linode · merll · May 8, 2026 · May 7, 2026 · May 7, 2026 · May 8, 2026
@@ -1,7 +1,7 @@
 appsInfo:
   alertmanager:
     title: Alertmanager
-    appVersion: 0.32.0
+    appVersion: 0.32.1
     repo: https://github.com/prometheus/alertmanager
     maintainers: Prometheus Community
     relatedLinks:
@@ -65,7 +65,7 @@ appsInfo:
     integration: App Platform uses Gitea as its default repository for App Platform configuration (values). Gitea can also be used by Teams to provide application code repositories. Access to Gitea is provided by the OIDC integration in App Platform. Members of the otomi-admin and team-admin group can seamlessly sign in to Gitea. When Argo CD is enabled, App Platform will automatically create a Gitops repository for each Team in Gitea.
   grafana:
     title: Grafana
-    appVersion: 12.4.3
+    appVersion: 13.0.1
     repo: https://github.com/grafana/grafana
     maintainers: Grafana Labs
     relatedLinks:
@@ -185,7 +185,7 @@ appsInfo:
     integration: Loki can be activated to aggregate all the container logs on the platform and store them in a storage endpoint of choice (defaults to PVC). When App Platform is configured in multi-tenancy mode, logs will be split-up between team namespaces and made available for team members only. App Platform shortcuts can be used to provide selections of logs based on interest.
   prometheus:
     title: Prometheus
-    appVersion: 3.11.2
+    appVersion: 3.11.3
     repo: https://github.com/prometheus/prometheus
     maintainers: Prometheus
     relatedLinks:

@@ -68,7 +68,7 @@ dependencies:
     version: v0.16.0
     repository: oci://ghcr.io/kserve/charts/kserve
   - name: kube-prometheus-stack
-    version: 83.7.0
+    version: 84.5.0
     repository: https://prometheus-community.github.io/helm-charts
   - name: kyverno
     version: 3.7.2

@@ -4,15 +4,15 @@ dependencies:
   version: 0.0.0
 - name: kube-state-metrics
   repository: https://prometheus-community.github.io/helm-charts
-  version: 7.2.2
+  version: 7.3.0
 - name: prometheus-node-exporter
   repository: https://prometheus-community.github.io/helm-charts
-  version: 4.53.1
+  version: 4.55.0
 - name: grafana
   repository: https://grafana-community.github.io/helm-charts
-  version: 11.6.1
+  version: 12.3.0
 - name: prometheus-windows-exporter
   repository: https://prometheus-community.github.io/helm-charts
   version: 0.12.6
-digest: sha256:e21304bc9748d1449437449b6e8819afeed2f1f68c473efb775f712790bdff40
-generated: "2026-04-21T14:07:57.575448317Z"
+digest: sha256:0858adf3673fb8d9530ce76ab1248795804721daa770bf77c32582e5a99cd7c8
+generated: "2026-05-01T17:58:51.49109567Z"
@@ -18,15 +18,15 @@ dependencies:
 - condition: kubeStateMetrics.enabled
   name: kube-state-metrics
   repository: https://prometheus-community.github.io/helm-charts
-  version: 7.2.2
+  version: 7.3.0
 - condition: nodeExporter.enabled
   name: prometheus-node-exporter
   repository: https://prometheus-community.github.io/helm-charts
-  version: 4.53.1
+  version: 4.55.0
 - condition: grafana.enabled
   name: grafana
   repository: https://grafana-community.github.io/helm-charts
-  version: 11.6.1
+  version: 12.3.0
 - condition: windowsMonitoring.enabled
   name: prometheus-windows-exporter
   repository: https://prometheus-community.github.io/helm-charts
@@ -69,4 +69,4 @@ sources:
 - https://github.com/prometheus-community/helm-charts
 - https://github.com/prometheus-operator/kube-prometheus
 type: application
-version: 83.7.0
+version: 84.5.0
@@ -6,7 +6,7 @@ annotations:
     - name: Upstream Project
       url: https://github.com/grafana/grafana
 apiVersion: v2
-appVersion: 12.4.3
+appVersion: 13.0.1
 description: The leading tool for querying and visualizing time series and metrics.
 home: https://grafana.com
 icon: https://artifacthub.io/image/b4fed1a7-6c8f-4945-b99d-096efa3e4116
@@ -26,4 +26,4 @@ sources:
 - https://github.com/grafana/grafana
 - https://github.com/grafana-community/helm-charts
 type: application
-version: 11.6.1
+version: 12.3.0
@@ -80,6 +80,10 @@ This ensures the expressions are preserved for Alertmanager instead of being ren
 
 The minimum required Kubernetes version is now 1.25. All references to deprecated APIs have been removed.
 
+### To 12.0.0
+
+Grafana 13 is configured by default. Grafana 13 explicit requires an image renderer token, which will be generated by the chart if not provided.
+
 ## Configuration
 
 ### Example ingress with path

@@ -111,6 +111,19 @@ app.kubernetes.io/name: {{ include "grafana.name" . }}-image-renderer
 app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end }}
 
+{{/*
+Looks if there's an existing secret and reuse its password. If not it generates
+new password and use it.
+*/}}
+{{- define "grafana.imageRenderer.token" -}}
+{{- $secret := (lookup "v1" "Secret" (include "grafana.namespace" .) (printf "%s-image-renderer" (include "grafana.imageRenderer.fullname" .)) ) }}
+{{- if $secret }}
+{{- index $secret "data" "token" }}
+{{- else }}
+{{- (randAlphaNum 40) | b64enc | quote }}
+{{- end }}
+{{- end }}
+
 {{/*
 Looks if there's an existing secret and reuse its password. If not it generates
 new password and use it.
@@ -152,8 +165,8 @@ Formats imagePullSecrets. Input is (dict "root" . "imagePullSecrets" .{specific
 
 
 {{/*
- Checks whether or not the configSecret secret has to be created
- */}}
+  Checks whether or not the configSecret secret has to be created
+*/}}
 {{- define "grafana.shouldCreateConfigSecret" -}}
 {{- $secretFound := false -}}
 {{- range $key, $value := .Values.datasources }}
@@ -226,12 +239,12 @@ sensitiveKeys:
 {{- end -}}
 
 {{/*
- Sidecars health port
- */}}
+  Sidecars health port
+*/}}
 
 {{/*
- Give health port for alerts sidecar
- */}}
+  Give health port for alerts sidecar
+*/}}
 {{- define "grafana.sidecar.alerts.healthPort" -}}
 {{- $healthPort := 8081 -}}
 {{- if hasKey .Values.sidecar.alerts "startupProbe" -}}
@@ -245,8 +258,8 @@ sensitiveKeys:
 {{- end -}}
 
 {{/*
- Give health port for datasources sidecar
- */}}
+  Give health port for datasources sidecar
+*/}}
 {{- define "grafana.sidecar.datasources.healthPort" -}}
 {{- $healthPort := 8082 -}}
 {{- if hasKey .Values.sidecar.datasources "startupProbe" -}}
@@ -260,8 +273,8 @@ sensitiveKeys:
 {{- end -}}
 
 {{/*
- Give health port for notifiers sidecar
- */}}
+  Give health port for notifiers sidecar
+*/}}
 {{- define "grafana.sidecar.notifiers.healthPort" -}}
 {{- $healthPort := 8083 -}}
 {{- if hasKey .Values.sidecar.notifiers "startupProbe" -}}
@@ -275,8 +288,8 @@ sensitiveKeys:
 {{- end -}}
 
 {{/*
- Give health port for dashboards sidecar
- */}}
+  Give health port for dashboards sidecar
+*/}}
 {{- define "grafana.sidecar.dashboards.healthPort" -}}
 {{- $healthPort := 8084 -}}
 {{- if hasKey .Values.sidecar.dashboards "startupProbe" -}}

@@ -1386,6 +1386,10 @@ containers:
       - name: {{ .name }}
         mountPath: {{ .mountPath }}
       {{- end }}
+      {{- if .Values.shadowBundledPlugins }}
+      - name: shadow-bundled-plugins
+        mountPath: /usr/share/grafana/data/plugins-bundled
+      {{- end }}
     ports:
       - name: {{ .Values.podPortName }}
         containerPort: {{ .Values.service.targetPort }}
@@ -1450,6 +1454,11 @@ containers:
         {{- else }}
         value: {{ .Values.imageRenderer.grafanaProtocol }}://{{ include "grafana.fullname" . }}.{{ include "grafana.namespace" . }}:{{ .Values.service.port }}/{{ .Values.imageRenderer.grafanaSubPath }}
         {{- end }}
+      - name: GF_RENDERING_RENDERER_TOKEN
+        valueFrom:
+          secretKeyRef:
+            name: {{ .Values.imageRenderer.existingSecret | default (printf "%s-image-renderer" (include "grafana.imageRenderer.fullname" .)) }}
+            key: token
       {{- end }}
       - name: GF_PATHS_DATA
         value: {{ (get .Values "grafana.ini").paths.data }}
@@ -1715,6 +1724,10 @@ volumes:
   - name: {{ .name }}
     emptyDir: {}
   {{- end }}
+  {{- if .Values.shadowBundledPlugins }}
+  - name: shadow-bundled-plugins
+    emptyDir: {}
+  {{- end }}
   {{- with .Values.extraContainerVolumes }}
   {{- tpl (toYaml .) $root | nindent 2 }}
   {{- end }}

@@ -25,6 +25,9 @@ spec:
   strategy:
     {{- toYaml . | trim | nindent 4 }}
   {{- end }}
+  {{- with .Values.progressDeadlineSeconds }}
+  progressDeadlineSeconds: {{ . }}
+  {{- end }}
   template:
     metadata:
       labels:

@@ -27,6 +27,9 @@ spec:
   strategy:
     {{- toYaml . | trim | nindent 4 }}
   {{- end }}
+  {{- with .Values.imageRenderer.progressDeadlineSeconds }}
+  progressDeadlineSeconds: {{ . }}
+  {{- end }}
   template:
     metadata:
       labels:
@@ -91,6 +94,13 @@ spec:
           env:
             - name: HTTP_PORT
               value: {{ .Values.imageRenderer.service.targetPort | quote }}
+          {{- if .Values.imageRenderer.service.enabled }}
+            - name: AUTH_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.imageRenderer.existingSecret | default (printf "%s-image-renderer" (include "grafana.imageRenderer.fullname" .)) }}
+                  key: token
+          {{- end }}
           {{- if .Values.imageRenderer.serviceMonitor.enabled }}
             - name: ENABLE_METRICS
               value: "true"

@@ -0,0 +1,22 @@
+{{- if and .Values.imageRenderer.enabled .Values.imageRenderer.service.enabled (not .Values.imageRenderer.existingSecret) }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "grafana.imageRenderer.fullname" . }}-image-renderer
+  namespace: {{ include "grafana.namespace" . }}
+  labels:
+    {{- include "grafana.imageRenderer.labels" . | nindent 4 }}
+    {{- with .Values.imageRenderer.service.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- with .Values.imageRenderer.service.annotations }}
+  annotations:
+    {{- tpl (toYaml . | nindent 4) $ }}
+  {{- end }}
+data:
+  {{- if .Values.imageRenderer.token }}
+  token: {{ .Values.imageRenderer.token | b64enc | quote }}
+  {{- else }}
+  token: {{ include "grafana.imageRenderer.token" . }}
+  {{- end }}
+{{- end }}
@@ -77,6 +77,10 @@ podDisruptionBudget: {}
 deploymentStrategy:
   type: RollingUpdate
 
+## The maximum time in seconds for a Deployment to make progress before it is considered to be failed.
+## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#progress-deadline-seconds
+progressDeadlineSeconds: null
+
 readinessProbe:
   httpGet:
     path: /api/health
@@ -179,6 +183,14 @@ extraEmptyDirMounts: []
   # - name: provisioning-notifiers
   #   mountPath: /etc/grafana/provisioning/notifiers
 
+# Shadow `/usr/share/grafana/data/plugins-bundled` with an emptyDir so plugins
+# listed under `plugins:` install cleanly into `/var/lib/grafana/plugins` instead
+# of failing on the read-only bundled directory shipped in the Grafana image.
+# Required for plugins moved out of core in Grafana 13 (e.g. `elasticsearch`,
+# `cloudwatch`) when listed in `plugins:`. Side effect: any bundled plugin not
+# explicitly listed in `plugins:` will not be available.
+shadowBundledPlugins: false
+
 
 # Apply extra labels to common labels.
 extraLabels: {}
@@ -190,7 +202,7 @@ downloadDashboardsImage:
   # -- The Docker registry
   registry: docker.io
   repository: curlimages/curl
-  tag: 8.19.0
+  tag: 8.20.0
   sha: ""
   pullPolicy: IfNotPresent
 
@@ -979,7 +991,7 @@ sidecar:
     # -- The Docker registry
     registry: quay.io
     repository: kiwigrid/k8s-sidecar
-    tag: 2.6.0
+    tag: 2.7.1
     sha: ""
   imagePullPolicy: IfNotPresent
   resources: {}
@@ -1460,6 +1472,10 @@ revisionHistoryLimit: 10
 ## Add a separate remote image renderer deployment/service
 imageRenderer:
   deploymentStrategy: {}
+  ## The maximum time in seconds for the image renderer Deployment to make progress before it is
+  ## considered to be failed.
+  ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#progress-deadline-seconds
+  progressDeadlineSeconds: null
   # Enable the image-renderer deployment & service
   enabled: false
   replicas: 1
@@ -1474,6 +1490,10 @@ imageRenderer:
   serverURL: ""
   # The callback url of grafana instances if it is not in the same namespace with the remote image renderer
   renderingCallbackURL: ""
+  # Token used for authentication between Grafana and the remote image renderer.
+  token: ""
+  # Use an existing secret for the image renderer token. Must contain a key named "token".
+  existingSecret: ""
   image:
     # -- The Docker registry
     registry: docker.io

@@ -26,4 +26,4 @@ name: kube-state-metrics
 sources:
 - https://github.com/kubernetes/kube-state-metrics/
 type: application
-version: 7.2.2
+version: 7.3.0
@@ -106,7 +106,7 @@ kubeRBACProxy:
   image:
     registry: quay.io
     repository: brancz/kube-rbac-proxy
-    tag: v0.21.2
+    tag: v0.22.0
     sha: ""
     pullPolicy: IfNotPresent
 

@@ -26,4 +26,4 @@ name: prometheus-node-exporter
 sources:
 - https://github.com/prometheus/node_exporter/
 type: application
-version: 4.53.1
+version: 4.55.0