Configuration Reference - AWS

Configuring your DC/OS installation on AWS using the Universal Installer

The Mesosphere Universal Installer supports a wide range of inputs/variables to add to your main.tf and enable you to customize your DC/OS cluster to your needs. These inputs/variables include everything from specifying the operating system (CentOS, Ubuntu, RHEL, Oracle Linux) to setting the garbage collection time of your DC/OS cluster.

The Terraform-based Universal Installer is designed to be flexible with configuration. Below is an example of a custom main.tf that provisions a customized DC/OS 1.13.3 cluster on AWS.

  1. provider "aws" {
  2. # Change your default region here
  3. region = "us-east-1"
  4. }
  5. # Used to determine your public IP for forwarding rules
  6. data "http" "whatismyip" {
  7. url = "http://whatismyip.akamai.com/"
  8. }
  9. module "dcos" {
  10. source = "dcos-terraform/dcos/aws"
  11. version = "~> 0.3.0"
  12. providers = {
  13. aws = aws
  14. }
  15. cluster_name = "my-dcos-demo"
  16. ssh_public_key_file = "<path-to-public-key-file>"
  17. admin_ips = ["${data.http.whatismyip.body}/32"]
  18. num_masters = 3
  19. num_private_agents = 2
  20. num_public_agents = 1
  21. dcos_version = "2.1"
  22. # dcos_variant = "ee"
  23. # dcos_license_key_contents = "${file("./license.txt")}"
  24. # Make sure to set your credentials if you do not want the default EE
  25. # dcos_superuser_username = "superuser-name"
  26. # dcos_superuser_password_hash = "${file("./dcos_superuser_password_hash.sha512")}"
  27. dcos_variant = "open"
  28. # availability_zones = ["<your_selected_region>a"]
  29. dcos_cluster_docker_credentials_enabled = "true"
  30. dcos_cluster_docker_credentials_write_to_etc = "true"
  31. dcos_cluster_docker_credentials_dcos_owned = "false"
  32. dcos_cluster_docker_registry_url = "https://index.docker.io"
  33. dcos_use_proxy = "yes"
  34. dcos_http_proxy = "example.com"
  35. dcos_https_proxy = "example.com"
  36. dcos_no_proxy = <<EOF
  37. # YAML
  38. - "internal.net"
  39. - "169.254.169.254"
  40. EOF
  41. dcos_overlay_network = <<EOF
  42. # YAML
  43. vtep_subnet: 44.128.0.0/20
  44. vtep_mac_oui: 70:B3:D5:00:00:00
  45. overlays:
  46. - name: dcos
  47. subnet: 12.0.0.0/8
  48. prefix: 26
  49. EOF
  50. dcos_rexray_config = <<EOF
  51. # YAML
  52. rexray:
  53. loglevel: warn
  54. modules:
  55. default-admin:
  56. host: tcp://127.0.0.1:61003
  57. storageDrivers:
  58. - ec2
  59. volume:
  60. unmount:
  61. ignoreusedcount: true
  62. EOF
  63. dcos_cluster_docker_credentials = <<EOF
  64. # YAML
  65. auths:
  66. 'https://index.docker.io/v1/':
  67. auth: Ze9ja2VyY3licmljSmVFOEJrcTY2eTV1WHhnSkVuVndjVEE=
  68. EOF
  69. }
  70. output "cluster-address" {
  71. value = module.dcos.masters-loadbalancer
  72. }

Supported DC/OS Versions

Currently, the Universal Installer defaults to 1.11.4 when using v0.1.0 modules and 1.13.3 for v0.2.0 modules. The following versions of DC/OS are currently supported. It is always recommended to specify a version.

  1. dcos_version: "1.13.3"
DC/OS Release1.131.121.111.10
Latest“1.13.3”“1.12.4”“1.11.11”“1.10.11”
-“1.13.2”“1.12.3”“1.11.10”“1.10.10”
-“1.13.1”“1.12.2”“1.11.9”“1.10.9”
-“1.13.0”“1.12.1”“1.11.8”“1.10.8”
--“1.12.0”“1.11.7”“1.10.7”
---“1.11.6”“1.10.6”
---“1.11.5”“1.10.5”
---“1.11.4”“1.10.4”
---“1.11.3”“1.10.3”
---“1.11.2”“1.10.2”
---“1.11.1”“1.10.1”
---1.11.0“1.10.0”

Supported Instance (Node) OS Versions

The default instance OS is currently centos_7.5, and will be applied unless specified in the configuration. The following instance operating systems are supported by DC/OS. To change the default OS, the following paramaters can be changed:

  1. dcos_instance_os = "centos_7.5"
Instance OS VersionValue
CentOS 7.6“centos_7.6”
CentOS 7.5“centos_7.5”
CentOS 7.4“centos_7.4”
RHEL“rhel_7.6”
RHEL“rhel_7.5”
RHEL“rhel_7.4”

Here is a list of all the variables that are currently supported on the Universal Installer and available for you to customize your cluster.

Inputs

NameDescriptionTypeDefaultRequired
admin_ipsList of CIDR admin IPslistn/ayes
ssh_public_key_filePath to SSH public key. This is mandatory but can be set to an empty string if you want to use ssh_public_key with the key as string.stringn/ayes
accepted_internal_networksSubnet ranges for all internal networkslist[]no
additional_private_agent_ipsAdditional private agent IPs.list[]no
additional_public_agent_ipsAdditional public agent IPs.list[]no
additional_windows_private_agent_ipsAdditional windows private agent IPslist[]no
additional_windows_private_agent_os_userAdditional windows private agent os user to be used for WinRMstring“Administrator”no
additional_windows_private_agent_passwordsAdditional windows private agent passwords to be used for WinRMlist[]no
ansible_additional_configAdd additional config options to ansible. This is getting merged with generated defaults. Do not specify dcos:string“”no
ansible_bundled_containerDocker container with bundled dcos-ansible and ansible executablesstring“mesosphere/dcos-ansible-bundle:latest”no
availability_zonesList of availability_zones to be used as the same format that are required by the platform/cloud providers. i.e [‘RegionZone’]list[]no
aws_amiAMI that will be used for the instances instead of the Mesosphere chosen default images. Custom AMIs must fulfill the Mesosphere DC/OS system-requirements: See /mesosphere/dcos/1.12/installing/production/system-requirements/string“”no
aws_key_nameSpecify the aws ssh key to use. We assume its already loaded in your SSH agent. Set ssh_public_key_file to empty stringstring“”no
bootstrap_associate_public_ip_address[BOOTSTRAP] Associate a public ip address with there instancesstring“true”no
bootstrap_aws_ami[BOOTSTRAP] AMI to be usedstring“”no
bootstrap_hostname_format[BOOTSTRAP] Format the hostname inputs are index+1, region, cluster_namestring“%[3]s-bootstrap%[1]d-%[2]s”no
bootstrap_iam_instance_profile[BOOTSTRAP] Instance profile to be used for these instancesstring“”no
bootstrap_instance_type[BOOTSTRAP] Instance typestring“t2.medium”no
bootstrap_os[BOOTSTRAP] Operating system to use. Instead of using your own AMI you could use a provided OS.string“”no
bootstrap_private_ipPrivate IP bootstrap nginx is listening on. Used to build the bootstrap URL.string“”no
bootstrap_root_volume_size[BOOTSTRAP] Root volume size in GBstring“80”no
bootstrap_root_volume_type[BOOTSTRAP] Root volume typestring“standard”no
cluster_nameName of the DC/OS clusterstring“dcos-example”no
cluster_name_random_stringAdd a random string to the cluster namestring“false”no
custom_dcos_download_pathinsert location of dcos installer script (optional)string“”no
dcos_adminrouter_tls_1_0_enabledIndicates whether to enable TLSv1 support in Admin Router. (optional)string“”no
dcos_adminrouter_tls_1_1_enabledIndicates whether to enable TLSv1.1 support in Admin Router. (optional)string“”no
dcos_adminrouter_tls_1_2_enabledIndicates whether to enable TLSv1.2 support in Admin Router. (optional)string“”no
dcos_adminrouter_tls_cipher_suite[Enterprise DC/OS] Indicates whether to allow web browsers to send the DC/OS authentication cookie through a non-HTTPS connection. (optional)string“”no
dcos_agent_listused to list the agents in the config.yaml (optional)list[]no
dcos_audit_logging[Enterprise DC/OS] enable security decisions are logged for Mesos, Marathon, and Jobs. (optional)string“”no
dcos_auth_cookie_secure_flag[Enterprise DC/OS] allow web browsers to send the DC/OS authentication cookie through a non-HTTPS connection. (optional)string“”no
dcos_aws_access_key_idAWS key ID for exhibitor storage (optional but required with dcos_exhibitor_address)string“”no
dcos_aws_regionAWS region for exhibitor storage (optional but required with dcos_exhibitor_address)string“”no
dcos_aws_secret_access_keyAWS secret key for exhibitor storage (optional but required with dcos_exhibitor_address)string“”no
dcos_aws_template_storage_access_key_idAWS key ID for CloudFormation template storage (optional)string“”no
dcos_aws_template_storage_bucketAWS CloudFormation bucket name (optional)string“”no
dcos_aws_template_storage_bucket_pathAWS CloudFormation bucket path (optional)string“”no
dcos_aws_template_storage_region_nameAWS CloudFormation region name (optional)string“”no
dcos_aws_template_storage_secret_access_keyAWS secret key for the CloudFormation template (optional)string“”no
dcos_aws_template_uploadTo automatically upload the customized advanced templates to your S3 bucket. (optional)string“”no
dcos_bootstrap_portPort of the bootstrap URLstring“8080”no
dcos_bouncer_expiration_auth_token_days[Enterprise DC/OS] Sets the auth token time-to-live (TTL) for Identity and Access Management. (optional)string“”no
dcos_ca_certificate_chain_path[Enterprise DC/OS] Path (relative to the $DCOS_INSTALL_DIR) to a file containing the complete CA certification chain required for end-entity certificate verification, in the OpenSSL PEM format. (optional)string“”no
dcos_ca_certificate_key_path[Enterprise DC/OS] Path (relative to the $DCOS_INSTALL_DIR) to a file containing a single X.509 certificate private key in the OpenSSL PEM format. (optional)string“”no
dcos_ca_certificate_path[Enterprise DC/OS] Path (relative to the $DCOS_INSTALL_DIR) to a file containing a single X.509 CA certificate in the OpenSSL PEM format. (optional)string“”no
dcos_check_timeCheck if Network Time Protocol (NTP) is enabled during DC/OS startup. (optional)string“”no
dcos_cluster_docker_credentialsDictionary of Docker credentials to pass. (optional)string“”no
dcos_cluster_docker_credentials_dcos_ownedIndicates whether to store the credentials file in /opt/mesosphere or /etc/mesosphere/docker_credentials. A sysadmin cannot edit /opt/mesosphere directly (optional)string“”no
dcos_cluster_docker_credentials_enabledIndicates whether to pass the Mesos —docker_config option to Mesos. (optional)string“”no
dcos_cluster_docker_credentials_write_to_etcIndicates whether to write a cluster credentials file. (optional)string“”no
dcos_cluster_docker_registry_enabledDC/OS cluster docker registry enabledstring“”no
dcos_cluster_docker_registry_urlThe custom URL that Mesos uses to pull Docker images from. If set, it will configure the Mesos —docker_registry flag to the specified URL. (optional)string“”no
dcos_cluster_namesets the DC/OS cluster namestring“”no
dcos_configused to add any extra arguments in the config.yaml that are not specified here. (optional)string“”no
dcos_custom_checksCustom installation checks that are added to the default check configuration process. (optional)string“”no
dcos_customer_key[Enterprise DC/OS] sets the customer key (optional)string“”no
dcos_dns_bind_ip_blacklistA list of IP addresses that DC/OS DNS resolvers cannot bind to. (optional)string“”no
dcos_dns_forward_zonesAllow to forward DNS to certain domain requests to specific server. The following syntax must be used in combination with Terraform string heredoc. (optional) (:warning: DC/OS 1.10+)string“”no
dcos_dns_searchA space-separated list of domains that are tried when an unqualified domain is entered. (optional)string“”no
dcos_docker_remove_delayThe amount of time to wait before removing stale Docker images stored on the agent nodes and the Docker image generated by the installer. (optional)string“”no
dcos_enable_docker_gcIndicates whether to run the docker-gc script, a simple Docker container and image garbage collection script, once every hour to clean up stray Docker containers. (optional)string“”no
dcos_enable_gpu_isolationIndicates whether to enable GPU support in DC/OS. (optional)string“”no
dcos_enable_mesos_input_pluginIndicates whether to enable Telegraf’s Mesos input plugin to collect Mesos metrics from Mesos masters and agents. Options: true or false (optional)string“”no
dcos_exhibitor_addressThe address of the load balancer in front of the masters (recommended)string“”no
dcos_exhibitor_azure_account_keythe azure account key for exhibitor storage (optional but required with dcos_exhibitor_address)string“”no
dcos_exhibitor_azure_account_namethe azure account name for exhibitor storage (optional but required with dcos_exhibitor_address)string“”no
dcos_exhibitor_azure_prefixthe azure account name for exhibitor storage (optional but required with dcos_exhibitor_address)string“”no
dcos_exhibitor_explicit_keysset whether you are using AWS API keys to grant Exhibitor access to S3. (optional)string“”no
dcos_exhibitor_storage_backendoptions are static, aws_s3, azure, or zookeeper (recommended)string“static”no
dcos_exhibitor_zk_hostsa comma-separated list of one or more ZooKeeper node IP and port addresses to use for configuring the internal Exhibitor instances. (not recommended but required with exhibitor_storage_backend set to ZooKeeper. Use aws_s3 or azure instead. Assumes external ZooKeeper is already online.)string“”no
dcos_exhibitor_zk_paththe filepath that Exhibitor uses to store data (not recommended but required with exhibitor_storage_backend set to zookeeper. Use aws_s3 or azureinstead. Assumes external ZooKeeper is already online.)string“”no
dcos_fault_domain_detect_contents[Enterprise DC/OS] fault domain script contents. Optional but required if no fault-domain-detect script present.string“”no
dcos_fault_domain_enabled[Enterprise DC/OS] used to control if fault domain is enabledstring“”no
dcos_gc_delayThe maximum amount of time to wait before cleaning up the executor directories (optional)string“”no
dcos_gpus_are_scarceIndicates whether to treat GPUs as a scarce resource in the cluster. (optional)string“”no
dcos_http_proxyhttp proxy (optional)string“”no
dcos_https_proxyhttps proxy (optional)string“”no
dcos_image_commitThe commit hash for the build of DC/OSstring“”no
dcos_instance_osOperating system to use. Instead of using your own AMI you could use a provided OS.string“centos_7.4”no
dcos_ip_detect_contentsAllows DC/OS to detect your private address. Use this to pass this as an input to the module rather than a file in side your bootstrap node. (recommended)string“”no
dcos_ip_detect_public_contentsAllows DC/OS to be aware of your publicly routeable address for ease of use (recommended)string“”no
dcos_ip_detect_public_filenamestatically set your detect-ip-public pathstring“genconf/ip-detect-public”no
dcos_l4lb_enable_ipv6A boolean that indicates if layer 4 load balancing is available for IPv6 networks. (optional)string“”no
dcos_license_key_contents[Enterprise DC/OS] used to privide the license key of DC/OS for Enterprise Edition. Optional if license.txt is present on bootstrap node.string“”no
dcos_log_directoryThe path to the installer host logs from the SSH processes. (optional)string“”no
dcos_master_discoveryThe Mesos master discovery method. The available options are static or master_http_loadbalancer. (recommend the use of master_http_loadbalancer)string“static”no
dcos_master_dns_bindallIndicates whether the master DNS port is open. (optional)string“”no
dcos_master_external_loadbalancerAllows DC/OS to configure certs around the External Load Balancer name. If not used SSL verfication issues will arrise. EE only. (recommended)string“”no
dcos_master_liststatically set your master nodes (not recommended but required with exhibitor_storage_backend set to static. Use aws_s3 or azure instead, that way you can replace masters in the cloud.)string“”no
dcos_mesos_container_log_sinkThe log manager for containers (tasks). The options are to send logs to: ‘journald’, ‘logrotate’, ‘journald+logrotate’. (optional)string“”no
dcos_mesos_dns_set_truncate_bitIndicates whether to set the truncate bit if the response is too large to fit in a single packet. (optional)string“”no
dcos_mesos_max_completed_tasks_per_frameworkThe number of completed tasks for each framework that the Mesos master will retain in memory. (optional)string“”no
dcos_no_proxyA YAML nested list (-) of addresses to exclude from the proxy. (optional)string“”no
dcos_num_mastersset the num of master nodes (required with exhibitor_storage_backend set to aws_s3, azure, ZooKeeper)string“”no
dcos_oauth_enabled[Open DC/OS Only] Indicates whether to enable authentication for your cluster. (optional)string“”no
dcos_overlay_config_attemptsSpecifies how many failed configuration attempts are allowed before the overlay configuration modules stop trying to configure an virtual network. (optional)string“”no
dcos_overlay_enableEnable to disable overlay (optional)string“”no
dcos_overlay_mtuThe maximum transmission unit (MTU) of the Virtual Ethernet (vEth) on the containers that are launched on the overlay. (optional)string“”no
dcos_overlay_networkThis group of parameters define an virtual network for DC/OS. (optional)string“”no
dcos_package_storage_uriWhere to permanently store DC/OS packages. The value must be a file URL. (optional)string“”no
dcos_previous_versionDC/OS 1.9+ requires users to set this value to ensure users know the version. Terraform helps populate this value, but users can override it here. (recommended)string“”no
dcos_previous_version_master_indexUsed to track the index of master for quering the previous DC/OS version during upgrading. (optional) applicable: 1.9+string“0”no
dcos_process_timeoutThe allowable amount of time, in seconds, for an action to begin after the process forks. (optional)string“”no
dcos_public_agent_liststatically set your public agents (not recommended)list[]no
dcos_resolversA YAML nested list (-) of DNS resolvers for your DC/OS cluster nodes. (recommended)list[ “169.254.169.253” ]no
dcos_rexray_configThe REX-Ray configuration method for enabling external persistent volumes in Marathon. (optional)string“”no
dcos_rexray_config_filenameThe REX-Ray configuration filename for enabling external persistent volumes in Marathon. (optional)string“”no
dcos_rexray_config_methodThe REX-Ray configuration method for enabling external persistent volumes in Marathon. (optional)string“”no
dcos_s3_bucketname of the s3 bucket for the exhibitor backend (recommended but required with dcos_exhibitor_address)string“”no
dcos_s3_prefixname of the s3 prefix for the exhibitor backend (recommended but required with dcos_exhibitor_address)string“”no
dcos_security[Enterprise DC/OS] set the security level of DC/OS, either ‘strict’ or ‘permissive’. Default is ‘permissive’. (recommended)string“”no
dcos_skip_checksUpgrade option: Used to skip all dcos checks that may block an upgrade if any DC/OS component is unhealthly. (optional) applicable: 1.10+string“false”no
dcos_staged_package_storage_uriWhere to temporarily store DC/OS packages while they are being added. (optional)string“”no
dcos_superuser_password_hash[Enterprise DC/OS] set the superuser password hash (recommended)string“”no
dcos_superuser_username[Enterprise DC/OS] set the superuser username (recommended)string“”no
dcos_telemetry_enabledChange the telemetry option (optional)string“”no
dcos_ucr_default_bridge_subnetIPv4 subnet allocated to the mesos-bridge CNI network for UCR bridge-mode networking. (optional)string“”no
dcos_use_proxyTo enable use of proxy for internal routing (optional)string“”no
dcos_variantSpecifies which DC/OS variant it should be: open (Open Source) or ee (Enterprise Edition)string“open”no
dcos_versionSpecifies which DC/OS version instruction to use. Options: 1.13.3, 1.12.4, 1.11.10, etc. See dcos_download_path or dcos_version tree for a full list.string“1.13.3”no
dcos_zk_agent_credentials[Enterprise DC/OS] set the ZooKeeper agent credentials (recommended)string“”no
dcos_zk_master_credentials[Enterprise DC/OS] set the ZooKeeper master credentials (recommended)string“”no
dcos_zk_super_credentials[Enterprise DC/OS] set the zk super credentials (recommended)string“”no
masters_acm_cert_arnACM certifacte to be used for the masters load balancerstring“”no
masters_associate_public_ip_address[MASTERS] Associate a public ip address with there instancesstring“true”no
masters_aws_ami[MASTERS] AMI to be usedstring“”no
masters_hostname_format[MASTERS] Format the hostname inputs are index+1, region, cluster_namestring“%[3]s-master%[1]d-%[2]s”no
masters_iam_instance_profile[MASTERS] Instance profile to be used for these instancesstring“”no
masters_instance_type[MASTERS] Instance typestring“m4.xlarge”no
masters_internal_acm_cert_arnACM certifacte to be used for the internal masters load balancerstring“”no
masters_os[MASTERS] Operating system to use. Instead of using your own AMI you could use a provided OS.string“”no
masters_root_volume_size[MASTERS] Root volume size in GBstring“120”no
num_mastersSpecify the amount of masters. For redundancy you should have at least 3string“3”no
num_of_private_agentsSpecify the amount of private agents. These agents will provide your main resourcesstring“”no
num_of_public_agentsSpecify the amount of public agents. These agents will host marathon-lb and edgelbstring“”no
num_private_agentsSpecify the amount of private agents. These agents will provide your main resourcesstring“2”no
num_public_agentsSpecify the amount of public agents. These agents will host marathon-lb and edgelbstring“1”no
private_agents_associate_public_ip_address[PRIVATE AGENTS] Associate a public ip address with there instancesstring“true”no
private_agents_aws_ami[PRIVATE AGENTS] AMI to be usedstring“”no
private_agents_extra_volumes[PRIVATE AGENTS] Extra volumes for each private agentlist[]no
private_agents_hostname_format[PRIVATE AGENTS] Format the hostname inputs are index+1, region, cluster_namestring“%[3]s-privateagent%[1]d-%[2]s”no
private_agents_iam_instance_profile[PRIVATE AGENTS] Instance profile to be used for these instancesstring“”no
private_agents_instance_type[PRIVATE AGENTS] Instance typestring“m4.xlarge”no
private_agents_os[PRIVATE AGENTS] Operating system to use. Instead of using your own AMI you could use a provided OS.string“”no
private_agents_root_volume_size[PRIVATE AGENTS] Root volume size in GBstring“120”no
private_agents_root_volume_type[PRIVATE AGENTS] Root volume typestring“gp2”no
public_agents_access_ipsList of ips allowed access to public agents. admin_ips are joined to this listlist[ “0.0.0.0/0” ]no
public_agents_acm_cert_arnACM certifacte to be used for the public agents load balancerstring“”no
public_agents_additional_portsList of additional ports allowed for public access on public agents (80 and 443 open by default)list[]no
public_agents_associate_public_ip_address[PUBLIC AGENTS] Associate a public ip address with there instancesstring“true”no
public_agents_aws_ami[PUBLIC AGENTS] AMI to be usedstring“”no
public_agents_hostname_format[PUBLIC AGENTS] Format the hostname inputs are index+1, region, cluster_namestring“%[3]s-publicagent%[1]d-%[2]s”no
public_agents_iam_instance_profile[PUBLIC AGENTS] Instance profile to be used for these instancesstring“”no
public_agents_instance_type[PUBLIC AGENTS] Instance typestring“m4.xlarge”no
public_agents_os[PUBLIC AGENTS] Operating system to use. Instead of using your own AMI you could use a provided OS.string“”no
public_agents_root_volume_size[PUBLIC AGENTS] Root volume sizestring“120”no
public_agents_root_volume_type[PUBLIC AGENTS] Specify the root volume type.string“gp2”no
ssh_public_keySSH public key in authorized keys format (e.g. ‘ssh-rsa …’) to be used with the instances. Make sure you added this key to your ssh-agent.string“”no
subnet_rangePrivate IP space to be used in CIDR formatstring“172.16.0.0/16”no
tagsAdd custom tags to all resourcesmap{}no
with_replaceable_mastersCreate S3 bucket for exhibitor and configure DC/OS to use it.string“false”no

Outputs

NameDescription
masters-ipsMaster IP addresses.
masters-loadbalancerThis is the load balancer address to access the DC/OS UI.
public-agents-loadbalancerThis is the load balancer address to access the DC/OS public agents.