[prometheus-kube-stack] crds sub chart labels not being applied consistently

[mergwyn]

Describe the bug a clear and concise description of what the bug is.

I needed to a a label to the update-crds job and service account objects and attempted to do this by adding the following snippet to my helm chart:

crds:
  enabled: true
  upgradeJob:
    enabled: true
    labels:
      velero.io/exclude-from-backup: "true"

After inspecting the chart, I expected that this would result in these labels being added to the clusterrrole, clusterrolebinding, job, and service account objects, but what I found was that they were only applied to the job.

What's your helm version?

version.BuildInfo{Version:"v4.2.0", GitCommit:"06468084e85c244c712834933d25ea232a4c2093", GitTreeState:"clean", GoVersion:"go1.26.3", KubeClientVersion:"v1.36"}

What's your kubectl version?

kubectl version Client Version: v1.36.1 Kustomize Version: v5.8.1 Server Version: v1.35.5+k3s1

Which chart?

kube-prometheus-stack

What's the chart version?

86.3.2

What happened?

I was able to add labels to the serviceaccount using:

crds:
    serviceAccount:
      labels:
        velero.io/exclude-from-backup: "true"

Afer loking at the crds chart templates, there were multiple references that look like the labels should have been included:

$ grep labels *
clusterrole.yaml:  labels:
clusterrole.yaml:    {{- include "kube-prometheus-stack.crd.upgradeJob.labels" . | nindent 4 }}
clusterrolebinding.yaml:  labels:
clusterrolebinding.yaml:    {{- include "kube-prometheus-stack.crd.upgradeJob.labels" . | nindent 4 }}
crds.yaml:  labels:
crds.yaml:    {{- include "kube-prometheus-stack.crd.upgradeJob.labels" . | nindent 4 }}
job.yaml:  labels:
job.yaml:    {{- include "kube-prometheus-stack.crd.upgradeJob.labels" . | nindent 4 }}
job.yaml:    {{- with .Values.upgradeJob.labels }}
job.yaml:      labels:
serviceaccount.yaml:  labels:
serviceaccount.yaml:    {{- include "kube-prometheus-stack.crd.upgradeJob.labels" . | nindent 4 }}
serviceaccount.yaml:    {{- with .Values.upgradeJob.serviceAccount.labels }}

But it seems that only those labels inserted via with work, whereas include does not. I am not knowledgable enough to understand why this is the case

What you expected to happen?

No response

How to reproduce it?

After inspecting the chart, I expected that this would result in these labels being added to the clusterrrole, clusterrolebinding, job, and service account objects, but what I found was that they were only applied to the job.

Enter the changed values of values.yaml?

crds:
    serviceAccount:
      labels:
        velero.io/exclude-from-backup: "true"

Enter the command that you execute and failing/misfunctioning.

helm install kube-prometheus-stack prometheus-community/kube-prometheus-stack

Anything else we need to know?

No response