Skip to main content

Configuration

Proxy Configuration​

The Cluster Manager, Sensor and Scanner respect the HTTP_PROXY family of environment variables. Set the proxy for your installation method.

Set the proxy_configuration variable. https_proxy defaults to the value of http_proxy when omitted. To exclude hosts from the proxy, add no_proxy with a comma-separated list of hosts.

proxy_configuration = {
  enabled    = true
  http_proxy = "http://proxy.service:1234"
}

Disable the Scanner​

The Upwind Scanner is deployed by default. To install without it, turn it off for your installation method.

Set the create_scanner variable to false.

create_scanner = false

Share the Registry Secret​

Each installation creates a registry credentials secret and a Lambda function that refreshes it. When you install in more ECS clusters in the same AWS account and Region, they can reuse the secret of the first installation instead of creating their own. The first installation stays the owner of the secret: keep it installed while other clusters use the secret.

Set the registry_secret_arn variable to the registry_credentials_secret_arn output of the first installation.

Multi-Cluster Mode​

To share one cluster manager across several ECS clusters, see Multi-Cluster Mode in the Runtime Terraform Module section.

gVisor Support​

The Upwind Sensor includes support for monitoring applications running in gVisor sandboxes, providing enhanced security isolation for sensitive workloads. gVisor implements a userspace kernel that acts as a security boundary between containerized applications and the host system.

Learn more about gVisor support including configuration, architecture, and deployment options.