Update Helm release grafana to v12.4.4

[renovate]

This PR contains the following updates:

Package	Update	Change	Pending
grafana (source)	patch	12.4.1 → 12.4.4	12.7.1 (+8)

---

Release Notes

grafana-community/helm-charts (grafana)

v12.4.4

Compare Source

The leading tool for querying and visualizing time series and metrics.

What's Changed

• [CI] Modify PR template for AI identification and testing by @​jkroepke in #​566
• [grafana] Fix skipTlsVerify consistent across all sidecars with per-sidecar override support by @​Alja9 in #​565

Full Changelog: grafana-community/helm-charts@grafana-12.4.3...grafana-12.4.4

v12.4.3

Compare Source

The leading tool for querying and visualizing time series and metrics.

What's Changed

• [grafana] Fix VPA namespace to respect namespaceOverride by @​Alja9 in #​564

New Contributors

• @​Alja9 made their first contribution in #​564

Full Changelog: grafana-community/helm-charts@tempo-distributed-2.23.5...grafana-12.4.3

v12.4.2

Compare Source

The leading tool for querying and visualizing time series and metrics.

What's Changed

• [grafana] allow init-chown-data to traverse restricted persisted directories by @​Copilot in #​536

Full Changelog: grafana-community/helm-charts@tempo-distributed-2.23.4...grafana-12.4.2

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • "after 12am and before 2am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

grafana (helm) 12.4.1 -> 12.4.4

Risk: 🟡 Caution

The Deep Dive

Update Scope

Updates the grafana Helm dependency in kubernetes/grafana/Chart.yaml from 12.4.1 to 12.4.4. The upstream chart appVersion stays 13.0.1-security-01, and the PR diff does not change the rendered docker.io/grafana/grafana:13.0.1-security-01 container image. This is a chart-scaffolding update, not a Grafana application upgrade.

Performance & Stability

• grafana-community/helm-charts PR 536 adds DAC_OVERRIDE to init-chown-data so the startup chown -R /var/lib/grafana can traverse persisted subdirectories with restrictive permissions. The PR diff renders that change, and this deployment has persistence enabled, so the fix applies to the existing Grafana data PVC.

Newer Versions

• grafana-12.7.1 is newer than this PR's grafana-12.4.4. I reviewed the release bodies for 12.4.5, 12.4.6, 12.4.7, 12.4.8, 12.4.9, 12.5.0, 12.6.0, 12.7.0, and 12.7.1; none is a regression fix for behavior introduced by 12.4.4.
• The notable later chart fix grafana-community/helm-charts PR 606 corrects inline env quoting for backslashes/special characters; the local inline env value is only GF_SECURITY_DISABLE_INITIAL_ADMIN_CREATION: 'true', so it is not a new risk from this PR.

Hazards & Risks

• grafana-community/helm-charts PR 536 is also a runtime permission expansion: the root init-chown-data init container now requests DAC_OVERRIDE in addition to CHOWN. In this repo it is limited to the existing persistence ownership init container, but clusters with admission policies that disallow added capabilities may reject the rendered Pod spec.
• Targeted validation beyond normal render/lint checks: run a cluster-connected Kubernetes dry-run such as kubectl apply --server-side --dry-run=server -k kubernetes/grafana/ to confirm admission accepts the rendered Grafana Pod with DAC_OVERRIDE. The Render Helm Charts check passed, and Kubernetes dry-run requests are not persisted, but this CI-mode evaluation cannot query the live cluster admission chain.

Sources

• Grafana chart 12.4.4 release
• Grafana chart PR 536 init-chown-data capability change
• Grafana chart PR 564 VPA namespaceOverride fix
• Grafana chart PR 565 sidecar skipTlsVerify fix
• Grafana chart 12.4.5 release
• Grafana chart 12.4.6 release
• Grafana chart 12.4.7 release
• Grafana chart 12.4.8 release
• Grafana chart 12.4.9 release
• Grafana chart 12.5.0 release
• Grafana chart 12.6.0 release
• Grafana chart 12.7.0 release
• Grafana chart 12.7.1 release
• Grafana chart PR 606 env quoting fix
• PR 2396 file diff
• Grafana community Helm chart security advisories
• Kubernetes dry-run API concept

---

🟡 Verdict: Caution

renovate:caution because grafana-community/helm-charts PR 536 expands the persistent-volume init container capability set, which warrants a cluster-connected server-side dry-run admission check for DAC_OVERRIDE. The rest is low risk: the PR diff leaves the Grafana app image unchanged, the Render Helm Charts check passed, and the newer Grafana chart release bodies do not show a 12.4.4 regression fixed later.