How do I monitor Kubernetes applications?

Based on Docker, Kubernetes is a next generation platform for deploying and running containerized applications at scale.

To monitor applications running on managed Kubernetes environments, integrate Dynatrace OneAgent into application containers, as described below.

Before you begin

If have access to your Kubernetes cluster, please see the instructions at How do I deploy Dynatrace OneAgent on Kubernetes?

What you'll need:

  • Dynatrace environment credentials

Also, be sure to review the list of supported applications and versions.


If you don't have access to your Kubernetes cluster's underlying hosts, Dynatrace still enables you to selectively monitor the components of your applications—and the relationships between those components—by integrating OneAgent directly into each containerized application process.

Generate PaaS token

The first step is to get your environment ID and generate a PaaS token for your Dynatrace environment.

  1. Login with your Dynatrace account.

  2. Select Deploy Dynatrace from the navigation menu.

  3. Click the Set up PaaS integration button.

  4. Your environment ID appears in the Environment ID text box. You'll need this ID to link your Dynatrace account with your PaaS environment. Click Copy to copy the ID to the clipboard. You can do this at any time by revisiting this page.

  5. To generate a PaaS token, click the Generate new token button. The PaaS token is essentially an API token that's used in combination with your environment ID to download Dynatrace OneAgent. As you'll see, there's also a default InstallerDownload token available that you can alternatively use. However, for security reasons, it's recommended that you create several discrete tokens for each environment you have.

  6. Type in a meaningful name for your PaaS token. A meaningful token name might be the name of the PaaS platform you want to monitor (for example, azure, cloud-foundry, or openshift). To view and manage your existing PaaS tokens, go to Settings -> Integration -> Platform as a Service.

  7. Click Generate to create the PaaS token. The newly created PaaS token will appear in the list below. Click Copy to copy the generated token to the clipboard. You can do this at any time by revisiting this page and clicking Show token next to the relevant PaaS token.

Integrate OneAgent into Kubernetes application containers

The following steps explain how to integrate OneAgent into a binary build with a Dockerfile.

Before you begin, ensure that your application start command uses CMD in exec form:

CMD [ "executable", "param1", "param2" ]

First, define variables with optional default values using ARG instructions.

Replace <environmentID> with your Dynatrace environment ID. If you’re using Dynatrace Managed, you need to provide your Dynatrace Server URL (https://<YourDynatraceServerURL>/e/<environmentID>/api).

Replace <token> with the PaaS token mentioned above.

Technology support is enabled via include parameters. Valid options for flavor=default are all, java, apache, nginx, nodejs, dotnet and php. Including specific technology-support options, rather than support for all technology options, results in a smaller OneAgent package.

To integrate OneAgent and activate instrumentation of your application, add the following commands to your current Dockerfile.

ARG DT_API_URL="https://<environmentID>"
ARG DT_API_TOKEN="<token>"
ARG DT_ONEAGENT_OPTIONS="flavor=default&include=<technology1>&include=<technology2>"
ENV DT_HOME="/opt/dynatrace/oneagent"
RUN mkdir -p "$DT_HOME" && \
    wget -O "$DT_HOME/" "$DT_API_URL/v1/deployment/installer/agent/unix/paas/latest?Api-Token=$DT_API_TOKEN&$DT_ONEAGENT_OPTIONS" && \
    unzip -d "$DT_HOME" "$DT_HOME/" && \
    rm "$DT_HOME/"
ENTRYPOINT [ "/bin/sh", "-c", "/opt/dynatrace/oneagent/" ]

Note: Please extend the ENTRYPOINT command above with your application arguments as needed, for example:

ENTRYPOINT [ "/bin/sh", "-c", "/opt/dynatrace/oneagent/ java -cp /app HelloWorld.Main" ]

Note: The commands above that use wget and unzip may fail if they aren't provided by the base image.

Note: For OneAgent v1.139 you can also use an optimized ENTRYPOINT command:

ENTRYPOINT [ "/opt/dynatrace/oneagent/" ]

Build your application image

Build the Docker image from your Dockerfile to use it in your Kubernetes environment:

$ docker build -t yourapp .

Monitor your application image in different Dynatrace environments

If you move your application from development to staging or production stages, you'll likely want to continue monitoring an application container after it moves to a new Dynatrace environment.

Beginning with OneAgent v1.139, you can change the Dynatrace environment for the monitoring of your Kubernetes applications without rebuilding your application image. This is done by supplying your Dynatrace environment ID via DT_TENANT and the tenant token via DT_TENANTTOKEN with your application image run command.

You can retrieve DT_TENANTTOKEN from the following REST endpoint. In return, you get a JSON object that includes the TENANT_TOKEN.


Be sure to replace <environmentID> and <token> with the proper values mentioned above. If you’re using Dynatrace Managed, you need to provide your Dynatrace Server URL (https://<YourDynatraceServerURL>/e/<environmentID>/api/v1/deployment/installer/agent/connectioninfo?Api-Token=<token>).

Update OneAgent for Kubernetes

Each time a new version of Dynatrace OneAgent becomes available, you must rebuild your applications’ Docker image. Following restart, your Kubernetes applications will be monitored with the latest version of OneAgent.

If you've specified a default OneAgent install version for new hosts and applications using OneAgent updates settings, your Kubernetes applications will be automatically monitored by the defined default version of Dynatrace OneAgent.