chore(deps): update dependency victoriametrics/victoriametrics-datasource to v0.26.1

[renovate]

This PR contains the following updates:

Package	Update	Change
VictoriaMetrics/victoriametrics-datasource	minor	0.25.2 → 0.26.1

---

Release Notes

VictoriaMetrics/victoriametrics-datasource (VictoriaMetrics/victoriametrics-datasource)

v0.26.1

Compare Source

• MAINTENANCE: fix the frontend build of the plugin.

v0.26.0

Compare Source

• FEATURE: align start and end of range queries to the query step. See #​539.

  • Note: if a query returns 50 or more data points, VictoriaMetrics shifts start and end a bit further on its own side to make response caching work, so the returned timestamps may not match the selected time range exactly. Add nocache=1 to the datasource custom query parameters to turn this off.

• BUGFIX: bring back warning about partial response. See #​542. Thanks to @​ilyalabun for contributing.

• BUGFIX: send start, end and time query params as unix milliseconds instead of whole seconds, so zoomed-in graphs with sub-second steps are no longer cut off at the edges. See #​539.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

🔍 Rendered manifest diff — this PR vs main (desired state)

1 changed · 0 added · 0 removed

Rendered with kustomize build + helm template (source of truth = git), so Helm-expanded workloads are included. Shows what Flux will apply — not a diff against live cluster state (drift is alerted on separately), and not CRD-defaulted / webhook-mutated output. Secret values are redacted; per-render noise (webhook caBundles, checksum/* annotations, render timestamps) is normalized out.

🟡 changed — v1/ConfigMap/observability/vm-common-helm-values

--- a/v1/ConfigMap/observability/vm-common-helm-values
+++ b/v1/ConfigMap/observability/vm-common-helm-values
@@ -1,6 +1,6 @@
 apiVersion: v1
 data:
-  values.yaml: "tenant: \"0\"\n\ndefaultRules:\n  # The control-plane components below are a managed service on EKS (and\n  # kube-proxy is replaced by Cilium), so they are not scraped \u2014 see the\n  # kube* toggles further down. Their default *Down alerts evaluate\n  # absent(up{job=...}) and would therefore fire forever. Disable the\n  # matching rule groups so the alerts track the scrape config.\n  groups:\n    kubernetes-system-apiserver:\n      create: false\n    kubernetes-system-controller-manager:\n      create: false\n    kubernetes-system-scheduler:\n      create: false\n  rule:\n    spec:\n      annotations:\n        dashboard: \"https://grafana.priv.gcp.cluster.local/dashboards\"\n\ngrafanaOperatorDashboardsFormat:\n  enabled: true\n  instanceSelector:\n    matchLabels:\n      dashboards: \"grafana\"\n  allowCrossNamespaceImport: false\n\nvmagent:\n  externalLabels:\n    cluster: \"foobar\"\n\n# vmagent's externalLabels are NOT enough, because alerts do not come from\n# vmagent -- they come from vmalert, and most upstream rules aggregate the\n# cluster label away. CPUThrottlingHigh, for instance, sums\n# `by (container, pod, namespace)`, so whatever vmagent attached is gone by\n# the time the alert fires.\n#\n# The result reached Slack as, literally:\n#\n#   27.78% throttling of CPU in namespace tooling for container metrics\n#   in pod xplane-harbor-valkey-... on cluster .\n#\n# -- an empty cluster, which is harmless with one cluster and useless with\n# two. It also silently broke the route's `group_by: [cluster, ...]`:\n# grouping on a label nothing carries groups everything together.\n#\n# vmalert stamps these onto every alert it generates, after rule evaluation,\n# so no aggregation can drop them.\nvmalert:\n  spec:\n    externalLabels:\n      cluster: \"foobar\"\n\nalertmanager:\n  enabled: true\n  spec:\n    externalURL: \"https://vmalertmanager-foobar.priv.gcp.cluster.local\"\n    secrets:\n      - \"victoria-metrics-k8s-stack-alertmanager-slack-app\"\n      - \"runlore-webhook-token\"\n  config:\n    global:\n      slack_api_url: \"https://slack.com/api/chat.postMessage\"\n      http_config:\n        authorization:\n          credentials_file: /etc/vm/secrets/victoria-metrics-k8s-stack-alertmanager-slack-app/token\n    route:\n      group_by:\n        - cluster\n        - alertname\n        - severity\n        - namespace\n      group_interval: 5m\n      group_wait: 30s\n      repeat_interval: 3h\n      receiver: \"slack-monitoring\"\n      routes:\n        - matchers:\n            - alertname =~ \"InfoInhibitor|Watchdog|KubeCPUOvercommit\"\n          receiver: \"blackhole\"\n        # Send a copy of every non-blackholed alert to the RunLore SRE agent,\n        # then continue so Slack still receives it. RunLore's own trigger policy\n        # decides which alerts it actually investigates.\n        - receiver: \"runlore\"\n          continue: true\n        # Explicit Slack catch-all (required because the route above matches all\n        # with continue: true, so the root receiver no longer fires on its own).\n        - receiver: \"slack-monitoring\"\n    receivers:\n      - name: \"blackhole\"\n      - name: \"runlore\"\n        webhook_configs:\n          - url: \"http://runlore.runlore.svc:8080/webhook/alertmanager\"\n            send_resolved: true\n            # v0.2.0 fails closed: the runlore agent requires a bearer token on\n            # /webhook/alertmanager once a model is configured. Per-receiver\n            # http_config overrides the global (Slack) one; the token is mounted\n            # from the runlore-webhook-token secret (spec.secrets above).\n            http_config:\n              authorization:\n                credentials_file: /etc/vm/secrets/runlore-webhook-token/token\n      - name: \"slack-monitoring\"\n        slack_configs:\n          - channel: \"#alerts\"\n            send_resolved: true\n            title: '{{ template \"slack.monzo.title\" . }}'\n            icon_emoji: '{{ template \"slack.monzo.icon_emoji\" . }}'\n            color: '{{ template \"slack.monzo.color\" . }}'\n            text: '{{ template \"slack.monzo.text\" . }}'\n            actions:\n              - type: button\n                text: \"Runbook :green_book:\"\n                url: \"{{ (index .Alerts 0).Annotations.runbook_url }}\"\n              - type: button\n                text: \"Query :mag:\"\n                url: \"{{ (index .Alerts 0).GeneratorURL }}\"\n              - type: button\n                text: \"Dashboard :grafana:\"\n                url: \"{{ (index .Alerts 0).Annotations.dashboard }}\"\n              - type: button\n                text: \"Silence :no_bell:\"\n                url: '{{ template \"__alert_silence_link\" . }}'\n              - type: button\n                text: '{{ template \"slack.monzo.link_button_text\" . }}'\n                url: \"{{ .CommonAnnotations.link_url }}\"\n\ndefaultDashboards:\n  enabled: true\n  grafanaOperator:\n      enabled: true\n      spec:\n        instanceSelector:\n          matchLabels:\n            dashboards: \"grafana\"\n        allowCrossNamespaceImport: true\n        # Place VictoriaMetrics dashboards in \"observability\" folder\n        folder: \"observability\"\n  dashboards:\n    # THE KEY IS THE RENDERED NAME'S SUFFIX, and getting it wrong fails\n    # SILENTLY. Each dashboard becomes\n    # `victoria-metrics-k8s-stack-dashboard-<key>`, so read the key off a live\n    # object: `kubectl get grafanadashboard -n observability`. A key matching\n    # no dashboard is accepted, written into the sync-job ConfigMap, and does\n    # nothing -- there is no error and no warning.\n    #\n    # That is not hypothetical. Four entries here were `k8s-views-*` while the\n    # chart's keys are `kubernetes-views-*`, so the block below did NOTHING for\n    # as long as it existed, and its own comment (\"already managed manually in\n    # infrastructure namespace\") described a de-duplication that never\n    # happened: both copies shipped, fighting over one Grafana UID.\n    # Resolved on 2026-08-28 the other way round -- the hand-maintained copies\n    # in observability/base/grafana-operator were dropped and the chart's\n    # vendored ones kept -- so those four entries are gone rather than\n    # corrected.\n    #\n    # Operating systems this platform does not run. Every node on both clusters\n    # is Linux (Bottlerocket on aws-0, Container-Optimized OS on gcp-0), so\n    # these seven drew empty panels and made up 7 of 63 dashboards.\n    #\n    # Disabled HERE and not via a HelmRelease postRenderer: these are created\n    # at RUNTIME by the chart's sync-job (labelled `managed-by: sync-job`, owned\n    # by its ServiceAccount), not rendered by `helm template`. A postRenderer\n    # sees nothing to delete -- tried, and it was a silent no-op.\n    k8s-resources-windows-cluster:\n      enabled: false\n    k8s-resources-windows-namespace:\n      enabled: false\n    k8s-resources-windows-pod:\n      enabled: false\n    k8s-windows-cluster-rsrc-use:\n      enabled: false\n    k8s-windows-node-rsrc-use:\n      enabled: false\n    nodes-aix:\n      enabled: false\n    nodes-darwin:\n      enabled: false\n    # Ours, from observability/base/grafana-operator, is the only\n    # node-exporter-full deployed -- this key is correct and effective.\n    node-exporter-full:\n      enabled: false\n    # Enable VictoriaMetrics-specific dashboards\n    victoriametrics-vmalert:\n      enabled: true\n    victoriametrics-operator:\n      enabled: true\n\ngrafana:\n  sidecar:\n    datasources:\n      enabled: true\n      initDatasources: false\n  # dashboards come from grafana-operator CRs and the chart sync-job only \u2014 no file-provider sidecar.\n  image:\n    # Overrides the grafana subchart's default (13.1.x). The vm-k8s-stack pins\n    # `grafana: 12.7.*`, so the Grafana APP version is controlled by that\n    # subchart constraint, not by Renovate \u2014 security releases (here the\n    # 2026-08-18 one) need this explicit tag until the stack bumps its dep.\n    tag: \"13.1.4\"\n  plugins:\n    # Signed catalog plugins, pinned. These replaced two curl initContainers:\n    # one frozen at v0.14.0 for 16 months, one fetching GitHub \"latest\" at\n    # every pod start. The chart maps this list straight to\n    # GF_PLUGINS_PREINSTALL_SYNC, whose pin separator is \"@\" \u2014 a space\n    # (like \"id version\") is silently split as two bare plugin ids instead,\n    # so the version half becomes a bogus plugin id on a fail-hard preinstall\n    # path and the real plugin installs UNPINNED. Use \"<id>@<version>\".\n    # renovate: datasource=github-releases depName=VictoriaMetrics/victoriametrics-datasource extractVersion=^v(?<version>.+)$\n    - \"victoriametrics-metrics-datasource@0.25.2\"\n    # These pins are tracked from GITHUB RELEASES but installed from the\n    # GRAFANA.COM CATALOG, and the two publish independently -- a tag can\n    # exist on GitHub days before (or without ever) reaching the catalog.\n    # Renovate has no catalog datasource, so it cannot see the difference.\n    #\n    # 0.32.0 was merged that way (#1959) and the catalog did not have it:\n    #   failed to install plugin victoriametrics-logs-datasource@0.32.0:\n    #   [plugin.versionNotFound] ... was not returned by the Grafana.com catalog\n    # Grafana then refuses to start at all -- the plugin installer is a\n    # startup module, so this is CrashLoopBackOff rather than a missing\n    # datasource, and it takes observability -> tooling -> apps down with it.\n    #\n    # Before accepting a bump here, check the version is actually published:\n    #   curl -s https://grafana.com/api/plugins/<plugin-id>/versions | jq -r '.items[].version'\n    # renovate: datasource=github-releases depName=VictoriaMetrics/victorialogs-datasource extractVersion=^v(?<version>.+)$\n    - \"victoriametrics-logs-datasource@0.32.0\"\n    - \"marcusolsson-dynamictext-panel\"\n  \"grafana.ini\":\n    feature_toggles:\n      enable: externalServiceAccounts\n    server:\n      root_url: \"https://grafana.priv.gcp.cluster.local\"\n      domain: \"grafana.priv.gcp.cluster.local\"\n    auth.generic_oauth:\n      enabled: true\n      name: \"SSO\"\n      allow_sign_up: true\n      scopes: \"openid profile email\"\n      auth_url: \"https://auth.cluster.local/oauth/v2/authorize\"\n      token_url: \"https://auth.cluster.local/oauth/v2/token\"\n      api_url: \"https://auth.cluster.local/oidc/v1/userinfo\"\n      role_attribute_path: >\n        contains(roles[*], 'admin') && 'Admin' ||\n        contains(roles[*], 'backend') && 'Editor' ||\n        contains(roles[*], 'frontend') && 'Editor' ||\n        contains(roles[*], 'data') && 'Editor' ||\n        'Viewer'\n  admin:\n    existingSecret: \"victoria-metrics-k8s-stack-grafana-envvars\"\n    userKey: \"GF_SECURITY_ADMIN_USER\"\n    passwordKey: \"GF_SECURITY_ADMIN_PASSWORD\"\n  envFromSecret: \"victoria-metrics-k8s-stack-grafana-envvars\"\n# Do not scrape controlplane components as it is a managed service on EKS\nkubeApiServer:\n  enabled: false\nkubeControllerManager:\n  enabled: false\nkubeEtcd:\n  enabled: false\nkubeScheduler:\n  enabled: false\nkubeProxy:\n  enabled: false\n\n# Deployed with all the other CRDs, flux kustomization\ncrds:\n  enabled: false\n\n# Avoid webhook chicken-and-egg: operator pod may not be ready when CRs are created\nvictoria-metrics-operator:\n  admissionWebhooks:\n    policy: Ignore\n"
+  values.yaml: "tenant: \"0\"\n\ndefaultRules:\n  # The control-plane components below are a managed service on EKS (and\n  # kube-proxy is replaced by Cilium), so they are not scraped \u2014 see the\n  # kube* toggles further down. Their default *Down alerts evaluate\n  # absent(up{job=...}) and would therefore fire forever. Disable the\n  # matching rule groups so the alerts track the scrape config.\n  groups:\n    kubernetes-system-apiserver:\n      create: false\n    kubernetes-system-controller-manager:\n      create: false\n    kubernetes-system-scheduler:\n      create: false\n  rule:\n    spec:\n      annotations:\n        dashboard: \"https://grafana.priv.gcp.cluster.local/dashboards\"\n\ngrafanaOperatorDashboardsFormat:\n  enabled: true\n  instanceSelector:\n    matchLabels:\n      dashboards: \"grafana\"\n  allowCrossNamespaceImport: false\n\nvmagent:\n  externalLabels:\n    cluster: \"foobar\"\n\n# vmagent's externalLabels are NOT enough, because alerts do not come from\n# vmagent -- they come from vmalert, and most upstream rules aggregate the\n# cluster label away. CPUThrottlingHigh, for instance, sums\n# `by (container, pod, namespace)`, so whatever vmagent attached is gone by\n# the time the alert fires.\n#\n# The result reached Slack as, literally:\n#\n#   27.78% throttling of CPU in namespace tooling for container metrics\n#   in pod xplane-harbor-valkey-... on cluster .\n#\n# -- an empty cluster, which is harmless with one cluster and useless with\n# two. It also silently broke the route's `group_by: [cluster, ...]`:\n# grouping on a label nothing carries groups everything together.\n#\n# vmalert stamps these onto every alert it generates, after rule evaluation,\n# so no aggregation can drop them.\nvmalert:\n  spec:\n    externalLabels:\n      cluster: \"foobar\"\n\nalertmanager:\n  enabled: true\n  spec:\n    externalURL: \"https://vmalertmanager-foobar.priv.gcp.cluster.local\"\n    secrets:\n      - \"victoria-metrics-k8s-stack-alertmanager-slack-app\"\n      - \"runlore-webhook-token\"\n  config:\n    global:\n      slack_api_url: \"https://slack.com/api/chat.postMessage\"\n      http_config:\n        authorization:\n          credentials_file: /etc/vm/secrets/victoria-metrics-k8s-stack-alertmanager-slack-app/token\n    route:\n      group_by:\n        - cluster\n        - alertname\n        - severity\n        - namespace\n      group_interval: 5m\n      group_wait: 30s\n      repeat_interval: 3h\n      receiver: \"slack-monitoring\"\n      routes:\n        - matchers:\n            - alertname =~ \"InfoInhibitor|Watchdog|KubeCPUOvercommit\"\n          receiver: \"blackhole\"\n        # Send a copy of every non-blackholed alert to the RunLore SRE agent,\n        # then continue so Slack still receives it. RunLore's own trigger policy\n        # decides which alerts it actually investigates.\n        - receiver: \"runlore\"\n          continue: true\n        # Explicit Slack catch-all (required because the route above matches all\n        # with continue: true, so the root receiver no longer fires on its own).\n        - receiver: \"slack-monitoring\"\n    receivers:\n      - name: \"blackhole\"\n      - name: \"runlore\"\n        webhook_configs:\n          - url: \"http://runlore.runlore.svc:8080/webhook/alertmanager\"\n            send_resolved: true\n            # v0.2.0 fails closed: the runlore agent requires a bearer token on\n            # /webhook/alertmanager once a model is configured. Per-receiver\n            # http_config overrides the global (Slack) one; the token is mounted\n            # from the runlore-webhook-token secret (spec.secrets above).\n            http_config:\n              authorization:\n                credentials_file: /etc/vm/secrets/runlore-webhook-token/token\n      - name: \"slack-monitoring\"\n        slack_configs:\n          - channel: \"#alerts\"\n            send_resolved: true\n            title: '{{ template \"slack.monzo.title\" . }}'\n            icon_emoji: '{{ template \"slack.monzo.icon_emoji\" . }}'\n            color: '{{ template \"slack.monzo.color\" . }}'\n            text: '{{ template \"slack.monzo.text\" . }}'\n            actions:\n              - type: button\n                text: \"Runbook :green_book:\"\n                url: \"{{ (index .Alerts 0).Annotations.runbook_url }}\"\n              - type: button\n                text: \"Query :mag:\"\n                url: \"{{ (index .Alerts 0).GeneratorURL }}\"\n              - type: button\n                text: \"Dashboard :grafana:\"\n                url: \"{{ (index .Alerts 0).Annotations.dashboard }}\"\n              - type: button\n                text: \"Silence :no_bell:\"\n                url: '{{ template \"__alert_silence_link\" . }}'\n              - type: button\n                text: '{{ template \"slack.monzo.link_button_text\" . }}'\n                url: \"{{ .CommonAnnotations.link_url }}\"\n\ndefaultDashboards:\n  enabled: true\n  grafanaOperator:\n      enabled: true\n      spec:\n        instanceSelector:\n          matchLabels:\n            dashboards: \"grafana\"\n        allowCrossNamespaceImport: true\n        # Place VictoriaMetrics dashboards in \"observability\" folder\n        folder: \"observability\"\n  dashboards:\n    # THE KEY IS THE RENDERED NAME'S SUFFIX, and getting it wrong fails\n    # SILENTLY. Each dashboard becomes\n    # `victoria-metrics-k8s-stack-dashboard-<key>`, so read the key off a live\n    # object: `kubectl get grafanadashboard -n observability`. A key matching\n    # no dashboard is accepted, written into the sync-job ConfigMap, and does\n    # nothing -- there is no error and no warning.\n    #\n    # That is not hypothetical. Four entries here were `k8s-views-*` while the\n    # chart's keys are `kubernetes-views-*`, so the block below did NOTHING for\n    # as long as it existed, and its own comment (\"already managed manually in\n    # infrastructure namespace\") described a de-duplication that never\n    # happened: both copies shipped, fighting over one Grafana UID.\n    # Resolved on 2026-08-28 the other way round -- the hand-maintained copies\n    # in observability/base/grafana-operator were dropped and the chart's\n    # vendored ones kept -- so those four entries are gone rather than\n    # corrected.\n    #\n    # Operating systems this platform does not run. Every node on both clusters\n    # is Linux (Bottlerocket on aws-0, Container-Optimized OS on gcp-0), so\n    # these seven drew empty panels and made up 7 of 63 dashboards.\n    #\n    # Disabled HERE and not via a HelmRelease postRenderer: these are created\n    # at RUNTIME by the chart's sync-job (labelled `managed-by: sync-job`, owned\n    # by its ServiceAccount), not rendered by `helm template`. A postRenderer\n    # sees nothing to delete -- tried, and it was a silent no-op.\n    k8s-resources-windows-cluster:\n      enabled: false\n    k8s-resources-windows-namespace:\n      enabled: false\n    k8s-resources-windows-pod:\n      enabled: false\n    k8s-windows-cluster-rsrc-use:\n      enabled: false\n    k8s-windows-node-rsrc-use:\n      enabled: false\n    nodes-aix:\n      enabled: false\n    nodes-darwin:\n      enabled: false\n    # Ours, from observability/base/grafana-operator, is the only\n    # node-exporter-full deployed -- this key is correct and effective.\n    node-exporter-full:\n      enabled: false\n    # Enable VictoriaMetrics-specific dashboards\n    victoriametrics-vmalert:\n      enabled: true\n    victoriametrics-operator:\n      enabled: true\n\ngrafana:\n  sidecar:\n    datasources:\n      enabled: true\n      initDatasources: false\n  # dashboards come from grafana-operator CRs and the chart sync-job only \u2014 no file-provider sidecar.\n  image:\n    # Overrides the grafana subchart's default (13.1.x). The vm-k8s-stack pins\n    # `grafana: 12.7.*`, so the Grafana APP version is controlled by that\n    # subchart constraint, not by Renovate \u2014 security releases (here the\n    # 2026-08-18 one) need this explicit tag until the stack bumps its dep.\n    tag: \"13.1.4\"\n  plugins:\n    # Signed catalog plugins, pinned. These replaced two curl initContainers:\n    # one frozen at v0.14.0 for 16 months, one fetching GitHub \"latest\" at\n    # every pod start. The chart maps this list straight to\n    # GF_PLUGINS_PREINSTALL_SYNC, whose pin separator is \"@\" \u2014 a space\n    # (like \"id version\") is silently split as two bare plugin ids instead,\n    # so the version half becomes a bogus plugin id on a fail-hard preinstall\n    # path and the real plugin installs UNPINNED. Use \"<id>@<version>\".\n    # renovate: datasource=github-releases depName=VictoriaMetrics/victoriametrics-datasource extractVersion=^v(?<version>.+)$\n    - \"victoriametrics-metrics-datasource@0.26.1\"\n    # These pins are tracked from GITHUB RELEASES but installed from the\n    # GRAFANA.COM CATALOG, and the two publish independently -- a tag can\n    # exist on GitHub days before (or without ever) reaching the catalog.\n    # Renovate has no catalog datasource, so it cannot see the difference.\n    #\n    # 0.32.0 was merged that way (#1959) and the catalog did not have it:\n    #   failed to install plugin victoriametrics-logs-datasource@0.32.0:\n    #   [plugin.versionNotFound] ... was not returned by the Grafana.com catalog\n    # Grafana then refuses to start at all -- the plugin installer is a\n    # startup module, so this is CrashLoopBackOff rather than a missing\n    # datasource, and it takes observability -> tooling -> apps down with it.\n    #\n    # Before accepting a bump here, check the version is actually published:\n    #   curl -s https://grafana.com/api/plugins/<plugin-id>/versions | jq -r '.items[].version'\n    # renovate: datasource=github-releases depName=VictoriaMetrics/victorialogs-datasource extractVersion=^v(?<version>.+)$\n    - \"victoriametrics-logs-datasource@0.32.0\"\n    - \"marcusolsson-dynamictext-panel\"\n  \"grafana.ini\":\n    feature_toggles:\n      enable: externalServiceAccounts\n    server:\n      root_url: \"https://grafana.priv.gcp.cluster.local\"\n      domain: \"grafana.priv.gcp.cluster.local\"\n    auth.generic_oauth:\n      enabled: true\n      name: \"SSO\"\n      allow_sign_up: true\n      scopes: \"openid profile email\"\n      auth_url: \"https://auth.cluster.local/oauth/v2/authorize\"\n      token_url: \"https://auth.cluster.local/oauth/v2/token\"\n      api_url: \"https://auth.cluster.local/oidc/v1/userinfo\"\n      role_attribute_path: >\n        contains(roles[*], 'admin') && 'Admin' ||\n        contains(roles[*], 'backend') && 'Editor' ||\n        contains(roles[*], 'frontend') && 'Editor' ||\n        contains(roles[*], 'data') && 'Editor' ||\n        'Viewer'\n  admin:\n    existingSecret: \"victoria-metrics-k8s-stack-grafana-envvars\"\n    userKey: \"GF_SECURITY_ADMIN_USER\"\n    passwordKey: \"GF_SECURITY_ADMIN_PASSWORD\"\n  envFromSecret: \"victoria-metrics-k8s-stack-grafana-envvars\"\n# Do not scrape controlplane components as it is a managed service on EKS\nkubeApiServer:\n  enabled: false\nkubeControllerManager:\n  enabled: false\nkubeEtcd:\n  enabled: false\nkubeScheduler:\n  enabled: false\nkubeProxy:\n  enabled: false\n\n# Deployed with all the other CRDs, flux kustomization\ncrds:\n  enabled: false\n\n# Avoid webhook chicken-and-egg: operator pod may not be ready when CRs are created\nvictoria-metrics-operator:\n  admissionWebhooks:\n    policy: Ignore\n"
 kind: ConfigMap
 metadata:
   name: vm-common-helm-values