Without this access the logs of metrics-server will show the following error line:
```
unable to fully scrape metrics from source kubelet_summary:k8s-1: unable to fetch metrics from Kubelet k8s-1 (10.8.10.14): request failed - "403 Forbidden", response: "Forbidden (user=system:serviceaccount:kube-system:metrics-server, verb=get, resource=nodes, subresource=stats)",
```
and `kubectl top nodes` will give no results

[1] https://github.com/koalaman/shellcheck

Make certgen work on OSX

In preparation of PR #1206 [1], This patch moves the Thanos manifests to the
`experimental` folder.

[1] https://github.com/coreos/prometheus-operator/pull/1206