[kube-prometheus-stack] Helm chart won't install with admission webhook disabled

[coffee-time-design]

Describe the bug a clear and concise description of what the bug is.

The Helm chart doesn't seem to install if admissionWebhooks is disabled.

What's your helm version?

version.BuildInfo{Version:"v4.1.0", GitCommit:"4553a0a96e5205595079b6757236cc6f969ed1b9", GitTreeState:"clean", GoVersion:"go1.25.6", KubeClientVersion:"v1.35"}

What's your kubectl version?

Client Version: v1.34.3 Kustomize Version: v5.7.1 Server Version: v1.35.0+k3s1

Which chart?

prometheus-community/kube-prometheus-stack

What's the chart version?

81.4.2

What happened?

I have tried to install the Prometheus helm chart a few times and it fails due to this error:
MountVolume.SetUp failed for volume "tls-secret" : secret "prometheus-kube-prometheus-admission" not found
Which produces this:
pod/prometheus-kube-prometheus-operator-5c6ddc5c45-nm459 0/1 ContainerCreating 0 3h14m

This is because I have admissionWebhooks disabled, if I enable it, the chart creates the secret.

What you expected to happen?

I expect the chart to install successfully, without the webhooks when set to disabled.

How to reproduce it?

Set admissionWebhooks to disabled.

Enter the changed values of values.yaml?

prometheusOperator:
admissionWebhooks:
enabled: false

Enter the command that you execute and failing/misfunctioning.

helm upgrade prometheus prometheus-community/kube-prometheus-stack --install -n prometheus -f custom-values.yaml --version 81.4.2

Anything else we need to know?

I disabled admissionWebhooks as it conflicts with another webhook.

[zeritti]

Prometheus operator uses the secret with TLS resources created by the create secret job. With the admission webhook disabled, the job does not run, the secret does not get created and cannot be therefore mounted as a volume - the file paths set in the corresponding operator's flags are then missing.
At the moment, one workaround would be disabling TLS support in Prometheus operator by setting prometheusOperator.tls.enabled=false. Prometheus operator will start but without TLS support at its metrics endpoint (its ServiceMonitor is ready for such a configuration).

To keep TLS support without the admission webhook, supplying a secret with TLS resources (e.g. a certificate by cert-manager could be created by means of extraManifests), setting prometheusOperator.extraVolumes, prometheusOperator.extraVolumeMounts and prometheusOperator.extraArgs should be possible.