Containerized ActiveGate configuration

An ActiveGate container can be configured to some degree using container-specific methods via variables or secrets. More advanced settings require providing an ActiveGate custom.properties file. See Advanced configuration to learn how to use Kubernetes mechanisms such as ConfigMap to map it into the custom.properties.

Sensitive information

To ensure security, you must pass the sensitive information to an ActiveGate container in a file containing a secret.

Environment configuration

An ActiveGate container image does not hold any configuration related to your environment.

See below for the mandatory configuration settings to make your ActiveGate container work.

Communication endpoints

This is a comma-separated list of the communication endpoints to be used by ActiveGate to send data to your Dynatrace environment.

To determine the endpoints, use GET connectivity information for ActiveGate in the Dynatrace API.

Environment variable	`DT_SERVER`
Mandatory?

Environment ID

The Dynatrace environment ID.

Environment variable	`DT_TENANT`
Mandatory?

Token

The tenant token is used by OneAgents and ActiveGates to report data to Dynatrace. Dynatrace automatically generates the tenant token for your ActiveGate.

To determine the token, use GET connectivity information for ActiveGate in the Dynatrace API.

Secret as a file	`/var/lib/dynatrace/secrets/tokens/tenant-token`
Mandatory?

Authorization token

ActiveGate requires a unique ActiveGate token to authorize in the Dynatrace Cluster.

For instructions, see Generate ActiveGate token.

Secret as a file	`/var/lib/dynatrace/secrets/tokens/auth-token`
Mandatory?

Deployment settings

Activation group

Defines the ActiveGate group to which the ActiveGate belongs. An ActiveGate can belong to only one group. The name of an ActiveGate group is a string of alphanumeric characters, hyphens (-), underscores (_), and dots (.). Dots are used as separators, so you must not use a dot as the first character of a group name. The length of the string is limited to 256 characters. You can use ActiveGate groups to perform bulk actions on your ActiveGates, such as managing Extensions 2.0 running on ActiveGates. If you want to assign your ActiveGate to a group, see ActiveGate group.

Environment variable	Example
`DT_GROUP`	`myGroup`

Network zone

Defines the network zone to which the ActiveGate belongs. An ActiveGate can belong to only one network zone. The name of a network zone is a string of alphanumeric characters, hyphens (-), underscores (_), and dots (.). Dots are used as separators, so you must not use a dot as the first character of a network zone name. The length of the string is limited to 256 characters.

Environment variable	Example
`DT_NETWORK_ZONE`	`myNetworkZone`

Enabled modules

Containerized ActiveGate does not enable any functionalities by default. Enabled modules need to be specified using the DT_CAPABILITIES environment variable. Add a comma-separated list of module names as the variable value.

Environment variable	Example
`DT_CAPABILITIES`	`aws_monitoring,azure_monitoring,MSGrouter`

See ActiveGate modules for a complete list. Generally, you should refer to the custom.properties section names as the module names, for example, cloudfoundry_monitoring.

The exceptions to this rule are the following modules that are stored in the [collector] section.

MSGrouter—Enables message routing
restInterface—Enables REST API module
java-script-agent-servlet—Enables JavaScript agent

Not all modules are supported

Not all modules are supported in containerized deployments yet. For more information, see ActiveGate purposes and functionality.

Network settings

Proxy

The proxy used for communication with the Dynatrace Cluster to which ActiveGate sends data.

Secret as a file	Description
`/var/lib/dynatrace/secrets/internal-proxy/host`	Server address.
`/var/lib/dynatrace/secrets/internal-proxy/port`	optional Port. If left empty, the default 8080 port is used.
`/var/lib/dynatrace/secrets/internal-proxy/scheme`	ActiveGate version 1.289+ optional Scheme. If left empty, the default `http` scheme is used. This applies the most common setup, where the connection to the proxy is initiated using HTTP and automatically upgraded to a secure one. All further ActiveGate communication through the proxy is secured by SSL/TLS. Must be set to `https` for proxies that do not support HTTP at all.
`/var/lib/dynatrace/secrets/internal-proxy/username`	optional User name.
`/var/lib/dynatrace/secrets/internal-proxy/password`	optional Password, see Proxy password requirements.

Advanced scenarios

For more advanced scenarios where one or more proxies are used for means other than communication with the Dynatrace Cluster, see Proxy for ActiveGate. Once you have crafted the required configuration, you can provide it to the ActiveGate container as a custom.properties file.

Rules for the proxy password

The proxy password needs to meet the following requirements.

Requirements	Corresponding characters
Characters allowed	[A-Za-z0-9] ! " # $ ( ) * - . / : ; < > ? @ [ ] ^ _ { \| }
Characters not allowed	blank space ' ` , & = + % \

Load balancer between ActiveGate and OneAgents

Dynatrace OneAgent accesses the ActiveGate via an auto-detected endpoint list. If a load balancer is placed on the path from OneAgent to the ActiveGate, such as Kubernetes Service, you need to explicitly set the endpoint to be used by OneAgents.

Environment variable	Example value
`DT_DNS_ENTRY_POINT`	`https://sg1.mydomain.com:9999`

Load balancer between ActiveGate and the Dynatrace Cluster

A reverse proxy or a load balancer can be placed on the path from an ActiveGate to the Dynatrace Cluster. This allows your ActiveGate to connect to any available node of the Cluster, spreading the load between the nodes.
To do this, you need to:

Provide the address of the reverse proxy/load balancer.
Ensure that ActiveGate will ignore any further target address information sent from the Dynatrace Cluster, and will thus connect only to the address you have specified.

ActiveGate connecting to Dynatrace Cluster via reverse proxy/load balancer

In this scenario, you need to set the following environment variables.

Environment variable	Example value
`DT_SERVER`	`https://load.balancer.com:9999`
`DT_IGNORE_CLUSTER_RUNTIME_INFO`	`true`

SSL settings

Custom SSL certificate

ActiveGate will serve a custom certificate instead of the default one. To configure this, you need a file in PKCS#12 format that contains a private key and its corresponding certificate chain. For more information, see Custom SSL certificate for ActiveGate.

Secret as a file	Description
`/var/lib/dynatrace/secrets/tls/server.p12`	Certificate file
`/var/lib/dynatrace/secrets/tls/password`	optional Certificate password
`/var/lib/dynatrace/secrets/tls/alias`	optional Certificate alias. The value must be specified in lower case.

Trusted root certificates

Additional trusted root certificates can be used by ActiveGate. To configure this, you need a file in the PEM format that contains a list of certificates to be included in the trust store. For more information, see Trusted root certificates for ActiveGate.

Secret as a file	Description
`/var/lib/dynatrace/secrets/rootca/rootca.pem`	Certificate file

HTTP port

An ActiveGate container by default opens HTTPS port 9999. If you require your ActiveGate to communicate over plain HTTP, you need to explicitly specify the HTTP port.

Environment variable	Example
`DT_HTTP_PORT`	`8888`

Advanced configuration

In addition to the configuration settings passed via environment variables or files, you can configure all other configuration settings by providing the contents of the custom.properties file.

Define ConfigMap.

kind: ConfigMap
apiVersion: v1
data:
  custom.properties: |-
    [vmware_monitoring]
    vmware_monitoring_enabled = true
metadata:
  name: vmware-config
  namespace: dynatrace

Reference ConfigMap in your deployment file.

[...]
      volumeMounts:
        [...]
        - name: ag-conf
          mountPath: /var/lib/dynatrace/gateway/config_template/custom.properties
          subPath: custom.properties
[...]
    volumes:
      - name: ag-conf
        configMap:
          name: vmware-config
          items:
          - key: custom.properties
            path: custom.properties