These changes have been tested against kubespray v2.9.0 on a baremetal
cluster created from scratch. They have not been tested against previous
versions of kubespray.

Fixes:

https://github.com/coreos/kube-prometheus/issues/79

A local ntp server is optional, while timex is in kernel and always
present. Some ntp daemons like chrony can also only be run in a client
mode, which synchronizes the kernel but doesn't expose an ntp server.
Using the timex metrics is a more reliable approach.

Currently, only cluster wide admins have the permissions to view
metrics resources. This fixes it by adding a read-only cluster role
which includes aggregation labels to synthesize permission rules for
standard user-facing roles according to [1].

Note that only the "pods" resource is granted as reading "nodes"
metrics requires a cluster wide permission.

[1] https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles

This alert is not specific enough on the interfaces it selects which in
turn makes it too noisy.

These metrics can still be valuable to troubleshoot components running
in cgroups on the host, outside the scope of Kubernetes pods.

cAdvisor exposes metrics for each cgroup hierachy step, and containers
are part of the respective pod's hierarchy, causing double accounting
when not filtered appropriately.

Follow other snippet file extension names
This file is not referenced from other location in repo according to
quick grep.

* `tsdb_wal_corruptions_total metric` name should be
`prometheus_tsdb_wal_corruptions_total`

Also remove unnecessary namespace from prometheus-adapter ClusterRoleBinding

Signed-off-by: Michael Goodness <mike.goodness@ticketmaster.com>

This commit removes get/list/watch on nodes for the Prometheus-k8s
instance, as Prometheus pods do not need that privilege for anything.

Regenerate kube-prometheus

Manifest generation fails if this option is not set. Instead, remove the
option and require users to patch the object in case they need it.