Deploy OneAgent on Google Kubernetes Engine clusters

Google Kubernetes Engine (GKE) is a managed environment for operating Kubernetes clusters and running containerized workloads at scale.


  • OneAgent Operator v0.3+ requires Kubernetes v1.11 or higher. Older versions of the OneAgent Operator work with Kubernetes v1.9 or higher.

  • While full-stack monitoring of Ubuntu-based GKE clusters is fully supported, monitoring of Container-Optimized OS (COS) and Container-Optimized OS with Containerd (cos_containerd) based GKE clusters are currently available as an Early Adopter release.

Please review the limitations section below.

Prepare Dynatrace tokens for OneAgent Operator

OneAgent Operator requires two different tokens for interacting with Dynatrace servers. These two tokens are made available to OneAgent Operator by means of a Kubernetes secret as explained at a later step.

  1. Get an API token for the Dynatrace API.
    Make sure the Access problem and event feed, metrics, and topology permission switch is enabled for this token.

  2. Get a PaaS token.

Prerequisite for GKE

Create a role binding to grant your GKE user a cluster-admin before you can create the role necessary for the OneAgent Operator in later steps.

$ kubectl create clusterrolebinding cluster-admin-binding \
  --clusterrole=cluster-admin --user=$(gcloud config get-value account)

Install OneAgent Operator

Create the necessary objects for OneAgent Operator. OneAgent Operator acts on its separate namespace dynatrace. It holds the operator deployment and all dependent objects like permissions, custom resources and the corresponding DaemonSet. You can also observe the logs of OneAgent Operator.

$ kubectl create namespace dynatrace
$ LATEST_RELEASE=$(curl -s | grep tag_name | cut -d '"' -f 4)
$ kubectl create -f$LATEST_RELEASE/deploy/kubernetes.yaml
$ kubectl -n dynatrace logs -f deployment/dynatrace-oneagent-operator

Create the secret holding API and PaaS tokens for authenticating to the Dynatrace cluster. The name of the secret is important in a later step when you configure the custom resource (.spec.tokens). In the following code-snippet the name is oneagent. Be sure to replace API_TOKEN and PAAS_TOKEN with the values explained above.

$ kubectl -n dynatrace create secret generic oneagent --from-literal="apiToken=API_TOKEN" --from-literal="paasToken=PAAS_TOKEN"

Save custom resource

The rollout of Dynatrace OneAgent is governed by a custom resource of type OneAgent.

Retrieve the cr.yaml file from the GitHub repository.

$ curl -o cr.yaml$LATEST_RELEASE/deploy/cr.yaml

Adapt custom resource

Adapt the values of the custom resource as indicated in the following table.

Parameter Description Default value
apiUrl Dynatrace SaaS: Replace ENVIRONMENTID with your Dynatrace environment ID in
Dynatrace Managed: Provide your Dynatrace Server URL (https://<YourDynatraceServerURL>/e/<ENVIRONMENTID>/api)
tokens Name of the secret that holds the API and PaaS tokens from above. Name of custom resource ( if unset
args Parameters to be passed to the OneAgent installer. All the command line parameters of the installer are supported, with the exception of INSTALL_PATH. We recommend to set APP_LOG_CONTENT_ACCESS=1 []
env Environment variables for OneAgent container. []

If you're rolling out Dynatrace OneAgent to Container-Optimized OS(cos) based GKE clusters, you'll need to add the following entry to the env section in the custom resource.

    value: "true"

Create the custom resource

Create the custom resource

$ kubectl apply -f cr.yaml

Configure proxy (optional)

  • For Operator version 0.7.0, you can configure optional parameters like proxy settings in the custom resource.
  • For earlier versions of the Operator, add environment variables as needed to the corresponding containers.


See Docker limitations for details.


Find out how to troubleshoot issues that you may encounter when deploying OneAgent on Kubernetes.

Limitations for Container Optimized OS based GKE clusters

  • Only local Docker volume driver is supported.