Problem:
Fail to enable monitoring on restricted PSP clusters.

Solution:
1. Update grafana to run as grafana user.
2. Update nginx sidecars to run as nginx user, move files to the user
home directory(/var/cache/nginx) and listen on non privileged 8080 port.
With 1 & 2, project monitoring works in restricted clusters out of the
box.
3. Add necessary PSP/role/rb resource to node-exporter, which is used by
cluster monitoring.

Problem:
New add charts operator-init lack of linux node selector and tolerations

Solution:
Improve node selector and tolerations

Problem:
can't get windows container/node metrics

Solution:
1. deploy windows node exporter
2. add add windows metrics service, endpoint, service monitor
3. add metric relabel rules to unify windows and linux expression

Issue:
https://github.com/rancher/rancher/issues/20513
https://github.com/rancher/rancher/issues/20076
https://github.com/rancher/rancher/issues/20122

Problem:
current elasticsearch gems has warning log for elasticsearch 7.x, rancher/fluentd have release new version

Solution:
upgrade fluentd, elasticsearch etc gems version

Issue:
https://github.com/rancher/rancher/issues/20450
https://github.com/rancher/rancher/issues/20509

Problem:
Daemonset api version extensions/v1beta1 is deperated in 1.16

Solution:
Use the capabilities API versions defined in template

Issue:
https://github.com/rancher/rancher/issues/21770

Problem:
now filename only allow numbers and letter

Solution:
change regex expression to allow all charaters

Issue:
https://github.com/rancher/rancher/issues/17022

Formerly, it is accessible by authenticated users.
Now, it is accessible by cluster owners and authorized users/groups.

* important stuff: update README

* cis chart - initial version

* updating to use same image

* adding owner

* fixing the image name, version

Using Rancher repo instead of harbor repo.

Change all the repository in the istio to use rancher repo to pull the
image.

Problem:
Registry pod stuck in AttchVolumeFailed status on upgrade. Deadlock happens where the new pod waits the old pod to dettach the volume, and the old one waits for the new one to be ready.

Solution:
Set maxUnavailable to 1, so that the old pod can be released before the new pod is ready.

  * add istio and certmanager CRDs
  * add rancher system default registry config
  * add rancher proxy to the Grafana, Prometheus, Kiali and Tracing
  * remove not used demo values.yaml files and serviceGraph(deprecated)

Add globalRegistryMode to enable deploying the Harbor as a global
registry in Rancher. It use the same domain as Rancher server in
ingress rules, and use the same tls-rancher-ingress secret for TLS.