Whenever serving Prometheus or Alertmanager through non root
ExternalURLs we require the reverse proxy to trim the URL to be to the
root Prometheus/Alertmanager.
For `--dry-run` to work with kubectl a Kubernetes cluster's apiserver is
actually used, which is unnecessary for generating these manifests. This
approach also allows further customization, such as adding labels to the
generated manifests.