Configure Istio for OneAgent traffic in Kubernetes

Istio is a service mesh that helps in managing distributed microservices architectures. Istio uses the sidecar pattern to deploy a proxy to pods which then intercept network traffic between your microservices. Egress traffic of Istio-enabled pods is redirected to the sidecar proxy within each pod, and accessibility of endpoints outside of the cluster depends on the configuration of the proxy. This includes the communication of Dynatrace OneAgent code modules. If the OneAgent code-modules' communication to the Dynatrace environment is blocked, the Dynatrace communication endpoints need to be explicitly added to the mesh or the proxy needs to be configured to pass through all requests.

This topic describes how to manually configure Istio for enabling egress traffic to your Dynatrace environment if you aren't using OneAgent Operator version 0.4 or higher.

OneAgent Operator version 0.4+ automatically manages Istio service entries and virtual services for your Dynatrace environment when enableIstio is set to true in the custom resource. The Dynatrace OneAgent code modules can then send monitoring information to your Dynatrace environment.

Prepare Dynatrace tokens

Get a Platform-as-a-Service token to query the list of communication endpoints for the OneAgent. This token is later referenced as {token}.

Configure a ServiceEntry object

Get the list of available communication endpoints for your environment.

For this you need to make a GET call to the REST endpoint of your Dynatrace environment. Don't forget to adapt the respective placeholders {environmentID} and {token}.


In return, you get a JSON object that covers the communicationEndpoints. The list of endpoints may look like this.

   "communicationEndpoints": [

Save the following snippet with the service entries to a file istio-oneagent-serviceentries.yaml and adapt the content to suit your communication endpoints from your JSON response above. The snippet below covers multiple ServiceEntry and VirtualService definitions.

  • Endpoints with a hostname that run on the same port (e.g. 9999 or 443) can be grouped in an HTTPS ServiceEntry and VirtualService combination.
  • Each endpoint with an IP address should be handled in its own TCP ServiceEntry.

Create the ServiceEntry and VirtualService objects

Create the ServiceEntry and VirtualService configuration from the saved file. We recommend to create the ServiceEntry and VirtualService resources in a dynatrace namespace.

kubectl -n dynatrace create -f istio-oneagent-serviceentries.yaml

Remove the ServiceEntry and VirtualService objects

In case you uninstalled the OneAgent you'll also need to remove the ServiceEntry configurations.

kubectl -n dynatrace delete -f istio-oneagent-serviceentries.yaml