Wayfinder is hosted in AWS

This article covers granting Wayfinder access to an GCP Project (target project) when Wayfinder is installed on AWS (home account), and you're using Wayfinder's credentials for authentication.

Jump to the Quick Start section for steps on how to create an AWS Cloud Access.

Overview

Workflow

Wayfinder's web interface provides you with the ARN value of Wayfinder's Workload Identity and an outline of the permissions Wayfinder need to manage cloud resources in the target project.

Use Wayfinder's terraform module to create the necessary Service Accounts, Policies and Trust Policies in the target project. Wayfinder's ARN value of Wayfinder's Workload Identity is needed to create the trust relationship between the home account and target project. The permissions are needed to create the Policies. See a full list of Wayfinder's terraform module input values. You can also do this configuration manually.

Wayfinder's terraform module will configure the target project with the needed permissions. You need to validate this configuration using Wayfinder's web interface. The configuration details are reflected in the corresponding CRD fields (Kind:CloudAccessConfig).

After you apply the cloud access configuration, either using Wayfinder's web interface or CLI, Wayfinder will be able to use its own identity to connect to the target account.

Home Account Details

Wayfinder's Workload Identity is the ARN of the AWS IRSA Role which trusts Wayfinder's Kubernetes Service Account. If you installed Wayfinder using Wayfinder's install terraform module, this will have been created for you during the install. If not, you need to provide the ARN of the AWS IRSA Role to the Helm chart on installation.

You use this ARN value when you configure a trust relationship between the home account and the target project.

Use Wayfinder's web interface to locate Wayfinder's Workload Identity or look it up manually in AWS.

Target Project Details

You need to provide Wayfinder with the Service Account Emails from the target project.

Each Service Account needs to be configured correctly with a Policy containing the permissions Wayfinder need and a Trust Policy to outline the trust relationship between Wayfinder's workload identity (home account) and the Service Account (target project).

Use Wayfinder's terraform module to configure the Service Accounts on your behalf or create it manually in Google Cloud. Wayfinder's web interface displays the input values for the terraform module on the sidebar when you reach the Step 4 - Permissions section. CLI users can use the wf describe cloudaccess --cloud-identity CLOUDIDENTITY-NAME --to-cloud TARGET-CLOUD --for-type ACCESS-TYPE --for-stage STAGE-NAME --for-workspace WORKSPACE-KEY -o tfvars command.

CLI Quick Reference

Instruction	CLI Command
Create a workspace (only if Access Type is Kubernetes Cluster Provisioning)	`wf create workspace WORKSPACE-KEY -s SUMMARY`
Create a stage (only if Access Type is Kubernetes Cluster Provisioning)	`wf create stage STAGE-NAME -d DESCRIPTION`
View Cloud Access Configurations	`wf get cloudaccessconfig -c CLOUD -w WORKSPACE-KEY`
Output the Cloud Access Configuration to console	`wf get cloudaccessconfig CONFIG-NAME -o yaml`
Output the Cloud Access Configuration to file	`wf get cloudaccessconfig CONFIG-NAME > ./PATH/TO/FILE.yaml`
Apply the Cloud Access Configuration from file	`wf apply cloudaccessconfig -f ./PATH/TO/FILE.yaml`
View Cloud Permissions	`wf get cloudpermissions`
View the Permissions of the specified Cloud Permission	`wf describe cloudpermissions PERMISSION-NAME -c CLOUD -o JSON`
View input values for Wayfinder's terraform module	`wf describe cloudaccess --cloud-identity CLOUDIDENTITY-NAME --to-cloud TARGET-CLOUD --for-type ACCESS-TYPE --for-stage STAGE-NAME --for-workspace WORKSPACE-KEY -o tfvars`
View cloud identities	`wf get cloudidentities`
Output the details of the cloud identity to console	`wf get cloudidentities NAME-OF-IDENTITY -o yaml`
Create a cloud identity for Wayfinder's workload identity (You only have to do this once)	`wf create cloudidentity CLOUDIDENTITY-NAME --for-workload-identity`
[ADVANCED USERS] Create a Cloud Access Configuration	`wf create cloudaccessconfig [flags]`

Considerations

For each project that you want to connect, you need to:

Decide what type of cloud access you need.
Decide the scope of the cloud project (workspace and stage).
Note that some access types are designated as 'administrative' for configurations that are outside the scope of any particular workspace or stage and are intended for Wayfinder administrators.
Decide what type of authentication method you want to use. This article outlines using Wayfinder's credentials (AWS IRSA Identity).
Give Wayfinder cloud permissions to access cloud resources and perform relevant tasks. At this point you need the output values from Wayfinder's terraform module or from your manual configuration.

Quick Start: Add a new GCP Cloud Access

CLI Steps

The easiest way to create a new GCP cloud access configuration is to edit an existing one.

Copy one of the cloud access configuration (yaml) examples or output the yaml of an existing Cloud Access Configuration to file.
Review the permissions that Wayfinder needs.
Use Wayfinder's terraform module to configure the target project (or do the configuration manually).
Apply the yaml of the Cloud Access Configuration that you've edited.

Wayfinder's Web Interface Steps

Select Admin, then navigate to Cloud > Access.
Select Google Cloud Platform.
Click the Add GCP cloud access button
You are presented with the Add GCP cloud access page. There are four main sections to complete.

1. Details Section Steps

Enter the Details for the new cloud access.
Enter the GCP Project ID for the GCP project that you want to give Wayfinder access to.
Select the Access Type that this cloud access connection is for e.g., Kubernetes Cluster Provisioning

Example

2. Scope Section Steps

Select a workspace from the drop-down list or create a new workspace.
Select a stage from the drop-down list or create a new stage.

note

The Access Type determines if the Scope section is editable or skipped. If skipped then the Scope is designated as 'Platform'.

Example

3. Authentication Section Steps

Select Wayfinder's AWS IRSA Identity as the Authentication Method.

Example

4. Permission Section Steps

note

You need to either run Wayfinder's terraform module to set up the needed cloud configuration in the target project or manually do the configuration. The right-hand panel will provide the needed input values for Wayfinder's terraform module. For more information see the Workflow section.

Example of what you'll see on the right-hand panel as input values for Wayfinder's terraform module

resource_suffix                           = ""
enable_cluster_manager                    = true
enable_dns_zone_manager                   = true
enable_network_manager                    = true
enable_cloud_info                         = false
from_aws                                  = true
from_gcp                                  = false
wayfinder_identity_aws_role_arn           = "arn:aws:iam::123456789012:role/wf-cloudidentity-aws"

Example of Wayfinder's terraform module output values

Changes to Outputs:
  + cloudaccess                      = {
      + cloud_info_service_account              = null
      + cluster_manager_service_account         = "wfclustermgr@project1-devtest.iam.gserviceaccount.com"
      + dns_zone_manager_service_account        = "wfdnszonemgr@project1-devtest.iam.gserviceaccount.com"
      + gcp_project                             = "project1-devtest"
      + gcp_projectnumber                       = "345678901234"
      + gcp_workload_identity_pool_id           = "proj1pool1"
      + gcp_workload_identity_provider_id_aws   = "proj1aws1"
      + gcp_workload_identity_provider_id_azure = null
      + network_manager_service_account         = "wfnetworkmgr@project1-devtest.iam.gserviceaccount.com"
    }
  - cluster_manager_service_account  = "wfclustermgr@project1-devtest.iam.gserviceaccount.com" -> null
  - dns_zone_manager_service_account = "wfdnszonemgr@project1-devtest.iam.gserviceaccount.com" -> null
  - network_manager_service_account  = "wfnetworkmgr@project1-devtest.iam.gserviceaccount.com" -> null

Paste in the GCP Project Number of the target project (This would be one of the output values of Wayfinder's terraform module or from your manual configuration)
Paste in the GCP Workload Identity Pool ID of the target project (This would be one of the output values of Wayfinder's terraform module or from your manual configuration)
Paste in the GCP Workload Identity Provider ID of the target project (This would be one of the output values of Wayfinder's terraform module or from your manual configuration)
Select the ClusterManager's Configure button.
Paste in the Service Account Email of the target project (This would be one of the output values of Wayfinder's terraform module or from your manual configuration)
Click the Validate button. You need to resolve all error messages before you can continue.
Repeat the steps above for DNSZoneManager and NetworkManager (if applicable for your Access Type).

Example

Fix any errors by either running Wayfinder's terraform module or update the permissions manually.

Permissions Section - Invalid Permissions

You will be able to proceed once the permissions are validated successfully.

All permissions must be validated successfully before you can proceed to the Summary section.

Permissions Section - All Valid Permissions

5. Summary Section Steps

Verify that all the details are correct.

note

You will not be able to apply the configuration if any of the validations failed.

Example

6. YAML Section Steps

Press the Apply button to apply the configuration.
Alternatively, download the YAML and apply it using Wayfinder's CLI or your CI pipeline.

GCP Cloud Access Properties

The following sections outline the properties that you'll need to connect your cloud project to Wayfinder. These properties are mirrored in the corresponding CRD manifests (in YAML format) generated by Wayfinder. CLI users can refer to the information in this section to understand how the settings from Wayfinder's web interface correlate with the respective YAML files.

Refer to the previous section for the quick start steps on how to add a new GCP Cloud Access.

Details Section Properties

This section specifies the general properties and access type for the GCP Project you're adding.

Field	Description
Name	The name of this cloud connection
Description	A meaningful description for this cloud connection
GCP Project ID	Specify the GCP Project ID that you're connecting to.
Access Type	The type of automation Wayfinder should provide. Option(s): Kubernetes Cluster Provisioning: Used for creating, updating and managing Kubernetes, cluster networking and workspace scoped DNS records for applications. DNS Provisioning: Used for managing a top-level domain, so that Wayfinder can create sub domains within it that are delegated to workspace clusters. Peering: Used for peering automation. Wayfinder can accept peering requests enabling connectivity between Wayfinder provisioned Kubernetes clusters and any external VPC network. Cost Estimate: Used for cost data retrieval in order to provide infrastructure cost estimates.

note

Each cloud project you connect is for the purpose of one of the 'Cloud Access Type' and each will have a different scope.

Scope Section Properties

When you've selected the Access Type as 'Kubernetes Cluster Provisioning', you need to set the scope to control where you want to provide the access to. This section is not visible for other Access Types.

What is the difference between a workspace and a stage?

A workspace is where teams provision and manage applications, environments, clusters, and cloud resources.
A stage is used to isolate and test resources at the infrastructure level such as production or development.

What is 'platform' scope?

Access types that are designated as 'platform' are for configurations that are outside the scope of any particular workspace or stage and are intended for the use by Wayfinder administrators.

Access Type	Description	Scope
Kubernetes Cluster Provisioning	Used for creating, updating and managing Kubernetes, cluster networking and workspace scoped DNS records for applications.	Workspace and Stage
DNS Provisioning	Used for managing a top-level domain, so that Wayfinder can create sub domains within it that are delegated to workspace clusters.	Platform
Peering	Used for peering automation. Wayfinder can accept peering requests enabling connectivity between Wayfinder provisioned Kubernetes clusters and any external VPC network.	Platform
Cost Estimates	Used for cost data retrieval in order to provide infrastructure cost estimates.	Platform
Private Links (Azure only)	Used when Wayfinder is installed in Azure, and you need to grant it access to a private cluster within a private virtual network (VNet)	Platform

Create a new workspace

You can create a new workspace if the existing ones don't meet your needs.

Field	Description
Select workspace	The workspace that can use this cloud account.
-- New workspace (button)	Creates a new workspace.
--- Name	The name for the new workspace.
--- Description	Meaningful description for this workspace.
--- Key	Unique 3-5 character identifier for the new workspace.

CLI Examples

Create a workspace

FORMAT: wf create workspace WORKSPACE-KEY -s SUMMARY

EXAMPLE:

wf create workspace sand -s "My sandbox workspace" 
◉ Waiting for resource "org.appvia.io/v2beta1/workspace/sand" to provision (background with ctrl-c)
✔ Successfully provisioned the resource: "sand"

Create a new stage

You can create a new stage if the existing ones don't meet your needs.

Field	Description
Select stage	The stage that can use this cloud account.
-- New stage (button)	Creates a new stage.
--- Name	The name for the new stage.
--- Description	Meaningful description for this stage.

CLI Examples

Create a stage

FORMAT: wf create stage STAGE-NAME -d DESCRIPTION

EXAMPLE:

~ wf create stage nonprod -d "non production stage"
✔ Successfully requested the resource "org.appvia.io/v2beta1/stage/nonprod"
✔ Successfully created the stage

Authentication Section Properties

This section specifies the properties to authenticate your Wayfinder instance with your cloud project.

Field	Description
Authentication method	The method in which Wayfinder will authenticate itself to the account. Option(s): - Authenticating without credentials -- Allows Wayfinder to authenticate itself using its own identity instead of static credentials. --- Note: For fresh installs you need to Create a New Workload Identity (once off task) -- Option presented to you will depend on where Wayfinder's instance is installed: --- IRSA Based Access (when Wayfinder's instance is installed on AWS) --- See respective documentation for when Wayfinder is installed in Azure or GCP -- Auto-detection: Presents the IRSA Identity of Wayfinder's Workload Identity - Credential-based Access -- Please see 'Use GCP static credentials'

Field

Description

Authentication method

The method in which Wayfinder will authenticate itself to the account.

Option(s):
- Authenticating without credentials
-- Allows Wayfinder to authenticate itself using its own identity instead of static credentials.
--- Note: For fresh installs you need to Create a New Workload Identity (once off task)
-- Option presented to you will depend on where Wayfinder's instance is installed:
--- IRSA Based Access (when Wayfinder's instance is installed on AWS)
--- See respective documentation for when Wayfinder is installed in Azure or GCP
-- Auto-detection: Presents the IRSA Identity of Wayfinder's Workload Identity

- Credential-based Access
-- Please see 'Use GCP static credentials'

Create a new Workload Identity

info

Note that you only need to do this once.

You need to create a cloud identity for Wayfinder's workload identity when you have a fresh installation of Wayfinder, it is the first time that you're adding a Cloud Access and you're using credential-less authentication.

Use wf create cloudidentity CLOUDIDENTITY-NAME with the --for-workload-identity -c CLOUD flags to create the cloud identity.

wf create cloudidentity wf-aws-irsa --for-workload-identity -c aws

In Wayfinder's web interface:

Create a new Cloud Access and progress to the Authentication page (see Quick Start guide for steps)
Select Wayfinder's AWS IRSA ID as the authentication method
Click the Configure button. Note that you will only see this button if you haven't previously created a cloud identity for Wayfinder's workload identity.
Fill in the details as outlined in the properties table below.
Click on the Validate button. All validation must pass before you can continue.
You will see a green tick mark that confirms that validate passed.

Field	Description
-- Name	Name of the new cloud identity
-- Cloud	The cloud in which the identity will be created (read-only value). Value(s): - AWS
-- Type	The type of identity to create. Option(s): - Wayfinder's IRSA Identity (Read-only value)
-- IRSA user ARN	Value of the IRSA ARN of Wayfinder's Workload Identity
-- Validate (button)	Validates that Wayfinder can use that cloud identity

Example

Fill in the details.

Auth Section - New Workload ID - Details

You can proceed once all the validation passed.

Permissions Section Properties

This section specifies the properties that grants the necessary permissions to Wayfinder. These permissions allow Wayfinder to create, manage and update cloud resources in the cloud project you specified in the previous section.

Field	Description
GCP Project Number	GCP Project Number of the target project (that you've configured manually or using Wayfinder's terraform module)
GCP Workload Identity Pool ID	GCP Workload Identity Pool ID of the target project (that you've configured manually or using Wayfinder's terraform module)
GCP Workload Identity Provider ID	GCP Workload Identity Provider ID of the target project (that you've configured manually or using Wayfinder's terraform module)
Cluster manager	Permissions that create and manage GKE Kubernetes clusters.
- GCP Service Account	The value of the identity that has the needed permissions assigned. - GCP: Specify the Service Account Email in the GCP project that you're adding and that you've configured (manually or using Wayfinder's terraform module) with the cluster management permissions.
- Necessary Permissions	JSON outlining the needed permissions for Cluster Manager.
- Validate (button)	Verification that the needed permissions were assigned correctly.
DNS management	Permissions that create and manage DNS Records.
- GCP Service Account	The value of the identity that has the needed permissions assigned. - GCP: Specify the Service Account Email in the GCP project that you're adding and that you've configured (manually or using Wayfinder's terraform module) with the DNS management permissions.
- Permissions	JSON outlining the needed permissions to manage the DNS records on a sub domain of your global DNS entry.
- Validate (button)	Verification that the needed permissions were assigned correctly.
Network management	Permissions that create and manage GKE cluster networks.
- GCP Service Account	The value of the identity that has the needed permissions assigned. - GCP: Specify the Service Account Email in the GCP project that you're adding and that you've configured (manually or using Wayfinder's terraform module) with the Network management permissions
- Permissions	JSON outlining the needed permissions.
- Validate (button)	Verification that the needed permissions were assigned correctly.

Summary Section Properties

Wayfinder provides you with a summary of the configuration details you've entered.

Important

You will not be able to apply the configuration if any of the validations failed.

YAML Section Properties

You will be presented with the manifest (yaml) files for the configuration details you entered.

You have the option to apply the configuration immediately by clicking the Apply button, or to download the YAML so that you can apply it later using Wayfinder's CLI or your CI system.

The following YAML files are produced:

Workspace

Only shown when you create a new workspace.

apiVersion: org.appvia.io/v2beta1
kind: Workspace
metadata:
  name: sand
spec:
  description: sandbox
  key: sand
  summary: sandbox for dev
  resourceNamespace: ''

Stage

Only shown when you create a new stage.

apiVersion: org.appvia.io/v2beta1
kind: Stage
metadata:
  name: nonprod
spec:
  displayName: nonprod
  description: non production stage for dev

Cloud Access Configuration

The type of manifest depends on the Access Type you've selected.

Provisioning
DNS Zone Management
Network Peering
Cost Estimates

apiVersion: cloudaccess.appvia.io/v2beta2
kind: CloudAccessConfig
metadata:
  name: gcp-test1
  namespace: ws-sand
spec:
  cloudIdentityRef:
    cloud: aws                               <-- Cloud Wayfinder is connecting from
    name: wf-aws-irsa                        <-- Identity Wayfinder is connecting with
  description: Cluster Provisioning for GCP Dev team 1
  gcp:
    project: project1-devtest                 <-- Project that you're adding
    projectNum: '345678901234'                <-- Wayfinder's terraform module output value or your manual configuration
    workloadIdentityPoolID: proj1pool1        <-- Wayfinder's terraform module output value or your manual configuration
    workloadIdentityProviderID: proj1aws1     <-- Wayfinder's terraform module output value or your manual configuration
    projectNumber: 345678901234
  type: Provisioning                          <-- Note the access type 
  permissions:
  - gcpServiceAccount: wfclustermgr@project1-devtest.iam.gserviceaccount.com <-- The gcp service account that the terraform module returned or your manual configuration
    permission: ClusterManager
  - gcpServiceAccount: wfdnszonemgr@project1-devtest.iam.gserviceaccount.com <-- The gcp service account that the terraform module returned or your manual configuration
    permission: DNSZoneManager
  - gcpServiceAccount: wfnetworkmgr@project1-devtest.iam.gserviceaccount.com <-- The gcp service account that the terraform module returned or your manual configuration
    permission: NetworkManager
  stage: nonprod

apiVersion: cloudaccess.appvia.io/v2beta2
kind: CloudAccessConfig
metadata:
  name: gcp-test1
  namespace: ws-sand
spec:
  cloudIdentityRef:
    cloud: aws                               <-- Cloud Wayfinder is connecting from
    name: wf-aws-irsa                        <-- Identity Wayfinder is connecting with
  description: Cluster Provisioning for GCP Dev team 1
  gcp:
    project: project1-devtest                 <-- Project that you're adding
    projectNum: '345678901234'                <-- Wayfinder's terraform module output value or your manual configuration
    workloadIdentityPoolID: proj1pool1        <-- Wayfinder's terraform module output value or your manual configuration
    workloadIdentityProviderID: proj1aws1     <-- Wayfinder's terraform module output value or your manual configuration
    projectNumber: 345678901234
  type: DNSZoneManagement                     <-- Note the access type 
  permissions:
  - gcpServiceAccount: wfdnszonemgr@project1-devtest.iam.gserviceaccount.com <-- The gcp service account that the terraform module returned or your manual configuration
    permission: DNSZoneManager
  stage: nonprod

apiVersion: cloudaccess.appvia.io/v2beta2
kind: CloudAccessConfig
metadata:
  name: gcp-test1
  namespace: ws-sand
spec:
  cloudIdentityRef:
    cloud: aws                               <-- Cloud Wayfinder is connecting from
    name: wf-aws-irsa                        <-- Identity Wayfinder is connecting with
  description: Cluster Provisioning for GCP Dev team 1
  gcp:
    project: project1-devtest                 <-- Project that you're adding
    projectNum: '345678901234'                <-- Wayfinder's terraform module output value or your manual configuration
    workloadIdentityPoolID: proj1pool1        <-- Wayfinder's terraform module output value or your manual configuration
    workloadIdentityProviderID: proj1aws1     <-- Wayfinder's terraform module output value or your manual configuration
    projectNumber: 345678901234
  type: Provisioning                          <-- Note the access type 
  permissions:
  - gcpServiceAccount: wfnetworkmgr@project1-devtest.iam.gserviceaccount.com <-- The gcp service account that the terraform module returned or your manual configuration
    permission: NetworkPeering
  stage: nonprod

apiVersion: cloudaccess.appvia.io/v2beta2
kind: CloudAccessConfig
metadata:
  name: gcp-test1
  namespace: ws-sand
spec:
  cloudIdentityRef:
    cloud: aws                               <-- Cloud Wayfinder is connecting from
    name: wf-aws-irsa                        <-- Identity Wayfinder is connecting with
  description: Cluster Provisioning for GCP Dev team 1
  gcp:
    project: project1-devtest                 <-- Project that you're adding
    projectNum: '345678901234'                <-- Wayfinder's terraform module output value or your manual configuration
    workloadIdentityPoolID: proj1pool1        <-- Wayfinder's terraform module output value or your manual configuration
    workloadIdentityProviderID: proj1aws1     <-- Wayfinder's terraform module output value or your manual configuration
    projectNumber: 345678901234
  type: CostsEstimates                        <-- Note the access type 
  permissions:
  - gcpServiceAccount: wfclustermgr@project1-devtest.iam.gserviceaccount.com <-- The gcp service account that the terraform module returned or your manual configuration
    permission: CloudInfo
  stage: nonprod

View Cloud Access Configurations

Use the wf get cloudaccessconfig CLI command to view a list of cloud access configurations. Use the --cloud flag to limit the results to the specified cloud provider and the -w flag to specify the workspace.

wf get cloudaccessconfig --cloud gcp -w dmo
NAME              PROVIDER      STATUS            IDENTIFIER    AGE
gcp-test1         gcp           Success           Unknown       1d
gcp-nonprod       gcp           ActionRequired    Unknown       19d
gcp-prod          gcp           ActionRequired    Unknown       19d

Use the -o yaml flag to output the cloud access configuration details to the console.

wf get cloudaccessconfig gcp-test1 -o yaml

Using Wayfinder's web interface:

Select Admin, then navigate to Cloud > Access
Select your cloud provider, for example Google Cloud Platform
The Cloud Access lists all the Cloud Access configurations for the selected cloud provider

Create a Cloud Access Configuration using CLI

[ADVANCED USERS]

Use the wf create cloudaccessconfig command to create a cloud access configuration using the CLI. Follow the CLI prompts or use the --help flag for a full list of options. You need to configure the target project manually or use Wayfinder's terraform module.

Edit & Apply Cloud Access Configurations

Output the cloud access configuration to file using the wf get cloudaccessconfigNAME-OF-CONFIG command with the > FILENAME.yaml postfix.

wf get cloudaccessconfig gcp-test1 > ./manifests/gcp-test1.yaml

Update the file as needed and use wf apply command with the -f PATH-TO-FILE.yaml flag to apply the changes.

wf apply cloudaccessconfig -f ./manifests/gcp-test1.yaml

Using Wayfinder's web interface:

Select Admin, then navigate to Cloud > Access
Select your cloud provider, for example Google Cloud Platform
The Cloud Access lists all the Cloud Access configurations for the selected cloud provider
Click on the name of the Cloud Access to open the form in Edit mode.
Update as needed.

note

You will not be able to change the values of the fields below. If they need changing then you need to create a new cloud access configuration.

Name
Project ID
Access Type

note

All validations need to pass before you can re-apply the configuration.

View Permissions

These are the permissions that Wayfinder need in the target project to create and manage cloud resources.

Use the wf get cloudpermissions CLI command to view a list of available cloud permissions.

wf get cloudpermissions
NAME              WAYFINDER FUNCTIONALITY SET    DESCRIPTION
ClusterManager    Provisioning                   Used for managing cluster provisioning inside the child account
DNSZoneManager    Provisioning                   Used for managing application DNS records on a sub domain of the Global DNS entry
NetworkManager    Provisioning                   Used for managing network permissions inside the child account
DNSZoneManager    DNSZoneManagement              Used to create sub domains for workspace clusters inside of the imported top-level domain
NetworkManager    NetworkPeering                 Accepts peering requests in an external VPC network to provide end-to-end peering automation
CloudInfo         CostsEstimates                 Used to retrieve cost data for infrastructure cost estimation

Use the wf describe cloudpermissions CLI command to view the JSON of the specified permission.

Also see the Permisisons Section section.

wf describe cloudpermission DNSZoneManager -c gcp
Permission: DNSZoneManager
Description: Used for managing application DNS records on a sub domain of the Global DNS entry
Permissions:
permissions:
- dns.resourceRecordSets.list
- dns.changes.create
- dns.managedZones.get
- dns.managedZones.create
- dns.managedZones.delete
roles: roles/dns.admin

Using Wayfinder's web interface:

Select Admin, then navigate to Cloud > Access
Select your cloud provider, for example Google Cloud Platform
The Cloud Access lists all the Cloud Access configurations for the selected cloud provider
Click on the name of the Cloud Access to open the form in Edit mode.
Navigate to the Permissions section.
Click on the Configure button.
The JSON outlining the permissions are displayed. Also see the Permisisons Section section.

Overview​

Workflow​

Home Account Details​

Target Project Details​

CLI Quick Reference​

Considerations​

Quick Start: Add a new GCP Cloud Access​

CLI Steps​

Wayfinder's Web Interface Steps​

1. Details Section Steps​

2. Scope Section Steps​

3. Authentication Section Steps​

4. Permission Section Steps​

5. Summary Section Steps​

6. YAML Section Steps​

GCP Cloud Access Properties​

Details Section Properties​

Scope Section Properties​

Create a new workspace​

CLI Examples​

Create a new stage​

CLI Examples​

Authentication Section Properties​

Create a new Workload Identity​

Permissions Section Properties​

Summary Section Properties​

YAML Section Properties​

Workspace​

Stage​

Cloud Access Configuration​

View Cloud Access Configurations​

Create a Cloud Access Configuration using CLI​

Edit & Apply Cloud Access Configurations​

View Permissions​

Overview

Workflow

Home Account Details

Target Project Details

CLI Quick Reference

Considerations

Quick Start: Add a new GCP Cloud Access

CLI Steps

Wayfinder's Web Interface Steps

1. Details Section Steps

2. Scope Section Steps

3. Authentication Section Steps

4. Permission Section Steps

5. Summary Section Steps

6. YAML Section Steps

GCP Cloud Access Properties

Details Section Properties

Scope Section Properties

Create a new workspace

CLI Examples

Create a new stage

CLI Examples

Authentication Section Properties

Create a new Workload Identity

Permissions Section Properties

Summary Section Properties

YAML Section Properties

Workspace

Stage

Cloud Access Configuration

View Cloud Access Configurations

Create a Cloud Access Configuration using CLI

Edit & Apply Cloud Access Configurations

View Permissions