Cluster Manager

Overview

The cluster_manager variable configures the Upwind cluster manager. All attributes are optional. PrivateLink settings are documented on the PrivateLink page.

Attribute	Type	Default	Description
`create`	`bool`	`true`	Whether the module deploys a cluster manager.
`domain`	`string`	`""`	The domain of an external cluster manager. Set it only when `create` is `false`.
`launch_type`	`string`	`"EC2"`	`EC2` or `FARGATE`. The module ignores it for service placement when `capacity_provider` is set.
`capacity_provider`	`string`	`""`	The capacity provider the service uses. See Capacity provider.
`image.registry`	`string`	`"registry.upwind.io"`	The image registry. See Image.
`image.repository`	`string`	`"images/cluster-agent"`	The image repository.
`image.tag`	`string`	`"0.66.2"`	The image tag.
`extra_env`	`map(string)`	`{}`	Extra environment variables for the container.
`resources.cpu`	`number`	`512`	CPU units for the task.
`resources.memory`	`number`	`1024`	Memory in MiB for the task.
`replicas`	`number`	`1`	The number of cluster manager tasks.
`cpu_architecture`	`string`	`"X86_64"`	The CPU architecture of the task.
`assign_public_ip`	`bool`	`false`	Fargate only. Whether the task gets a public IP address. Not supported with the EC2 launch type.
`security_groups`	`set(string)`	`[]`	IDs of extra security groups for the task.
`service_discovery`	`object`	`{}`	How the sensors, scanners, and tracers find the cluster manager. See Service discovery.
`privatelink`	`object`	`null`	PrivateLink settings. See PrivateLink.
`multi_cluster`	`bool`	`false`	Deprecated. It has no effect.

When the module deploys the cluster manager, you must also set vpc_id and subnets on the module.

Launch type, size, and replicas

module "upwind_ecs_runtime" {
  source = "https://get.upwind.io/terraform/modules/aws-ecs-runtime/aws-ecs-runtime-1.5.1.tar.gz"

  ecs_cluster_name = "my-ecs-cluster"
  vpc_id           = "vpc-0123456789abcdef0"
  subnets          = ["subnet-0123456789abcdef0", "subnet-0fedcba9876543210"]

  credentials = {
    client_id     = var.upwind_client_id
    client_secret = var.upwind_client_secret
  }

  cluster_manager = {
    launch_type      = "FARGATE"
    cpu_architecture = "ARM64"
    replicas         = 2

    resources = {
      cpu    = 1024
      memory = 2048
    }
  }
}

With the FARGATE launch type, the module adds the tracer sidecar to the cluster manager task. See the install guide for the Fargate settings.

Image

By default, the module pulls the cluster manager image from the Upwind registry. To pull it from a mirror, set image.registry. You can also set image.repository and image.tag.

cluster_manager = {
  image = {
    registry = "111122223333.dkr.ecr.us-east-1.amazonaws.com"
  }
}

If the mirror needs no Upwind credentials, also set credentials.registry_auth_enabled = false. See Credentials and secrets.

Extra environment variables

Use extra_env to add environment variables to the cluster manager container:

cluster_manager = {
  extra_env = {
    EXAMPLE_VARIABLE = "value"
  }
}

Capacity provider

By default, the cluster manager service runs with the launch_type you set. To run it on a specific capacity provider instead, set capacity_provider to its name. When you set it, the module ignores launch_type for service placement. Keep launch_type in line with the capacity provider, because it still decides the task definition type and whether the tracer sidecar is added.

cluster_manager = {
  capacity_provider = "my-capacity-provider"
}

Networking

By default, the task gets no public IP address. Set subnets to private subnets with a route to a NAT gateway. Add your own security groups with security_groups.

assign_public_ip works only when the cluster manager runs on Fargate (launch_type = "FARGATE"). AWS supports public IP assignment only for Fargate tasks, so the setting is not supported with the EC2 launch type.

cluster_manager = {
  launch_type      = "FARGATE"
  assign_public_ip = true
  security_groups  = ["sg-0123456789abcdef0"]
}

warning

assign_public_ip exists to support proofs of concept in VPCs that have no private subnets. Do not use it for a broad rollout. Use private subnets with a route to a NAT gateway, or a proxy, instead.

Service discovery

The sensors, scanners, and tracers must reach the cluster manager. The service_discovery object sets how. By default, the module creates an AWS Cloud Map private DNS namespace and a service in it. Set service_discovery.use_internal_lb = true to put an internal Network Load Balancer in front of the cluster manager instead.

Attribute	Type	Default	Description
`use_internal_lb`	`bool`	`false`	Use an internal Network Load Balancer instead of Cloud Map.
`enable_cross_zone_load_balancing`	`bool`	`true`	Cross-zone load balancing on the load balancer.
`namespace_id`	`string`	`""`	The ID of an existing Cloud Map namespace. When empty, the module creates one.
`namespace_name`	`string`	`""`	The name of the existing namespace. Set it together with `namespace_id`.
`service_name`	`string`	`"upwind-cluster-manager"`	The name of the Cloud Map service.
`ttl`	`number`	`10`	The DNS record TTL in seconds.

Use the internal load balancer:

cluster_manager = {
  service_discovery = {
    use_internal_lb = true
  }
}

Use an existing Cloud Map namespace:

cluster_manager = {
  service_discovery = {
    namespace_id   = "ns-0123456789abcdef0"
    namespace_name = "example.private"
  }
}

External cluster manager

To point the sensors and scanners at a cluster manager that runs elsewhere, set create = false and set domain to its address. The module deploys no cluster manager. You can then leave out vpc_id and subnets.

module "upwind_ecs_runtime" {
  source = "https://get.upwind.io/terraform/modules/aws-ecs-runtime/aws-ecs-runtime-1.5.1.tar.gz"

  ecs_cluster_name = "my-ecs-cluster"

  credentials = {
    client_id     = var.upwind_client_id
    client_secret = var.upwind_client_secret
  }

  cluster_manager = {
    create = false
    domain = "upwind-cluster-manager.example.private"
  }
}

You can set domain only when create is false.

Direct mode

If you set create = false and leave domain empty, the module runs in direct mode. The sensors and scanners connect straight to the Upwind backend and no cluster manager is involved.

cluster_manager = {
  create = false
}

Deprecated: multi_cluster

cluster_manager.multi_cluster is deprecated and has no effect. The cluster manager can describe tasks in any cluster, so you do not need to set it. Remove it from your configuration.

Overview​

Launch type, size, and replicas​

Image​

Extra environment variables​

Capacity provider​

Networking​

Service discovery​

External cluster manager​

Direct mode​

Deprecated: multi_cluster​