Prometheus :9090/metrics is open and not secure

[type-checker]

Is there any reason for Prometheus :9090/metrics to be open and doesn't require authentication?

[sebadob]

Of course there is a reason. Metrics are usually only used internally, don't expose sensitive information and it's just a lot more straight forward to have these endpoints open, so they can be auto-scraped e.g. inside K8s without any additional setup, or by simply adding K8s labels or similar.