Resolve Prometheus scrape credential files through the mounted secret, not a host path

Source facts

The documented Azure Managed Prometheus file-based authentication path uses the ama-metrics-mtls-secret secret in kube-system. Its keys become files under the mandatory /etc/prometheus/certs/ directory in the collector, with values decoded into file contents. File references must match those key-derived names. Microsoft requires creating the secret before the ConfigMap, PodMonitor or ServiceMonitor that references it; the reverse order can produce a missing-certificate-file error. Microsoft Learn.

Applicability

Use this check for the managed collector’s documented credential-file or TLS-file configuration. Identify whether the failing reference belongs to a password, token, CA certificate or client certificate before changing it. Do not assume a file present on an administrator’s machine is available inside the collector.

DSE recommendation

Check the secret name, namespace, key and mounted path as one reference chain before investigating the remote endpoint. Keep secret creation ordered ahead of its consuming configuration in the approved deployment workflow. Review the reference names without printing secret values into troubleshooting logs. If both authentication and TLS files are needed, confirm all required keys are included in the intended secret.

Verification

In a controlled deployment, inspect the configuration references and collector error context, then confirm the target is scraped after the intended files are available. Preserve sanitized names, paths and outcomes rather than credentials. Keep certificate validation enabled in the reviewed design; a file-location problem should not be treated as a reason to discard the intended trust check.

Official references

Microsoft Learn: Custom Prometheus scrape configuration. Source reviewed September 9, 2026.