Skip to main content

Install Upwind on Kubernetes

Overview​

This topic provides instructions on installing the Upwind Sensor in a Kubernetes environment. By default, the Upwind Sensor runs as a DaemonSet.

Generate Credentials​

note

This step is relevant only if you want to create new client credentials. If you already have client credentials, you can skip this step.

Select the + (plus) symbol at the top of the screen and select Connect Kubernetes Cluster. Select Generate a new one to create a new client ID and client secret. Provide a name and select Generate.

Alternatively, you can generate it in the Credentials page in the console. For more information review the documentation on Credentials.

Provide Client Credentials​

There are two ways to provide the credentials to the Sensor: pre-create a Kubernetes Secret (recommended), or pass them inline to helm install. The install commands below adapt to whichever you pick here.

Pre-create a Secret in the upwind namespace. This keeps the client secret out of shell history, out of ps / /proc/<pid>/cmdline, and out of the Helm release storage Secret (where any user with namespace read access could otherwise recover it):

kubectl create namespace upwind

There are two ways to create the Secret itself. Both produce an identical Secret in the cluster.

tip

The leading space before each export keeps the credentials out of your shell history.

# Upwind Client Credentials
 export UPWIND_CLIENT_ID="<redacted>"
 export UPWIND_CLIENT_SECRET="<redacted>"

kubectl create secret generic upwind-secret -n upwind \
  --from-literal=clientId="$UPWIND_CLIENT_ID" \
  --from-literal=clientSecret="$UPWIND_CLIENT_SECRET"
note

The Amazon EKS Add-on requires the Secret to be named exactly upwind-operator-client-credentials instead of upwind-secret. See the EKS Add-on tab below for the EKS-specific instructions.

Install​

Prerequisites​

note

If you are deploying the Upwind agent on an AWS EC2 container instance instance in AWS and using IMDSv2, it is necessary to set the hop limit to 2. This configuration allows the agent to successfully query the instance metadata service.

Step 1. Upwind Operator Deployment​

To deploy the Upwind Operator, you can either use our survey tool to guide you through the process or manually deploy the operator. We highly recommend using the survey tool to ensure that you have the correct configuration for your environment.

A prerequisite for using the survey tool is to have access to the Kubernetes cluster by having a kubeconfig and set to the correct context.

The Kubernetes Survey will check your cluster for size, internet connectivity, and other factors to determine the best way to deploy the Upwind Operator. It will generate the installation instructions for you to follow.

Make sure to fill in the UPWIND_CLIENT_ID and UPWIND_CLIENT_SECRET fields with the values you generated in Step 1.

curl -s https://get.upwind.io/upwindctl.sh | bash -s -- kubernetes survey \
  --client-id=${UPWIND_CLIENT_ID} \
  --client-secret=${UPWIND_CLIENT_SECRET}
note

For EU or ME tenants pass --region eu (or --region me). Default is us. Omitting the flag generates Helm values with region: us, which points the operator at the US backend.

warning

The Survey command passes the client secret on its argv. While the variable name ${UPWIND_CLIENT_SECRET} is what your shell history sees, the expanded value is briefly visible in ps / /proc/<pid>/cmdline while the command runs. Run it on a trusted host. The output of upwindctl kubernetes survey is a set of Helm install instructions — when you run those, you can choose the Kubernetes Secret approach in Provide Client Credentials to keep the secret out of further command lines.

Step 2. Test Connectivity​

It is recommended to validate that none of the resources deployed by Upwind are in a Pending/Failed or any other error state, which will prevent Upwind from operating as expected.

Run the following command to validate that all the resources are in a Running state:

kubectl get agent,clusteragent --namespace upwind

Clean Up​

Once the install is complete and you have verified the Sensor is running, clean up any temporary credential artifacts on your local machine. The Secret stored in the cluster is what the Sensor uses at runtime — the local artifacts are no longer needed.

  • If you exported environment variables, unset them so they do not linger in the shell:

    unset UPWIND_CLIENT_ID UPWIND_CLIENT_SECRET

  • If you created a manifest file (e.g. upwind-secret.yaml), delete it — or move it into a secrets manager such as Sealed Secrets or External Secrets Operator if you need GitOps-friendly long-term storage:

    rm -i upwind-secret.yaml

Troubleshooting​

If you encounter any issues during the installation process, please refer to the Troubleshooting guide, where you can find a list of possible issues and solutions.