<p>I have set up a v1.13 Kubernetes cluster using Kube spray.
Our etcd is running as docker containers outside the K8s cluster. If I check the etcd certificates, I can see each etcd has its own ca, client cert and key.</p>

<p>If I want to scrape the /metrics endpoints of these etcd conatiners for Prometheus, which certificates to use for the HTTPS endpoints?</p>

swetad90
<p>I am not yet sure, if this is the most secured way or not.
But I took the ca.pem, cert and key that one of the etcd uses.</p>
<p>I created a Kubernetes secret object out of the three:</p>
<pre><code>kubectl create secret generic etcd-metrics -n monitoring --from-file=etcd-secrets/
</code></pre>
<p>Then I added the secrets as configmaps in Prometheus config and below as my scrape</p>
<pre><code>targets:
- job_name: etcd
  scrape_interval: 15s
  scrape_timeout: 10s
  metrics_path: /metrics
  scheme: https
  static_configs:
 - targets:
   - 172.xxxxx:2379
   - 172.xxxxx:2379
   - 172.xxxxx:2379
 tls_config:
  ca_file: /etc/ssl/etcd/ca.pem
  cert_file: /etc/ssl/etcd/etcd-node.pem
  key_file: /etc/ssl/etcd/etcd-key.pem
  insecure_skip_verify: false
</code></pre>
