<p>I have installed Prometheus-adapter along with the default metrics-server that comes with k3s securely on port 443.</p>
<p>Unfortunately, I get no resources when I query custom.metrics.k8s.io</p>
<pre><code>$  kubectl get --raw &quot;/apis/custom.metrics.k8s.io/v1beta1&quot; | jq .
{
  &quot;kind&quot;: &quot;APIResourceList&quot;,
  &quot;apiVersion&quot;: &quot;v1&quot;,
  &quot;groupVersion&quot;: &quot;custom.metrics.k8s.io/v1beta1&quot;,
  &quot;resources&quot;: []
}
</code></pre>
<p>When I look at the logs of Prometheus-adapter I get <code>unable to update list of all metrics: unable to fetch metrics for query ...: x509: certificate is valid for localhost, localhost, not metrics-server.kube-system</code></p>
<p>How can I resolve this issue?</p>

<p>To solve this issue, I had to create <a href="https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster/" rel="nofollow noreferrer">separate certificate</a> for both metrics-server and adapter. Adapter also has an <a href="https://github.com/kubernetes-sigs/prometheus-adapter/issues/169" rel="nofollow noreferrer">issue</a> about adding capability to ignore cert validation which wasn't merged.</p>
<p>For metrics-server and cert request I used the following:</p>
<pre><code>{
  &quot;hosts&quot;: [
    &quot;prometheus-adapter&quot;,
    &quot;prometheus-adapter.monitoring&quot;,
    &quot;prometheus-adapter.monitoring.svc&quot;,
    &quot;prometheus-adapter.monitoring.pod&quot;,
    &quot;prometheus-adapter.monitoring.svc.cluster.local&quot;,
    &quot;prometheus-adapter.monitoring.pod.cluster.local&quot;,
    &quot;&lt;pod ip&gt;&quot;,
    &quot;&lt;service ip&gt;&quot;
  ],
  &quot;CN&quot;: &quot;prometheus-adapter.monitoring.pod.cluster.local&quot;,
  &quot;key&quot;: {
    &quot;algo&quot;: &quot;ecdsa&quot;,
    &quot;size&quot;: 256
  },
}

</code></pre>
<pre><code>{
  &quot;hosts&quot;: [
    &quot;metrics-server&quot;,
    &quot;metrics-server.kube-system&quot;,
    &quot;metrics-server.kube-system.svc&quot;,
    &quot;metrics-server.kube-system.pod&quot;,
    &quot;metrics-server.kube-system.svc.cluster.local&quot;,
    &quot;metrics-server.kube-system.pod.cluster.local&quot;,
    &quot;&lt;service ip&gt;&quot;,
    &quot;&lt;pod ip&gt;&quot;
  ],
  &quot;CN&quot;: &quot;metrics-server.kube-system&quot;,
  &quot;key&quot;: {
    &quot;algo&quot;: &quot;ecdsa&quot;,
    &quot;size&quot;: 256
  },
}

</code></pre>
<p>For ca, you can create your certificate authority or use Kubernetes signers as indicated <a href="https://kubernetes.io/docs/reference/access-authn-authz/certificate-signing-requests/#kubernetes-signers" rel="nofollow noreferrer">here</a>
The only point worth noting here is that if you use either of signers, you should mount the ca bundle yourself to your deployments.</p>
<p>Finally, mount tls keys and ca bundle to your deployment.</p>
<pre><code>  extraArguments:
    - --tls-cert-file=/var/run/serving-cert/tls.crt
    - --tls-private-key-file=/var/run/serving-cert/tls.key
    - --client-ca-file=/etc/ssl/certs/ca.crt
</code></pre>
