You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/azure-monitor/containers/prometheus-metrics-scrape-configuration.md
+9-12Lines changed: 9 additions & 12 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -511,15 +511,15 @@ basic_auth:
511
511
512
512
### TLS based scraping
513
513
514
-
If you are using `tls_config` setting in your prometheus configuration, please follow the steps -
514
+
If you have a Prometheus instance served with TLS and you want to scrape metrics from it, you need to set scheme to `https` and set the TLS settings in your configmap or respective CRD.
515
+
Please follow the below steps.
515
516
516
-
Below is an example of creating a secret.
517
-
518
-
1. Create a secret object in the **kube-system** namespace named **ama-metrics-mtls-secret**.
517
+
1. Create a secret object in the **kube-system** namespace named **ama-metrics-mtls-secret**.
518
+
Example command for creating secret: kubectl create secret generic ama-metrics-mtls-secret --from-file=secret_kube-system_ama-metrics-mtls-secret_client-cert.pem=secret_kube-system_ama-metrics-mtls-secret_client-cert.pem --from-file=secret_kube-system_ama-metrics-mtls-secret_client-key.pem=secret_kube-system_ama-metrics-mtls-secret_client-key.pem -n kube-system.
519
519
520
520
521
521
The value for password1 is **base64encoded**
522
-
The key *password1* can be anything, but just needs to match your scrapeconfig *password_file* filepath.
522
+
The key *password1* can be anything, but just needs to match with the keys/filenames mentioned in your CRD/Configmap.
523
523
524
524
```yaml
525
525
apiVersion: v1
@@ -568,17 +568,14 @@ tlsConfig:
568
568
name: "ama-metrics-mtls-secret"
569
569
insecureSkipVerify: false
570
570
```
571
+
571
572
> [!NOTE]
572
-
>
573
+
>
573
574
> Make sure that the certificate file name and key name inside the mtls app is in the following format in case of a CRD based scraping. For example: secret_kube-system_ama-metrics-mtls-secret_cert-name.pem and secret_kube-system_ama-metrics-mtls-secret_key-name.pem.
574
-
> The CRD needs to be created in kube-system namespace.
575
-
> The secret name should exactly be ama-metrics-mtls-secret in kube-system namespace. An example command for creating secret: kubectl create secret generic ama-metrics-mtls-secret --from-file=secret_kube-system_ama-metrics-mtls-secret_client-cert.pem=secret_kube-system_ama-metrics-mtls-secret_client-cert.pem --from-file=secret_kube-system_ama-metrics-mtls-secret_client-key.pem=secret_kube-system_ama-metrics-mtls-secret_client-key.pem -n kube-system
576
-
> If you have a Prometheus instance served with TLS and you want to scrape metrics from it, you need to set scheme to `https` and set the TLS settings in your configmap or respective CRD. You can use the `tls_config` configuration property inside a custom scrape job to configure the TLS settings either using a CRD or a configmap. You need to provide a CA certificate to validate API server certificate with. The CA certificate is used to verify the authenticity of the server's certificate when Prometheus connects to the target over TLS. It helps ensure that the server's certificate is signed by a trusted authority.
575
+
>
577
576
> The secret should be created in kube-system namespace and then the configmap/CRD should be created in kube-system namespace. The order of secret creation matters. When there's no secret but a valid CRD/config map, you will find errors in collector log -> `no file found for cert....`
578
-
> To read more on TLS authentication, the following documents might be helpful.
0 commit comments