# Resolve Prometheus scrape credential files through the mounted secret, not a host path

> What must match when an Azure Managed Prometheus scrape configuration references a credential or certificate file?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-370-resolve-prometheus-scrape-credential-files-through-the-mounted-secret-not-a-host/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:25:46+00:00
- Modified: 2026-09-10T02:01:56+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

What must match when an Azure Managed Prometheus scrape configuration references a credential or certificate file?

## Potentially affected

Azure Managed Prometheus custom scraping that uses file-based credentials or TLS files in Kubernetes.

## DSE recommendation

Check the secret name, namespace, key and mounted path as one reference chain before investigating the remote endpoint.

## Article

## Source facts

The documented Azure Managed Prometheus file-based authentication path uses the ama-metrics-mtls-secret secret in kube-system. Its keys become files under the mandatory /etc/prometheus/certs/ directory in the collector, with values decoded into file contents. File references must match those key-derived names. Microsoft requires creating the secret before the ConfigMap, PodMonitor or ServiceMonitor that references it; the reverse order can produce a missing-certificate-file error. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/containers/prometheus-metrics-scrape-configmap).

## Applicability

Use this check for the managed collector’s documented credential-file or TLS-file configuration. Identify whether the failing reference belongs to a password, token, CA certificate or client certificate before changing it. Do not assume a file present on an administrator’s machine is available inside the collector.

## DSE recommendation

Check the secret name, namespace, key and mounted path as one reference chain before investigating the remote endpoint. Keep secret creation ordered ahead of its consuming configuration in the approved deployment workflow. Review the reference names without printing secret values into troubleshooting logs. If both authentication and TLS files are needed, confirm all required keys are included in the intended secret.

## Verification

In a controlled deployment, inspect the configuration references and collector error context, then confirm the target is scraped after the intended files are available. Preserve sanitized names, paths and outcomes rather than credentials. Keep certificate validation enabled in the reviewed design; a file-location problem should not be treated as a reason to discard the intended trust check.

## Official references

[Microsoft Learn: Custom Prometheus scrape configuration](https://learn.microsoft.com/en-us/azure/azure-monitor/containers/prometheus-metrics-scrape-configmap). Source reviewed September 9, 2026.

## Primary reference

- Name: Create custom Prometheus scrape job from your Kubernetes cluster using ConfigMap - Azure Monitor | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-monitor/containers/prometheus-metrics-scrape-configmap
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Resolve Prometheus scrape credential files through the mounted secret, not a host path,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-370-resolve-prometheus-scrape-credential-files-through-the-mounted-secret-not-a-host/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.