diff --git a/packs/metrics-server-3.13.1/README.md b/packs/metrics-server-3.13.1/README.md
new file mode 100644
index 00000000..cf7bc7d1
--- /dev/null
+++ b/packs/metrics-server-3.13.1/README.md
@@ -0,0 +1,124 @@
+# Metrics Server
+
+[Metrics Server](https://github.com/kubernetes-sigs/metrics-server) is a scalable, efficient source of container resource metrics for Kubernetes built-in autoscaling pipelines. It collects resource usage (CPU and memory) from the `kubelet` on each node and exposes it through the Kubernetes [Metrics API](https://github.com/kubernetes/metrics), which is consumed by core components such as the Horizontal Pod Autoscaler (`kubectl autoscale`), the Vertical Pod Autoscaler, and `kubectl top`.
+
+This pack packages the official Metrics Server Helm chart, version `3.13.1`, which deploys Metrics Server `v0.8.1`.
+
+
+## Prerequisites
+
+- A Kubernetes cluster running v1.29 or later.
+- Network connectivity between the API server and the `kubelet` on every node (the API server must be able to reach the Metrics Server pod, and Metrics Server must be able to reach each node's `kubelet` on the configured port).
+- No previous, non-Palette-managed installation of Metrics Server on the target cluster. Some managed Kubernetes distributions (for example EKS, AKS and GKE) ship their own Metrics Server add-on; disable it before deploying this pack to avoid a conflict over the `v1beta1.metrics.k8s.io` API service.
+
+
+## Parameters
+
+The pack exposes the upstream Helm chart values under the `charts.metrics-server` key. The defaults work for most clusters; the parameters below are the ones most likely to need changing.
+
+| **Parameter** | **Description** | **Type** | **Default Value** | **Required** |
+|---|---|---|---|---|
+| `charts.metrics-server.image.repository` | Metrics Server image repository. | String | `registry.k8s.io/metrics-server/metrics-server` | No |
+| `charts.metrics-server.image.tag` | Image tag. Empty means the chart's `appVersion` (`v0.8.1`). | String | `""` | No |
+| `charts.metrics-server.replicas` | Number of Metrics Server replicas. | Int | `1` | No |
+| `charts.metrics-server.defaultArgs` | Default command-line arguments passed to Metrics Server. | List | See values | No |
+| `charts.metrics-server.args` | Additional command-line arguments appended to `defaultArgs`. | List | `[]` | No |
+| `charts.metrics-server.apiService.insecureSkipTLSVerify` | Skip TLS verification when the API server calls the Metrics Server API service. Disable and set `apiService.caBundle` for a hardened setup. | Bool | `true` | No |
+| `charts.metrics-server.tls.type` | TLS certificate method: `metrics-server`, `helm`, `cert-manager`, or `existingSecret`. | String | `"metrics-server"` | No |
+| `charts.metrics-server.hostNetwork.enabled` | Run Metrics Server in the host network namespace. Required on some overlay networks (for example Weave on EKS) where the API server cannot otherwise reach the pod. | Bool | `false` | No |
+| `charts.metrics-server.resources` | CPU/memory requests and limits for the Metrics Server container. | Object | `requests: {cpu: 100m, memory: 200Mi}` | No |
+| `charts.metrics-server.podDisruptionBudget.enabled` | Create a PodDisruptionBudget for the Metrics Server deployment. | Bool | `false` | No |
+| `charts.metrics-server.service.type` | Service type for the Metrics Server Service. | String | `ClusterIP` | No |
+| `charts.metrics-server.serviceMonitor.enabled` | Create a Prometheus `ServiceMonitor` for Metrics Server. Requires the Prometheus Operator CRDs to be present. | Bool | `false` | No |
+| `charts.metrics-server.nodeSelector` | Node selector for the Metrics Server pod. | Object | `{}` | No |
+| `charts.metrics-server.tolerations` | Tolerations for the Metrics Server pod. | List | `[]` | No |
+
+> [!CAUTION]
+> If your cloud provider or Kubernetes distribution already ships a Metrics Server add-on (for example the EKS or AKS built-in add-on), remove it before installing this pack. Two Metrics Server instances competing for the same `v1beta1.metrics.k8s.io` API service will conflict.
+
+
+## Upgrade
+
+This is the initial release of this pack, so there are no prior pack versions to migrate from. When upgrading to a future version of this pack, review the [Metrics Server releases](https://github.com/kubernetes-sigs/metrics-server/releases) and the chart's [CHANGELOG](https://github.com/kubernetes-sigs/metrics-server/blob/master/charts/metrics-server/CHANGELOG.md) for breaking changes between chart versions, since Helm does not automatically reconcile changes to cluster-scoped resources such as `ClusterRole`, `ClusterRoleBinding`, or the `APIService`.
+
+
+## Usage
+
+Add this pack as a layer in an [add-on cluster profile](https://docs.spectrocloud.com/profiles/cluster-profiles/create-cluster-profiles/create-addon-profile/). The default values work for most clusters without any changes.
+
+Once the cluster reconciles, confirm Metrics Server is running and serving metrics:
+
+```powershell
+kubectl get pods -n kube-system -l app.kubernetes.io/name=metrics-server
+kubectl top nodes
+kubectl top pods -A
+```
+
+
+## Known Issues on Managed Kubernetes
+
+### EKS / AKS / GKE: Metrics Server conflict
+
+These managed Kubernetes distributions deploy their own Metrics Server. When Spectro Cloud provisions a cluster, it also deploys an older version (chart `3.8.4`, appVersion `0.9.0-spectro`). This creates a conflict with this pack.
+
+**Symptoms:**
+- Pack stuck at "AddOnDeploying"
+- Error: `ClusterRole "system:metrics-server-aggregated-reader" exists and cannot be imported`
+
+**Resolution:**
+
+```powershell
+# 1. Find the Spectro Cloud namespace with the old release
+helm list --all-namespaces | findstr metrics
+
+# 2. Uninstall the old release (use the namespace from step 1)
+helm uninstall metrics-server -n <NAMESPACE>
+```
+
+Spectro Cloud will automatically redeploy your pack (chart `3.13.1`) with `apiService.create: true` (the default). No additional steps are required.
+
+> [!NOTE]
+> The default value `apiService.create: true` is required for `kubectl top` and HPA to work. Do not set it to `false` unless you need to coexist with another metrics-server installation (not recommended).
+
+## HPA Test (PowerShell)
+
+To verify Metrics Server works with the Horizontal Pod Autoscaler:
+
+```powershell
+# 1. Create a deployment
+kubectl create deployment example-app --image=registry.k8s.io/hpa-example --replicas=1 -n default
+kubectl set resources deployment example-app --requests=cpu=200m --limits=cpu=500m
+
+# 2. Expose the service
+kubectl expose deployment example-app --port=80 --target-port=80
+
+# 3. Create the HPA
+kubectl autoscale deployment example-app --cpu-percent=70 --min=1 --max=5
+
+# 4. Verify HPA is ready
+kubectl get hpa example-app
+# Expected: TARGETS cpu: 0%/70%, REPLICAS 1
+
+# 5. Generate CPU load (run in one terminal)
+kubectl run load-generator --image=busybox --rm -i --tty --restart=Never -- /bin/sh -c "while true; do wget -q -O- http://example-app; done"
+
+# 6. Watch scaling (in another terminal)
+kubectl get pods -l app=example-app --watch
+kubectl get hpa example-app
+# Expected: REPLICAS scales from 1 to 5
+
+# 7. Clean up
+kubectl delete hpa example-app
+kubectl delete deployment example-app
+kubectl delete service example-app
+```
+
+
+## References
+
+- [Metrics Server on GitHub](https://github.com/kubernetes-sigs/metrics-server)
+- [Metrics Server Helm chart](https://github.com/kubernetes-sigs/metrics-server/tree/master/charts/metrics-server)
+- [Kubernetes Metrics API](https://github.com/kubernetes/metrics)
+- [Horizontal Pod Autoscaler documentation](https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/)
+- [Metrics Server FAQ](https://github.com/kubernetes-sigs/metrics-server/blob/master/FAQ.md)
+- [Metrics Server known issues](https://github.com/kubernetes-sigs/metrics-server/blob/master/KNOWN_ISSUES.md)
diff --git a/packs/metrics-server-3.13.1/charts/metrics-server-3.13.1.tgz b/packs/metrics-server-3.13.1/charts/metrics-server-3.13.1.tgz
new file mode 100644
index 00000000..7d629c69
Binary files /dev/null and b/packs/metrics-server-3.13.1/charts/metrics-server-3.13.1.tgz differ
diff --git a/packs/metrics-server-3.13.1/charts/metrics-server/.helmignore b/packs/metrics-server-3.13.1/charts/metrics-server/.helmignore
new file mode 100644
index 00000000..0e8a0eb3
--- /dev/null
+++ b/packs/metrics-server-3.13.1/charts/metrics-server/.helmignore
@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
diff --git a/packs/metrics-server-3.13.1/charts/metrics-server/CHANGELOG.md b/packs/metrics-server-3.13.1/charts/metrics-server/CHANGELOG.md
new file mode 100644
index 00000000..9e4c3521
--- /dev/null
+++ b/packs/metrics-server-3.13.1/charts/metrics-server/CHANGELOG.md
@@ -0,0 +1,193 @@
+# Metrics Server Helm Chart Changelog
+
+> [!NOTE]
+> All notable changes to this project will be documented in this file; the format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+<!--
+### Added - For new features.
+### Changed - For changes in existing functionality.
+### Deprecated - For soon-to-be removed features.
+### Removed - For now removed features.
+### Fixed - For any bug fixes.
+### Security - In case of vulnerabilities.
+-->
+
+## [UNRELEASED]
+
+## [3.13.1] - 2026-02-27
+
+### Changed
+
+- Update the _Metrics Server_ OCI image to [`0.8.1`](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.8.1). ([#1770](https://github.com/kubernetes-sigs/metrics-server/pull/1770)) _@stevehipwell_
+
+### Fixed
+
+- Conditionally render `insecureSkipTLSVerify` field in APIService template to prevent GitOps sync drift when value is `false`. ([#1727](https://github.com/kubernetes-sigs/metrics-server/pull/1727)) _@pawl_
+- Do not render annotations as null in APIService template to prevent permanent OutOfSync in ArgoCD. ([#1752](https://github.com/kubernetes-sigs/metrics-server/pull/1752)) _@Serializator_
+
+## [3.13.0] - 2025-07-22
+
+### Added
+
+- Add chart options to secure the connection between Metrics Server and the Kubernetes API Server. ([#1288](https://github.com/kubernetes-sigs/metrics-server/pull/1288)) _@mkilchhofer_
+- Add `unhealthyPodEvictionPolicy` to the Metrics Server PDB as a user enabled feature. ([#1574](https://github.com/kubernetes-sigs/metrics-server/pull/1574)) @peterabarr
+
+### Changed
+
+- Update the _Addon Resizer_ OCI image to [`1.8.23`](https://github.com/kubernetes/autoscaler/releases/tag/addon-resizer-1.8.23). ([#1626](https://github.com/kubernetes-sigs/metrics-server/pull/1626)) _@stevehipwell_
+- Update the _Metrics Server_ OCI image to [`0.8.0`](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.8.0). ([#1683](https://github.com/kubernetes-sigs/metrics-server/pull/1683)) _@stevehipwell_
+
+## [3.12.2] - 2024-10-07
+
+### Added
+
+- Explicitly added the app protocol to the service. ([#1540](https://github.com/kubernetes-sigs/metrics-server/pull/1540)) _@
+seankhliao_
+
+### Changed
+
+- Updated the _Metrics Server_ OCI image to [v0.7.2](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.2). ([#1568](https://github.com/kubernetes-sigs/metrics-server/pull/1568)) _@stevehipwell_
+- Updated the _addonResizer_ OCI image to [1.8.21](https://github.com/kubernetes/autoscaler/releases/tag/addon-resizer-1.8.21). ([#1504](https://github.com/kubernetes-sigs/metrics-server/pull/1504)) _@jimmy-ungerman_
+
+### Fixed
+
+- Fixed nanny's RoleBinding which contained a hard-coded namespace instead of the Helm's release namespace. ([#1479](https://github.com/kubernetes-sigs/metrics-server/pull/1479)) _@the-technat_
+- Fixed the `ServiceMonitor` job label. ([#1568](https://github.com/kubernetes-sigs/metrics-server/pull/1568)) _@stevehipwell_
+
+## [3.12.1] - 2024-04-05
+
+### Changed
+
+- Updated the _Metrics Server_ OCI image to [v0.7.1](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.1). ([#1461](https://github.com/kubernetes-sigs/metrics-server/pull/1461)) _@stevehipwell_
+- Changed `Deployment` templating to ignore `schedulerName` when value is empty. ([#1475](https://github.com/kubernetes-sigs/metrics-server/pull/1475)) _@senges_
+
+## [3.12.0] - 2024-02-07
+
+### Changed
+
+- Updated the _Metrics Server_ OCI image to [v0.7.0](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0). ([#1414](https://github.com/kubernetes-sigs/metrics-server/pull/1414)) [@stevehipwell](https://github.com/stevehipwell)
+- Updated the _addon-resizer_ OCI image to [v1.8.20](https://github.com/kubernetes/autoscaler/releases/tag/addon-resizer-1.8.20). ([#1414](https://github.com/kubernetes-sigs/metrics-server/pull/1414)) [@stevehipwell](https://github.com/stevehipwell)
+
+## [3.11.0] - 2023-08-03
+
+### Added
+
+- Added default _Metrics Server_ resource requests.
+
+### Changed
+
+- Updated the _Metrics Server_ OCI image to [v0.6.4](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.4).
+- Updated the _addon-resizer_ OCI image to [v1.8.19](https://github.com/kubernetes/autoscaler/releases/tag/addon-resizer-1.8.19).
+
+## [3.10.0] - 2023-04-12
+
+### Added
+
+- Added support for running under PodSecurity restricted.
+
+### Fixed
+
+- Fixed `auth-reader` role binding namespace to always use `kube-system`.
+- Fixed addon-resizer configuration.
+- Fixed container port default not having been updated to `10250`.
+
+## [3.9.0] - 2023-03-28
+
+### Added
+
+- Added autoscaling support via the addon-resizer.
+
+### Changed
+
+- Updated the _Metrics Server_ OCI image to [v0.6.3](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3).
+
+### Fixed
+
+- Fixed service labels/annotations.
+
+## [3.8.4] - 2023-03-06
+
+### Changed
+
+- Changed the image registry location to `registry.k8s.io`.
+
+## [3.8.3] - 2022-12-08
+
+### Added
+
+- Added support for topologySpreadConstraints.
+- Always set resource namespaces explicitly.
+- Allow configuring TLS on the APIService.
+- Enabled service monitor relabelling.
+- Added ability to set the scheduler name.
+- Added support for common labels.
+
+### Changed
+
+- Updated the _Metrics Server_ OCI image to [v0.6.2](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2).
+
+## [3.8.2] - 2022-02-23
+
+### Changed
+
+- Changed chart to allow probes to be turned off completely (this is not advised unless you know what you're doing).
+
+## [3.8.1] - 2022-02-09
+
+### Changed
+
+- Updated the _Metrics Server_ OCI image to [v0.6.1](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.1).
+
+## [3.8.0] - 2022-02-08
+
+### Added
+
+- Added support for unauthenticated access to the /metrics endpoint.
+- Added optional _Prometheus Operator_ `ServiceMonitor`.
+
+### Changed
+
+- Updated the _Metrics Server_ OCI image to [v0.6.0](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.0).
+
+## [3.7.0] - 2021-11-18
+
+### Changed
+
+- Updated the _Metrics Server_ OCI image to [v0.5.2](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.5.2).
+
+## [3.6.0] - 2021-10-18
+
+### Added
+
+- Added new `defaultArgs`` value to enable overriding the default arguments.
+
+### Changed
+
+- Updated the _Metrics Server_ OCI image to [v0.5.1](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.5.1).
+
+## [3.5.0] - 2021-10-07
+
+### Added
+
+- Added initial Helm chart release from official repo.
+
+<!--
+RELEASE LINKS
+-->
+[UNRELEASED]: https://github.com/kubernetes-sigs/metrics-server/tree/master/charts/metrics-server
+[3.13.1]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.13.1
+[3.13.0]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.13.0
+[3.12.2]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.12.2
+[3.12.1]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.12.1
+[3.12.0]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.12.0
+[3.11.0]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.11.0
+[3.10.0]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.10.0
+[3.9.0]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.9.0
+[3.8.4]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.8.4
+[3.8.3]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.8.3
+[3.8.2]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.8.2
+[3.8.1]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.8.1
+[3.8.0]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.8.0
+[3.7.0]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.7.0
+[3.6.0]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.6.0
+[3.5.0]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.5.0
diff --git a/packs/metrics-server-3.13.1/charts/metrics-server/Chart.yaml b/packs/metrics-server-3.13.1/charts/metrics-server/Chart.yaml
new file mode 100644
index 00000000..5b94ef77
--- /dev/null
+++ b/packs/metrics-server-3.13.1/charts/metrics-server/Chart.yaml
@@ -0,0 +1,29 @@
+apiVersion: v2
+name: metrics-server
+description: Metrics Server is a scalable, efficient source of container resource metrics for Kubernetes built-in autoscaling pipelines.
+type: application
+version: 3.13.1
+appVersion: 0.8.1
+keywords:
+  - kubernetes
+  - metrics-server
+  - metrics
+home: https://github.com/kubernetes-sigs/metrics-server
+icon: https://avatars.githubusercontent.com/u/36015203?s=400&v=4
+sources:
+  - https://github.com/kubernetes-sigs/metrics-server
+maintainers:
+  - name: stevehipwell
+    url: https://github.com/stevehipwell
+  - name: krmichel
+    url: https://github.com/krmichel
+  - name: endrec
+    url: https://github.com/endrec
+annotations:
+  artifacthub.io/changes: |
+    - kind: fixed
+      description: "Conditionally render `insecureSkipTLSVerify` field in APIService template to prevent GitOps sync drift when value is `false`."
+    - kind: fixed
+      description: "Do not render annotations as null in APIService template to prevent permanent OutOfSync in ArgoCD."
+    - kind: changed
+      description: "Update the Metrics Server OCI image to [`0.8.1`](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.8.1)."
diff --git a/packs/metrics-server-3.13.1/charts/metrics-server/README.md b/packs/metrics-server-3.13.1/charts/metrics-server/README.md
new file mode 100644
index 00000000..d6bbdf25
--- /dev/null
+++ b/packs/metrics-server-3.13.1/charts/metrics-server/README.md
@@ -0,0 +1,190 @@
+# Kubernetes Metrics Server
+
+[Metrics Server](https://github.com/kubernetes-sigs/metrics-server/) is a scalable, efficient source of container resource metrics for Kubernetes built-in autoscaling pipelines.
+
+## Installing the Chart
+
+Before you can install the chart you will need to add the `metrics-server` repo to [Helm](https://helm.sh/).
+
+```shell
+helm repo add metrics-server https://kubernetes-sigs.github.io/metrics-server/
+```
+
+After you've installed the repo you can install the chart.
+
+```shell
+helm upgrade --install metrics-server metrics-server/metrics-server
+```
+
+## Configuration
+
+The following table lists the configurable parameters of the _Metrics Server_ chart and their default values.
+
+| Parameter                                        | Description                                                                                                                                                                                                                                                      | Default                                                                        |
+| ------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------ |
+| `image.repository`                               | Image repository.                                                                                                                                                                                                                                                | `registry.k8s.io/metrics-server/metrics-server`                                |
+| `image.tag`                                      | Image tag, will override the default tag derived from the chart app version.                                                                                                                                                                                     | `""`                                                                           |
+| `image.pullPolicy`                               | Image pull policy.                                                                                                                                                                                                                                               | `IfNotPresent`                                                                 |
+| `imagePullSecrets`                               | Image pull secrets.                                                                                                                                                                                                                                              | `[]`                                                                           |
+| `nameOverride`                                   | Override the `name` of the chart.                                                                                                                                                                                                                                | `nil`                                                                          |
+| `fullnameOverride`                               | Override the `fullname` of the chart.                                                                                                                                                                                                                            | `nil`                                                                          |
+| `serviceAccount.create`                          | If `true`, create a new service account.                                                                                                                                                                                                                         | `true`                                                                         |
+| `serviceAccount.annotations`                     | Annotations to add to the service account.                                                                                                                                                                                                                       | `{}`                                                                           |
+| `serviceAccount.name`                            | Service account to be used. If not set and `serviceAccount.create` is `true`, a name is generated using the full name template.                                                                                                                                  | `nil`                                                                          |
+| `serviceAccount.secrets`                         | The list of secrets mountable by this service account. See <https://kubernetes.io/docs/reference/labels-annotations-taints/#enforce-mountable-secrets>                                                                                                           | `[]`                                                                           |
+| `rbac.create`                                    | If `true`, create the RBAC resources.                                                                                                                                                                                                                            | `true`                                                                         |
+| `rbac.pspEnabled`                                | If `true`, create a pod security policy resource, unless Kubernetes version is 1.25 or later.                                                                                                                                                                    | `false`                                                                        |
+| `apiService.create`                              | If `true`, create the `v1beta1.metrics.k8s.io` API service. You typically want this enabled! If you disable API service creation you have to manage it outside of this chart for e.g horizontal pod autoscaling to work with this release.                       | `true`                                                                         |
+| `apiService.annotations`                         | Annotations to add to the API service                                                                                                                                                                                                                            | `{}`                                                                           |
+| `apiService.insecureSkipTLSVerify`               | Specifies whether to skip TLS verification (NOTE: this setting is not a proxy for the `--kubelet-insecure-tls` metrics-server flag)                                                                                                                              | `true`                                                                         |
+| `apiService.caBundle`                            | The PEM encoded CA bundle for TLS verification                                                                                                                                                                                                                   | `""`                                                                           |
+| `commonLabels`                                   | Labels to add to each object of the chart.                                                                                                                                                                                                                       | `{}`                                                                           |
+| `podLabels`                                      | Labels to add to the pod.                                                                                                                                                                                                                                        | `{}`                                                                           |
+| `podAnnotations`                                 | Annotations to add to the pod.                                                                                                                                                                                                                                   | `{}`                                                                           |
+| `podSecurityContext`                             | Security context for the pod.                                                                                                                                                                                                                                    | `{}`                                                                           |
+| `securityContext`                                | Security context for the _metrics-server_ container.                                                                                                                                                                                                             | _See values.yaml_                                                              |
+| `priorityClassName`                              | Priority class name to use.                                                                                                                                                                                                                                      | `system-cluster-critical`                                                      |
+| `containerPort`                                  | port for the _metrics-server_ container.                                                                                                                                                                                                                         | `10250`                                                                        |
+| `hostNetwork.enabled`                            | If `true`, start _metric-server_ in hostNetwork mode. You would require this enabled if you use alternate overlay networking for pods and API server unable to communicate with metrics-server. As an example, this is required if you use Weave network on EKS. | `false`                                                                        |
+| `replicas`                                       | Number of replicas to run.                                                                                                                                                                                                                                       | `1`                                                                            |
+| `revisionHistoryLimit`                           | Number of revisions to keep.                                                                                                                                                                                                                                     | `nil`                                                                          |
+| `updateStrategy`                                 | Customise the default update strategy.                                                                                                                                                                                                                           | `{}`                                                                           |
+| `podDisruptionBudget.enabled`                    | If `true`, create `PodDisruptionBudget` resource.                                                                                                                                                                                                                | `{}`                                                                           |
+| `podDisruptionBudget.minAvailable`               | Set the `PodDisruptionBudget` minimum available pods.                                                                                                                                                                                                            | `nil`                                                                          |
+| `podDisruptionBudget.maxUnavailable`             | Set the `PodDisruptionBudget` maximum unavailable pods.                                                                                                                                                                                                          | `nil`                                                                          |
+| `podDisruptionBudget.maxUnavailable`             | Set the `PodDisruptionBudget` maximum unavailable pods.                                                                                                                                                                                                          | `nil`                                                                          |
+| `podDisruptionBudget.unhealthyPodEvictionPolicy` | Unhealthy pod eviction policy for the PDB.                                                                                                                                                                                                                       | `nil`                                                                          |
+| `defaultArgs`                                    | Default arguments to pass to the _metrics-server_ command.                                                                                                                                                                                                       | See _values.yaml_                                                              |
+| `args`                                           | Additional arguments to pass to the _metrics-server_ command.                                                                                                                                                                                                    | `[]`                                                                           |
+| `livenessProbe`                                  | Liveness probe.                                                                                                                                                                                                                                                  | See _values.yaml_                                                              |
+| `readinessProbe`                                 | Readiness probe.                                                                                                                                                                                                                                                 | See _values.yaml_                                                              |
+| `service.type`                                   | Service type.                                                                                                                                                                                                                                                    | `ClusterIP`                                                                    |
+| `service.port`                                   | Service port.                                                                                                                                                                                                                                                    | `443`                                                                          |
+| `service.annotations`                            | Annotations to add to the service.                                                                                                                                                                                                                               | `{}`                                                                           |
+| `service.labels`                                 | Labels to add to the service.                                                                                                                                                                                                                                    | `{}`                                                                           |
+| `addonResizer.enabled`                           | If `true`, run the addon-resizer as a sidecar to automatically scale resource requests with cluster size.                                                                                                                                                        | `false`                                                                        |
+| `addonResizer.securityContext`                   | Security context for the _metrics_server_container.                                                                                                                                                                                                              | _See values.yaml                                                               |
+| `addonResizer.image.repository`                  | addon-resizer image repository                                                                                                                                                                                                                                   | `registry.k8s.io/autoscaling/addon-resizer`                                    |
+| `addonResizer.image.tag`                         | addon-resizer image tag                                                                                                                                                                                                                                          | `1.8.23`                                                                       |
+| `addonResizer.resources`                         | Resource requests and limits for the _nanny_ container.                                                                                                                                                                                                          | `{ requests: { cpu: 40m, memory: 25Mi }, limits: { cpu: 40m, memory: 25Mi } }` |
+| `addonResizer.nanny.cpu`                         | The base CPU requirement.                                                                                                                                                                                                                                        | `0m`                                                                           |
+| `addonResizer.nanny.extraCPU`                    | The amount of CPU to add per node.                                                                                                                                                                                                                               | `1m`                                                                           |
+| `addonResizer.nanny.memory`                      | The base memory requirement.                                                                                                                                                                                                                                     | `0Mi`                                                                          |
+| `addonResizer.nanny.extraMemory`                 | The amount of memory to add per node.                                                                                                                                                                                                                            | `2Mi`                                                                          |
+| `addonResizer.nanny.minClusterSize`              | Specifies the smallest number of nodes resources will be scaled to.                                                                                                                                                                                              | `100`                                                                          |
+| `addonResizer.nanny.pollPeriod`                  | The time, in milliseconds, to poll the dependent container.                                                                                                                                                                                                      | `300000`                                                                       |
+| `addonResizer.nanny.threshold`                   | A number between 0-100. The dependent's resources are rewritten when they deviate from expected by more than threshold.                                                                                                                                          | `5`                                                                            |
+| `metrics.enabled`                                | If `true`, allow unauthenticated access to `/metrics`.                                                                                                                                                                                                           | `false`                                                                        |
+| `serviceMonitor.enabled`                         | If `true`, create a _Prometheus_ service monitor. This needs `metrics.enabled` to be `true`.                                                                                                                                                                     | `false`                                                                        |
+| `serviceMonitor.additionalLabels`                | Additional labels to be set on the ServiceMonitor.                                                                                                                                                                                                               | `{}`                                                                           |
+| `serviceMonitor.metricRelabelings`               | _Prometheus_ metric relabeling.                                                                                                                                                                                                                                  | `[]`                                                                           |
+| `serviceMonitor.relabelings`                     | _Prometheus_ relabeling.                                                                                                                                                                                                                                         | `[]`                                                                           |
+| `serviceMonitor.interval`                        | _Prometheus_ scrape frequency.                                                                                                                                                                                                                                   | `1m`                                                                           |
+| `serviceMonitor.scrapeTimeout`                   | _Prometheus_ scrape timeout.                                                                                                                                                                                                                                     | `10s`                                                                          |
+| `resources`                                      | Resource requests and limits for the _metrics-server_ container. See <https://github.com/kubernetes-sigs/metrics-server#scaling>                                                                                                                                 | `{ requests: { cpu: 100m, memory: 200Mi }}`                                    |
+| `extraVolumeMounts`                              | Additional volume mounts for the _metrics-server_ container.                                                                                                                                                                                                     | `[]`                                                                           |
+| `extraVolumes`                                   | Additional volumes for the pod.                                                                                                                                                                                                                                  | `[]`                                                                           |
+| `nodeSelector`                                   | Node labels for pod assignment.                                                                                                                                                                                                                                  | `{}`                                                                           |
+| `tolerations`                                    | Tolerations for pod assignment.                                                                                                                                                                                                                                  | `[]`                                                                           |
+| `affinity`                                       | Affinity for pod assignment.                                                                                                                                                                                                                                     | `{}`                                                                           |
+| `topologySpreadConstraints`                      | Pod Topology Spread Constraints.                                                                                                                                                                                                                                 | `[]`                                                                           |
+| `deploymentAnnotations`                          | Annotations to add to the deployment.                                                                                                                                                                                                                            | `{}`                                                                           |
+| `schedulerName`                                  | scheduler to set to the deployment.                                                                                                                                                                                                                              | `""`                                                                           |
+| `dnsConfig`                                      | Set the dns configuration options for the deployment.                                                                                                                                                                                                            | `{}`                                                                           |
+| `tmpVolume`                                      | Volume to be mounted in Pods for temporary files.                                                                                                                                                                                                                | `{"emptyDir":{}}`                                                              |
+| `tls.type`                                       | TLS option to use. Either use `metrics-server` for self-signed certificates, `helm`, `cert-manager` or `existingSecret`.                                                                                                                                         | `"metrics-server"`                                                             |
+| `tls.clusterDomain`                              | Kubernetes cluster domain. Used to configure Subject Alt Names for the certificate when using `tls.type` `helm` or `cert-manager`.                                                                                                                               | `"cluster.local"`                                                              |
+| `tls.certManager.addInjectorAnnotations`         | Automatically add the cert-manager.io/inject-ca-from annotation to the APIService resource.                                                                                                                                                                      | `true`                                                                         |
+| `tls.certManager.existingIssuer.enabled`         | Use an existing cert-manager issuer                                                                                                                                                                                                                              | `false`                                                                        |
+| `tls.certManager.existingIssuer.kind`            | Kind of the existing cert-manager issuer                                                                                                                                                                                                                         | `"Issuer"`                                                                     |
+| `tls.certManager.existingIssuer.name`            | Name of the existing cert-manager issuer                                                                                                                                                                                                                         | `"my-issuer"`                                                                  |
+| `tls.certManager.duration`                       | Set the requested duration (i.e. lifetime) of the Certificate.                                                                                                                                                                                                   | `""`                                                                           |
+| `tls.certManager.renewBefore`                    | How long before the currently issued certificate’s expiry cert-manager should renew the certificate.                                                                                                                                                             | `""`                                                                           |
+| `tls.certManager.annotations`                    | Add extra annotations to the Certificate resource                                                                                                                                                                                                                | `{}`                                                                           |
+| `tls.certManager.labels`                         | Add extra labels to the Certificate resource                                                                                                                                                                                                                     | `{}`                                                                           |
+| `tls.helm.certDurationDays`                      | Cert validity duration in days                                                                                                                                                                                                                                   | `365`                                                                          |
+| `tls.helm.lookup`                                | Use helm lookup function to reuse Secret created in previous helm install                                                                                                                                                                                        | `true`                                                                         |
+| `tls.existingSecret.lookup`                      | Use helm lookup function to provision `apiService.caBundle`                                                                                                                                                                                                      | `true`                                                                         |
+| `tls.existingSecret.name`                        | Name of the existing Secret to use for TLS                                                                                                                                                                                                                       | `""`                                                                           |
+
+## Hardening metrics-server
+
+By default, metrics-server is using a self-signed certificate which is generated during startup. The `APIservice` resource is registered with `.spec.insecureSkipTLSVerify` set to `true` as you can see here:
+
+```yaml
+apiVersion: apiregistration.k8s.io/v1
+kind: APIService
+metadata:
+  name: v1beta1.metrics.k8s.io
+spec:
+  #..
+  insecureSkipTLSVerify: true # <-- see here
+  service:
+    name: metrics-server
+  #..
+```
+
+To harden metrics-server, you have these options described in the following section.
+
+### Option 1: Let helm generate a self-signed certificate
+
+This option is probably the easiest solution for you. We delegate the process to generate a self-signed certificate to helm.
+As helm generates them during deploy time, helm can also inject the `apiService.caBundle` for you.
+
+**The only disadvantage of using this method is that it is not GitOps friendly** (e.g. Argo CD). If you are using one of these
+GitOps tools with drift detection, it will always detect changes. However if you are deploying the helm chart via Terraform
+for example (or maybe even Flux), this method is perfectly fine.
+
+To use this method, please setup your values file like this:
+
+```yaml
+apiService:
+  insecureSkipTLSVerify: false
+tls:
+  type: helm
+```
+
+### Option 2: Use cert-manager
+
+> **Requirement:** cert-manager needs to be installed before you install metrics-server
+
+To use this method, please setup your values file like this:
+
+```yaml
+apiService:
+  insecureSkipTLSVerify: false
+tls:
+  type: cert-manager
+```
+
+There are other optional parameters, if you want to customize the behavior of the certificate even more.
+
+### Option 3: Use existing Secret
+
+This option allows you to reuse an existing Secret. This Secrets can have an arbitrary origin, e.g.
+
+- Created via kubectl / Terraform / etc.
+- Synced from a secret management solution like AWS Secrets Manager, HashiCorp Vault, etc.
+
+When using this type of TLS option, the keys `tls.key` and the `tls.crt` key must be provided in the data field of the
+existing Secret.
+
+You need to pass the certificate of the issuing CA (or the certificate itself) via `apiService.caBundle` to ensure
+proper configuration of the `APIservice` resource. Otherwise you cannot set `apiService.insecureSkipTLSVerify` to
+`false`.
+
+To use this method, please setup your values file like this:
+
+```yaml
+apiService:
+  insecureSkipTLSVerify: false
+  caBundle: |
+    -----BEGIN CERTIFICATE-----
+    ...
+    -----END CERTIFICATE-----
+
+tls:
+  type: existingSecret
+  existingSecret:
+    name: metrics-server-existing
+```
diff --git a/packs/metrics-server-3.13.1/charts/metrics-server/ci/ci-values.yaml b/packs/metrics-server-3.13.1/charts/metrics-server/ci/ci-values.yaml
new file mode 100644
index 00000000..b9e9ef73
--- /dev/null
+++ b/packs/metrics-server-3.13.1/charts/metrics-server/ci/ci-values.yaml
@@ -0,0 +1,2 @@
+args:
+  - --kubelet-insecure-tls
diff --git a/packs/metrics-server-3.13.1/charts/metrics-server/ci/tls-certManager-values.yaml b/packs/metrics-server-3.13.1/charts/metrics-server/ci/tls-certManager-values.yaml
new file mode 100644
index 00000000..3dcfd0ea
--- /dev/null
+++ b/packs/metrics-server-3.13.1/charts/metrics-server/ci/tls-certManager-values.yaml
@@ -0,0 +1,8 @@
+args:
+  - --kubelet-insecure-tls
+
+apiService:
+  insecureSkipTLSVerify: false
+
+tls:
+  type: cert-manager
diff --git a/packs/metrics-server-3.13.1/charts/metrics-server/ci/tls-existingSecret-values.yaml b/packs/metrics-server-3.13.1/charts/metrics-server/ci/tls-existingSecret-values.yaml
new file mode 100644
index 00000000..8daa8483
--- /dev/null
+++ b/packs/metrics-server-3.13.1/charts/metrics-server/ci/tls-existingSecret-values.yaml
@@ -0,0 +1,12 @@
+args:
+  - --kubelet-insecure-tls
+
+## Set via GH action (step "Prepare existing secret test scenario")
+# apiService:
+#   insecureSkipTLSVerify: false
+#   caBundle: |
+
+tls:
+  type: existingSecret
+  existingSecret:
+    name: metrics-server-existing
diff --git a/packs/metrics-server-3.13.1/charts/metrics-server/ci/tls-helm-values.yaml b/packs/metrics-server-3.13.1/charts/metrics-server/ci/tls-helm-values.yaml
new file mode 100644
index 00000000..dc834286
--- /dev/null
+++ b/packs/metrics-server-3.13.1/charts/metrics-server/ci/tls-helm-values.yaml
@@ -0,0 +1,8 @@
+args:
+  - --kubelet-insecure-tls
+
+apiService:
+  insecureSkipTLSVerify: false
+
+tls:
+  type: helm
diff --git a/packs/metrics-server-3.13.1/charts/metrics-server/templates/NOTES.txt b/packs/metrics-server-3.13.1/charts/metrics-server/templates/NOTES.txt
new file mode 100644
index 00000000..0ad6bb07
--- /dev/null
+++ b/packs/metrics-server-3.13.1/charts/metrics-server/templates/NOTES.txt
@@ -0,0 +1,7 @@
+***********************************************************************
+* Metrics Server                                                      *
+***********************************************************************
+  Chart version: {{ .Chart.Version }}
+  App version:   {{ .Chart.AppVersion }}
+  Image tag:     {{ include "metrics-server.image" . }}
+***********************************************************************
diff --git a/packs/metrics-server-3.13.1/charts/metrics-server/templates/_helpers.tpl b/packs/metrics-server-3.13.1/charts/metrics-server/templates/_helpers.tpl
new file mode 100644
index 00000000..9b87f118
--- /dev/null
+++ b/packs/metrics-server-3.13.1/charts/metrics-server/templates/_helpers.tpl
@@ -0,0 +1,102 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "metrics-server.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "metrics-server.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "metrics-server.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "metrics-server.labels" -}}
+helm.sh/chart: {{ include "metrics-server.chart" . }}
+{{ include "metrics-server.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- if .Values.commonLabels }}
+{{ toYaml .Values.commonLabels }}
+{{- end }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "metrics-server.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "metrics-server.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "metrics-server.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "metrics-server.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{/*
+The image to use
+*/}}
+{{- define "metrics-server.image" -}}
+{{- printf "%s:%s" .Values.image.repository (default (printf "v%s" .Chart.AppVersion) .Values.image.tag) }}
+{{- end }}
+
+{{/*
+The image to use for the addon resizer
+*/}}
+{{- define "metrics-server.addonResizer.image" -}}
+{{- printf "%s:%s" .Values.addonResizer.image.repository .Values.addonResizer.image.tag }}
+{{- end }}
+
+{{/*
+ConfigMap name of addon resizer
+*/}}
+{{- define "metrics-server.addonResizer.configMap" -}}
+{{- printf "%s-%s" (include "metrics-server.fullname" .) "nanny-config" }}
+{{- end }}
+
+{{/*
+Role name of addon resizer
+*/}}
+{{- define "metrics-server.addonResizer.role" -}}
+{{ printf "system:%s-nanny" (include "metrics-server.fullname" .) }}
+{{- end }}
+
+{{/* Get PodDisruptionBudget API Version */}}
+{{- define "metrics-server.pdb.apiVersion" -}}
+  {{- if and (.Capabilities.APIVersions.Has "policy/v1") (semverCompare ">= 1.21-0" .Capabilities.KubeVersion.Version) -}}
+      {{- print "policy/v1" -}}
+  {{- else -}}
+    {{- print "policy/v1beta1" -}}
+  {{- end -}}
+{{- end -}}
diff --git a/packs/metrics-server-3.13.1/charts/metrics-server/templates/apiservice.yaml b/packs/metrics-server-3.13.1/charts/metrics-server/templates/apiservice.yaml
new file mode 100644
index 00000000..fe34dd18
--- /dev/null
+++ b/packs/metrics-server-3.13.1/charts/metrics-server/templates/apiservice.yaml
@@ -0,0 +1,74 @@
+{{- $altNames := list }}
+{{- $certs := dict }}
+{{- $previous := dict }}
+
+{{- if eq .Values.tls.type "helm" }}
+{{- $previous = lookup "v1" "Secret" .Release.Namespace (include "metrics-server.fullname" .) }}
+{{- $commonName := include "metrics-server.fullname" . }}
+{{- $ns := .Release.Namespace }}
+{{- $altNames = append $altNames (printf "%s.%s" $commonName $ns) }}
+{{- $altNames = append $altNames (printf "%s.%s.svc" $commonName $ns) }}
+{{- $altNames = append $altNames (printf "%s.%s.svc.%s" $commonName $ns .Values.tls.clusterDomain) }}
+{{- $certs = genSelfSignedCert $commonName nil $altNames (int .Values.tls.helm.certDurationDays) }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "metrics-server.fullname" . }}
+  labels:
+    {{- include "metrics-server.labels" . | nindent 4 }}
+type: Opaque
+data:
+  {{- if and $previous .Values.tls.helm.lookup }}
+  tls.crt: {{ index $previous.data "tls.crt" }}
+  tls.key: {{ index $previous.data "tls.key" }}
+  {{- else }}
+  tls.crt: {{ $certs.Cert| b64enc | quote }}
+  tls.key: {{ $certs.Key | b64enc | quote }}
+  {{- end }}
+{{- end }}
+---
+{{- $existing := dict }}
+{{- if .Values.apiService.create }}
+{{- if and (eq .Values.tls.type "existingSecret") .Values.tls.existingSecret.lookup }}
+{{- $existing := lookup "v1" "Secret" .Release.Namespace .Values.tls.existingSecret.name }}
+{{- end }}
+apiVersion: apiregistration.k8s.io/v1
+kind: APIService
+metadata:
+  name: v1beta1.metrics.k8s.io
+  labels:
+    {{- include "metrics-server.labels" . | nindent 4 }}
+  {{- $includeCertManagerAnnotations := (and .Values.tls.certManager.addInjectorAnnotations (eq .Values.tls.type "cert-manager")) }}
+  {{- if or .Values.apiService.annotations $includeCertManagerAnnotations }}
+  annotations:
+    {{- if $includeCertManagerAnnotations }}
+    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "metrics-server.fullname" . }}
+    {{- end }}
+    {{- with .Values.apiService.annotations }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- end }}
+spec:
+  {{- if eq .Values.tls.type "helm" }}
+    {{- if and $previous .Values.tls.helm.lookup }}
+  caBundle: {{ index $previous.data "tls.crt" }}
+    {{- else }}
+  caBundle: {{ $certs.Cert | b64enc }}
+    {{- end }}
+  {{- else if $existing }}
+  caBundle: {{ index $existing.data "tls.crt" }}
+  {{- else if and .Values.apiService.caBundle (ne .Values.tls.type "cert-manager") }}
+  caBundle: {{ .Values.apiService.caBundle | b64enc }}
+  {{- end }}
+  group: metrics.k8s.io
+  groupPriorityMinimum: 100
+{{- with .Values.apiService.insecureSkipTLSVerify }}
+  insecureSkipTLSVerify: {{ . }}
+{{- end }}
+  service:
+    name: {{ include "metrics-server.fullname" . }}
+    namespace: {{ .Release.Namespace }}
+    port: {{ .Values.service.port }}
+  version: v1beta1
+  versionPriority: 100
+{{- end }}
diff --git a/packs/metrics-server-3.13.1/charts/metrics-server/templates/certificate.yaml b/packs/metrics-server-3.13.1/charts/metrics-server/templates/certificate.yaml
new file mode 100644
index 00000000..c4de300f
--- /dev/null
+++ b/packs/metrics-server-3.13.1/charts/metrics-server/templates/certificate.yaml
@@ -0,0 +1,47 @@
+{{- if eq .Values.tls.type "cert-manager" }}
+{{- if not .Values.tls.certManager.existingIssuer.enabled }}
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  annotations:
+    {{- toYaml .Values.additionalAnnotations | nindent 4 }}
+  name: {{ include "metrics-server.fullname" . }}-issuer
+  namespace: {{ .Release.Namespace }}
+spec:
+  selfSigned: {}
+{{- end }}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: {{ include "metrics-server.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+spec:
+  commonName: {{ include "metrics-server.fullname" . }}
+  dnsNames:
+  - {{ include "metrics-server.fullname" . }}.{{ .Release.Namespace }}
+  - {{ include "metrics-server.fullname" . }}.{{ .Release.Namespace }}.svc
+  - {{ include "metrics-server.fullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.tls.clusterDomain }}
+  secretName: {{ include "metrics-server.fullname" . }}
+  usages:
+    - server auth
+    - client auth
+  privateKey:
+    algorithm: RSA
+    size: 2048
+  {{- with .Values.tls.certManager.duration }}
+  duration: {{ . }}
+  {{- end }}
+  {{- with .Values.tls.certManager.renewBefore }}
+  renewBefore: {{ . }}
+  {{- end }}
+  issuerRef:
+    {{- if .Values.tls.certManager.existingIssuer.enabled }}
+    name: {{ .Values.tls.certManager.existingIssuer.name }}
+    kind: {{ .Values.tls.certManager.existingIssuer.kind }}
+    {{- else }}
+    name: {{ include "metrics-server.fullname" . }}-issuer
+    kind: Issuer
+    {{- end }}
+    group: cert-manager.io
+{{- end }}
diff --git a/packs/metrics-server-3.13.1/charts/metrics-server/templates/clusterrole-aggregated-reader.yaml b/packs/metrics-server-3.13.1/charts/metrics-server/templates/clusterrole-aggregated-reader.yaml
new file mode 100644
index 00000000..d5e8fe1b
--- /dev/null
+++ b/packs/metrics-server-3.13.1/charts/metrics-server/templates/clusterrole-aggregated-reader.yaml
@@ -0,0 +1,21 @@
+{{- if .Values.rbac.create -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ printf "system:%s-aggregated-reader" (include "metrics-server.name" .) }}
+  labels:
+    {{- include "metrics-server.labels" . | nindent 4 }}
+    rbac.authorization.k8s.io/aggregate-to-admin: "true"
+    rbac.authorization.k8s.io/aggregate-to-edit: "true"
+    rbac.authorization.k8s.io/aggregate-to-view: "true"
+rules:
+  - apiGroups:
+      - metrics.k8s.io
+    resources:
+      - pods
+      - nodes
+    verbs:
+      - get
+      - list
+      - watch
+{{- end -}}
diff --git a/packs/metrics-server-3.13.1/charts/metrics-server/templates/clusterrole-nanny.yaml b/packs/metrics-server-3.13.1/charts/metrics-server/templates/clusterrole-nanny.yaml
new file mode 100644
index 00000000..24edd81c
--- /dev/null
+++ b/packs/metrics-server-3.13.1/charts/metrics-server/templates/clusterrole-nanny.yaml
@@ -0,0 +1,13 @@
+{{- if and .Values.rbac.create .Values.addonResizer.enabled -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ printf "system:%s-nanny" (include "metrics-server.fullname" .) }}
+  labels:
+    {{- include "metrics-server.labels" . | nindent 4 }}
+rules:
+  - nonResourceURLs:
+      - /metrics
+    verbs:
+      - get
+{{- end -}}
diff --git a/packs/metrics-server-3.13.1/charts/metrics-server/templates/clusterrole.yaml b/packs/metrics-server-3.13.1/charts/metrics-server/templates/clusterrole.yaml
new file mode 100644
index 00000000..5d25c1e8
--- /dev/null
+++ b/packs/metrics-server-3.13.1/charts/metrics-server/templates/clusterrole.yaml
@@ -0,0 +1,37 @@
+{{- if .Values.rbac.create -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ printf "system:%s" (include "metrics-server.fullname" .) }}
+  labels:
+    {{- include "metrics-server.labels" . | nindent 4 }}
+rules:
+  - apiGroups:
+    - ""
+    resources:
+    - nodes/metrics
+    verbs:
+    - get
+  - apiGroups:
+    - ""
+    resources:
+      - pods
+      - nodes
+      - namespaces
+      - configmaps
+    verbs:
+      - get
+      - list
+      - watch
+  {{- if .Values.rbac.pspEnabled }}
+  - apiGroups:
+      - extensions
+      - policy
+    resources:
+      - podsecuritypolicies
+    resourceNames:
+      - {{ printf "privileged-%s" (include "metrics-server.fullname" .) }}
+    verbs:
+      - use
+  {{- end -}}
+{{- end -}}
diff --git a/packs/metrics-server-3.13.1/charts/metrics-server/templates/clusterrolebinding-auth-delegator.yaml b/packs/metrics-server-3.13.1/charts/metrics-server/templates/clusterrolebinding-auth-delegator.yaml
new file mode 100644
index 00000000..826c3b7b
--- /dev/null
+++ b/packs/metrics-server-3.13.1/charts/metrics-server/templates/clusterrolebinding-auth-delegator.yaml
@@ -0,0 +1,16 @@
+{{- if .Values.rbac.create -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ printf "%s:system:auth-delegator" (include "metrics-server.fullname" .) }}
+  labels:
+    {{- include "metrics-server.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:auth-delegator
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "metrics-server.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end -}}
diff --git a/packs/metrics-server-3.13.1/charts/metrics-server/templates/clusterrolebinding-nanny.yaml b/packs/metrics-server-3.13.1/charts/metrics-server/templates/clusterrolebinding-nanny.yaml
new file mode 100644
index 00000000..43738ccb
--- /dev/null
+++ b/packs/metrics-server-3.13.1/charts/metrics-server/templates/clusterrolebinding-nanny.yaml
@@ -0,0 +1,18 @@
+{{- if .Values.rbac.create -}}
+{{- if .Values.addonResizer.enabled -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ printf "system:%s-nanny" (include "metrics-server.fullname" .) }}
+  labels:
+    {{- include "metrics-server.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:{{ template "metrics-server.fullname" . }}-nanny
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "metrics-server.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end -}}
+{{- end -}}
diff --git a/packs/metrics-server-3.13.1/charts/metrics-server/templates/clusterrolebinding.yaml b/packs/metrics-server-3.13.1/charts/metrics-server/templates/clusterrolebinding.yaml
new file mode 100644
index 00000000..512cb651
--- /dev/null
+++ b/packs/metrics-server-3.13.1/charts/metrics-server/templates/clusterrolebinding.yaml
@@ -0,0 +1,16 @@
+{{- if .Values.rbac.create -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ printf "system:%s" (include "metrics-server.fullname" .) }}
+  labels:
+    {{- include "metrics-server.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:{{ template "metrics-server.fullname" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "metrics-server.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end -}}
diff --git a/packs/metrics-server-3.13.1/charts/metrics-server/templates/configmaps-nanny.yaml b/packs/metrics-server-3.13.1/charts/metrics-server/templates/configmaps-nanny.yaml
new file mode 100644
index 00000000..c25005ec
--- /dev/null
+++ b/packs/metrics-server-3.13.1/charts/metrics-server/templates/configmaps-nanny.yaml
@@ -0,0 +1,17 @@
+{{- if .Values.addonResizer.enabled -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "metrics-server.addonResizer.configMap" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "metrics-server.labels" . | nindent 4 }}
+data:
+  NannyConfiguration: |-
+    apiVersion: nannyconfig/v1alpha1
+    kind: NannyConfiguration
+    baseCPU: {{ .Values.addonResizer.nanny.cpu }}
+    cpuPerNode: {{ .Values.addonResizer.nanny.extraCpu }}
+    baseMemory: {{ .Values.addonResizer.nanny.memory }}
+    memoryPerNode: {{ .Values.addonResizer.nanny.extraMemory }}
+{{- end -}}
diff --git a/packs/metrics-server-3.13.1/charts/metrics-server/templates/deployment.yaml b/packs/metrics-server-3.13.1/charts/metrics-server/templates/deployment.yaml
new file mode 100644
index 00000000..d7535b87
--- /dev/null
+++ b/packs/metrics-server-3.13.1/charts/metrics-server/templates/deployment.yaml
@@ -0,0 +1,177 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "metrics-server.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "metrics-server.labels" . | nindent 4 }}
+  {{- with .Values.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  replicas: {{ .Values.replicas }}
+  {{- if not (has (quote .Values.revisionHistoryLimit) (list "" (quote ""))) }}
+  revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
+  {{- end }}
+  {{- with .Values.updateStrategy }}
+  strategy:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "metrics-server.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "metrics-server.selectorLabels" . | nindent 8 }}
+      {{- with .Values.podLabels }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    spec:
+      {{- with .Values.schedulerName }}
+      schedulerName: {{ . }}
+      {{- end }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "metrics-server.serviceAccountName" . }}
+      {{- with .Values.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.priorityClassName }}
+      priorityClassName: {{ . | quote }}
+      {{- end }}
+      {{- if .Values.hostNetwork.enabled }}
+      hostNetwork: true
+      {{- end }}
+      {{- with .Values.dnsConfig }}
+      dnsConfig:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: metrics-server
+          {{- with .Values.securityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          image: {{ include "metrics-server.image" . }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          args:
+            - {{ printf "--secure-port=%d" (int .Values.containerPort) }}
+          {{- range .Values.defaultArgs }}
+            - {{ . }}
+          {{- end }}
+          {{- if .Values.metrics.enabled }}
+            - --authorization-always-allow-paths=/metrics
+          {{- end }}
+          {{- if ne .Values.tls.type "metrics-server" }}
+            - --tls-cert-file=/tmp/tls-certs/tls.crt
+            - --tls-private-key-file=/tmp/tls-certs/tls.key
+          {{- end }}
+          {{- range .Values.args }}
+            - {{ . }}
+          {{- end }}
+          ports:
+          - name: https
+            protocol: TCP
+            containerPort: {{ .Values.containerPort }}
+          {{- with .Values.livenessProbe }}
+          livenessProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.readinessProbe }}
+          readinessProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+              {{- if ne .Values.tls.type "metrics-server" }}
+            - mountPath: /tmp/tls-certs
+              name: certs
+              readOnly: true
+              {{- end }}
+          {{- with .Values.extraVolumeMounts }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+        {{- if .Values.addonResizer.enabled }}
+        - name: metrics-server-nanny
+          {{- with .Values.addonResizer.securityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          image: {{ include "metrics-server.addonResizer.image" . }}
+          env:
+            - name: MY_POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: MY_POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+          command:
+            - /pod_nanny
+            - --config-dir=/etc/config
+            - --deployment={{ include "metrics-server.fullname" . }}
+            - --container=metrics-server
+            - --threshold={{ .Values.addonResizer.nanny.threshold }}
+            - --poll-period={{ .Values.addonResizer.nanny.pollPeriod }}
+            - --estimator=exponential
+            - --minClusterSize={{ .Values.addonResizer.nanny.minClusterSize }}
+            - --use-metrics=true
+          volumeMounts:
+            - name: nanny-config-volume
+              mountPath: /etc/config
+          {{- with .Values.addonResizer.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+        {{- end }}
+      volumes:
+        - name: tmp
+          {{- toYaml .Values.tmpVolume | nindent 10 }}
+      {{- if .Values.addonResizer.enabled }}
+        - name: nanny-config-volume
+          configMap:
+            name: {{ include "metrics-server.addonResizer.configMap" . }}
+      {{- end }}
+      {{- if ne .Values.tls.type "metrics-server" }}
+        - name: certs
+          secret:
+            {{- if and (eq .Values.tls.type "existingSecret") .Values.tls.existingSecret.name }}
+            secretName: {{ .Values.tls.existingSecret.name }}
+            {{- else }}
+            secretName: {{ include "metrics-server.fullname" . }}
+            {{- end }}
+      {{- end }}
+      {{- with .Values.extraVolumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
diff --git a/packs/metrics-server-3.13.1/charts/metrics-server/templates/pdb.yaml b/packs/metrics-server-3.13.1/charts/metrics-server/templates/pdb.yaml
new file mode 100644
index 00000000..de7689d4
--- /dev/null
+++ b/packs/metrics-server-3.13.1/charts/metrics-server/templates/pdb.yaml
@@ -0,0 +1,25 @@
+{{- if .Values.podDisruptionBudget.enabled -}}
+apiVersion: {{ include "metrics-server.pdb.apiVersion" . }}
+kind: PodDisruptionBudget
+metadata:
+  name: {{ include "metrics-server.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "metrics-server.labels" . | nindent 4 }}
+spec:
+  {{- if .Values.podDisruptionBudget.minAvailable }}
+  minAvailable: {{ .Values.podDisruptionBudget.minAvailable }}
+  {{- end }}
+  {{- if .Values.podDisruptionBudget.maxUnavailable }}
+  maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }}
+  {{- end }}
+  {{- if (semverCompare ">= 1.27-0" .Capabilities.KubeVersion.Version) }}
+  {{- with .Values.podDisruptionBudget.unhealthyPodEvictionPolicy }}
+  unhealthyPodEvictionPolicy: {{ . }}
+  {{- end }}
+  {{- end }}
+
+  selector:
+    matchLabels:
+      {{- include "metrics-server.selectorLabels" . | nindent 6 }}
+{{- end -}}
diff --git a/packs/metrics-server-3.13.1/charts/metrics-server/templates/psp.yaml b/packs/metrics-server-3.13.1/charts/metrics-server/templates/psp.yaml
new file mode 100644
index 00000000..d5710de0
--- /dev/null
+++ b/packs/metrics-server-3.13.1/charts/metrics-server/templates/psp.yaml
@@ -0,0 +1,28 @@
+{{- if and (.Values.rbac.pspEnabled) (semverCompare "<1.25-0" .Capabilities.KubeVersion.GitVersion) }}
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: {{ printf "privileged-%s" (include "metrics-server.fullname" .) }}
+  labels:
+    {{- include "metrics-server.labels" . | nindent 4 }}
+spec:
+  allowedCapabilities:
+    - '*'
+  fsGroup:
+    rule: RunAsAny
+  privileged: true
+  runAsUser:
+    rule: RunAsAny
+  seLinux:
+    rule: RunAsAny
+  supplementalGroups:
+    rule: RunAsAny
+  volumes:
+    - '*'
+  hostPID: true
+  hostIPC: true
+  hostNetwork: true
+  hostPorts:
+    - min: 1
+      max: 65536
+{{- end }}
diff --git a/packs/metrics-server-3.13.1/charts/metrics-server/templates/role-nanny.yaml b/packs/metrics-server-3.13.1/charts/metrics-server/templates/role-nanny.yaml
new file mode 100644
index 00000000..f0bf8fce
--- /dev/null
+++ b/packs/metrics-server-3.13.1/charts/metrics-server/templates/role-nanny.yaml
@@ -0,0 +1,27 @@
+{{- if .Values.rbac.create -}}
+{{- if .Values.addonResizer.enabled -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "metrics-server.addonResizer.role" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "metrics-server.labels" . | nindent 4 }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  resourceNames:
+  - {{ include "metrics-server.fullname" . }}
+  verbs:
+  - get
+  - patch
+{{- end -}}
+{{- end -}}
diff --git a/packs/metrics-server-3.13.1/charts/metrics-server/templates/rolebinding-nanny.yaml b/packs/metrics-server-3.13.1/charts/metrics-server/templates/rolebinding-nanny.yaml
new file mode 100644
index 00000000..228c0cfe
--- /dev/null
+++ b/packs/metrics-server-3.13.1/charts/metrics-server/templates/rolebinding-nanny.yaml
@@ -0,0 +1,19 @@
+{{- if .Values.rbac.create -}}
+{{- if .Values.addonResizer.enabled -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ printf "%s-nanny" (include "metrics-server.fullname" .)  }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "metrics-server.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ include "metrics-server.addonResizer.role" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "metrics-server.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end -}}
+{{- end -}}
diff --git a/packs/metrics-server-3.13.1/charts/metrics-server/templates/rolebinding.yaml b/packs/metrics-server-3.13.1/charts/metrics-server/templates/rolebinding.yaml
new file mode 100644
index 00000000..3fda7433
--- /dev/null
+++ b/packs/metrics-server-3.13.1/charts/metrics-server/templates/rolebinding.yaml
@@ -0,0 +1,17 @@
+{{- if .Values.rbac.create -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ printf "%s-auth-reader" (include "metrics-server.fullname" .)  }}
+  namespace: kube-system
+  labels:
+    {{- include "metrics-server.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: extension-apiserver-authentication-reader
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "metrics-server.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end -}}
diff --git a/packs/metrics-server-3.13.1/charts/metrics-server/templates/service.yaml b/packs/metrics-server-3.13.1/charts/metrics-server/templates/service.yaml
new file mode 100644
index 00000000..35318a48
--- /dev/null
+++ b/packs/metrics-server-3.13.1/charts/metrics-server/templates/service.yaml
@@ -0,0 +1,24 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "metrics-server.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "metrics-server.labels" . | nindent 4 }}
+  {{- with .Values.service.labels -}}
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.service.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - name: https
+      port: {{ .Values.service.port }}
+      protocol: TCP
+      targetPort: https
+      appProtocol: https
+  selector:
+    {{- include "metrics-server.selectorLabels" . | nindent 4 }}
diff --git a/packs/metrics-server-3.13.1/charts/metrics-server/templates/serviceaccount.yaml b/packs/metrics-server-3.13.1/charts/metrics-server/templates/serviceaccount.yaml
new file mode 100644
index 00000000..80ef6996
--- /dev/null
+++ b/packs/metrics-server-3.13.1/charts/metrics-server/templates/serviceaccount.yaml
@@ -0,0 +1,17 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "metrics-server.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "metrics-server.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- with .Values.serviceAccount.secrets }}
+secrets:
+  {{- toYaml . | nindent 2 }}
+{{- end }}
+{{- end -}}
diff --git a/packs/metrics-server-3.13.1/charts/metrics-server/templates/servicemonitor.yaml b/packs/metrics-server-3.13.1/charts/metrics-server/templates/servicemonitor.yaml
new file mode 100644
index 00000000..079318d2
--- /dev/null
+++ b/packs/metrics-server-3.13.1/charts/metrics-server/templates/servicemonitor.yaml
@@ -0,0 +1,40 @@
+{{- if and .Values.serviceMonitor.enabled .Values.metrics.enabled -}}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: {{ include "metrics-server.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "metrics-server.labels" . | nindent 4 }}
+    {{- with .Values.serviceMonitor.additionalLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  jobLabel: app.kubernetes.io/instance
+  namespaceSelector:
+    matchNames:
+      - {{ .Release.Namespace }}
+  selector:
+    matchLabels:
+      {{- include "metrics-server.selectorLabels" . | nindent 6 }}
+  endpoints:
+    - port: https
+      path: /metrics
+      scheme: https
+      tlsConfig:
+        insecureSkipVerify: true
+      {{- with .Values.serviceMonitor.interval }}
+      interval: {{ . }}
+      {{- end }}
+      {{- with .Values.serviceMonitor.scrapeTimeout  }}
+      scrapeTimeout: {{ . }}
+      {{- end }}
+      {{- with .Values.serviceMonitor.metricRelabelings }}
+      metricRelabelings:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.serviceMonitor.relabelings }}
+      relabelings:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+{{- end -}}
diff --git a/packs/metrics-server-3.13.1/charts/metrics-server/values.yaml b/packs/metrics-server-3.13.1/charts/metrics-server/values.yaml
new file mode 100644
index 00000000..20940357
--- /dev/null
+++ b/packs/metrics-server-3.13.1/charts/metrics-server/values.yaml
@@ -0,0 +1,245 @@
+# Default values for metrics-server.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+image:
+  repository: registry.k8s.io/metrics-server/metrics-server
+  # Overrides the image tag whose default is v{{ .Chart.AppVersion }}
+  tag: ""
+  pullPolicy: IfNotPresent
+
+imagePullSecrets: []
+# - name: registrySecretName
+
+nameOverride: ""
+fullnameOverride: ""
+
+serviceAccount:
+  # Specifies whether a service account should be created
+  create: true
+  # Annotations to add to the service account
+  annotations: {}
+  # The name of the service account to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name: ""
+  # The list of secrets mountable by this service account.
+  # See https://kubernetes.io/docs/reference/labels-annotations-taints/#enforce-mountable-secrets
+  secrets: []
+
+rbac:
+  # Specifies whether RBAC resources should be created
+  create: true
+  # Note: PodSecurityPolicy will not be created when Kubernetes version is 1.25 or later.
+  pspEnabled: false
+
+apiService:
+  # Specifies if the v1beta1.metrics.k8s.io API service should be created.
+  #
+  # You typically want this enabled! If you disable API service creation you have to
+  # manage it outside of this chart for e.g horizontal pod autoscaling to
+  # work with this release.
+  create: true
+  # Annotations to add to the API service
+  annotations: {}
+  # Specifies whether to skip TLS verification
+  insecureSkipTLSVerify: true
+  # The PEM encoded CA bundle for TLS verification
+  caBundle: ""
+
+commonLabels: {}
+podLabels: {}
+podAnnotations: {}
+
+podSecurityContext: {}
+
+securityContext:
+  allowPrivilegeEscalation: false
+  readOnlyRootFilesystem: true
+  runAsNonRoot: true
+  runAsUser: 1000
+  seccompProfile:
+    type: RuntimeDefault
+  capabilities:
+    drop:
+      - ALL
+
+priorityClassName: system-cluster-critical
+
+containerPort: 10250
+
+hostNetwork:
+  # Specifies if metrics-server should be started in hostNetwork mode.
+  #
+  # You would require this enabled if you use alternate overlay networking for pods and
+  # API server unable to communicate with metrics-server. As an example, this is required
+  # if you use Weave network on EKS
+  enabled: false
+
+replicas: 1
+
+revisionHistoryLimit:
+
+updateStrategy: {}
+#   type: RollingUpdate
+#   rollingUpdate:
+#     maxSurge: 0
+#     maxUnavailable: 1
+
+podDisruptionBudget:
+  # https://kubernetes.io/docs/tasks/run-application/configure-pdb/
+  enabled: false
+  minAvailable:
+  maxUnavailable:
+  unhealthyPodEvictionPolicy:
+
+defaultArgs:
+  - --cert-dir=/tmp
+  - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
+  - --kubelet-use-node-status-port
+  - --metric-resolution=15s
+
+args: []
+
+livenessProbe:
+  httpGet:
+    path: /livez
+    port: https
+    scheme: HTTPS
+  initialDelaySeconds: 0
+  periodSeconds: 10
+  failureThreshold: 3
+
+readinessProbe:
+  httpGet:
+    path: /readyz
+    port: https
+    scheme: HTTPS
+  initialDelaySeconds: 20
+  periodSeconds: 10
+  failureThreshold: 3
+
+service:
+  type: ClusterIP
+  port: 443
+  annotations: {}
+  labels: {}
+  #  Add these labels to have metrics-server show up in `kubectl cluster-info`
+  #  kubernetes.io/cluster-service: "true"
+  #  kubernetes.io/name: "Metrics-server"
+
+addonResizer:
+  enabled: false
+  image:
+    repository: registry.k8s.io/autoscaling/addon-resizer
+    tag: 1.8.23
+  securityContext:
+    allowPrivilegeEscalation: false
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    runAsUser: 1000
+    seccompProfile:
+      type: RuntimeDefault
+    capabilities:
+      drop:
+        - ALL
+  resources:
+    requests:
+      cpu: 40m
+      memory: 25Mi
+    limits:
+      cpu: 40m
+      memory: 25Mi
+  nanny:
+    cpu: 0m
+    extraCpu: 1m
+    memory: 0Mi
+    extraMemory: 2Mi
+    minClusterSize: 100
+    pollPeriod: 300000
+    threshold: 5
+
+metrics:
+  enabled: false
+
+serviceMonitor:
+  enabled: false
+  additionalLabels: {}
+  interval: 1m
+  scrapeTimeout: 10s
+  metricRelabelings: []
+  relabelings: []
+
+# See https://github.com/kubernetes-sigs/metrics-server#scaling
+resources:
+  requests:
+    cpu: 100m
+    memory: 200Mi
+    # limits:
+    #   cpu:
+    #   memory:
+
+extraVolumeMounts: []
+
+extraVolumes: []
+
+nodeSelector: {}
+
+tolerations: []
+
+affinity: {}
+
+topologySpreadConstraints: []
+
+dnsConfig: {}
+
+# Annotations to add to the deployment
+deploymentAnnotations: {}
+
+schedulerName: ""
+
+tmpVolume:
+  emptyDir: {}
+
+tls:
+  # Set the TLS method to use. Supported values:
+  # - `metrics-server` : Metrics-server will generate a self-signed certificate
+  # - `helm`           : Helm will generate a self-signed certificate
+  # - `cert-manager`   : Use cert-manager.io to create and maintain the certificate
+  # - `existingSecret` : Reuse an existing secret. No new secret will be created
+  type: "metrics-server"
+  # Kubernetes cluster domain. Used to configure Subject Alt Names for the certificate
+  clusterDomain: cluster.local
+
+  certManager:
+    # Automatically add the cert-manager.io/inject-ca-from annotation to the APIService resource.
+    # See https://cert-manager.io/docs/concepts/ca-injector
+    addInjectorAnnotations: true
+    existingIssuer:
+      # Use an existing cert-manager issuer
+      enabled: false
+      # Kind of the existing cert-manager issuer
+      kind: "Issuer"
+      # Name of the existing cert-manager issuer
+      name: "my-issuer"
+    # Set the requested duration (i.e. lifetime) of the Certificate.
+    # See https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec
+    duration: ""
+    # How long before the currently issued certificate’s expiry cert-manager should renew the certificate.
+    # See https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec
+    renewBefore: ""
+    # Add extra annotations to the Certificate resource
+    annotations: {}
+    # Add extra labels to the Certificate resource
+    labels: {}
+
+  helm:
+    # Use helm lookup function to reuse Secret created in previous helm install
+    lookup: true
+    # Cert validity duration in days
+    certDurationDays: 365
+
+  existingSecret:
+    # Name of the existing Secret to use for TLS
+    name: ""
+    # Use helm lookup function to provision `apiService.caBundle`
+    lookup: true
diff --git a/packs/metrics-server-3.13.1/logo.png b/packs/metrics-server-3.13.1/logo.png
new file mode 100644
index 00000000..5e2b1ab7
Binary files /dev/null and b/packs/metrics-server-3.13.1/logo.png differ
diff --git a/packs/metrics-server-3.13.1/pack.json b/packs/metrics-server-3.13.1/pack.json
new file mode 100644
index 00000000..da74d744
--- /dev/null
+++ b/packs/metrics-server-3.13.1/pack.json
@@ -0,0 +1,28 @@
+{
+  "addonType": "monitoring",
+  "annotations": {
+    "source": "community",
+    "contributor": "spectrocloud"
+  },
+  "cloudTypes": [
+    "all"
+  ],
+  "displayName": "Metrics Server",
+  "charts": [
+    "charts/metrics-server-3.13.1.tgz"
+  ],
+  "layer": "addon",
+  "name": "metrics-server",
+  "version": "3.13.1",
+  "constraints": {
+    "dependencies": [
+      {
+        "packName": "kubernetes",
+        "layer": "k8s",
+        "minVersion": "1.29",
+        "maxVersion": "",
+        "type": "optional"
+      }
+    ]
+  }
+}
diff --git a/packs/metrics-server-3.13.1/values.yaml b/packs/metrics-server-3.13.1/values.yaml
new file mode 100644
index 00000000..62ce0545
--- /dev/null
+++ b/packs/metrics-server-3.13.1/values.yaml
@@ -0,0 +1,262 @@
+pack:
+  # The namespace (on the target cluster) in which the pack will be deployed.
+  # When the namespace is not found, a new namespace will be created with the name specified.
+  # kube-system is the namespace metrics-server is deployed to by default on most
+  # Kubernetes distributions (kubeadm, EKS, GKE, AKS, etc.).
+  namespace: "kube-system"
+
+  content:
+    images:
+      - image: registry.k8s.io/metrics-server/metrics-server:v0.8.1
+    charts:
+      - repo: https://kubernetes-sigs.github.io/metrics-server/
+        name: metrics-server
+        version: 3.13.1
+
+charts:
+  metrics-server:
+    # Default values for metrics-server.
+    # This is a YAML-formatted file.
+    # Declare variables to be passed into your templates.
+
+    image:
+      repository: registry.k8s.io/metrics-server/metrics-server
+      # Overrides the image tag whose default is v{{ .Chart.AppVersion }}
+      tag: ""
+      pullPolicy: IfNotPresent
+
+    imagePullSecrets: []
+    # - name: registrySecretName
+
+    nameOverride: ""
+    fullnameOverride: ""
+
+    serviceAccount:
+      # Specifies whether a service account should be created
+      create: true
+      # Annotations to add to the service account
+      annotations: {}
+      # The name of the service account to use.
+      # If not set and create is true, a name is generated using the fullname template
+      name: ""
+      # The list of secrets mountable by this service account.
+      # See https://kubernetes.io/docs/reference/labels-annotations-taints/#enforce-mountable-secrets
+      secrets: []
+
+    rbac:
+      # Specifies whether RBAC resources should be created
+      create: true
+      # Note: PodSecurityPolicy will not be created when Kubernetes version is 1.25 or later.
+      pspEnabled: false
+
+    apiService:
+      # Specifies if the v1beta1.metrics.k8s.io API service should be created.
+      #
+      # You typically want this enabled! If you disable API service creation you have to
+      # manage it outside of this chart for e.g horizontal pod autoscaling to
+      # work with this release.
+      create: true
+      # Annotations to add to the API service
+      annotations: {}
+      # Specifies whether to skip TLS verification
+      insecureSkipTLSVerify: true
+      # The PEM encoded CA bundle for TLS verification
+      caBundle: ""
+
+    commonLabels: {}
+    podLabels: {}
+    podAnnotations: {}
+
+    podSecurityContext: {}
+
+    securityContext:
+      allowPrivilegeEscalation: false
+      readOnlyRootFilesystem: true
+      runAsNonRoot: true
+      runAsUser: 1000
+      seccompProfile:
+        type: RuntimeDefault
+      capabilities:
+        drop:
+          - ALL
+
+    priorityClassName: system-cluster-critical
+
+    containerPort: 10250
+
+    hostNetwork:
+      # Specifies if metrics-server should be started in hostNetwork mode.
+      #
+      # You would require this enabled if you use alternate overlay networking for pods and
+      # API server unable to communicate with metrics-server. As an example, this is required
+      # if you use Weave network on EKS
+      enabled: false
+
+    replicas: 1
+
+    revisionHistoryLimit:
+
+    updateStrategy: {}
+    #   type: RollingUpdate
+    #   rollingUpdate:
+    #     maxSurge: 0
+    #     maxUnavailable: 1
+
+    podDisruptionBudget:
+      # https://kubernetes.io/docs/tasks/run-application/configure-pdb/
+      enabled: false
+      minAvailable:
+      maxUnavailable:
+      unhealthyPodEvictionPolicy:
+
+    defaultArgs:
+      - --cert-dir=/tmp
+      - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
+      - --kubelet-use-node-status-port
+      - --metric-resolution=15s
+
+    args: []
+
+    livenessProbe:
+      httpGet:
+        path: /livez
+        port: https
+        scheme: HTTPS
+      initialDelaySeconds: 0
+      periodSeconds: 10
+      failureThreshold: 3
+
+    readinessProbe:
+      httpGet:
+        path: /readyz
+        port: https
+        scheme: HTTPS
+      initialDelaySeconds: 20
+      periodSeconds: 10
+      failureThreshold: 3
+
+    service:
+      type: ClusterIP
+      port: 443
+      annotations: {}
+      labels: {}
+      #  Add these labels to have metrics-server show up in `kubectl cluster-info`
+      #  kubernetes.io/cluster-service: "true"
+      #  kubernetes.io/name: "Metrics-server"
+
+    addonResizer:
+      enabled: false
+      image:
+        repository: registry.k8s.io/autoscaling/addon-resizer
+        tag: 1.8.23
+      securityContext:
+        allowPrivilegeEscalation: false
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 1000
+        seccompProfile:
+          type: RuntimeDefault
+        capabilities:
+          drop:
+            - ALL
+      resources:
+        requests:
+          cpu: 40m
+          memory: 25Mi
+        limits:
+          cpu: 40m
+          memory: 25Mi
+      nanny:
+        cpu: 0m
+        extraCpu: 1m
+        memory: 0Mi
+        extraMemory: 2Mi
+        minClusterSize: 100
+        pollPeriod: 300000
+        threshold: 5
+
+    metrics:
+      enabled: false
+
+    serviceMonitor:
+      enabled: false
+      additionalLabels: {}
+      interval: 1m
+      scrapeTimeout: 10s
+      metricRelabelings: []
+      relabelings: []
+
+    # See https://github.com/kubernetes-sigs/metrics-server#scaling
+    resources:
+      requests:
+        cpu: 100m
+        memory: 200Mi
+        # limits:
+        #   cpu:
+        #   memory:
+
+    extraVolumeMounts: []
+
+    extraVolumes: []
+
+    nodeSelector: {}
+
+    tolerations: []
+
+    affinity: {}
+
+    topologySpreadConstraints: []
+
+    dnsConfig: {}
+
+    # Annotations to add to the deployment
+    deploymentAnnotations: {}
+
+    schedulerName: ""
+
+    tmpVolume:
+      emptyDir: {}
+
+    tls:
+      # Set the TLS method to use. Supported values:
+      # - `metrics-server` : Metrics-server will generate a self-signed certificate
+      # - `helm`           : Helm will generate a self-signed certificate
+      # - `cert-manager`   : Use cert-manager.io to create and maintain the certificate
+      # - `existingSecret` : Reuse an existing secret. No new secret will be created
+      type: "metrics-server"
+      # Kubernetes cluster domain. Used to configure Subject Alt Names for the certificate
+      clusterDomain: cluster.local
+
+      certManager:
+        # Automatically add the cert-manager.io/inject-ca-from annotation to the APIService resource.
+        # See https://cert-manager.io/docs/concepts/ca-injector
+        addInjectorAnnotations: true
+        existingIssuer:
+          # Use an existing cert-manager issuer
+          enabled: false
+          # Kind of the existing cert-manager issuer
+          kind: "Issuer"
+          # Name of the existing cert-manager issuer
+          name: "my-issuer"
+        # Set the requested duration (i.e. lifetime) of the Certificate.
+        # See https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec
+        duration: ""
+        # How long before the currently issued certificate's expiry cert-manager should renew the certificate.
+        # See https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec
+        renewBefore: ""
+        # Add extra annotations to the Certificate resource
+        annotations: {}
+        # Add extra labels to the Certificate resource
+        labels: {}
+
+      helm:
+        # Use helm lookup function to reuse Secret created in previous helm install
+        lookup: true
+        # Cert validity duration in days
+        certDurationDays: 365
+
+      existingSecret:
+        # Name of the existing Secret to use for TLS
+        name: ""
+        # Use helm lookup function to provision `apiService.caBundle`
+        lookup: true