Ceph » mgr » Dashboard

As Prometheus' security model may not be obvious, we should document how Prometheus, by default, sees it and provide references to this perception.

For example, access to the Prometheus HTTP API cannot be password protected by configuring Prometheus and is, by default, considered to be accessible by untrusted users.

It is presumed that untrusted users have access to the Prometheus HTTP endpoint and logs.
-- https://prometheus.io/docs/operating/security/