Configuration

Proxy Configuration

The Cluster Manager respects the HTTP_PROXY family of environment variables. Set the proxy for your installation method.

Terraform

Set the proxy_configuration variable. https_proxy defaults to the value of http_proxy when omitted. To exclude hosts from the proxy, add no_proxy with a comma-separated list of hosts.

proxy_configuration = {
  enabled    = true
  http_proxy = "http://proxy.service:1234"
}

CloudFormation

Set the Proxy parameter to the proxy URL, for example http://proxy.service:1234. To exclude hosts from the proxy, set the NoProxy parameter to a comma-separated list of hosts.

Cluster Manager CPU Architecture

The Cluster Manager runs on X86_64 by default. To run it on AWS Graviton (ARM64), set the architecture for your installation method.

Terraform

Set the cluster_manager_cpu_architecture variable.

cluster_manager_cpu_architecture = "ARM64"

CloudFormation

Set the ClusterManagerCPUArchitecture parameter to ARM64.

Share the Registry Secret

Each installation creates a registry credentials secret and a Lambda function that refreshes it. When you install in more ECS clusters in the same AWS account and Region, they can reuse the secret of the first installation instead of creating their own. The first installation stays the owner of the secret: keep it installed while other clusters use the secret.

Terraform

Set the registry_secret_arn variable to the registry_credentials_secret_arn output of the first installation.

CloudFormation

Set the RegistrySecretARN parameter to the RegistrySecretARN output of the first stack.

Multi Cluster Mode

In some Fargate environments its quite common to run a single cluster for a workload given that there is no overhead to creating clusters since they don't have to provision any resources.

In order to support this mode the onboarding modules have a configuration option to enable this feature.

info

Workloads communicating with the cluster manager will have to belong to the same VPC.

Terraform

Set the multi_cluster variable to true

multi_cluster = true

CloudFormation

Set the MultiCluster parameter to true

In order to configure the upwind-tracer to communicate with the cluster manager the UPWIND_TRACER_API_HOST variable will need to be explicitly set for each workload with the fully qualified domain name of the cluster manager including the port 8082.

Example: Given a cluster name fargate-utility the UPWIND_TRACER_API_HOST variable will need to be set to

 "environment": [
  {
    "name": "UPWIND_TRACER_API_HOST",
    "value": "upwind-cluster-manager.upwind-fargate-utility.private:8082"
  }
]

API Security

API security is enabled for the tracer after version 0.6.2 by setting the UPWIND_TRACER_EXTENDED_SYSCALLS and UPWIND_TRACER_REPORT_API_CATALOG to true.

Required Dependency

This feature depends on the cluster manager at version v0.57.0 or later. This is required for the tracer to get the configured sensitive data patterns to match and filter on.

Example: Enabling API security.

 "environment": [
  {
    "name": "UPWIND_TRACER_EXTENDED_SYSCALLS",
    "value": "true"
  },
  {
    "name": "UPWIND_TRACER_REPORT_API_CATALOG",
    "value": "true"
  }
]

important

This feature requires traffic to be decrypted.

warning

Enabling this feature adds processing that increases the latency of application workloads.

Automated Task Definition Patching

For Infrastructure as Code workflows, you can use the upwindctl ECS command to automatically patch your task definitions and inject the Upwind Tracer. This tool is particularly useful when managing task definitions with Terraform or CloudFormation.