Hello,
there is also a documentation from Istio how to mount the sidecar certificates in the Prometheus pod: Istio / Prometheus.
In my case, configuring the tlsConfig in the ServiceMonitor workes:
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
name: app-prometheus
namespace: monitoring
labels:
release: prometheus-stack
spec:
selector:
matchLabels:
app: app
namespaceSelector:
matchNames:
- default
endpoints:
- port: 'http'
path: '/metrics'
interval: 10s
basicAuth:
password:
name: app-metrics-credentials
key: password
username:
name: app-metrics-credentials
key: username
scheme: https
tlsConfig:
caFile: /etc/prom-certs/root-cert.pem
certFile: /etc/prom-certs/cert-chain.pem
keyFile: /etc/prom-certs/key.pem
insecureSkipVerify: true # Prometheus does not support Istio security naming, thus skip verifying target pod ceritifcate