topic Re: OpenShift Dynakube capability "ingest" and custom certificate (tlsSecretName param). Any one got it to work ? in Dynatrace API

OpenShift Dynakube capability "ingest" and custom certificate (tlsSecretName param). Any one got it to work ?

gilles_tabary — Mon, 07 Sep 2026 14:28:13 GMT

Hello All.

This post is a kind of follow up of old post "Dynatrace V2 Metrics API + Kubernetes - How to configure localhost V2 API endpoint ?"

Spec: : Managed 1.344 + ActiveGate 1.327 + OCP 4.21.22 + Dynakube operator 1.7.3.

In our Kubernetes / OpenShift cluster, we have successfully set an ActiveGate workload with capability ingest. Fine. We need to go the extra step of setting up custom SSL/TLS cert through param tlsSecretName along How to add a custom certificate for ActiveGate documentation. Yet we get an ActiveGate displaying a "not ready" state, with oc events displaying such error :

Warning Unhealthy 76s (x65 over 16m) kubelet Readiness probe failed: Get "https://xx.yyy.zzz.ttt:9999/rest/health": tls: invalid signature by the server certificate: crypto/rsa: verification error

We are puzzled by how to generate our custom cert with a dynamic IP each time new, which may change dynamically ? Should we ? Our custom certs uses OpenShift cluster internal FQDN, not dynamic IPs. We see in the default OepenShift dynatrace self-signed certs a DNS Alt Name made of an other IP. Hmmm 🤔

Any one successfully set custom certs in this context ? Any feed back ?

Regards.

Gilles

Re: OpenShift Dynakube capability "ingest" and custom certificate (tlsSecretName param). Any one got it to work ?

Julius_Loman — Mon, 07 Sep 2026 18:04:32 GMT

I have this set up with OpenShift, and I did not encounter such issues, just my version of the Dynatrace Operator is 1.10.2 . The certificate is issued for the service name create by the operator , <dynakube name>-activegate.dynatrace

What CN and SNI has the certificate you use? What does the Dynatrace ActiveGate serve?

Re: OpenShift Dynakube capability "ingest" and custom certificate (tlsSecretName param). Any one got it to work ?

gilles_tabary — Tue, 08 Sep 2026 08:18:34 GMT

We got it to work by inserting in the OpenShift ActiveGate cert, the full CA chain.

Re: OpenShift Dynakube capability "ingest" and custom certificate (tlsSecretName param). Any one got it to work ?

gilles_tabary — Tue, 08 Sep 2026 08:20:19 GMT

Thanks for feedback. Helps to know it works for you. It also reminds me we have to update operator (even though it may not be the thing fixing my issue).