GitLab

https://github.com/rancher/rancher/issues/23857

Problem:
Fails to run nginx proxies, because user home directory is not owned by nginx user inside newer nginx-alpine images

Solution:
Mount emptyDir to the user home directory(/var/cache/nginx) so that it
is writable by the nginx user.
Also update UID from 100 to 101 to be consistent with upstream changes(https://github.com/nginxinc/docker-nginx/issues/218)

logging 0.1.2 -> 0.1.3
monitoring 0.0.4 -> 0.0.5

Problem:
Fail to enable monitoring on restricted PSP clusters.

Solution:
1. Update grafana to run as grafana user.
2. Update nginx sidecars to run as nginx user, move files to the user
home directory(/var/cache/nginx) and listen on non privileged 8080 port.
With 1 & 2, project monitoring works in restricted clusters out of the
box.
3. Add necessary PSP/role/rb resource to node-exporter, which is used by
cluster monitoring.

Problem:
New add charts operator-init lack of linux node selector and tolerations

Solution:
Improve node selector and tolerations

- Use project name & cluster name info from Values.global

- Embed operator as sub charts
    + Support to configure operator like other charts
    + Adjust operator default limit
- Add permission to kube-state exporter
- Replace localhost by 127.0.0.1 on prometheus-auth
- Increase Nginx proxy buffers
- Configure PVC name of Prometheus or Alertmanager
    + Allow to configure PVC name of Prometheus or Alertmanager via `prometheus.persistence.name` or `alertmanager.persistence.name`
- Adjust Cluster Monitoring scrape logic
    + Don't scrape Monitoring namespace on `prometheus-io-scrape` job
    + The rate to scrape is using global interval, the default is 60s
    + Remove useless Prometheus record rules

**Issue:**
- https://github.com/rancher/rancher/issues/19693
- https://github.com/rancher/rancher/issues/18830
- https://github.com/rancher/rancher/issues/19243
- https://github.com/rancher/rancher/issues/19689
- https://github.com/rancher/rancher/issues/19410
- https://github.com/rancher/rancher/issues/19248

checking

**Issue:**
https://github.com/rancher/rancher/issues/18104

**Issues:**
https://github.com/rancher/rancher/issues/18166

**Problem:**
- Remote reader mode only allow `project-level` Prometheus to share the
metrics from `cluster-level` Prometheus
- Remote reader mode cannot save the namespace-related metrics from
`cluster-level` Prometheus

**Solution:**
- Add `prometheus.sync.mode` to choose
- Add a "federate" scrape job when deploying federation mode

**Issue:**
https://github.com/rancher/rancher/issues/17390

**Problem:**
Cannot input like `x.y.z/k` label name into nodeSelector

**Solution:**
Use array instead of object as values

**Issue:**
https://github.com/rancher/rancher/issues/17340

problem:
We can not deploy monitoring tools in an
air gap environment.

Solution:
Add the ability to use the private image registry when deploying
monitoring tools

Issue:
https://github.com/rancher/rancher/issues/17842

**Problem:**
- Previous charts cannot satisfy the project level monitoring deploying design
- Grafana cannot be restarted after password changed
- node-exporter cannot be scheduled to `controlpane` or `etcd` role nodes
- Prometheus cannot be started with PVC that provided by some storage provisioner which don't respect the `SecurityContext`

**Solution:**
- Deploy "project level" monitoring with a permission-limit Prometheus
- Remove Grafana account `Secret` and use provisioning instead of `grafana-watch`
- Modify node-exporter `taints`
- Add configurable `SecurityContext` for Prometheus and Alertmanager
- Narrow Prometheus permission

**Issue:**
- https://github.com/rancher/rancher/issues/17039
- https://github.com/rancher/rancher/issues/16962
- https://github.com/rancher/rancher/issues/17030
- https://github.com/rancher/rancher/issues/17256Co-authored-by: orangedeng <jxfa0043379@hotmail.com>

        (+) Only use for Rancher 2.0 Monitoring and Alerting
        (+) Support Grafana to proxy with authorization bearer token to
        Prometheus-Auth agent
        (+) Support Prometheus web to proxy with authorization bearer token
        to Prometheus-Auth agent
        (+) Rich metrics for Kubernetes and Rancher
Co-authored-by: aiwantaozi <michelia.feng@gmail.com>
Co-authored-by: orangedeng <jxfa0043379@hotmail.com>