Deploy ActiveGate in Kubernetes/OpenShift as a StatefulSet

yamlcopydownload
apiVersion: v1
kind: Service
metadata:
  name: dynatrace-activegate
  namespace: dynatrace
spec:
  type: ClusterIP
  selector:
    activegate: kubernetes-monitoring-and-routing
  ports:
  - protocol: TCP
    port: 443
    targetPort: ag-https
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: dynatrace-activegate
  namespace: dynatrace
  labels:
    activegate: kubernetes-monitoring-and-routing
spec:
  serviceName: ""
  selector:
    matchLabels:
      activegate: kubernetes-monitoring-and-routing
  template:
    metadata:
      annotations:
        container.apparmor.security.beta.kubernetes.io/activegate: runtime/default
      labels:
        activegate: kubernetes-monitoring-and-routing
    spec:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - amd64
              - key: beta.kubernetes.io/os
                operator: In
                values:
                - linux
            - matchExpressions:
              - key: kubernetes.io/arch
                operator: In
                values:
                - amd64
              - key: kubernetes.io/os
                operator: In
                values:
                - linux
      containers:
      - name: activegate
        image: <YOUR_ENVIRONMENT_URL>/linux/activegate
        imagePullPolicy: Always
        ports:
          - name: ag-https
            containerPort: 9999
        env:
        - name: DT_ID_SEED_NAMESPACE
          value: dynatrace
        - name: DT_ID_SEED_K8S_CLUSTER_ID
          value: <ANY_UNIQUE_ID>
        - name: DT_CAPABILITIES
          value: kubernetes_monitoring,MSGrouter,restInterface
        # - name: DT_NETWORK_ZONE
        #   value: <CUSTOM_NZ>
        - name: DT_DNS_ENTRY_POINT
          value: https://$(DYNATRACE_ACTIVEGATE_SERVICE_HOST):$(DYNATRACE_ACTIVEGATE_SERVICE_PORT)/communication
        volumeMounts:
        - name: truststore-volume
          mountPath: /opt/dynatrace/gateway/jre/lib/security/cacerts
          readOnly: true
          subPath: k8s-local.jks
        - name: ag-lib-gateway-config
          mountPath: /var/lib/dynatrace/gateway/config
        - name: ag-lib-gateway-temp
          mountPath: /var/lib/dynatrace/gateway/temp
        - name: ag-lib-gateway-data
          mountPath: /var/lib/dynatrace/gateway/data
        - name: ag-log-gateway
          mountPath: /var/log/dynatrace/gateway
        - name: ag-tmp-gateway
          mountPath: /var/tmp/dynatrace/gateway
        livenessProbe:
          failureThreshold: 2
          httpGet:
            path: /rest/state
            port: ag-https
            scheme: HTTPS
          initialDelaySeconds: 30
          periodSeconds: 30
          successThreshold: 1
          timeoutSeconds: 1
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /rest/health
            port: ag-https
            scheme: HTTPS
          initialDelaySeconds: 30
          periodSeconds: 15
          successThreshold: 1
          timeoutSeconds: 1
        # resources:
        #   limits:
        #     cpu: "1"
        #     memory: 2G
        #   requests:
        #     cpu: "1"
        #     memory: 2G
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - all
          privileged: false
          readOnlyRootFilesystem: true
          runAsNonRoot: true
          seccompProfile:
            type: RuntimeDefault
      initContainers:
      - name: certificate-loader
        image: <YOUR_ENVIRONMENT_URL>/linux/activegate
        workingDir: /var/lib/dynatrace/gateway
        command: ['/bin/bash']
        args: ['-c', '/opt/dynatrace/gateway/k8scrt2jks.sh']
        volumeMounts:
        - mountPath: /var/lib/dynatrace/gateway/ssl
          name: truststore-volume
      imagePullSecrets:
      - name: dynatrace-docker-registry
      volumes:
      - name: truststore-volume
        emptyDir: {}
      - name: ag-lib-gateway-config
        emptyDir: {}
      - name: ag-lib-gateway-temp
        emptyDir: {}
      - name: ag-lib-gateway-data
        emptyDir: {}
      - name: ag-log-gateway
        emptyDir: {}
      - name: ag-tmp-gateway
        emptyDir: {}
  updateStrategy:
    type: RollingUpdate

yamlcopydownload
apiVersion: v1
kind: ServiceAccount
metadata:
  name: dynatrace-monitoring
  namespace: dynatrace
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: dynatrace-monitoring-cluster
rules:
- apiGroups:
  - ""
  - batch
  - apps
  - apps.openshift.io
  resources:
  - nodes
  - pods
  - namespaces
  - deployments
  - replicasets
  - deploymentconfigs
  - replicationcontrollers
  - jobs
  - cronjobs
  - statefulsets
  - daemonsets
  - events
  - resourcequotas
  - pods/proxy
  verbs:
  - list
  - watch
  - get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: dynatrace-monitoring-cluster
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: dynatrace-monitoring-cluster
subjects:
- kind: ServiceAccount
  name: dynatrace-monitoring
  namespace: dynatrace

For Rancher distributions of Kubernetes, you need to use the bearer token and API URL of the Rancher server, as this server manages and secures traffic to the Kubernetes API server. Follow the steps below.

1. Get the Kubernetes API URL for later use.

shellcopydownload
$ kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}'

2. Configure a user.
   On the Rancher web UI page, either create a new user or use an existing user to be associated with the token. We recommend creating a new user.

3. Set permissions.
   Make sure the user has either Owner or Custom permissions to the cluster you want to monitor. We recommend using the Custom permissions for this type of account.

Note: If you select Custom permissions, make sure to check these two roles: View all Projects and View Nodes.

4. Create an API key.
   Go to API & Keys and create a key either for your specific account (enter your cluster name) or for all clusters (enter No scope). For security reasons, we recommend selecting the first option.

Note: Newly created keys display four fields. Make sure to use the content of the field called Bearer token to set up the connection to the Kubernetes API described in the next section.