In CMO, ThanosRuler pods have an Oauth-proxy on port 9091 for web access on all paths.

We are going to replace it with kube-rbac-proxy and constraint the access to /api/v1 paths. 

The current behavior is to allow access to the ThanosRuler web server for any user having "get" access to "namespace" resources. We do not have to keep the same logic but have to make sure no regression happen. We may need use a stub custom resource to authorize both "post" and "get" HTTP requests from certain users.