[kube-prometheus-stack] skip disabled single-rule groups

[Zakharden]

What this PR does / why we need it

Skips rendering the three generated single-alert PrometheusRule groups when their only alert is disabled via defaultRules.disabled.

With Helm 4, disabling KubeControllerManagerDown, KubeProxyDown, or KubeSchedulerDown currently leaves a rendered PrometheusRule with spec.groups[].rules: null, which Kubernetes rejects because rules must be an array. Since each affected group contains only that one alert, omitting the whole group avoids rendering invalid resources while preserving the default behavior when the alerts are enabled.

The generated templates and hack/sync_prometheus_rules.py are updated together so future rule syncs keep the same guards.

Which issue this PR fixes

• fixes [prometheus-kube-stack] won't install with some defaultRules disabled when using Helm 4 #6772

Special notes for your reviewer

I added a focused helm-unittest case for the disabled single-rule groups. I could not run it locally because the helm unittest plugin is not installed in this environment, but the rendered chart was validated with helm template and helm lint.

Validation

• helm template test charts/kube-prometheus-stack --kube-version 1.35.4 --set defaultRules.disabled.KubeControllerManagerDown=true --set defaultRules.disabled.KubeProxyDown=true --set defaultRules.disabled.KubeSchedulerDown=true --set grafana.enabled=false --set kubeStateMetrics.enabled=false --set nodeExporter.enabled=false --set windowsMonitoring.enabled=false > /tmp/kps-disabled-rules.yaml
• rg -n "kubernetes-system-(kube-proxy|controller-manager|scheduler)" /tmp/kps-disabled-rules.yaml (no matches)
• helm template test charts/kube-prometheus-stack --kube-version 1.35.4 --show-only templates/prometheus/rules-1.14/kubernetes-system-kube-proxy.yaml --show-only templates/prometheus/rules-1.14/kubernetes-system-controller-manager.yaml --show-only templates/prometheus/rules-1.14/kubernetes-system-scheduler.yaml
• helm lint charts/kube-prometheus-stack --kube-version 1.35.4
• helm lint charts/kube-prometheus-stack --kube-version 1.35.4 --set defaultRules.disabled.KubeControllerManagerDown=true --set defaultRules.disabled.KubeProxyDown=true --set defaultRules.disabled.KubeSchedulerDown=true --set grafana.enabled=false --set kubeStateMetrics.enabled=false --set nodeExporter.enabled=false --set windowsMonitoring.enabled=false
• git diff --check

Checklist

• DCO signed
• Chart Version bumped
• Title of the PR starts with chart name (e.g. [prometheus-couchdb-exporter])

[Zakharden]

Hi maintainers, could someone review this when available?

It avoids rendering invalid PrometheusRule objects with rules: null when the single-alert controller-manager/kube-proxy/scheduler groups are disabled.

I validated the disabled and enabled render paths with helm template/helm lint; I’m happy to adjust the unittest coverage or generated sync changes if you prefer a different pattern. Thanks.
@dpetersen @Bregor @redondos @kesor

[Zakharden]

@jkroepke Rebased on the latest main; the PR is mergeable now and CI is green. I also verified the focused helm-unittest case locally. Could you please re-review when you have a chance?

[jkroepke]

Thanks