robot: project prometheus-node-exporter chart upgrades from 4.6.0 to …

…4.41.0

Signed-off-by: robot <[email protected]>

charts/prometheus-node-exporter/config

@@ -4,7 +4,7 @@ export USE_OPENSOURCE_CHART=false
 export REPO_URL=https://prometheus-community.github.io/helm-charts
 export REPO_NAME=prometheus-node-exporter
 export CHART_NAME=prometheus-node-exporter
-export VERSION=4.6.0
+export VERSION=4.41.0
 
 # pr, issue, none
 export UPGRADE_METHOD=pr

charts/prometheus-node-exporter/prometheus-node-exporter/Chart.yaml

@@ -1,5 +1,10 @@
+annotations:
+  artifacthub.io/license: Apache-2.0
+  artifacthub.io/links: |
+    - name: Chart Source
+      url: https://github.com/prometheus-community/helm-charts
 apiVersion: v2
-appVersion: 1.3.1
+appVersion: 1.8.2
 description: A Helm chart for prometheus node-exporter
 home: https://github.com/prometheus/node_exporter/
 keywords:
@@ -11,12 +16,14 @@ maintainers:
     name: gianrubio
   - email: [email protected]
     name: zanhsieh
+  - email: [email protected]
+    name: zeritti
 name: prometheus-node-exporter
 sources:
   - https://github.com/prometheus/node_exporter/
 type: application
-version: 4.6.0
+version: 4.41.0
 dependencies:
   - name: prometheus-node-exporter
-    version: "4.6.0"
+    version: "4.41.0"
     repository: "https://prometheus-community.github.io/helm-charts"

charts/prometheus-node-exporter/prometheus-node-exporter/README.md

@@ -1,18 +1,18 @@
-# Prometheus `Node Exporter`
+# Prometheus Node Exporter
 
 Prometheus exporter for hardware and OS metrics exposed by *NIX kernels, written in Go with pluggable metric collectors.
 
-This chart bootstraps a prometheus [`Node Exporter`](http://github.com/prometheus/node_exporter) daemonset on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager.
+This chart bootstraps a Prometheus [Node Exporter](http://github.com/prometheus/node_exporter) daemonset on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager.
 
 ## Get Repository Info
-
+<!-- textlint-disable terminology -->
 ```console
 helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
 helm repo update
 ```
 
-_See [`helm repo`](https://helm.sh/docs/helm/helm_repo/) for command documentation._
-
+_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
+<!-- textlint-enable -->
 ## Install Chart
 
 ```console
@@ -36,7 +36,7 @@ _See [helm uninstall](https://helm.sh/docs/helm/helm_uninstall/) for command doc
 ## Upgrading Chart
 
 ```console
-helm upgrade [RELEASE_NAME] [CHART] --install
+helm upgrade [RELEASE_NAME] prometheus-community/prometheus-node-exporter --install
 ```
 
 _See [helm upgrade](https://helm.sh/docs/helm/helm_upgrade/) for command documentation._
@@ -75,3 +75,22 @@ See [Customizing the Chart Before Installing](https://helm.sh/docs/intro/using_h
 ```console
 helm show values prometheus-community/prometheus-node-exporter
 ```
+
+### kube-rbac-proxy
+
+You can enable `prometheus-node-exporter` endpoint protection using `kube-rbac-proxy`. By setting `kubeRBACProxy.enabled: true`, this chart will deploy a RBAC proxy container protecting the node-exporter endpoint.
+To authorize access, authenticate your requests (via a `ServiceAccount` for example) with a `ClusterRole` attached such as:
+
+```yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: prometheus-node-exporter-read
+rules:
+  - apiGroups: [ "" ]
+    resources: ["services/node-exporter-prometheus-node-exporter"]
+    verbs:
+      - get
+```
+
+See [kube-rbac-proxy examples](https://github.com/brancz/kube-rbac-proxy/tree/master/examples/resource-attributes) for more details.

charts/prometheus-node-exporter/prometheus-node-exporter/charts/prometheus-node-exporter/Chart.yaml

@@ -1,5 +1,10 @@
+annotations:
+  artifacthub.io/license: Apache-2.0
+  artifacthub.io/links: |
+    - name: Chart Source
+      url: https://github.com/prometheus-community/helm-charts
 apiVersion: v2
-appVersion: 1.3.1
+appVersion: 1.8.2
 description: A Helm chart for prometheus node-exporter
 home: https://github.com/prometheus/node_exporter/
 keywords:
@@ -11,8 +16,10 @@ maintainers:
   name: gianrubio
 - email: [email protected]
   name: zanhsieh
+- email: [email protected]
+  name: zeritti
 name: prometheus-node-exporter
 sources:
 - https://github.com/prometheus/node_exporter/
 type: application
-version: 4.6.0
+version: 4.41.0

charts/prometheus-node-exporter/prometheus-node-exporter/charts/prometheus-node-exporter/README.md

@@ -1,18 +1,18 @@
-# Prometheus `Node Exporter`
+# Prometheus Node Exporter
 
 Prometheus exporter for hardware and OS metrics exposed by *NIX kernels, written in Go with pluggable metric collectors.
 
-This chart bootstraps a prometheus [`Node Exporter`](http://github.com/prometheus/node_exporter) daemonset on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager.
+This chart bootstraps a Prometheus [Node Exporter](http://github.com/prometheus/node_exporter) daemonset on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager.
 
 ## Get Repository Info
-
+<!-- textlint-disable terminology -->
 ```console
 helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
 helm repo update
 ```
 
-_See [`helm repo`](https://helm.sh/docs/helm/helm_repo/) for command documentation._
-
+_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
+<!-- textlint-enable -->
 ## Install Chart
 
 ```console
@@ -36,7 +36,7 @@ _See [helm uninstall](https://helm.sh/docs/helm/helm_uninstall/) for command doc
 ## Upgrading Chart
 
 ```console
-helm upgrade [RELEASE_NAME] [CHART] --install
+helm upgrade [RELEASE_NAME] prometheus-community/prometheus-node-exporter --install
 ```
 
 _See [helm upgrade](https://helm.sh/docs/helm/helm_upgrade/) for command documentation._
@@ -75,3 +75,22 @@ See [Customizing the Chart Before Installing](https://helm.sh/docs/intro/using_h
 ```console
 helm show values prometheus-community/prometheus-node-exporter
 ```
+
+### kube-rbac-proxy
+
+You can enable `prometheus-node-exporter` endpoint protection using `kube-rbac-proxy`. By setting `kubeRBACProxy.enabled: true`, this chart will deploy a RBAC proxy container protecting the node-exporter endpoint.
+To authorize access, authenticate your requests (via a `ServiceAccount` for example) with a `ClusterRole` attached such as:
+
+```yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: prometheus-node-exporter-read
+rules:
+  - apiGroups: [ "" ]
+    resources: ["services/node-exporter-prometheus-node-exporter"]
+    verbs:
+      - get
+```
+
+See [kube-rbac-proxy examples](https://github.com/brancz/kube-rbac-proxy/tree/master/examples/resource-attributes) for more details.

charts/prometheus-node-exporter/prometheus-node-exporter/charts/prometheus-node-exporter/ci/common-labels-values.yaml

@@ -0,0 +1,4 @@
+---
+commonLabels:
+  foo: bar
+  baz: '{{ include "prometheus-node-exporter.fullname" . }}'

charts/prometheus-node-exporter/prometheus-node-exporter/charts/prometheus-node-exporter/ci/default-values.yaml

@@ -0,0 +1 @@
+## Default values test case

charts/prometheus-node-exporter/prometheus-node-exporter/charts/prometheus-node-exporter/ci/kube-rbac-proxy-tlssecret-values.yaml

@@ -0,0 +1,25 @@
+---
+fullnameOverride: prometheus-node-exporter
+
+kubeRBACProxy:
+  enabled: true
+  tls:
+    enabled: true
+    tlsClientAuth: true
+
+tlsSecret:
+  enabled: true
+  caItem: client-ca.crt
+  secretName: '{{ include "prometheus-node-exporter.fullname" . }}-tls'
+  volumeName: '{{ include "prometheus-node-exporter.fullname" . }}-tls'
+
+extraManifests:
+  - |
+    apiVersion: v1
+    data:
+      client-ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURTekNDQWpPZ0F3SUJBZ0lJY3hXZmlGVnp1WUl3RFFZSktvWklodmNOQVFFTEJRQXdJREVlTUJ3R0ExVUUKQXhNVmJXbHVhV05oSUhKdmIzUWdZMkVnTnpNeE5UbG1NQ0FYRFRJME1EZ3lNekl3TURjMU1Wb1lEekl4TWpRdwpPREl6TWpBd056VXhXakFnTVI0d0hBWURWUVFERXhWdGFXNXBZMkVnY205dmRDQmpZU0EzTXpFMU9XWXdnZ0VpCk1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLQW9JQkFRQy84Q2Y0VVFVaGc3NkpXSGV4c21pc3hYdWQKd2g0UmlJaUJXdFRIdkt0UElTVzdLUEhzRy9pYUppR2VFZ01uZzlCRHBlWmJzbVBzOXBFUkxwRU82bzFRTUYzYwowUnErM1ZIdWN5TWcrVFZ2czB0T1VFYmF3VldNRjdCTjBlbVNBUzBSaFpPaWQ2aEtrRHdiN2JDN3N6U1lwdlZ4Ckk1WGJxZHYrNWdKeEsrSThLRmNkTXJUUmQyUlpQbGlwYmpIbWJQNjhuSHVVbm5rS1kyTDFOR3UwR0xmS2JqRnIKT3hKU1ZMZ29idXZCcW1LTFFQZHZNdkpUTHZYdjBYWFVlRlk3VkVMTVFVSjVwbjU3dlRwU1I4Vzc4MTZnTHQyeApUVWFQcXI1ekpiakQzQllZK3FXQ0JZekNKNkxtbjREUzlJU1FINXlvbjdkREhpcWZKWVZlUy94UUI5cEJBZ01CCkFBR2pnWVl3Z1lNd0RnWURWUjBQQVFIL0JBUURBZ0tFTUIwR0ExVWRKUVFXTUJRR0NDc0dBUVVGQndNQkJnZ3IKQmdFRkJRY0RBakFTQmdOVkhSTUJBZjhFQ0RBR0FRSC9BZ0VBTUIwR0ExVWREZ1FXQkJUN25vTjF6a0R1UFJoOQpWeWtOdlBLeHFRVms4akFmQmdOVkhTTUVHREFXZ0JUN25vTjF6a0R1UFJoOVZ5a052UEt4cVFWazhqQU5CZ2txCmhraUc5dzBCQVFzRkFBT0NBUUVBWFdla3FVcll4Y0h5TWU0ZmUyOXliTDE4cDlqeVB1RDE4Q2x4aXI4V3AzV3UKQm1RUG5qMEdldEo0QnBTazBUOTlVbFZOdUlrT29RcnFBb21VTnpvZWhKcmMrL0dKaHNYTEVKcnZhMFp6TnpiLwpnVHpLSHgxc3YrNnJ4UlJ4ZVlqbVpLZ25kWUgvY1BSVWpvSkJ3azE0Tk5mbG9aN21Id2krN3U3dkM2cW9VMkQ3CjZQemdYSmsvVmNZaHVGMngydFZ2TG1sL05GNlIremxzemJMYXZlMUh2K0ZqbXFMcW0vU2lsdmszdUtWVzlJbGEKTDVJRUVyVkFmVzdXTkdLWWZRZkFVblZ0UTFZTkZoUXNFL3lUQ3JrNXFUZmZuY1VvMmtMNjhOSXB1ZmRMU01zSQpqZUVZdjhEQWJBK2daNEZ2cGt6UjZLZytxcFJvM0JDRmQwbkQ4bDVTUnc9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+      tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURhRENDQWxDZ0F3SUJBZ0lSQUxFTnU3Wit1dC9LZ1NabCs4SjB5ZTB3RFFZSktvWklodmNOQVFFTEJRQXcKSURFZU1Cd0dBMVVFQXhNVmJXbHVhV05oSUhKdmIzUWdZMkVnTnpNeE5UbG1NQ0FYRFRJME1EZ3lOVEV5TlRjMApObG9ZRHpJd056UXdPREV6TVRJMU56UTFXakFqTVNFd0h3WURWUVFERXhod2NtOXRaWFJvWlhWekxXNXZaR1V0ClpYaHdiM0owWlhJd2dnRWlNQTBHQ1NxR1NJYjNEUUVCQVFVQUE0SUJEd0F3Z2dFS0FvSUJBUURNb1pWL2I3NEEKZURBQ2dCZEdpK29tb1Y5VWxyTG12RHdhOE85TGNRNzVIMURDeHpQbFRpdXA3SDNyMXdSSXlWSmduQTRPdmdVdwpHZ1F4UXUwcTdOcSs5YjJLY3lvZ0xLUEo1aWxTb3JPN3QxSm9SMzN0Q281R28zc0tUdEl5cmwvR3NPQndmb1BjCk9ONkhHMWdRZkNpSFNEQnkyRVZvZkoycytKZWN6N2JEQ2Vvb05ZVms4Wm50cGl6ZGg3elloK291VUZJcStuVjUKN01WN05wd1Jhak9qQ2p4RERseHIyWmVvMXpZRGhaTWNxbFd4RmN6YitTUkw4bFJzNVVoOTF5RWMyWENJUnROWgpnR3MvTmpzVXdNQU9jYTVFLzdFRyt6NHFTeTNOV2ZPTnpoWGQ0VTRDRm1EaHJNdzRZZVlEM25iQXpEMTg5bkdxCkl2Z000RTczUGMzSEFnTUJBQUdqZ1pjd2daUXdEZ1lEVlIwUEFRSC9CQVFEQWdXZ01CMEdBMVVkSlFRV01CUUcKQ0NzR0FRVUZCd01CQmdnckJnRUZCUWNEQWpBZEJnTlZIUTRFRmdRVXJ3SUtRM0IydW1lQndTWnBEZmhMYnZobgpDOU13SHdZRFZSMGpCQmd3Rm9BVSs1NkRkYzVBN2owWWZWY3BEYnp5c2FrRlpQSXdJd1lEVlIwUkJCd3dHb0lZCmNISnZiV1YwYUdWMWN5MXViMlJsTFdWNGNHOXlkR1Z5TUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFBOVpFQmkKVFVrZWNuTElab2hteXNqQVU0WTUxV2VyUm90TTNBTFdNZWlENlpadG16Ym9BVkRDQ0FNaWRqZm1zR2xQelhFRgpxU09vZGMwRjl4QURRcWF3K0ZsVmZwcnJ4b1Juc2NGUDBtS08xTFNlaHp6WVZHTUdjL0ZaOXhJTzE5cjdBY2lICkJCdTVSaHljVmkvdlBVbHpGZVZuaEZWcEYwWk1xd0NUK2hXd29KbWVzYzJHaVh3ZEtrNEVCYWptVFVKdUhUbVUKaDc3YWhTQWp5SWNDdWlVcDFrdVk4cllwbHpWdTJWMnFtTEs1Nm9qN2U0T01nYlR4cmwwOVcwOW5UbmMzL3F3dwovR3V2SmhybFhrOFlzOU5tdEdCVnRkSEVhaXhFKzdTSEdTTCszYnIzZjBPSGdNWk5WT0tTTVYzQXFZdUpOWmhSCkM2VVVyRUl3ZkxRNUtXVmQKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
+      tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb2dJQkFBS0NBUUVBektHVmYyKytBSGd3QW9BWFJvdnFKcUZmVkpheTVydzhHdkR2UzNFTytSOVF3c2N6CjVVNHJxZXg5NjljRVNNbFNZSndPRHI0Rk1Cb0VNVUx0S3V6YXZ2Vzlpbk1xSUN5anllWXBVcUt6dTdkU2FFZDkKN1FxT1JxTjdDazdTTXE1ZnhyRGdjSDZEM0RqZWh4dFlFSHdvaDBnd2N0aEZhSHlkclBpWG5NKzJ3d25xS0RXRgpaUEdaN2FZczNZZTgySWZxTGxCU0t2cDFlZXpGZXphY0VXb3pvd284UXc1Y2E5bVhxTmMyQTRXVEhLcFZzUlhNCjIva2tTL0pVYk9WSWZkY2hITmx3aUViVFdZQnJQelk3Rk1EQURuR3VSUCt4QnZzK0trc3R6Vm56amM0VjNlRk8KQWhaZzRhek1PR0htQTk1MndNdzlmUFp4cWlMNERPQk85ejNOeHdJREFRQUJBb0lCQUJWNmxIV1c1Z3Vva2VtQgpSbkFxT1g2cWk1WVdaMXJld1RSV3U5ZGdXNkQ4ajM2U2FEa1dkbkRVbVBjTFQ3RFFLT3hwRlBTcEwyUTRKdDZBCjF1SWRrR3hnNE85S1hVNlpRT3Z0VThNUHZ1dmlOeTBvNitmWXBzeDFWbkhqaWg2MXZPbmZJUC9OMTh0aTBNQy8KdHdPcjlKa1drN2RLU2liSWhjaGxJNHpiSktUZUVuMFhVZWVPdGZFRXNSd0dESmI4aG9ZaHRPSzJDZ3hhWGw2MwpNMUFnMnl6RHFaUERlS0VYSEJ5SU5UTzNNS05RYUdIUWZSbkxBbE51R1FPb0lsMk9RZzl1enArWGsrTFhXN2hsCkdtSXBkZ2VDVXNFOGo5WjJnTmxZRlFiUW9UbkJIaGFqT2pQSWdIUG44QnRjWHlLcVVSeWZ2TlRKWXk3MExTNy8KUlh5ejhZa0NnWUVBMzRoQnBYVXNZVHJrOUFIUE9mYUx2SVAxRm9yRXo5MkFYQVZaLzF4OGc0Q3lIMUkybFlUYgpaMzhnN1IxVXdaWjV1YStYVlhBcVhKY0J6WUhVVlhIUkZ1TkNBT1VuUmFaeTVRVU5uVFJhZXBScjc0UHlPK2JYCmhPWTk5NjVQQlB6WVFxZTgvQWIvTUNQSEZocmxOMDY4ejVkdW9FdEI2YWUxTFBTYmIwcGFSeDBDZ1lFQTZscUUKWVRBWGZCRWxHZ1NUbTlDMmtXQmRiWTFyUHJ3bThVRDFXOTNTTmxnekx1L1dGbkpNRzdWSzVKdS9KczB4b0NEZQo3aUFsYVZubGlEclpXWXcrQm5ESk1LZXhkR0M1akFxM2F2VDhLa1lZUkt0Rktra3N0OUgwTUhmc21iUFJVc0ZqCk9CUTR0a3BMTzQ1WGFYeWZhT2RRcndBZ2g0emFyYkJQdU8rUHZ6TUNnWUJHLzdCYUxXMTdOSW1rTnk3cTZqUlkKSEZHc1owYzcvczdXYTV5NlQxWDlMdE5rdjJnMjlZdjZ3NVpodWY5QnZkbkw4TW5RaVYvcktNdVp5ckwyc01BSQoxUVlSNHJjbW1FZkdGbVRNbWVSakt1RmRvanMrYTRQbzRuaXNRdUUyWkZrTVV0cmo4aFQ3NVdGRzFDUVovUmhiCmwyMjczQ3VEVzVGZ1JoRll0L1VVd1FLQmdHb1dEYVQ5SXpScmduTVRyVW8wb2VDUFVkdTh6OVozVDkyWVBUbVgKNFlmdVIwVXhGcVhVbWJWVlRSRE5uQ3RSYWV5RjFNVFEwbjZ0VGlWc0ZtWGVBVm5qQm9BNitTNm9kblg1aCt3bgorRnFlbm0rL1pERHZMUW9OUmRBSENaak9lS3hRbEx5WEV0RWFNcEpFTGplM1RXWXNpQzZnRFJtdlhuS1B4SmNBCkF2OVhBb0dBREx1YUtJZEhTY1BQVWludDlYSnJLbC9RQktHajZYWDVkVU5mT04xWG1CSWFEZmRQcGdRTWhXdUgKd3pVVURqNk9YYVo0WHBDQW9lcE50YzFhYU5pd0hWQXJOR1ZwcllEL2E5WXBxNWNkY3laTzBQYXJmSk53MkJ0Sgp1ZHIxY1B4SE04VW40REZnNzBiRnpXQVJwZEVwSnk0TjMwWExyUTZJcWlpdHZwaGQ3QTg9Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==
+    kind: Secret
+    metadata:
+      name: '{{ include "prometheus-node-exporter.fullname" . }}-tls'

charts/prometheus-node-exporter/prometheus-node-exporter/charts/prometheus-node-exporter/ci/networkpolicy-values.yaml

@@ -0,0 +1,5 @@
+networkPolicy:
+  enabled: true
+  ingress:
+  - ports:
+    - port: 9100

charts/prometheus-node-exporter/prometheus-node-exporter/charts/prometheus-node-exporter/ci/pod-labels-values.yaml

@@ -0,0 +1,4 @@
+---
+podLabels:
+  foo: bar
+  baz: '{{ .Chart.AppVersion }}'

charts/prometheus-node-exporter/prometheus-node-exporter/charts/prometheus-node-exporter/ci/service-labels-values.yaml

@@ -0,0 +1,5 @@
+---
+service:
+  labels:
+    foo: bar
+    baz: quux

charts/prometheus-node-exporter/prometheus-node-exporter/charts/prometheus-node-exporter/ci/serviceport-values.yaml

@@ -0,0 +1,3 @@
+---
+service:
+  servicePort: 80

charts/prometheus-node-exporter/prometheus-node-exporter/charts/prometheus-node-exporter/templates/NOTES.txt

@@ -13,3 +13,17 @@
   echo "Visit http://127.0.0.1:9100 to use your application"
   kubectl port-forward --namespace {{ template "prometheus-node-exporter.namespace" . }} $POD_NAME 9100
 {{- end }}
+
+{{- if .Values.kubeRBACProxy.enabled}}
+
+kube-rbac-proxy endpoint protections is enabled:
+- Metrics endpoints is now HTTPS
+- Ensure that the client authenticates the requests (e.g. via service account) with the following role permissions:
+```
+rules:
+  - apiGroups: [ "" ]
+    resources: ["services/{{ template "prometheus-node-exporter.fullname" . }}"]
+    verbs:
+      - get
+```
+{{- end }}

charts/prometheus-node-exporter/prometheus-node-exporter/charts/prometheus-node-exporter/templates/_helpers.tpl

@@ -43,8 +43,8 @@ app.kubernetes.io/part-of: {{ include "prometheus-node-exporter.name" . }}
 {{- with .Chart.AppVersion }}
 app.kubernetes.io/version: {{ . | quote }}
 {{- end }}
-{{- with .Values.podLabels }}
-{{ toYaml . }}
+{{- with .Values.commonLabels }}
+{{ tpl (toYaml .) $ }}
 {{- end }}
 {{- if .Values.releaseLabel }}
 release: {{ .Release.Name }}
@@ -76,9 +76,19 @@ The image to use
 */}}
 {{- define "prometheus-node-exporter.image" -}}
 {{- if .Values.image.sha }}
-{{- printf "%s/%s:%s@%s" .Values.image.registry .Values.image.repository (default (printf "v%s" .Chart.AppVersion) .Values.image.tag) .Values.image.sha }}
+{{- fail "image.sha forbidden. Use image.digest instead" }}
+{{- else if .Values.image.digest }}
+{{- if .Values.global.imageRegistry }}
+{{- printf "%s/%s:%s@%s" .Values.global.imageRegistry .Values.image.repository (default (printf "v%s" .Chart.AppVersion) .Values.image.tag) .Values.image.digest }}
 {{- else }}
-{{- printf "%s/%s:%s"  .Values.image.registry .Values.image.repository (default (printf "v%s" .Chart.AppVersion) .Values.image.tag) }}
+{{- printf "%s/%s:%s@%s" .Values.image.registry .Values.image.repository (default (printf "v%s" .Chart.AppVersion) .Values.image.tag) .Values.image.digest }}
+{{- end }}
+{{- else }}
+{{- if .Values.global.imageRegistry }}
+{{- printf "%s/%s:%s" .Values.global.imageRegistry .Values.image.repository (default (printf "v%s" .Chart.AppVersion) .Values.image.tag) }}
+{{- else }}
+{{- printf "%s/%s:%s" .Values.image.registry .Values.image.repository (default (printf "v%s" .Chart.AppVersion) .Values.image.tag) }}
+{{- end }}
 {{- end }}
 {{- end }}
 
@@ -126,3 +136,67 @@ labelNameLengthLimit: {{ . }}
 labelValueLengthLimit: {{ . }}
 {{- end }}
 {{- end }}
+
+{{/*
+Formats imagePullSecrets. Input is (dict "Values" .Values "imagePullSecrets" .{specific imagePullSecrets})
+*/}}
+{{- define "prometheus-node-exporter.imagePullSecrets" -}}
+{{- range (concat .Values.global.imagePullSecrets .imagePullSecrets) }}
+  {{- if eq (typeOf .) "map[string]interface {}" }}
+- {{ toYaml . | trim }}
+  {{- else }}
+- name: {{ . }}
+  {{- end }}
+{{- end }}
+{{- end -}}
+
+{{/*
+Create the namespace name of the pod monitor
+*/}}
+{{- define "prometheus-node-exporter.podmonitor-namespace" -}}
+{{- if .Values.namespaceOverride }}
+{{- .Values.namespaceOverride }}
+{{- else }}
+{{- if .Values.prometheus.podMonitor.namespace }}
+{{- .Values.prometheus.podMonitor.namespace }}
+{{- else }}
+{{- .Release.Namespace }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/* Sets default scrape limits for podmonitor */}}
+{{- define "podmonitor.scrapeLimits" -}}
+{{- with .sampleLimit }}
+sampleLimit: {{ . }}
+{{- end }}
+{{- with .targetLimit }}
+targetLimit: {{ . }}
+{{- end }}
+{{- with .labelLimit }}
+labelLimit: {{ . }}
+{{- end }}
+{{- with .labelNameLengthLimit }}
+labelNameLengthLimit: {{ . }}
+{{- end }}
+{{- with .labelValueLengthLimit }}
+labelValueLengthLimit: {{ . }}
+{{- end }}
+{{- end }}
+
+{{/* Sets sidecar volumeMounts */}}
+{{- define "prometheus-node-exporter.sidecarVolumeMounts" -}}
+{{- range $_, $mount := $.Values.sidecarVolumeMount }}
+- name: {{ $mount.name }}
+  mountPath: {{ $mount.mountPath }}
+  readOnly: {{ $mount.readOnly }}
+{{- end }}
+{{- range $_, $mount := $.Values.sidecarHostVolumeMounts }}
+- name: {{ $mount.name }}
+  mountPath: {{ $mount.mountPath }}
+  readOnly: {{ $mount.readOnly }}
+{{- if $mount.mountPropagation }}
+  mountPropagation: {{ $mount.mountPropagation }}
+{{- end }}
+{{- end }}
+{{- end }}

charts/prometheus-node-exporter/prometheus-node-exporter/charts/prometheus-node-exporter/templates/clusterrole.yaml

@@ -0,0 +1,19 @@
+{{- if and (eq .Values.rbac.create true) (eq .Values.kubeRBACProxy.enabled true) -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "prometheus-node-exporter.fullname" . }}
+  labels:
+    {{- include "prometheus-node-exporter.labels" . | nindent 4 }}
+rules:
+  {{-  if $.Values.kubeRBACProxy.enabled  }}
+  - apiGroups: [ "authentication.k8s.io" ]
+    resources:
+      - tokenreviews
+    verbs: [ "create" ]
+  - apiGroups: [ "authorization.k8s.io" ]
+    resources:
+      - subjectaccessreviews
+    verbs: [ "create" ]
+  {{- end }}
+{{- end -}}

charts/prometheus-node-exporter/prometheus-node-exporter/charts/prometheus-node-exporter/templates/clusterrolebinding.yaml

@@ -0,0 +1,20 @@
+{{- if and (eq .Values.rbac.create true) (eq .Values.kubeRBACProxy.enabled true) -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    {{- include "prometheus-node-exporter.labels" . | nindent 4 }}
+  name: {{ template "prometheus-node-exporter.fullname" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+{{- if .Values.rbac.useExistingRole }}
+  name: {{ .Values.rbac.useExistingRole }}
+{{- else }}
+  name: {{ template "prometheus-node-exporter.fullname" . }}
+{{- end }}
+subjects:
+- kind: ServiceAccount
+  name: {{ template "prometheus-node-exporter.serviceAccountName" . }}
+  namespace: {{ template "prometheus-node-exporter.namespace" . }}
+{{- end -}}