Cluster Plans
Cluster plans function as templates for self-serve clusters, serving as guardrails that enable Wayfinder administrators to customise available options and configurations for developers (as workspace members) to independently provision their environments.
As a Wayfinder administrator, you hold the authority to define the workspaces where each cluster plan will be accessible. These plans are presented as Environment Plans within the respective workspaces. Wayfinder automatically sets up a developer's environment based on the settings specified in the corresponding cluster plan.
Cluster plans have a wide range of properties that you can define, such as:
- Cluster plan information: Properties that help users in workspaces select the right plan for the cluster they're provisioning (such as a meaningful plan name, description and which workspaces they apply to).
- Cluster settings: Properties that apply at the cluster level (such as cluster labels, region, kubernetes version and cluster lifetime).
- Nodes: Properties related to cluster node pool configuration (such as auto-scaling, node pool sizes, approximate pool costs, image types, machine types, modes, spot instances, disk size, labels and taints).
- Upgrades: Properties that affect how clusters are auto-upgraded (such as auto-upgrade start time and duration)
- Multi-tenancy: Properties that define templates for namespace quota limits.
- Cluster networking: Properties that allow you to specify which cluster network settings Wayfinder should use when auto-creating clusters (such as using fixed CIDR ranges or auto-allocating IP subnetworks from pre-defined CIDR ranges.)
- Profiles (AKS only): Profile properties that specify administrative access and authentication (such as admin username and password, SSH public keys and SKU Tiers)
- Pod Security Standards: Properties that determine the type of policy to enforce (such as privileged, baseline and restricted)
- Estimated costs: A summary of expected cost of clusters provisioned using the cluster plan
CLI Quick Reference
Instruction | CLI Command |
---|---|
List cluster plans | wf get clusterplan |
View cluster plan's manifest | wf get clusterplan PLAN-NAME -o yaml |
Output cluster plan's manifest to file | wf get clusterplan PLAN-NAME -o yaml > MYPLAN.yaml |
Apply a cluster plan's manifest from file | wf apply -f MYPLAN.yaml |
Create an environment by specifying the cluster and cluster plan | wf create appenv --app APP-NAME --env ENV-NAME --cluster CLUSTER-NAME --plan CLUSTER-PLAN-NAME --stage STAGE --region REGION |
Advantages of Cluster Plans
- Offering sensible default settings that align with best practices for both production and non-production environments.
- Establishing guardrails for workspace members' environment choices to ensure infrastructure compliance with your organisation's standards.
- Enabling policies to dictate whether workspace members can modify different cluster settings within the allocated plan(s).
Enhancing Cluster Security
We adhere to guidelines published by cloud providers to configure clusters:
- We eliminate any loosely defined permission bindings.
- We remove prior pod security policies (PSP), applying a baseline (PSS) Pod Security Standard to all applications as a reasonable least privileged (default) setting.
- We enforce a default network policy denial rule for all newly created namespaces, ensuring explicit traffic permission rather than a blanket allowance.
Utilising Cluster Plans
After setting up cluster plans, workspace members have the option to choose them for environment creation. Subsequently, they can deploy their applications into these environments.
You can find examples demonstrating how to create environments using cluster plans here.
Properties of Cluster Plans
The following sections outline the properties that can be defined for cluster plans using Wayfinder's web interface. These properties are mirrored in the corresponding CRD manifests (in YAML format) generated by Wayfinder. CLI users can refer to the information in this section to understand how the settings from Wayfinder's web interface correlate with the respective YAML files.
To learn how to view and create cluster plans, you can skip this section and proceed directly to the respective sections in Wayfinder's web interface and CLI.
Please note that Wayfinder excludes default values from the manifests. Unspecified values will use the default that the cloud provider specifies.
Cluster plan information
This section assists workspace members in choosing the appropriate plan for provisioning a cluster as an environment.
Field | Description |
---|---|
Plan name & description | Give a suitable name and description to assist developers in selecting the correct plan when creating a cluster, for example eks-budget-plan . |
Allocate to workspaces | Default is 'All workspaces'. Choose the workspaces in which this plan should be accessible. It can be applied to all workspaces, specific ones, or unallocated. |

YAML Example(s):
- Cluster plan is accessible in specific workspaces:
apiVersion: compute.appvia.io/v2beta1
kind: ClusterPlan
metadata:
name: aks-dev-basic
spec:
allocation:
type: workspaces
workspaces:
- sand
- ctest
summary: Basic AKS cluster plan for Dev
template:
providerDetails:
type: AKS
- Cluster plan is accessible in all workspaces.
spec:
allocation:
type: all
workspaces:
- '*'
- Cluster plan is unallocated to any workspace.
spec:
allocation:
type: none
To view a complete YAML example of a cluster plan, click here.
Cluster settings
This section establishes default settings and guardrails for all new clusters provisioned using the cluster plan.
- Common properties across all cloud providers:
Field | Description |
---|---|
Labels | Include one or more labels. Wayfinder will automatically apply these labels to every cluster provisioned using this plan. By default, Wayfinder recommends an optional ingress label. This ensures the installation of ingress packages. |
Region | Select a region. Every cluster provisioned using this plan will be assigned this selected region. |
Allow changes to Region: Enabled by default allowing users the opportunity to select a region. Manage allowed values: Specify the regions that users can choose. Disable: Toggle off this property if you only want your defined value(s) to apply. | |
Kubernetes Version | Select a Kubernetes version. Every cluster provisioned using this plan will operate on the chosen Kubernetes version. The recommended default is Wayfinder's default option. |
Allow changes to Kubernetes version: Enabled by default allowing users the opportunity to choose a Kubernetes version. Manage allowed values: Specify the Kubernetes versions that users can choose from. Disable: Toggle off this property if you only want your defined value(s) to apply. | |
Cluster Lifetime | Select the method for cluster deletion. The default option is manual deletion. Manual deletion: Cluster exists until you delete it manually. Set: Select this setting if you want the cluster to be automatically deleted after a specified expiration time [in hours/days/weeks]. The expiration time is displayed in the environment plans, providing developers with visibility into the duration of the cluster's availability. |
Allow changes to Cluster lifetime: Enabled by default allowing users the opportunity to set their own cluster lifetime details. Disable: Toggle off this property if you only want your defined value(s) to apply. |
- EKS specific properties:
Category | Field | Description |
---|---|---|
Cloud watch logs | Kubernetes API logs | Unspecified by default. Specified: Select the box to make use of Kubernetes API logs. |
Allow changes to Kubernetes API logs: Enabled by default allowing users the opportunity to make use of Kubernetes API logs. Disable: Toggle off this property if you only want your defined value(s) to apply. | ||
Kubernetes audit logs | Unspecified by default. Specified: Select the box to make use of Kubernetes audit logs. | |
Allow changes to Kubernetes audit logs: Enabled by default allowing users the opportunity to make use of Kubernetes audit logs. Disable: Toggle off this property if you only want your defined value(s) to apply. | ||
Kubernetes authentication logs | Unspecified by default. Specified: Select the box to make use of Kubernetes authentication logs. | |
Allow changes to Kubernetes authentication logs: Enabled by default allowing users the opportunity to make use of Kubernetes authentication logs. Disable: Toggle off this property if you only want your defined value(s) to apply. | ||
Kubernetes controller log | Unspecified by default. Specified: Select the box to make use of Kubernetes controller logs. | |
Allow changes to Kubernetes controller logs: Enabled by default allowing users the opportunity to make use of Kubernetes controller logs. Disable: Toggle off this property if you only want your defined value(s) to apply. | ||
Kubernetes scheduler component logs | Unspecified by default. Specified: Select the box to make use of Kubernetes scheduler component logs. | |
Allow changes to Kubernetes scheduler component logs: Enabled by default allowing users the opportunity to make use of Kubernetes scheduler component logs. Disable: Toggle off this property if you only want your defined value(s) to apply. | ||
EKS Encryption | Secrets Encryption | Unspecified by default. Specified: Selecting the box generates a new, dedicated Key Management Service (KMS) key and configures the cluster to use this for secrets encryption. WARNING - Once Secrets Encryption is enabled on a cluster, then you can't disable it on that cluster. - If you delete the cluster, then the dedicated KMS key that Wayfinder created, will also be deleted. - If you delete the KMS key, you permanently put the cluster in a degraded state. For more information see: - Amazon: Enable AWS KMS Keys - Amazon: Deleting AWS KMS Keys - Kubernetes: Encrypting Confidential Data at Rest |
Allow changes to Secrets Encryption: Enabled by default allowing users the opportunity to select secrets encryption. Disable: Toggle off this property if you only want your defined value(s) to apply. |
- GKE specific properties:
Category | Field | Description |
---|---|---|
Addons | Enable horizontal pod Autoscaler | Unspecified by default. Enabled: Select the box to enable horizontal pod Autoscaler. When enabled, the autoscaler will alter your Kubernetes workload's structure by automatically adjusting the number of Pods in response to CPU or memory consumption, or in reaction to custom metrics from within Kubernetes or external metrics from sources outside your cluster. |
Allow changes to horizontal pod Autoscaler: Enabled by default allowing users the opportunity to make use of horizontal pod autoscaling. Disable: Toggle off this property if you only want your defined value(s) to apply. | ||
Enable HTTP load balancer | Unspecified by default. Enabled: Select the box to enable the HTTP load balancer. When enabled, GKE will auto-discover your ingress resources and automatically provision load balancers on your behalf. | |
Allow changes to Enable HTTP load balancer: Enabled by default allowing users the opportunity to make use of the HTTP load balancer . Disable: Toggle off this property if you only want your defined value(s) to apply. | ||
Enable shielded nodes | Unspecified by default. Enabled: Select the box to enable shielded nodes. When enabled, this provides protection against a variety of attacks by hardening the underlying GKE node against rootkits and bootkits. | |
Allow changes to Enable shielded nodes: Enabled by default allowing users the opportunity to make use of shielded nodes. Disable: Toggle off this property if you only want your defined value(s) to apply. | ||
Enable Stackdriver logging | Unspecified by default. Enabled: Select the box to enable Stackdriver logging for the cluster. | |
Allow changes to Enable Stackdriver logging: Enabled by default allowing users the opportunity to make use of Stackdriver logging. Disable: Toggle off this property if you only want your defined value(s) to apply. | ||
Enable Stackdriver metrics | Unspecified by default. Enabled: Select the box to enable Enable Stackdriver metrics. When enabled, Stackdriver metrics are enabled for the cluster. | |
Allow changes to Enable Stackdriver metrics: Enabled by default allowing users the opportunity to make use of Stackdriver metrics. Disable: Toggle off this property if you only want your defined value(s) to apply. |

apiVersion: compute.appvia.io/v2beta1
kind: ClusterPlan
metadata:
name: aks-dev-basic
spec:
policies:
- editable: true
enum:
- southindia
- australiaeast
- uksouth
path: spec.region
- editable: false
enum:
- latest
- 1.26.6
path: spec.version
- editable: false
path: spec.expires
template:
clusterLabels:
appvia.io/ingresspublic: "true"
expires: 24h0m0s
region: uksouth
version: 1.26.6
To view the complete YAML example of a cluster plan, click here.
Nodes
This section establishes the default cluster node pools. You must define at least one node pool.
- Common properties across all cloud providers:
Field | Description |
---|---|
Name | Give a suitable name for the node pool or use the auto-generated name. |
Allow changes to Name: Enabled by default allowing users the opportunity to provide their own pool name. Disable: Toggle off this property if you only want your defined value(s) to apply. | |
Description | Give a suitable description for this node pool. |
Allow changes to Description: Enabled by default allowing users the opportunity to provide their own description. Manage allowed values: Specify the descriptions that users can choose from. Disable: Toggle off this property if you only want your defined value(s) to apply. | |
Auto-Scaling | Select a value for auto-scaling. Default is "yes". "Yes": Allow automatic adjustment of the number of running instances (replicas). "No": Running instances are not scaled automatically. |
Allow changes to Auto-Scaling: Enabled by default allowing users the opportunity to use auto-scaling. Disable: Toggle off this property if you only want your defined value(s) to apply. | |
Node pool size > Minimum size | Provide the minimum number of worker nodes for this node pool. Requires Auto-scaling to be set to "yes". Default value is 1. |
Allow changes to Minimum size: Enabled by default allowing users the opportunity to set their own minimum size. Configure Range: Specify the range that users can choose from. Disable: Toggle off this property if you only want your defined value(s) to apply. | |
Node pool size > Initial size | Provide the number of worker nodes that are provisioned when the node pool is created or scaled up for the first time. Default value is 1. EKS default value is 2. |
Allow changes to Initial size: Enabled by default allowing users the opportunity to set their own initial size. Configure Range: Specify the range that users can choose from. Disable: Toggle off this property if you only want your defined value(s) to apply. | |
Node pool size > Maximum size | Provide the maximum number of worker nodes that the node pool can scale up to. Requires Auto-scaling to be set to "yes". Default value is 10. |
Allow changes to Maximum size: Enabled by default allowing users the opportunity to set their own maximum size. Configure Range: Specify the range that users can choose from. Disable: Toggle off this property if you only want your defined value(s) to apply. | |
Maximum pods per node | Provide a value to control the density of pods running on each worker node. Default value is 110. EKS default is unspecified. |
Allow changes to Maximum pods per node: Enabled by default allowing users the opportunity to set their own value. Configure Range: Specify the range that users can choose from. Disable: Toggle off this property if you only want your defined value(s) to apply. | |
Approximate pool cost | Wayfinder displays an estimated cost for running the node pool based on your node pool configuration. |
Image type | Provide the underlying operating system that will be used for the worker nodes. The options available depend on your cloud provider. |
Allow changes to Image type: Enabled by default allowing users the opportunity to select their own image type. Manage allowed values: Specify the values that users can choose from. Disable: Toggle off this property if you only want your defined value(s) to apply. | |
Machine type | Provide the virtual machine configuration that is to be used for each worker node in the cluster. The options available depend on your cloud provider. |
Allow changes to Machine type: Enabled by default allowing users the opportunity to select their own machine type. Manage allowed values: Specify the values that users can choose from. Disable: Toggle off this property if you only want your defined value(s) to apply. | |
Use spot instances | Disabled by default. Enable: Spot instances can deliver significant cost savings but can be destroyed at any time. When Auto-scale is enabled, it will attempt to replace any instances that have been destroyed, but capacity to create new spot instances is never guaranteed, thus your node pool may be smaller than your specified minimum size at times. Ensure you understand the impact of this on your workloads before enabling. |
Allow changes to Use spot instances: Enabled by default allowing users the opportunity to make use of spot instances. Disable: Toggle off this property if you only want your defined value(s) to apply. | |
Disk size | Provide the storage capacity to reserve. Units are usually in gigabytes, but check your cloud provider's documentation. Default value is 30. |
Allow changes to Disk size: Enabled by default allowing users the opportunity to specify their own disk size. Disable: Toggle off this property if you only want your defined value(s) to apply. | |
Labels | Unspecified by default. Add label: Provide the labels you want to attach to the node pools. |
Allow changes to Lables: Enabled by default allowing users the opportunity to specify their own lables. Disable: Toggle off this property if you only want your defined value(s) to apply. | |
Taints | Unspecified by default. Add taints: Provide one or more taints. The key and value define the characteristic that the taint represents. The effect specifies how pods without matching tolerations should be treated. The effect can be one of three options: - NoSchedule: Indicates that pods without matching tolerations will not be scheduled on that node. - PreferNoSchedule: Indicates a preference against scheduling pods without matching tolerations on nodes with the taint. - NoExecute: Prevents pods without matching tolerations from being scheduled on nodes and evicts existing pods that no longer tolerate the taint. |
Allow changes to Taints: Enabled by default allowing users the opportunity to specify their own taints. Disable: Toggle off this property if you only want your defined value(s) to apply. |
- AKS specific properties:
Field | Description |
---|---|
Mode | Provide a mode. Default is "system". System: Allocated resources to be dedicated to system processes User: Allocated resources to be dedicated to user workloads such as their applications. |
Allow changes to Mode: Enabled by default allowing users the opportunity to specify their own mode. Disable: Toggle off this property if you only want your defined value(s) to apply. | |
Max spot price | Requires 'Use spot instances' to be set to "yes". Default value is "unlimited". Unlimited: There is no maximum. Limit spot price: Provide the maximum currency amount for the spot price. |
Allow changes to Max spot price: Enabled by default allowing users the opportunity to specify their own maximum spot price. Disable: Toggle off this property if you only want your defined value(s) to apply. |
- EKS specific properties:
Field | Description |
---|---|
Additional instance types | Requires 'spot instances' to be set to "yes". Unsepecified by default. Add additional instance types: Provide additonal instances to use. |
Allow changes to Additional instance types: Enabled by default allowing users the opportunity to make use of additional instance types. Disable: Toggle off this property if you only want your defined value(s) to apply. |
- GKE specific properties:
Field | Description |
---|---|
Enable auto-repair | Unspecified by default. Enabled: Choose "yes" to enable auto-repair. When enabled, the node pool automatically repairs failed nodes. |
Allow changes to Enable auto-repair: Enabled by default allowing users the opportunity to make use of auto-repair. Disable: Toggle off this property if you only want your defined value(s) to apply. | |
Enable auto-upgrade | Unspecified by default. Enabled: Choose "yes" to enable auto-upgrade. When enabled, the node group is configured with auto-upgrading enabled. Required to be set to enabled when the cluster version is set to any "Release channel" or "Latest", instead of a specific Kubernetes version. |
Allow changes to Enable auto-upgrade: Enabled by default allowing users the opportunity to make use of auto-upgrade. Disable: Toggle off this property if you only want your defined value(s) to apply. |

apiVersion: compute.appvia.io/v2beta1
kind: ClusterPlan
metadata:
name: aks-dev-basic
spec:
policies:
- editable: true
enum:
- dev nodepool
- sand nodepool
- test nodepool
path: spec.nodePools.0.description
- editable: true
max: 100
min: 0
path: spec.nodePools.0.autoscaling.minSize
- editable: true
max: 9
min: 0
path: spec.nodePools.0.size
- editable: true
max: 3
min: 0
path: spec.nodePools.0.autoscaling.maxSize
- editable: true
max: 50
min: 0
path: spec.nodePools.0.maxPodsPerNode
- editable: true
max: 40
min: 20
path: spec.nodePools.0.diskSize
template:
nodePools:
- autoscaling:
enabled: true
maxSize: 1
minSize: 1
description: sand nodepool
diskSize: 30
image: Windows
labels:
performance: "true"
logicalName: devpl
machine: Standard_D2_v5
maxPodsPerNode: 30
providerDetails:
aks:
mode: system
type: AKS
size: 1
spot:
aks:
maxSpotPrice: "100"
enabled: true
taints:
- effect: NoSchedule
key: performance
value: high
provider: AKS
providerDetails:
aks:
linuxProfile: {}
windowsProfile: {}
type: AKS
To view the complete YAML example of a cluster plan, click here.
Upgrades
This section defines if clusters should be automatically upgraded to the latest Kubernetes version.
Field | Description |
---|---|
Auto-upgrade | Set to "No" by default. Choose "yes" if you want all clusters created under this plan, to be automatically upgraded to the latest Kubernetes version. |
Allow changes to Enable auto-upgrade: Enabled by default allowing users the opportunity to make use of auto-upgrade. Disable: Toggle off this property if you only want your defined value(s) to apply. | |
Auto-upgrade start time | Requires Auto-upgrade to be set to "yes". Specifies the earliest time that auto-upgrades can commence. Example: 03:00 |
Allow changes to Auto-upgrade start time: Enabled by default allowing users the opportunity to specify their own auto-upgrade start time. Manage allowed values: Specify the range that users can choose from. Disable: Toggle off this property if you only want your defined value(s) to apply. | |
Auto-upgrade duration | Requires Auto-upgrade to be set to "yes". Specifies the auto-upgrade maintenance window duration. Example: 2hr |
Allow changes to Auto-upgrade duration: Enabled by default allowing users the opportunity to specify their own auto-upgrade duration. Manage allowed values: Specify the range that users can choose from. Disable: Toggle off this property if you only want your defined value(s) to apply. |

apiVersion: compute.appvia.io/v2beta1
kind: ClusterPlan
metadata:
name: aks-dev-basic
spec:
template:
enableAutoUpgrade: true
expires: 24h0m0s
maintenance:
windowDuration: 4hr
windowStart: "01:00"
To view the complete YAML example of a cluster plan, click here.
Multi-tenancy
This section defines the namespace quota limit templates for multi-tenancy clusters.
When enabled, a cluster can be shared by other workspaces and used for new application environments. The following settings define how the cluster can be used across 'tenants' of the cluster.
Field | Description |
---|---|
Enable quota limits | Default is disabled. Switch the toggle on if you want to enable quota limits. |
Template Values: | |
- Name | Provide a meaningful name for the template |
Allow changes to Name: Enabled by default allowing users the opportunity to specify their own template name. Disable: Toggle off this property if you only want your defined value(s) to apply. | |
- Resource quotas | You can configure quotas for resource requests for a namespace. These limit the sum total of requests allowed for all containers in the namespace. Default value for "requests.cpu" is 1. Default value for "requests.memory" is 3.5Gi. |
Allow changes to Resource quotas: Enabled by default allowing users the opportunity to specify their own resource quotas. Disable: Toggle off this property if you only want your defined value(s) to apply. | |
- Limit ranges | You can configure maximum values that can be used by any pod and/or any container in a namespace. Default "type" is container. Default "cpu" value is 256m. Default "memory" is 896Mi. Default "ephemeral-storage" is 2.175Gi. |
Allow changes to Limit ranges: Enabled by default allowing users the opportunity to specify their own limit ranges. Disable: Toggle off this property if you only want your defined value(s) to apply. | |
- Resource defaults for a container | You can set resource defaults for containers. These are used when deployed containers don't specify their own default requests and limits. |

Cluster networking
This section defines networking for clusters using this plan. You must select an existing cluster network plan. If an existing one doesn't meet your needs, then you can create one on the fly.
Field | Description |
---|---|
VPC & Subnets | Auto Create signifies the cluster's network that Wayfinder creates when creating a cluster with this plan. |
Select cluster network plan | Select an existing cluster network plan from the drop-down list. A summary of the selected cluster network plan's properties is displayed. |
New Cluster Network Plan | If you do not have an existing cluster network plan or if none of the existing ones meet your needs, then you can create one on the fly. See [Create Cluster Network Plan] |
Cluster endpoint access | Unspecified by default. Define how the cluster created from this network should be accessed. You can choose between private and public. |
Authorised master network | One entry required. This signifies a collection of network CIDR ranges allowed to access the Kubernetes API directly, and not via Wayfinder. It defaults to all if not provided. |
Allow changes to Authorised master network: Switch the toggle on if you want to give users the ability to specify their own authorised master networks. Switch the toggle off if you only want your values to apply. | |
Authorised networks | One entry required. This signifies the networks which are allowed to connect to this cluster via Wayfinder, using "wf access cluster" and "kubectl" commands. It defaults to all if not provided. |
Allow changes to Authorised networks: Switch the toggle on if you want to give users the ability to specify their own authorised networks. Switch the toggle off if you only want your values to apply. | |
Network CNI provider | Defaults to Unspecified. Only applicable to AKS and GKE. Select a Network Container Network Interface (CNI) provider. Selecting CNI signifies to use a generic CNI plugin based on the CNI specification. You can also select a speicif CNI provider from the list such as Calico. |
Allow changes to Network CNI provider: Switch the toggle on if you want to give users the ability to specify their own network CNI provider. Switch the toggle off if you only want your values to apply. |
- GKE specific properties:
Field | Description |
---|---|
Master IPv4 CIDR | Provide the CIDR range that will be reserved for the GKE control plane components. |
Allow changes to Master IPv4 CIDR: Switch the toggle on if you want to give users the ability to specify their own master IPv4 CIDR range. Switch the toggle off if you only want your values to apply. |

apiVersion: compute.appvia.io/v2beta1
kind: ClusterPlan
metadata:
name: aks-dev-basic
spec:
template:
enablePrivateCluster: false
networking:
authorizedMasterNetworks:
- cidr: 10.0.8.0/20
name: master
authorizedNetworks:
- cidr: 10.0.8.0/20
name: network
networkPlan: aks-fixed-high-performance-dev
networkProvider: cni
To view the complete YAML example of a cluster plan, click here.
Create Cluster Network Plan
This section describes the properties you need to specify when creating a new cluster network plan.
Field | Description |
---|---|
Name | Provide a meaningful name for your cluster network plan. It will help others to understand what your plan entails. |
Description | Provide a meaningful description for your plan. |
IPv4 CIDR range | Fixed signifies that you are using a fixed range of IP addresses. You will have a fixed number of IP addresses available across all clusters that use this plan. Therefore, clusters using this plan can't be peered together or join a corporate network. Allocated signifies that you have one or more IP address ranges available to clusters using this plan. You specify the CIDR ranges and Wayfinder will use different chunks from those ranges you specified. |
IPv4 CIDR range > Fixed | AKS: Specify the fixed CIDR IP address range that the Node and Service should use EKS: Select the number of availability zones for the cluster. Specify the fixed CIDR IP address range that the Node should use. GKE: Specify the fixed CIDR IP address range that the Node, Service and Pod should use |
IPv4 CIDR range > Auto-allocated | AKS: Specify the auto-allocated range size for the Node and Service. Select the CIDR range to allocate from. EKS: Select the number of availability zones for the cluster. Specify the auto-allocated range size for the Node. Select the CIDR range to allocate from. GKE: Specify the auto-allocated range size for the Node, Service and Pod. Select the CIDR range to allocate from. Note regarding the auto-allocated range table: If the table is empty, or you do not see the range you want, then you need to define a range. |
Summary | A summary of the network ranges that Wayfinder will create and consume from. |
Profiles (AKS only)
This section describes the cluster profile properties that specify administrative access and authentication for AKS clusters.
Configuration for Linux VMs or Windows VMs
Field | Description |
---|---|
Admin user | Unspecified by default. Provide the administrative username. |
Allow changes to Admin user: Enabled by default allowing users the opportunity to specify their own admin username. Disable: Toggle off this property if you only want your defined value(s) to apply. | |
SSH public keys | Unspecified by default. Provide one or more SSH public keys. |
Allow changes to SSH public keys: Enabled by default allowing users the opportunity to specify their own SSH public keys. Disable: Toggle off this property if you only want your defined value(s) to apply. | |
Stock Keeping Unit (SKU) Tier | Unspecified by default. Select the Uptime SLA that should be used for the AKS cluster. |
Allow changes to SKU Tier: Enabled by default allowing users the opportunity to specify their own SKU Tier. Disable: Toggle off this property if you only want your defined value(s) to apply. |

Pod Security Standards
This section describes the properties that determine the type of PSS policy to enforce (such as privileged, baseline and restricted). For more information on how PSS is applied, see our Pod Security Standards page.
Field | Description |
---|---|
Enable Pod Security Standards | Default is disabled. Switch the toggle on to enable. Choose if you want to allow privileged, baseline and restricted policies. You must select one of those policies to be the default. |
Allow changes to Pod Security Standards: Enabled by default allowing users the opportunity to specify Pod Security Standards. Disable: Toggle off this property if you only want your defined value(s) to apply. |

apiVersion: compute.appvia.io/v2beta1
kind: ClusterPlan
metadata:
name: aks-dev-basic
spec:
security:
podSecurityStandard:
allowed:
- privileged
- baseline
- restricted
defaultProfile: baseline
enabled: true
To view the complete YAML example of a cluster plan, click here.
Estimated Costs
This section provides you with a summary of the likely costs your cluster will incur when you provision it using this cluster plan.

Using cluster plans with YAML
When developers (as workspace members) create an environment, they can choose to use existing infrastructure (Wayfinder creates a new namespace on an existing cluster) or choose to provision new infrastructure (Wayfinder provisions a new cluster and a namespace in accordance to the cluster plan).
When provisioning an environment using new infrastructure, either using the CLI or Wayfinder's web interface, the cluster plan is used as a boilerplate of defaults for the cluster's specifications. This cluster definition is submitted to the API and verified against the cluster plan's policy, ensuring the cluster definition does not violate any restrictions in the cluster plan.
The developer is in full control of the application's configuration and selecting an environment with a cluster configuration that suits their needs. Clusters are represented
to developers as environments, so the underlying application's environment YAML definition must have a reference spec.plan
(cluster plan). Developers can only specify
cluster plans that are available to them in their workspace. By default, workspace members can't create any new cluster plans or edit existing ones. Upon creating or updating
the application environment's YAML definition, the cluster definition is verified against the cluster plan's policy.
Below is an example of the developer's application environment YAML manifest: Wayfinder provisions the cluster according to the specification outlined in the aks-playground cluster plan. For more YAML examples, please see the Application Environment section of the documentation.
➜ ~ wf create appenv --app myapp --env dev3 --cluster devhost --plan aks-playground --stage nonprod --region uksouth
kind: AppEnv
spec:
application: myapp
cloud: azure
clusterRef:
group: compute.appvia.io
kind: Cluster
name: devhost
namespace: ws-dmo
version: v2beta1
key: dev3
name: dev3
namespace: myapp-dev3
plan: aks-playground <-- This is the cluster plan
region: uksouth
stage: nonprod
Wayfinder's administrators have permissions to create new cluster plans and to edit existing ones. The exception to the rule is that Wayfinder's default cluster plans are read-only, but you can create a copy and update the settings as per your requirements. Please see the sections below for examples.
View cluster plans
By default, the cluster plans provided by Wayfinder for each cloud provider are available in all workspaces. Wayfinder administrators can choose if new cluster plans should be available in all workspaces or only some workspaces.
To view cluster plans in the CLI:
Run
wf get clusterplan
.Cluster plans for all cloud providers are displayed:
wf get clusterplan
NAME SUMMARY CLOUD AGE
aks-hardened Hardened AKS cluster with a default "restricted" PSS Policy, recommended for Production workloads. AKS 51d
aks-playground Low cost cluster configuration for testing purposes, default expiry TTL set to 7 days. AKS 51d
aks-standard General purpose AKS cluster. AKS 51d
eks-gpu Cluster plans which contains GPU enabled nodepools EKS 30h
eks-hardened Hardened EKS cluster with a default "restricted" PSS Policy, recommended for Production workloads. EKS 51d
eks-playground Low cost cluster configuration for testing purposes, default expiry TTL set to 7 days. EKS 51d
eks-standard General purpose EKS cluster. EKS 51d
gke-hardened Hardened GKE cluster with a default "restricted" PSS Policy, recommended for Production workloads. GKE 51d
gke-playground Low cost cluster configuration for testing purposes, default expiry TTL set to 7 days. GKE 51d
gke-standard General purpose GKE cluster. GKE 51d
To view cluster plans using Wayfinder's web interface:
Select Settings, then navigate to Developer Self-Service > Cluster Self-Service > Cluster plans.
Click the cloud provider that you want to see plans for, for example, Google Cloud Platform.
The plans are displayed.
Add a new cluster plan
Wayfinder's default cluster plans for each cloud provider cannot be edited. But you can add your own plans. A convenient way to add a cluster plan is to copy one, and then customise it. You can also start from scratch. Once you've added a new plan for a cloud provider and specified which workspaces the plan should be available in, workspace members in that workspace and cloud can select that plan when creating an environment.
In the cluster plan configuration, you can enforce which cluster settings can be changed by workspace owners, for example, if clusters should auto-upgrade or not.
The plan properties, and whether they are permitted to be changed, applies to any workspace you allocate this plan to. If you want to set different permissions for specific workspaces, you must create a new plan.
If you change a plan to modify the cluster configuration, this does not modify the clusters that were built from it, but applies to new clusters using that plan. However, if you update policies in the plan, the new policies are enforced for all clusters using the plan, meaning any changes to the configuration of those clusters must match the updated policies on the plan.
Services included in each cluster
Clusters created in Wayfinder come with the following pre-provisioned services:
- NGINX ingress (optional)
- Flux Helm Controller
- ExternalDNS
- cert-manager
- Auto-scalers: Installed for EKS, and enabled in GKE and AKS
- AKS: AAD Pod Identity
- EKS: Kubernetes metrics-server (available by default in GKE and AKS)
- EKS: Calico networking
Add a cluster plan in Wayfinder's web interface
To add a cluster plan:
- Click on Settings, then navigate to Developer Self-Service > Cluster Self-Service > Cluster Plans.
- Click the tab for the cloud provider that you want to add a plan for, and then click the Create [AKS/EKS/GCP] cluster plan button.
- Enter the details as described in the Properties of cluster plans section.
- Click the Save button.
Alternatively,
- If you want to copy an existing plan, then select your desired plan and then click on the Copy button.
- Enter the details as described in the tables below.
- Click Save.
For most plan properties, you can set whether to allow changes. When you allow changes, then workspace owners and members will be able to edit those parameters.
Add a cluster using the CLI
You can also create your own plan by writing a .yaml
file specifying the plan properties, and then applying it to Wayfinder using the
CLI. We recommend you start with an out-of-the-box plan and edit it to suit your needs.
To create a new cluster plan from an existing one:
Get the yaml from an existing plan:
wf get clusterplan gke-playground -o yaml > MYPLAN.yaml
This copies the the
gke-playground
cluster plan and places it in a fileMYPLAN.yaml
.Edit the plan file as needed, being sure to change the metadata name to a new name to indicate that you wish to make a new plan. Thereafter, apply the file:
wf apply -f MYPLAN.yaml
You can prevent workspaces from editing a parameter when creating a cluster by setting editable
to false
for that parameter. In below example
the cluster's region, version and upgrade method is locked (set to false) from being edited. The cluster's lifetime is editable (set to true).
policies:
- editable: false
path: spec.region
- editable: false
path: spec.version
- editable: true
path: spec.expires
- editable: false
path: spec.enableAutoUpgrade
Associate a plan to a workspace
Cluster plans can be allocated to one or more workspaces using the spec.allocation
field in the resource definition.
For the full plan specification, see PlanSpec.
The YAML example below specifies that the cluster plan is available in all workspaces.
spec:
allocation:
type: all
workspaces:
- '*'
The YAML example below specifies that the cluster plan is only available in the 'sandbox' workspace.
spec:
allocation:
type: workspaces
workspaces:
- sandbox
Network capacity and availability
Wayfinder inlcudes the clusterNetwork
and networkCapacity
details under status
.
clusterNetwork > exampleNetwork
demonstrates the next network range that Wayfinder will create from this plan, when a Cluster Network is created.networkCapacity
indicates that the network ranges have capacity and can be used for at least one more network.
apiVersion: compute.appvia.io/v2beta1
kind: ClusterPlan
name: eks-test1
spec:
status:
clusterNetwork:
exampleNetwork:
awsVPC:
cidr: 10.0.0.0/24
subnets:
- availabilityZone: az-1
cidr: 10.0.0.64/26
natGateway: true
type: EKSPrivate
- availabilityZone: az-2
cidr: 10.0.0.128/26
natGateway: true
type: EKSPrivate
- availabilityZone: az-3
cidr: 10.0.0.192/26
natGateway: true
type: EKSPrivate
- availabilityZone: az-1
cidr: 10.0.0.0/28
type: EKSPublic
- availabilityZone: az-2
cidr: 10.0.0.16/28
type: EKSPublic
- availabilityZone: az-3
cidr: 10.0.0.32/28
type: EKSPublic
networkCapacity:
- hasCapacity: true
stage: nonprod
- hasCapacity: true
stage: prod
Define the management peering rule
This is only required for private clusters. Skip this if your plan does not enable a private cluster.
Wayfinder requires direct connectivity to the public kubernetes API. This is the cloud managed Kubernetes API, not the authentication module.
Setting a cluster to private (enablePrivateCluster: true
in the above cluster plan) removes all public access to the API endpoint, so you must create a peering back to the
management network.
To define the management peering rule:
Create a resource file and apply it using the CLI:
wf apply -f FILENAME
Here's a sample peering rule definition:
---
apiVersion: networking.appvia.io/v1alpha1
kind: PeeringRule
metadata:
name: management
spec:
filters:
allocation:
type: all
selectors:
matchExpressions:
- key: networking.appvia.io/peering
operator: In
values: ["true"]
- key: appvia.io/provider
operator: In
values: ["aws"]
connection:
type: peering
peering:
enableAutoApproval: true
YAML Examples
AKS yaml example
~ wf get clusterplan aks-dev-basic -o yaml
apiVersion: compute.appvia.io/v2beta1
kind: ClusterPlan
name: aks-dev-basic
spec:
allocation:
type: workspaces
workspaces:
- sand
- ctest
policies:
- editable: true
enum:
- southindia
- australiaeast
- uksouth
path: spec.region
- editable: true
enum:
- dev nodepool
- sand nodepool
- test nodepool
path: spec.nodePools.0.description
- editable: true
max: 100
min: 0
path: spec.nodePools.0.autoscaling.minSize
- editable: true
max: 9
min: 0
path: spec.nodePools.0.size
- editable: true
max: 3
min: 0
path: spec.nodePools.0.autoscaling.maxSize
- editable: true
max: 50
min: 0
path: spec.nodePools.0.maxPodsPerNode
- editable: true
max: 40
min: 20
path: spec.nodePools.0.diskSize
- editable: false
enum:
- latest
- 1.26.6
path: spec.version
- editable: false
path: spec.expires
summary: Basic AKS cluster plan for Dev
template:
clusterLabels:
appvia.io/ingresspublic: "true"
enableAutoUpgrade: true
enablePrivateCluster: false
expires: 24h0m0s
maintenance:
windowDuration: 4hr
windowStart: "01:00"
networking:
authorizedMasterNetworks:
- cidr: 10.0.8.0/20
name: master
authorizedNetworks:
- cidr: 10.0.8.0/20
name: network
networkPlan: aks-fixed-high-performance-dev
networkProvider: cni
nodePools:
- autoscaling:
enabled: true
maxSize: 1
minSize: 1
description: sand nodepool
diskSize: 30
image: Windows
labels:
performance: "true"
logicalName: devpl
machine: Standard_D2_v5
maxPodsPerNode: 30
providerDetails:
aks:
mode: system
type: AKS
size: 1
spot:
aks:
maxSpotPrice: "100"
enabled: true
taints:
- effect: NoSchedule
key: performance
value: high
provider: AKS
providerDetails:
aks:
linuxProfile: {}
windowsProfile: {}
type: AKS
region: uksouth
security:
podSecurityStandard:
allowed:
- privileged
- baseline
- restricted
defaultProfile: baseline
enabled: true
version: 1.26.6
EKS yaml example
wf get clusterplans eks-test1 -o yaml
apiVersion: compute.appvia.io/v2beta1
kind: ClusterPlan
metadata:
name: eks-test1
spec:
allocation:
type: all
summary: eks-test1-desc
template:
channel: default
clusterLabels:
appvia.io/ingresspublic: "true"
enableAutoUpgrade: false
enablePrivateCluster: true
networking:
authorizedMasterNetworks:
- cidr: 10.0.8.0/24
name: master
authorizedNetworks:
- cidr: 10.0.8.0/25
name: network
networkPlan: eks-standard
nodePools:
- autoscaling:
enabled: true
maxSize: 10
minSize: 1
description: syak8-desc
diskSize: 30
image: AL2_x86_64
logicalName: syak8
machine: t3.large
size: 2
spot:
eks: {}
provider: EKS
providerDetails:
eks:
cloudWatchLogging:
api: true
audit: true
authenticator: true
controllerManager: true
scheduler: true
encryption:
secretsEncryptionEnabled: true
type: EKS
region: eu-west-2
security:
podSecurityStandard: {}
GKE yaml example
wf get clusterplans gke-test1 -o yaml
apiVersion: compute.appvia.io/v2beta1
kind: ClusterPlan
name: gke-test1
spec:
allocation:
type: all
summary: gke-test1-desc
template:
channel: default
clusterLabels:
appvia.io/ingresspublic: "true"
enablePrivateCluster: false
networking:
authorizedMasterNetworks:
- cidr: 10.0.8.0/24
name: master1
authorizedNetworks:
- cidr: 10.0.8.0/25
name: network1
networkPlan: gke-standard
networkProvider: calico
nodePools:
- autoscaling:
enabled: true
maxSize: 10
minSize: 1
description: znqfp-desc
diskSize: 30
image: COS_CONTAINERD
logicalName: znqfp
machine: n2-standard-2
maxPodsPerNode: 110
providerDetails:
gke:
enableAutorepair: true
enableAutoupgrade: true
type: GKE
size: 1
spot: {}
provider: GKE
providerDetails:
gke:
enableHTTPLoadBalancer: true
enableHorizontalPodAutoscaler: true
enableShieldedNodes: true
enableStackDriverLogging: true
enableStackDriverMetrics: true
masterIPV4Cidr: 10.0.8.0/24
type: GKE
region: europe-west2
security: {}