OpenTelemetry Operator for Dynatrace (metrics)

Install the OpenTelemetry Operator in hawk-monitor with cert-manager + ClusterIssuer for webhook TLS, then deploy a collector that sends metrics (and optionally traces/logs) to Dynatrace.

Prerequisites

• Kubernetes cluster (1.23+)
• cert-manager installed (any namespace; ClusterIssuer is cluster-scoped)
• A cert-manager ClusterIssuer (e.g. the one you see in hawk-monitor)
• Dynatrace environment URL and API token with ingest permissions

0. Install CRDs (cluster has no CRDs)

This setup does not let Helm create CRDs (crds.create: false). Install the operator CRDs once before installing the operator:

./install-crds.sh

This pulls the OpenTelemetry Operator Helm chart and applies only the CRDs. Then proceed to install the operator with Helm (step 2).

1. Cert-manager and ClusterIssuer

Installation is in hawk-monitor. The operator Helm chart creates a Certificate in that namespace; cert-manager uses your ClusterIssuer (cluster-scoped) to issue the webhook TLS cert.

• Set admissionWebhooks.certManager.issuerRef.name in values-certmanager.yaml to the ClusterIssuer name you see in hawk-monitor (e.g. kubectl get clusterissuer). Default in values is platform-selfsigned.

2. Install OpenTelemetry Operator with Helm

helm repo add open-telemetry https://open-telemetry.github.io/opentelemetry-helm-charts
helm repo update

# Install operator in hawk-monitor; webhook cert from cert-manager + ClusterIssuer
helm upgrade -i opentelemetry-operator open-telemetry/opentelemetry-operator \
  --namespace hawk-monitor \
  --create-namespace \
  -f values-certmanager.yaml

3. Dynatrace credentials secret

Edit dynatrace-credentials-secret.yaml: set DT_ENDPOINT and DT_API_TOKEN, and the metadata.namespace if needed. Then:

kubectl apply -f dynatrace-credentials-secret.yaml

• DT_ENDPOINT: e.g. https://<your-environment>.live.dynatrace.com/api/v2/otlp (from Dynatrace → Settings → Integration → OpenTelemetry).
• DT_API_TOKEN: token with “Ingest OpenTelemetry traces” and/or “Ingest metrics” (and logs if you enable those pipelines).

4. Deploy Dynatrace collector (metrics to Dynatrace)

Ensure the collector manifest uses the same namespace as the secret, then:

kubectl apply -f dynatrace-collector-metrics.yaml

This runs the Dynatrace OTel Collector in deployment (gateway) mode and sends metrics to Dynatrace. To also send traces and logs, uncomment the traces and logs pipelines in dynatrace-collector-metrics.yaml.

5. Verify

• Operator: kubectl get pods -n hawk-monitor -l app.kubernetes.io/name=opentelemetry-operator
• Collector: kubectl get pods in the namespace where you applied dynatrace-collector-metrics.yaml
• Certificates: kubectl get certificate -n hawk-monitor
• In Dynatrace: check metrics (and traces/logs if enabled) for your environment

Files

File	Purpose
values-certmanager.yaml	Helm values (namespace hawk-monitor; cert-manager + ClusterIssuer; crds.create: false)
install-crds.sh	Installs OpenTelemetry Operator CRDs only (run before Helm install)
install.sh	Installs the operator via Helm (expects CRDs already installed)
dynatrace-credentials-secret.yaml	Template secret for Dynatrace endpoint and API token
dynatrace-collector-metrics.yaml	OpenTelemetryCollector CR that sends metrics to Dynatrace

Namespace and endpoints

Operator and collector run in hawk-monitor. cert-manager (with your ClusterIssuer) is used only for the operator’s admission webhook TLS. The collector sends metrics to Dynatrace’s OTLP URL (or your proxy).