Additional OpenShift configurations

Integrating Dynatrace Operator into OpenShift environments requires understanding the specifics of both platforms. This guide depicts the necessary configurations, focusing on Security Context Constraints (SCCs) and the use of the CSI driver in various scenarios.

Security Context Constraints (SCCs)

In OpenShift, SCCs provide control over pod permissions in a manner akin to the built-in Role-Based Access Control (RBAC) system of Kubernetes. SCCs specify the actions a pod can perform and define its levels of resource access.

To get an overview of all default and custom SCCs in an OpenShift cluster, execute the following command:

oc get scc

OpenShift provides default SCCs for a more standardized approach, while also supporting custom SCCs to cover more specific requirements.

Dynatrace Operator

This section provides an overview of the SCCs used by Dynatrace Operator, varying by OpenShift version, and serves as a reference. It also delves into the relationship between SCCs and earlier versions of Dynatrace Operator.

Code module injection for application monitoring

cloudNativeFullStack applicationMonitoring

For effective application monitoring, Dynatrace Operator adds CSI volumes to application pods. These volumes, provided by the CSI driver, contain necessary code modules needed for OneAgent injection. Given that SCCs regulate resource access levels, their role is vital in facilitating this integration.

Below are scenarios detailing the use of SCCs and instances where configuration might be necessary.

Configure custom SCC for application monitoring

The following code snippet explains how to add the csi volume to a custom SCC:

apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints
metadata:
 name: <custom>
...
volumes:
...
- csi

For further details on SCC configuration options, see security context constraints documentation.

CSI Inline Ephemeral Volume Security

OpenShift version 4.13+

The CSI driver requires specific labeling for validation by the CSI Volume Admission plugin.

The necessary label is automatically added to the csidriver resource. It is required for enabling CSI volumes injected by Dynatrace Operator using Webhook-based injection modes.

kubectl label csidriver csi.oneagent.dynatrace.com security.openshift.io/csi-ephemeral-volume-profile=restricted