From 2898a2a6c86ffff2eef3f1efebe109145895de68 Mon Sep 17 00:00:00 2001
From: David Young <156974579+DYTechWriter@users.noreply.github.com>
Date: Fri, 12 Jun 2026 00:55:59 +0000
Subject: [PATCH] docs: document /metrics endpoint authentication requirement

The /metrics endpoint requires authentication by default since a recent
Mission Control release. Documents the metrics.auth.disabled=true Helm
flag for environments where open access is required, with a note about
the security implication. Closes #466.
---
 mission-control/docs/integrations/prometheus.mdx | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/mission-control/docs/integrations/prometheus.mdx b/mission-control/docs/integrations/prometheus.mdx
index e3c77a41..0cf21786 100644
--- a/mission-control/docs/integrations/prometheus.mdx
+++ b/mission-control/docs/integrations/prometheus.mdx
@@ -67,11 +67,24 @@ spec:
 
 Mission Control exposes Prometheus metrics for monitoring health checks, notifications, and configuration scraping.
 
+### Authentication
+
+The `/metrics` endpoint requires authentication by default. Prometheus must supply valid credentials when scraping, or you can disable the requirement:
+
+```bash title="Disable metrics authentication"
+helm install mission-control flanksource/mission-control \
+  --set metrics.auth.disabled=true
+```
+
+:::note
+Disabling authentication exposes your metrics endpoint publicly. Only use this setting in trusted network environments.
+:::
+
 ### ServiceMonitor Setup
 
 Enable Prometheus scraping via ServiceMonitor:
 
-```bash
+```bash title="Enable ServiceMonitor"
 helm install mission-control flanksource/mission-control \
   --set serviceMonitor=true
 ```