{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-370-resolve-prometheus-scrape-credential-files-through-the-mounted-secret-not-a-host/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-370-resolve-prometheus-scrape-credential-files-through-the-mounted-secret-not-a-host/", "slug": "dse-20260909-370-resolve-prometheus-scrape-credential-files-through-the-mounted-secret-not-a-host", "url": "https://update.dsesecurity.com/updates/dse-20260909-370-resolve-prometheus-scrape-credential-files-through-the-mounted-secret-not-a-host/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-370-resolve-prometheus-scrape-credential-files-through-the-mounted-secret-not-a-host.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-370-resolve-prometheus-scrape-credential-files-through-the-mounted-secret-not-a-host/" }, "title": "Resolve Prometheus scrape credential files through the mounted secret, not a host path", "summary": "What must match when an Azure Managed Prometheus scrape configuration references a credential or certificate file?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "physical-security", "label": "Physical security", "alt": "Integrated video surveillance and controlled entry at a modern commercial facility.", "card_url": "https://update.dsesecurity.com/assets/editorial/physical-security-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/physical-security-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:25:46+00:00", "modified_at": "2026-09-10T02:01:56+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 245, "potentially_affected": "Azure Managed Prometheus custom scraping that uses file-based credentials or TLS files in Kubernetes.", "dse_recommendation": "Check the secret name, namespace, key and mounted path as one reference chain before investigating the remote endpoint.", "primary_source": { "name": "Create custom Prometheus scrape job from your Kubernetes cluster using ConfigMap - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/containers/prometheus-metrics-scrape-configmap", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

The documented Azure Managed Prometheus file-based authentication path uses the ama-metrics-mtls-secret secret in kube-system. Its keys become files under the mandatory /etc/prometheus/certs/ directory in the collector, with values decoded into file contents. File references must match those key-derived names. Microsoft requires creating the secret before the ConfigMap, PodMonitor or ServiceMonitor that references it; the reverse order can produce a missing-certificate-file error. Microsoft Learn.

\n

Applicability

\n

Use this check for the managed collector’s documented credential-file or TLS-file configuration. Identify whether the failing reference belongs to a password, token, CA certificate or client certificate before changing it. Do not assume a file present on an administrator’s machine is available inside the collector.

\n

DSE recommendation

\n

Check the secret name, namespace, key and mounted path as one reference chain before investigating the remote endpoint. Keep secret creation ordered ahead of its consuming configuration in the approved deployment workflow. Review the reference names without printing secret values into troubleshooting logs. If both authentication and TLS files are needed, confirm all required keys are included in the intended secret.

\n

Verification

\n

In a controlled deployment, inspect the configuration references and collector error context, then confirm the target is scraped after the intended files are available. Preserve sanitized names, paths and outcomes rather than credentials. Keep certificate validation enabled in the reviewed design; a file-location problem should not be treated as a reason to discard the intended trust check.

\n

Official references

\n

Microsoft Learn: Custom Prometheus scrape configuration. Source reviewed September 9, 2026.

", "content_text": "Source facts\nThe documented Azure Managed Prometheus file-based authentication path uses the ama-metrics-mtls-secret secret in kube-system. Its keys become files under the mandatory /etc/prometheus/certs/ directory in the collector, with values decoded into file contents. File references must match those key-derived names. Microsoft requires creating the secret before the ConfigMap, PodMonitor or ServiceMonitor that references it; the reverse order can produce a missing-certificate-file error. Microsoft Learn.\nApplicability\nUse this check for the managed collector’s documented credential-file or TLS-file configuration. Identify whether the failing reference belongs to a password, token, CA certificate or client certificate before changing it. Do not assume a file present on an administrator’s machine is available inside the collector.\nDSE recommendation\nCheck the secret name, namespace, key and mounted path as one reference chain before investigating the remote endpoint. Keep secret creation ordered ahead of its consuming configuration in the approved deployment workflow. Review the reference names without printing secret values into troubleshooting logs. If both authentication and TLS files are needed, confirm all required keys are included in the intended secret.\nVerification\nIn a controlled deployment, inspect the configuration references and collector error context, then confirm the target is scraped after the intended files are available. Preserve sanitized names, paths and outcomes rather than credentials. Keep certificate validation enabled in the reviewed design; a file-location problem should not be treated as a reason to discard the intended trust check.\nOfficial references\nMicrosoft Learn: Custom Prometheus scrape configuration. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nThe documented Azure Managed Prometheus file-based authentication path uses the ama-metrics-mtls-secret secret in kube-system. Its keys become files under the mandatory /etc/prometheus/certs/ directory in the collector, with values decoded into file contents. File references must match those key-derived names. Microsoft requires creating the secret before the ConfigMap, PodMonitor or ServiceMonitor that references it; the reverse order can produce a missing-certificate-file error. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/containers/prometheus-metrics-scrape-configmap).\n\n## Applicability\n\nUse this check for the managed collector’s documented credential-file or TLS-file configuration. Identify whether the failing reference belongs to a password, token, CA certificate or client certificate before changing it. Do not assume a file present on an administrator’s machine is available inside the collector.\n\n## DSE recommendation\n\nCheck the secret name, namespace, key and mounted path as one reference chain before investigating the remote endpoint. Keep secret creation ordered ahead of its consuming configuration in the approved deployment workflow. Review the reference names without printing secret values into troubleshooting logs. If both authentication and TLS files are needed, confirm all required keys are included in the intended secret.\n\n## Verification\n\nIn a controlled deployment, inspect the configuration references and collector error context, then confirm the target is scraped after the intended files are available. Preserve sanitized names, paths and outcomes rather than credentials. Keep certificate validation enabled in the reviewed design; a file-location problem should not be treated as a reason to discard the intended trust check.\n\n## Official references\n\n[Microsoft Learn: Custom Prometheus scrape configuration](https://learn.microsoft.com/en-us/azure/azure-monitor/containers/prometheus-metrics-scrape-configmap). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-370-resolve-prometheus-scrape-credential-files-through-the-mounted-secret-not-a-host/", "url": "https://update.dsesecurity.com/updates/dse-20260909-370-resolve-prometheus-scrape-credential-files-through-the-mounted-secret-not-a-host/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-370-resolve-prometheus-scrape-credential-files-through-the-mounted-secret-not-a-host/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Resolve Prometheus scrape credential files through the mounted secret, not a host path", "item": "https://update.dsesecurity.com/updates/dse-20260909-370-resolve-prometheus-scrape-credential-files-through-the-mounted-secret-not-a-host/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-370-resolve-prometheus-scrape-credential-files-through-the-mounted-secret-not-a-host/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-370-resolve-prometheus-scrape-credential-files-through-the-mounted-secret-not-a-host/", "url": "https://update.dsesecurity.com/updates/dse-20260909-370-resolve-prometheus-scrape-credential-files-through-the-mounted-secret-not-a-host/", "headline": "Resolve Prometheus scrape credential files through the mounted secret, not a host path", "description": "What must match when an Azure Managed Prometheus scrape configuration references a credential or certificate file?", "abstract": "What must match when an Azure Managed Prometheus scrape configuration references a credential or certificate file?", "articleBody": "Source facts\nThe documented Azure Managed Prometheus file-based authentication path uses the ama-metrics-mtls-secret secret in kube-system. Its keys become files under the mandatory /etc/prometheus/certs/ directory in the collector, with values decoded into file contents. File references must match those key-derived names. Microsoft requires creating the secret before the ConfigMap, PodMonitor or ServiceMonitor that references it; the reverse order can produce a missing-certificate-file error. Microsoft Learn.\nApplicability\nUse this check for the managed collector’s documented credential-file or TLS-file configuration. Identify whether the failing reference belongs to a password, token, CA certificate or client certificate before changing it. Do not assume a file present on an administrator’s machine is available inside the collector.\nDSE recommendation\nCheck the secret name, namespace, key and mounted path as one reference chain before investigating the remote endpoint. Keep secret creation ordered ahead of its consuming configuration in the approved deployment workflow. Review the reference names without printing secret values into troubleshooting logs. If both authentication and TLS files are needed, confirm all required keys are included in the intended secret.\nVerification\nIn a controlled deployment, inspect the configuration references and collector error context, then confirm the target is scraped after the intended files are available. Preserve sanitized names, paths and outcomes rather than credentials. Keep certificate validation enabled in the reviewed design; a file-location problem should not be treated as a reason to discard the intended trust check.\nOfficial references\nMicrosoft Learn: Custom Prometheus scrape configuration. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:25:46+00:00", "dateModified": "2026-09-10T02:01:56+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-370-resolve-prometheus-scrape-credential-files-through-the-mounted-secret-not-a-host/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-370-resolve-prometheus-scrape-credential-files-through-the-mounted-secret-not-a-host/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Resolve Prometheus scrape credential files through the mounted secret, not a host path" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 245, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Create custom Prometheus scrape job from your Kubernetes cluster using ConfigMap - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/containers/prometheus-metrics-scrape-configmap" } } ] } }