Proxy config for k8s synthetic metric adapter

[Enrico_F]

Has anybody had any success with deploying containerized, auto-scalable private synthetic locations in "air-gapped" K8s namespaces where egress to the Dynatrace SaaS cloud is only possible via HTTP proxy?

I'm asking because it seems there are no instructions about how to configure a proxy with the metrics adapter template - only for the location template.

I'm referring to this documentation:

https://docs.dynatrace.com/docs/platform-modules/digital-experience/synthetic-monitoring/private-syn...

As per the generated metric adapter template the deployment "dynatrace-metrics-apiserver" obviously wants to communicate with the public API endpoint on SaaS configured via env var BASE_URL:

apiVersion: apps/v1
kind: Deployment
metadata:
  ...
spec:
  ...
  template:
    ...
    spec:
      ...
      containers:
        - name: dynatrace-metrics-apiserver
          image: dynatrace/dynatrace-synthetic-adapter:latest
          env:
            - name: BASE_URL
              value: "https://abcdef.live.dynatrace.com/e/abcdef"
          imagePullPolicy: Always
          args:
            - --secure-port=6443
            - --cert-dir=/tmp
          ports:
            - name: https
              containerPort: 6443
          volumeMounts:
            - name: temp-vol
              mountPath: /tmp
            - name: dynametric
              mountPath: /var/lib/dynatrace/secrets/dynametric
              readOnly: true
          ...
      ...

On our k8s cluster this will not work as direct egress is not allowed.

[HannahM]

I don't believe that it is currently possible to add proxy settings for the metric adapter. I'm checking into it

[Enrico_F]

Hi @HannahM 

Thanks for looking into this - appreciated!

If a proxy config is not currently supported the other option would be to connect to an internal API endpoint on one of our ActiveGates that is reachable directly from the namespace, but that would require either allowing insecure TLS comms or the configuration of a custom CA in the trust store (since our AG's use a server cert that is signed by a private CA).

[Peter_Youssef]

Hi @Enrico_F 

have you checked customizing proxy configurations in Dynakube.yaml on the K8s cluster.

BR, 

Peter.

[Enrico_F]

No, because 

1. our expectation is that containerized, auto-scalable private synthetic locations must be completely decoupled from the Dynatrace operator namespace.
2. I don't see why that would have any effect as there is no requirement/dependency mentioned with regards to the Dynatrace operator in the documentation.
3. we don't have direct access to the Dynatrace operator namespace (it's part of the OpenShift PaaS)

[Peter_Youssef]

Hello @Enrico_F 

You can check the attached configurations: https://docs.dynatrace.com/docs/shortlink/sgw-configure#synth_mod 

Hoping it adds value.

BR,

Peter.

[Enrico_F]

Thanks. I'm already familiar with the ActivGate properties but IMO this is not really relevant here as my question is not specifically about the ActiveGate itself but rather about the synthetic (metric) adapter component that's required for auto-scaling containerized private locations on K8s.

[Peter_Youssef]

Thanks @Enrico_F for feedback.

what about checking this section https://docs.dynatrace.com/docs/shortlink/sgw-proxy-authentication#advanced 

Regards,

[Enrico_F]

Already checked - none of that applies to the synthetic adapter component. But thanks anyway.

[Enrico_F · Accepted solution]

FWIW: In the meantime this was acknowledged by support as something that got missed during initial design and will be addressed in sprint 305 (expected for late January 2025).

[Peter_Youssef]

Thanks @Enrico_F for the update.

BR,

Peter

[HannahM · Accepted solution]

Some good news on this one, the fix has been backported to the 303 ActiveGate. So should be available in the next couple of weeks. 

[Peter_Youssef]

Thanks @HannahM for the good news 🗞😊