diff --git a/stable/prometheus/Chart.yaml b/stable/prometheus/Chart.yaml
index 8cf98ebba3..88e214f9f7 100644
--- a/stable/prometheus/Chart.yaml
+++ b/stable/prometheus/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: v1
 name: prometheus
-version: 11.6.1
+version: 11.6.2
 appVersion: 2.19.0
 description: Prometheus is a monitoring system and time series database.
 home: https://prometheus.io/
diff --git a/stable/prometheus/templates/alertmanager-clusterrole.yaml b/stable/prometheus/templates/alertmanager-clusterrole.yaml
index 3cfc13300b..f8b95a76e4 100644
--- a/stable/prometheus/templates/alertmanager-clusterrole.yaml
+++ b/stable/prometheus/templates/alertmanager-clusterrole.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.alertmanager.enabled .Values.rbac.create -}}
+{{- if and .Values.alertmanager.enabled .Values.rbac.create .Values.alertmanager.useClusterRole -}}
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
 metadata:
diff --git a/stable/prometheus/templates/alertmanager-clusterrolebinding.yaml b/stable/prometheus/templates/alertmanager-clusterrolebinding.yaml
index 03102fb185..7354931550 100644
--- a/stable/prometheus/templates/alertmanager-clusterrolebinding.yaml
+++ b/stable/prometheus/templates/alertmanager-clusterrolebinding.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.alertmanager.enabled .Values.rbac.create -}}
+{{- if and .Values.alertmanager.enabled .Values.rbac.create .Values.alertmanager.useClusterRole -}}
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRoleBinding
 metadata:
diff --git a/stable/prometheus/templates/alertmanager-role.yaml b/stable/prometheus/templates/alertmanager-role.yaml
new file mode 100644
index 0000000000..1abea5369f
--- /dev/null
+++ b/stable/prometheus/templates/alertmanager-role.yaml
@@ -0,0 +1,24 @@
+{{- if and .Values.alertmanager.enabled .Values.rbac.create (eq .Values.alertmanager.useClusterRole false) -}}
+{{- range $.Values.alertmanager.namespaces }}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: Role
+metadata:
+  labels:
+    {{- include "prometheus.alertmanager.labels" $ | nindent 4 }}
+  name: {{ template "prometheus.alertmanager.fullname" $ }}
+  namespace: {{ . }}
+rules:
+{{- if $.Values.podSecurityPolicy.enabled }}
+  - apiGroups:
+    - extensions
+    resources:
+    - podsecuritypolicies
+    verbs:
+    - use
+    resourceNames:
+    - {{ template "prometheus.alertmanager.fullname" $ }}
+{{- else }}
+  []
+{{- end }}
+{{- end }}
+{{- end }}
diff --git a/stable/prometheus/templates/alertmanager-rolebinding.yaml b/stable/prometheus/templates/alertmanager-rolebinding.yaml
new file mode 100644
index 0000000000..1dc1a360b6
--- /dev/null
+++ b/stable/prometheus/templates/alertmanager-rolebinding.yaml
@@ -0,0 +1,19 @@
+{{- if and .Values.alertmanager.enabled .Values.rbac.create (eq .Values.alertmanager.useClusterRole false) -}}
+{{ range $.Values.alertmanager.namespaces }}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: RoleBinding
+metadata:
+  labels:
+    {{- include "prometheus.alertmanager.labels" $ | nindent 4 }}
+  name: {{ template "prometheus.alertmanager.fullname" $ }}
+  namespace: {{ . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "prometheus.serviceAccountName.alertmanager" $ }}
+{{ include "prometheus.namespace" $ | indent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "prometheus.alertmanager.fullname" $ }}
+{{- end }}
+{{ end }}
diff --git a/stable/prometheus/templates/server-clusterrole.yaml b/stable/prometheus/templates/server-clusterrole.yaml
index b5c6382296..4c3008b0e5 100644
--- a/stable/prometheus/templates/server-clusterrole.yaml
+++ b/stable/prometheus/templates/server-clusterrole.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.server.enabled .Values.rbac.create -}}
+{{- if and .Values.server.enabled .Values.rbac.create (empty .Values.server.useExistingClusterRoleName) -}}
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
 metadata:
diff --git a/stable/prometheus/templates/server-clusterrolebinding.yaml b/stable/prometheus/templates/server-clusterrolebinding.yaml
index 5beebfc8db..d3dce41d44 100644
--- a/stable/prometheus/templates/server-clusterrolebinding.yaml
+++ b/stable/prometheus/templates/server-clusterrolebinding.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.server.enabled .Values.rbac.create -}}
+{{- if and .Values.server.enabled .Values.rbac.create (empty .Values.server.namespaces) (empty .Values.server.useExistingClusterRoleName) -}}
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRoleBinding
 metadata:
diff --git a/stable/prometheus/templates/server-rolebinding.yaml b/stable/prometheus/templates/server-rolebinding.yaml
new file mode 100644
index 0000000000..38c8e1a49b
--- /dev/null
+++ b/stable/prometheus/templates/server-rolebinding.yaml
@@ -0,0 +1,20 @@
+{{- if and .Values.server.enabled .Values.rbac.create .Values.server.useExistingClusterRoleName .Values.server.namespaces -}}
+{{ range $.Values.server.namespaces -}}
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: RoleBinding
+metadata:
+  labels:
+    {{- include "prometheus.server.labels" $ | nindent 4 }}
+  name: {{ template "prometheus.server.fullname" $ }}
+  namespace: {{ . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "prometheus.serviceAccountName.server" $ }}
+{{ include "prometheus.namespace" $ | indent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ $.Values.server.useExistingClusterRoleName }}
+{{ end -}}
+{{ end -}}
diff --git a/stable/prometheus/values.yaml b/stable/prometheus/values.yaml
index 0e1cdad141..ef05b89cd6 100644
--- a/stable/prometheus/values.yaml
+++ b/stable/prometheus/values.yaml
@@ -32,6 +32,11 @@ alertmanager:
   ##
   enabled: true
 
+  ## Use a ClusterRole (and ClusterRoleBinding)
+  ## - If set to false, we define a Role and RoleBinding in the defined namespaces ONLY
+  ## This makes alertmanager work - for users who do not have ClusterAdmin privs, but wants alertmanager to operate on their own namespaces, instead of clusterwide.
+  useClusterRole: true
+
   ## alertmanager container name
   ##
   name: alertmanager
@@ -538,6 +543,21 @@ server:
   ## Prometheus server container name
   ##
   enabled: true
+
+  ## Use a ClusterRole (and ClusterRoleBinding)
+  ## - If set to false - we define a RoleBinding in the defined namespaces ONLY
+  ##
+  ## NB: because we need a Role with nonResourceURL's ("/metrics") - you must get someone with Cluster-admin privileges to define this role for you, before running with this setting enabled.
+  ##     This makes prometheus work - for users who do not have ClusterAdmin privs, but wants prometheus to operate on their own namespaces, instead of clusterwide.
+  ##
+  ## You MUST also set namespaces to the ones you have access to and want monitored by Prometheus.
+  ##
+  # useExistingClusterRoleName: nameofclusterrole
+
+  ## namespaces to monitor (instead of monitoring all - clusterwide). Needed if you want to run without Cluster-admin privileges.
+  # namespaces:
+  #   - yournamespace
+
   name: server
   sidecarContainers: