Automate Istio configurations with enableIstio

The enableIstio attribute in the Dynatrace Kubernetes integration is designed to simplify the setup of Istio configurations by automatically creating ServiceEntries and VirtualServices. This guide explains how to use enableIstio to streamline the communication setup for Dynatrace components within an Istio service mesh.

How it works

The enableIstio attribute is a convenience feature that automatically creates ServiceEntries and VirtualServices for connection endpoints required by:

  • Dynatrace Operator: Uses apiUrl defined in DynaKube.
  • ActiveGate: Uses the /v1/deployment/installer/gateway/connectioninfo endpoint.
  • OneAgent injected into user containers: Uses the /v1/deployment/installer/agent/connectioninfo, which respects the networkZone attribute for routing.

When to use it

Use the enableIstio attribute if:

  • Both Dynatrace Operator’s pods and/or the injected workloads are part of the Istio mesh.
  • ServiceEntries and VirtualServices are required for the endpoints used by Dynatrace Operator and/or the components deployed by Dynatrace Operator.
  • Istio is configured to be registry only (for example, meshConfig.outboundTrafficPolicy.mode=REGISTRY_ONLY).

Note that enableIstio attribute will not consider pre-existing ServiceEntries and VirtualServices. Using this attribute prematurely might lead to conflicts in Istio configurations. In complex setups, manual configuration may yield better outcomes.

Manual configuration

Manual configuration of ServiceEntries and VirtualServices may be required in the following cases:

Dynatrace Operator

  • Requirement: Necessary if Dynatrace Operator pod is part of the mesh.
  • Configuration: Ensure the apiUrl defined in the DynaKube is present in ServiceEntries and VirtualServices.

ActiveGate

  • Requirement: Necessary if the ActiveGate pod is part of the mesh.
  • Configuration: Manually configure ServiceEntries and VirtualServices based on the output of the /v1/deployment/installer/gateway/connectioninfo endpoint.

cloudNativeFullstack and applicationMonitoring

  • Requirement: Necessary if injected user applications are part of the mesh.
  • Configuration: Manually configure ServiceEntries and VirtualServices based on the output of the /v1/deployment/installer/agent/connectioninfo endpoint.

classicFullStack and hostMonitoring

  • Requirement: Not applicable.
  • Reason: Both classicFullStack and hostMonitoring DaemonSet use hostNetwork: true in their security context, which means they can't be part of the Istio mesh.