Not a bug.  Ended up converting to a research [Spike] with this  Google Doc as the result.

***********

Update https://docs.openshift.com/container-platform/4.7/service_mesh/v2x/ossm-observability.html#ossm-access-prometheus_observability

When Service Mesh installs Prometheus, it's behind an authentication proxy.  Customers cannot access it via the route as currently documented.

From Kiali-dev Slack (@Mazz)

 It's just that when ServiceMesh installs Prometheus, they put it behind some authentication proxy. Here's the config we use when we deploy using our dev makefile - you can see we need to obtain the password that ServiceMesh sets up (its from a secret somewhere that they create) and we need to tell Kiali about it: https://github.com/kiali/kiali-operator/blob/master/deploy/kiali/kiali_cr_dev_servicemesh.yaml#L32-L38

Here's how our makefile determines what the password is - this is something anyone will need to know how to do in order to query prometheus (you need these credentials to login): https://github.com/kiali/kiali/blob/de7041d3c7b4b5e4b9185cea70572e092cd21318/make/Makefile.operator.mk#L60