# Deploy Helm chart for linkerd-viz using stable-2.13.x - can no longer access Prometheus

**URL:** <https://linkerd.buoyant.io/t/deploy-helm-chart-for-linkerd-viz-using-stable-2-13-x-can-no-longer-access-prometheus/202>\
**Category:** Linkerd General Discussion\
**Tags:** configuration\
**Created:** [July 27, 2023, 3:14pm UTC](https://linkerd.buoyant.io/t/deploy-helm-chart-for-linkerd-viz-using-stable-2-13-x-can-no-longer-access-prometheus/202 "2023-07-27T15:14:19Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jiml617](https://avatars.discourse-cdn.com/v4/letter/j/e480ec/32.png) [@jiml617](https://linkerd.buoyant.io/u/jiml617)\
**Post date:** [July 27, 2023, 3:14pm UTC](https://linkerd.buoyant.io/t/deploy-helm-chart-for-linkerd-viz-using-stable-2-13-x-can-no-longer-access-prometheus/202/1 "2023-07-27T15:14:19Z")

</div>

Hello All,

New to Linkerd. I was deploying Helm charts that were using linkerd-viz release **stable-2.12.x** and I was able to access the provided Prometheus server without a problem. Now, if I deploy any Helm chart that is using linkerd-viz release **stable-2.13.x** , I get a **403 Forbidden error** when trying to access the provided Prometheus server.

As additional info, the control-plane is running **stable-2.13.5**.

I’m assuming this is some sort of new/changed authorization policy, but have no clue as to what I should modify or add. Any assistance would be greatly appreciated. Thanks.

---

<div class="post-metadata">

**Author:** ![Alex](https://yyz1.discourse-cdn.com/flex029/user_avatar/linkerd.buoyant.io/alex/32/63_2.png) [@Alex](https://linkerd.buoyant.io/u/Alex)\
**Post date:** [July 27, 2023, 5:49pm UTC](https://linkerd.buoyant.io/t/deploy-helm-chart-for-linkerd-viz-using-stable-2-13-x-can-no-longer-access-prometheus/202/2 "2023-07-27T17:49:50Z")

</div>

By default, Linkerd-viz’s Prometheus is locked down so that it can only be accessed by the `metrics-api` service account:

> <https://github.com/linkerd/linkerd2/blob/main/viz/charts/linkerd-viz/templates/prometheus-policy.yaml>

You can create more AuthorizationPolicy resources to allow access from other service accounts or subnets. For more details on how AuthorizationPolicies work, see: [Authorization Policy | Linkerd](https://linkerd.io/2.13/reference/authorization-policy/#authorizationpolicy)

---

<div class="post-metadata">

**Author:** ![jiml617](https://avatars.discourse-cdn.com/v4/letter/j/e480ec/32.png) [@jiml617](https://linkerd.buoyant.io/u/jiml617)\
**Post date:** [July 27, 2023, 7:42pm UTC](https://linkerd.buoyant.io/t/deploy-helm-chart-for-linkerd-viz-using-stable-2-13-x-can-no-longer-access-prometheus/202/3 "2023-07-27T19:42:50Z")

</div>

Thanks! So one other question: Do these AuthorizationPolicy objects go into effect immediately, or does anything require a restart?

---

<div class="post-metadata">

**Author:** ![alpeb](https://yyz1.discourse-cdn.com/flex029/user_avatar/linkerd.buoyant.io/alpeb/32/61_2.png) [@alpeb](https://linkerd.buoyant.io/u/alpeb)\
**Post date:** [July 31, 2023, 7:18pm UTC](https://linkerd.buoyant.io/t/deploy-helm-chart-for-linkerd-viz-using-stable-2-13-x-can-no-longer-access-prometheus/202/4 "2023-07-31T19:18:10Z")

</div>

> [@jiml617](#):
>
> Do these AuthorizationPolicy objects go into effect immediately, or does anything require a restart?

They are detected and go into effect immediately automatically so there’s no need to restart anything.