This message was deleted.

Initial approach with no transformations using dotnet/c#:

// kube prometheus stack; <https://github.com/prometheus-community/helm-charts/tree/main/charts/kube-prometheus-stack>
var kubePrometheusStackCrds = new ConfigGroup("kube-prometheus-stack-crds",
    new ConfigGroupArgs { Yaml = ReadResource("KubePrometheusStackCrds.yaml") },
    new ComponentResourceOptions { /*Protect = true,*/ Provider = k8sProvider });

var monitoringNs = new Namespace("monitoring",
    new NamespaceArgs { Metadata = new ObjectMetaArgs { Name = "monitoring" } },
    new CustomResourceOptions { Provider = k8sProvider });

var kubePrometheusStackValues =
    new Dictionary<string, object>
    {
        ["alertmanager"] = new
        {
            alertmanagerSpec = new
            {
                nodeSelector = new { role = "monitoring" },
                tolerations = new[] { new { key = "role", @operator = "Exists" } }
            },
            ingress = new { enabled = false }
        },
        ["grafana"] = new
        {
            ingress = new { enabled = false },
            nodeSelector = new { role = "monitoring" },
            tolerations = new[] { new { key = "role", @operator = "Exists" } }
        },
        ["kubeControllerManager"] = new { enabled = false },
        ["kubeEtcd"] = new { enabled = false },
        ["kubeScheduler"] = new { enabled = false },
        ["kube-state-metrics"] = new
        {
            nodeSelector = new { role = "monitoring" },
            tolerations = new[] { new { key = "role", @operator = "Exists" } }
        },
        ["prometheus"] = new
        {
            ingress = new { enabled = false },
            prometheusSpec = new
            {
                podMonitorSelectorNilUsesHelmValues = false,
                serviceMonitorSelectorNilUsesHelmValues = false,
                nodeSelector = new { role = "monitoring" },
                tolerations = new[] { new { key = "role", @operator = "Exists" } }
            }
        },
        ["prometheus-node-exporter"] = new { tolerations = new[] { new { key = "role", @operator = "Exists" } } },
        ["prometheusOperator"] = new
        {
            admissionWebhooks = new
            {
                certManager = new { enabled = true },
                patch = new
                {
                    nodeSelector = new { role = "monitoring" },
                    tolerations = new[] { new { key = "role", @operator = "Exists" } }
                }
            },
            nodeSelector = new { role = "monitoring" },
            tolerations = new[] { new { key = "role", @operator = "Exists" } }
        }
    };

new Chart("kube-prometheus-stack",
    new ChartArgs
    {
        Namespace = monitoringNs.Metadata.Apply(metadata => metadata.Name),
        FetchOptions = new ChartFetchArgs { Repo = "<https://prometheus-community.github.io/helm-charts>" },
        Chart = "kube-prometheus-stack",
        Version = K8sConfig.KubePrometheusStackChartVersion,
        Values = kubePrometheusStackValues,
        SkipCRDRendering = true
    },
    new ComponentResourceOptions { DependsOn = { kubePrometheusStackCrds, certManagerCrds }, Provider = k8sProvider });

Hi @worried-city-86458. I gave up, couldn't get it working

hey @worried-city-86458.

# Do not wait for services in 'kube-system' namespace
# kps-rapid-kube-prometheus-kube-controller-manager
# kps-rapid-kube-prometheus-kube-etcd
# kps-rapid-kube-prometheus-kube-proxy
# kps-rapid-kube-prometheus-kube-scheduler
def kube_system_not_wait(obj):
    if obj["kind"] == "Service":
        if obj["metadata"]["namespace"] == "kube-system":
            if not obj["metadata"].get("annotations"):
                obj["metadata"]["annotations"] =\
                    {
                        "<http://pulumi.com/skipAwait|pulumi.com/skipAwait>": "true"
                    }


# Apply 'DaemonSet(s)' only to 'linux' nodes
def only_linux_nodes(obj):
    if obj["kind"] == "DaemonSet":
        obj["spec"]["template"]["spec"]["nodeSelector"] =\
            {
                "<http://beta.kubernetes.io/os|beta.kubernetes.io/os>": "linux"
            }


# TODO: Remove this when <https://github.com/pulumi/pulumi-kubernetes/issues/800>
#  is fixed
# Remove the .status field from CRDs
def remove_crds_status(obj):
    if obj["kind"] == "CustomResourceDefinition":
        del obj["status"]


# Do not install CRDs as they are installed via ConfigFile
def omit_crds(obj):
    if obj["kind"] == "CustomResourceDefinition":
        obj["apiVersion"] = "v1"
        obj["kind"] = "List"


# TODO: Remove this after it is fixed
#  <https://github.com/pulumi/pulumi-kubernetes/issues/555>
# Remove Grafana's 'test-pod'
def omit_grafana_test_pod(obj):
    # if obj["kind"] == "Pod" and 'grafana-test' in obj["metadata"]["name"]:
    if 'grafana-test' in obj["metadata"]["name"]:
        obj["apiVersion"] = "v1"
        obj["kind"] = "List"

Thanks, @better-actor-92669. I got it to work with a few differences to the above. In particular I didn't need the

skipAwait

annotation. Why did you need that?

@worried-city-86458, I don't remember to be honest, but my best guess is that some of the Services in kube-system namespace wouldn't be marked as "ready" by Pulumi ("pulumi up" was timing out), so I had to bypass that manually