[kube-prometheus-stack] Fix admission webhook DNS name rendering

[vitrix1]

To prevent Error: YAML parse error on charts/kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/job-patch/job-createSecret.yaml: error converting YAML to JSON: yaml: line 45: did not find expected key

What this PR does / why we need it
Fixes broken DNS SAN in admission webhook cert caused by whitespace in Helm template.

Special notes for your reviewer
Without this change, the rendered DNS name contains a leading space, causing invalid SANs in the webhook TLS certificate.

cc @andrewgkew @gianrubio @gkarthiks @GMartinez-Sisti @jkroepke @Xtigyro @QuentinBisson

Special notes for your reviewer

Checklist

• DCO signed
• Chart Version bumped
• Title of the PR starts with chart name (e.g. [prometheus-couchdb-exporter])

[jkroepke]

Do you have a minimal reproducible example? That triggers this error?

[vitrix1]

Sure!
Here my values to install kube-prometheus-stack:

  prometheus:
    enabled: true
  grafana:
    enabled: false
  alertmanager:
    enabled: false
  kubeStateMetrics:
    enabled: false
  prometheusOperator:
    enabled: true
  nodeExporter:
    enabled: false

helm install kps prometheus-community/kube-prometheus-stack -f values.yaml 

[jkroepke]

Somehow, it looks good to me:

helm template oci://ghcr.io/prometheus-community/charts/kube-prometheus-stack -f a.yaml -s templates/prometheus-operator/admission-webhooks/job-patch/job-createSecret.yaml

---
# Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/job-patch/job-createSecret.yaml
apiVersion: batch/v1
kind: Job
metadata:
  name:  release-name-kube-promethe-admission-create
  namespace: default
  annotations:
    "helm.sh/hook": pre-install,pre-upgrade
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
  labels:
    app: kube-prometheus-stack-admission-create
    
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/instance: release-name
    app.kubernetes.io/version: "81.6.0"
    app.kubernetes.io/part-of: kube-prometheus-stack
    chart: kube-prometheus-stack-81.6.0
    release: "release-name"
    heritage: "Helm"
    app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
    app.kubernetes.io/component: prometheus-operator-webhook
spec:
  ttlSecondsAfterFinished: 60
  template:
    metadata:
      name:  release-name-kube-promethe-admission-create
      labels:
        app: kube-prometheus-stack-admission-create
        
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/instance: release-name
        app.kubernetes.io/version: "81.6.0"
        app.kubernetes.io/part-of: kube-prometheus-stack
        chart: kube-prometheus-stack-81.6.0
        release: "release-name"
        heritage: "Helm"
        app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
        app.kubernetes.io/component: prometheus-operator-webhook
    spec:
      containers:
        - name: create
          image: ghcr.io/jkroepke/kube-webhook-certgen:1.7.4
          imagePullPolicy: IfNotPresent
          args:
            - create
            - --host=release-name-kube-promethe-operator,release-name-kube-promethe-operator.default.svc
            - --namespace=default
            - --secret-name=release-name-kube-promethe-admission
          securityContext:
          
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
          resources:
            {}
      restartPolicy: OnFailure
      serviceAccountName: release-name-kube-promethe-admission
      securityContext:
        runAsGroup: 2000
        runAsNonRoot: true
        runAsUser: 2000
        seccompProfile:
          type: RuntimeDefault

Otherwise, it must break for each end user installation. What is special on your side?

[vitrix1]

If I do this:

helm template kube-prometheus-stack/ -f kube-prometheus-stack/vls.yaml   --debug

I get this:

Error: YAML parse error on kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/job-patch/job-createSecret.yaml: error converting YAML to JSON: yaml: line 45: did not find expected key
helm.go:92: 2026-02-13 04:37:28.412829253 -0500 EST m=+1.086760437 [debug] error converting YAML to JSON: yaml: line 45: did not find expected key
YAML parse error on kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/job-patch/job-createSecret.yaml
helm.sh/helm/v3/pkg/releaseutil.(*manifestFile).sort
        helm.sh/helm/v3/pkg/releaseutil/manifest_sorter.go:152
helm.sh/helm/v3/pkg/releaseutil.SortManifests
        helm.sh/helm/v3/pkg/releaseutil/manifest_sorter.go:104
helm.sh/helm/v3/pkg/action.(*Configuration).renderResources
        helm.sh/helm/v3/pkg/action/action.go:172
helm.sh/helm/v3/pkg/action.(*Install).RunWithContext
        helm.sh/helm/v3/pkg/action/install.go:317
main.runInstall
        helm.sh/helm/v3/cmd/helm/install.go:317
main.newTemplateCmd.func2
        helm.sh/helm/v3/cmd/helm/template.go:95
github.com/spf13/cobra.(*Command).execute
        github.com/spf13/cobra@v1.10.1/command.go:1015
github.com/spf13/cobra.(*Command).ExecuteC
        github.com/spf13/cobra@v1.10.1/command.go:1148
github.com/spf13/cobra.(*Command).Execute
        github.com/spf13/cobra@v1.10.1/command.go:1071
main.main
        helm.sh/helm/v3/cmd/helm/helm.go:91
runtime.main
        runtime/proc.go:283
runtime.goexit
        runtime/asm_amd64.s:1700

Here's what happens after rendering

           - create
            - --host=release-name-kube-promethe-operator^M,release-name-kube-promethe-operator.default.svc
            - --namespace=default
            - --secret-name=release-name-kube-promethe-admission

I guess the ^M in the string --host=release-name-kube-promethe-operator^M,release-name-kube-promethe-operator.default.svc broke everything.
It is worth adding that I build the archive with the chart on Windows 11, and then install it on a Unix system.