The metrics listener (metrics.enabled, default port 4004): GET /metrics, GET /health and GET /ready, and a 404 for everything else. A scraper or a kubelet probe gets a route to those three and none to the operator API (Ankusa.Admin.Router), which mutates sources, replays and the pen and so belongs behind a different network rule than a Prometheus job.

The admin listener serves the same three routes through the same functions (metrics/1, health/1, ready/1), so a scrape answers identically on either port.

Like every listener it carries no authentication of its own: bind it to an interface only the scraper reaches, or give it a metrics.tls block with verify: :verify_peer so only a client holding a certificate from your CA can connect (see Ankusa.Listener).