---
title: Quickstart for Kubernetes on Elastic Cloud Hosted
description: Learn how to set up the {{agent}} and EDOT SDKs in a Kubernetes environment with Elastic Cloud Hosted to collect metrics, logs, and traces using the Managed OTLP Endpoint.
url: https://www.elastic.co/elastic/docs-builder/docs/4097/solutions/observability/get-started/opentelemetry/quickstart/ech/k8s
products:
- Elastic Agent
- Elastic Cloud Hosted
- Elastic Observability
applies_to:
- Elastic Cloud Hosted: Generally available
---
# Quickstart for Kubernetes on Elastic Cloud Hosted
Learn how to set up the Elastic Agent and EDOT SDKs in a Kubernetes environment with Elastic Cloud Hosted (ECH) to collect host metrics, logs, and application traces. This quickstart uses the [Elastic Cloud Managed OTLP Endpoint](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4097/reference/opentelemetry/managed-inputs/managed-otlp-endpoint), which is the recommended ingestion path for ECH.
## Prerequisites
- An Elastic Cloud Hosted deployment running version 9.0 or later.
- Helm version 3.9+ up to and including 3.21.0.
## Guided setup
The fastest way to get started is the **Add data** screen in Elastic Observability. It generates install commands with your endpoint and API key already included.
1. Open Elastic Observability.
2. Go to **Add data**.
3. Select what you want to monitor.
4. Follow the instructions.
If you need to manage credentials manually, for example, to use them in automation or to configure multiple environments, follow the steps in the Manual installation section.
## Manual installation
Follow these steps to deploy the Elastic Agent and EDOT SDKs in Kubernetes with ECH:
Run the following command to add the charts repository to Helm:
```bash
helm repo add open-telemetry "https://open-telemetry.github.io/opentelemetry-helm-charts" --force-update
```
**Find your endpoint**
The easiest way to get your endpoint and API key is from the **Add data** screen in Kibana:
1. Go to **Add data**.
2. In the **Connect directly to the endpoint** section, select the **OpenTelemetry** tab.
3. Copy the **Endpoint** value.
4. Click **Create key** to generate an API key with the required privileges.
Alternatively, retrieve the endpoint from the Elastic Cloud Console and create an API key manually:
1. Log in to the [Elastic Cloud Console](https://cloud.elastic.co/).
2. Find your deployment in **Hosted deployments**, and select **Manage**.
3. In the **Application endpoints, cluster and component IDs** section, select **Managed OTLP**.
4. Copy the public endpoint value.
**Create an API key**
The Elastic Cloud Managed OTLP Endpoint validates API keys using APM application privileges. Index-level privilege scoping is not yet supported, meaning that API keys with custom index-level role descriptors return a `PermissionDenied` error.
1. Go to **Stack Management** → **API keys**.
2. Click **Create API key**, enter a name, and enable **Control security privileges**.
3. In the role descriptors box, enter the following privileges:
```json
{
"otlp_writer": {
"applications": [
{
"application": "apm",
"resources": ["*"],
"privileges": ["event:write"]
}
]
}
}
```
4. Click **Create API key** and copy the encoded value.
Use the [Create API key](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-security-create-api-key) API:
```json
{
"name": "otlp-writer",
"role_descriptors": {
"otlp_writer": {
"applications": [
{
"application": "apm",
"resources": ["*"],
"privileges": ["event:write"]
}
]
}
}
}
```
The `event:write` privilege for the `apm` application is the minimum required to send data through the Elastic Cloud Managed OTLP Endpoint.
Replace `` and `` in the following command to create a namespace and a secret with your credentials.
```bash
kubectl create namespace opentelemetry-operator-system
kubectl create secret generic elastic-secret-otel \
--namespace opentelemetry-operator-system \
--from-literal=elastic_otlp_endpoint='' \
--from-literal=elastic_api_key=''
```
On Windows PowerShell, replace backslashes (`\`) with backticks (```) for line continuation and single quotes (`'`) with double quotes (`"`).
Install the OpenTelemetry Operator using the `kube-stack` Helm chart with the `managed_otlp` values file:
```bash
helm install opentelemetry-kube-stack open-telemetry/opentelemetry-kube-stack \
--namespace opentelemetry-operator-system \
--values 'https://raw.githubusercontent.com/elastic/elastic-agent/refs/tags/v9.5.3/deploy/helm/edot-collector/kube-stack/managed_otlp/values.yaml' \
--version '0.16.0'
```
The Operator provides a deployment of the Elastic Agent and configuration environment variables. This allows SDKs and instrumentation to send data to the Elastic Agent without further configuration.For details about the pipelines, refer to [Managed OTLP Endpoint](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4097/reference/edot-collector/config/default-config-k8s#managed-otlp-endpoint).
Add a language-specific annotation to your namespace by replacing `` with one of the supported values (`nodejs`, `java`, `python`, `dotnet`, or `go`) in the following command.
```bash
kubectl annotate namespace YOUR_NAMESPACE instrumentation.opentelemetry.io/inject-="opentelemetry-operator-system/elastic-instrumentation"
```
The OpenTelemetry Operator automatically provides the OTLP endpoint configuration and authentication to the SDKs through environment variables. Restart your deployment to ensure the annotations and auto-instrumentations are applied.For languages where auto-instrumentation is not available, manually instrument your application. See the [Setup section in the corresponding SDK](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4097/reference/opentelemetry/edot-sdks).
Install the **[Kubernetes OpenTelemetry Assets](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4097/reference/kubernetes_otel)** and **[System OpenTelemetry Assets](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4097/reference/system_otel)** integrations in Kibana.
Go to Kibana and select **Dashboards** to explore your newly collected data.
## Using the `elasticsearch` exporter
If you need to write telemetry directly to Elasticsearch (for example, for pipeline customizations not yet supported through Elastic Cloud Managed OTLP Endpoint), use the following configuration instead.
Create the secret with your Elasticsearch endpoint:
```bash
kubectl create namespace opentelemetry-operator-system
kubectl create secret generic elastic-secret-otel \
--namespace opentelemetry-operator-system \
--from-literal=elastic_endpoint='' \
--from-literal=elastic_api_key=''
```
Install the Operator using the standard values file:
```bash
helm install opentelemetry-kube-stack open-telemetry/opentelemetry-kube-stack \
--namespace opentelemetry-operator-system \
--values 'https://raw.githubusercontent.com/elastic/elastic-agent/refs/tags/v9.5.3/deploy/helm/edot-collector/kube-stack/values.yaml' \
--version '0.16.0'
```
For details about the pipelines, refer to [Direct ingestion into Elasticsearch](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4097/reference/edot-collector/config/default-config-k8s#direct-ingestion-into-elasticsearch).
## Troubleshooting
The following issues might occur.
### API key prefix not found
The following error is due to an improperly formatted API key, and typically occurs when credentials are configured manually:
```txt
Exporting failed. Dropping data.
{"kind": "exporter", "data_type": }
"Unauthenticated desc = ApiKey prefix not found"
```
For a Collector, format the header as `"Authorization": "ApiKey "`. For an SDK, format it as `"Authorization=ApiKey "`.
For additional troubleshooting, refer to [Troubleshooting common issues with the Elastic Agent](https://www.elastic.co/elastic/docs-builder/docs/4097/troubleshoot/ingest/opentelemetry/edot-collector) and [Troubleshooting the EDOT SDKs](https://www.elastic.co/elastic/docs-builder/docs/4097/troubleshoot/ingest/opentelemetry/edot-sdks).