Set namespace-based isolation levels for pods

Kubernetes version 1.25+

You can set namespace-based isolation levels for pods using Pod Security Standards.

If the defaults property in the built-in admission controller is set to baseline or restricted, you need to mark the dynatrace namespace as privileged, as only the Privileged policy is supported by Dynatrace Operator (the CSI driver and OneAgent pods require more permissions than the Baseline or Restricted policies allow).

To do that, run the command below.

1kubectl label namespace dynatrace pod-security.kubernetes.io/enforce=privileged pod-security.kubernetes.io/audit=privileged pod-security.kubernetes.io/warn=privileged