Try it free

Tokens and permissions

  • Latest Dynatrace
  • How-to guide
  • 4-min read

Tokens authenticate and authorize API calls, ensuring that only authorized services can interact with your Dynatrace environment. In the context of Dynatrace Operator for Kubernetes, two tokens are used:

  • Operator token
    The Operator token enables the Dynatrace Operator to manage settings and the lifecycle of all Dynatrace components in the Kubernetes cluster.

  • Data Ingest token
    The data ingest token enriches and sends additional observability signals (for example, custom metrics) from your Kubernetes cluster to Dynatrace.

For each Kubernetes cluster, Dynatrace Operator uses two platform tokens associated with a dedicated service user:

  • Operator token—assigned the Kubernetes Operator policy. Manages the lifecycle of all Dynatrace components in the cluster.
  • Data Ingest token—assigned the Kubernetes Ingest policy. Ingests observability signals (metrics, logs, traces) from the cluster.

Operator token

ScopeUsage

fleet-management:activegate.connection-info:read

Collect information for ActiveGate lifecycle

fleet-management:activegate.tokens:create

Create an authentication token for your ActiveGate to connect to the Dynatrace Cluster

fleet-management:container-images:read

Read image information for managed components

fleet-management:oneagent.connection-info:read

Collect information for OneAgent lifecycle

fleet-management:oneagents:download

Manage OneAgent lifecycle

settings:objects:read

Read settings for Kubernetes API monitoring, KSPM, and log monitoring

settings:objects:write

Manage settings for Kubernetes API monitoring, KSPM, and log monitoring

Data Ingest token

ScopeUsage

openpipeline:logs:ingest

Ingest logs

openpipeline:metrics:ingest

Ingest metrics

openpipeline:traces:ingest

Ingest traces

storage:metrics:write

Write metrics to Dynatrace

For background on the required concepts, see:

  • Users, service users
  • Local groups, policies
  • Manage service users
  • Platform tokens for service users

Platform tokens are created automatically as part of the Kubernetes Onboarding flow — you don't need to create them manually unless you prefer to. To use the onboarding flow, an account administrator must first grant Kubernetes Onboarding permissions to your user.

Create tokens

Create a service user

  1. Go to Account Management. If you have more than one account, select the account you want to manage.
  2. Go to Identity & access management > Service users.
  3. On the Service users page, select Add service user.
  4. On the Create service user page, enter the following service user details.
    • Name
    • Optional Description

    Make sure they're both meaningful for environment admins so that they understand the purpose of the service user.

  5. In the Assign permissions section, select to assign the following permissions Directly:
    • Kubernetes Operator
    • Kubernetes Ingest
  6. Select Create.

Create platform tokens

Repeat the following steps for both the Operator and Data Ingest tokens.

  1. Go to My platform tokens.
  2. Select Platform token and specify:
    • A meaningful Token Name
    • Expiration date
    • Account
    • Environments to restrict the token's scope to specific Dynatrace environments
  3. Select token scopes in the table.
    • For the Operator token, enable the scopes listed in Operator token.
    • For the Data Ingest token, enable the scopes listed in Data Ingest token.
  4. Assign each token to the service user.
  5. Select Generate to create the token.
  6. Copy the token and store it in a secure place. The token is only shown once.
  7. Select Finish and exit.

Grant Kubernetes Onboarding permissions to users

Only a Dynatrace account administrator can complete the following steps.

  1. Go to Account Management. If you have more than one account, select the account you want to manage.
  2. Go to Identity & access management > Group management.
  3. On the Group management page, select Create group.
  4. On the New group page, enter the following group details.
    • Name
    • Optional Description

    Make sure they're both meaningful for environment admins so that they understand the purpose of the group.

  5. In the Permissions tab, select Add permission.
    • Select Kubernetes Onboarding from the Permissions drop down, then choose a Scope and Boundaries to assign to this group.
  6. In the Members tab, select Add members.
    • Select members in the Add members to this group dialog, then select Add.
  7. Select Create.