<p>Here is the helm chart values for <code>stable/prometheus</code>: <a href="https://github.com/helm/charts/blob/master/stable/prometheus/values.yaml" rel="nofollow noreferrer">https://github.com/helm/charts/blob/master/stable/prometheus/values.yaml</a></p>

<p>I was able to get this to work:</p>

<pre><code>helm upgrade --install prometheus stable/prometheus \
--set extraScrapeConfigs="- job_name: 'myjob'
  scrape_interval: 1s
  metrics_path: /metrics
  scheme: https
  static_configs:
    - targets: ['###.##.###.###:#####']
  tls_config:
    ca_file: /prometheus/ca.pem
    key_file: /prometheus/key.pem
    cert_file: /prometheus/cert.pem
    insecure_skip_verify: true"
</code></pre>

<p>In order to do this I had to do:</p>

<pre><code>kubectl cp localdir/ca.pem prometheus-server-abc:/prometheus -c prometheus-server
kubectl cp localdir/key.pem prometheus-server-abc:/prometheus -c prometheus-server
kubectl cp localdir/cert.pem prometheus-server-abc:/prometheus -c prometheus-server
</code></pre>

<p>I believe there's a better and more proper way to do this with <code>Secret</code> and <code>mountPath</code>. I tried something like the following with no luck:</p>

<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: mysecret
data:
  ca.pem: base64encodedcapem
  key.pem: base64encodedkeypem
  cert.pem: base64encodedcertpem
</code></pre>

<pre><code>kubectl apply -f mysecret
</code></pre>

<pre><code>helm upgrade --install prometheus stable/prometheus \
--set extraSecretMounts="- name: mysecret-mount
  mountPath: /somepathinpod/mysecret
  secretName: mysecret" \
--set extraScrapeConfigs="- job_name: 'myjob'
  scrape_interval: 1s
  metrics_path: /metrics
  scheme: https
  static_configs:
    - targets: ['###.##.###.###:#####']
  tls_config:
    ca_file: /somepathinpod/mysecret/ca.pem
    key_file: /somepathinpod/mysecret/key.pem
    cert_file: /somepathinpod/mysecret/cert.pem
    insecure_skip_verify: true"
</code></pre>

<p>I expected the certs to magically show up at <code>/somepathinpod</code> but they did not.</p>

<p>I'm assuming I don't have to clone the whole repo and manually edit the helm chart to put a <code>volumeMount</code> into the <code>prometheus-server</code> deployment/pod and can just change my helm command somehow. Any advice on how to get my certs in there?</p>

atkayla
<p>According to the <a href="https://github.com/helm/charts/tree/master/stable/prometheus" rel="nofollow noreferrer">documentation</a>, the correct key to use would be <code>server.extraSecretMounts</code> instead of just <code>extraSecretMounts</code>.</p>

<p>Also verify the generated YAML on Kubernetes to contain the correct mounts via:</p>

<pre><code>kubectl get deployment prometheus-server-object-name -o yaml
</code></pre>

<p><strong>override.yaml</strong></p>

<pre><code>server:
  extraSecretMounts:
    - name: mysecret-mount
      mountPath: /etc/config/mysecret
      secretName: mysecret

extraScrapeConfigs: |
  - job_name: myjob
    scrape_interval: 15s
    metrics_path: /metrics
    scheme: https
    static_configs:
      - targets:
          - ###.##.###.###:#####
    tls_config:
      ca_file: /etc/config/mysecret/ca.pem
      key_file: /etc/config/mysecret/key.pem
      cert_file: /etc/config/mysecret/cert.pem
      insecure_skip_verify: true
</code></pre>

<pre><code>helm upgrade -f override.yaml prometheus stable/prometheus
</code></pre>
