ceph-mgr prometheus module does not open 9283 in iptables

[Vern Hart]

After applying CIS hardening to our ceph-mon units, we can no longer get the ceph metrics in prometheus/grafana.
We're getting a connection timeout ("context deadline exceeded") in the scrape target.
After some investigation it seems port 9283 is no longer accessible because the CIS hardening changes the default firewall policy to DROP.

As a work-around, we can allow the port:

    iptables -I INPUT -p tcp --dport 9238 -j ACCEPT