feat: allow prometheus for only authorized users (#12121)

allow restrictions on who can access Prometheus
endpoint, additionally add prometheus as part of
diagnostics canned policy.

Signed-off-by: Harshavardhana <harsha@minio.io>

pkg/iam/policy/admin-action.go

@@ -31,6 +31,8 @@ const (
 
 	// StorageInfoAdminAction - allow listing server info
 	StorageInfoAdminAction = "admin:StorageInfo"
+	// PrometheusAdminAction - prometheus info action
+	PrometheusAdminAction = "admin:Prometheus"
 	// DataUsageInfoAdminAction - allow listing data usage info
 	DataUsageInfoAdminAction = "admin:DataUsageInfo"
 	// ForceUnlockAdminAction - allow force unlocking locks
@@ -141,6 +143,7 @@ var supportedAdminActions = map[AdminAction]struct{}{
 	DataUsageInfoAdminAction:        {},
 	TopLocksAdminAction:             {},
 	ProfilingAdminAction:            {},
+	PrometheusAdminAction:           {},
 	TraceAdminAction:                {},
 	ConsoleLogAdminAction:           {},
 	KMSKeyStatusAdminAction:         {},

pkg/iam/policy/constants.go

@@ -76,7 +76,9 @@ var AdminDiagnostics = Policy{
 			Actions: NewActionSet(ProfilingAdminAction,
 				TraceAdminAction, ConsoleLogAdminAction,
 				ServerInfoAdminAction, TopLocksAdminAction,
-				HealthInfoAdminAction, BandwidthMonitorAction),
+				HealthInfoAdminAction, BandwidthMonitorAction,
+				PrometheusAdminAction,
+			),
 			Resources: NewResourceSet(NewResource("*", "")),
 		},
 	},