Deploy Dynatrace OneAgent on Kubernetes with the Dynatrace Operator: A Step‑by‑Step Guide

Desired Outcome

After following this guide you will have a fully‑functional Dynatrace OneAgent running as a DaemonSet on every worker node in your Kubernetes cluster. The Agent will report host, process, and network metrics to your Dynatrace SaaS or Managed environment, and your applications will be instrumented for full‑stack visibility.

Prerequisites

• Dynatrace SaaS or Managed tenant with an environment URL (e.g. https://12345.live.dynatrace.com).
• API token with Read/Write permissions for OneAgent and Hosts.
• Optional: PaaS token for OneAgent download if you use a private registry.
• Kubernetes cluster (v1.19+ recommended) with kubectl access and the kube-system namespace writable.
• Network egress to *.dynatrace.com on port 443 or an ActiveGate reachable from the cluster.

Procedure

1. Create a Kubernetes secret for the Dynatrace API token

   kubectl create secret generic dynatrace-token \
     --from-literal=DT_TENANT_URL="https://12345.live.dynatrace.com" \
     --from-literal=DT_API_TOKEN="YOUR_API_TOKEN" \
     -n dynatrace
   

   Store the secret in the dynatrace namespace. Replace placeholders with your actual values.

2. Install the Dynatrace Operator

   You can install it via Helm or plain kubectl apply. Helm is recommended for version control.

   helm repo add dynatrace https://charts.dynatrace.com
   helm repo update
   helm install dynatrace-operator dynatrace/dynatrace-operator \
     --namespace dynatrace \
     --create-namespace \
     --set env.DYNATRACE_API_TOKEN=YOUR_API_TOKEN \
     --set env.DYNATRACE_TENANT_URL=https://12345.live.dynatrace.com
   

3. Create a DynaKube custom resource

   This CR tells the Operator which nodes to instrument and any optional settings.

   apiVersion: dynatrace.com/v1alpha1
   kind: DynaKube
   metadata:
     name: oneagent
     namespace: dynatrace
   spec:
     oneAgent:
       runtime: "auto"  # auto‑detect runtime for containers
       hostRootPath: "/host"
     activeGate:
       enabled: false
     # Optional: proxy settings
     proxy:
       http: "http://proxy.example.com:3128"
       https: "https://proxy.example.com:3128"
   

4. Wait for reconciliation

   The Operator will create a DaemonSet named oneagent that runs on all worker nodes.

Expected Checks

Recovery & Troubleshooting

• DynaKube not Ready

  Check Operator logs: kubectl logs -n dynatrace -l app=dynatrace-operator. Common issues include expired API token or missing DYNATRACE_TENANT_URL.

• DaemonSet pods stuck in ImagePullBackOff

  Verify that the node can reach the OneAgent image registry. If using a private registry, add imagePullSecrets to the DynaKube spec.

• No nodes appear in Dynatrace

  Ensure egress to *.dynatrace.com:443 is allowed. If a corporate proxy is used, confirm that the proxy settings in the DynaKube spec are correct.

• High CPU/memory overhead

  Review the OneAgent resource limits in the DaemonSet. Adjust the oneAgent section of the DynaKube spec or resize node pools accordingly.

Limitations & Caveats

• OneAgent consumes 200–400 MiB RAM per node; plan node sizing accordingly.
• Unsupported Kubernetes versions (<1.19) may prevent the Operator from running.
• Tokens should be rotated regularly; store them in Kubernetes secrets and use kubectl patch secret to update.

Practical Verification

After deployment, run:

kubectl get pods -n dynatrace -l app=oneagent -o wide

and in Dynatrace, search for a host named after your node. If the host appears with metrics, the installation succeeded.

Conclusion

Using the Dynatrace Operator to deploy OneAgent as a DaemonSet simplifies lifecycle management and ensures consistent monitoring across your cluster. By following the steps above, verifying status, and knowing how to recover common issues, you can quickly gain full‑stack visibility into your Kubernetes workloads.