> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connecting To Prometheus

> Guide for accessing and exposing a Prometheus server in Kubernetes, covering service inspection, port-forward, NodePort, LoadBalancer, Ingress, and security best practices.

This guide explains how to access the Prometheus server running inside your Kubernetes cluster, including quick diagnostic commands and common access methods (temporary and production-ready). Follow the sequence below to inspect the service, confirm its configuration, and choose an access strategy.

## Inspect the Prometheus services

Start by listing services in the cluster to find the Prometheus-related services and their types:

```bash theme={null}
kubectl get service
NAME                                         TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)                        AGE
alertmanager-operated                        ClusterIP   None             <none>        9093/TCP,9094/TCP,9094/UDP     11h
kubernetes                                   ClusterIP   10.100.0.1       <none>        443/TCP                        4d5h
prometheus-grafana                           ClusterIP   10.100.235.247   <none>        80/TCP                         11h
prometheus-kube-prometheus-alertmanager      ClusterIP   10.100.53.114    <none>        9093/TCP                       11h
prometheus-kube-prometheus-operator          ClusterIP   10.100.196.32    <none>        443/TCP                        11h
prometheus-kube-prometheus-prometheus        ClusterIP   10.100.54.169    <none>        9090/TCP                       11h
prometheus-kube-state-metrics                ClusterIP   10.100.133.149   <none>        8080/TCP                       11h
prometheus-operated                          ClusterIP   10.100.248.61    <none>        9100/TCP                       11h
prometheus-prometheus-node-exporter          ClusterIP   10.100.249.161   <none>        9100/TCP                       11h
```

Note the `TYPE` column — in this example the Prometheus server is exposed via a `ClusterIP` service (`prometheus-kube-prometheus-prometheus`), which by default is accessible only from within the cluster.

<Callout icon="lightbulb" color="#1CB2FE">
  If you are running commands in a specific namespace other than `default`, add `-n <namespace>` to the `kubectl` commands above. For example: `kubectl get service -n monitoring`.
</Callout>

## Inspect the service YAML

Export the service YAML to confirm its configured ports, selectors, and `type`:

```bash theme={null}
kubectl get service prometheus-kube-prometheus-prometheus -o yaml > service.yaml
```

Example excerpt showing the key sections:

```yaml theme={null}
apiVersion: v1
kind: Service
metadata:
  annotations:
    meta.helm.sh/release-name: prometheus
    meta.helm.sh/release-namespace: default
  labels:
    app: kube-prometheus-stack-prometheus
    app.kubernetes.io/instance: prometheus
spec:
  clusterIP: 10.100.54.169
  ports:
    - name: http-web
      port: 9090
      protocol: TCP
      targetPort: 9090
  selector:
    app.kubernetes.io/name: prometheus
    prometheus: prometheus-kube-prometheus-prometheus
  type: ClusterIP
```

The `type: ClusterIP` confirms the service is internal-only.

## How to connect to Prometheus (options)

Choose one of the following access methods depending on your needs. Summary below:

| Method                   | When to use                             | Pros                               | Cons                                              | Example command(s)                                                                                                        |
| ------------------------ | --------------------------------------- | ---------------------------------- | ------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- |
| Port-forward (temporary) | Quick local access for debugging/demos  | Fast, no cluster config changes    | Not suitable for production; single-user          | `kubectl port-forward <pod-name> 9090:9090` or `kubectl port-forward svc/prometheus-kube-prometheus-prometheus 9090:9090` |
| NodePort                 | Quick cluster-wide access from node IPs | Simple, exposes on node port       | Requires opening node port; not cloud LB-managed  | `kubectl edit svc prometheus-kube-prometheus-prometheus` → set `type: NodePort`                                           |
| LoadBalancer             | Production-ready in cloud environments  | Cloud LB + external IP             | Depends on cloud provider; may incur cost         | `kubectl edit svc prometheus-kube-prometheus-prometheus` → set `type: LoadBalancer`                                       |
| Ingress                  | Route via domain/host with TLS          | Clean host-based routing and certs | Requires Ingress controller and additional config | Create Ingress resource that targets the service                                                                          |

Links and references:

* Kubernetes Service types: [https://kubernetes.io/docs/concepts/services-networking/service/](https://kubernetes.io/docs/concepts/services-networking/service/)
* kubectl port-forward: [https://kubernetes.io/docs/tasks/access-application-cluster/port-forward-access-application-cluster/](https://kubernetes.io/docs/tasks/access-application-cluster/port-forward-access-application-cluster/)

<Callout icon="warning" color="#FF6B6B">
  Exposing Prometheus directly to the Internet can reveal sensitive metric data. When enabling external access, use authentication, TLS, and network restrictions (Ingress with auth, or firewall rules).
</Callout>

## Quick demo — Port-forward to verify the UI

For a short demo or verification you can port-forward the service (or a pod) to your localhost. This does not change the cluster configuration and is temporary.

1. List pods to find the Prometheus pod name (or use the service name for `kubectl port-forward svc/...`):

```bash theme={null}
kubectl get pods -l app.kubernetes.io/name=prometheus
```

2. Port-forward the Prometheus pod (or service) to localhost 9090:

```bash theme={null}
# Using a pod (replace <prom-pod> with the actual pod name)
kubectl port-forward <prom-pod> 9090:9090

# Or directly from the service
kubectl port-forward svc/prometheus-kube-prometheus-prometheus 9090:9090
```

3. Open your browser at: [http://localhost:9090](http://localhost:9090)

You should see the Prometheus web UI where you can run queries and explore time series data.

<Frame>
  <img src="https://mintcdn.com/kodekloud-c4ac6d9a/g3ob3hoM5yRC7KZS/images/Prep-Course-Prometheus-Certified-Associate-PCA-Certification/Monitoring-Kubernetes/Connecting-To-Prometheus/prometheus-web-interface-query-time-series.jpg?fit=max&auto=format&n=g3ob3hoM5yRC7KZS&q=85&s=540db5549b1f95ac772e7bef1cb57cd5" alt="The image shows a Prometheus web interface for querying time series data, with options for enabling features like autocomplete and highlighting. It includes fields for expressions and no data has been queried yet." width="1920" height="1080" data-path="images/Prep-Course-Prometheus-Certified-Associate-PCA-Certification/Monitoring-Kubernetes/Connecting-To-Prometheus/prometheus-web-interface-query-time-series.jpg" />
</Frame>

This local port-forward is ideal for quick checks and demos. For persistent or multi-user access, choose NodePort, LoadBalancer, or an Ingress-based approach and secure it appropriately.

## Example: change service type to NodePort (quick patch)

If you decide to expose Prometheus via NodePort briefly, you can patch the service:

```bash theme={null}
kubectl patch svc prometheus-kube-prometheus-prometheus -p '{"spec": {"type": "NodePort"}}'
```

After patching, run `kubectl get svc prometheus-kube-prometheus-prometheus -o wide` to see the assigned `NODE-PORT`. Then you can access Prometheus at `http://<node-ip>:<node-port>` (ensure firewall / security groups allow the port).

For production setups, prefer Ingress with TLS and authentication, or use a cloud LoadBalancer combined with proper access controls.

<CardGroup>
  <Card title="Watch Video" icon="video" cta="Learn more" href="https://learn.kodekloud.com/user/courses/prometheus-certified-associate-pca/module/bb958f66-38c3-41ed-ae2f-7a4ee96c4d66/lesson/b88c394c-edce-4eb5-8fc4-c65759ecbf20" />
</CardGroup>