Deploy releases/k8s-manifests a96152b

[github-actions]

kubectl diff reports that applying a96152b will change:

diff -uN /tmp/LIVE-1197455589/rbac.authorization.k8s.io.v1.Role.choose-native-plants.deployment-admin /tmp/MERGED-59614736/rbac.authorization.k8s.io.v1.Role.choose-native-plants.deployment-admin
--- /tmp/LIVE-1197455589/rbac.authorization.k8s.io.v1.Role.choose-native-plants.deployment-admin	2025-05-16 10:39:05.450304553 +0000
+++ /tmp/MERGED-59614736/rbac.authorization.k8s.io.v1.Role.choose-native-plants.deployment-admin	2025-05-16 10:39:05.462299334 +0000
@@ -89,3 +89,12 @@
   - update
   - patch
   - delete
+- apiGroups:
+  - metrics.k8s.io
+  resources:
+  - pods
+  - nodes
+  verbs:
+  - get
+  - list
+  - watch

[github-actions]

kubectl apply output (excluding unchanged) for 7e11012 was:

customresourcedefinition.apiextensions.k8s.io/sealedsecrets.bitnami.com configured
clusterrole.rbac.authorization.k8s.io/grafana-clusterrole configured
clusterrole.rbac.authorization.k8s.io/prometheus-alertmanager configured
clusterrole.rbac.authorization.k8s.io/prometheus-pushgateway configured
clusterrolebinding.rbac.authorization.k8s.io/cert-manager-webhook:subjectaccessreviews configured
clusterrolebinding.rbac.authorization.k8s.io/sealed-secrets configured
mutatingwebhookconfiguration.admissionregistration.k8s.io/cert-manager-webhook configured
validatingwebhookconfiguration.admissionregistration.k8s.io/cert-manager-webhook configured
validatingwebhookconfiguration.admissionregistration.k8s.io/ingress-nginx-admission configured
configmap/cert-manager-webhook configured
configmap/cert-manager configured
rolebinding.rbac.authorization.k8s.io/cert-manager-webhook:dynamic-serving configured
deployment.apps/choose-native-plants configured
role.rbac.authorization.k8s.io/deployment-admin configured
statefulset.apps/data-warehouse-postgresql configured
configmap/grafana-dashboards-default configured
deployment.apps/grafana configured
deployment.apps/ingress-nginx-controller configured
deployment.apps/metrics-server configured
rolebinding.rbac.authorization.k8s.io/cert-manager:leaderelection configured
secret/promtail configured
statefulset.apps/loki configured
statefulset.apps/database configured
deployment.apps/prometheus-alertmanager configured
deployment.apps/prometheus-kube-state-metrics configured
deployment.apps/prometheus-pushgateway configured
deployment.apps/prometheus-server configured
serviceaccount/prometheus-kube-state-metrics configured
deployment.apps/sealed-secrets configured
rolebinding.rbac.authorization.k8s.io/sealed-secrets-key-admin configured
service/sealed-secrets configured
clusterrole.rbac.authorization.k8s.io "sealed-secrets-access" deleted
clusterrolebinding.rbac.authorization.k8s.io "sealed-secrets-access-choose-native-plants" deleted