Skip to main content

Install Upwind on Kubernetes

Overview​

This topic provides instructions on installing the Upwind Sensor in a Kubernetes environment. By default, the Upwind Sensor runs as a DaemonSet.

Generate Credentials​

note

This step is relevant only if you want to create new client credentials. If you already have client credentials, you can skip this step.

Select the + (plus) symbol at the top of the screen and select Connect Kubernetes Cluster. Select Generate a new one to create a new client ID and client secret. Provide a name and select Generate.

Alternatively, you can generate it in the Credentials page in the console.

Provide Client Credentials​

There are two ways to provide the credentials to the Sensor: pre-create a Kubernetes Secret (recommended), or pass them inline to helm install. The install commands below adapt to whichever you pick here.

Pre-create a Secret in the upwind namespace. This keeps the client secret out of shell history, out of ps / /proc/<pid>/cmdline, and out of the Helm release storage Secret (where any user with namespace read access could otherwise recover it):

kubectl create namespace upwind

There are two ways to create the Secret itself. Both produce an identical Secret in the cluster.

tip

The leading space before each export keeps the credentials out of your shell history.

# Upwind Client Credentials
 export UPWIND_CLIENT_ID="<redacted>"
 export UPWIND_CLIENT_SECRET="<redacted>"

kubectl create secret generic upwind-secret -n upwind \
  --from-literal=clientId="$UPWIND_CLIENT_ID" \
  --from-literal=clientSecret="$UPWIND_CLIENT_SECRET"
note

The Amazon EKS Add-on requires the Secret to be named exactly upwind-operator-client-credentials instead of upwind-secret. See the EKS Add-on tab below for the EKS-specific instructions.

Install​

Selecting your region

By default the Upwind components connect to the US region. If your Upwind tenant is in another region, set the region as part of the install:

  • Survey tool: pass --region eu (or --region me) to the upwindctl kubernetes survey command.
  • Manual / Helm: set the top-level region Helm value, for example --set region=eu (or --set region=me), or add region: eu to your values file.
  • Terraform: add upwind_region = "eu" (or "me") to the module block.
  • Helm Umbrella Chart: set the region on the operator subchart, for example --set upwind-operator.region=eu.
  • Helm Operatorless: add --set region=eu to both the Cluster Manager and the Sensor install commands, and in Step 1 request the registry token from your region's token URL, for example https://oauth.eu.upwind.io/oauth/token.

The default is us.

Prerequisites​

  • Helm installed.
  • Review the Upwind Helm chart releases in the Release Notes section of the Upwind Documentation Center.
note

If you are deploying the Upwind agent on an AWS EC2 container instance instance in AWS and using IMDSv2, it is necessary to set the hop limit to 2. This configuration allows the agent to successfully query the instance metadata service.

Step 1. Upwind Operator Deployment​

To deploy the Upwind Operator, you can either use our survey tool to guide you through the process or manually deploy the operator. We highly recommend using the survey tool to ensure that you have the correct configuration for your environment.

A prerequisite for using the survey tool is to have access to the Kubernetes cluster by having a kubeconfig and set to the correct context.

The Kubernetes Survey will check your cluster for size, internet connectivity, and other factors to determine the best way to deploy the Upwind Operator. It will generate the installation instructions for you to follow.

The survey reads your client credentials from the UPWIND_CLIENT_ID and UPWIND_CLIENT_SECRET environment variables. Export them first, as shown in Provide Client Credentials, if they aren't already set in your shell.

curl -fsSL https://get.upwind.io/upwindctl.sh | bash -s -- kubernetes survey
warning

The survey prints Helm install commands that contain your client ID and client secret, so don't share its output. If you created the Kubernetes Secret in Provide Client Credentials, replace the --set credentials.clientId=... and --set credentials.clientSecret=... lines in the printed command with:

--set credentials.create=false \
--set credentials.name=upwind-secret \

Step 2. Test Connectivity​

It is recommended to validate that none of the resources deployed by Upwind are in a Pending/Failed or any other error state, which will prevent Upwind from operating as expected.

Run the following commands to confirm that the Upwind components are installed and running:

kubectl get agent,clusteragent --namespace upwind
kubectl get pods --namespace upwind

Both resources should show READY as True and STATUS as Installed, and every pod should be Running with all containers ready.

Clean Up​

Once the install is complete and you have verified the Sensor is running, clean up any temporary credential artifacts on your local machine. The Secret stored in the cluster is what the Sensor uses at runtime — the local artifacts are no longer needed.

  • If you exported environment variables, unset them so they do not linger in the shell:

    unset UPWIND_CLIENT_ID UPWIND_CLIENT_SECRET

  • If you created a manifest file (e.g. upwind-secret.yaml), delete it — or move it into a secrets manager such as Sealed Secrets or External Secrets Operator if you need GitOps-friendly long-term storage:

    rm -i upwind-secret.yaml

Troubleshooting​

If you encounter any issues during the installation process, please refer to the Troubleshooting guide, where you can find a list of possible issues and solutions.