# Best Practices for Automating Dynatrace OneAgent Deployment via Chef

**URL:** <https://community.dynatrace.com/t/best-practices-for-automating-dynatrace-oneagent-deployment-via-chef/52061>\
**Category:** Open Q&A\
**Tags:** installation, technologies, oneagent, automation\
**Created:** [June 12, 2025, 11:12am UTC](https://community.dynatrace.com/t/best-practices-for-automating-dynatrace-oneagent-deployment-via-chef/52061 "2025-06-12T11:12:54Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Roeir5](https://avatars.discourse-cdn.com/v4/letter/r/50afbb/32.png) [@Roeir5](https://community.dynatrace.com/u/Roeir5)\
**Post date:** [June 12, 2025, 11:12am UTC](https://community.dynatrace.com/t/best-practices-for-automating-dynatrace-oneagent-deployment-via-chef/52061/1 "2025-06-12T11:12:54Z")

</div>

Hi Dynatrace Community,

We’re currently working on automating the deployment of **Dynatrace OneAgent** on virtual machine images using a **Chef cookbook**. The intended flow involves a shell script that:

1. Executes a wget command to download the OneAgent installer to the target VM,
2. Runs the modified installer with predefined parameters (e.g., custom log directory, monitoring mode, etc.).

To support this, we’ve ensured the following environment preparations:

- A persistent, mounted /opt/dynatrace directory with at least 5GB allocated,
- Verified connectivity across our internal network to reach Dynatrace SaaS/Managed servers as required.

However, I’m facing a few questions and would appreciate guidance from the community:

* * *

**1. Fixing or Dynamically Pulling Agent Versions**  
What is the best practice for downloading the installer via wget in a way that allows dynamically fetching the latest available version? since using wget command allows downloading and fetching only a fixed version of the agent.

**2. Download Token Expiry**  
Does the OneAgent download token have an expiration date or lifecycle policy I should be aware of?

**3. Token Rotation & Secure Usage**  
What is the recommended approach to securely rotate the download token and integrate it into a script used by the Chef cookbook? Any best practices for token management at scale would be greatly appreciated.

* * *

If anyone has successfully implemented a similar solution or has tips on robust agent deployment pipelines using configuration management tools, I’d love to hear about it.

Thanks in advance for your help and insights!

Roei

---

<div class="post-metadata">

**Author:** ![lubrman](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/lubrman/32/7353_2.png) [@lubrman](https://community.dynatrace.com/u/lubrman)\
**Post date:** [June 16, 2025, 8:43am UTC](https://community.dynatrace.com/t/best-practices-for-automating-dynatrace-oneagent-deployment-via-chef/52061/2 "2025-06-16T08:43:31Z")

</div>

Hi&nbsp;[@Roeir5](https://community.dynatrace.com/user/81319)

Wouldn’t it be better for you to use an Ansible role to run the installations instead of writing your own shell script?

> **[Ansible Galaxy](https://galaxy.ansible.com/ui/repo/published/dynatrace/oneagent/content/role/oneagent/)**

As for the token, you can define its validity within Dynatrace management.

Similarly, you can configure how often and to which version the OneAgent upgrade should be performed in the Settings → Updates → OneAgent updates section.