kube-state-metrics needs additional permissions for replicationcontrollers, limitranges, and services (otherwise the API server logs are flooded with RBAC DENY messages)
In cleanup commit 9cd05a8c39c6ed03688859de92372d93af5cc6e2 the labels on the ServiceMonitors were changed from k8s-apps to k8s-app. This commit makes the Prometheus selector match that change.