Traefik & AWS ECS¶
A Story of Labels & Elastic Containers
Attach labels to your ECS containers and let Traefik do the rest!
Configuration Examples¶
Configuring ECS provider
Enabling the ECS provider:
providers:
ecs: {}
[providers.ecs]
--providers.ecs=true
Policy¶
Traefik needs the following policy to read ECS information:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "TraefikECSReadAccess",
"Effect": "Allow",
"Action": [
"ecs:ListClusters",
"ecs:DescribeClusters",
"ecs:ListTasks",
"ecs:DescribeTasks",
"ecs:DescribeContainerInstances",
"ecs:DescribeTaskDefinition",
"ec2:DescribeInstances"
],
"Resource": [
"*"
]
}
]
}
Provider Configuration¶
autoDiscoverClusters
¶
Optional, Default=false
Search for services in cluster list.
- If set to
true
service discovery is disabled on configured clusters, but enabled for all other clusters. - If set to
false
service discovery is enabled on configured clusters only.
providers:
ecs:
autoDiscoverClusters: true
# ...
[providers.ecs]
autoDiscoverClusters = true
# ...
--providers.ecs.autoDiscoverClusters=true
# ...
clusters
¶
Optional, Default=["default"]
Search for services in cluster list.
providers:
ecs:
clusters:
- default
# ...
[providers.ecs]
clusters = ["default"]
# ...
--providers.ecs.clusters=default
# ...
exposedByDefault
¶
Optional, Default=true
Expose ECS services by default in Traefik.
If set to false
, services that do not have a traefik.enable=true
label are ignored from the resulting routing configuration.
providers:
ecs:
exposedByDefault: false
# ...
[providers.ecs]
exposedByDefault = false
# ...
--providers.ecs.exposedByDefault=false
# ...
defaultRule
¶
Optional, Default=Host(`{{ normalize .Name }}`)
The defaultRule
option defines what routing rule to apply to a container if no rule is defined by a label.
It must be a valid Go template, and can use
sprig template functions.
The container service name can be accessed with the Name
identifier,
and the template has access to all the labels defined on this container.
providers:
ecs:
defaultRule: "Host(`{{ .Name }}.{{ index .Labels \"customLabel\"}}`)"
# ...
[providers.ecs]
defaultRule = "Host(`{{ .Name }}.{{ index .Labels \"customLabel\"}}`)"
# ...
--providers.ecs.defaultRule=Host(`{{ .Name }}.{{ index .Labels \"customLabel\"}}`)
# ...
refreshSeconds
¶
Optional, Default=15
Polling interval (in seconds).
providers:
ecs:
refreshSeconds: 15
# ...
[providers.ecs]
refreshSeconds = 15
# ...
--providers.ecs.refreshSeconds=15
# ...
Credentials¶
Optional
If region
is not provided, it is resolved from the EC2 metadata endpoint for EC2 tasks.
In a FARGATE context it is resolved from the AWS_REGION
environment variable.
If accessKeyID
and secretAccessKey
are not provided, credentials are resolved in the following order:
- Using the environment variables
AWS_ACCESS_KEY_ID
,AWS_SECRET_ACCESS_KEY
, andAWS_SESSION_TOKEN
. - Using shared credentials, determined by
AWS_PROFILE
andAWS_SHARED_CREDENTIALS_FILE
, defaults todefault
and~/.aws/credentials
. - Using EC2 instance role or ECS task role
providers:
ecs:
region: us-east-1
accessKeyID: "abc"
secretAccessKey: "123"
# ...
[providers.ecs]
region = "us-east-1"
accessKeyID = "abc"
secretAccessKey = "123"
--providers.ecs.region="us-east-1"
--providers.ecs.accessKeyID="abc"
--providers.ecs.secretAccessKey="123"
# ...