chore(container): update image ghcr.io/prometheus-community/charts/kube-prometheus-stack to v90 - autoclosed - #2616
Closed
daddy-ro[bot] wants to merge 1 commit into
Conversation
…be-prometheus-stack to v90
Contributor
Author
|
Caution
Warning
Note 1 resource changed across 1 app konflate 0.6.3 · rendered |
jfroy
added a commit
that referenced
this pull request
Sep 7, 2026
…token kube-prometheus-stack 90.0.0 drops `bearerTokenFile` from the control-plane ServiceMonitors (prometheus-operator rejects it under `arbitraryFSAccessThroughSMs.deny`, and Alloy silently drops those targets) and authenticates through `authorization` + a Secret instead. The chart creates that Secret itself only alongside its own Prometheus, which is disabled here, so `helm template` hard-fails on the bump in #2616. vmagent scrapes these targets, so point every enabled control-plane component at a long-lived token Secret for the `vmagent-kantai` ServiceAccount — the same identity the old `bearerTokenFile` resolved to. Lands ahead of the bump: 89.2.4 has no `serviceMonitor.authorization` value, so the only thing this changes on the current chart is creating the Secret. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XoBaidgnaAAUkvQRZCtVmC
jfroy
added a commit
that referenced
this pull request
Sep 7, 2026
kube-prometheus-stack 90.0.0 replaces `bearerTokenFile` on the control-plane ServiceMonitors with `authorization` pointing at a Secret. The chart creates that Secret only alongside its own Prometheus, which is disabled here, so the bump on its own fails to render. vmagent scrapes these targets, so point every enabled control-plane component at a long-lived token Secret for the `vmagent-kantai` ServiceAccount — the same identity the old `bearerTokenFile` resolved to. Supersedes #2616. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XoBaidgnaAAUkvQRZCtVmC
jfroy
added a commit
that referenced
this pull request
Sep 7, 2026
kube-prometheus-stack 90.0.0 replaces `bearerTokenFile` on the control-plane ServiceMonitors with `authorization` pointing at a Secret. The chart creates that Secret only alongside its own Prometheus, which is disabled here, so the bump on its own fails to render. vmagent scrapes these targets, so every control-plane component that still renders — coreDns, kubeApiServer, kubelet, kubeControllerManager, kubeEtcd, kubeScheduler — points its `serviceMonitor.authorization` at a token Secret for the `vmagent-kantai` ServiceAccount. That is the same identity the old `bearerTokenFile` resolved to, so scraping is unchanged. kubeProxy and kubeDns are disabled and never reach the template. The Secret is a `kubernetes.io/service-account-token` populated by the token controller from its annotation. A ServiceMonitor can only carry a credential by Secret reference, so vmagent's own projected token is not reachable from one; the trade is that this token is long-lived and does not expire. The Kustomization now depends on victoria-metrics, which is where the VictoriaMetrics operator creates the `vmagent-kantai` ServiceAccount. Without that ServiceAccount the token controller deletes the Secret rather than populating it. Supersedes #2616. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XoBaidgnaAAUkvQRZCtVmC
jfroy
added a commit
that referenced
this pull request
Sep 7, 2026
kube-prometheus-stack 90.0.0 replaces `bearerTokenFile` on the control-plane ServiceMonitors with `authorization` pointing at a Secret. The chart creates that Secret only alongside its own Prometheus, which is disabled here, so the bump on its own fails to render. vmagent scrapes these targets, so every control-plane component that still renders — coreDns, kubeApiServer, kubelet, kubeControllerManager, kubeEtcd, kubeScheduler — points its `serviceMonitor.authorization` at a token Secret for the `vmagent-kantai` ServiceAccount. That is the same identity the old `bearerTokenFile` resolved to, so scraping is unchanged. kubeProxy and kubeDns are disabled and never reach the template. The Secret is a `kubernetes.io/service-account-token` populated by the token controller from its annotation. A ServiceMonitor can only carry a credential by Secret reference, so vmagent's own projected token is not reachable from one; the trade is that this token is long-lived and does not expire. The Kustomization now depends on victoria-metrics, which is where the VictoriaMetrics operator creates the `vmagent-kantai` ServiceAccount. Without that ServiceAccount the token controller deletes the Secret rather than populating it. Supersedes #2616. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XoBaidgnaAAUkvQRZCtVmC
jfroy
added a commit
that referenced
this pull request
Sep 7, 2026
kube-prometheus-stack 90.0.0 replaces `bearerTokenFile` on the control-plane ServiceMonitors with `authorization` pointing at a Secret. The chart creates that Secret only alongside its own Prometheus, which is disabled here, so the bump on its own fails to render. vmagent scrapes these targets, so every control-plane component that still renders — coreDns, kubeApiServer, kubelet, kubeControllerManager, kubeEtcd, kubeScheduler — points its `serviceMonitor.authorization` at a token Secret for the `vmagent-kantai` ServiceAccount. That is the same identity the old `bearerTokenFile` resolved to, so scraping is unchanged. kubeProxy and kubeDns are disabled and never reach the template. The Secret is a `kubernetes.io/service-account-token` populated by the token controller from its annotation. A ServiceMonitor can only carry a credential by Secret reference, so vmagent's own projected token is not reachable from one; the trade is that this token is long-lived and does not expire. The Kustomization now depends on victoria-metrics, which is where the VictoriaMetrics operator creates the `vmagent-kantai` ServiceAccount. Without that ServiceAccount the token controller deletes the Secret rather than populating it. Supersedes #2616. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XoBaidgnaAAUkvQRZCtVmC
daddy-ro
Bot
changed the title
auto-merge was automatically disabled
September 7, 2026 23:50
Pull request was closed
daddy-ro
Bot
deleted the
renovate/ghcr.io-prometheus-community-charts-kube-prometheus-stack-90.x
branch
September 7, 2026 23:50
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
89.2.4→90.0.0Release Notes
prometheus-community/helm-charts (ghcr.io/prometheus-community/charts/kube-prometheus-stack)
v90.0.0kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.
What's Changed
New Contributors
Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-89.2.4...kube-prometheus-stack-90.0.0
Configuration
📅 Schedule: (in timezone America/Los_Angeles)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.