Skip to main content

wf install

wf install

Installs a production grade Wayfinder management plane in the cloud


Install Wayfinder and any cloud infrastructure it depends on.

On first run, this will create two files in your current directory - wf-install.yaml and wf-install-secrets.yaml. These contain the values you choose during the install and can be used in future for a non-interactive re-install or upgrade.

You can prepare these files without installing by using --init-only. Note that this will create reserved IP addresses in your cloud provider to enable you to set up DNS - if you decide not to continue, these can be removed using wf install --remove.

You should store these files as appropriate, ensuring that the secrets file is encrypted or provided from a secrets management system. Alternatively, you can provide the secret values using CLI options and discard the wf-install-secrets.yaml file.

For these commands to work, you must be logged into the specific cloud account you wish to install Wayfinder in:

wf install [flags]


# Install Wayfinder, being prompted for all values - if you have existing wf-install.yaml and
# wf-install-secrets.yaml files in the current directory, these will provide defaults and be updated
# with any changes you make, else new files will be created:
$ wf install

# Prepare (or update) wf-install.yaml and wf-install-secrets.yaml files in the current directory,
# but do not install:
$ wf install --init-only

# Install using a prepared wf-install.yaml and wf-install-secrets.yaml in the current directory
# without prompting (can also be used to upgrade):
$ wf install --non-interactive

# Install using a non-default wf-install.yaml / wf-install-secrets.yaml:
$ wf install --non-interactive --values /path/to/wf-install.yaml --secrets /path/to/wf-install-secrets.yaml

# Alternatively, provide the secrets on the CLI instead of using the secrets file:
$ wf install --non-interactive --values /path/to/wf-install.yaml --idp-client-secret SECRET_VALUE


  -a, --account string                          Cloud account (AWS Account ID / Azure Subscription ID / GCP Project ID)
--api-host string DNS host name for the api, e.g.
--api-tls-private-key-pem string the name of a PEM file for the api private key
--api-tls-public-chain-pem string the name of a PEM file for the api public key chain
-c, --cloud string Cloud provider to use
--cluster-name string Name of the cluster to build
--confirm-instance-id-for-remove string Provide the instance id of Wayfinder to confirm delete
--disable-idp DEPRECATED - the default is now to configure IDP after install and this flag no longer has any effect - will be removed in 1.7
--disable-local-login Completely disables local logins (includes localadmin user)
-d, --domain string DNS domain (zone) to use, e.g.
-h, --help help for install
--honeycomb-api-key string Enable distributed tracing export to by providing the API key
--idp-client-id string OpenID Identity Provider client ID - must be specified with --idp-url and --idp-client-secret
--idp-client-secret string OpenID Identity Provider client secret - must be specified with --idp-url and --idp-client-id
--idp-url string OpenID Identity Provider Issuer URL - must be specified with --idp-client-secret and --idp-client-id
--in-cluster-instance string Instance name to install - must be unique inside --in-cluster-namespace (requires --in-cluster)
--init-only Prepares your wf-install.yaml and wf-install-secrets.yaml but does not install
--instance-identifier string Unique identifier for this install of Wayfinder
--json-file string create a JSON formated file with installer outputs
--leave-admin-token Leave the install-time admin token in place (DEPRECATED - will be removed in next release - use reset-local-admin instead)
--leave-networking Leave the networking and ingress IPs when removing
--license-email string Obtain a free license key with this email address (if required)
--license-key string Existing license key to apply to installation (can also be provided via environment variable WF_LICENSE_KEY)
--network-range string IPv4 range to use for the infrastructure
--no-dns-check Skips validation that DNS names resolve - only valid with --init-only
--non-interactive Do not prompt for user input
-r, --region string Cloud region
--remove Uninstall Wayfinder and infrastructure
--reset-local-admin Reset local admin account password (when IDP integration disabled and upgrading existing Wayfinder install)
--secrets PATH Custom Wayfinder install secrets file (default wf-instal-secrets.yaml in current directory) PATH
--skip-kube-depends Skip installation of Wayfinder Kubernetes dependencies
--ui-host string DNS host name for the web UI, e.g.
--ui-tls-private-key-pem string the name of a PEM file for the web UI private key
--ui-tls-public-chain-pem string the name of a PEM file for the web UI public key chain
--values PATH Custom Wayfinder install values file (default wf-install.yaml in current directory) PATH

Options inherited from parent commands

      --debug              Indicates we should use debug / trace logging (default: false)
--force Used to force an operation to happen (default: false)
--no-wait Indicates we should not wait for resources to provision
-o, --output string Output format of the resource (json,yaml,table,template) (default "table")
--profile string Use a profile other than your default for this command
--show-headers Indicates we should display headers on table out (default true)
--verbose Enables verbose logging for debugging purposes (default: false)
-w, --workspace string The workspace you are operating within


  • wf - wf provides a cli for Wayfinder
  • wf install deps - Creates or updates the pre-requisite dependencies for Wayfinder in a cluster
  • wf install infra - Creates or updates host cluster infrastructure for Wayfinder