Tokens authenticate and authorize API calls, ensuring that only authorized services can interact with your Dynatrace environment. In the context of Dynatrace Operator for Kubernetes, two tokens are used:
Operator token
The Operator token (former API token) enables the Dynatrace Operator to manage settings and the lifecycle of all Dynatrace components in the Kubernetes cluster.
Data Ingest token
The data ingest token enriches and sends additional observability signals (for example, custom metrics) from your Kubernetes cluster to Dynatrace.
Latest Dynatrace
For each Kubernetes cluster, Dynatrace Operator uses two platform tokens associated with a dedicated service user:
Operator token — assigned the Kubernetes Operator policy. Manages the lifecycle of all Dynatrace components in the cluster.
Data Ingest token — assigned the Kubernetes Ingest policy. Ingests observability signals (metrics, logs, traces) from the cluster.
Token scopes
Operator token
Scope
Usage
fleet-management:activegate.connection-info:read
Collect information for ActiveGate lifecycle
fleet-management:activegate.tokens:create
Create an authentication token for your ActiveGate to connect to the Dynatrace Cluster
Platform tokens are created automatically as part of the Kubernetes Onboarding flow — you don't need to create them manually unless you prefer to. To use the onboarding flow, an account administrator must first grant Kubernetes Onboarding permissions to your user.
Create tokens
Create a service user
Go to Account Management. If you have more than one account, select the account you want to manage.
Go to Identity & access management > Service users.
On the Service users page, select Add service user.
On the Create service user page, enter the following service user details.
Name
OptionalDescription
Make sure they're both meaningful for environment admins so that they understand the purpose of the service user.
In the Assign permissions section, select to assign the following permissions Directly:
Kubernetes Operator
Kubernetes Ingest
Select Create.
Create platform tokens
Repeat the following steps for both the Operator and Data Ingest tokens.
Environments to restrict the token's scope to specific Dynatrace environments
Select token scopes in the table.
For the Operator token, enable the scopes listed in Operator token.
For the Data Ingest token, enable the scopes listed in Data Ingest token.
Assign each token to the service user.
Select Generate to create the token.
Copy the token and store it in a secure place. The token is only shown once.
Select Finish and exit.
Grant Kubernetes Onboarding permissions to users
Only a Dynatrace account administrator can complete the following steps.
Go to Account Management. If you have more than one account, select the account you want to manage.
Go to Identity & access management > Group management.
On the Group management page, select Create group.
On the New group page, enter the following group details.
Name
OptionalDescription
Make sure they're both meaningful for environment admins so that they understand the purpose of the group.
In the Permissions tab, select Add permission.
Select Kubernetes Onboarding from the Permissions drop down, then choose a Scope and Boundaries to assign to this group.
In the Members tab, select Add members.
Select members in the Add members to this group dialog, then select Add.
Select Create.
Create token
Repeat the following steps for both the Operator and Data Ingest tokens.
Go to Access Tokens.
Select Generate new token.
Provide a meaningful name for the token.
Enable the required permissions for the token.
For the Operator token, select the template in Template > Kubernetes: Dynatrace Operator. This will automatically add the required scopes (see Operator token)
For the Data Ingest token, select the template in Template > Kubernetes: Data Ingest. This will automatically add the required scopes (see Data Ingest token)
Select Generate token to create the token.
Copy the token and store it in a secure place.
View token scopes
Operator token
The Operator token requires the following scopes:
Scope
Usage
Dynatrace Operator version
PaaS - Installer (Installer download)
Manages OneAgent and ActiveGate lifecycle.
Any version
Access problem and event feed, metrics, and topology (API v1 - DataExport)
Notifies the Dynatrace Cluster of graceful shutdown. Starting with OneAgent version 1.301, graceful host shutdown is detected without Dynatrace Operator.
<1.6.0
Read settings (API v2 - settings.read)
Manage the ActiveGate object for Kubernetes API monitoring. 2
0.4.0+
Write settings (API v2 - settings.write)
Manage the ActiveGate object for Kubernetes API monitoring. 2
0.4.0+
Read entities (API v2 - entities.read)
Checks if the ActiveGate object exists for Kubernetes API monitoring. 3
Creates an authentication token for your ActiveGate to connect to the Dynatrace Cluster.1
0.9.0+
1
The token is rotated by Dynatrace Operator every 30 days. When an authentication token is rotated, the affected ActiveGate is automatically deleted and redeployed.
2
Optional since Dynatrace Operator version v1.7.0+.
3
No longer required with Dynatrace Operator version v1.7.0+