From bbf4f4911f80349979782ea5c18b2fa973771aa8 Mon Sep 17 00:00:00 2001
From: David Hadley <davehadley@users.noreply.github.com>
Date: Mon, 10 Aug 2026 08:06:41 +0100
Subject: [PATCH] chore(charts): upgrade vcluster from 0.28.0 to 0.36.1

---
 charts/workflows-cluster/Chart.lock  |  6 ++--
 charts/workflows-cluster/Chart.yaml  |  4 +--
 charts/workflows-cluster/values.yaml | 53 ++++++++++++++++++++++++++--
 3 files changed, 56 insertions(+), 7 deletions(-)

diff --git a/charts/workflows-cluster/Chart.lock b/charts/workflows-cluster/Chart.lock
index e1b61e97a..e514002e7 100644
--- a/charts/workflows-cluster/Chart.lock
+++ b/charts/workflows-cluster/Chart.lock
@@ -4,9 +4,9 @@ dependencies:
   version: 2.23.0
 - name: vcluster
   repository: https://charts.loft.sh
-  version: 0.28.0
+  version: 0.36.1
 - name: secrets
   repository: file://./charts/secrets
   version: 0.0.18
-digest: sha256:b33147fb1c7b15ffeb219185d1b7eeab1c97bdf0a2cd93d49a1b948bd3ca15b3
-generated: "2026-08-07T10:36:31.823636509+01:00"
+digest: sha256:33c7f258fb406fba2568dc99358d2392aab8cae2c6a621e58a314e9d0fda5296
+generated: "2026-08-10T08:03:22.693209742+01:00"
diff --git a/charts/workflows-cluster/Chart.yaml b/charts/workflows-cluster/Chart.yaml
index 0b4236642..c15b080b0 100644
--- a/charts/workflows-cluster/Chart.yaml
+++ b/charts/workflows-cluster/Chart.yaml
@@ -3,14 +3,14 @@ name: workflows-cluster
 description: A virtual cluster for Data Analysis workflows
 type: application
 
-version: 0.13.21
+version: 0.13.22
 dependencies:
   - name: common
     version: 2.23.0
     repository: oci://docker.io/bitnamicharts
   - name: vcluster
     repository: https://charts.loft.sh
-    version: 0.28.0
+    version: 0.36.1
   - name: secrets
     repository: file://./charts/secrets
     version: 0.0.18
diff --git a/charts/workflows-cluster/values.yaml b/charts/workflows-cluster/values.yaml
index 943d65d13..8b182e793 100644
--- a/charts/workflows-cluster/values.yaml
+++ b/charts/workflows-cluster/values.yaml
@@ -134,7 +134,9 @@ vcluster:
         enabled: true
     fromHost:
       nodes:
-        enabled: true
+        enabled: false
+      events:
+        enabled: false
       secrets:
         enabled: true
         mappings:
@@ -169,11 +171,58 @@ vcluster:
   rbac:
     clusterRole:
       enabled: false
+    role:
+      enabled: true
+      overwriteRules:
+        # Overwrite rules due to incompatibility of defaults with host cluster permissions
+        # On upgrading vCluster version compare these rules with the default rules
+        # (cf helm template with overwriteRules disabled) in case the minimum required permissions change
+        # see: https://www.vcluster.com/docs/vcluster/configure/vcluster-yaml/rbac#overwrite-rules
+        - apiGroups: [""]
+          resources:
+            [
+              "configmaps",
+              "secrets",
+              "services",
+              "pods",
+              "pods/attach",
+              "pods/portforward",
+              "pods/exec",
+              "persistentvolumeclaims",
+            ]
+          verbs: ["create", "delete", "patch", "update", "get", "list", "watch"]
+        - apiGroups: [""]
+          resources: ["pods/status", "pods/ephemeralcontainers"]
+          verbs: ["patch", "update"]
+        - apiGroups: [""]
+          resources: ["pods/resize"]
+          verbs: ["patch", "update"]
+        - apiGroups: ["apps"]
+          resources: ["statefulsets", "replicasets", "deployments"]
+          verbs: ["get", "list", "watch", "patch", "update"]
+        - apiGroups: [""]
+          resources: ["endpoints", "pods/log"]
+          verbs: ["get", "list", "watch"]
+        - apiGroups: [""]
+          resources: ["events"]
+          verbs: ["create", "get", "list", "watch"]
+        - apiGroups: [""]
+          resources: ["endpoints"]
+          verbs: ["create", "delete", "patch", "update"]
+        - apiGroups: ["discovery.k8s.io"]
+          resources: ["endpointslices"]
+          verbs: ["create", "list", "get", "delete", "patch", "update", "watch"]
+        - apiGroups: ["coordination.k8s.io"]
+          resources: ["leases"]
+          verbs: ["create", "list", "get", "delete", "patch", "update", "watch"]
+        - apiGroups: ["networking.k8s.io"]
+          resources: ["ingresses"]
+          verbs: ["create", "list", "get", "delete", "patch", "update", "watch"]
 
   integrations:
     metricsServer:
       enabled: true
-      nodes: true
+      nodes: false
       pods: true
 
 ingress: