              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[30m]))
+              +
+              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[30m]))
+            )
+          )
+          +
+          # errors
+          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[30m]))
+        )
+        /
+        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET"}[30m]))
+      labels:
+        verb: read
+      record: apiserver_request:burnrate30m
+    - expr: |-
+        (
+          (
+            # too slow
[Diff truncated by flux-local]
--- HelmRelease: monitoring/kube-prometheus-stack PrometheusRule: monitoring/kube-prometheus-stack-kubernetes-apps

+++ HelmRelease: monitoring/kube-prometheus-stack PrometheusRule: monitoring/kube-prometheus-stack-kubernetes-apps

@@ -239,12 +239,14 @@

         runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubejobnotcompleted
         summary: Job did not complete in time
       expr: |-
         time() - max by (namespace, job_name, cluster) (kube_job_status_start_time{job="kube-state-metrics", namespace=~".*"}
           and
         kube_job_status_active{job="kube-state-metrics", namespace=~".*"} > 0) > 43200
+          unless on (namespace, job_name, cluster)
+        max by (namespace, job_name, cluster) (kube_job_labels{job="kube-state-metrics", namespace=~".*",label_excluded_from_alerts="true"} == 1)
       labels:
         severity: warning
     - alert: KubeJobFailed
       annotations:
         description: Job {{ $labels.namespace }}/{{ $labels.job_name }} failed to
           complete. Removing failed job after investigation should clear this alert
@@ -311,10 +313,13 @@

         (
           kube_poddisruptionbudget_status_desired_healthy{job="kube-state-metrics", namespace=~".*"}
           -
           kube_poddisruptionbudget_status_current_healthy{job="kube-state-metrics", namespace=~".*"}
         )
         > 0
+        and
+        kube_poddisruptionbudget_status_expected_pods{job="kube-state-metrics", namespace=~".*"}
+        > 0
       for: 15m
       labels:
         severity: warning
 
--- HelmRelease: monitoring/kube-prometheus-stack ServiceMonitor: monitoring/kube-prometheus-stack-coredns

+++ HelmRelease: monitoring/kube-prometheus-stack ServiceMonitor: monitoring/kube-prometheus-stack-coredns

@@ -19,8 +19,12 @@

       release: kube-prometheus-stack
   namespaceSelector:
     matchNames:
     - kube-system
   endpoints:
   - port: http-metrics
-    bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+    authorization:
+      credentials:
+        key: token
+        name: kube-prometheus-stack-prometheus-token
+      type: Bearer
 
--- HelmRelease: monitoring/kube-prometheus-stack ServiceMonitor: monitoring/kube-prometheus-stack-apiserver

+++ HelmRelease: monitoring/kube-prometheus-stack ServiceMonitor: monitoring/kube-prometheus-stack-apiserver

@@ -10,15 +10,19 @@

     app.kubernetes.io/instance: kube-prometheus-stack
     app.kubernetes.io/part-of: kube-prometheus-stack
     release: kube-prometheus-stack
     heritage: Helm
 spec:
   endpoints:
-  - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
-    port: https
+  - port: https
     scheme: https
+    authorization:
+      credentials:
+        key: token
+        name: kube-prometheus-stack-prometheus-token
+      type: Bearer
     metricRelabelings:
     - action: keep
       regex: (aggregator_openapi|aggregator_unavailable|apiextensions_openapi|apiserver_admission|apiserver_audit|apiserver_cache|apiserver_cel|apiserver_client|apiserver_crd|apiserver_current|apiserver_envelope|apiserver_flowcontrol|apiserver_init|apiserver_kube|apiserver_longrunning|apiserver_request|apiserver_requested|apiserver_response|apiserver_selfrequest|apiserver_storage|apiserver_terminated|apiserver_tls|apiserver_watch|apiserver_webhooks|authenticated_user|authentication|disabled_metric|etcd_bookmark|etcd_lease|etcd_request|field_validation|get_token|go|grpc_client|hidden_metric|kube_apiserver|kubernetes_build|kubernetes_feature|node_authorizer|pod_security|process_cpu|process_max|process_open|process_resident|process_start|process_virtual|registered_metric|rest_client|scrape_duration|scrape_samples|scrape_series|serviceaccount_legacy|serviceaccount_stale|serviceaccount_valid|watch_cache|workqueue)_(.+)
       sourceLabels:
       - __name__
     - action: drop
@@ -27,15 +31,18 @@

       - __name__
     - action: drop
       regex: (apiserver_response_sizes_bucket|apiserver_watch_events_sizes_bucket)
       sourceLabels:
       - __name__
     tlsConfig:
-      caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+      ca:
+        configMap:
+          key: ca.crt
+          name: kube-root-ca.crt
+      insecureSkipVerify: false
       serverName: kubernetes
-      insecureSkipVerify: false
   jobLabel: component
   namespaceSelector:
     matchNames:
     - default
   selector:
     matchLabels:
--- HelmRelease: monitoring/kube-prometheus-stack ServiceMonitor: monitoring/kube-prometheus-stack-kube-etcd

+++ HelmRelease: monitoring/kube-prometheus-stack ServiceMonitor: monitoring/kube-prometheus-stack-kube-etcd

@@ -19,8 +19,12 @@

       release: kube-prometheus-stack
   namespaceSelector:
     matchNames:
     - kube-system
   endpoints:
   - port: http-metrics
-    bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+    authorization:
+      credentials:
+        key: token
+        name: kube-prometheus-stack-prometheus-token
+      type: Bearer
 
--- HelmRelease: monitoring/kube-prometheus-stack ServiceMonitor: monitoring/kube-prometheus-stack-kubelet

+++ HelmRelease: monitoring/kube-prometheus-stack ServiceMonitor: monitoring/kube-prometheus-stack-kubelet

@@ -23,15 +23,22 @@

       app.kubernetes.io/name: kubelet
       k8s-app: kubelet
   endpoints:
   - port: https-metrics
     scheme: https
     tlsConfig:
-      caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+      ca:
+        configMap:
+          key: ca.crt
+          name: kube-root-ca.crt
       insecureSkipVerify: true
-    bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+    authorization:
+      credentials:
+        key: token
+        name: kube-prometheus-stack-prometheus-token
+      type: Bearer
     honorLabels: true
     honorTimestamps: true
     metricRelabelings:
     - action: keep
       regex: (apiserver_audit|apiserver_client|apiserver_delegated|apiserver_envelope|apiserver_storage|apiserver_webhooks|authentication_token|cadvisor_version|container_blkio|container_cpu|container_fs|container_last|container_memory|container_network|container_oom|container_processes|container|csi_operations|disabled_metric|get_token|go|hidden_metric|kubelet_certificate|kubelet_cgroup|kubelet_container|kubelet_containers|kubelet_cpu|kubelet_device|kubelet_graceful|kubelet_http|kubelet_lifecycle|kubelet_managed|kubelet_node|kubelet_pleg|kubelet_pod|kubelet_run|kubelet_running|kubelet_runtime|kubelet_server|kubelet_started|kubelet_volume|kubernetes_build|kubernetes_feature|machine_cpu|machine_memory|machine_nvm|machine_scrape|node_namespace|plugin_manager|prober_probe|process_cpu|process_max|process_open|process_resident|process_start|process_virtual|registered_metric|rest_client|scrape_duration|scrape_samples|scrape_series|storage_operation|volume_manager|volume_operation|workqueue)_(.+)
       sourceLabels:
@@ -50,15 +57,22 @@

     path: /metrics/cadvisor
     interval: 10s
     honorLabels: true
     honorTimestamps: true
     trackTimestampsStaleness: true
     tlsConfig:
-      caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+      ca:
+        configMap:
+          key: ca.crt
+          name: kube-root-ca.crt
       insecureSkipVerify: true
-    bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+    authorization:
+      credentials:
+        key: token
+        name: kube-prometheus-stack-prometheus-token
+      type: Bearer
     metricRelabelings:
     - action: drop
       regex: container_cpu_(cfs_throttled_seconds_total|load_average_10s|system_seconds_total|user_seconds_total)
       sourceLabels:
       - __name__
     - action: drop
@@ -100,15 +114,22 @@

   - port: https-metrics
     scheme: https
     path: /metrics/probes
     honorLabels: true
     honorTimestamps: true
     tlsConfig:
-      caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+      ca:
+        configMap:
+          key: ca.crt
+          name: kube-root-ca.crt
       insecureSkipVerify: true
-    bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+    authorization:
+      credentials:
+        key: token
+        name: kube-prometheus-stack-prometheus-token
+      type: Bearer
     relabelings:
     - action: replace
       sourceLabels:
       - __metrics_path__
       targetLabel: metrics_path
 
--- HelmRelease: monitoring/kube-prometheus-stack Job: monitoring/kube-prometheus-stack-admission-create

+++ HelmRelease: monitoring/kube-prometheus-stack Job: monitoring/kube-prometheus-stack-admission-create

@@ -30,13 +30,13 @@

         heritage: Helm
         app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
         app.kubernetes.io/component: prometheus-operator-webhook
     spec:
       containers:
       - name: create
-        image: ghcr.io/jkroepke/kube-webhook-certgen:1.8.5
+        image: ghcr.io/jkroepke/kube-webhook-certgen:1.8.9
         imagePullPolicy: IfNotPresent
         args:
         - create
         - --host=kube-prometheus-stack-operator,kube-prometheus-stack-operator.monitoring.svc
         - --namespace=monitoring
         - --secret-name=kube-prometheus-stack-admission
--- HelmRelease: monitoring/kube-prometheus-stack Job: monitoring/kube-prometheus-stack-admission-patch

+++ HelmRelease: monitoring/kube-prometheus-stack Job: monitoring/kube-prometheus-stack-admission-patch

@@ -30,13 +30,13 @@

         heritage: Helm
         app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
         app.kubernetes.io/component: prometheus-operator-webhook
     spec:
       containers:
       - name: patch
-        image: ghcr.io/jkroepke/kube-webhook-certgen:1.8.5
+        image: ghcr.io/jkroepke/kube-webhook-certgen:1.8.9
         imagePullPolicy: IfNotPresent
         args:
         - patch
         - --webhook-name=kube-prometheus-stack-admission
         - --namespace=monitoring
         - --secret-name=kube-prometheus-stack-admission

@mglants-bot

mglants-bot Bot commented Sep 13, 2026 •

Copy link
Copy Markdown
--- kubernetes/subterra/apps/monitoring/kube-prometheus-stack/app Kustomization: flux-system/cluster-apps-kube-prometheus-stack HelmRelease: monitoring/kube-prometheus-stack

+++ kubernetes/subterra/apps/monitoring/kube-prometheus-stack/app Kustomization: flux-system/cluster-apps-kube-prometheus-stack HelmRelease: monitoring/kube-prometheus-stack

@@ -13,13 +13,13 @@

       chart: kube-prometheus-stack
       interval: 5m
       sourceRef:
         kind: HelmRepository
         name: prometheus-community-charts
         namespace: flux-system
-      version: 88.3.0
+      version: 91.8.1
   install:
     crds: CreateReplace
   interval: 5m
   postRenderers:
   - kustomize:
       patches:

@renovate renovate Bot changed the title feat(helm)!: Update chart kube-prometheus-stack ( 88.3.0 → 91.0.0 ) feat(helm)!: Update chart kube-prometheus-stack ( 88.3.0 → 91.2.0 ) Sep 13, 2026
@renovate
renovate Bot force-pushed the renovate/kube-prometheus-stack-91.x branch 2 times, most recently from ed86a17 to b840970 Compare September 14, 2026 01:28
@renovate renovate Bot changed the title feat(helm)!: Update chart kube-prometheus-stack ( 88.3.0 → 91.2.0 ) feat(helm)!: Update chart kube-prometheus-stack ( 88.3.0 → 91.2.1 ) Sep 14, 2026
@renovate
renovate Bot force-pushed the renovate/kube-prometheus-stack-91.x branch from b840970 to 1246ee6 Compare September 14, 2026 06:33
@renovate renovate Bot changed the title feat(helm)!: Update chart kube-prometheus-stack ( 88.3.0 → 91.2.1 ) feat(helm)!: Update chart kube-prometheus-stack ( 88.3.0 → 91.2.2 ) Sep 14, 2026
@renovate
renovate Bot force-pushed the renovate/kube-prometheus-stack-91.x branch from 1246ee6 to 04ce704 Compare September 14, 2026 08:39
@renovate renovate Bot changed the title feat(helm)!: Update chart kube-prometheus-stack ( 88.3.0 → 91.2.2 ) feat(helm)!: Update chart kube-prometheus-stack ( 88.3.0 → 91.2.3 ) Sep 14, 2026
@renovate
renovate Bot force-pushed the renovate/kube-prometheus-stack-91.x branch from 04ce704 to 9b40450 Compare September 14, 2026 16:53
@renovate renovate Bot changed the title feat(helm)!: Update chart kube-prometheus-stack ( 88.3.0 → 91.2.3 ) feat(helm)!: Update chart kube-prometheus-stack ( 88.3.0 → 91.3.0 ) Sep 14, 2026
@renovate renovate Bot changed the title feat(helm)!: Update chart kube-prometheus-stack ( 88.3.0 → 91.3.0 ) feat(helm)!: Update chart kube-prometheus-stack ( 88.3.0 → 91.4.0 ) Sep 14, 2026
@renovate
renovate Bot force-pushed the renovate/kube-prometheus-stack-91.x branch 2 times, most recently from 0b42e28 to 5c0b784 Compare September 16, 2026 06:06
@renovate renovate Bot changed the title feat(helm)!: Update chart kube-prometheus-stack ( 88.3.0 → 91.4.0 ) feat(helm)!: Update chart kube-prometheus-stack ( 88.3.0 → 91.4.1 ) Sep 16, 2026
@renovate
renovate Bot force-pushed the renovate/kube-prometheus-stack-91.x branch from 5c0b784 to 6a4866e Compare September 26, 2026 02:29
@renovate renovate Bot changed the title feat(helm)!: Update chart kube-prometheus-stack ( 88.3.0 → 91.4.1 ) feat(helm)!: Update chart kube-prometheus-stack ( 88.3.0 → 91.5.3 ) Sep 26, 2026
@renovate
renovate Bot force-pushed the renovate/kube-prometheus-stack-91.x branch from 6a4866e to b2db12c Compare September 26, 2026 11:19
@renovate renovate Bot changed the title feat(helm)!: Update chart kube-prometheus-stack ( 88.3.0 → 91.5.3 ) feat(helm)!: Update chart kube-prometheus-stack ( 88.3.0 → 91.7.0 ) Sep 26, 2026
@renovate
renovate Bot force-pushed the renovate/kube-prometheus-stack-91.x branch from b2db12c to 6e95c01 Compare September 27, 2026 13:04
@renovate renovate Bot changed the title feat(helm)!: Update chart kube-prometheus-stack ( 88.3.0 → 91.7.0 ) feat(helm)!: Update chart kube-prometheus-stack ( 88.3.0 → 91.7.1 ) Sep 27, 2026
@renovate
renovate Bot force-pushed the renovate/kube-prometheus-stack-91.x branch from 6e95c01 to 705630f Compare September 27, 2026 21:32
@renovate renovate Bot changed the title feat(helm)!: Update chart kube-prometheus-stack ( 88.3.0 → 91.7.1 ) feat(helm)!: Update chart kube-prometheus-stack ( 88.3.0 → 91.8.0 ) Sep 27, 2026
| datasource | package               | from   | to     |
| ---------- | --------------------- | ------ | ------ |
| helm       | kube-prometheus-stack | 88.3.0 | 91.8.1 |
@renovate
renovate Bot force-pushed the renovate/kube-prometheus-stack-91.x branch from 705630f to a8e17e4 Compare September 28, 2026 23:56
@renovate renovate Bot changed the title feat(helm)!: Update chart kube-prometheus-stack ( 88.3.0 → 91.8.0 ) feat(helm)!: Update chart kube-prometheus-stack ( 88.3.0 → 91.8.1 ) Sep 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants