External prometheus unable to scrape linkerd-service-mirror on port 9999 (403 Forbidden)

[taind772]

I set up our external Prometheus to scrape Linkerd metrics: proxy & controller metrics work fine but when Prometheus scrapes Linkerd-service-mirror metrics it gets HTTP status 403 Forbidden.

I tried scraping metrics from another pod and got the same issue, but built-in prometheus (installed by linkerd-viz chart) works just fine and forwarding service-mirror container port 9999 works too.

It looks like linkerd-porxy blocked the scrape request. I tried removing linkerd.io/inject annotation from the service mirror pod and it works, but it's certainly not a fix.

Linkerd version: 2.11.1

[taind772]

I found out it was due to a specific authorization policy installed by helm chart