• Home
  • Setup and configuration
  • Set up Dynatrace on container platforms
  • Kubernetes
  • Legacy
  • Set up Kubernetes monitoring (deprecated)

Set up Kubernetes monitoring (deprecated)

This page describes how to set up Kubernetes monitoring using Dynatrace Operator versions 0.2.0 and earlier.

  • If you are making a fresh installation, we recommend that you set up Kubernetes monitoring using Dynatrace Operator version 0.3.0+.

  • If you already set up monitoring with Dynatrace Operator version 0.2.0 or earlier, we recommend that you upgrade.

    Upgrade to Dynatrace Operator version 0.3.0+

    Run the following command.

    bash
    kubectl apply -f https://github.com/Dynatrace/dynatrace-operator/releases/latest/download/kubernetes.yaml

    Note: For preview features, where you use the CSI driver to provide binaries to pods, use the command below instead.

    bash
    kubectl apply -f https://github.com/Dynatrace/dynatrace-operator/releases/latest/download/kubernetes-csi.yaml

Deploy Dynatrace Operator and enable Kubernetes API monitoring

There are two ways to configure Dynatrace Operator to monitor your Kubernetes cluster, (automated or manual. See below for instructions.

Prerequisites
  • Dynatrace Cluster version 1.215
  • Kubernetes versions 1.19+
  • Pods must allow egress to your Dynatrace environment or to your Environment ActiveGate in order for metric routing to work properly.
  • See Support lifecycle for supported Kubernetes versions.

Automated

  1. In the Dynatrace menu, go to Hub.
  2. Find and select Kubernetes.
  3. Select Monitor Kubernetes.
  4. On the Monitor Kubernetes / OpenShift page, follow the on-screen deployment instructions.
    • Name: This name is used by various Dynatrace settings, including Kubernetes cluster name, Network Zone, ActiveGate Group, and Host Group
    • Platform: Kubernetes
    • PaaS token and API token: To create these tokens automatically, select Create tokens
  5. Under Execute the following command in your terminal, Dynatrace creates a command based on your input in the previous steps. After you have set all of the preceding parameters, select Copy to copy the command to your clipboard.
  6. Paste the command to your terminal and run it.

Manual

  1. Generate an API token and a PaaS token in your Dynatrace environment.
    Note: Make sure you have the following permissions enabled for the API token in the API v1 section:
  • Access problem and event feed, metrics, and topology
  • Read configuration
  • Write configuration
  1. Create the necessary objects for Dynatrace Operator.
    Dynatrace Operator acts on its separate namespace, dynatrace. It holds the operator deployment and all dependent objects, such as permissions, custom resources, and the corresponding DaemonSet and StatefulSet. You can also observe the logs of Dynatrace Operator.
bash
kubectl create namespace dynatrace kubectl apply -f https://github.com/Dynatrace/dynatrace-operator/releases/download/v0.2.2/kubernetes.yaml kubectl -n dynatrace logs -f deployment/dynatrace-operator
  1. Create the secret holding API and PaaS tokens for authentication to the Dynatrace Cluster.
    The name of the secret is important in a later step when you configure the custom resource (.spec.tokens). In the following code snippet, the name is dynakube. Be sure to replace API_TOKEN and PAAS_TOKEN with the values explained in the prerequisites.
bash
kubectl -n dynatrace create secret generic dynakube --from-literal="apiToken=API_TOKEN" --from-literal="paasToken=PAAS_TOKEN"
  1. Get the DynaKube custom resource from the GitHub repository.
bash
curl -Lo cr.yaml https://github.com/Dynatrace/dynatrace-operator/blob/release-0.2/config/samples/cr.yaml
  1. Adapt the values of the custom resource as indicated below.

Example of a basic configuration:

yaml
apiVersion: dynatrace.com/v1alpha1 kind: DynaKube metadata: name: dynakube namespace: dynatrace spec: # Dynatrace apiUrl including the `/api` path at the end. # For SaaS, set `YOUR_ENVIRONMENT_ID` to your environment ID. # For Managed, change the apiUrl address. # For instructions on how to determine the environment ID and how to configure the apiUrl address, see https://www.dynatrace.com/support/help/shortlink/environment-id. # apiUrl: https://YOUR_ENVIRONMENT_ID.live.dynatrace.com/api # Name of the secret holding the API and PaaS tokens. # If unset, Dynatrace Operator uses the name of the custom resource. # # tokens: "" # Enables and configures an ActiveGate instance that allows monitoring # of Kubernetes environments. # kubernetesMonitoring: # Enable Kubernetes monitoring functionality. # enabled: true classicFullStack: # Enable classic oneagent monitoring enabled: true tolerations: - effect: NoSchedule key: node-role.kubernetes.io/master operator: Exists

If you want to revert an argument, you need to set it to empty instead of removing it from the custom resource.

Example:

args:

  • "–set-proxy="

Parameters

For a complete list of parameters, see the list below.

Global parameters

ParameterDescriptionDefault value
apiUrlRequired Dynatrace apiUrl, including the /api path at the end.
- For SaaS, set YOUR_ENVIRONMENT_ID to your environment ID.
- For Managed, change the apiUrl address.
For instructions on how to determine the environment ID and how to configure the apiUrl address, see Environment ID.
tokensOptional Name of the secret holding the API and PaaS tokens.Name of custom resource (.metadata.name) if unset
skipCertCheckOptional Disable certificate check for the connection between Dynatrace Operator and the Dynatrace Cluster.
Set to true if you want to skip certification validation checks.
false
proxyOptional Set custom proxy settings either directly or from a secret with the field proxy.
Note: Only Dynatrace Operator traffic runs through this proxy; ActiveGate traffic doesn't.
trustedCAsOptional Adds custom RootCAs from a configmap. Put the certificate under certs within your configmap.
Note: Applies only to Dynatrace Operator, not to ActiveGate.
networkZoneOptional Sets a network zone for the OneAgent and ActiveGate pods.
customPullSecretOptional Defines a custom pull secret in case you use a private registry when pulling images from the Dynatrace environment.
enableIstioOptional When enabled, and if Istio is installed on the Kubernetes environment, Dynatrace Operator will create the corresponding VirtualService and ServiceEntry objects to allow access to the Dynatrace Cluster from the OneAgent or ActiveGate. Disabled by default.false

ActiveGate parameters

ParameterDescriptionDefault value
activeGate.imageOptional Configuration for ActiveGate instances (to use a custom ActiveGate Docker image).

OneAgent parameters

ParameterDescriptionDefault value
oneAgent.versionOptional The OneAgent version to be used when useImmutableImage is enabled. The latest version is used by default.
oneAgent.imageOptional Use a custom OneAgent Docker image. Defaults to docker.io/dynatrace/oneagent in Kubernetes and registry.connect.redhat.com/dynatrace/oneagent in OpenShift.
oneAgent.autoUpdateOptional Disables automatic restarts of OneAgent pods in case a new version is available. True by default.true

Classic full-stack observability parameters

ParameterDescriptionDefault value
classicFullStack.enabledOptional Enables classic OneAgent monitoring.false
classicFullStack.nodeSelectorOptional Specify the node selector that controls on which nodes OneAgent will be deployed.
classicFullStack.tolerationsOptional Tolerations to include with the OneAgent DaemonSet.
For details, see Taints and Tolerations.
classicFullStack.resourcesOptional Resource settings for OneAgent container. Consumption of the OneAgent heavily depends on the workload to monitor. You can use the default settings in the CR.
Note: resource.requests shows the values needed to run; resource.limits shows the maximum limits for the pod.
classicFullStack.argsOptional Set additional arguments to the OneAgent installer.
For available options, see Linux custom installation.
For the list of limitations, see Limitations.
"--set-app-log-content-access=true"
classicFullStack.envOptional Set additional environment variables for the OneAgent pods.
classicFullStack.priorityClassNameOptional Assign a priority class to the OneAgent pods. By default, no class is set.
For details, see Pod Priority and Preemption.
classicFullStack.dnsPolicyOptional Set the DNS Policy for OneAgent pods.
For details, see Pods DNS Policy.
ClusterFirstWithHostNet
classicFullStack.serviceAccountNameOptional The name of the ServiceAccount to assign to the OneAgent pods."dynatrace-dynakube-oneagent"
classicFullStack.labelsOptional Your defined labels for OneAgent pods in order to structure workloads as desired.
classicFullStack.useUnprivilegedModeOptional When enabled, the OneAgent pods will run as unprivileged. Enabled by default.true
classicFullStack.useImmutableImageOptional When enabled, the Operator will use the immutable image from the Dynatrace environment or from your custom registry. Otherwise, an installer image is used. Disabled by default.false

Kubernetes API Monitoring parameters

ParameterDescriptionDefault value
kubernetesMonitoring.enabledOptional Enable Kubernetes monitoring functionality.false
kubernetesMonitoring.replicasOptional Number of replicas of ActiveGate pods.1
kubernetesMonitoring.tolerationsOptional Tolerations to include with the ActiveGate StatefulSet.
For details, see Taints and Tolerations.
kubernetesMonitoring.nodeSelectorOptional Node selector to control on which nodes the ActiveGate will be deployed.{}
kubernetesMonitoring.resourcesOptional Resource settings for ActiveGate container. Consumption of the ActiveGate heavily depends on the workload to monitor. You can use the default settings in the CR.
Note: resource.requests shows the values needed to run; resource.limits shows the maximum limits for the pod.
kubernetesMonitoring.labelsOptional Your defined labels for ActiveGate pods in order to structure workloads as desired.
kubernetesMonitoring.argsOptional Set additional arguments to the ActiveGate pods.
kubernetesMonitoring.envOptional Set additional environment variables to the ActiveGate pods.
kubernetesMonitoring.groupOptional Set activation group for ActiveGate. See Customize ActiveGate properties for details.
kubernetesMonitoring.customPropertiesOptional Add a custom properties file by providing it as a value or reference it from a secret.
Note: when referencing it from a secret, make sure the key is called customProperties. See Customize ActiveGate properties for details.

Routing parameters

ParameterDescriptionDefault value
routing.enabledOptional Enable routing functionality.false

For a complete file with all the properties, see the custom resource file on GitHub.

Configuration for Anthos, SUSE CaaS, GKE, IKS, and TKGI

For Anthos, SUSE CaaS, Google Kubernetes Engine, and VMware Tanzu Kubernetes Grid Integrated Edition (formerly PKE), you must add the following additional parameters to the env section in the cr.yaml file:

Anthos and GKE
yaml
classicFullStack: env: - name: ONEAGENT_ENABLE_VOLUME_STORAGE value: "true"
TKGI
yaml
classicFullStack: env: - name: ONEAGENT_ENABLE_VOLUME_STORAGE value: "true" - name: ONEAGENT_CONTAINER_STORAGE_PATH value: /var/vcap/store
IKS
yaml
classicFullStack: env: - name: ONEAGENT_ENABLE_VOLUME_STORAGE value: "true" - name: ONEAGENT_CONTAINER_STORAGE_PATH value: /opt
SUSE CaaS
yaml
classicFullStack: env: - name: ONEAGENT_ENABLE_VOLUME_STORAGE value: "true"
  1. Apply the custom resource.
bash
kubectl apply -f cr.yaml

Configure proxy optional

  • You can configure optional parameters like proxy settings in the cr.yaml file in order to
    • Download the OneAgent installer
    • Ensure communication between the OneAgent and your Dynatrace environment
    • Ensure communication between Dynatrace Operator and the Dynatrace API.

There are two ways to provide the proxy, depending on whether your proxy uses credentials.

No credentials

If you have a proxy that doesn't use credentials, enter your proxy URL directly in the value field for the proxy.

Example

apiVersion: dynatrace.com/v1alpha1 kind: DynaKube metadata: name: dynakube namespace: dynatrace spec: apiUrl: https://environmentid.live.dynatrace.com/api proxy: value: http://mysuperproxy
With credentials

If your proxy uses credentials

  1. Create a secret with a field called proxy that holds your encrypted proxy URL with the credentials.
    Example.

    kubectl -n dynatrace create secret generic myproxysecret --from-literal="proxy=http://<user>:<password>@<IP>:<PORT>"
  2. Provide the name of the secret in the valueFrom section.
    Example.

    apiVersion: dynatrace.com/v1alpha1 kind: DynaKube metadata: name: dynakube namespace: dynatrace spec: apiUrl: https://environmentid.live.dynatrace.com/api proxy: valueFrom: myproxysecret

Connect your Kubernetes cluster to Dynatrace

Some Kubernetes pages require that your Kubernetes cluster is connected to Dynatrace. This connection creates relationships among applications, services, processes, hosts, and Kubernetes objects, such as pods and namespaces.

See Connect your Kubernetes clusters to Dynatrace for instructions on how to connect your cluster to Dynatrace.

If you want to monitor several Kubernetes clusters with one ActiveGate and don't care about network isolation, you can install an ActiveGate on a virtual machine using a conventional installer to connect your clusters to Dynatrace.

Monitor large Kubernetes environments

Contact Dynatrace ONE if you want to monitor environments that are larger than:

  • 50 Kubernetes clusters per Dynatrace environment
  • 500 nodes per Kubernetes cluster
  • 50,000 pods per Kubernetes cluster

Uninstall Dynatrace Operator

Remove DynaKube custom resources and clean all remaining Dynatrace Operator–specific objects.

kubectl delete -n dynatrace dynakube --all kubectl delete -f https://github.com/Dynatrace/dynatrace-operator/releases/latest/download/kubernetes.yaml
Related topics
  • Kubernetes/OpenShift monitoring

    Monitor Kubernetes/OpenShift with Dynatrace.