When Prometheus metrics are enabled on OpenShift, anybody on Internet can see them.

It's sufficient to add appended “/metrics” to web console route to access the metrics. There is no authentication of the user.