OpenShift Dynakube capability "ingest" and custom certificate (tlsSecretName param). Any one got it to work ?

[gilles_tabary]

Hello All.

This post is a kind of follow up of old post "Dynatrace V2 Metrics API + Kubernetes - How to configure localhost V2 API endpoint ?"

Spec: : Managed 1.344 + ActiveGate 1.327 + OCP 4.21.22 + Dynakube operator 1.7.3.

In our Kubernetes / OpenShift cluster, we have successfully set an ActiveGate workload with capability ingest. Fine. We need to go the extra step of setting up custom SSL/TLS cert through param tlsSecretName along How to add a custom certificate for ActiveGate documentation. Yet we get an ActiveGate displaying a "not ready" state, with oc events displaying such error : 

Warning  Unhealthy       76s (x65 over 16m)  kubelet            Readiness probe failed: Get "https://xx.yyy.zzz.ttt:9999/rest/health": tls: invalid signature by the server certificate: crypto/rsa: verification error

We are puzzled by how to generate our custom cert with a dynamic IP each time new, which may change dynamically ? Should we ? Our custom certs uses OpenShift cluster internal FQDN, not dynamic IPs. We see in the default OepenShift dynatrace self-signed certs a DNS Alt Name made of an other IP. Hmmm 🤔

Any one successfully set custom certs in this context ? Any feed back ?

Regards.

Gilles

[Julius_Loman]

I have this set up with OpenShift, and I did not encounter such issues, just my version of the Dynatrace Operator is 1.10.2 . The certificate is issued for the service name create by the operator , <dynakube name>-activegate.dynatrace 

What CN and SNI has the certificate you use? What does the Dynatrace ActiveGate serve?

[gilles_tabary]

Thanks for feedback. Helps to know it works for you. It also reminds me we have to update operator (even though it may not be the thing fixing my issue).

[gilles_tabary · Accepted solution]

We got it to work by inserting in the OpenShift ActiveGate cert, the full CA chain.