kubernetesSecurityPostureManagement.yaml

apiVersion: dynatrace.com/v1beta5
kind: DynaKube
metadata:
  name: dynakube
  namespace: dynatrace
  # annotations:
  #   feature.dynatrace.com/k8s-app-enabled: "true"
spec:
  # Link to api reference for further information: https://docs.dynatrace.com/docs/ingest-from/setup-on-k8s/reference/dynakube-parameters

  # Required: Dynatrace apiUrl including the `/api` path at the end.
  apiUrl: https://ENVIRONMENTID.live.dynatrace.com/api

  # Optional: Name of the secret holding the tokens used for connecting to Dynatrace.
  #
  # tokens: ""

  # Optional: Defines a custom pull secret in case you use a private registry when pulling images from the Dynatrace environment
  #
  # customPullSecret: "custom-pull-secret"

  # Optional: Disable certificate check for the connection between Dynatrace Operator and the Dynatrace Cluster.
  #
  # skipCertCheck: false

  # Optional: Set custom proxy settings either directly or from a secret with the field 'proxy'
  #
  # proxy:
  #   value: my-proxy-url.com
  #   valueFrom: name-of-my-proxy-secret

  # Optional: Add custom RootCAs from a configmap.
  #
  # trustedCAs: name-of-my-ca-configmap

  # Optional: Set a network zone for the OneAgent and ActiveGate pods.
  #
  # networkZone: name-of-my-network-zone

  # Optional: Configure istio to allow access to the Dynatrace Cluster from the OneAgent or ActiveGate pods.
  #
  # enableIstio: true

  # Optional: Minimum minutes between Dynatrace API requests.
  #
  # dynatraceApiRequestThreshold: 15

  # Configuration for Metadata Enrichment.
  #
  # metadataEnrichment:
  #   enabled: true

    # Optional: The namespaces where you want Dynatrace Operator to inject
    #
    # namespaceSelector:
    #   matchLabels:
    #     app: my-app
    #   matchExpressions:
    #   - key: app
    #     operator: In
  #     values: [my-frontend, my-backend, my-database]

  kspm:
    #  Define the host paths that are mounted to the container.
    #
    #  Suggested list of paths:
    mappedHostPaths:
      - /boot
      - /etc
      - /proc/sys/kernel
      - /sys/fs
      - /sys/kernel/security/apparmor
      - /usr/lib/systemd/system
      - /var/lib

  # Configuration for ActiveGate instances.
  #
  activeGate:
    # Defines the ActiveGate capabilities
    #
    capabilities:
      - kubernetes-monitoring

    # Optional: Amount of replicas of ActiveGate pods.
    #
    # replicas: 1

    # Optional: Use a custom ActiveGate image
    #
    # image: ""

    # Optional: Set the ActiveGate group
    #
    # group: ""

    # Optional: Add a custom properties file by providing it as a value or by referencing it from a secret.
    #
    # customProperties:
    #   value: |
    #     [kubernetes_monitoring]
    #     kubernetes_configuration_dataset_pipeline_enabled = true
    #     kubernetes_configuration_dataset_pipeline_include_node_config = true

    # Optional: Resource settings for ActiveGate container.
    #
    resources:
      requests:
        cpu: 500m
        memory: 1.5Gi
      limits:
        cpu: 1000m
        memory: 1.5Gi

    # Optional: Specify the node selector that controls on which nodes ActiveGate will be deployed.
    #
    # nodeSelector: {}

    # Optional: Set tolerations for the ActiveGate pods.
    #
    # tolerations:
    # - effect: NoSchedule
    #   key: node-role.kubernetes.io/master
    #   operator: Exists

    # Optional: Add custom labels to ActiveGate pods
    #
    # labels:
    #   custom: label

    # Optional: Add custom environment variables to ActiveGate pods
    #
    # env: []

    # Optional: Name of a secret containing ActiveGate TLS certificate, key, and password.
    #
    # tlsSecretName: "my-tls-secret"

    # Optional: Set the DNS policy for ActiveGate pods.
    #
    # dnsPolicy: "Default"

    # Optional: Assign a priority class to the ActiveGate pods.
    #
    # priorityClassName: priority-class

    # Optional: Add custom annotations to ActiveGate pods
    #
    # annotations:
    #   custom: annotation

    # Optional: Add TopologySpreadConstraints to the ActiveGate pods
    #
    # topologySpreadConstraints: []

  templates:
    kspmNodeConfigurationCollector:
      # Required: Configure the image for the Node Configuration Collector.
      imageRef:
        repository: public.ecr.aws/dynatrace/dynatrace-k8s-node-config-collector
        tag: <tag>

      # Optional: Define the update strategy for the Node Configuration Collector daemonSet
      #
      # updateStrategy: {}

      # Optional: Add custom labels to NNode Configuration Collector pods
      #
      # labels:
      #   custom: label

      # Optional: Add custom annotations to Node Configuration Collector pods.
      #
      # annotations:
      #   custom: annotation

      # Optional: Specify the node selector that controls on which nodes OneAgent will be deployed.
      #
      # nodeSelector: {}

      # Optional: Define the nodeAffinity for the DaemonSet of the Node Configuration Collector
      #
      # nodeAffinity: {}

      # Optional: Assign a priority class to the Node Configuration Collector pods.
      #
      # priorityClassName: priority-class

      # Optional: Tolerations to include with the Node Configuration Collector DaemonSet.
      #
      tolerations:
        - effect: NoSchedule
          key: node-role.kubernetes.io/master
          operator: Exists
        - effect: NoSchedule
          key: node-role.kubernetes.io/control-plane
          operator: Exists

      # Optional: Resource settings for Node Configuration Collector container.
      #
      # resources: {}

      # Optional: Set additional arguments to the Node Configuration Collector.
      #
      # args: []

      # Optional: Set additional environment variables for the Node Configuration Collector pods.
      #
      # env: []