Push gateway does not have any authentication built in, so that'll need some sort of authenticating proxy that ensures the correct project tags are in place. API keys managed via prometheus-manager are likely the way to go.