- Adding checksum over secrets to ensure change in secrets upgrades deployment
- Using rancher image for ensuring airgap case works too
- Adding nodeSelector to ensure the workloads never schedule to the Windows node
- Adding resource limits
- Add private image registry for airgap case

We will be keeping up with the upstream chart
https://github.com/helm/charts/tree/master/stable/external-dns

**Problem:**
Cannot start "rules-configmap-reloader" container with 10Mi limit resource

**Solution:**
Update images:

- quay.io/coreos/prometheus-operator:v0.29.0 ->
rancher/coreos-prometheus-operator:v0.29.0
- quay.io/coreos/prometheus-config-reloader ->
rancher/coreos-prometheus-config-reloader:v0.29.0
- prom/alertmanager:v0.16.1 -> rancher/prom-alertmanager:v0.16.1
- prom/prometheus:v2.7.1 -> rancher/prom-prometheus:v2.7.1
- grafana/grafana:5.4.3 -> rancher/grafana-grafana:5.4.3
- prom/node-exporter:v0.17.0 -> rancher/prom-node-exporter:v0.17.0
- quay.io/coreos/kube-state-metrics:v1.5.0 ->
rancher/coreos-kube-state-metrics:v1.5.0

**Issue:**
- https://github.com/rancher/rancher/issues/17997
- https://github.com/rancher/rancher/issues/18353

**Problem:**
Enable logging and monitoring in `rancher/rancher:master`, but can't see fluentd metric

**Solution:**
Consist label and endpoint name in `system-chart/rancher-monitoring:v0.0.2``

**Issue:**
https://github.com/rancher/rancher/issues/18327

**Patch:**
https://github.com/rancher/system-charts/pull/17

Problem:
enable logging and moinitoring but can't see fluentd metric

Solution:
consist label and endpoint name

Issue:
https://github.com/rancher/rancher/issues/18327

Refactor & fix some issue for Monitoring

checking

**Issue:**
https://github.com/rancher/rancher/issues/18104

**Issues:**
https://github.com/rancher/rancher/issues/18166

**Problem:**
- Remote reader mode only allow `project-level` Prometheus to share the
metrics from `cluster-level` Prometheus
- Remote reader mode cannot save the namespace-related metrics from
`cluster-level` Prometheus

**Solution:**
- Add `prometheus.sync.mode` to choose
- Add a "federate" scrape job when deploying federation mode

**Issue:**
https://github.com/rancher/rancher/issues/17390

**Problem:**
Cannot input like `x.y.z/k` label name into serviceSelectorLabels

**Solution:**
Use array instead of object as values

**Problem:**
Cannot input like `x.y.z/k` label name into nodeSelector

**Solution:**
Use array instead of object as values

**Issue:**
https://github.com/rancher/rancher/issues/17340

problem:
We can not deploy monitoring tools in an
air gap environment.

Solution:
Add the ability to use the private image registry when deploying
monitoring tools

Issue:
https://github.com/rancher/rancher/issues/17842

**Problem:**
- Previous charts cannot satisfy the project level monitoring deploying design
- Grafana cannot be restarted after password changed
- node-exporter cannot be scheduled to `controlpane` or `etcd` role nodes
- Prometheus cannot be started with PVC that provided by some storage provisioner which don't respect the `SecurityContext`

**Solution:**
- Deploy "project level" monitoring with a permission-limit Prometheus
- Remove Grafana account `Secret` and use provisioning instead of `grafana-watch`
- Modify node-exporter `taints`
- Add configurable `SecurityContext` for Prometheus and Alertmanager
- Narrow Prometheus permission

**Issue:**
- https://github.com/rancher/rancher/issues/17039
- https://github.com/rancher/rancher/issues/16962
- https://github.com/rancher/rancher/issues/17030
- https://github.com/rancher/rancher/issues/17256Co-authored-by: orangedeng <jxfa0043379@hotmail.com>

problem:
After we refactored the logging, we can not deploy logging tools in an
air gap environment.

Solution:
Add the ability to use the private image registry when deploying logging
tools

Issue:
https://github.com/rancher/rancher/issues/17568

Problem:
we want to use catalog to deploy system tools

Solution:
add logging chart

**Problem:**
Can't enable project level monitoring without resources quota

**Solution:**
Add resource quota to workload spec

**Issue:**
https://github.com/rancher/rancher/issues/16993

**Problem:**
Grafana still can't mount PV correctly in Cloud, because there are 2
`securityContext` and `fsGroup` only work on Pod spec.

**Solution:**
Change the `securityContext` to Pod spec.

**Issue:**
https://github.com/rancher/rancher/issues/16953

This reverts commit cb0f92308e32c637a5cd09b5c1b7a644378bb58a.

Problem:
There isn't `fsGroup` in Container `securityContext`

Problem:
- Grafana can't mount PV correctly in Cloud

Solution:
- Use SecurityContext

Issue:
rancher/rancher#16953

        (+) Only use for Rancher 2.0 Monitoring and Alerting
        (+) Support Grafana to proxy with authorization bearer token to
        Prometheus-Auth agent
        (+) Support Prometheus web to proxy with authorization bearer token
        to Prometheus-Auth agent
        (+) Rich metrics for Kubernetes and Rancher
Co-authored-by: aiwantaozi <michelia.feng@gmail.com>
Co-authored-by: orangedeng <jxfa0043379@hotmail.com>