To ensure Dynatrace Operator components work correctly in a Kubernetes cluster, they need to be able to communicate with both the Dynatrace Cluster and the Kubernetes cluster.
Dynatrace Operator components are accessible through specific ports and access various resources inside and outside the Kubernetes cluster. For more details on which resources are accessed within the Kubernetes cluster, see the Operator RBAC permissions reference page.
Source
Destination
Port
Note
kube-apiserver
Dynatrace Webhook /inject, /label-ns, /validate*
TCP 8443
Dynamic Admission Controller
Prometheus metrics scraper Optional
Dynatrace Operator CSI driver server container /metrics
TCP 8080
Metrics address 2
Prometheus metrics scraper Optional
Dynatrace Operator CSI driver provisioner container /metrics
TCP 8090
Metrics address 2
Application pods
ActiveGate /*
TCP 9999
Default HTTPS port
Application pods
ActiveGate /*
TCP 9998
Default HTTP port, Data ingest, API access
Liveness probes are used by Kubernetes to verify the container is running properly. If the request fails, the container will be restarted. Readiness probes are used by Kubernetes to verify the Pod is ready to accept traffic.
Metrics endpoints emit additional metrics in Prometheus format.
No ingress traffic is accepted for EdgeConnect and OneAgent.
Dynatrace Operator components have to access both the Kubernetes cluster and resources outside the Cluster to function properly. All resources in the namespace of Dynatrace Operator, with the default namespace being dynatrace, need to be able to resolve DNS requests.
Depending on your setup, the default port may be different from TCP 443.
Depending on your setup, the port may differ from the default.
Communication with hosts must be allowed as configured in DynaKube (apiUrl) or EdgeConnect (apiServer) custom resources. Different communication endpoints may be used as fallback to ensure proper connection.
Only required when codeModulesImage field is used.
Only required when Kubernetes Automation is enabled.