Dynatrace OneAgent and Kubernetes Operator: Resolving the Injection Boundary in Production

Question

Integration boundaryA Dynatrace OneAgent configuration that connects in a local Docker Compose setup may not connect when the same application runs under the Dynatrace Kubernetes Operator. The local path typically relies on manually set DT_API_URL and DT_API_TOKEN environment variables. The production path depends on the Operator's mutating webhook and pod annotations to inject connection variables such as DT_CONNECTION_POINT and DT_TENANT.The unresolved decision is which injection mechanism should be authoritative when both are present or when the webhook is disabled. Operator versions around 0.9.0 changed required annotation keys, and older documentation may still reference dynatrace.com/inject. SaaS and Managed endpoints and token formats are not interchangeable, so a local token may be rejected in production even if injection succeeds. The exact annotation key and version compatibility require current verification against the deployed Operator release.Open questionsDoes the deployed Operator version inject connection variables through the mutating webhook, or should the OneAgent continue to read manually set DT_API_URL and DT_API_TOKEN?Which annotation key is required for the current Operator version, and how does it interact with the webhook?When the webhook is unavailable, what is the supported way to supply the connection point without conflicting with Operator-managed values?

Tasadduq Burney · Answer

Direct AnswerWhen the Dynatrace Kubernetes Operator's mutating webhook is enabled and the pod carries the required injection annotation, the webhook is authoritative: it injects DT_CONNECTION_POINT, DT_TENANT, and DT_TENANT_TOKEN and overwrites any manually set DT_API_URL/DT_API_TOKEN. If the webhook is disabled or the pod lacks the annotation, you must supply DT_CONNECTION_POINT and DT_TENANT_TOKEN (or DT_API_TOKEN for older OneAgent versions) manually.Likely Explanation vs. Confirmed FactsLikely: Operator versions ≥ 0.9.0 prefer the annotation dynatrace.com/oneagent: \"true\" but may still accept dynatrace.com/inject: \"true\" for backward compatibility. The exact key must be verified against the deployed Operator's CRD.Confirmed: The webhook injects the three variables above and also adds volume mounts for the OneAgent binary and sets LD_PRELOAD/JAVA_TOOL_OPTIONS. Without the webhook, those mounts are absent and the application runs uninstrumented.Confirmed: SaaS and Managed tokens are not interchangeable. A token from a SaaS tenant will be rejected by a Managed cluster even if injection succeeds.Steps to Resolve for Your CaseCheck the deployed Operator version and webhook statuskubectl get dynakube -n dynatrace -o yaml kubectl get pods -n dynatrace -l app=dynatrace-webhookVerify the annotation key required by that version – consult the Operator release notes for the exact version (e.g., https://github.com/Dynatrace/dynatrace-operator/releases/tag/v).Inspect a target pod's environment to see which variables are actually present:kubectl exec -n -- env | grep -E 'DT_'Validate the token format by decoding the secret referenced in the DynaKube CR:kubectl get secret -n dynatrace -o jsonpath='{.data.apiToken}' | base64 -dEnsure it matches your target environment (SaaS vs. Managed).If the webhook is unavailable, add DT_CONNECTION_POINT and DT_TENANT_TOKEN as env vars in the pod spec (or use a secret). Do not set DT_API_URL/DT_API_TOKEN alongside them.One Missing Diagnostic DetailWhat is the exact Operator version (e.g., v0.12.0) running in your cluster? The required annotation key and any breaking changes depend on that version, and it changes whether dynatrace.com/inject or dynatrace.com/oneagent is authoritative.

Dynatrace OneAgent and Kubernetes Operator: Resolving the Injection Boundary in Production

Integration boundary

Open questions

1 answer

Direct Answer

Likely Explanation vs. Confirmed Facts

Steps to Resolve for Your Case

One Missing Diagnostic Detail

Your perspective belongs here.

0 question comments