dt-setup-oneagent — Skillopedia

Deploy Dynatrace OneAgent — knowledge reference This skill is reference-only . It contains the documented endpoints, environment variables, token scopes, and commands that an operator (or another agent) needs to install OneAgent manually across the supported targets. It executes nothing. This skill gives you the commands; it does not run them. Follow the procedure for the target you need, substituting the environment URL and token as documented below. Hard rules for any agent consuming this skill - Operate only on resources the user explicitly named. Never create a placeholder/test Lambda, IA…

|| true)\"\n\naws lambda update-function-configuration \\\n --region \"$LAMBDA_REGION\" \\\n --function-name \"$LAMBDA_FN\" \\\n --layers \"$DYNATRACE_LAYER_ARN\" $KEEP_LAYERS \\\n --environment \"$MERGED_ENV\"\n```\n\nThen wait until `LastUpdateStatus=Successful` before invoking the function.\n\n### Create a new function and install OneAgent\n\nCreating the function and instrumenting it in one go. Provisions **exactly two** resources for the named function, then attaches OneAgent the same way as the existing-function path. No extra logging, monitoring, or helper resources — anything beyond this is out of scope.\n\n| Resource | Name | Notes |\n|---|---|---|\n| Lambda function | exactly the value the user passed | runtime + arch default to `python3.12` / `x86_64`; placeholder handler returning `{statusCode: 200}` |\n| IAM execution role | `${LAMBDA_FN}-dt-execution-role` | trust policy: `lambda.amazonaws.com`; managed policy: `AWSLambdaBasicExecutionRole` |\n\nSupported runtimes for the placeholder handler: `python*` and `nodejs*`. For Java, .NET, Go, or custom runtimes, create the function out-of-band with the real artifact, then use the CLI attach path on the existing function.\n\n**Step 1 — Create the execution role:**\n\n```bash\naws iam create-role \\\n --role-name \"${LAMBDA_FN}-dt-execution-role\" \\\n --description \"Execution role for Lambda ${LAMBDA_FN}\" \\\n --assume-role-policy-document '{\n \"Version\":\"2012-10-17\",\n \"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"lambda.amazonaws.com\"},\"Action\":\"sts:AssumeRole\"}]\n }'\n\naws iam attach-role-policy \\\n --role-name \"${LAMBDA_FN}-dt-execution-role\" \\\n --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole\n\n# IAM is eventually consistent — a freshly created role is often not yet\n# assumable by lambda:CreateFunction. ~10s is the documented workaround.\nsleep 10\n\nROLE_ARN=$(aws iam get-role --role-name \"${LAMBDA_FN}-dt-execution-role\" \\\n --query 'Role.Arn' --output text)\n```\n\n**Step 2 — Build a minimal deployment package.** Python (default) shown; the matching Node.js handler is below.\n\n```bash\nTMP=$(mktemp -d)\ncat > \"$TMP/lambda_function.py\" \u003c\u003c'PY'\ndef lambda_handler(event, context):\n return {\"statusCode\": 200, \"body\": \"Placeholder handler — OneAgent instrumentation attached.\"}\nPY\n( cd \"$TMP\" && zip -q -r \"/tmp/${LAMBDA_FN}.zip\" . )\n# Handler string for create-function: \"lambda_function.lambda_handler\"\n```\n\nNode.js variant (`--runtime nodejs20.x` etc.):\n\n```bash\ncat > \"$TMP/index.mjs\" \u003c\u003c'JS'\nexport const handler = async (event) => ({\n statusCode: 200,\n body: \"Placeholder handler — OneAgent instrumentation attached.\",\n});\nJS\n# Handler string for create-function: \"index.handler\"\n```\n\n**Step 3 — Create the function:**\n\n```bash\naws lambda create-function \\\n --region \"$LAMBDA_REGION\" \\\n --function-name \"$LAMBDA_FN\" \\\n --runtime python3.12 \\\n --architectures x86_64 \\\n --role \"$ROLE_ARN\" \\\n --handler lambda_function.lambda_handler \\\n --zip-file \"fileb:///tmp/${LAMBDA_FN}.zip\"\n\naws lambda wait function-active \\\n --region \"$LAMBDA_REGION\" \\\n --function-name \"$LAMBDA_FN\"\n```\n\n**Step 4 — Attach OneAgent.** Use the \"CLI attach\" command above against the newly created function. The layer ARN comes from the Dynatrace layer-ARN API (see *Layer ARN auto-discovery* — pass the same runtime/region/architecture you just created).\n\n**Idempotency:** if the function or role already exists, `create-*` calls fail with `EntityAlreadyExists` / `ResourceConflictException`; treat those as no-ops and proceed to attach.\n\n**Teardown** is the caller's responsibility — uninstall (below) removes only the OneAgent layer + env vars. To delete the function and role entirely:\n\n```bash\naws lambda delete-function --function-name \"$LAMBDA_FN\" --region \"$LAMBDA_REGION\"\naws iam detach-role-policy --role-name \"${LAMBDA_FN}-dt-execution-role\" \\\n --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole\naws iam delete-role --role-name \"${LAMBDA_FN}-dt-execution-role\"\n```\n\n**Gotchas:**\n\n- `aws lambda update-function-configuration --environment` accepts **JSON** for the whole parameter (`{\"Variables\":{…}}`) or **shorthand** (`Variables={K=v,K=v}`). It does *not* accept `Variables=\u003cjson>`. Mixing the two fails with `Expected: '=', received: '\"'`.\n- Before mutating, capture a backup with `aws lambda get-function-configuration --function-name \u003cfn> > \u003cfn>.config.backup.json`. To revert: `--layers $(jq -r '.Layers[]?.Arn' backup.json)` and `--environment \"$(jq -c '{Variables: (.Environment.Variables // {})}' backup.json)\"`.\n- If you take a backup *after* OneAgent was already attached, the backup is poisoned — restoring it re-instruments the function. Always check `current_has_dynatrace` before overwriting an existing backup file.\n\n### Storing the runtime token in AWS Secrets Manager (preferred)\n\nWrite the token to a `0600` file first — `--secret-string \"$DT_API_TOKEN\"` would put it in the AWS CLI's command line, visible to `ps`:\n\n```bash\numask 077\nTOKEN_FILE=\"$(mktemp)\"\ntrap 'rm -f \"$TOKEN_FILE\"' EXIT\nprintf '%s' \"$DT_API_TOKEN\" > \"$TOKEN_FILE\"\n```\n\n```bash\nSECRET_ARN=$(aws secretsmanager create-secret \\\n --region \"$LAMBDA_REGION\" \\\n --name \"dynatrace/oneagent/${LAMBDA_FN}/auth-token\" \\\n --secret-string \"file://$TOKEN_FILE\" \\\n --query ARN --output text)\n\n# Grant the function's execution role read on this one secret\naws iam put-role-policy --role-name \"$FN_ROLE\" \\\n --policy-name Dynatrace-OneAgent-SecretAccess \\\n --policy-document \"$(jq -nc --arg arn \"$SECRET_ARN\" '\n {Version:\"2012-10-17\", Statement:[{Effect:\"Allow\",\n Action:\"secretsmanager:GetSecretValue\", Resource:$arn}]}')\"\n```\n\nThen set `DT_CONNECTION_AUTH_TOKEN_SECRETS_MANAGER_ARN=$SECRET_ARN` on the function (instead of the inlined `DT_CONNECTION_AUTH_TOKEN`).\n\n### Surgical uninstall (no backup available)\n\n```bash\nCFG=$(aws lambda get-function-configuration --region \"$R\" --function-name \"$F\")\n\nKEEP_LAYERS=( $(echo \"$CFG\" | jq -r '.Layers[]?.Arn | select(test(\"dynatrace\"; \"i\") | not)') )\nKEEP_ENV_JSON=$(echo \"$CFG\" | jq -c '{\n Variables: (.Environment.Variables // {}\n | with_entries(select(.key | test(\"^DT_|^AWS_LAMBDA_EXEC_WRAPPER$\") | not)))\n}')\n\nLAYER_ARGS=(--layers)\n[ \"${#KEEP_LAYERS[@]}\" -gt 0 ] && LAYER_ARGS=(--layers \"${KEEP_LAYERS[@]}\")\n\naws lambda update-function-configuration --region \"$R\" --function-name \"$F\" \\\n \"${LAYER_ARGS[@]}\" --environment \"$KEEP_ENV_JSON\"\n```\n\nWhen the Dynatrace layer was the function's only layer, `KEEP_LAYERS` is empty and the call is made with a bare `--layers`. That is intentional and correct: it sends an empty layer list, which is the documented way to detach every layer. Do **not** \"fix\" this by passing `--layers ''` — an empty string is validated as a layer ARN and the CLI rejects it before the request is sent (`Invalid length for parameter Layers[0], value: 0, valid min length: 1`), which breaks the most common uninstall case.\n\n### Verifying instrumentation\n\nThe definitive signals that OneAgent is actually loaded by the runtime are:\n\n1. A layer ARN containing `Dynatrace_OneAgent_…` in `Layers[].Arn`, **and**\n2. `AWS_LAMBDA_EXEC_WRAPPER=/opt/dynatrace` in the function's environment.\n\n`DT_TENANT`, `DT_CONNECTION_BASE_URL`, etc. are *not* sufficient on their own — application code commonly sets them for its own Dynatrace API calls. Use both signals together.\n\n---\n","content_type":"text/markdown; charset=utf-8","language":"markdown","size":13387,"content_sha256":"6e53ae6ee47c78eb6b567cc0bafb0691f549c1c5fdabd2909019319b4c7a45bf"},{"filename":"references/azure-vm.md","content":"# Azure VM / VM Scale Set (OneAgent VM extension)\n\nInstalling OneAgent on an Azure VM or Virtual Machine Scale Set through the Dynatrace VM extension, driven remotely with `az` — you do not need to be on the machine.\n\nPart of the `dt-setup-oneagent` skill — see [../SKILL.md](../SKILL.md) for the hard rules, URL normalization and token guidance that apply to every target.\n\nList what your subscription actually offers before you start — this resolves both the publisher and the extension type for your region:\n\n```bash\naz vm extension image list --publisher dynatrace.ruxit --location \u003cregion> -o table\n```\n\n---\n\n### A note on the identifiers\n\n`dynatrace.ruxit` is the publisher — it is what docs.dynatrace.com documents and what appears in Microsoft's `azure-resource-manager-schemas` publisher enum. If you find a write-up using `dynatrace.ruxitagents`, it is wrong; that string exists nowhere in Azure's own metadata.\n\nExtension **type** is less settled. Current Dynatrace documentation gives `oneAgentLinux` / `oneAgentWindows`, which is what this page uses. Microsoft's ARM schema for the older `2015-08-01` API version lists `ruxitAgentLinux` / `ruxitAgentWindows`, which appears to be the legacy naming. The `extension image list` command above resolves which your subscription actually offers.\n\nOneAgent on Azure VMs is shipped as a Marketplace **VM extension**. The extension wraps the same Linux/Windows installer used elsewhere, but the install is driven remotely via `az ... extension set` — you do **not** need to be on the VM. AKS clusters are covered by the Kubernetes flow above, not this one.\n\n### Extension identity\n\n| Field | Value |\n|---|---|\n| Publisher | `dynatrace.ruxit` |\n| Type (Linux) | `oneAgentLinux` |\n| Type (Windows) | `oneAgentWindows` |\n| Version | use `1.*` (or the explicit latest published version) |\n\n**Marketplace prerequisite:** the first use in a subscription requires accepting the offer once via Azure Marketplace. If `az ... extension set` returns `MarketplacePurchaseEligibilityFailed`, that's the cause.\n\n### Settings payload\n\nSplit between `--settings` (public, returned by `az ... extension show`) and `--protected-settings` (encrypted at rest; not returned on read):\n\n```json\n// --settings (public)\n{\n \"tenantId\": \"\u003cenv-id>\", // e.g. \"abc12345\"\n \"server\": \"https://\u003cenv-id>.live.dynatrace.com\", // normalized env URL\n \"hostGroup\": \"\u003coptional>\", // optional\n \"monitoringMode\": \"fullStack|infraOnly|discoveryMode\", // optional, camelCase\n \"enableLogAnalytics\": \"yes\" // optional, documented by Dynatrace\n}\n\n// --protected-settings (encrypted)\n{\n \"token\": \"dt0c01.…\" // PaaS token, InstallerDownload scope\n}\n```\n\n**Always put the token in `protectedSettings`.** Dynatrace recommends this from extension version 2.200.0.0 onward, though some example snippets still show it inside the public `settings` block. The distinction matters: `settings` is returned verbatim by `az ... extension show`, so anyone with Reader on the resource can retrieve the token — a far wider audience than the people you deliberately gave it to. `protectedSettings` is encrypted at rest and never returned on read.\n\n`monitoringMode` uses camelCase (`fullStack`, `infraOnly`, `discoveryMode`) — different from the kebab-case (`fullstack`, `infra-only`, `discovery`) accepted by the Linux installer one-liner.\n\n### Detect kind + OS\n\nThe same name can be a VM or a VMSS, and the right extension type depends on the OS. Cheap pair of API calls:\n\n```bash\n# Is it a VM?\naz vm show -g \"$RG\" -n \"$NAME\" --query storageProfile.osDisk.osType -o tsv\n# Or a VMSS?\naz vmss show -g \"$RG\" -n \"$NAME\" --query virtualMachineProfile.storageProfile.osDisk.osType -o tsv\n```\n\nEither returns `Linux` or `Windows`; lowercase it and pick the matching extension type.\n\n### Install — Azure VM\n\nAzure encrypts protected settings at rest and never returns them from `az … extension show`, but an inline `--protected-settings '{\"token\":\"…\"}'` still puts the token in your shell history and in `ps` output for the duration of the call. Pass it via a `0600` file instead — `az` accepts `@filename` for both settings arguments:\n\n```bash\numask 077\nPROT=\"$(mktemp)\"\ntrap 'rm -f \"$PROT\"' EXIT\nprintf '{\"token\":\"%s\"}\\n' \"$DT_API_TOKEN\" > \"$PROT\"\n\naz vm extension set \\\n --resource-group \"$RG\" --vm-name \"$VM\" \\\n --publisher dynatrace.ruxit --name \"$EXT\" \\\n --settings '{\"tenantId\":\"\u003cenv-id>\",\"server\":\"https://\u003cenv-id>.live.dynatrace.com\"}' \\\n --protected-settings \"@$PROT\"\n```\n\nWhere `$EXT` is `oneAgentLinux` or `oneAgentWindows`. Provisioning typically takes 1–3 minutes; Azure runs the agent installer behind the scenes.\n\n### Install — Azure VM Scale Set (VMSS)\n\nSame shape, different verb. The extension attaches to the VMSS **model**, not to live instances:\n\n```bash\numask 077\nPROT=\"$(mktemp)\"\ntrap 'rm -f \"$PROT\"' EXIT\nprintf '{\"token\":\"%s\"}\\n' \"$DT_API_TOKEN\" > \"$PROT\"\n\naz vmss extension set \\\n --resource-group \"$RG\" --vmss-name \"$VMSS\" \\\n --publisher dynatrace.ruxit --name \"$EXT\" \\\n --settings '{\"tenantId\":\"\u003cenv-id>\",\"server\":\"https://\u003cenv-id>.live.dynatrace.com\"}' \\\n --protected-settings \"@$PROT\"\n\n# New instances pick it up on next boot. Existing instances need an explicit\n# update (or rely on the VMSS's upgrade policy):\naz vmss update-instances -g \"$RG\" -n \"$VMSS\" --instance-ids '*'\n```\n\n### Uninstall\n\nRemoving the extension triggers the agent's uninstall handler on the live machine(s):\n\n```bash\n# VM\naz vm extension delete -g \"$RG\" --vm-name \"$VM\" --name \"$EXT\"\n\n# VMSS (also remove from the model; existing instances keep the agent\n# until reimage/reboot or an explicit update-instances).\naz vmss extension delete -g \"$RG\" --vmss-name \"$VMSS\" --name \"$EXT\"\naz vmss update-instances -g \"$RG\" -n \"$VMSS\" --instance-ids '*'\n```\n\nFind any Dynatrace-published extensions on a resource (regardless of whether it's `oneAgentLinux` or `oneAgentWindows`):\n\n```bash\naz vm extension list -g \"$RG\" --vm-name \"$VM\" --query \"[?publisher=='dynatrace.ruxit'].name\" -o tsv\naz vmss extension list -g \"$RG\" --vmss-name \"$VMSS\" --query \"[?publisher=='dynatrace.ruxit'].name\" -o tsv\n```\n\n### Verifying\n\nThe definitive signals that the extension is attached and healthy:\n\n1. `publisher == 'dynatrace.ruxit'` shows up in `az ... extension list`, **and**\n2. `provisioningState == 'Succeeded'` on that entry.\n\n```bash\naz vm extension list -g \"$RG\" --vm-name \"$VM\" \\\n --query \"[?publisher=='dynatrace.ruxit'].{name:name,state:provisioningState}\" -o tsv\n```\n\nA `provisioningState` of `Failed` typically means: missing RBAC (`Microsoft.Compute/.../extensions/write`), an invalid token, the wrong server URL (forgot the `https://` or used the unnormalized `apps.dynatrace.com` host), or the marketplace offer hasn't been accepted yet in the subscription.\n\n### Gotchas\n\n- **Server URL normalization applies here too.** Use `\u003cenv-id>.live.dynatrace.com` (or the regional `dynatracelabs.com` host), **not** the `apps.dynatrace.com` UI URL. See *URL normalization* at the top of this doc.\n- **AKS is not Azure VM.** Even though AKS node pools are technically VMSSes, do not install the VM extension on them — use the Kubernetes Operator + DynaKube path. The OneAgent CSI driver and operator handle pod-level injection in a way the VM extension can't.\n- **Azure Functions / App Service / Container Apps** use different mechanisms (site extension or app settings env vars) and are **not** covered by `dynatrace.ruxit`. They are explicitly out of scope for this skill.\n- **VMSS model vs instances.** The extension is part of the model. New scale-out picks it up automatically; existing instances need `az vmss update-instances --instance-ids '*'` (or the VMSS's automatic upgrade policy). Same caveat on uninstall.\n- **Protected-settings retrieval.** `az ... extension show` returns `--settings` but **not** `--protected-settings`. The token is encrypted at rest; you cannot recover it from Azure later. Plan for that — keep the token in your own secret store, not \"I'll read it back from Azure.\"\n","content_type":"text/markdown; charset=utf-8","language":"markdown","size":8186,"content_sha256":"ca94bee7a1fa907afc2e9cb953baf896af3f546bd1f39b0f331fbfc0ad4c2d8f"},{"filename":"references/kubernetes.md","content":"# Kubernetes — Dynatrace Operator and DynaKube\n\nOperator install via Helm or manifest, the dynakube secret, a cloud-native full-stack DynaKube CR, and an ordered uninstall.\n\nPart of the `dt-setup-oneagent` skill — see [../SKILL.md](../SKILL.md) for the hard rules, URL normalization and token guidance that apply to every target.\n\n---\n\nThe Operator runs in the `dynatrace` namespace and reconciles a `DynaKube` CR. Both the operator and the CR are needed.\n\n### 1. Install the operator\n\n**Helm (recommended, Helm 3+):**\n\n```bash\nhelm upgrade --install dynatrace-operator oci://public.ecr.aws/dynatrace/dynatrace-operator \\\n --version 1.9.0 \\\n --create-namespace --namespace dynatrace --atomic\n```\n\nNote OCI chart tags are unprefixed (`1.9.0`), but GitHub release tags use `v1.9.0`.\n\nBoth forms pin a **version**, not a digest. A published GitHub release asset is stable in practice, but an OCI tag can in principle be re-pushed, so `--version 1.9.0` is a weaker guarantee than a content hash. If your environment requires immutability, resolve the chart to a digest with `helm pull` and reference that, and mirror the CSI manifest into a location you control rather than fetching it from github.com at apply time. Pin the operator version deliberately either way — leaving it unset installs whatever is newest, which is not what you want in a cluster you intend to reproduce.\n\n**Manifest fallback (no Helm):**\n\n```bash\nkubectl create namespace dynatrace\nkubectl apply -f https://github.com/Dynatrace/dynatrace-operator/releases/download/v1.9.0/kubernetes-csi.yaml\nkubectl -n dynatrace wait pod \\\n --for=condition=ready \\\n --selector=app.kubernetes.io/name=dynatrace-operator,app.kubernetes.io/component=webhook \\\n --timeout=300s\n```\n\n### 2. Create the `dynakube` secret\n\nDo **not** use `kubectl create secret --from-literal=apiToken=$DT_API_TOKEN`: that places the token in kubectl's own command line, where any local user can read it from the process list for the duration of the call. Pipe a manifest instead — `printf` is a shell builtin and `base64` reads stdin, so the value never becomes an argument:\n\n```bash\nkubectl -n dynatrace apply -f - \u003c\u003cEOF\napiVersion: v1\nkind: Secret\nmetadata:\n name: dynakube\n namespace: dynatrace\ntype: Opaque\ndata:\n apiToken: $(printf '%s' \"$DT_API_TOKEN\" | base64 | tr -d '\\n')\n dataIngestToken: $(printf '%s' \"$DT_DATA_INGEST_TOKEN\" | base64 | tr -d '\\n')\nEOF\n```\n\n`dataIngestToken` can equal `apiToken` if you don't have a separate ingest token. Applying the manifest is also idempotent — re-running it rotates the stored token rather than failing on an existing secret.\n\n### 3. Apply a DynaKube CR (cloud-native full-stack mode)\n\n```yaml\napiVersion: dynatrace.com/v1beta5 # storage version in operator v1.9.0; check the CRD if you've upgraded\nkind: DynaKube\nmetadata:\n name: dynakube\n namespace: dynatrace\n annotations:\n feature.dynatrace.com/k8s-app-enabled: \"true\"\n feature.dynatrace.com/injection-readonly-volume: \"true\"\nspec:\n apiUrl: ${DT_ENV_URL_NORMALIZED}/api # note the trailing /api\n metadataEnrichment:\n enabled: true\n oneAgent:\n cloudNativeFullStack:\n tolerations:\n - effect: NoSchedule\n key: node-role.kubernetes.io/master\n operator: Exists\n - effect: NoSchedule\n key: node-role.kubernetes.io/control-plane\n operator: Exists\n activeGate:\n capabilities: [routing, kubernetes-monitoring]\n resources:\n requests: { cpu: 500m, memory: 512Mi }\n limits: { cpu: 1000m, memory: 1.5Gi }\n```\n\nAlways run `kubectl apply --dry-run=server -f dynakube.yaml` first — the operator webhook produces meaningful validation errors.\n\n### AWS EKS specifics\n\nOn standard EKS with EC2 or bare-metal nodes there is nothing to do differently — Dynatrace documents *\"No specific configuration is required for EKS.\"* Same operator install, same secret, same DynaKube. The differences are all driven by **node type**:\n\n| Node type | What works |\n|---|---|\n| EC2 / bare-metal | Everything. Full-stack, CSI driver, no special config |\n| **Fargate** | `applicationMonitoring` **only**, without the CSI driver. No DaemonSet is possible — Fargate gives you no nodes to place one on |\n| **Bottlerocket** | `applicationMonitoring` only. Platform Observability via OneAgent is not supported; `cloudNativeFullStack` and `classicFullStack` are unavailable |\n\nBottlerocket needs two DynaKube annotations that no other distribution does — a read-only root filesystem forces the CSI driver into read-only mode, and platform observability has to come from an ActiveGate instead of the agent:\n\n```yaml\nmetadata:\n annotations:\n feature.dynatrace.com/injection-readonly-volume: \"true\"\n feature.dynatrace.com/automatic-kubernetes-api-monitoring: \"true\"\n```\n\nThe Dynatrace quickstart wizard enforces this: pick EKS-on-Bottlerocket (or GKE Autopilot) and full-stack is not offered at all.\n\n**No AWS IAM setup is required.** The operator authenticates to Dynatrace with the API token in the `dynakube` secret, not with cloud credentials — there is no IRSA role, no service-account annotation, nothing to attach.\n\n**An EKS-only install path exists.** Dynatrace ships as an AWS Marketplace EKS add-on, which provisions the namespace and operator in place of `helm install`:\n\n```bash\naws eks create-addon --cluster-name \u003ccluster> --addon-name dynatrace_dynatrace-operator\n```\n\nEverything after that — creating the secret, applying the DynaKube — is identical to the steps above.\n\n**EKS Auto Mode has no Dynatrace documentation.** It appears in neither the support matrix, the supported-technologies page nor the quickstart. Auto Mode provisions Bottlerocket nodes by default, so expect the Bottlerocket restrictions above to apply — plan for `applicationMonitoring` rather than full-stack.\n\n### Uninstall (in order)\n\nThe order matters: deleting the namespace or the CRDs before the DynaKube finalizers have drained strands agent pods and can leave the namespace stuck `Terminating`.\n\n```bash\nkubectl -n dynatrace delete dynakube --all # let operator unwind agent pods\nkubectl -n dynatrace wait --for=delete dynakube --all --timeout=60s # finalizers must drain first\nhelm uninstall dynatrace-operator -n dynatrace # or kubectl delete -f the manifest\nkubectl get crd -o name | grep 'dynatrace\\.com

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

| xargs -r kubectl delete\nkubectl delete namespace dynatrace\n```\n\n---\n","content_type":"text/markdown; charset=utf-8","language":"markdown","size":6448,"content_sha256":"7cbad63bf6ad137a727f51e8febe457351f38773cd15407d5c7d84e6b9a1917d"},{"filename":"references/remote-vm-ec2.md","content":"# Remote VM / EC2 over SSH\n\nInstalling OneAgent on a host reached over the network — an EC2 instance, a bare-metal server, anything with SSH.\n\nPart of the `dt-setup-oneagent` skill — see [../SKILL.md](../SKILL.md) for the hard rules, URL normalization and token guidance that apply to every target.\n\n---\n\nThe VM / server commands in [../SKILL.md](../SKILL.md) install OneAgent on **the machine running them**. To instrument a different host — an EC2 instance, a bare-metal server, any reachable Linux box — run the same installer *on that host* over SSH.\n\nNothing here creates the instance. Provision it with your own tooling (Terraform, CloudFormation, `aws ec2 run-instances`), then attach OneAgent to the host that already exists.\n\n**Login user by AMI:** Amazon Linux / AL2023 → `ec2-user`, Ubuntu → `ubuntu`, Debian → `admin`, RHEL → `ec2-user`. The user needs `sudo`; stock EC2 AMIs are passwordless.\n\n**Keep the token off the command line.** Write it into a `0600` file on the target through stdin — never as an `ssh` argument, or it lands in the process list on both machines and in your shell history:\n\n```bash\nSSH_HOST=\"[email protected]\"\nSSH_KEY=\"$HOME/.ssh/my-key.pem\"\nSSH_OPTS=(-o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=10 -i \"$SSH_KEY\")\nREMOTE_DIR=\"/tmp/dt-install-$(date +%s)\"\nAUTH_SCHEME=\"Api-Token\" # platform token (dt0s16.…): Bearer\nARCH=\"x86\" # Graviton / arm64 instances: arm\n\n# 1. verify connectivity first — BatchMode fails fast instead of prompting\nssh \"${SSH_OPTS[@]}\" \"$SSH_HOST\" 'echo connectivity-ok'\n\n# 2. ensure wget is present (installer dependency)\nssh \"${SSH_OPTS[@]}\" \"$SSH_HOST\" '\n command -v wget >/dev/null 2>&1 || {\n command -v apt-get >/dev/null 2>&1 && sudo apt-get update -qq && sudo apt-get install -y -qq wget ||\n command -v dnf >/dev/null 2>&1 && sudo dnf install -y -q wget ||\n sudo yum install -y -q wget\n }'\n\n# 3. ship the credentials into a 0600 file via stdin\nssh \"${SSH_OPTS[@]}\" \"$SSH_HOST\" \"mkdir -p '$REMOTE_DIR' && chmod 700 '$REMOTE_DIR'\"\nprintf 'export DT_ENV_URL=%q\\nexport DT_API_TOKEN=%q\\nexport AUTH_SCHEME=%q\\nexport ARCH=%q\\n' \\\n \"$DT_ENV_URL_NORMALIZED\" \"$DT_API_TOKEN\" \"$AUTH_SCHEME\" \"$ARCH\" \\\n | ssh \"${SSH_OPTS[@]}\" \"$SSH_HOST\" \"umask 077 && cat > '$REMOTE_DIR/dt.env'\"\n\n# 4. download and run the installer on the remote host\nssh \"${SSH_OPTS[@]}\" -t \"$SSH_HOST\" \"\n set -e\n . '$REMOTE_DIR/dt.env'\n cd '$REMOTE_DIR'\n wget -q -O oneagent.sh \\\n --header=\\\"Authorization: \\$AUTH_SCHEME \\$DT_API_TOKEN\\\" \\\n \\\"\\$DT_ENV_URL/api/v1/deployment/installer/agent/unix/default/latest?arch=\\$ARCH&flavor=default\\\"\n sudo /bin/sh oneagent.sh --set-monitoring-mode=fullstack --set-app-log-content-access=true\n\"\n\n# 5. ALWAYS clean up — dt.env holds the token\nssh \"${SSH_OPTS[@]}\" \"$SSH_HOST\" \"rm -rf '$REMOTE_DIR'\" || {\n echo \"WARNING: $REMOTE_DIR/dt.env still holds a live token on $SSH_HOST\" >&2\n echo \" remove it: ssh $SSH_HOST 'rm -rf $REMOTE_DIR'\" >&2\n}\n```\n\n**If the cleanup fails, do not treat the run as clean.** A network blip after a successful install is enough, and the credentials file then stays on the host indefinitely — `0600`, but readable by root and by anything later running as root. Retry the removal; if it still fails, treat the token as exposed and rotate it. Scripting this? Exit with a distinct status for \"installed but the token file could not be removed\", so a pipeline can tell it apart from success.\n\n**On `StrictHostKeyChecking=accept-new`.** This accepts an unrecognised host key on first connect. It is what makes a fresh instance usable without manual steps, but it also means the very run that ships a live token to that host is the one with no way to tell the real machine from an interposed one. On a private subnet with a known-good route that is a reasonable trade. Over the public internet, or when the token matters more than convenience, pin the key first — for EC2, the instance prints its host keys to the console on first boot:\n\n```bash\naws ec2 get-console-output --instance-id i-xxxxxxxx --region \u003cregion> \\\n --output text | sed -n '/BEGIN SSH HOST KEY KEYS/,/END SSH HOST KEY KEYS/p'\n```\n\nCompare that against `ssh-keyscan \u003chost>`, add the verified key to `known_hosts`, and switch to `StrictHostKeyChecking=yes`. Console output can lag a minute or two after boot.\n\n**Private instances** with no public IP: add a jump host — `-J [email protected]` in `SSH_OPTS`. AWS SSM Session Manager is the alternative when SSH is closed entirely.\n\n**Verify** (no token needed):\n\n```bash\nssh \"${SSH_OPTS[@]}\" \"$SSH_HOST\" \\\n 'systemctl is-active oneagent || ls -d /opt/dynatrace/oneagent'\n```\n\n**Uninstall** (no token needed):\n\n```bash\nssh \"${SSH_OPTS[@]}\" -t \"$SSH_HOST\" \\\n 'sudo /bin/sh /opt/dynatrace/oneagent/agent/uninstall.sh'\n```\n\n**Restart caveat applies remotely too:** OneAgent cannot inject into already-running processes, so restart the workloads on the target after installing.\n\n---\n","content_type":"text/markdown; charset=utf-8","language":"markdown","size":5027,"content_sha256":"0cf9beab43032751e991b24501c9ba306104d3f976f5048f5a8b1d2e904b0bc1"},{"filename":"references/windows.md","content":"# Windows host (from WSL or native)\n\nInstaller endpoint, elevated install, and the MSI product-code lookup needed to uninstall.\n\nPart of the `dt-setup-oneagent` skill — see [../SKILL.md](../SKILL.md) for the hard rules, URL normalization and token guidance that apply to every target.\n\n---\n\n**Endpoint:**\n\n```\nGET ${DT_ENV_URL_NORMALIZED}/api/v1/deployment/installer/agent/windows/default/latest?flavor=default\nHeader: Authorization: Api-Token ${DT_API_TOKEN} # dt0c01.… access token\n Authorization: Bearer ${DT_API_TOKEN} # dt0s16.… platform token\n```\n\nThe downloaded `.exe` is an MSI wrapper. **Sanity check** before invoking: the first two bytes must be `MZ` (PE magic). If not, the API returned an error body, not the installer.\n\n**Install** (UAC required — silent MSI mode):\n\n```text\nStart-Process -FilePath 'C:\\path\\to\\Dynatrace-OneAgent-Windows.exe' `\n -ArgumentList '--set-monitoring-mode=fullstack','--set-app-log-content-access=true','/quiet' `\n -Verb RunAs -Wait\n```\n\n**Uninstall (no standalone uninstaller — must go through MSI):**\n\n```text\n$pc = (Get-ItemProperty 'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*',\n 'HKLM:\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*' |\n Where-Object DisplayName -EQ 'Dynatrace OneAgent' | Select -First 1).PSChildName\nStart-Process msiexec.exe -ArgumentList '/x',$pc,'/quiet','/norestart' -Verb RunAs -Wait\n```\n\n---\n","content_type":"text/markdown; charset=utf-8","language":"markdown","size":1452,"content_sha256":"c9daffcb47f015eba533178c2a48882f16a971eb22e5bf9175967cd50e56ee8b"}],"content_json":{"type":"doc","content":[{"type":"heading","attrs":{"level":1},"content":[{"text":"Deploy Dynatrace OneAgent — knowledge reference","type":"text"}]},{"type":"paragraph","content":[{"text":"This skill is ","type":"text"},{"text":"reference-only","type":"text","marks":[{"type":"strong"}]},{"text":". It contains the documented endpoints, environment variables, token scopes, and commands that an operator (or another agent) needs to install OneAgent manually across the supported targets. It executes nothing.","type":"text"}]},{"type":"blockquote","content":[{"type":"paragraph","content":[{"text":"This skill gives you the commands; it does not run them. Follow the procedure for the target you need, substituting the environment URL and token as documented below.","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Hard rules for any agent consuming this skill","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Operate only on resources the user explicitly named.","type":"text","marks":[{"type":"strong"}]},{"text":" Never create a placeholder/test Lambda, IAM role, K8s namespace, secret, S3 bucket, EC2 instance, or any other fixture on your own initiative — not to \"demonstrate\", not \"while we're at it\", not preemptively. If the named resource doesn't exist and the user hasn't asked for it to be created, stop and ask. Side resources (additional Secrets Manager entries, monitoring, helper stacks) must not be provisioned silently — surface them as confirmation questions with the exact definition first.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Explicit user-driven create modes are fine.","type":"text","marks":[{"type":"strong"}]},{"text":" When the user passes ","type":"text"},{"text":"--create","type":"text","marks":[{"type":"code_inline"}]},{"text":" (or explicitly says \"yes, create it\" after being asked), provisioning exactly the resources documented for that mode is the right thing to do — see ","type":"text"},{"text":"Create a new function and install OneAgent","type":"text","marks":[{"type":"em"}]},{"text":" in ","type":"text"},{"text":"references/aws-lambda.md","type":"text","marks":[{"type":"link","attrs":{"href":"references/aws-lambda.md","title":null}}]},{"text":" for the documented set. Don't second-guess the function name the user typed: do ","type":"text"},{"text":"not","type":"text","marks":[{"type":"strong"}]},{"text":" pattern-match on names like \"test\", \"demo\", \"scratch\", \"tmp\" and refuse, warn, or insist on an alternative. The input is authoritative; the rule above is about ","type":"text"},{"text":"silent","type":"text","marks":[{"type":"em"}]},{"text":" or ","type":"text"},{"text":"unsolicited","type":"text","marks":[{"type":"em"}]},{"text":" creation, not user-requested creation.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Never persist the API token.","type":"text","marks":[{"type":"strong"}]},{"text":" The token's only job is to (a) authenticate the OneAgent artifact download / layer-ARN lookup and (b) get handed to the target system (Lambda env var or Secrets Manager, Linux installer, DynaKube secret) as part of the install. Do not cache it to local files, write it to scratch scripts, leave it in shell history, copy it into PR descriptions, or store it anywhere outside the target system that strictly needs it. Treat each run as fresh: supply via env var or 0600 file, use, discard.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Never echo or log the API token.","type":"text","marks":[{"type":"strong"}]},{"text":" When you have to reference it in a command, write ","type":"text"},{"text":"$DT_API_TOKEN","type":"text","marks":[{"type":"code_inline"}]},{"text":" or an elided prefix (","type":"text"},{"text":"dt0s16.…","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"dt0c01.…","type":"text","marks":[{"type":"code_inline"}]},{"text":"). Don't paste the literal value into prose.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Never assume the env URL, and confirm the tenant before installing.","type":"text","marks":[{"type":"strong"}]},{"text":" Targeting the wrong environment fails ","type":"text"},{"text":"silently","type":"text","marks":[{"type":"em"}]},{"text":": the install succeeds and the host or function simply reports to a tenant nobody is watching. An environment URL the user stated explicitly always wins over anything derived from a tool default or a previous run — never let a cached or discovered value override it. State the tenant you are about to use and let the user correct you. Tenant IDs (","type":"text"},{"text":"abc12345","type":"text","marks":[{"type":"code_inline"}]},{"text":") and labs vs. prod determine the correct host.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Writes that take a collection replace it — read, merge, then write.","type":"text","marks":[{"type":"strong"}]},{"text":" Several APIs here accept a whole collection and overwrite whatever was there: ","type":"text"},{"text":"aws lambda update-function-configuration","type":"text","marks":[{"type":"code_inline"}]},{"text":" does this for ","type":"text"},{"text":"both","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"--environment","type":"text","marks":[{"type":"code_inline"}]},{"text":" and ","type":"text"},{"text":"--layers","type":"text","marks":[{"type":"code_inline"}]},{"text":", so sending only the Dynatrace values silently deletes the function's own variables and any other layers. Always read current state, merge your additions into it, and write the union back. Take a rollback snapshot before the first write. This applies wherever you are about to replace a set rather than add to one.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Deriving the env URL from dtctl.","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"dtctl config current-context","type":"text","marks":[{"type":"code_inline"}]},{"text":" returns only the ","type":"text"},{"text":"context name","type":"text","marks":[{"type":"em"}]},{"text":" (e.g. ","type":"text"},{"text":"my-env","type":"text","marks":[{"type":"code_inline"}]},{"text":"), not a URL. The URL comes from ","type":"text"},{"text":"dtctl config describe-context \u003cctx>","type":"text","marks":[{"type":"code_inline"}]},{"text":". Do ","type":"text"},{"text":"not","type":"text","marks":[{"type":"strong"}]},{"text":" pipe that straight into ","type":"text"},{"text":"jq","type":"text","marks":[{"type":"code_inline"}]},{"text":": some dtctl versions ignore ","type":"text"},{"text":"-o json","type":"text","marks":[{"type":"code_inline"}]},{"text":" and print a human table (","type":"text"},{"text":"Environment: https://…","type":"text","marks":[{"type":"code_inline"}]},{"text":") while still exiting 0, so jq dies on a parse error and takes any ","type":"text"},{"text":"set -e -o pipefail","type":"text","marks":[{"type":"code_inline"}]},{"text":" script down with it. Check the output really is JSON first, and fall back to scraping the ","type":"text"},{"text":"Environment:","type":"text","marks":[{"type":"code_inline"}]},{"text":" line:","type":"text"}]}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"CTX=\"$(dtctl config current-context 2>/dev/null || true)\"\nOUT=\"$(dtctl config describe-context \"$CTX\" -o json 2>/dev/null || true)\"\nif printf '%s' \"$OUT\" | jq -e . >/dev/null 2>&1; then\n DT_ENV_URL=\"$(printf '%s' \"$OUT\" | jq -r '.environment // .url // empty')\"\nelse\n DT_ENV_URL=\"$(printf '%s' \"$OUT\" | awk 'tolower($1) ~ /^(environment|url):$/ {print $2; exit}')\"\nfi","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"URL normalization","type":"text"}]},{"type":"paragraph","content":[{"text":"Dynatrace's \"new platform\" URLs and the classic OneAgent installer endpoints differ. Before constructing installer URLs, convert:","type":"text"}]},{"type":"table","attrs":{"layout":null},"content":[{"type":"tr","content":[{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Input (Dynatrace UI / docs)","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Use for installer endpoints","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"https://\u003cid>.apps.dynatrace.com","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"https://\u003cid>.live.dynatrace.com","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"https://\u003cid>.\u003cregion>.apps.dynatracelabs.com","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"https://\u003cid>.\u003cregion>.dynatracelabs.com","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Anything else","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"unchanged","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"The tenant ID is the first dot-separated segment (","type":"text"},{"text":"\u003cid>","type":"text","marks":[{"type":"code_inline"}]},{"text":").","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"Token types and the Authorization header","type":"text"}]},{"type":"paragraph","content":[{"text":"Two token families are in play, and ","type":"text"},{"text":"the ","type":"text","marks":[{"type":"strong"}]},{"text":"Authorization","type":"text","marks":[{"type":"code_inline"},{"type":"strong"}]},{"text":" scheme is chosen by the token's prefix, not by which endpoint you call","type":"text","marks":[{"type":"strong"}]},{"text":":","type":"text"}]},{"type":"table","attrs":{"layout":null},"content":[{"type":"tr","content":[{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Token","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Prefix","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Header","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Platform token","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"dt0s16.","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Authorization: Bearer \u003ctoken>","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Access token (classic API token)","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"dt0c01.","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Authorization: Api-Token \u003ctoken>","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"PaaS token","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"dt0s01.","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Authorization: Bearer \u003ctoken>","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"OAuth client secret","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"dt0s02.","type":"text","marks":[{"type":"code_inline"}]},{"text":" / ","type":"text"},{"text":"dt0s03.","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"❌ not directly usable — must be exchanged for a bearer token first","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"Platform tokens are the forward-looking default.","type":"text","marks":[{"type":"strong"}]},{"text":" Dynatrace is deprecating access tokens: new tenants can no longer create them, and Classic API endpoints are being updated to accept platform tokens. Do ","type":"text"},{"text":"not","type":"text","marks":[{"type":"strong"}]},{"text":" assume a token starts with ","type":"text"},{"text":"dt0c01.","type":"text","marks":[{"type":"code_inline"}]},{"text":". The reference implementation of this rule is dtwiz's ","type":"text"},{"text":"AuthHeader()","type":"text","marks":[{"type":"code_inline"}]},{"text":" (","type":"text"},{"text":"pkg/installer/installer.go","type":"text","marks":[{"type":"code_inline"}]},{"text":"): ","type":"text"},{"text":"dt0c01.*","type":"text","marks":[{"type":"code_inline"}]},{"text":" → ","type":"text"},{"text":"Api-Token","type":"text","marks":[{"type":"code_inline"}]},{"text":", everything else → ","type":"text"},{"text":"Bearer","type":"text","marks":[{"type":"code_inline"}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"One path hands the token to a component that has historically required a PaaS/access token — if it rejects a platform token, use a ","type":"text"},{"text":"dt0c01.","type":"text","marks":[{"type":"code_inline"}]},{"text":" access token there:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Kubernetes","type":"text","marks":[{"type":"strong"}]},{"text":" — the Dynatrace Operator authenticates using the ","type":"text"},{"text":"dynakube","type":"text","marks":[{"type":"code_inline"}]},{"text":" secret.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"VM, remote VM/EC2, Windows and Lambda call the Deployment API directly and work with either family.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Token scopes by target","type":"text"}]},{"type":"paragraph","content":[{"text":"For a ","type":"text"},{"text":"platform token","type":"text","marks":[{"type":"strong"}]},{"text":" (","type":"text"},{"text":"dt0s16.","type":"text","marks":[{"type":"code_inline"}]},{"text":"), the OneAgent-relevant scopes live under ","type":"text"},{"text":"Fleet management","type":"text","marks":[{"type":"strong"}]},{"text":": ","type":"text"},{"text":"fleet-management:oneagents:download","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"fleet-management:oneagent.connection-info:read","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"fleet-management:oneagent.tokens:read","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"fleet-management:cluster-id:read","type":"text","marks":[{"type":"code_inline"}]},{"text":"; Kubernetes additionally wants ","type":"text"},{"text":"fleet-management:activegates:download","type":"text","marks":[{"type":"code_inline"}]},{"text":" and ","type":"text"},{"text":"fleet-management:activegate.tokens:create","type":"text","marks":[{"type":"code_inline"}]},{"text":". Generating the token via the Dynatrace ","type":"text"},{"text":"QuickStart","type":"text","marks":[{"type":"strong"}]},{"text":" app provisions a working set.","type":"text"}]},{"type":"paragraph","content":[{"text":"For a ","type":"text"},{"text":"classic access token","type":"text","marks":[{"type":"strong"}]},{"text":" (","type":"text"},{"text":"dt0c01.","type":"text","marks":[{"type":"code_inline"}]},{"text":"):","type":"text"}]},{"type":"table","attrs":{"layout":null},"content":[{"type":"tr","content":[{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Target","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Required token scopes","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"VM / Windows","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"InstallerDownload","type":"text","marks":[{"type":"code_inline"}]},{"text":" (PaaS)","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Kubernetes","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"InstallerDownload","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"settings.read","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"settings.write","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"activeGateTokenManagement.create","type":"text","marks":[{"type":"code_inline"}]},{"text":" — the Dynatrace UI's \"Kubernetes: Dynatrace Operator\" template sets all four.","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Azure VM / VMSS","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"InstallerDownload","type":"text","marks":[{"type":"code_inline"}]},{"text":" (PaaS). Azure side: the caller's ","type":"text"},{"text":"az","type":"text","marks":[{"type":"code_inline"}]},{"text":" identity needs ","type":"text"},{"text":"Contributor","type":"text","marks":[{"type":"code_inline"}]},{"text":" or any role granting ","type":"text"},{"text":"Microsoft.Compute/.../extensions/write","type":"text","marks":[{"type":"code_inline"}]},{"text":" on the resource.","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"AWS Lambda (runtime token)","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"A ","type":"text"},{"text":"connection auth token","type":"text","marks":[{"type":"strong"}]},{"text":" consumed by the OneAgent layer at runtime. Distinct from the installer token. Create from the Dynatrace UI under ","type":"text"},{"text":"Access tokens","type":"text","marks":[{"type":"em"}]},{"text":" with ","type":"text"},{"text":"entities.read","type":"text","marks":[{"type":"code_inline"}]},{"text":", or use the Hub → AWS Lambda template.","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"Tokens are never username-scoped — they belong to the tenant.","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"Targets","type":"text"}]},{"type":"paragraph","content":[{"text":"Each target has its own reference. They share the rules, URL normalization and token guidance above — read those first, then the one you need.","type":"text"}]},{"type":"paragraph","content":[{"text":"Managed Kubernetes distributions are covered inside the Kubernetes reference rather than separately: the install is identical and only the node type differs, so the deltas belong next to the procedure they modify.","type":"text"}]},{"type":"table","attrs":{"layout":null},"content":[{"type":"tr","content":[{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Target","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Reference","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"VM / server (Linux, macOS)","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"below — the base case every other target builds on","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Remote VM / EC2 over SSH","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"→ ","type":"text"},{"text":"references/remote-vm-ec2.md","type":"text","marks":[{"type":"link","attrs":{"href":"references/remote-vm-ec2.md","title":null}}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Windows host (WSL or native)","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"→ ","type":"text"},{"text":"references/windows.md","type":"text","marks":[{"type":"link","attrs":{"href":"references/windows.md","title":null}}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Kubernetes (Operator + DynaKube) — incl. ","type":"text"},{"text":"EKS","type":"text","marks":[{"type":"strong"}]},{"text":", Fargate and Bottlerocket limits","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"→ ","type":"text"},{"text":"references/kubernetes.md","type":"text","marks":[{"type":"link","attrs":{"href":"references/kubernetes.md","title":null}}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"AWS Lambda (layer + env vars)","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"→ ","type":"text"},{"text":"references/aws-lambda.md","type":"text","marks":[{"type":"link","attrs":{"href":"references/aws-lambda.md","title":null}}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Azure VM / VM Scale Set (VM extension)","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"→ ","type":"text"},{"text":"references/azure-vm.md","type":"text","marks":[{"type":"link","attrs":{"href":"references/azure-vm.md","title":null}}]}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"By platform","type":"text"}]},{"type":"paragraph","content":[{"text":"The table above is organised by install mechanism, because that is what decides the procedure. If you are arriving from a particular cloud instead:","type":"text"}]},{"type":"table","attrs":{"layout":null},"content":[{"type":"tr","content":[{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Platform","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"What you are deploying to","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Go to","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"AWS","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"EC2 instance","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"remote-vm-ec2.md","type":"text","marks":[{"type":"link","attrs":{"href":"references/remote-vm-ec2.md","title":null}}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph"}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"EKS — EC2 nodes","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"kubernetes.md","type":"text","marks":[{"type":"link","attrs":{"href":"references/kubernetes.md","title":null}}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph"}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"EKS — Fargate or Bottlerocket nodes","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"kubernetes.md § AWS EKS specifics","type":"text","marks":[{"type":"link","attrs":{"href":"references/kubernetes.md","title":null}}]},{"text":" — full-stack unavailable, ","type":"text"},{"text":"applicationMonitoring","type":"text","marks":[{"type":"code_inline"}]},{"text":" only","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph"}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Lambda function","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"aws-lambda.md","type":"text","marks":[{"type":"link","attrs":{"href":"references/aws-lambda.md","title":null}}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Azure","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"VM or VM Scale Set","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"azure-vm.md","type":"text","marks":[{"type":"link","attrs":{"href":"references/azure-vm.md","title":null}}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph"}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"AKS","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"kubernetes.md","type":"text","marks":[{"type":"link","attrs":{"href":"references/kubernetes.md","title":null}}]},{"text":" — ","type":"text"},{"text":"not","type":"text","marks":[{"type":"strong"}]},{"text":" the VM extension, even though node pools are VMSSes","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Google Cloud","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"GKE (standard)","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"kubernetes.md","type":"text","marks":[{"type":"link","attrs":{"href":"references/kubernetes.md","title":null}}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph"}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"GKE Autopilot","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"kubernetes.md","type":"text","marks":[{"type":"link","attrs":{"href":"references/kubernetes.md","title":null}}]},{"text":" for the operator path — full-stack is unavailable, as on Bottlerocket. Autopilot-specific tuning is not covered","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph"}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Compute Engine VM","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"remote-vm-ec2.md","type":"text","marks":[{"type":"link","attrs":{"href":"references/remote-vm-ec2.md","title":null}}]},{"text":" — the SSH procedure is not AWS-specific","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"On-prem / anywhere else","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Linux or macOS you are logged into","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"below","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph"}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Linux you reach over SSH","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"remote-vm-ec2.md","type":"text","marks":[{"type":"link","attrs":{"href":"references/remote-vm-ec2.md","title":null}}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph"}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Windows","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"windows.md","type":"text","marks":[{"type":"link","attrs":{"href":"references/windows.md","title":null}}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph"}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Kubernetes, or OpenShift via the standard operator","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"kubernetes.md","type":"text","marks":[{"type":"link","attrs":{"href":"references/kubernetes.md","title":null}}]},{"text":" — the classic OpenShift node-config-operator route is not covered","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"VM / server (Linux, macOS)","type":"text"}]},{"type":"paragraph","content":[{"text":"Endpoint","type":"text","marks":[{"type":"strong"}]},{"text":" (substitute ","type":"text"},{"text":"${DT_ENV_URL_NORMALIZED}","type":"text","marks":[{"type":"code_inline"}]},{"text":" and ","type":"text"},{"text":"${ARCH}","type":"text","marks":[{"type":"code_inline"}]},{"text":" where ","type":"text"},{"text":"ARCH","type":"text","marks":[{"type":"code_inline"}]},{"text":" ∈ ","type":"text"},{"text":"x86 | arm | ppc64le | s390","type":"text","marks":[{"type":"code_inline"}]},{"text":"):","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"GET ${DT_ENV_URL_NORMALIZED}/api/v1/deployment/installer/agent/unix/default/latest?arch=${ARCH}&flavor=default\nHeader: Authorization: Api-Token ${DT_API_TOKEN} # dt0c01.… access token\n Authorization: Bearer ${DT_API_TOKEN} # dt0s16.… platform token","type":"text"}]},{"type":"paragraph","content":[{"text":"Install command:","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Set the scheme to match your token — ","type":"text"},{"text":"Api-Token","type":"text","marks":[{"type":"code_inline"}]},{"text":" for ","type":"text"},{"text":"dt0c01.…","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"Bearer","type":"text","marks":[{"type":"code_inline"}]},{"text":" for ","type":"text"},{"text":"dt0s16.…","type":"text","marks":[{"type":"code_inline"}]},{"text":":","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"DT_AUTH=\"Api-Token ${DT_API_TOKEN}\" # platform token: DT_AUTH=\"Bearer ${DT_API_TOKEN}\"\n\nwget -O Dynatrace-OneAgent-Linux.sh \\\n --header=\"Authorization: ${DT_AUTH}\" \\\n \"${DT_ENV_URL_NORMALIZED}/api/v1/deployment/installer/agent/unix/default/latest?arch=${ARCH}&flavor=default\"\n\nsudo /bin/sh Dynatrace-OneAgent-Linux.sh \\\n --set-monitoring-mode=fullstack \\\n --set-app-log-content-access=true \\\n [--set-host-group=\u003cname>] \\\n [--set-network-zone=\u003czone>]","type":"text"}]},{"type":"paragraph","content":[{"text":"Restart caveat:","type":"text","marks":[{"type":"strong"}]},{"text":" OneAgent cannot inject into already-running processes. After install, restart the workloads you want monitored.","type":"text"}]},{"type":"paragraph","content":[{"text":"Uninstall:","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"sudo /opt/dynatrace/oneagent/agent/uninstall.sh","type":"text"}]},{"type":"paragraph","content":[{"text":"Removes the systemd unit, ","type":"text"},{"text":"/opt/dynatrace","type":"text","marks":[{"type":"code_inline"}]},{"text":", and the ","type":"text"},{"text":"/etc/ld.so.preload","type":"text","marks":[{"type":"code_inline"}]},{"text":" line that injects the agent.","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"When you should not use this skill","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"The user wants the install performed for them rather than explained. → This skill still applies: follow the target's procedure and run the commands, confirming the tenant first.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"The user is asking why an install failed and wants an explanation. → This skill is appropriate.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"The user wants a target this skill doesn't cover (Azure Functions / App Service / Container Apps, classic OpenShift node-config-operator, GKE Autopilot specifics, ECS Fargate). → Refer to ","type":"text"},{"text":"https://docs.dynatrace.com","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.dynatrace.com","title":null}}]},{"text":"; this skill covers VM/server, remote VM/EC2 over SSH, Windows, Kubernetes and AWS Lambda.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"References","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"OneAgent Linux install: ","type":"text"},{"text":"https://docs.dynatrace.com/docs/ingest-from/dynatrace-oneagent/installation-and-operation/linux","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.dynatrace.com/docs/ingest-from/dynatrace-oneagent/installation-and-operation/linux","title":null}}]}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"OneAgent Windows install: ","type":"text"},{"text":"https://docs.dynatrace.com/docs/ingest-from/dynatrace-oneagent/installation-and-operation/windows","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.dynatrace.com/docs/ingest-from/dynatrace-oneagent/installation-and-operation/windows","title":null}}]}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Kubernetes (Operator + DynaKube): ","type":"text"},{"text":"https://docs.dynatrace.com/docs/ingest-from/setup-on-k8s/deployment/full-stack-observability","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.dynatrace.com/docs/ingest-from/setup-on-k8s/deployment/full-stack-observability","title":null}}]}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Dynatrace Operator releases: ","type":"text"},{"text":"https://github.com/Dynatrace/dynatrace-operator/releases","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com/Dynatrace/dynatrace-operator/releases","title":null}}]}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"AWS Lambda (Hub): ","type":"text"},{"text":"https://www.dynatrace.com/hub/detail/amazon-web-services-aws-lambda/","type":"text","marks":[{"type":"link","attrs":{"href":"https://www.dynatrace.com/hub/detail/amazon-web-services-aws-lambda/","title":null}}]}]}]}]}]},"metadata":{"date":"2026-11-02","name":"dt-setup-oneagent","author":"@skillopedia","source":{"stars":172,"repo_name":"dynatrace-for-ai","origin_url":"https://github.com/Dynatrace/dynatrace-for-ai/blob/HEAD/skills/dt-setup-oneagent/SKILL.md","repo_owner":"Dynatrace","body_sha256":"00644a53357c660185ee793a5c1652b2d9720755a1f185140804e1e42b52da92","cluster_key":"60ca4d613d6e036475952dfd6c550ba6c830bc07ac7067cb6956f1e373040889","clean_bundle":{"format":"clean-skill-bundle-v1","source":"Dynatrace/dynatrace-for-ai/skills/dt-setup-oneagent/SKILL.md","text_bytes":34500,"source_commit":"306fb94e36a53de026cb05a58b5b440fe6d7f000","skills_sh_rank":18180,"attachment_count":5,"text_attachments":5,"attachment_storage":"skill_attachments","binary_attachments":0},"cluster_size":1,"skill_md_path":"skills/dt-setup-oneagent/SKILL.md","import_metadata":{"date":"2026-11-02","author":"@skillopedia","version":"v1","category":"devops-infrastructure","category_label":"DevOps"},"exact_dupes_collapsed_into_this":0},"license":"Apache-2.0","version":"v1","category":"devops-infrastructure","import_tag":"skills-sh-top20k-2026-11","description":"Reference knowledge for installing, uninstalling, or creating-and-installing Dynatrace OneAgent across VM/server, Kubernetes (Operator + DynaKube), AWS Lambda (layer + env vars, plus optional fresh function provisioning), Windows hosts, remote Linux hosts / EC2 instances over SSH, and Azure VMs / VM Scale Sets. Returns documented endpoints, env vars, token scopes, and copy-paste-ready commands. Returns the exact commands to run rather than executing them. Use when the user asks to install or uninstall OneAgent, or asks \"how do I…\", \"what URL/scope/var do I need for…\", or \"explain the OneAgent deployment for X\"."}},"renderedAt":1793666333156}

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.