From 35fffd081d332b1a25fa23fb678cad1ad5d157c3 Mon Sep 17 00:00:00 2001
From: shashank-nand <nandennavar.shashank@gmail.com>
Date: Mon, 30 Oct 2023 12:52:43 +0530
Subject: [PATCH] updated servicemonitor

---
 .../grafana/ci/with-affinity-values.yaml      |  16 ++
 .../ci/with-extraconfigmapmounts-values.yaml  |   7 +
 .../ci/with-image-renderer-values.yaml        |  19 ++
 .../charts/grafana/ci/with-persistence.yaml   |   3 +
 .../grafana/templates/configSecret.yaml       |  43 ++++
 .../grafana/templates/extra-manifests.yaml    |   4 +
 .../charts/grafana/templates/hpa.yaml         |  52 +++++
 .../templates/image-renderer-deployment.yaml  | 131 +++++++++++
 .../grafana/templates/image-renderer-hpa.yaml |  47 ++++
 .../image-renderer-network-policy.yaml        |  79 +++++++
 .../templates/image-renderer-service.yaml     |  31 +++
 .../image-renderer-servicemonitor.yaml        |  48 ++++
 .../grafana/templates/networkpolicy.yaml      |  52 +++++
 .../grafana/templates/servicemonitor.yaml     |  52 +++++
 .../templates/ciliumnetworkpolicy.yaml        |  33 +++
 .../templates/crs-configmap.yaml              |  16 ++
 .../templates/extra-manifests.yaml            |   4 +
 .../templates/kubeconfig-secret.yaml          |  12 +
 .../templates/networkpolicy.yaml              |  43 ++++
 .../templates/rbac-configmap.yaml             |  22 ++
 .../kube-state-metrics/templates/role.yaml    | 212 ++++++++++++++++++
 .../templates/rolebinding.yaml                |  24 ++
 .../templates/verticalpodautoscaler.yaml      |  44 ++++
 .../ci/port-values.yaml                       |   3 +
 .../templates/clusterrole.yaml                |  19 ++
 .../templates/clusterrolebinding.yaml         |  20 ++
 .../templates/extra-manifests.yaml            |   4 +
 .../templates/networkpolicy.yaml              |  23 ++
 .../templates/podmonitor.yaml                 |  91 ++++++++
 .../templates/rbac-configmap.yaml             |  16 ++
 .../templates/servicemonitor.yaml             |  61 +++++
 .../templates/verticalpodautoscaler.yaml      |  40 ++++
 32 files changed, 1271 insertions(+)
 create mode 100644 kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/ci/with-affinity-values.yaml
 create mode 100644 kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/ci/with-extraconfigmapmounts-values.yaml
 create mode 100644 kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/ci/with-image-renderer-values.yaml
 create mode 100644 kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/ci/with-persistence.yaml
 create mode 100644 kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/templates/configSecret.yaml
 create mode 100644 kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/templates/extra-manifests.yaml
 create mode 100644 kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/templates/hpa.yaml
 create mode 100644 kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/templates/image-renderer-deployment.yaml
 create mode 100644 kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/templates/image-renderer-hpa.yaml
 create mode 100644 kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/templates/image-renderer-network-policy.yaml
 create mode 100644 kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/templates/image-renderer-service.yaml
 create mode 100644 kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/templates/image-renderer-servicemonitor.yaml
 create mode 100644 kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/templates/networkpolicy.yaml
 create mode 100644 kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/templates/servicemonitor.yaml
 create mode 100644 kubernetes/helm_charts/monitoring/prometheus-operator/charts/kube-state-metrics/templates/ciliumnetworkpolicy.yaml
 create mode 100644 kubernetes/helm_charts/monitoring/prometheus-operator/charts/kube-state-metrics/templates/crs-configmap.yaml
 create mode 100644 kubernetes/helm_charts/monitoring/prometheus-operator/charts/kube-state-metrics/templates/extra-manifests.yaml
 create mode 100644 kubernetes/helm_charts/monitoring/prometheus-operator/charts/kube-state-metrics/templates/kubeconfig-secret.yaml
 create mode 100644 kubernetes/helm_charts/monitoring/prometheus-operator/charts/kube-state-metrics/templates/networkpolicy.yaml
 create mode 100644 kubernetes/helm_charts/monitoring/prometheus-operator/charts/kube-state-metrics/templates/rbac-configmap.yaml
 create mode 100644 kubernetes/helm_charts/monitoring/prometheus-operator/charts/kube-state-metrics/templates/role.yaml
 create mode 100644 kubernetes/helm_charts/monitoring/prometheus-operator/charts/kube-state-metrics/templates/rolebinding.yaml
 create mode 100644 kubernetes/helm_charts/monitoring/prometheus-operator/charts/kube-state-metrics/templates/verticalpodautoscaler.yaml
 create mode 100644 kubernetes/helm_charts/monitoring/prometheus-operator/charts/prometheus-node-exporter/ci/port-values.yaml
 create mode 100644 kubernetes/helm_charts/monitoring/prometheus-operator/charts/prometheus-node-exporter/templates/clusterrole.yaml
 create mode 100644 kubernetes/helm_charts/monitoring/prometheus-operator/charts/prometheus-node-exporter/templates/clusterrolebinding.yaml
 create mode 100644 kubernetes/helm_charts/monitoring/prometheus-operator/charts/prometheus-node-exporter/templates/extra-manifests.yaml
 create mode 100644 kubernetes/helm_charts/monitoring/prometheus-operator/charts/prometheus-node-exporter/templates/networkpolicy.yaml
 create mode 100644 kubernetes/helm_charts/monitoring/prometheus-operator/charts/prometheus-node-exporter/templates/podmonitor.yaml
 create mode 100644 kubernetes/helm_charts/monitoring/prometheus-operator/charts/prometheus-node-exporter/templates/rbac-configmap.yaml
 create mode 100644 kubernetes/helm_charts/monitoring/prometheus-operator/charts/prometheus-node-exporter/templates/servicemonitor.yaml
 create mode 100644 kubernetes/helm_charts/monitoring/prometheus-operator/charts/prometheus-node-exporter/templates/verticalpodautoscaler.yaml

diff --git a/kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/ci/with-affinity-values.yaml b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/ci/with-affinity-values.yaml
new file mode 100644
index 0000000000..f5b9b53e73
--- /dev/null
+++ b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/ci/with-affinity-values.yaml
@@ -0,0 +1,16 @@
+affinity:
+  podAntiAffinity:
+    preferredDuringSchedulingIgnoredDuringExecution:
+      - podAffinityTerm:
+          labelSelector:
+            matchLabels:
+              app.kubernetes.io/instance: grafana-test
+              app.kubernetes.io/name: grafana
+          topologyKey: failure-domain.beta.kubernetes.io/zone
+        weight: 100
+    requiredDuringSchedulingIgnoredDuringExecution:
+      - labelSelector:
+          matchLabels:
+            app.kubernetes.io/instance: grafana-test
+            app.kubernetes.io/name: grafana
+        topologyKey: kubernetes.io/hostname
diff --git a/kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/ci/with-extraconfigmapmounts-values.yaml b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/ci/with-extraconfigmapmounts-values.yaml
new file mode 100644
index 0000000000..5cc44a056a
--- /dev/null
+++ b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/ci/with-extraconfigmapmounts-values.yaml
@@ -0,0 +1,7 @@
+extraConfigmapMounts:
+  - name: '{{ include "grafana.fullname" . }}'
+    configMap: '{{ include "grafana.fullname" . }}'
+    mountPath: /var/lib/grafana/dashboards/test-dashboard.json
+    # This is not a realistic test, but for this we only care about extraConfigmapMounts not being empty and pointing to an existing ConfigMap
+    subPath: grafana.ini
+    readOnly: true
diff --git a/kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/ci/with-image-renderer-values.yaml b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/ci/with-image-renderer-values.yaml
new file mode 100644
index 0000000000..32f3074347
--- /dev/null
+++ b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/ci/with-image-renderer-values.yaml
@@ -0,0 +1,19 @@
+podLabels:
+  customLableA: Aaaaa
+imageRenderer:
+  enabled: true
+  env:
+    RENDERING_ARGS: --disable-gpu,--window-size=1280x758
+    RENDERING_MODE: clustered
+  podLabels:
+    customLableB: Bbbbb
+  networkPolicy:
+    limitIngress: true
+    limitEgress: true
+  resources:
+    limits:
+      cpu: 1000m
+      memory: 1000Mi
+    requests:
+      cpu: 500m
+      memory: 50Mi
diff --git a/kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/ci/with-persistence.yaml b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/ci/with-persistence.yaml
new file mode 100644
index 0000000000..b92ca02c9e
--- /dev/null
+++ b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/ci/with-persistence.yaml
@@ -0,0 +1,3 @@
+persistence:
+  type: pvc
+  enabled: true
diff --git a/kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/templates/configSecret.yaml b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/templates/configSecret.yaml
new file mode 100644
index 0000000000..f8937ccc7a
--- /dev/null
+++ b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/templates/configSecret.yaml
@@ -0,0 +1,43 @@
+{{- $createConfigSecret := eq (include "grafana.shouldCreateConfigSecret" .) "true" -}}
+{{- if and .Values.createConfigmap $createConfigSecret }}
+{{- $files := .Files }}
+{{- $root := . -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: "{{ include "grafana.fullname" . }}-config-secret"
+  namespace: {{ include "grafana.namespace" . }}
+  labels:
+      {{- include "grafana.labels" . | nindent 4 }}
+  {{- with .Values.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+data:
+{{- range $key, $value := .Values.alerting }}
+  {{- if (hasKey $value "secretFile") }}
+  {{- $key | nindent 2 }}:
+    {{- toYaml ( $files.Get $value.secretFile ) | b64enc | nindent 4}}
+  {{/* as of https://helm.sh/docs/chart_template_guide/accessing_files/ this will only work if you fork this chart and add files to it*/}}
+  {{- end }}
+{{- end }}
+stringData:
+{{- range $key, $value := .Values.datasources }}
+{{- if (hasKey $value "secret") }}
+{{- $key | nindent 2 }}: |
+  {{- tpl (toYaml $value | nindent 4) $root }}
+{{- end }}
+{{- end }}
+{{- range $key, $value := .Values.notifiers }}
+{{- if (hasKey $value "secret") }}
+{{- $key | nindent 2 }}: |
+  {{- tpl (toYaml $value | nindent 4) $root }}
+{{- end }}
+{{- end }}
+{{- range $key, $value := .Values.alerting }}
+{{ if (hasKey $value "secret") }}
+  {{- $key | nindent 2 }}: |
+    {{- tpl (toYaml $value.secret | nindent 4) $root }}
+  {{- end }}
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/templates/extra-manifests.yaml b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/templates/extra-manifests.yaml
new file mode 100644
index 0000000000..a9bb3b6ba8
--- /dev/null
+++ b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/templates/extra-manifests.yaml
@@ -0,0 +1,4 @@
+{{ range .Values.extraObjects }}
+---
+{{ tpl (toYaml .) $ }}
+{{ end }}
diff --git a/kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/templates/hpa.yaml b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/templates/hpa.yaml
new file mode 100644
index 0000000000..46bbcb49a2
--- /dev/null
+++ b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/templates/hpa.yaml
@@ -0,0 +1,52 @@
+{{- $sts := list "sts" "StatefulSet" "statefulset" -}}
+{{- if .Values.autoscaling.enabled }}
+apiVersion: {{ include "grafana.hpa.apiVersion" . }}
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ include "grafana.fullname" . }}
+  namespace: {{ include "grafana.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "grafana.name" . }}
+    helm.sh/chart: {{ include "grafana.chart" . }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    {{- if has .Values.persistence.type $sts }}
+    kind: StatefulSet
+    {{- else }}
+    kind: Deployment
+    {{- end }}
+    name: {{ include "grafana.fullname" . }}
+  minReplicas: {{ .Values.autoscaling.minReplicas }}
+  maxReplicas: {{ .Values.autoscaling.maxReplicas }}
+  metrics:
+    {{- if .Values.autoscaling.targetMemory }}
+    - type: Resource
+      resource:
+        name: memory
+        {{- if eq (include "grafana.hpa.apiVersion" .) "autoscaling/v2beta1" }}
+        targetAverageUtilization: {{ .Values.autoscaling.targetMemory }}
+        {{- else }}
+        target:
+          type: Utilization
+          averageUtilization: {{ .Values.autoscaling.targetMemory }}
+        {{- end }}
+    {{- end }}
+    {{- if .Values.autoscaling.targetCPU }}
+    - type: Resource
+      resource:
+        name: cpu
+        {{- if eq (include "grafana.hpa.apiVersion" .) "autoscaling/v2beta1" }}
+        targetAverageUtilization: {{ .Values.autoscaling.targetCPU }}
+        {{- else }}
+        target:
+          type: Utilization
+          averageUtilization: {{ .Values.autoscaling.targetCPU }}
+        {{- end }}
+    {{- end }}
+  {{- if .Values.autoscaling.behavior }}
+  behavior: {{ toYaml .Values.autoscaling.behavior | nindent 4 }}
+  {{- end }}
+{{- end }}
diff --git a/kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/templates/image-renderer-deployment.yaml b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/templates/image-renderer-deployment.yaml
new file mode 100644
index 0000000000..ea97969c2e
--- /dev/null
+++ b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/templates/image-renderer-deployment.yaml
@@ -0,0 +1,131 @@
+{{ if .Values.imageRenderer.enabled }}
+{{- $root := . -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "grafana.fullname" . }}-image-renderer
+  namespace: {{ include "grafana.namespace" . }}
+  labels:
+    {{- include "grafana.imageRenderer.labels" . | nindent 4 }}
+    {{- with .Values.imageRenderer.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- with .Values.imageRenderer.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if and (not .Values.imageRenderer.autoscaling.enabled) (.Values.imageRenderer.replicas) }}
+  replicas: {{ .Values.imageRenderer.replicas }}
+  {{- end }}
+  revisionHistoryLimit: {{ .Values.imageRenderer.revisionHistoryLimit }}
+  selector:
+    matchLabels:
+      {{- include "grafana.imageRenderer.selectorLabels" . | nindent 6 }}
+
+  {{- with .Values.imageRenderer.deploymentStrategy }}
+  strategy:
+    {{- toYaml . | trim | nindent 4 }}
+  {{- end }}
+  template:
+    metadata:
+      labels:
+        {{- include "grafana.imageRenderer.selectorLabels" . | nindent 8 }}
+        {{- with .Values.imageRenderer.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
+        {{- with .Values.imageRenderer.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      {{- with .Values.imageRenderer.schedulerName }}
+      schedulerName: "{{ . }}"
+      {{- end }}
+      {{- with .Values.imageRenderer.serviceAccountName }}
+      serviceAccountName: "{{ . }}"
+      {{- end }}
+      {{- with .Values.imageRenderer.securityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.imageRenderer.hostAliases }}
+      hostAliases:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.imageRenderer.priorityClassName }}
+      priorityClassName: {{ . }}
+      {{- end }}
+      {{- with .Values.imageRenderer.image.pullSecrets }}
+      imagePullSecrets:
+        {{- range . }}
+        - name: {{ tpl . $root }}
+        {{- end}}
+      {{- end }}
+      containers:
+        - name: {{ .Chart.Name }}-image-renderer
+          {{- $registry := .Values.global.imageRegistry | default .Values.imageRenderer.image.registry -}}
+          {{- if .Values.imageRenderer.image.sha }}
+          image: "{{ $registry }}/{{ .Values.imageRenderer.image.repository }}:{{ .Values.imageRenderer.image.tag }}@sha256:{{ .Values.imageRenderer.image.sha }}"
+          {{- else }}
+          image: "{{ $registry }}/{{ .Values.imageRenderer.image.repository }}:{{ .Values.imageRenderer.image.tag }}"
+          {{- end }}
+          imagePullPolicy: {{ .Values.imageRenderer.image.pullPolicy }}
+          {{- if .Values.imageRenderer.command }}
+          command:
+            {{- range .Values.imageRenderer.command }}
+            - {{ . }}
+            {{- end }}
+          {{- end}}
+          ports:
+            - name: {{ .Values.imageRenderer.service.portName }}
+              containerPort: {{ .Values.imageRenderer.service.targetPort }}
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /
+              port: {{ .Values.imageRenderer.service.portName }}
+          env:
+            - name: HTTP_PORT
+              value: {{ .Values.imageRenderer.service.targetPort | quote }}
+          {{- if .Values.imageRenderer.serviceMonitor.enabled }}
+            - name: ENABLE_METRICS
+              value: "true"
+          {{- end }}
+          {{- range $key, $value := .Values.imageRenderer.envValueFrom }}
+            - name: {{ $key | quote }}
+              valueFrom:
+                {{- tpl (toYaml $value) $ | nindent 16 }}
+          {{- end }}
+          {{- range $key, $value := .Values.imageRenderer.env }}
+            - name: {{ $key | quote }}
+              value: {{ $value | quote }}
+          {{- end }}
+          {{- with .Values.imageRenderer.containerSecurityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+            - mountPath: /tmp
+              name: image-renderer-tmpfs
+          {{- with .Values.imageRenderer.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+      {{- with .Values.imageRenderer.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.imageRenderer.affinity }}
+      affinity:
+        {{- tpl (toYaml .) $root | nindent 8 }}
+      {{- end }}
+      {{- with .Values.imageRenderer.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      volumes:
+        - name: image-renderer-tmpfs
+          emptyDir: {}
+{{- end }}
diff --git a/kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/templates/image-renderer-hpa.yaml b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/templates/image-renderer-hpa.yaml
new file mode 100644
index 0000000000..b0f0059b79
--- /dev/null
+++ b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/templates/image-renderer-hpa.yaml
@@ -0,0 +1,47 @@
+{{- if and .Values.imageRenderer.enabled .Values.imageRenderer.autoscaling.enabled }}
+apiVersion: {{ include "grafana.hpa.apiVersion" . }}
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ include "grafana.fullname" . }}-image-renderer
+  namespace: {{ include "grafana.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "grafana.name" . }}-image-renderer
+    helm.sh/chart: {{ include "grafana.chart" . }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: {{ include "grafana.fullname" . }}-image-renderer
+  minReplicas: {{ .Values.imageRenderer.autoscaling.minReplicas }}
+  maxReplicas: {{ .Values.imageRenderer.autoscaling.maxReplicas }}
+  metrics:
+    {{- if .Values.imageRenderer.autoscaling.targetMemory }}
+    - type: Resource
+      resource:
+        name: memory
+        {{- if eq (include "grafana.hpa.apiVersion" .) "autoscaling/v2beta1" }}
+        targetAverageUtilization: {{ .Values.imageRenderer.autoscaling.targetMemory }}
+        {{- else }}
+        target:
+          type: Utilization
+          averageUtilization: {{ .Values.imageRenderer.autoscaling.targetMemory }}
+        {{- end }}
+    {{- end }}
+    {{- if .Values.imageRenderer.autoscaling.targetCPU }}
+    - type: Resource
+      resource:
+        name: cpu
+        {{- if eq (include "grafana.hpa.apiVersion" .) "autoscaling/v2beta1" }}
+        targetAverageUtilization: {{ .Values.imageRenderer.autoscaling.targetCPU }}
+        {{- else }}
+        target:
+          type: Utilization
+          averageUtilization: {{ .Values.imageRenderer.autoscaling.targetCPU }}
+        {{- end }}
+    {{- end }}
+  {{- if .Values.imageRenderer.autoscaling.behavior }}
+  behavior: {{ toYaml .Values.imageRenderer.autoscaling.behavior | nindent 4 }}
+  {{- end }}
+{{- end }}
diff --git a/kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/templates/image-renderer-network-policy.yaml b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/templates/image-renderer-network-policy.yaml
new file mode 100644
index 0000000000..d1a0eb313d
--- /dev/null
+++ b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/templates/image-renderer-network-policy.yaml
@@ -0,0 +1,79 @@
+{{- if and .Values.imageRenderer.enabled .Values.imageRenderer.networkPolicy.limitIngress }}
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "grafana.fullname" . }}-image-renderer-ingress
+  namespace: {{ include "grafana.namespace" . }}
+  annotations:
+    comment: Limit image-renderer ingress traffic from grafana
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "grafana.imageRenderer.selectorLabels" . | nindent 6 }}
+      {{- with .Values.imageRenderer.podLabels }}
+      {{- toYaml . | nindent 6 }}
+      {{- end }}
+
+  policyTypes:
+    - Ingress
+  ingress:
+    - ports:
+        - port: {{ .Values.imageRenderer.service.targetPort }}
+          protocol: TCP
+      from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: {{ include "grafana.namespace" . }}
+          podSelector:
+            matchLabels:
+              {{- include "grafana.selectorLabels" . | nindent 14 }}
+              {{- with .Values.podLabels }}
+              {{- toYaml . | nindent 14 }}
+              {{- end }}
+        {{- with .Values.imageRenderer.networkPolicy.extraIngressSelectors -}}
+        {{ toYaml . | nindent 8 }}
+        {{- end }}
+{{- end }}
+
+{{- if and .Values.imageRenderer.enabled .Values.imageRenderer.networkPolicy.limitEgress }}
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "grafana.fullname" . }}-image-renderer-egress
+  namespace: {{ include "grafana.namespace" . }}
+  annotations:
+    comment: Limit image-renderer egress traffic to grafana
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "grafana.imageRenderer.selectorLabels" . | nindent 6 }}
+      {{- with .Values.imageRenderer.podLabels }}
+      {{- toYaml . | nindent 6 }}
+      {{- end }}
+
+  policyTypes:
+    - Egress
+  egress:
+    # allow dns resolution
+    - ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+    # talk only to grafana
+    - ports:
+        - port: {{ .Values.service.targetPort }}
+          protocol: TCP
+      to:
+        - namespaceSelector:
+            matchLabels:
+              name: {{ include "grafana.namespace" . }}
+          podSelector:
+            matchLabels:
+              {{- include "grafana.selectorLabels" . | nindent 14 }}
+              {{- with .Values.podLabels }}
+              {{- toYaml . | nindent 14 }}
+              {{- end }}
+{{- end }}
diff --git a/kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/templates/image-renderer-service.yaml b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/templates/image-renderer-service.yaml
new file mode 100644
index 0000000000..f8da127cf8
--- /dev/null
+++ b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/templates/image-renderer-service.yaml
@@ -0,0 +1,31 @@
+{{- if and .Values.imageRenderer.enabled .Values.imageRenderer.service.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "grafana.fullname" . }}-image-renderer
+  namespace: {{ include "grafana.namespace" . }}
+  labels:
+    {{- include "grafana.imageRenderer.labels" . | nindent 4 }}
+    {{- with .Values.imageRenderer.service.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- with .Values.imageRenderer.service.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  type: ClusterIP
+  {{- with .Values.imageRenderer.service.clusterIP }}
+  clusterIP: {{ . }}
+  {{- end }}
+  ports:
+    - name: {{ .Values.imageRenderer.service.portName }}
+      port: {{ .Values.imageRenderer.service.port }}
+      protocol: TCP
+      targetPort: {{ .Values.imageRenderer.service.targetPort }}
+      {{- with .Values.imageRenderer.appProtocol }}
+      appProtocol: {{ . }}
+      {{- end }}
+  selector:
+    {{- include "grafana.imageRenderer.selectorLabels" . | nindent 4 }}
+{{- end }}
diff --git a/kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/templates/image-renderer-servicemonitor.yaml b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/templates/image-renderer-servicemonitor.yaml
new file mode 100644
index 0000000000..5d9f09d266
--- /dev/null
+++ b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/templates/image-renderer-servicemonitor.yaml
@@ -0,0 +1,48 @@
+{{- if .Values.imageRenderer.serviceMonitor.enabled }}
+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: {{ include "grafana.fullname" . }}-image-renderer
+  {{- if .Values.imageRenderer.serviceMonitor.namespace }}
+  namespace: {{ tpl .Values.imageRenderer.serviceMonitor.namespace . }}
+  {{- else }}
+  namespace: {{ include "grafana.namespace" . }}
+  {{- end }}
+  labels:
+    {{- include "grafana.imageRenderer.labels" . | nindent 4 }}
+    {{- with .Values.imageRenderer.serviceMonitor.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  endpoints:
+  - port: {{ .Values.imageRenderer.service.portName }}
+    {{- with .Values.imageRenderer.serviceMonitor.interval }}
+    interval: {{ . }}
+    {{- end }}
+    {{- with .Values.imageRenderer.serviceMonitor.scrapeTimeout }}
+    scrapeTimeout: {{ . }}
+    {{- end }}
+    honorLabels: true
+    path: {{ .Values.imageRenderer.serviceMonitor.path }}
+    scheme: {{ .Values.imageRenderer.serviceMonitor.scheme }}
+    {{- with .Values.imageRenderer.serviceMonitor.tlsConfig }}
+    tlsConfig:
+      {{- toYaml . | nindent 6 }}
+    {{- end }}
+    {{- with .Values.imageRenderer.serviceMonitor.relabelings }}
+    relabelings:
+      {{- toYaml . | nindent 6 }}
+    {{- end }}
+  jobLabel: "{{ .Release.Name }}-image-renderer"
+  selector:
+    matchLabels:
+      {{- include "grafana.imageRenderer.selectorLabels" . | nindent 6 }}
+  namespaceSelector:
+    matchNames:
+      - {{ include "grafana.namespace" . }}
+  {{- with .Values.imageRenderer.serviceMonitor.targetLabels }}
+  targetLabels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
diff --git a/kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/templates/networkpolicy.yaml b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/templates/networkpolicy.yaml
new file mode 100644
index 0000000000..ea4578bec2
--- /dev/null
+++ b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/templates/networkpolicy.yaml
@@ -0,0 +1,52 @@
+{{- if .Values.networkPolicy.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "grafana.fullname" . }}
+  namespace: {{ include "grafana.namespace" . }}
+  labels:
+    {{- include "grafana.labels" . | nindent 4 }}
+    {{- with .Values.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- with .Values.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  policyTypes:
+    {{- if .Values.networkPolicy.ingress }}
+    - Ingress
+    {{- end }}
+    {{- if .Values.networkPolicy.egress.enabled }}
+    - Egress
+    {{- end }}
+  podSelector:
+    matchLabels:
+      {{- include "grafana.selectorLabels" . | nindent 6 }}
+
+  {{- if .Values.networkPolicy.egress.enabled }}
+  egress:
+    - ports:
+        {{ .Values.networkPolicy.egress.ports | toJson }}
+  {{- end }}
+  {{- if .Values.networkPolicy.ingress }}
+  ingress:
+    - ports:
+      - port: {{ .Values.service.targetPort }}
+      {{- if not .Values.networkPolicy.allowExternal }}
+      from:
+        - podSelector:
+            matchLabels:
+              {{ include "grafana.fullname" . }}-client: "true"
+        {{- with .Values.networkPolicy.explicitNamespacesSelector }}
+        - namespaceSelector:
+            {{- toYaml . | nindent 12 }}
+        {{- end }}
+        - podSelector:
+            matchLabels:
+              {{- include "grafana.labels" . | nindent 14 }}
+              role: read
+      {{- end }}
+  {{- end }}
+{{- end }}
diff --git a/kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/templates/servicemonitor.yaml b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/templates/servicemonitor.yaml
new file mode 100644
index 0000000000..72396828f5
--- /dev/null
+++ b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/grafana/templates/servicemonitor.yaml
@@ -0,0 +1,52 @@
+{{- if .Values.serviceMonitor.enabled }}
+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: {{ include "grafana.fullname" . }}
+  {{- if .Values.serviceMonitor.namespace }}
+  namespace: {{ tpl .Values.serviceMonitor.namespace . }}
+  {{- else }}
+  namespace: {{ include "grafana.namespace" . }}
+  {{- end }}
+  labels:
+    {{- include "grafana.labels" . | nindent 4 }}
+    {{- with .Values.serviceMonitor.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  endpoints:
+  - port: {{ .Values.service.portName }}
+    {{- with .Values.serviceMonitor.interval }}
+    interval: {{ . }}
+    {{- end }}
+    {{- with .Values.serviceMonitor.scrapeTimeout }}
+    scrapeTimeout: {{ . }}
+    {{- end }}
+    honorLabels: true
+    path: {{ .Values.serviceMonitor.path }}
+    scheme: {{ .Values.serviceMonitor.scheme }}
+    {{- with .Values.serviceMonitor.tlsConfig }}
+    tlsConfig:
+      {{- toYaml . | nindent 6 }}
+    {{- end }}
+    {{- with .Values.serviceMonitor.relabelings }}
+    relabelings:
+      {{- toYaml . | nindent 6 }}
+    {{- end }}
+    {{- with .Values.serviceMonitor.metricRelabelings }}
+    metricRelabelings:
+      {{- toYaml . | nindent 6 }}
+    {{- end }}
+  jobLabel: "{{ .Release.Name }}"
+  selector:
+    matchLabels:
+      {{- include "grafana.selectorLabels" . | nindent 6 }}
+  namespaceSelector:
+    matchNames:
+      - {{ include "grafana.namespace" . }}
+  {{- with .Values.serviceMonitor.targetLabels }}
+  targetLabels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
diff --git a/kubernetes/helm_charts/monitoring/prometheus-operator/charts/kube-state-metrics/templates/ciliumnetworkpolicy.yaml b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/kube-state-metrics/templates/ciliumnetworkpolicy.yaml
new file mode 100644
index 0000000000..025cd47a88
--- /dev/null
+++ b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/kube-state-metrics/templates/ciliumnetworkpolicy.yaml
@@ -0,0 +1,33 @@
+{{- if and .Values.networkPolicy.enabled (eq .Values.networkPolicy.flavor "cilium") }}
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  {{- if .Values.annotations }}
+  annotations:
+    {{ toYaml .Values.annotations | nindent 4 }}
+  {{- end }}
+  labels:
+    {{- include "kube-state-metrics.labels" . | indent 4 }}
+  name: {{ template "kube-state-metrics.fullname" . }}
+  namespace: {{ template "kube-state-metrics.namespace" . }}
+spec:
+  endpointSelector:
+    matchLabels:
+      {{- include "kube-state-metrics.selectorLabels" . | indent 6 }}
+  egress:
+    {{- if and .Values.networkPolicy.cilium .Values.networkPolicy.cilium.kubeApiServerSelector }}
+      {{ toYaml .Values.networkPolicy.cilium.kubeApiServerSelector | nindent 6 }}
+    {{- else }}
+    - toEntities:
+      - kube-apiserver
+    {{- end }}
+  ingress:
+  - toPorts:
+    - ports:
+      - port: {{ .Values.service.port | quote }}
+        protocol: TCP
+      {{- if .Values.selfMonitor.enabled }}
+      - port: {{ .Values.selfMonitor.telemetryPort | default 8081 | quote }}
+        protocol: TCP
+      {{ end }}
+{{ end }}
diff --git a/kubernetes/helm_charts/monitoring/prometheus-operator/charts/kube-state-metrics/templates/crs-configmap.yaml b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/kube-state-metrics/templates/crs-configmap.yaml
new file mode 100644
index 0000000000..d38a75a51d
--- /dev/null
+++ b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/kube-state-metrics/templates/crs-configmap.yaml
@@ -0,0 +1,16 @@
+{{- if .Values.customResourceState.enabled}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ template "kube-state-metrics.fullname" . }}-customresourcestate-config
+  namespace: {{ template "kube-state-metrics.namespace" . }}
+  labels:
+    {{- include "kube-state-metrics.labels" . | indent 4 }}
+  {{- if .Values.annotations }}
+  annotations:
+    {{ toYaml .Values.annotations | nindent 4 }}
+  {{- end }}
+data:
+  config.yaml: |
+    {{- toYaml .Values.customResourceState.config | nindent 4 }}
+{{- end }}
diff --git a/kubernetes/helm_charts/monitoring/prometheus-operator/charts/kube-state-metrics/templates/extra-manifests.yaml b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/kube-state-metrics/templates/extra-manifests.yaml
new file mode 100644
index 0000000000..567f7bf329
--- /dev/null
+++ b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/kube-state-metrics/templates/extra-manifests.yaml
@@ -0,0 +1,4 @@
+{{ range .Values.extraManifests }}
+---
+{{ tpl (toYaml .) $ }}
+{{ end }}
diff --git a/kubernetes/helm_charts/monitoring/prometheus-operator/charts/kube-state-metrics/templates/kubeconfig-secret.yaml b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/kube-state-metrics/templates/kubeconfig-secret.yaml
new file mode 100644
index 0000000000..6af0084502
--- /dev/null
+++ b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/kube-state-metrics/templates/kubeconfig-secret.yaml
@@ -0,0 +1,12 @@
+{{- if .Values.kubeconfig.enabled -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ template "kube-state-metrics.fullname" . }}-kubeconfig
+  namespace: {{ template "kube-state-metrics.namespace" . }}
+  labels:
+    {{- include "kube-state-metrics.labels" . | indent 4 }}
+type: Opaque
+data:
+  config: '{{ .Values.kubeconfig.secret }}'
+{{- end -}}
diff --git a/kubernetes/helm_charts/monitoring/prometheus-operator/charts/kube-state-metrics/templates/networkpolicy.yaml b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/kube-state-metrics/templates/networkpolicy.yaml
new file mode 100644
index 0000000000..309b38ec54
--- /dev/null
+++ b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/kube-state-metrics/templates/networkpolicy.yaml
@@ -0,0 +1,43 @@
+{{- if and .Values.networkPolicy.enabled (eq .Values.networkPolicy.flavor "kubernetes") }}
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  {{- if .Values.annotations }}
+  annotations:
+    {{ toYaml .Values.annotations | nindent 4 }}
+  {{- end }}
+  labels:
+    {{- include "kube-state-metrics.labels" . | indent 4 }}
+  name: {{ template "kube-state-metrics.fullname" . }}
+  namespace: {{ template "kube-state-metrics.namespace" . }}
+spec:
+  {{- if .Values.networkPolicy.egress }}
+  ## Deny all egress by default
+  egress:
+    {{- toYaml .Values.networkPolicy.egress | nindent 4 }}
+  {{- end }}
+  ingress:
+  {{- if .Values.networkPolicy.ingress }}
+    {{- toYaml .Values.networkPolicy.ingress | nindent 4 }}
+  {{- else }}
+    ## Allow ingress on default ports by default
+  - ports:
+    - port: {{ .Values.service.port | default 8080 }}
+      protocol: TCP
+    {{- if .Values.selfMonitor.enabled }}
+    {{- $telemetryPort := ternary 9091 (.Values.selfMonitor.telemetryPort | default 8081) .Values.kubeRBACProxy.enabled}}
+    - port: {{ $telemetryPort }}
+      protocol: TCP
+    {{- end }}
+  {{- end }}
+  podSelector:
+    {{- if .Values.networkPolicy.podSelector }}
+    {{- toYaml .Values.networkPolicy.podSelector | nindent 4 }}
+    {{- else }}
+    matchLabels:
+      {{- include "kube-state-metrics.selectorLabels" . | indent 6 }}
+    {{- end }}
+  policyTypes:
+    - Ingress
+    - Egress
+{{- end }}
diff --git a/kubernetes/helm_charts/monitoring/prometheus-operator/charts/kube-state-metrics/templates/rbac-configmap.yaml b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/kube-state-metrics/templates/rbac-configmap.yaml
new file mode 100644
index 0000000000..671dc9d660
--- /dev/null
+++ b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/kube-state-metrics/templates/rbac-configmap.yaml
@@ -0,0 +1,22 @@
+{{- if .Values.kubeRBACProxy.enabled}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ template "kube-state-metrics.fullname" . }}-rbac-config
+  namespace: {{ template "kube-state-metrics.namespace" . }}
+  labels:
+    {{- include "kube-state-metrics.labels" . | indent 4 }}
+  {{- if .Values.annotations }}
+  annotations:
+    {{ toYaml .Values.annotations | nindent 4 }}
+  {{- end }}
+data:
+  config-file.yaml: |+
+    authorization:
+      resourceAttributes:
+        namespace: {{ template "kube-state-metrics.namespace" . }}
+        apiVersion: v1
+        resource: services
+        subresource: {{ template "kube-state-metrics.fullname" . }}
+        name: {{ template "kube-state-metrics.fullname" . }}
+{{- end }}
diff --git a/kubernetes/helm_charts/monitoring/prometheus-operator/charts/kube-state-metrics/templates/role.yaml b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/kube-state-metrics/templates/role.yaml
new file mode 100644
index 0000000000..d33687f2d1
--- /dev/null
+++ b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/kube-state-metrics/templates/role.yaml
@@ -0,0 +1,212 @@
+{{- if and (eq .Values.rbac.create true) (not .Values.rbac.useExistingRole) -}}
+{{- range (ternary (join "," .Values.namespaces | split "," ) (list "") (eq $.Values.rbac.useClusterRole false)) }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+{{- if eq $.Values.rbac.useClusterRole false }}
+kind: Role
+{{- else }}
+kind: ClusterRole
+{{- end }}
+metadata:
+  labels:
+    {{- include "kube-state-metrics.labels" $ | indent 4 }}
+  name: {{ template "kube-state-metrics.fullname" $ }}
+{{- if eq $.Values.rbac.useClusterRole false }}
+  namespace: {{ . }}
+{{- end }}
+rules:
+{{ if has "certificatesigningrequests" $.Values.collectors }}
+- apiGroups: ["certificates.k8s.io"]
+  resources:
+  - certificatesigningrequests
+  verbs: ["list", "watch"]
+{{ end -}}
+{{ if has "configmaps" $.Values.collectors }}
+- apiGroups: [""]
+  resources:
+  - configmaps
+  verbs: ["list", "watch"]
+{{ end -}}
+{{ if has "cronjobs" $.Values.collectors }}
+- apiGroups: ["batch"]
+  resources:
+  - cronjobs
+  verbs: ["list", "watch"]
+{{ end -}}
+{{ if has "daemonsets" $.Values.collectors }}
+- apiGroups: ["extensions", "apps"]
+  resources:
+  - daemonsets
+  verbs: ["list", "watch"]
+{{ end -}}
+{{ if has "deployments" $.Values.collectors }}
+- apiGroups: ["extensions", "apps"]
+  resources:
+  - deployments
+  verbs: ["list", "watch"]
+{{ end -}}
+{{ if has "endpoints" $.Values.collectors }}
+- apiGroups: [""]
+  resources:
+  - endpoints
+  verbs: ["list", "watch"]
+{{ end -}}
+{{ if has "endpointslices" $.Values.collectors }}
+- apiGroups: ["discovery.k8s.io"]
+  resources:
+  - endpointslices
+  verbs: ["list", "watch"]
+{{ end -}}
+{{ if has "horizontalpodautoscalers" $.Values.collectors }}
+- apiGroups: ["autoscaling"]
+  resources:
+  - horizontalpodautoscalers
+  verbs: ["list", "watch"]
+{{ end -}}
+{{ if has "ingresses" $.Values.collectors }}
+- apiGroups: ["extensions", "networking.k8s.io"]
+  resources:
+  - ingresses
+  verbs: ["list", "watch"]
+{{ end -}}
+{{ if has "jobs" $.Values.collectors }}
+- apiGroups: ["batch"]
+  resources:
+  - jobs
+  verbs: ["list", "watch"]
+{{ end -}}
+{{ if has "leases" $.Values.collectors }}
+- apiGroups: ["coordination.k8s.io"]
+  resources:
+  - leases
+  verbs: ["list", "watch"]
+{{ end -}}
+{{ if has "limitranges" $.Values.collectors }}
+- apiGroups: [""]
+  resources:
+  - limitranges
+  verbs: ["list", "watch"]
+{{ end -}}
+{{ if has "mutatingwebhookconfigurations" $.Values.collectors }}
+- apiGroups: ["admissionregistration.k8s.io"]
+  resources:
+    - mutatingwebhookconfigurations
+  verbs: ["list", "watch"]
+{{ end -}}
+{{ if has "namespaces" $.Values.collectors }}
+- apiGroups: [""]
+  resources:
+  - namespaces
+  verbs: ["list", "watch"]
+{{ end -}}
+{{ if has "networkpolicies" $.Values.collectors }}
+- apiGroups: ["networking.k8s.io"]
+  resources:
+  - networkpolicies
+  verbs: ["list", "watch"]
+{{ end -}}
+{{ if has "nodes" $.Values.collectors }}
+- apiGroups: [""]
+  resources:
+  - nodes
+  verbs: ["list", "watch"]
+{{ end -}}
+{{ if has "persistentvolumeclaims" $.Values.collectors }}
+- apiGroups: [""]
+  resources:
+  - persistentvolumeclaims
+  verbs: ["list", "watch"]
+{{ end -}}
+{{ if has "persistentvolumes" $.Values.collectors }}
+- apiGroups: [""]
+  resources:
+  - persistentvolumes
+  verbs: ["list", "watch"]
+{{ end -}}
+{{ if has "poddisruptionbudgets" $.Values.collectors }}
+- apiGroups: ["policy"]
+  resources:
+    - poddisruptionbudgets
+  verbs: ["list", "watch"]
+{{ end -}}
+{{ if has "pods" $.Values.collectors }}
+- apiGroups: [""]
+  resources:
+  - pods
+  verbs: ["list", "watch"]
+{{ end -}}
+{{ if has "replicasets" $.Values.collectors }}
+- apiGroups: ["extensions", "apps"]
+  resources:
+  - replicasets
+  verbs: ["list", "watch"]
+{{ end -}}
+{{ if has "replicationcontrollers" $.Values.collectors }}
+- apiGroups: [""]
+  resources:
+  - replicationcontrollers
+  verbs: ["list", "watch"]
+{{ end -}}
+{{ if has "resourcequotas" $.Values.collectors }}
+- apiGroups: [""]
+  resources:
+  - resourcequotas
+  verbs: ["list", "watch"]
+{{ end -}}
+{{ if has "secrets" $.Values.collectors }}
+- apiGroups: [""]
+  resources:
+  - secrets
+  verbs: ["list", "watch"]
+{{ end -}}
+{{ if has "services" $.Values.collectors }}
+- apiGroups: [""]
+  resources:
+  - services
+  verbs: ["list", "watch"]
+{{ end -}}
+{{ if has "statefulsets" $.Values.collectors }}
+- apiGroups: ["apps"]
+  resources:
+  - statefulsets
+  verbs: ["list", "watch"]
+{{ end -}}
+{{ if has "storageclasses" $.Values.collectors }}
+- apiGroups: ["storage.k8s.io"]
+  resources:
+    - storageclasses
+  verbs: ["list", "watch"]
+{{ end -}}
+{{ if has "validatingwebhookconfigurations" $.Values.collectors }}
+- apiGroups: ["admissionregistration.k8s.io"]
+  resources:
+    - validatingwebhookconfigurations
+  verbs: ["list", "watch"]
+{{ end -}}
+{{ if has "volumeattachments" $.Values.collectors }}
+- apiGroups: ["storage.k8s.io"]
+  resources:
+    - volumeattachments
+  verbs: ["list", "watch"]
+{{ end -}}
+{{-  if $.Values.kubeRBACProxy.enabled  }}
+- apiGroups: ["authentication.k8s.io"]
+  resources:
+    - tokenreviews
+  verbs: ["create"]
+- apiGroups: ["authorization.k8s.io"]
+  resources:
+    - subjectaccessreviews
+  verbs: ["create"]
+{{- end }}
+{{- if $.Values.customResourceState.enabled }}
+- apiGroups: ["apiextensions.k8s.io"]
+  resources:
+    - customresourcedefinitions
+  verbs: ["list", "watch"]
+{{- end }}
+{{ if $.Values.rbac.extraRules }}
+{{ toYaml $.Values.rbac.extraRules }}
+{{ end }}
+{{- end -}}
+{{- end -}}
diff --git a/kubernetes/helm_charts/monitoring/prometheus-operator/charts/kube-state-metrics/templates/rolebinding.yaml b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/kube-state-metrics/templates/rolebinding.yaml
new file mode 100644
index 0000000000..330651b73f
--- /dev/null
+++ b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/kube-state-metrics/templates/rolebinding.yaml
@@ -0,0 +1,24 @@
+{{- if and (eq  .Values.rbac.create true) (eq .Values.rbac.useClusterRole false) -}}
+{{- range (join "," $.Values.namespaces) | split "," }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels:
+    {{- include "kube-state-metrics.labels" $ | indent 4 }}
+  name: {{ template "kube-state-metrics.fullname" $ }}
+  namespace: {{ . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+{{- if (not $.Values.rbac.useExistingRole) }}
+  name: {{ template "kube-state-metrics.fullname" $ }}
+{{- else }}
+  name: {{ $.Values.rbac.useExistingRole }}
+{{- end }}
+subjects:
+- kind: ServiceAccount
+  name: {{ template "kube-state-metrics.serviceAccountName" $ }}
+  namespace: {{ template "kube-state-metrics.namespace" $ }}
+{{- end -}}
+{{- end -}}
diff --git a/kubernetes/helm_charts/monitoring/prometheus-operator/charts/kube-state-metrics/templates/verticalpodautoscaler.yaml b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/kube-state-metrics/templates/verticalpodautoscaler.yaml
new file mode 100644
index 0000000000..f46305b517
--- /dev/null
+++ b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/kube-state-metrics/templates/verticalpodautoscaler.yaml
@@ -0,0 +1,44 @@
+{{- if and (.Capabilities.APIVersions.Has "autoscaling.k8s.io/v1") (.Values.verticalPodAutoscaler.enabled) }}
+apiVersion: autoscaling.k8s.io/v1
+kind: VerticalPodAutoscaler
+metadata:
+  name: {{ template "kube-state-metrics.fullname" . }}
+  namespace: {{ template "kube-state-metrics.namespace" . }}
+  labels:
+    {{- include "kube-state-metrics.labels" . | indent 4 }}
+spec:
+  {{- with .Values.verticalPodAutoscaler.recommenders }}
+  recommenders:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  resourcePolicy:
+    containerPolicies:
+    - containerName: {{ template "kube-state-metrics.name" . }}
+      {{- with .Values.verticalPodAutoscaler.controlledResources }}
+      controlledResources:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if .Values.verticalPodAutoscaler.controlledValues }}
+      controlledValues: {{ .Values.verticalPodAutoscaler.controlledValues }}
+      {{- end }}
+      {{- if .Values.verticalPodAutoscaler.maxAllowed }}
+      maxAllowed:
+        {{ toYaml .Values.verticalPodAutoscaler.maxAllowed | nindent 8 }}
+      {{- end }}
+      {{- if .Values.verticalPodAutoscaler.minAllowed }}
+      minAllowed:
+        {{ toYaml .Values.verticalPodAutoscaler.minAllowed | nindent 8 }}
+      {{- end }}
+  targetRef:
+    apiVersion: apps/v1
+    {{- if .Values.autosharding.enabled }}
+    kind: StatefulSet
+    {{- else }}
+    kind: Deployment
+    {{- end }}
+    name:  {{ template "kube-state-metrics.fullname" . }}
+  {{- with .Values.verticalPodAutoscaler.updatePolicy }}
+  updatePolicy:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
diff --git a/kubernetes/helm_charts/monitoring/prometheus-operator/charts/prometheus-node-exporter/ci/port-values.yaml b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/prometheus-node-exporter/ci/port-values.yaml
new file mode 100644
index 0000000000..dbfb4b67ff
--- /dev/null
+++ b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/prometheus-node-exporter/ci/port-values.yaml
@@ -0,0 +1,3 @@
+service:
+  targetPort: 9102
+  port: 9102
diff --git a/kubernetes/helm_charts/monitoring/prometheus-operator/charts/prometheus-node-exporter/templates/clusterrole.yaml b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/prometheus-node-exporter/templates/clusterrole.yaml
new file mode 100644
index 0000000000..c256dba73d
--- /dev/null
+++ b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/prometheus-node-exporter/templates/clusterrole.yaml
@@ -0,0 +1,19 @@
+{{- if and (eq .Values.rbac.create true) (eq .Values.kubeRBACProxy.enabled true) -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "prometheus-node-exporter.fullname" . }}
+  labels:
+    {{- include "prometheus-node-exporter.labels" . | nindent 4 }}
+rules:
+  {{-  if $.Values.kubeRBACProxy.enabled  }}
+  - apiGroups: [ "authentication.k8s.io" ]
+    resources:
+      - tokenreviews
+    verbs: [ "create" ]
+  - apiGroups: [ "authorization.k8s.io" ]
+    resources:
+      - subjectaccessreviews
+    verbs: [ "create" ]
+  {{- end }}
+{{- end -}}
diff --git a/kubernetes/helm_charts/monitoring/prometheus-operator/charts/prometheus-node-exporter/templates/clusterrolebinding.yaml b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/prometheus-node-exporter/templates/clusterrolebinding.yaml
new file mode 100644
index 0000000000..653305ad9e
--- /dev/null
+++ b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/prometheus-node-exporter/templates/clusterrolebinding.yaml
@@ -0,0 +1,20 @@
+{{- if and (eq .Values.rbac.create true) (eq .Values.kubeRBACProxy.enabled true) -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    {{- include "prometheus-node-exporter.labels" . | nindent 4 }}
+  name: {{ template "prometheus-node-exporter.fullname" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+{{- if .Values.rbac.useExistingRole }}
+  name: {{ .Values.rbac.useExistingRole }}
+{{- else }}
+  name: {{ template "prometheus-node-exporter.fullname" . }}
+{{- end }}
+subjects:
+- kind: ServiceAccount
+  name: {{ template "prometheus-node-exporter.serviceAccountName" . }}
+  namespace: {{ template "prometheus-node-exporter.namespace" . }}
+{{- end -}}
diff --git a/kubernetes/helm_charts/monitoring/prometheus-operator/charts/prometheus-node-exporter/templates/extra-manifests.yaml b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/prometheus-node-exporter/templates/extra-manifests.yaml
new file mode 100644
index 0000000000..2b21b71062
--- /dev/null
+++ b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/prometheus-node-exporter/templates/extra-manifests.yaml
@@ -0,0 +1,4 @@
+{{ range .Values.extraManifests }}
+---
+{{ tpl . $ }}
+{{ end }}
diff --git a/kubernetes/helm_charts/monitoring/prometheus-operator/charts/prometheus-node-exporter/templates/networkpolicy.yaml b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/prometheus-node-exporter/templates/networkpolicy.yaml
new file mode 100644
index 0000000000..825722729d
--- /dev/null
+++ b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/prometheus-node-exporter/templates/networkpolicy.yaml
@@ -0,0 +1,23 @@
+{{- if .Values.networkPolicy.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "prometheus-node-exporter.fullname" . }}
+  namespace: {{ include "prometheus-node-exporter.namespace" . }}
+  labels:
+    {{- include "prometheus-node-exporter.labels" $ | nindent 4 }}
+  {{- with .Values.service.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  ingress:
+    - ports:
+      - port: {{ .Values.service.port }}
+  policyTypes:
+    - Egress
+    - Ingress
+  podSelector:
+    matchLabels:
+      {{- include "prometheus-node-exporter.selectorLabels" . | nindent 6 }}
+{{- end }}
diff --git a/kubernetes/helm_charts/monitoring/prometheus-operator/charts/prometheus-node-exporter/templates/podmonitor.yaml b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/prometheus-node-exporter/templates/podmonitor.yaml
new file mode 100644
index 0000000000..f88da6a34e
--- /dev/null
+++ b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/prometheus-node-exporter/templates/podmonitor.yaml
@@ -0,0 +1,91 @@
+{{- if .Values.prometheus.podMonitor.enabled }}
+apiVersion: {{ .Values.prometheus.podMonitor.apiVersion | default "monitoring.coreos.com/v1" }}
+kind: PodMonitor
+metadata:
+  name: {{ include "prometheus-node-exporter.fullname" . }}
+  namespace: {{ include "prometheus-node-exporter.podmonitor-namespace" . }}
+  labels:
+    {{- include "prometheus-node-exporter.labels" . | nindent 4 }}
+    {{- with .Values.prometheus.podMonitor.additionalLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  jobLabel: {{ default "app.kubernetes.io/name" .Values.prometheus.podMonitor.jobLabel }}
+  {{- include "podmonitor.scrapeLimits" .Values.prometheus.podMonitor | nindent 2 }}
+  selector:
+    matchLabels:
+    {{- with .Values.prometheus.podMonitor.selectorOverride }}
+      {{- toYaml . | nindent 6 }}
+    {{- else }}
+      {{- include "prometheus-node-exporter.selectorLabels" . | nindent 6 }}
+    {{- end }}
+  namespaceSelector:
+    matchNames:
+      - {{ include "prometheus-node-exporter.namespace" . }}
+  {{- with .Values.prometheus.podMonitor.attachMetadata }}
+  attachMetadata:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.prometheus.podMonitor.podTargetLabels }}
+  podTargetLabels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  podMetricsEndpoints:
+    - port: {{ .Values.service.portName }}
+      {{- with .Values.prometheus.podMonitor.scheme }}
+      scheme: {{ . }}
+      {{- end }}
+      {{- with .Values.prometheus.podMonitor.path }}
+      path: {{ . }}
+      {{- end }}
+      {{- with .Values.prometheus.podMonitor.basicAuth }}
+      basicAuth:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.prometheus.podMonitor.bearerTokenSecret }}
+      bearerTokenSecret:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.prometheus.podMonitor.tlsConfig }}
+      tlsConfig:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.prometheus.podMonitor.authorization }}
+      authorization:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.prometheus.podMonitor.oauth2 }}
+      oauth2:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.prometheus.podMonitor.proxyUrl }}
+      proxyUrl: {{ . }}
+      {{- end }}
+      {{- with .Values.prometheus.podMonitor.interval }}
+      interval: {{ . }}
+      {{- end }}
+      {{- with .Values.prometheus.podMonitor.honorTimestamps }}
+      honorTimestamps: {{ . }}
+      {{- end }}
+      {{- with .Values.prometheus.podMonitor.honorLabels }}
+      honorLabels: {{ . }}
+      {{- end }}
+      {{- with .Values.prometheus.podMonitor.scrapeTimeout }}
+      scrapeTimeout: {{ . }}
+      {{- end }}
+      {{- with .Values.prometheus.podMonitor.relabelings }}
+      relabelings:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.prometheus.podMonitor.metricRelabelings }}
+      metricRelabelings:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      enableHttp2: {{ default false .Values.prometheus.podMonitor.enableHttp2 }}
+      filterRunning: {{ default true .Values.prometheus.podMonitor.filterRunning }}
+      followRedirects: {{ default false .Values.prometheus.podMonitor.followRedirects }}
+      {{- with .Values.prometheus.podMonitor.params }}
+      params:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+{{- end }}
diff --git a/kubernetes/helm_charts/monitoring/prometheus-operator/charts/prometheus-node-exporter/templates/rbac-configmap.yaml b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/prometheus-node-exporter/templates/rbac-configmap.yaml
new file mode 100644
index 0000000000..814e110337
--- /dev/null
+++ b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/prometheus-node-exporter/templates/rbac-configmap.yaml
@@ -0,0 +1,16 @@
+{{- if .Values.kubeRBACProxy.enabled}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ template "prometheus-node-exporter.fullname" . }}-rbac-config
+  namespace: {{ include "prometheus-node-exporter.namespace" . }}
+data:
+  config-file.yaml: |+
+    authorization:
+      resourceAttributes:
+        namespace: {{ template "prometheus-node-exporter.namespace" . }}
+        apiVersion: v1
+        resource: services
+        subresource: {{ template "prometheus-node-exporter.fullname" . }}
+        name: {{ template "prometheus-node-exporter.fullname" . }}
+{{- end }}
\ No newline at end of file
diff --git a/kubernetes/helm_charts/monitoring/prometheus-operator/charts/prometheus-node-exporter/templates/servicemonitor.yaml b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/prometheus-node-exporter/templates/servicemonitor.yaml
new file mode 100644
index 0000000000..0d7a42eaec
--- /dev/null
+++ b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/prometheus-node-exporter/templates/servicemonitor.yaml
@@ -0,0 +1,61 @@
+{{- if .Values.prometheus.monitor.enabled }}
+apiVersion: {{ .Values.prometheus.monitor.apiVersion | default "monitoring.coreos.com/v1" }}
+kind: ServiceMonitor
+metadata:
+  name: {{ include "prometheus-node-exporter.fullname" . }}
+  namespace: {{ include "prometheus-node-exporter.monitor-namespace" . }}
+  labels:
+    {{- include "prometheus-node-exporter.labels" . | nindent 4 }}
+    {{- with .Values.prometheus.monitor.additionalLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  jobLabel: {{ default "app.kubernetes.io/name" .Values.prometheus.monitor.jobLabel }}
+  {{- include "servicemonitor.scrapeLimits" .Values.prometheus.monitor | nindent 2 }}
+  {{- with .Values.prometheus.monitor.podTargetLabels }}
+  podTargetLabels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  selector:
+    matchLabels:
+    {{- with .Values.prometheus.monitor.selectorOverride }}
+      {{- toYaml . | nindent 6 }}
+    {{- else }}
+      {{- include "prometheus-node-exporter.selectorLabels" . | nindent 6 }}
+    {{- end }}
+  {{- with .Values.prometheus.monitor.attachMetadata }}
+  attachMetadata:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  endpoints:
+    - port: {{ .Values.service.portName }}
+      scheme: {{ .Values.prometheus.monitor.scheme }}
+      {{- with .Values.prometheus.monitor.basicAuth }}
+      basicAuth:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.prometheus.monitor.bearerTokenFile }}
+      bearerTokenFile: {{ . }}
+      {{- end }}
+      {{- with .Values.prometheus.monitor.tlsConfig }}
+      tlsConfig:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.prometheus.monitor.proxyUrl }}
+      proxyUrl: {{ . }}
+      {{- end }}
+      {{- with .Values.prometheus.monitor.interval }}
+      interval: {{ . }}
+      {{- end }}
+      {{- with .Values.prometheus.monitor.scrapeTimeout }}
+      scrapeTimeout: {{ . }}
+      {{- end }}
+      {{- with .Values.prometheus.monitor.relabelings }}
+      relabelings:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.prometheus.monitor.metricRelabelings }}
+      metricRelabelings:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+{{- end }}
diff --git a/kubernetes/helm_charts/monitoring/prometheus-operator/charts/prometheus-node-exporter/templates/verticalpodautoscaler.yaml b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/prometheus-node-exporter/templates/verticalpodautoscaler.yaml
new file mode 100644
index 0000000000..2c2705f872
--- /dev/null
+++ b/kubernetes/helm_charts/monitoring/prometheus-operator/charts/prometheus-node-exporter/templates/verticalpodautoscaler.yaml
@@ -0,0 +1,40 @@
+{{- if and (.Capabilities.APIVersions.Has "autoscaling.k8s.io/v1") (.Values.verticalPodAutoscaler.enabled) }}
+apiVersion: autoscaling.k8s.io/v1
+kind: VerticalPodAutoscaler
+metadata:
+  name: {{ include "prometheus-node-exporter.fullname" . }}
+  namespace: {{ include "prometheus-node-exporter.namespace" . }}
+  labels:
+    {{- include "prometheus-node-exporter.labels" . | nindent 4 }}
+spec:
+  {{- with .Values.verticalPodAutoscaler.recommenders }}
+  recommenders:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  resourcePolicy:
+    containerPolicies:
+    - containerName: node-exporter
+      {{- with .Values.verticalPodAutoscaler.controlledResources }}
+      controlledResources:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.verticalPodAutoscaler.controlledValues }}
+      controlledValues: {{ . }}
+      {{- end }}
+      {{- with .Values.verticalPodAutoscaler.maxAllowed }}
+      maxAllowed:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.verticalPodAutoscaler.minAllowed }}
+      minAllowed:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+  targetRef:
+    apiVersion: apps/v1
+    kind: DaemonSet
+    name: {{ include "prometheus-node-exporter.fullname" . }}
+  {{- with .Values.verticalPodAutoscaler.updatePolicy }}
+  updatePolicy:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}