From db2aba94ad5d54804c77cf438b5af93558d995da Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Thu, 9 Jul 2026 14:20:42 +0200
Subject: [PATCH 01/17] fix(yaml): Quote/comment templating syntax

The update script (.scripts/update_helm_charts.py) skipped these files
---
 .../sealed-airflow-postgres-credentials.yaml  |  2 +-
 .../manifests/airflow/airflow.yaml            |  2 +-
 .../airflow/sealed-airflow-credentials.yaml   |  2 +-
 .../sealed-airflow-minio-connection.yaml      |  2 +-
 .../minio/sealed-minio-credentials.yaml       |  2 +-
 stacks/_templates/argo-cd.yaml                |  4 ++--
 .../minio-distributed-small-tls/values.yaml   |  8 +++----
 .../minio-distributed-tls/values.yaml         |  8 +++----
 stacks/_templates/minio.yaml                  | 10 ++++-----
 stacks/_templates/opensearch-dashboards.yaml  | 10 ++++-----
 stacks/_templates/postgresql-airflow.yaml     |  4 ++--
 stacks/_templates/postgresql-druid.yaml       |  4 ++--
 .../_templates/postgresql-hive-iceberg.yaml   |  4 ++--
 stacks/_templates/postgresql-hive.yaml        |  4 ++--
 stacks/_templates/postgresql-superset.yaml    |  4 ++--
 stacks/_templates/postgresql-timescaledb.yaml |  4 ++--
 stacks/_templates/vector-aggregator.yaml      | 10 ++++-----
 .../secrets/sealed-secrets-key.yaml           |  4 ++--
 .../jupyterhub-native-auth.yaml               |  4 ++--
 stacks/jupyterhub-keycloak/jupyterhub.yaml    | 22 +++++++++----------
 stacks/monitoring/prometheus.yaml             |  8 +++----
 .../grafana-admin-credentials.yaml            |  2 +-
 stacks/observability/grafana-tempo.yaml       |  4 ++--
 stacks/observability/grafana.yaml             |  8 +++----
 stacks/observability/jaeger.yaml              |  4 ++--
 .../observability/opentelemetry-operator.yaml |  4 ++--
 stacks/signal-processing/grafana.yaml         | 10 ++++-----
 stacks/signal-processing/jupyterhub.yaml      | 10 ++++-----
 stacks/signal-processing/secrets.yaml         |  2 +-
 29 files changed, 83 insertions(+), 83 deletions(-)

diff --git a/demos/argo-cd-git-ops/manifests/airflow-postgres/sealed-airflow-postgres-credentials.yaml b/demos/argo-cd-git-ops/manifests/airflow-postgres/sealed-airflow-postgres-credentials.yaml
index 96dcd8f0..21f3cdd9 100644
--- a/demos/argo-cd-git-ops/manifests/airflow-postgres/sealed-airflow-postgres-credentials.yaml
+++ b/demos/argo-cd-git-ops/manifests/airflow-postgres/sealed-airflow-postgres-credentials.yaml
@@ -18,5 +18,5 @@ spec:
       namespace: stackable-airflow
       labels:
         stackable.tech/vendor: Stackable
-        stackable.tech/demo: {{ DEMO }}
+        stackable.tech/demo: "{{ DEMO }}"
     type: Opaque
diff --git a/demos/argo-cd-git-ops/manifests/airflow/airflow.yaml b/demos/argo-cd-git-ops/manifests/airflow/airflow.yaml
index d572d736..4df65e9a 100644
--- a/demos/argo-cd-git-ops/manifests/airflow/airflow.yaml
+++ b/demos/argo-cd-git-ops/manifests/airflow/airflow.yaml
@@ -5,7 +5,7 @@ metadata:
   name: airflow
   labels:
     stackable.tech/vendor: Stackable
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: "{{ DEMO }}"
 spec:
   image:
     productVersion: 3.2.2
diff --git a/demos/argo-cd-git-ops/manifests/airflow/sealed-airflow-credentials.yaml b/demos/argo-cd-git-ops/manifests/airflow/sealed-airflow-credentials.yaml
index a0530541..520e5eff 100644
--- a/demos/argo-cd-git-ops/manifests/airflow/sealed-airflow-credentials.yaml
+++ b/demos/argo-cd-git-ops/manifests/airflow/sealed-airflow-credentials.yaml
@@ -23,5 +23,5 @@ spec:
       namespace: stackable-airflow
       labels:
         stackable.tech/vendor: Stackable
-        stackable.tech/demo: {{ DEMO }}
+        stackable.tech/demo: "{{ DEMO }}"
     type: Opaque
diff --git a/demos/argo-cd-git-ops/manifests/airflow/sealed-airflow-minio-connection.yaml b/demos/argo-cd-git-ops/manifests/airflow/sealed-airflow-minio-connection.yaml
index e7dccbac..3e5d3ed1 100644
--- a/demos/argo-cd-git-ops/manifests/airflow/sealed-airflow-minio-connection.yaml
+++ b/demos/argo-cd-git-ops/manifests/airflow/sealed-airflow-minio-connection.yaml
@@ -15,5 +15,5 @@ spec:
       namespace: stackable-airflow
       labels:
         stackable.tech/vendor: Stackable
-        stackable.tech/demo: {{ DEMO }}
+        stackable.tech/demo: "{{ DEMO }}"
     type: Opaque
diff --git a/demos/argo-cd-git-ops/manifests/minio/sealed-minio-credentials.yaml b/demos/argo-cd-git-ops/manifests/minio/sealed-minio-credentials.yaml
index 94f672e4..d33f7d83 100644
--- a/demos/argo-cd-git-ops/manifests/minio/sealed-minio-credentials.yaml
+++ b/demos/argo-cd-git-ops/manifests/minio/sealed-minio-credentials.yaml
@@ -16,5 +16,5 @@ spec:
       namespace: minio
       labels:
         stackable.tech/vendor: Stackable
-        stackable.tech/demo: {{ DEMO }}
+        stackable.tech/demo: "{{ DEMO }}"
     type: Opaque
diff --git a/stacks/_templates/argo-cd.yaml b/stacks/_templates/argo-cd.yaml
index 2cb43fd9..c4235066 100644
--- a/stacks/_templates/argo-cd.yaml
+++ b/stacks/_templates/argo-cd.yaml
@@ -9,11 +9,11 @@ options:
   global:
     additionalLabels:
       stackable.tech/vendor: Stackable
-      stackable.tech/stack: {{ STACK }}
+      stackable.tech/stack: "{{ STACK }}"
       # The following is a Jinja2 template directive, not a regular comment.
       # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
       # {% if DEMO is defined %}
-      stackable.tech/demo: {{ DEMO }}
+      stackable.tech/demo: "{{ DEMO }}"
       # {% endif %}
   configs:
     secret:
diff --git a/stacks/_templates/minio-distributed-small-tls/values.yaml b/stacks/_templates/minio-distributed-small-tls/values.yaml
index 25b926f2..9fbdb1e6 100644
--- a/stacks/_templates/minio-distributed-small-tls/values.yaml
+++ b/stacks/_templates/minio-distributed-small-tls/values.yaml
@@ -1,19 +1,19 @@
 ---
 additionalLabels:
   stackable.tech/vendor: Stackable
-  stackable.tech/stack: {{ STACK }}
+  stackable.tech/stack: "{{ STACK }}"
   # The following is a Jinja2 template directive, not a regular comment.
   # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
   # {% if DEMO is defined %}
-  stackable.tech/demo: {{ DEMO }}
+  stackable.tech/demo: "{{ DEMO }}"
   # {% endif %}
 podLabels:
   stackable.tech/vendor: Stackable
-  stackable.tech/stack: {{ STACK }}
+  stackable.tech/stack: "{{ STACK }}"
   # The following is a Jinja2 template directive, not a regular comment.
   # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
   # {% if DEMO is defined %}
-  stackable.tech/demo: {{ DEMO }}
+  stackable.tech/demo: "{{ DEMO }}"
   # {% endif %}
 rootUser: admin
 rootPassword: adminadmin
diff --git a/stacks/_templates/minio-distributed-tls/values.yaml b/stacks/_templates/minio-distributed-tls/values.yaml
index a122c521..d601af57 100644
--- a/stacks/_templates/minio-distributed-tls/values.yaml
+++ b/stacks/_templates/minio-distributed-tls/values.yaml
@@ -1,19 +1,19 @@
 ---
 additionalLabels:
   stackable.tech/vendor: Stackable
-  stackable.tech/stack: {{ STACK }}
+  stackable.tech/stack: "{{ STACK }}"
   # The following is a Jinja2 template directive, not a regular comment.
   # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
   # {% if DEMO is defined %}
-  stackable.tech/demo: {{ DEMO }}
+  stackable.tech/demo: "{{ DEMO }}"
   # {% endif %}
 podLabels:
   stackable.tech/vendor: Stackable
-  stackable.tech/stack: {{ STACK }}
+  stackable.tech/stack: "{{ STACK }}"
   # The following is a Jinja2 template directive, not a regular comment.
   # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
   # {% if DEMO is defined %}
-  stackable.tech/demo: {{ DEMO }}
+  stackable.tech/demo: "{{ DEMO }}"
   # {% endif %}
 rootUser: admin
 rootPassword: adminadmin
diff --git a/stacks/_templates/minio.yaml b/stacks/_templates/minio.yaml
index c1a0cbca..8072d6ca 100644
--- a/stacks/_templates/minio.yaml
+++ b/stacks/_templates/minio.yaml
@@ -8,22 +8,22 @@ version: 5.4.0 # RELEASE.2024-12-18T13-15-44Z
 options:
   additionalLabels:
     stackable.tech/vendor: Stackable
-    stackable.tech/stack: {{ STACK }}
+    stackable.tech/stack: "{{ STACK }}"
     # The following is a Jinja2 template directive, not a regular comment.
     # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
     # {% if DEMO is defined %}
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: "{{ DEMO }}"
     # {% endif %}
   podLabels:
     stackable.tech/vendor: Stackable
-    stackable.tech/stack: {{ STACK }}
+    stackable.tech/stack: "{{ STACK }}"
     # The following is a Jinja2 template directive, not a regular comment.
     # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
     # {% if DEMO is defined %}
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: "{{ DEMO }}"
     # {% endif %}
   rootUser: admin
-  rootPassword: {{ minioAdminPassword }}
+  rootPassword: "{{ minioAdminPassword }}"
   mode: standalone
   persistence:
     size: 10Gi
diff --git a/stacks/_templates/opensearch-dashboards.yaml b/stacks/_templates/opensearch-dashboards.yaml
index 2b86f755..f7826afd 100644
--- a/stacks/_templates/opensearch-dashboards.yaml
+++ b/stacks/_templates/opensearch-dashboards.yaml
@@ -4,18 +4,18 @@ name: opensearch-dashboards
 repo:
   name: opensearch-dashboards
   url: https://opensearch-project.github.io/helm-charts
-version: {{ opensearchVersion }}
+version: "{{ opensearchVersion }}"
 options:
   image:
     repository: oci.stackable.tech/sdp/opensearch-dashboards
     tag: "{{ opensearchVersion }}-stackable{{ stackableReleaseVersion }}"
   labels:
     stackable.tech/vendor: Stackable
-    stackable.tech/stack: {{ STACK }}
+    stackable.tech/stack: "{{ STACK }}"
     # The following is a Jinja2 template directive, not a regular comment.
     # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
     # {% if DEMO is defined %}
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: "{{ DEMO }}"
     # {% endif %}
   service:
     type: NodePort
@@ -25,11 +25,11 @@ options:
       stackable.tech/logging-credentials-secret: opensearch-user
     labels:
       stackable.tech/vendor: Stackable
-      stackable.tech/stack: {{ STACK }}
+      stackable.tech/stack: "{{ STACK }}"
       # The following is a Jinja2 template directive, not a regular comment.
       # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
       # {% if DEMO is defined %}
-      stackable.tech/demo: {{ DEMO }}
+      stackable.tech/demo: "{{ DEMO }}"
       # {% endif %}
   opensearchHosts: null # Use the discovery ConfigMap instead
   extraEnvs:
diff --git a/stacks/_templates/postgresql-airflow.yaml b/stacks/_templates/postgresql-airflow.yaml
index 96a688c6..d84a433f 100644
--- a/stacks/_templates/postgresql-airflow.yaml
+++ b/stacks/_templates/postgresql-airflow.yaml
@@ -8,11 +8,11 @@ version: 18.5.6 # 18.3.0
 options:
   commonLabels:
     stackable.tech/vendor: Stackable
-    stackable.tech/stack: {{ STACK }}
+    stackable.tech/stack: "{{ STACK }}"
     # The following is a Jinja2 template directive, not a regular comment.
     # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
     # {% if DEMO is defined %}
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: "{{ DEMO }}"
     # {% endif %}
   auth:
     username: airflow
diff --git a/stacks/_templates/postgresql-druid.yaml b/stacks/_templates/postgresql-druid.yaml
index 12d99761..3a70f46c 100644
--- a/stacks/_templates/postgresql-druid.yaml
+++ b/stacks/_templates/postgresql-druid.yaml
@@ -8,11 +8,11 @@ version: 18.5.6 # 18.3.0
 options:
   commonLabels:
     stackable.tech/vendor: Stackable
-    stackable.tech/stack: {{ STACK }}
+    stackable.tech/stack: "{{ STACK }}"
     # The following is a Jinja2 template directive, not a regular comment.
     # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
     # {% if DEMO is defined %}
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: "{{ DEMO }}"
     # {% endif %}
   auth:
     username: druid
diff --git a/stacks/_templates/postgresql-hive-iceberg.yaml b/stacks/_templates/postgresql-hive-iceberg.yaml
index 1ce8cce4..6d5a693e 100644
--- a/stacks/_templates/postgresql-hive-iceberg.yaml
+++ b/stacks/_templates/postgresql-hive-iceberg.yaml
@@ -8,11 +8,11 @@ version: 18.5.6 # 18.3.0
 options:
   commonLabels:
     stackable.tech/vendor: Stackable
-    stackable.tech/stack: {{ STACK }}
+    stackable.tech/stack: "{{ STACK }}"
     # The following is a Jinja2 template directive, not a regular comment.
     # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
     # {% if DEMO is defined %}
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: "{{ DEMO }}"
     # {% endif %}
   auth:
     username: hive
diff --git a/stacks/_templates/postgresql-hive.yaml b/stacks/_templates/postgresql-hive.yaml
index a1de1e2c..e5472974 100644
--- a/stacks/_templates/postgresql-hive.yaml
+++ b/stacks/_templates/postgresql-hive.yaml
@@ -8,11 +8,11 @@ version: 18.5.6 # 18.3.0
 options:
   commonLabels:
     stackable.tech/vendor: Stackable
-    stackable.tech/stack: {{ STACK }}
+    stackable.tech/stack: "{{ STACK }}"
     # The following is a Jinja2 template directive, not a regular comment.
     # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
     # {% if DEMO is defined %}
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: "{{ DEMO }}"
     # {% endif %}
   auth:
     username: hive
diff --git a/stacks/_templates/postgresql-superset.yaml b/stacks/_templates/postgresql-superset.yaml
index 747458f7..21d3df45 100644
--- a/stacks/_templates/postgresql-superset.yaml
+++ b/stacks/_templates/postgresql-superset.yaml
@@ -8,11 +8,11 @@ version: 18.5.6 # 18.3.0
 options:
   commonLabels:
     stackable.tech/vendor: Stackable
-    stackable.tech/stack: {{ STACK }}
+    stackable.tech/stack: "{{ STACK }}"
     # The following is a Jinja2 template directive, not a regular comment.
     # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
     # {% if DEMO is defined %}
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: "{{ DEMO }}"
     # {% endif %}
   auth:
     username: superset
diff --git a/stacks/_templates/postgresql-timescaledb.yaml b/stacks/_templates/postgresql-timescaledb.yaml
index 246f2846..19f63770 100644
--- a/stacks/_templates/postgresql-timescaledb.yaml
+++ b/stacks/_templates/postgresql-timescaledb.yaml
@@ -8,11 +8,11 @@ version: 0.33.1
 options:
   podLabels:
     stackable.tech/vendor: Stackable
-    stackable.tech/stack: {{ STACK }}
+    stackable.tech/stack: "{{ STACK }}"
     # The following is a Jinja2 template directive, not a regular comment.
     # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
     # {% if DEMO is defined %}
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: "{{ DEMO }}"
     # {% endif %}
   replicaCount: 1
   secrets:
diff --git a/stacks/_templates/vector-aggregator.yaml b/stacks/_templates/vector-aggregator.yaml
index 4b247aa7..af99ee79 100644
--- a/stacks/_templates/vector-aggregator.yaml
+++ b/stacks/_templates/vector-aggregator.yaml
@@ -8,19 +8,19 @@ version: 0.52.0 # app version 0.55.0
 options:
   commonLabels:
     stackable.tech/vendor: Stackable
-    stackable.tech/stack: {{ STACK }}
+    stackable.tech/stack: "{{ STACK }}"
     # The following is a Jinja2 template directive, not a regular comment.
     # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
     # {% if DEMO is defined %}
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: "{{ DEMO }}"
     # {% endif %}
   podLabels:
     stackable.tech/vendor: Stackable
-    stackable.tech/stack: {{ STACK }}
+    stackable.tech/stack: "{{ STACK }}"
     # The following is a Jinja2 template directive, not a regular comment.
     # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
     # {% if DEMO is defined %}
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: "{{ DEMO }}"
     # {% endif %}
   role: Aggregator
   customConfig:
@@ -49,7 +49,7 @@ options:
         auth:
           strategy: basic
           user: admin
-          password: {{ openSearchAdminPassword }}
+          password: "{{ openSearchAdminPassword }}"
   envFrom:
     - configMapRef:
         name: opensearch
diff --git a/stacks/argo-cd-git-ops/secrets/sealed-secrets-key.yaml b/stacks/argo-cd-git-ops/secrets/sealed-secrets-key.yaml
index 90b798d9..0f2cd25e 100644
--- a/stacks/argo-cd-git-ops/secrets/sealed-secrets-key.yaml
+++ b/stacks/argo-cd-git-ops/secrets/sealed-secrets-key.yaml
@@ -5,11 +5,11 @@ metadata:
   name: sealed-secrets-key
   labels:
     stackable.tech/vendor: Stackable
-    stackable.tech/stack: {{ STACK }}
+    stackable.tech/stack: "{{ STACK }}"
     # The following is a Jinja2 template directive, not a regular comment.
     # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
     # {% if DEMO is defined %}
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: "{{ DEMO }}"
     # {% endif %}
 stringData:
   # Generated on 2025/04/12
diff --git a/stacks/jupyterhub-keycloak/jupyterhub-native-auth.yaml b/stacks/jupyterhub-keycloak/jupyterhub-native-auth.yaml
index 8fd6d945..b68f5ba1 100644
--- a/stacks/jupyterhub-keycloak/jupyterhub-native-auth.yaml
+++ b/stacks/jupyterhub-keycloak/jupyterhub-native-auth.yaml
@@ -41,11 +41,11 @@ options:
       enabled: false
     extraLabels:
       stackable.tech/vendor: Stackable
-      stackable.tech/stack: {{ STACK }}
+      stackable.tech/stack: "{{ STACK }}"
       # The following is a Jinja2 template directive, not a regular comment.
       # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
       # {% if DEMO is defined %}
-      stackable.tech/demo: {{ DEMO }}
+      stackable.tech/demo: "{{ DEMO }}"
       # {% endif %}
     profileList:
       - display_name: "Default"
diff --git a/stacks/jupyterhub-keycloak/jupyterhub.yaml b/stacks/jupyterhub-keycloak/jupyterhub.yaml
index 5025800a..7c412132 100644
--- a/stacks/jupyterhub-keycloak/jupyterhub.yaml
+++ b/stacks/jupyterhub-keycloak/jupyterhub.yaml
@@ -19,7 +19,7 @@ options:
           - isla.williams
       GenericOAuthenticator:
         client_id: jupyterhub
-        client_secret: {{jupyterhubClientPassword}}
+        client_secret: "{{jupyterhubClientPassword}}"
         username_claim: preferred_username
         scope:
           - openid
@@ -149,11 +149,11 @@ options:
       enabled: false
     extraLabels:
       stackable.tech/vendor: Stackable
-      stackable.tech/stack: {{ STACK }}
+      stackable.tech/stack: "{{ STACK }}"
       # The following is a Jinja2 template directive, not a regular comment.
       # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
       # {% if DEMO is defined %}
-      stackable.tech/demo: {{ DEMO }}
+      stackable.tech/demo: "{{ DEMO }}"
       # {% endif %}
     initContainers:
       - name: download-notebook
@@ -199,29 +199,29 @@ options:
           cpu:
             display_name: CPU
             choices:
-{% for cpu in ["1","2","4","8","16","32"] %}
+# {% for cpu in ["1","2","4","8","16","32"] %}
               "{{cpu}}":
                 display_name: "{{cpu}}"
                 kubespawner_override:
-                  cpu_guarantee: {{cpu}}
-                  cpu_limit: {{cpu}}
-{% endfor %}
+                  cpu_guarantee: "{{cpu}}"
+                  cpu_limit: "{{cpu}}"
+# {% endfor %}
           memory:
             display_name: Memory
             choices:
-{% for memory in ["1","2","4","8","16","32","64","128"] %}
+# {% for memory in ["1","2","4","8","16","32","64","128"] %}
               "{{memory}} GB":
                 display_name: "{{memory}} GB"
                 kubespawner_override:
                   mem_guarantee: "{{memory}}G"
                   mem_limit: "{{memory}}G"
-{% endfor %}
+# {% endfor %}
           image:
             display_name: Image
             choices:
-{% for image in ["quay.io/jupyter/pyspark-notebook:python-3.11.9", "quay.io/jupyter/pyspark-notebook:spark-3.5.2"] %}
+# {% for image in ["quay.io/jupyter/pyspark-notebook:python-3.11.9", "quay.io/jupyter/pyspark-notebook:spark-3.5.2"] %}
               "{{image}}":
                 display_name: "{{image}}"
                 kubespawner_override:
                   image: "{{image}}"
-{% endfor %}
+# {% endfor %}
diff --git a/stacks/monitoring/prometheus.yaml b/stacks/monitoring/prometheus.yaml
index 5a7edba3..c93f3ebd 100644
--- a/stacks/monitoring/prometheus.yaml
+++ b/stacks/monitoring/prometheus.yaml
@@ -8,15 +8,15 @@ version: 82.10.3 # 0.89.0
 options:
   commonLabels:
     stackable.tech/vendor: Stackable
-    stackable.tech/stack: {{ STACK }}
+    stackable.tech/stack: "{{ STACK }}"
     # The following is a Jinja2 template directive, not a regular comment.
     # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
     # {% if DEMO is defined %}
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: "{{ DEMO }}"
     # {% endif %}
   prometheusOperator:
     kubeletService:
-      namespace: {{ NAMESPACE }}
+      namespace: "{{ NAMESPACE }}"
   prometheus:
     prometheusSpec:
       storageSpec:
@@ -33,7 +33,7 @@ options:
     grafana.ini:
       analytics:
         check_for_updates: false
-    adminPassword: {{ grafanaAdminPassword }}
+    adminPassword: "{{ grafanaAdminPassword }}"
     persistence:
       enabled: true
       size: 10Gi
diff --git a/stacks/observability/grafana-admin-credentials.yaml b/stacks/observability/grafana-admin-credentials.yaml
index c8037bd2..26a71cf1 100644
--- a/stacks/observability/grafana-admin-credentials.yaml
+++ b/stacks/observability/grafana-admin-credentials.yaml
@@ -5,4 +5,4 @@ metadata:
   name: grafana-admin-credentials
 stringData:
   admin-user: admin
-  admin-password: {{ grafanaAdminPassword }}
+  admin-password: "{{ grafanaAdminPassword }}"
diff --git a/stacks/observability/grafana-tempo.yaml b/stacks/observability/grafana-tempo.yaml
index 2b6eca17..65e770f0 100644
--- a/stacks/observability/grafana-tempo.yaml
+++ b/stacks/observability/grafana-tempo.yaml
@@ -15,11 +15,11 @@ options:
   global:
     commonLabels:
       stackable.tech/vendor: Stackable
-      stackable.tech/stack: {{ STACK }}
+      stackable.tech/stack: "{{ STACK }}"
       # The following is a Jinja2 template directive, not a regular comment.
       # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
       # {% if DEMO is defined %}
-      stackable.tech/demo: {{ DEMO }}
+      stackable.tech/demo: "{{ DEMO }}"
       # {% endif %}
   tempo:
     receivers:
diff --git a/stacks/observability/grafana.yaml b/stacks/observability/grafana.yaml
index 1e8b8333..2a907e07 100644
--- a/stacks/observability/grafana.yaml
+++ b/stacks/observability/grafana.yaml
@@ -13,11 +13,11 @@ version: 11.3.2 # 12.4.1
 options:
   extraLabels:
     stackable.tech/vendor: Stackable
-    stackable.tech/stack: {{ STACK }}
+    stackable.tech/stack: "{{ STACK }}"
     # The following is a Jinja2 template directive, not a regular comment.
     # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
     # {% if DEMO is defined %}
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: "{{ DEMO }}"
     # {% endif %}
   admin:
     existingSecret: grafana-admin-credentials
@@ -30,14 +30,14 @@ options:
       datasources:
         - name: Loki
           type: loki
-          url: http://loki.{{ NAMESPACE }}.svc.cluster.local:3100
+          url: "http://loki.{{ NAMESPACE }}.svc.cluster.local:3100"
           access: proxy
           isDefault: false
           jsonData:
             tlsAuthWithCACert: false
         - name: Tempo
           type: tempo
-          url: http://tempo.{{ NAMESPACE }}.svc.cluster.local:3200
+          url: "http://tempo.{{ NAMESPACE }}.svc.cluster.local:3200"
           access: proxy
           isDefault: false
           jsonData:
diff --git a/stacks/observability/jaeger.yaml b/stacks/observability/jaeger.yaml
index 59a5638a..5a9c35d1 100644
--- a/stacks/observability/jaeger.yaml
+++ b/stacks/observability/jaeger.yaml
@@ -13,11 +13,11 @@ version: 4.5.0 # 2.15.1
 options:
   commonLabels:
     stackable.tech/vendor: Stackable
-    stackable.tech/stack: {{ STACK }}
+    stackable.tech/stack: "{{ STACK }}"
     # The following is a Jinja2 template directive, not a regular comment.
     # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
     # {% if DEMO is defined %}
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: "{{ DEMO }}"
     # {% endif %}
   provisionDataStore:
     cassandra: false
diff --git a/stacks/observability/opentelemetry-operator.yaml b/stacks/observability/opentelemetry-operator.yaml
index a61d6b57..6201e10c 100644
--- a/stacks/observability/opentelemetry-operator.yaml
+++ b/stacks/observability/opentelemetry-operator.yaml
@@ -10,11 +10,11 @@ version: 0.107.0 # 0.146.0
 options:
   additionalLabels:
     stackable.tech/vendor: Stackable
-    stackable.tech/stack: {{ STACK }}
+    stackable.tech/stack: "{{ STACK }}"
     # The following is a Jinja2 template directive, not a regular comment.
     # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
     # {% if DEMO is defined %}
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: "{{ DEMO }}"
     # {% endif %}
   admissionWebhooks:
     certManager:
diff --git a/stacks/signal-processing/grafana.yaml b/stacks/signal-processing/grafana.yaml
index 3d453979..659064f9 100644
--- a/stacks/signal-processing/grafana.yaml
+++ b/stacks/signal-processing/grafana.yaml
@@ -8,16 +8,16 @@ version: 10.5.15 # 12.3.1
 options:
   extraLabels:
     stackable.tech/vendor: Stackable
-    stackable.tech/stack: {{ STACK }}
+    stackable.tech/stack: "{{ STACK }}"
     # The following is a Jinja2 template directive, not a regular comment.
     # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
     # {% if DEMO is defined %}
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: "{{ DEMO }}"
     # {% endif %}
   grafana.ini:
     analytics:
       check_for_updates: false
-  adminPassword: {{ grafanaAdminPassword }}
+  adminPassword: "{{ grafanaAdminPassword }}"
   persistence:
     enabled: true
     size: 10Gi
@@ -44,10 +44,10 @@ options:
       datasources:
         - name: postgres
           type: postgres
-          url: postgresql-timescaledb.{{ NAMESPACE }}.svc.cluster.local:5432
+          url: "postgresql-timescaledb.{{ NAMESPACE }}.svc.cluster.local:5432"
           user: admin
           secureJsonData:
-            password: {{ postgresAdminPassword }}
+            password: "{{ postgresAdminPassword }}"
           jsonData:
             database: tsdb
             sslmode: 'require'
diff --git a/stacks/signal-processing/jupyterhub.yaml b/stacks/signal-processing/jupyterhub.yaml
index c479ad6d..3010cf88 100644
--- a/stacks/signal-processing/jupyterhub.yaml
+++ b/stacks/signal-processing/jupyterhub.yaml
@@ -12,16 +12,16 @@ options:
         allowed_users:
           - admin
       DummyAuthenticator:
-        password: {{ jupyterHubAdminPassword }}
+        password: "{{ jupyterHubAdminPassword }}"
       JupyterHub:
         authenticator_class: dummy
     labels:
       stackable.tech/vendor: Stackable
-      stackable.tech/stack: {{ STACK }}
+      stackable.tech/stack: "{{ STACK }}"
       # The following is a Jinja2 template directive, not a regular comment.
       # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
       # {% if DEMO is defined %}
-      stackable.tech/demo: {{ DEMO }}
+      stackable.tech/demo: "{{ DEMO }}"
       # {% endif %}
   proxy:
     service:
@@ -45,11 +45,11 @@ options:
       enabled: false
     extraLabels:
       stackable.tech/vendor: Stackable
-      stackable.tech/stack: {{ STACK }}
+      stackable.tech/stack: "{{ STACK }}"
       # The following is a Jinja2 template directive, not a regular comment.
       # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it.
       # {% if DEMO is defined %}
-      stackable.tech/demo: {{ DEMO }}
+      stackable.tech/demo: "{{ DEMO }}"
       # {% endif %}
     initContainers:
       - name: download-notebook
diff --git a/stacks/signal-processing/secrets.yaml b/stacks/signal-processing/secrets.yaml
index 2265fb38..2ce5be5b 100644
--- a/stacks/signal-processing/secrets.yaml
+++ b/stacks/signal-processing/secrets.yaml
@@ -5,4 +5,4 @@ metadata:
   name: timescale-admin-credentials
 stringData:
   username: admin
-  password: {{ postgresAdminPassword }}
+  password: "{{ postgresAdminPassword }}"

From 7f9e0125235ca7f054ca6c836e3efc8f1f8366c4 Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Thu, 9 Jul 2026 14:21:53 +0200
Subject: [PATCH 02/17] chore(script): Formatting

---
 .scripts/update_helm_charts.py | 24 +++++++++++++++++-------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/.scripts/update_helm_charts.py b/.scripts/update_helm_charts.py
index a06fde14..53252861 100755
--- a/.scripts/update_helm_charts.py
+++ b/.scripts/update_helm_charts.py
@@ -5,6 +5,7 @@
 import yaml
 from typing import Tuple, Set
 
+
 def run_helm_repo_add(repo_name: str, repo_url: str) -> None:
     try:
         subprocess.run(["helm", "repo", "add", repo_name, repo_url], check=True)
@@ -25,7 +26,7 @@ def get_chart_and_app_version(repo_name: str, chart_name: str) -> Tuple[str, str
         ["helm", "show", "chart", full_chart],
         capture_output=True,
         text=True,
-        check=True
+        check=True,
     )
     chart_yaml = yaml.safe_load(result.stdout)
     return chart_yaml["version"], chart_yaml["appVersion"]
@@ -79,12 +80,14 @@ def process_yaml_files(top_dir: str) -> None:
                 run_helm_repo_update(repo_name)
 
                 # print(f"📦 Updating {filepath} -> {repo_name}/{chart_name}")
-                new_chart_version, new_app_version = get_chart_and_app_version(repo_name, chart_name)
+                new_chart_version, new_app_version = get_chart_and_app_version(
+                    repo_name, chart_name
+                )
 
                 updated_lines = []
                 for line in raw_lines:
                     if line.strip().startswith("version:"):
-                        new_line = f'version: {new_chart_version} # {new_app_version}\n'
+                        new_line = f"version: {new_chart_version} # {new_app_version}\n"
                         updated_lines.append(new_line)
                     else:
                         updated_lines.append(line)
@@ -97,11 +100,18 @@ def process_yaml_files(top_dir: str) -> None:
             except Exception as e:
                 print(f"⚠️ Error processing {filepath}: {e}")
 
+
 if __name__ == "__main__":
-    print('⚠️⚠️⚠️ This script is best-effort! Always check the result using "git diff"! ⚠️⚠️⚠️')
-    print('Notably, it skips invalid YAMLs, which can be the case because we sometimes use templating syntax, even for helm-chart definitions')
-    print('Please judge on the skipped files if they contain a helm-chart and should be manually bumped')
-    print('The script can be improved to handle such files in the future')
+    print(
+        '⚠️⚠️⚠️ This script is best-effort! Always check the result using "git diff"! ⚠️⚠️⚠️'
+    )
+    print(
+        "Notably, it skips invalid YAMLs, which can be the case because we sometimes use templating syntax, even for helm-chart definitions"
+    )
+    print(
+        "Please judge on the skipped files if they contain a helm-chart and should be manually bumped"
+    )
+    print("The script can be improved to handle such files in the future")
     print()
 
     process_yaml_files(".")

From a92a6e0c6b7a54fe046b2930a1672f5f6cc7ed0b Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Thu, 9 Jul 2026 14:22:41 +0200
Subject: [PATCH 03/17] fix(script): Handle empty appVersion

---
 .scripts/update_helm_charts.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.scripts/update_helm_charts.py b/.scripts/update_helm_charts.py
index 53252861..7e8fde14 100755
--- a/.scripts/update_helm_charts.py
+++ b/.scripts/update_helm_charts.py
@@ -29,7 +29,7 @@ def get_chart_and_app_version(repo_name: str, chart_name: str) -> Tuple[str, str
         check=True,
     )
     chart_yaml = yaml.safe_load(result.stdout)
-    return chart_yaml["version"], chart_yaml["appVersion"]
+    return chart_yaml["version"], chart_yaml.setdefault("appVersion", "Not present")
 
 
 def process_yaml_files(top_dir: str) -> None:

From 935965f13b25ec312b7f931f4314d9b60b7fa328 Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Thu, 9 Jul 2026 14:28:32 +0200
Subject: [PATCH 04/17] fix(script): Don't strip leading indentation

This was matching on vector-aggregator:

```yaml
        version: "2"
```
---
 .scripts/update_helm_charts.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.scripts/update_helm_charts.py b/.scripts/update_helm_charts.py
index 7e8fde14..95eca89a 100755
--- a/.scripts/update_helm_charts.py
+++ b/.scripts/update_helm_charts.py
@@ -86,7 +86,7 @@ def process_yaml_files(top_dir: str) -> None:
 
                 updated_lines = []
                 for line in raw_lines:
-                    if line.strip().startswith("version:"):
+                    if line.startswith("version:"):
                         new_line = f"version: {new_chart_version} # {new_app_version}\n"
                         updated_lines.append(new_line)
                     else:

From bfe0b033caf0b4b8228ce89c7ca0bc48be681bbe Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Thu, 9 Jul 2026 14:28:56 +0200
Subject: [PATCH 05/17] chore(script): mention "appVersion" before the app
 version

---
 .scripts/update_helm_charts.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.scripts/update_helm_charts.py b/.scripts/update_helm_charts.py
index 95eca89a..bd89fe46 100755
--- a/.scripts/update_helm_charts.py
+++ b/.scripts/update_helm_charts.py
@@ -87,7 +87,7 @@ def process_yaml_files(top_dir: str) -> None:
                 updated_lines = []
                 for line in raw_lines:
                     if line.startswith("version:"):
-                        new_line = f"version: {new_chart_version} # {new_app_version}\n"
+                        new_line = f"version: {new_chart_version} # appVersion: {new_app_version}\n"
                         updated_lines.append(new_line)
                     else:
                         updated_lines.append(line)

From 5d4c9844d351d3d8756864bda36e3471a25a6a33 Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Thu, 9 Jul 2026 14:34:25 +0200
Subject: [PATCH 06/17] chore(helm): Bump versions

---
 stacks/_templates/argo-cd.yaml                         | 2 +-
 stacks/_templates/minio.yaml                           | 2 +-
 stacks/_templates/postgresql-airflow.yaml              | 2 +-
 stacks/_templates/postgresql-druid.yaml                | 2 +-
 stacks/_templates/postgresql-hive-iceberg.yaml         | 2 +-
 stacks/_templates/postgresql-hive.yaml                 | 2 +-
 stacks/_templates/postgresql-superset.yaml             | 2 +-
 stacks/_templates/postgresql-timescaledb.yaml          | 2 +-
 stacks/_templates/vector-aggregator.yaml               | 2 +-
 stacks/jupyterhub-keycloak/jupyterhub-native-auth.yaml | 2 +-
 stacks/jupyterhub-keycloak/jupyterhub.yaml             | 2 +-
 stacks/monitoring/prometheus.yaml                      | 2 +-
 stacks/observability/grafana-loki.yaml                 | 2 +-
 stacks/observability/grafana-tempo.yaml                | 2 +-
 stacks/observability/jaeger.yaml                       | 2 +-
 stacks/observability/opentelemetry-operator.yaml       | 2 +-
 stacks/signal-processing/grafana.yaml                  | 2 +-
 stacks/signal-processing/jupyterhub.yaml               | 2 +-
 18 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/stacks/_templates/argo-cd.yaml b/stacks/_templates/argo-cd.yaml
index c4235066..828b8177 100644
--- a/stacks/_templates/argo-cd.yaml
+++ b/stacks/_templates/argo-cd.yaml
@@ -4,7 +4,7 @@ name: argo-cd
 repo:
   name: argo-cd
   url: https://argoproj.github.io/argo-helm
-version: 9.4.10 # v3.3.3
+version: 10.1.2 # appVersion: v3.4.4
 options:
   global:
     additionalLabels:
diff --git a/stacks/_templates/minio.yaml b/stacks/_templates/minio.yaml
index 8072d6ca..135558ad 100644
--- a/stacks/_templates/minio.yaml
+++ b/stacks/_templates/minio.yaml
@@ -4,7 +4,7 @@ name: minio
 repo:
   name: minio
   url: https://charts.min.io/
-version: 5.4.0 # RELEASE.2024-12-18T13-15-44Z
+version: 5.4.0 # appVersion: RELEASE.2024-12-18T13-15-44Z
 options:
   additionalLabels:
     stackable.tech/vendor: Stackable
diff --git a/stacks/_templates/postgresql-airflow.yaml b/stacks/_templates/postgresql-airflow.yaml
index d84a433f..4350d0c3 100644
--- a/stacks/_templates/postgresql-airflow.yaml
+++ b/stacks/_templates/postgresql-airflow.yaml
@@ -4,7 +4,7 @@ name: postgresql
 repo:
   name: bitnami
   url: https://charts.bitnami.com/bitnami/
-version: 18.5.6 # 18.3.0
+version: 18.7.13 # appVersion: 18.4.0
 options:
   commonLabels:
     stackable.tech/vendor: Stackable
diff --git a/stacks/_templates/postgresql-druid.yaml b/stacks/_templates/postgresql-druid.yaml
index 3a70f46c..a5efa578 100644
--- a/stacks/_templates/postgresql-druid.yaml
+++ b/stacks/_templates/postgresql-druid.yaml
@@ -4,7 +4,7 @@ name: postgresql
 repo:
   name: bitnami
   url: https://charts.bitnami.com/bitnami/
-version: 18.5.6 # 18.3.0
+version: 18.7.13 # appVersion: 18.4.0
 options:
   commonLabels:
     stackable.tech/vendor: Stackable
diff --git a/stacks/_templates/postgresql-hive-iceberg.yaml b/stacks/_templates/postgresql-hive-iceberg.yaml
index 6d5a693e..01984159 100644
--- a/stacks/_templates/postgresql-hive-iceberg.yaml
+++ b/stacks/_templates/postgresql-hive-iceberg.yaml
@@ -4,7 +4,7 @@ name: postgresql
 repo:
   name: bitnami
   url: https://charts.bitnami.com/bitnami/
-version: 18.5.6 # 18.3.0
+version: 18.7.13 # appVersion: 18.4.0
 options:
   commonLabels:
     stackable.tech/vendor: Stackable
diff --git a/stacks/_templates/postgresql-hive.yaml b/stacks/_templates/postgresql-hive.yaml
index e5472974..4b623157 100644
--- a/stacks/_templates/postgresql-hive.yaml
+++ b/stacks/_templates/postgresql-hive.yaml
@@ -4,7 +4,7 @@ name: postgresql
 repo:
   name: bitnami
   url: https://charts.bitnami.com/bitnami/
-version: 18.5.6 # 18.3.0
+version: 18.7.13 # appVersion: 18.4.0
 options:
   commonLabels:
     stackable.tech/vendor: Stackable
diff --git a/stacks/_templates/postgresql-superset.yaml b/stacks/_templates/postgresql-superset.yaml
index 21d3df45..f20013ad 100644
--- a/stacks/_templates/postgresql-superset.yaml
+++ b/stacks/_templates/postgresql-superset.yaml
@@ -4,7 +4,7 @@ name: postgresql
 repo:
   name: bitnami
   url: https://charts.bitnami.com/bitnami/
-version: 18.5.6 # 18.3.0
+version: 18.7.13 # appVersion: 18.4.0
 options:
   commonLabels:
     stackable.tech/vendor: Stackable
diff --git a/stacks/_templates/postgresql-timescaledb.yaml b/stacks/_templates/postgresql-timescaledb.yaml
index 19f63770..74be8a3f 100644
--- a/stacks/_templates/postgresql-timescaledb.yaml
+++ b/stacks/_templates/postgresql-timescaledb.yaml
@@ -4,7 +4,7 @@ name: timescaledb-single
 repo:
   name: timescale
   url: https://charts.timescale.com/
-version: 0.33.1
+version: 0.33.1 # appVersion: Not present
 options:
   podLabels:
     stackable.tech/vendor: Stackable
diff --git a/stacks/_templates/vector-aggregator.yaml b/stacks/_templates/vector-aggregator.yaml
index af99ee79..522a09b9 100644
--- a/stacks/_templates/vector-aggregator.yaml
+++ b/stacks/_templates/vector-aggregator.yaml
@@ -4,7 +4,7 @@ name: vector
 repo:
   name: vector
   url: https://helm.vector.dev
-version: 0.52.0 # app version 0.55.0
+version: 0.56.0 # appVersion: 0.56.0-distroless-libc
 options:
   commonLabels:
     stackable.tech/vendor: Stackable
diff --git a/stacks/jupyterhub-keycloak/jupyterhub-native-auth.yaml b/stacks/jupyterhub-keycloak/jupyterhub-native-auth.yaml
index b68f5ba1..7d5ca771 100644
--- a/stacks/jupyterhub-keycloak/jupyterhub-native-auth.yaml
+++ b/stacks/jupyterhub-keycloak/jupyterhub-native-auth.yaml
@@ -9,7 +9,7 @@ repo:
 # Special care should be taken during testing when this version was bumped.
 # There might be cases where this needs to be dropped back, because the chart
 # is not compatible with other components of the stack/images used.
-version: 4.3.2 # 5.4.3
+version: 4.4.0 # appVersion: 5.5.0
 options:
   hub:
     config:
diff --git a/stacks/jupyterhub-keycloak/jupyterhub.yaml b/stacks/jupyterhub-keycloak/jupyterhub.yaml
index 7c412132..59aec283 100644
--- a/stacks/jupyterhub-keycloak/jupyterhub.yaml
+++ b/stacks/jupyterhub-keycloak/jupyterhub.yaml
@@ -8,7 +8,7 @@ repo:
 # Special care should be taken during testing when this version was bumped.
 # There might be cases where this needs to be dropped back, because the chart
 # is not compatible with other components of the stack/images used.
-version: 4.3.2 # 5.4.3
+version: 4.4.0 # appVersion: 5.5.0
 options:
   hub:
     config:
diff --git a/stacks/monitoring/prometheus.yaml b/stacks/monitoring/prometheus.yaml
index c93f3ebd..962ba6a5 100644
--- a/stacks/monitoring/prometheus.yaml
+++ b/stacks/monitoring/prometheus.yaml
@@ -4,7 +4,7 @@ name: kube-prometheus-stack
 repo:
   name: prometheus-community
   url: https://prometheus-community.github.io/helm-charts
-version: 82.10.3 # 0.89.0
+version: 87.12.2 # appVersion: v0.92.1
 options:
   commonLabels:
     stackable.tech/vendor: Stackable
diff --git a/stacks/observability/grafana-loki.yaml b/stacks/observability/grafana-loki.yaml
index 04296da7..27ef1b0c 100644
--- a/stacks/observability/grafana-loki.yaml
+++ b/stacks/observability/grafana-loki.yaml
@@ -8,7 +8,7 @@ repo:
 # To find the latest version:
 # helm repo add grafana https://grafana.github.io/helm-charts --force-update
 # helm search repo grafana/loki
-version: 6.54.0 # 3.6.7
+version: 7.0.0 # appVersion: 3.6.7
 options:
   deploymentMode: SingleBinary
   singleBinary:
diff --git a/stacks/observability/grafana-tempo.yaml b/stacks/observability/grafana-tempo.yaml
index 65e770f0..7bb82c0d 100644
--- a/stacks/observability/grafana-tempo.yaml
+++ b/stacks/observability/grafana-tempo.yaml
@@ -10,7 +10,7 @@ repo:
 # To find the latest version:
 # helm repo add grafana https://grafana.github.io/helm-charts --force-update
 # helm search repo grafana/tempo
-version: 1.24.4 # 2.9.0
+version: 1.24.4 # appVersion: 2.9.0
 options:
   global:
     commonLabels:
diff --git a/stacks/observability/jaeger.yaml b/stacks/observability/jaeger.yaml
index 5a9c35d1..64ab2e0c 100644
--- a/stacks/observability/jaeger.yaml
+++ b/stacks/observability/jaeger.yaml
@@ -9,7 +9,7 @@ repo:
 # To find the latest version:
 # helm repo add jaegertracing https://jaegertracing.github.io/helm-charts --force-update
 # helm search repo jaegertracing/jaeger
-version: 4.5.0 # 2.15.1
+version: 4.11.1 # appVersion: 2.19.0
 options:
   commonLabels:
     stackable.tech/vendor: Stackable
diff --git a/stacks/observability/opentelemetry-operator.yaml b/stacks/observability/opentelemetry-operator.yaml
index 6201e10c..bc768bc2 100644
--- a/stacks/observability/opentelemetry-operator.yaml
+++ b/stacks/observability/opentelemetry-operator.yaml
@@ -6,7 +6,7 @@ repo:
   name: opentelemetry-operator
   url: https://open-telemetry.github.io/opentelemetry-helm-charts
 # Find the newest chart at https://github.com/open-telemetry/opentelemetry-helm-charts/releases
-version: 0.107.0 # 0.146.0
+version: 0.119.0 # appVersion: 0.154.0
 options:
   additionalLabels:
     stackable.tech/vendor: Stackable
diff --git a/stacks/signal-processing/grafana.yaml b/stacks/signal-processing/grafana.yaml
index 659064f9..fb9bb222 100644
--- a/stacks/signal-processing/grafana.yaml
+++ b/stacks/signal-processing/grafana.yaml
@@ -4,7 +4,7 @@ name: grafana
 repo:
   name: grafana
   url: https://grafana.github.io/helm-charts
-version: 10.5.15 # 12.3.1
+version: 10.5.15 # appVersion: 12.3.1
 options:
   extraLabels:
     stackable.tech/vendor: Stackable
diff --git a/stacks/signal-processing/jupyterhub.yaml b/stacks/signal-processing/jupyterhub.yaml
index 3010cf88..2f586b51 100644
--- a/stacks/signal-processing/jupyterhub.yaml
+++ b/stacks/signal-processing/jupyterhub.yaml
@@ -4,7 +4,7 @@ name: jupyterhub
 repo:
   name: jupyterhub
   url: https://jupyterhub.github.io/helm-chart/
-version: 4.3.2 # 5.4.3
+version: 4.4.0 # appVersion: 5.5.0
 options:
   hub:
     config:

From 38ddf5c6f2fb22f97668b5197061074ae10c02ae Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Thu, 9 Jul 2026 15:10:59 +0200
Subject: [PATCH 07/17] fix(script): Combine helm repo add with update
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This had a side-effect: When the `repo.url` is updated (eg: https://grafana.github.io/helm-charts -> https://grafana-community.github.io/helm-charts), but the user has a named repo with the old url (because the `repo.name` wasn't updated), this caused chart downgrades.

Now we do an add and force update (once), along with a repo URL check and bail out with this message:

```
⚠️ Error processing ./stacks/observability/grafana.yaml:
You have a local repo named grafana pointing to https://grafana.github.io/helm-charts, but the stack/demo wants https://grafana-community.github.io/helm-charts
Either delete or update your local repo URL, or update the stack/demo repo name so it doesn't conflict
```
---
 .scripts/update_helm_charts.py | 42 +++++++++++++++++++++++++---------
 1 file changed, 31 insertions(+), 11 deletions(-)

diff --git a/.scripts/update_helm_charts.py b/.scripts/update_helm_charts.py
index bd89fe46..98478108 100755
--- a/.scripts/update_helm_charts.py
+++ b/.scripts/update_helm_charts.py
@@ -4,20 +4,24 @@
 import subprocess
 import yaml
 from typing import Tuple, Set
+from textwrap import dedent
 
 
 def run_helm_repo_add(repo_name: str, repo_url: str) -> None:
-    try:
-        subprocess.run(["helm", "repo", "add", repo_name, repo_url], check=True)
-    except subprocess.CalledProcessError as e:
-        if "already exists" in e.stderr.decode() if e.stderr else str(e):
-            pass  # Ignore "already exists" error
-        else:
-            raise
+        subprocess.run(
+            ["helm", "repo", "add", repo_name, repo_url, "--force-update"], check=True
+        )
 
 
-def run_helm_repo_update(repo_name: str) -> None:
-    subprocess.run(["helm", "repo", "update", repo_name], check=True)
+def local_repo_list():
+    result = subprocess.run(
+        ["helm", "repo", "list", "-o", "yaml"],
+        capture_output=True,
+        text=True,
+        check=True,
+    )
+    repo_list = yaml.safe_load(result.stdout)
+    return repo_list
 
 
 def get_chart_and_app_version(repo_name: str, chart_name: str) -> Tuple[str, str]:
@@ -34,6 +38,7 @@ def get_chart_and_app_version(repo_name: str, chart_name: str) -> Tuple[str, str
 
 def process_yaml_files(top_dir: str) -> None:
     seen_repos: Set[str] = set()
+    local_repos = local_repo_list()
 
     for root, _, files in os.walk(top_dir):
         for file in files:
@@ -73,12 +78,24 @@ def process_yaml_files(top_dir: str) -> None:
                 if not repo_name or not repo_url:
                     continue
 
+                local_repo = next(
+                    (repo for repo in local_repos if repo["name"] == repo_name), None
+                )
+                if local_repo is not None:
+                    local_repo_url = local_repo["url"]
+                    if local_repo_url != repo_url:
+                        raise Exception(
+                            dedent(f"""
+                            You have a local repo named {repo_name} pointing to {local_repo_url}, but the stack/demo wants {repo_url}
+                            Either delete or update your local repo URL, or update the stack/demo repo name so it doesn't conflict
+                        """)
+                        )
+
                 if repo_name not in seen_repos:
+                    # TODO: If the repo exists locally, but with a different URL, let the user know
                     run_helm_repo_add(repo_name, repo_url)
                     seen_repos.add(repo_name)
 
-                run_helm_repo_update(repo_name)
-
                 # print(f"📦 Updating {filepath} -> {repo_name}/{chart_name}")
                 new_chart_version, new_app_version = get_chart_and_app_version(
                     repo_name, chart_name
@@ -98,6 +115,9 @@ def process_yaml_files(top_dir: str) -> None:
                 print(f"✅ Updated {filepath}")
 
             except Exception as e:
+                # If debugging, you can get the exception line number like this:
+                # _, _, tb = os.sys.exc_info()
+                # lineno = tb.tb_lineno
                 print(f"⚠️ Error processing {filepath}: {e}")
 
 

From 6616080cdaab7e663824a9518add60a497557e06 Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Thu, 9 Jul 2026 15:22:00 +0200
Subject: [PATCH 08/17] fix(script): Ignore bumping templated versions

---
 .scripts/update_helm_charts.py | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/.scripts/update_helm_charts.py b/.scripts/update_helm_charts.py
index 98478108..3937490e 100755
--- a/.scripts/update_helm_charts.py
+++ b/.scripts/update_helm_charts.py
@@ -8,9 +8,9 @@
 
 
 def run_helm_repo_add(repo_name: str, repo_url: str) -> None:
-        subprocess.run(
-            ["helm", "repo", "add", repo_name, repo_url, "--force-update"], check=True
-        )
+    subprocess.run(
+        ["helm", "repo", "add", repo_name, repo_url, "--force-update"], check=True
+    )
 
 
 def local_repo_list():
@@ -78,6 +78,10 @@ def process_yaml_files(top_dir: str) -> None:
                 if not repo_name or not repo_url:
                     continue
 
+                chart_version = first_doc["version"]
+                if chart_version.startswith("{{"):
+                    continue
+
                 local_repo = next(
                     (repo for repo in local_repos if repo["name"] == repo_name), None
                 )

From e331d39051ec3457b8c259cbecd9d0c14cd4644d Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Thu, 9 Jul 2026 15:23:13 +0200
Subject: [PATCH 09/17] chore(helm): Update grafana repo name

---
 stacks/observability/grafana.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/stacks/observability/grafana.yaml b/stacks/observability/grafana.yaml
index 2a907e07..2e5467f0 100644
--- a/stacks/observability/grafana.yaml
+++ b/stacks/observability/grafana.yaml
@@ -4,12 +4,12 @@
 releaseName: grafana
 name: grafana
 repo:
-  name: grafana
+  name: grafana-community
   url: https://grafana-community.github.io/helm-charts
 # To find the latest version:
 # helm repo add grafana-community https://grafana-community.github.io/helm-charts --force-update
 # helm search repo grafana-community/grafana
-version: 11.3.2 # 12.4.1
+version: 12.7.2 # appVersion: 13.1.0
 options:
   extraLabels:
     stackable.tech/vendor: Stackable

From 767c99a8aaa025e38633dd1083667c82e46a1f75 Mon Sep 17 00:00:00 2001
From: Nick <10092581+NickLarsenNZ@users.noreply.github.com>
Date: Thu, 9 Jul 2026 20:10:46 +0200
Subject: [PATCH 10/17] Apply suggestions from code review

Co-authored-by: Techassi <git@techassi.dev>
---
 .scripts/update_helm_charts.py | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/.scripts/update_helm_charts.py b/.scripts/update_helm_charts.py
index 3937490e..32d42912 100755
--- a/.scripts/update_helm_charts.py
+++ b/.scripts/update_helm_charts.py
@@ -20,8 +20,7 @@ def local_repo_list():
         text=True,
         check=True,
     )
-    repo_list = yaml.safe_load(result.stdout)
-    return repo_list
+    return yaml.safe_load(result.stdout)
 
 
 def get_chart_and_app_version(repo_name: str, chart_name: str) -> Tuple[str, str]:
@@ -33,6 +32,8 @@ def get_chart_and_app_version(repo_name: str, chart_name: str) -> Tuple[str, str
         check=True,
     )
     chart_yaml = yaml.safe_load(result.stdout)
+    # Some charts don't have an appVersion and as such we fallback to a default
+    # value to not cause lookup errors.
     return chart_yaml["version"], chart_yaml.setdefault("appVersion", "Not present")
 
 
@@ -79,6 +80,7 @@ def process_yaml_files(top_dir: str) -> None:
                     continue
 
                 chart_version = first_doc["version"]
+                # Skip chart versions which seem to be templated.
                 if chart_version.startswith("{{"):
                     continue
 
@@ -96,7 +98,6 @@ def process_yaml_files(top_dir: str) -> None:
                         )
 
                 if repo_name not in seen_repos:
-                    # TODO: If the repo exists locally, but with a different URL, let the user know
                     run_helm_repo_add(repo_name, repo_url)
                     seen_repos.add(repo_name)
 

From ed73a38e16647086fbf2f83d58618e6653a92135 Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Thu, 9 Jul 2026 19:53:35 +0200
Subject: [PATCH 11/17] chore(script): Dedent and """

---
 .scripts/update_helm_charts.py | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/.scripts/update_helm_charts.py b/.scripts/update_helm_charts.py
index 32d42912..291a9052 100755
--- a/.scripts/update_helm_charts.py
+++ b/.scripts/update_helm_charts.py
@@ -128,15 +128,14 @@ def process_yaml_files(top_dir: str) -> None:
 
 if __name__ == "__main__":
     print(
-        '⚠️⚠️⚠️ This script is best-effort! Always check the result using "git diff"! ⚠️⚠️⚠️'
+        dedent("""
+            ⚠️⚠️⚠️ This script is best-effort! Always check the result using "git diff"! ⚠️⚠️⚠️
+            Notably, it skips invalid YAMLs, which can be the case because we sometimes use templating syntax, even for helm-chart definitions.
+            In those cases, use quotes around templated values, or otherwise comments for templated blocks.
+
+            Please judge on the skipped files if they contain a helm-chart and should be manually bumped.
+            The script can be improved to handle such files in the future.
+        """)
     )
-    print(
-        "Notably, it skips invalid YAMLs, which can be the case because we sometimes use templating syntax, even for helm-chart definitions"
-    )
-    print(
-        "Please judge on the skipped files if they contain a helm-chart and should be manually bumped"
-    )
-    print("The script can be improved to handle such files in the future")
-    print()
 
     process_yaml_files(".")

From 9e576bec694e4712888b34e8b23f99163d8bbad5 Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Thu, 9 Jul 2026 20:24:00 +0200
Subject: [PATCH 12/17] chore(script): Skip Vector bumps

These are currently tied to the vector version shipped with products via docker-images.

Hopefully we can move to OTLP for the vector sidecar -> vector-aggregator.
---
 .scripts/update_helm_charts.py | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.scripts/update_helm_charts.py b/.scripts/update_helm_charts.py
index 291a9052..7acde127 100755
--- a/.scripts/update_helm_charts.py
+++ b/.scripts/update_helm_charts.py
@@ -79,6 +79,16 @@ def process_yaml_files(top_dir: str) -> None:
                 if not repo_name or not repo_url:
                     continue
 
+                # At this point, it appears to be a Helm Chart manifest.
+
+                # Skip Vector, as we currently keep it tied to the version that the product sidecars use.abs
+                # Looking forward to swapping the transport with OTLP.
+                if chart_name == "vector":
+                    raise Exception(
+                        "Skipping vector. Ensure it is at the same version as the product sidecars"
+                    )
+                    continue
+
                 chart_version = first_doc["version"]
                 # Skip chart versions which seem to be templated.
                 if chart_version.startswith("{{"):

From a1c4de18e5eba4a06c50c850beee73a3fac3ba99 Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Thu, 9 Jul 2026 20:24:47 +0200
Subject: [PATCH 13/17] revert(helm): Go back to vector 0.55.0

---
 stacks/_templates/vector-aggregator.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stacks/_templates/vector-aggregator.yaml b/stacks/_templates/vector-aggregator.yaml
index 522a09b9..af99ee79 100644
--- a/stacks/_templates/vector-aggregator.yaml
+++ b/stacks/_templates/vector-aggregator.yaml
@@ -4,7 +4,7 @@ name: vector
 repo:
   name: vector
   url: https://helm.vector.dev
-version: 0.56.0 # appVersion: 0.56.0-distroless-libc
+version: 0.52.0 # app version 0.55.0
 options:
   commonLabels:
     stackable.tech/vendor: Stackable

From e41077522c80db560197edc874c287865868b770 Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Thu, 9 Jul 2026 20:25:32 +0200
Subject: [PATCH 14/17] revert(helm): Last minute ArgoCD bump

---
 stacks/_templates/argo-cd.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stacks/_templates/argo-cd.yaml b/stacks/_templates/argo-cd.yaml
index 828b8177..87730d33 100644
--- a/stacks/_templates/argo-cd.yaml
+++ b/stacks/_templates/argo-cd.yaml
@@ -4,7 +4,7 @@ name: argo-cd
 repo:
   name: argo-cd
   url: https://argoproj.github.io/argo-helm
-version: 10.1.2 # appVersion: v3.4.4
+version: 10.1.3 # appVersion: v3.4.5
 options:
   global:
     additionalLabels:

From db8d32ddd7d2791bbfb041f5ef70a8f99d2f1cde Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Thu, 9 Jul 2026 20:44:30 +0200
Subject: [PATCH 15/17] chore(helm): Update loki and tempo

They have new helm-chart repos.
---
 stacks/observability/grafana-loki.yaml  |  8 ++++----
 stacks/observability/grafana-tempo.yaml | 12 +++++-------
 2 files changed, 9 insertions(+), 11 deletions(-)

diff --git a/stacks/observability/grafana-loki.yaml b/stacks/observability/grafana-loki.yaml
index 27ef1b0c..1ac6551e 100644
--- a/stacks/observability/grafana-loki.yaml
+++ b/stacks/observability/grafana-loki.yaml
@@ -3,12 +3,12 @@
 releaseName: loki
 name: loki
 repo:
-  name: loki
-  url: https://grafana.github.io/helm-charts
+  name: grafana-community
+  url: https://grafana-community.github.io/helm-charts
 # To find the latest version:
-# helm repo add grafana https://grafana.github.io/helm-charts --force-update
+# helm repo add grafana-community https://grafana-community.github.io/helm-charts --force-update
 # helm search repo grafana/loki
-version: 7.0.0 # appVersion: 3.6.7
+version: 18.4.2 # appVersion: 3.7.3
 options:
   deploymentMode: SingleBinary
   singleBinary:
diff --git a/stacks/observability/grafana-tempo.yaml b/stacks/observability/grafana-tempo.yaml
index 7bb82c0d..4685be09 100644
--- a/stacks/observability/grafana-tempo.yaml
+++ b/stacks/observability/grafana-tempo.yaml
@@ -3,14 +3,12 @@
 releaseName: tempo
 name: tempo
 repo:
-  name: tempo
-  url: https://grafana.github.io/helm-charts
-# Watch out for https://github.com/grafana/helm-charts/issues/3417
-# Workaround at: https://github.com/grafana/helm-charts/issues/3660#issuecomment-3007113458
+  name: grafana-community
+  url: https://grafana-community.github.io/helm-charts
 # To find the latest version:
-# helm repo add grafana https://grafana.github.io/helm-charts --force-update
-# helm search repo grafana/tempo
-version: 1.24.4 # appVersion: 2.9.0
+# helm repo add grafana-community https://grafana-community.github.io/helm-charts --force-update
+# helm search repo grafana-community/tempo
+version: 2.2.3 # appVersion: 2.10.7
 options:
   global:
     commonLabels:

From 858eae4c2a3c803c6d57e42c147eaeeab40bda05 Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Thu, 9 Jul 2026 20:44:48 +0200
Subject: [PATCH 16/17] chore(script): Improve script output

---
 .scripts/update_helm_charts.py | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/.scripts/update_helm_charts.py b/.scripts/update_helm_charts.py
index 7acde127..983f2ab9 100755
--- a/.scripts/update_helm_charts.py
+++ b/.scripts/update_helm_charts.py
@@ -8,9 +8,17 @@
 
 
 def run_helm_repo_add(repo_name: str, repo_url: str) -> None:
-    subprocess.run(
-        ["helm", "repo", "add", repo_name, repo_url, "--force-update"], check=True
+    result = subprocess.run(
+        ["helm", "repo", "add", repo_name, repo_url, "--force-update"],
+        capture_output=True,
+        check=True,
     )
+    if result.returncode == 0:
+        print(f"✅ Added/Updated {repo_name} ({repo_url})")
+    else:
+        print(
+            f"⚠️ There was a problem Adding/Updating {repo_name} ({repo_url}): {result.stderr}"
+        )
 
 
 def local_repo_list():

From dbaf0d9f203205a4c98fd611b39ba75879081f6b Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Thu, 9 Jul 2026 21:31:23 +0200
Subject: [PATCH 17/17] chore(helm): Update signal-processing/grafana to the
 new charts repo

---
 stacks/signal-processing/grafana.yaml | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/stacks/signal-processing/grafana.yaml b/stacks/signal-processing/grafana.yaml
index fb9bb222..2462d723 100644
--- a/stacks/signal-processing/grafana.yaml
+++ b/stacks/signal-processing/grafana.yaml
@@ -2,9 +2,12 @@
 releaseName: grafana
 name: grafana
 repo:
-  name: grafana
-  url: https://grafana.github.io/helm-charts
-version: 10.5.15 # appVersion: 12.3.1
+  name: grafana-community
+  url: https://grafana-community.github.io/helm-charts
+# To find the latest version:
+# helm repo add grafana-community https://grafana-community.github.io/helm-charts --force-update
+# helm search repo grafana-community/grafana
+version: 12.7.2 # appVersion: 13.1.0
 options:
   extraLabels:
     stackable.tech/vendor: Stackable