Dynatrace component permissions for Kubernetes/OpenShift

Kubernetes observability relies on components with different purposes, default configurations, and permissions.

Dynatrace Operator

Purpose: Maintains the lifecycle of Dynatrace components. Replaces OneAgent Operator.

Default configuration: 1-replica-per-cluster

Cluster-wide permissions: The following table shows the permissions needed for Dynatrace Operator.

Resources accessed	APIs used	Resource names
`Nodes`	Get/List/Watch	-
`Namespaces`	Get/List/Watch	-
`Secrets`	Create	-
`Secrets`	Get/Update/Delete	`dynatrace-dynakube-config` `dynatrace-data-ingest-endpoint` `dynatrace-activegate-internal-proxy`
`MutatingWebhookConfigurations`	Get/Update	`dynatrace-webhook`
`ValidatingWebhookConfigurations`	Get/Update	`dynatrace-webhook`
`Events`	Create/Patch	-
`CustomResourceDefinitions`	Get/Update	`dynakubes.dynatrace.com`

OneAgent

Purposes:

Collects host metrics from Kubernetes nodes.
Detects new containers and injects OneAgent code modules into application pods using classic full-stack injection. optional

Default configuration: 1-replica-per-node (deployed via a DaemonSet)

Policy settings: Allow HostNetwork, HostPID, to use any volume types.

Necessary capabilities: CHOWN, DAC_OVERRIDE, DAC_READ_SEARCH, FOWNER, FSETID, KILL, NET_ADMIN, NET_RAW, SETFCAP, SETGID, SETUID, SYS_ADMIN, SYS_CHROOT, SYS_PTRACE, SYS_RESOURCE

PodSecurityPolicies

These permissions used to be managed using a PodSecurityPolicy (PSP), but in Kubernetes version 1.25 PSPs will be removed from the following components:

Dynatrace Operator version 0.2.2
LEGACY Dynatrace OneAgent Operator version 0.11.0
Corresponding Helm charts

Dynatrace Operator version 0.2.1 is the last version in which PSPs are applied by default, so it's up to you to enforce these rules. As PSP alternatives, you can use other policy enforcement tools such as:

Note: If you choose to use a PSP alternative, be sure to provide the necessary permissions to the Dynatrace components.

Dynatrace CSI driver

Purpose:

For applicationMonitoring configurations, it provides the necessary OneAgent binary for application monitoring to the pods on each node.
For hostMonitoring configurations, it provides a writable folder for the OneAgent configurations when a read-only host file system is used.
For cloudNativeFullStack, it provides both of the above.

Default configuration: 1-replica-per-node (deployed via a DaemonSet)

Cluster-wide permissions: The following table shows the permissions needed for Dynatrace CSI driver.

Resources accessed	APIs used	Resource names
`Namespaces`	Get/List/Watch	-
`Events`	List/Watch/Create/Update/Patch	-
`Nodes`	Get/List/Watch	-
`CsiNodes`	Get/List/Watch	-
`Pods`	Get/List/Watch	-

Dynatrace webhook server

Purposes:

Modifies pod definitions to include Dynatrace code modules for application observability
Validates DynaKube custom resources
Handles the DynaKube conversion between versions

Default configuration: 1-replica-per-cluster, can be scaled

Cluster-wide permissions: The following table shows the permissions needed for the Dynatrace webhook server.

Resources accessed	APIs used	Resource names
`Namespaces`	Get/List/Watch/Update	-
`Events`	Create/Patch	-
`Secrets`	Get/List/Watch/Update	`dynatrace-dynakube-config` `dynatrace-data-ingest-endpoint`
`Secrets`	Create	-
`Replicationcontrollers`	Get	-
`Replicasets`	Get	-
`Statefulsets`	Get	-
`Daemonsets`	Get	-
`Deployments`	Get	-
`Jobs`	Get	-
`Cronjobs`	Get	-
`Deploymentconfigs`	Get	-

Dynatrace Kubernetes Monitoring (ActiveGate)

Purpose: collects cluster and workload metrics, events, and status from the Kubernetes API.

Default configuration: 1-replica-per-cluster, can be scaled

Cluster-wide permissions: The following table shows the permissions needed for Dynatrace Kubernetes Monitoring.

Resources accessed	APIs used	Resource names
`Nodes`	Get/List/Watch	-
`Pods`	Get/List/Watch	-
`Namespaces`	Get/List/Watch	-
`Deployments`	Get/List/Watch	-
`ReplicaSets`	Get/List/Watch	-
`DeploymentConfigs`	Get/List/Watch	-
`ReplicationControllers`	Get/List/Watch	-
`Jobs`	Get/List/Watch	-
`CronJobs`	Get/List/Watch	-
`StatefulSets`	Get/List/Watch	-
`DaemonSets`	Get/List/Watch	-
`Events`	Get/List/Watch	-
`ResourceQuotas`	Get/List/Watch	-
`Pods/Proxy`	Get/List/Watch	-
`Nodes/Proxy`	Get/List/Watch	-
`Services`	Get/List/Watch	-
`ClusterVersions`	Get/List/Watch	-
`/metrics`	Get	-
`/version`	Get	-
`/readyz`	Get	-
`/livez`	Get	-