Deploy ActiveGate in Kubernetes/OpenShift as a StatefulSet

Dynatrace Operator manages the lifecycle of several Dynatrace components, including ActiveGate. If you can't use Dynatrace Operator, you can deploy ActiveGate directly as a StatefulSet. See below for instructions.

Prerequisites

• Create a PaaS token

• Create an authentication token

• Get your kube-system namespace UUID

  How to extract the kube-system namespace UUID

  Run the command below and save the UUID from the output for later use.

  kubectloc

  bashcopydownload
  kubectl get namespace kube-system -o jsonpath='{.metadata.uid}'

  bashcopydownload
  oc get namespace kube-system -o jsonpath='{.metadata.uid}'

Deploy ActiveGate

To deploy ActiveGate

1. Create a dedicated namespace (Kubernetes)/project (OpenShift).

Depending on your platform, select one of the options below.

plaintextcopydownload
kubectl create namespace dynatrace

plaintextcopydownload
oc adm new-project --node-selector="" dynatrace

2. Create two secrets:

   • A secret holding the environment URL and login credentials for this registry
   • A secret for the ActiveGate authentication token

   Example commands:

   kubectloc

   plaintextcopydownload
   kubectl -n dynatrace create secret docker-registry dynatrace-docker-registry --docker-server=<YOUR_ENVIRONMENT_URL> --docker-username=<YOUR_ENVIRONMENT_ID> --docker-password=<YOUR_PAAS_TOKEN>

   plaintextcopydownload
   oc -n dynatrace create secret docker-registry dynatrace-docker-registry --docker-server=<YOUR_ENVIRONMENT_URL> --docker-username=<YOUR_ENVIRONMENT_ID> --docker-password=<YOUR_PAAS_TOKEN>

   where you need to replace

   • <YOUR_ENVIRONMENT_URL> with your environment URL (without 'http'). Example: {your-environment}.live.dynatrace.com

   • <YOUR_ENVIRONMENT_ID> with the Docker account username (same as the ID in your environment URL above).

To determine your environment ID, see the syntax below. SaaS: https://{your-environment-id}.live.dynatrace.com
Managed: https://{your-domain}/e/{your-environment-id}

• <YOUR_PAAS_TOKEN> with the PaaS token you created in Prerequisites

1. Create a service account and a cluster role.

   Create a kubernetes-monitoring-service-account.yaml file with the following content.

   kubernetes-monitoring-service-account.yaml

   yamlcopydownload
   apiVersion: v1
   kind: ServiceAccount
   metadata:
     name: dynatrace-activegate
     namespace: dynatrace
   ---
   apiVersion: rbac.authorization.k8s.io/v1
   kind: ClusterRole
   metadata:
     name: dynatrace-activegate
   rules:
   - apiGroups:
     - ""
     - batch
     - apps
     - apps.openshift.io
     resources:
     - nodes
     - nodes/metrics
     - pods
     - namespaces
     - deployments
     - replicasets
     - deploymentconfigs
     - replicationcontrollers
     - jobs
     - cronjobs
     - statefulsets
     - daemonsets
     - events
     - resourcequotas
     - pods/proxy
     - services
     verbs:
     - list
     - watch
     - get
   ---
   apiVersion: rbac.authorization.k8s.io/v1
   kind: ClusterRoleBinding
   metadata:
     name: dynatrace-activegate
   roleRef:
     apiGroup: rbac.authorization.k8s.io
     kind: ClusterRole
     name: dynatrace-activegate
   subjects:
   - kind: ServiceAccount
     name: dynatrace-activegate
     namespace: dynatrace

2. Apply the file.

   kubectloc

   bashcopydownload
   kubectl apply -f kubernetes-monitoring-service-account.yaml

   bashcopydownload
   oc apply -f kubernetes-monitoring-service-account.yaml

3. Create a file named ag-monitoring-and-routing.yaml with the following content, making sure to replace

   • <YOUR_ENVIRONMENT_URL> with your value as described above.
   • <YOUR_KUBE-SYSTEM_NAMESPACE_UUID> with the Kubernetes namespace UUID obtained in Prerequisites.

yamlcopydownload
apiVersion: v1
kind: Service
metadata:
  name: dynatrace-activegate
  namespace: dynatrace
spec:
  type: ClusterIP
  selector:
    activegate: kubernetes-monitoring-and-routing
  ports:
  - protocol: TCP
    port: 443
    targetPort: ag-https
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: dynatrace-activegate
  namespace: dynatrace
  labels:
    activegate: kubernetes-monitoring-and-routing
spec:
  serviceName: ""
  selector:
    matchLabels:
      activegate: kubernetes-monitoring-and-routing
  template:
    metadata:
#     Uncomment the lines below to enable AppArmor
#     annotations:
#  container.apparmor.security.beta.kubernetes.io/activegate: runtime/default
      labels:
        activegate: kubernetes-monitoring-and-routing
    spec:
      serviceAccountName: dynatrace-activegate
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: kubernetes.io/arch
                operator: In
                values:
                - amd64
              - key: kubernetes.io/os
                operator: In
                values:
                - linux
      containers:
      - name: activegate
        image: <YOUR_ENVIRONMENT_URL>/linux/activegate
        imagePullPolicy: Always
        ports:
          - name: ag-https
            containerPort: 9999
        env:
        - name: DT_ID_SEED_NAMESPACE
          value: dynatrace
        - name: DT_ID_SEED_K8S_CLUSTER_ID
          value: <YOUR_KUBE-SYSTEM_NAMESPACE_UUID>
        - name: DT_CAPABILITIES
          value: kubernetes_monitoring,MSGrouter,restInterface
        # - name: DT_NETWORK_ZONE
        #   value: <CUSTOM_NZ>
        - name: DT_DNS_ENTRY_POINT
          value: https://$(DYNATRACE_ACTIVEGATE_SERVICE_HOST):$(DYNATRACE_ACTIVEGATE_SERVICE_PORT)/communication
        volumeMounts:
        - name: dynatrace-tokens
          mountPath: /var/lib/dynatrace/secrets/tokens
        - name: truststore-volume
          mountPath: /opt/dynatrace/gateway/jre/lib/security/cacerts
          readOnly: true
          subPath: k8s-local.jks
        - name: ag-lib-gateway-config
          mountPath: /var/lib/dynatrace/gateway/config
        - name: ag-lib-gateway-temp
          mountPath: /var/lib/dynatrace/gateway/temp
        - name: ag-lib-gateway-data
          mountPath: /var/lib/dynatrace/gateway/data
        - name: ag-log-gateway
          mountPath: /var/log/dynatrace/gateway
        - name: ag-tmp-gateway
          mountPath: /var/tmp/dynatrace/gateway
        livenessProbe:
          failureThreshold: 2
          httpGet:
            path: /rest/state
            port: ag-https
            scheme: HTTPS
          initialDelaySeconds: 30
          periodSeconds: 30
          successThreshold: 1
          timeoutSeconds: 1
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /rest/health
            port: ag-https
            scheme: HTTPS
          initialDelaySeconds: 30
          periodSeconds: 15
          successThreshold: 1
          timeoutSeconds: 1
        resources:
          requests:
            cpu: 250m
            memory: 512Mi
          limits:
            cpu: 250m
            memory: 512Mi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - all
          privileged: false
          readOnlyRootFilesystem: true
          runAsNonRoot: true
          seccompProfile:
            type: RuntimeDefault
      initContainers:
      - name: certificate-loader
        image: YOUR_ENVIRONMENT_URL>/linux/activegate
        workingDir: /var/lib/dynatrace/gateway
        command: ['/bin/bash']
        args: ['-c', '/opt/dynatrace/gateway/k8scrt2jks.sh']
        volumeMounts:
        - mountPath: /var/lib/dynatrace/gateway/ssl
          name: truststore-volume
      imagePullSecrets:
      - name: dynatrace-docker-registry
      volumes:
      - name: dynatrace-tokens
        secret:
          secretName: dynatrace-tokens
      - name: truststore-volume
        emptyDir: {}
      - name: ag-lib-gateway-config
        emptyDir: {}
      - name: ag-lib-gateway-temp
        emptyDir: {}
      - name: ag-lib-gateway-data
        emptyDir: {}
      - name: ag-log-gateway
        emptyDir: {}
      - name: ag-tmp-gateway
        emptyDir: {}
  updateStrategy:
    type: RollingUpdate

6. Deploy ActiveGate.

   kubectloc

   bashcopydownload
   kubectl apply -f ag-monitoring-and-routing.yaml

   bashcopydownload
   oc apply -f ag-monitoring-and-routing.yaml

Connect your Kubernetes clusters to Dynatrace

To get native Kubernetes metrics, you need to connect your clusters to Dynatrace.

To connect your clusters and enable monitoring, you have two options:

• Connect the containerized ActiveGate to a local Kubernetes API endpoint
• Connect the containerized ActiveGate to the public Kubernetes API URL

See below for instructions for both options.

Connect to a local Kubernetes API endpoint

ActiveGate version 1.229+

You can enable monitoring by connecting a containerized ActiveGate to a local Kubernetes API endpoint. For this, you only need to provide the unique Kubernetes cluster ID (the UUID of the kube-system namespace) in the Dynatrace web UI. The containerized ActiveGate then identifies the unique cluster ID and sends it over to Dynatrace.

To connect to a local Kubernetes API endpoint

1. In the Dynatrace menu, go to Kubernetes.

2. Select Connect manually.

3. On the Kubernetes cluster monitoring settings page, provide a Name, and then turn on Connect containerized ActiveGate to local Kubernetes API endpoint.

4. For Kubernetes cluster ID, enter the kube-system namespace UUID obtained in Prerequisites.

5. Select Save changes to save your configuration.

   You can save your configuration even if the ActiveGate isn't ready to connect, and finish the configuration later. To verify if it's ready, select Test configuration.

Change monitoring settings

You can change monitoring settings at any time from your Kubernetes cluster details page.

1. In the Dynatrace menu, go to Kubernetes.
2. Find your Kubernetes cluster, and then select Actions > Settings.
3. Adjust your settings, and then select Save changes.

Delete configuration

To delete the connection to a local Kubernetes API endpoint

1. In the Dynatrace menu, go to Kubernetes.
2. Find your Kubernetes cluster, and then select Actions > Settings.
3. Select Use defaults, and then select Save changes.

Connect to the public Kubernetes API

To connect to the public Kubernetes API, follow the instructions that apply to your Kubernetes version:

• Kubernetes version 1.24+
• Kubernetes version earlier than 1.24

Kubernetes version 1.24+

1. Get the Kubernetes API URL.

   kubectloc

   bashcopydownload
   kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}'

   bashcopydownload
   oc config view --minify -o jsonpath='{.clusters[0].cluster.server}'

   If you set enableIstio to true in the DynaKube custom resource, use the command below to get the Kubernetes API URL:

   kubectloc

   bashcopydownload
   kubectl -n default get svc/kubernetes -o jsonpath='https://{.spec.clusterIP}'

   bashcopydownload
   oc -n default get svc/kubernetes -o jsonpath='https://{.spec.clusterIP}'

2. Create a token secret named token-secret.yaml in the namespace where ActiveGate is running, with the following content:

   yamlcopydownload
   apiVersion: v1
   kind: Secret
   metadata:
     name: dynatrace-activegate
     annotations:
       kubernetes.io/service-account.name: "dynatrace-activegate"
   type: kubernetes.io/service-account-token

3. Apply the file to create the dynatrace-kubernetes-monitoring secret.

   kubectlocp

   bashcopydownload
   kubectl apply -n dynatrace -f token-secret.yaml

   bashcopydownload
   oc apply -n dynatrace -f token-secret.yaml

4. Get the bearer token.

   kubectlocp

   bashcopydownload
   kubectl get secret dynatrace-activegate -o jsonpath='{.data.token}' -n dynatrace | base64 --decode

   bashcopydownload
   oc get secret dynatrace-activegate -o jsonpath='{.data.token}' -n dynatrace | base64 --decode

5. In the Dynatrace menu, go to Kubernetes and select Connect manually.

6. On the Kubernetes cluster monitoring settings page, provide a Name, the Kubernetes API URL, and the Bearer token for the Kubernetes cluster.

7. Select Save changes.

Kubernetes version earlier than 1.24

1. Get the Kubernetes API URL.

   kubectloc

   bashcopydownload
   kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}'

   bashcopydownload
   oc config view --minify -o jsonpath='{.clusters[0].cluster.server}'

2. Get the bearer token.

   KubernetesOpenShift v3.xOpenShift v4.x

   bashcopydownload
   kubectl get secret $(kubectl get sa dynatrace-activegate -o jsonpath='{.secrets[0].name}' -n dynatrace) -o jsonpath='{.data.token}' -n dynatrace | base64 --decode

   bashcopydownload
   oc get secret $(oc get sa dynatrace-activegate -o jsonpath='{.secrets[0].name}' -n dynatrace) -o jsonpath='{.data.token}' -n dynatrace | base64 --decode

   bashcopydownload
   oc get secret $(oc get sa dynatrace-activegate -o jsonpath='{.secrets[1].name}' -n dynatrace) -o jsonpath='{.data.token}' -n dynatrace | base64 --decode

3. In the Dynatrace menu, go to Kubernetes and select Connect manually.

4. Provide a Name, Kubernetes API URL target, and the Bearer token for the Kubernetes cluster.

   For Rancher distributions, you need the bearer token that was created in Rancher web UI, as described in Special instructions for Rancher distributions above.

5. Select Save changes.

Once you connect your Kubernetes clusters to Dynatrace, you can get native Kubernetes metrics, like request limits, and differences in pods requested vs. running pods.

ActiveGate update behavior

ActiveGate is updated automatically on pod restart whenever there's a new version available, unless the image already specifies a certain version (for example, 1.273.1).