Hi Dynatrace,
We have trouble deploying CloudNative Dynatrace in OpenShift clusters.
Can you confirm us that these "hybrid" architecture is valid ?
- Install CloudNative Dynatrace in OpenShift clusters with Company trustedCA in Dynakube
- Private docker registry holding OneAgent and codemodules images exposing the Company certificate (green box on the left)
- ActiveGate VM with Dynatrace self signed Certificate (purple box)
- Company Internet Proxy (no certificate)
- Notice that we have many oneagent deployed in virtual machine. These oneagents trust the ActiveGate VM Certificate.
- We don't want to change the exposed certificate of ActiveGate.
When we add the trustedCAs field in the dynakube configuration, the communication between oneagent pod and activegate vm are broken (invalid certificate).
In my opinion, the problem is that when you configure a trustedCA in Kubernetes, it will use it for all outgoing communication. Now: when the OneAgents want to sent out that information, it'll mismatch with the self-signed one.
You could potentially test this to add it to 1 of the Environment ActiveGate and put that one in a network zone.
if this doesn't help, I'd recommend getting Dynatrace support onboard to figure out what the best solution for you is.
Featured Posts
