baalajimaestro/traefik
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions
traefik/docs/configuration/backends/ecs.md

210 lines
21 KiB
Markdown
Raw Normal View History

doc: structural review - user-guide review. - add DataDog and StatD configuration. - sync sample.toml and doc. - split entry points doc. - Deprecated.
2017-08-26 10:12:44 +00:00
# ECS Backend
Refactor doc pages
2017-08-25 19:32:33 +00:00
Enhance documentation readability.
2017-09-11 17:10:04 +00:00
Træfik can be configured to use Amazon ECS as a backend configuration.
## Configuration
Refactor doc pages
2017-08-25 19:32:33 +00:00
```toml
################################################################
# ECS configuration backend
################################################################
Enhance documentation readability.
2017-09-11 17:10:04 +00:00
# Enable ECS configuration backend.
Refactor doc pages
2017-08-25 19:32:33 +00:00
[ecs]
Enhance documentation readability.
2017-09-11 17:10:04 +00:00
# ECS Cluster Name.
Refactor doc pages
2017-08-25 19:32:33 +00:00
#
Enhance documentation readability.
2017-09-11 17:10:04 +00:00
# DEPRECATED - Please use `clusters`.
Refactor doc pages
2017-08-25 19:32:33 +00:00
#
Enhance documentation readability.
2017-09-11 17:10:04 +00:00
cluster = "default"
Refactor doc pages
2017-08-25 19:32:33 +00:00
Enhance documentation readability.
2017-09-11 17:10:04 +00:00
# ECS Clusters Name.
Refactor doc pages
2017-08-25 19:32:33 +00:00
#
# Optional
# Default: ["default"]
#
Enhance documentation readability.
2017-09-11 17:10:04 +00:00
clusters = ["default"]
Refactor doc pages
2017-08-25 19:32:33 +00:00
Enhance documentation readability.
2017-09-11 17:10:04 +00:00
# Enable watch ECS changes.
Refactor doc pages
2017-08-25 19:32:33 +00:00
#
# Optional
# Default: true
#
Enhance documentation readability.
2017-09-11 17:10:04 +00:00
watch = true
# Default domain used.
#
# Optional
# Default: ""
#
domain = "ecs.localhost"
Refactor doc pages
2017-08-25 19:32:33 +00:00
Enhance documentation readability.
2017-09-11 17:10:04 +00:00
# Enable auto discover ECS clusters.
Refactor doc pages
2017-08-25 19:32:33 +00:00
#
# Optional
# Default: false
#
Enhance documentation readability.
2017-09-11 17:10:04 +00:00
autoDiscoverClusters = false
Refactor doc pages
2017-08-25 19:32:33 +00:00
Enhance documentation readability.
2017-09-11 17:10:04 +00:00
# Polling interval (in seconds).
Refactor doc pages
2017-08-25 19:32:33 +00:00
#
# Optional
# Default: 15
#
Enhance documentation readability.
2017-09-11 17:10:04 +00:00
refreshSeconds = 15
Refactor doc pages
2017-08-25 19:32:33 +00:00
Enhance documentation readability.
2017-09-11 17:10:04 +00:00
# Expose ECS services by default in Traefik.
Refactor doc pages
2017-08-25 19:32:33 +00:00
#
# Optional
# Default: true
#
Enhance documentation readability.
2017-09-11 17:10:04 +00:00
exposedByDefault = false
Refactor doc pages
2017-08-25 19:32:33 +00:00
Enhance documentation readability.
2017-09-11 17:10:04 +00:00
# Region to use when connecting to AWS.
Refactor doc pages
2017-08-25 19:32:33 +00:00
#
# Optional
#
Enhance documentation readability.
2017-09-11 17:10:04 +00:00
region = "us-east-1"
Refactor doc pages
2017-08-25 19:32:33 +00:00
Normalize parameter names in configs
2018-04-06 07:38:03 +00:00
# Access Key ID to use when connecting to AWS.
Refactor doc pages
2017-08-25 19:32:33 +00:00
#
# Optional
#
Enhance documentation readability.
2017-09-11 17:10:04 +00:00
accessKeyID = "abc"
Refactor doc pages
2017-08-25 19:32:33 +00:00
Normalize parameter names in configs
2018-04-06 07:38:03 +00:00
# Secret Access Key to use when connecting to AWS.
Refactor doc pages
2017-08-25 19:32:33 +00:00
#
# Optional
#
Enhance documentation readability.
2017-09-11 17:10:04 +00:00
secretAccessKey = "123"
Refactor doc pages
2017-08-25 19:32:33 +00:00
Enhance documentation readability.
2017-09-11 17:10:04 +00:00
# Override default configuration template.
# For advanced users :)
doc: structural review - user-guide review. - add DataDog and StatD configuration. - sync sample.toml and doc. - split entry points doc. - Deprecated.
2017-08-26 10:12:44 +00:00
#
# Optional
#
# filename = "ecs.tmpl"
doc: template version for ECS, Consul Catalog and Mesos.
2018-03-28 22:18:50 +00:00
# Override template version
# For advanced users :)
#
# Optional
# - "1": previous template version (must be used only with older custom templates, see "filename")
# - "2": current template version (must be used to force template version when "filename" is used)
#
# templateVersion = "2"
Refactor doc pages
2017-08-25 19:32:33 +00:00
```
Normalize parameter names in configs
2018-04-06 07:38:03 +00:00
If `accessKeyID`/`secretAccessKey` is not given credentials will be resolved in the following order:
Refactor doc pages
2017-08-25 19:32:33 +00:00
- From environment variables; `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and `AWS_SESSION_TOKEN`.
- Shared credentials, determined by `AWS_PROFILE` and `AWS_SHARED_CREDENTIALS_FILE`, defaults to `default` and `~/.aws/credentials`.
- EC2 instance role or ECS task role
Enhance documentation readability.
2017-09-11 17:10:04 +00:00
## Policy
Refactor doc pages
2017-08-25 19:32:33 +00:00
Træfik needs the following policy to read ECS information:
```json
{
"Version": "2012-10-17",
"Statement": [
{
Fix IAM policy sid.
2017-09-07 08:08:04 +00:00
"Sid": "TraefikECSReadAccess",
Refactor doc pages
2017-08-25 19:32:33 +00:00
"Effect": "Allow",
"Action": [
"ecs:ListClusters",
"ecs:DescribeClusters",
"ecs:ListTasks",
"ecs:DescribeTasks",
"ecs:DescribeContainerInstances",
"ecs:DescribeTaskDefinition",
"ec2:DescribeInstances"
],
"Resource": [
"*"
]
}
]
}
```
Enhance documentation readability.
2017-09-11 17:10:04 +00:00
## Labels: overriding default behaviour
Labels can be used on task containers to override default behaviour:
doc(ecs): update labels documentation.
2017-12-20 22:11:00 +00:00
| Label | Description |
|------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `traefik.enable=false` | Disable this container in Træfik |
| `traefik.port=80` | Override the default `port` value. Overrides `NetworkBindings` from Docker Container |
| `traefik.protocol=https` | Override the default `http` protocol |
| `traefik.weight=10` | Assign this weight to the container |
| `traefik.backend=foo` | Give the name `foo` to the generated backend for this container. |
Request buffering middleware
2018-01-31 14:32:04 +00:00
| `traefik.backend.buffering.maxRequestBodyBytes=0` | See [buffering](/configuration/commons/#buffering) section. |
| `traefik.backend.buffering.maxResponseBodyBytes=0` | See [buffering](/configuration/commons/#buffering) section. |
| `traefik.backend.buffering.memRequestBodyBytes=0` | See [buffering](/configuration/commons/#buffering) section. |
| `traefik.backend.buffering.memResponseBodyBytes=0` | See [buffering](/configuration/commons/#buffering) section. |
| `traefik.backend.buffering.retryExpression=EXPR` | See [buffering](/configuration/commons/#buffering) section. |
doc(ecs): update labels documentation.
2017-12-20 22:11:00 +00:00
| `traefik.backend.circuitbreaker.expression=EXPR` | Create a [circuit breaker](/basics/#backends) to be used against the backend |
| `traefik.backend.healthcheck.path=/health` | Enable health check for the backend, hitting the container at `path`. |
| `traefik.backend.healthcheck.port=8080` | Allow to use a different port for the health check. |
| `traefik.backend.healthcheck.interval=1s` | Define the health check interval. (Default: 30s) |
add http headers to healthcheck
2018-04-16 09:40:03 +00:00
| `traefik.backend.healthcheck.hostname=foobar.com` | Define the health check hostname. |
| `traefik.backend.healthcheck.headers=EXPR` | Define the health check request headers <br>Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code> |
doc(ecs): update labels documentation.
2017-12-20 22:11:00 +00:00
| `traefik.backend.loadbalancer.method=drr` | Override the default `wrr` load balancer algorithm |
| `traefik.backend.loadbalancer.stickiness=true` | Enable backend sticky sessions |
| `traefik.backend.loadbalancer.stickiness.cookieName=NAME` | Manually set the cookie name for sticky sessions |
| `traefik.backend.loadbalancer.sticky=true` | Enable backend sticky sessions (DEPRECATED) |
| `traefik.backend.maxconn.amount=10` | Set a maximum number of connections to the backend.<br>Must be used in conjunction with the below label to take effect. |
| `traefik.backend.maxconn.extractorfunc=client.ip` | Set the function to be used against the request to determine what to limit maximum connections to the backend by.<br>Must be used in conjunction with the above label to take effect. |
| `traefik.frontend.auth.basic=EXPR` | Sets basic authentication for that frontend in CSV format: `User:Hash,User:Hash` |
| `traefik.frontend.entryPoints=http,https` | Assign this frontend to entry points `http` and `https`.<br>Overrides `defaultEntryPoints` |
| `traefik.frontend.errors.<name>.backend=NAME` | See [custom error pages](/configuration/commons/#custom-error-pages) section. |
| `traefik.frontend.errors.<name>.query=PATH` | See [custom error pages](/configuration/commons/#custom-error-pages) section. |
| `traefik.frontend.errors.<name>.status=RANGE` | See [custom error pages](/configuration/commons/#custom-error-pages) section. |
| `traefik.frontend.passHostHeader=true` | Forward client `Host` header to the backend. |
| `traefik.frontend.passTLSCert=true` | Forward TLS Client certificates to the backend. |
| `traefik.frontend.priority=10` | Override default frontend priority |
Fix typo in doc for rate limit label
2018-02-01 07:04:03 +00:00
| `traefik.frontend.rateLimit.extractorFunc=EXP` | See [rate limiting](/configuration/commons/#rate-limiting) section. |
| `traefik.frontend.rateLimit.rateSet.<name>.period=6` | See [rate limiting](/configuration/commons/#rate-limiting) section. |
| `traefik.frontend.rateLimit.rateSet.<name>.average=6` | See [rate limiting](/configuration/commons/#rate-limiting) section. |
| `traefik.frontend.rateLimit.rateSet.<name>.burst=6` | See [rate limiting](/configuration/commons/#rate-limiting) section. |
doc(ecs): update labels documentation.
2017-12-20 22:11:00 +00:00
| `traefik.frontend.redirect.entryPoint=https` | Enables Redirect to another entryPoint for that frontend (e.g. HTTPS) |
| `traefik.frontend.redirect.regex=^http://localhost/(.*)` | Redirect to another URL for that frontend.<br>Must be set with `traefik.frontend.redirect.replacement`. |
| `traefik.frontend.redirect.replacement=http://mydomain/$1` | Redirect to another URL for that frontend.<br>Must be set with `traefik.frontend.redirect.regex`. |
Fix typo in doc for rate limit label
2018-02-01 07:04:03 +00:00
| `traefik.frontend.redirect.permanent=true` | Return 301 instead of 302. |
doc(ecs): update labels documentation.
2017-12-20 22:11:00 +00:00
| `traefik.frontend.rule=EXPR` | Override the default frontend rule. Default: `Host:{instance_name}.{domain}`. |
Ability to use "X-Forwarded-For" as a source of IP for white list.
2018-03-23 16:40:04 +00:00
| `traefik.frontend.whiteList.sourceRange=RANGE` | List of IP-Ranges which are allowed to access.<br>An unset or empty list allows all Source-IPs to access. If one of the Net-Specifications are invalid, the whole list is invalid and allows all Source-IPs to access. |
| `traefik.frontend.whiteList.useXForwardedFor=true` | Use `X-Forwarded-For` header as valid source of IP for the white list. |
doc(ecs): update labels documentation.
2017-12-20 22:11:00 +00:00
Split security labels and custom labels documentation.
2018-02-16 15:04:05 +00:00
### Custom Headers
| Label | Description |
|-------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `traefik.frontend.headers.customRequestHeaders=EXPR ` | Provides the container with custom request headers that will be appended to each request forwarded to the container.<br>Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code> |
| `traefik.frontend.headers.customResponseHeaders=EXPR` | Appends the headers to each response returned by the container, before forwarding the response to the client.<br>Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code> |
### Security Headers
doc(ecs): update labels documentation.
2017-12-20 22:11:00 +00:00
| Label | Description |
|----------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `traefik.frontend.headers.allowedHosts=EXPR` | Provides a list of allowed hosts that requests will be processed.<br>Format: `Host1,Host2` |
| `traefik.frontend.headers.hostsProxyHeaders=EXPR ` | Provides a list of headers that the proxied hostname may be stored.<br>Format: `HEADER1,HEADER2` |
| `traefik.frontend.headers.SSLRedirect=true` | Forces the frontend to redirect to SSL if a non-SSL request is sent. |
| `traefik.frontend.headers.SSLTemporaryRedirect=true` | Forces the frontend to redirect to SSL if a non-SSL request is sent, but by sending a 302 instead of a 301. |
| `traefik.frontend.headers.SSLHost=HOST` | This setting configures the hostname that redirects will be based on. Default is "", which is the same host as the request. |
| `traefik.frontend.headers.SSLProxyHeaders=EXPR` | Header combinations that would signify a proper SSL Request (Such as `X-Forwarded-For:https`).<br>Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code> |
| `traefik.frontend.headers.STSSeconds=315360000` | Sets the max-age of the STS header. |
| `traefik.frontend.headers.STSIncludeSubdomains=true` | Adds the `IncludeSubdomains` section of the STS header. |
| `traefik.frontend.headers.STSPreload=true` | Adds the preload flag to the STS header. |
| `traefik.frontend.headers.forceSTSHeader=false` | Adds the STS header to non-SSL requests. |
| `traefik.frontend.headers.frameDeny=false` | Adds the `X-Frame-Options` header with the value of `DENY`. |
| `traefik.frontend.headers.customFrameOptionsValue=VALUE` | Overrides the `X-Frame-Options` header with the custom value. |
| `traefik.frontend.headers.contentTypeNosniff=true` | Adds the `X-Content-Type-Options` header with the value `nosniff`. |
| `traefik.frontend.headers.browserXSSFilter=true` | Adds the X-XSS-Protection header with the value `1; mode=block`. |
New option in secure middleware
2018-03-02 13:24:03 +00:00
| `traefik.frontend.headers.customBrowserXSSValue=VALUE` | Set custom value for X-XSS-Protection header. This overrides the BrowserXssFilter option. |
doc(ecs): update labels documentation.
2017-12-20 22:11:00 +00:00
| `traefik.frontend.headers.contentSecurityPolicy=VALUE` | Adds CSP Header with the custom value. |
| `traefik.frontend.headers.publicKey=VALUE` | Adds pinned HTST public key header. |
| `traefik.frontend.headers.referrerPolicy=VALUE` | Adds referrer policy header. |
| `traefik.frontend.headers.isDevelopment=false` | This will cause the `AllowedHosts`, `SSLRedirect`, and `STSSeconds`/`STSIncludeSubdomains` options to be ignored during development.<br>When deploying to production, be sure to set this to false. |
Reference in a new issue Copy permalink