Provisioning clusters
Provision an EKS, GKE, or AKS cluster from the Provision drawer, typically in 15 to 30 minutes, and get a registered deployment space with default platform components.
ZopDay provisions managed Kubernetes clusters on all three major clouds from the same Provision drawer. Cluster creation typically takes 15 to 30 minutes. When it succeeds, ZopDay registers the cluster as a deployment space and installs the Helm components you picked. Before the first service deploys, ZopDay adds anything missing from its default baseline (ingress, TLS, and metrics), so you can deploy to it straight away.
Infrastructure, Graph view; clusters, VMs, and datastores grouped by cloud and region, with their connections and monthly cost.
Before you start
- A cloud account connected with the provisioning IAM scope. See Cloud permissions.
- The
provisioning:createpolicy. See RBAC. - A networking decision: provision a new VPC for this cluster, or use an existing one (see Existing VPC requirements).
- A region and a size for the cluster.
How it works
| Provider | Cluster API | What the job creates |
|---|---|---|
| AWS | EKS | Control plane, worker nodes, and the cluster IAM |
| GCP | GKE | Control plane, worker nodes, and the cluster IAM |
| Azure | AKS | Control plane, worker nodes, and the cluster IAM |
The job also creates the network if you ask for a new VPC, and the components you pick install once the job completes. If you need a cluster built to a different baseline, provision it outside ZopDay and register it through the BYOC path. See Cluster registration.
Pipeline steps
Validate → Create network → Create IAM → Create cluster → Register space → Finalize| Step | What it does |
|---|---|
| Validate | Checks the request before anything is created |
| Create network | Provisions the VPC, subnets, NAT, internet gateway, and route tables (skipped for an existing VPC) |
| Create IAM | Creates the IAM the cluster and its nodes need |
| Create cluster | Submits the EKS / GKE / AKS create call and waits for the cluster to be ready |
| Register space | Registers the cluster as a deployment space |
| Finalize | Marks the job completed |
Most of the wall-clock time is spent creating the cluster. The EKS / GKE / AKS create call blocks while the cloud provider provisions the control plane and the worker pool. All the other steps together finish in well under a minute.
What lands on the cluster
When the provisioning job completes, ZopDay installs the components you picked in the drawer’s Advanced settings → Components tab. Each install runs as its own logged, retryable action. If you pick none, nothing installs at that point.
Before the first service deploys to the cluster, ZopDay installs whatever is missing from the baseline the service chart needs:
| Component | Purpose |
|---|---|
NGINX Ingress Controller (ingress-nginx) | Routes external traffic to cluster services through a cloud load balancer |
Cert Manager (cert-manager) | Automated TLS certificates with Let’s Encrypt |
Prometheus Stack (prometheus) | Monitoring, alerting, and Grafana dashboards |
| Cluster Autoscaler and EBS CSI Driver | AWS only |
You can add or upgrade other components later, such as Metrics Server, KEDA, or Loki. See Components.
Provision a cluster
Go to Infrastructure → Provision → Kubernetes Cluster. All settings are in one drawer.
Cloud account + region
Pick the connected cloud account and the region. ZopDay checks that the account can reach the cluster API in that region, because some organisations restrict regions at the account level.
Name and size
Name the cluster and pick a size. Advanced settings holds the cluster version, scaling, components, and network options, with sensible defaults already applied.
Networking
Choose one of two options:
- Create new VPC (recommended): ZopDay provisions a VPC with public and private subnets across availability zones, NAT, an internet gateway, route tables, and the security groups the cluster needs. See Networking for the default layout.
- Use existing VPC: pick a VPC that ZopDay can already see on the cloud account. ZopDay detects which subnets are public and which are private, and proposes a layout. You can override it.
The cluster API endpoint is public: EKS clusters are created with both public and private endpoint access, and GKE and AKS clusters with their default public endpoint. If you restrict it afterwards with authorised CIDRs (EKS), authorised networks (GKE), or authorised IP ranges (AKS), keep ZopDay’s deploys allowed.
Provision
Click Provision. The job runs in the background. Follow its steps in Activity → Provisioning Jobs.
Use an existing VPC
If you pick Use existing VPC, ZopDay needs:
| Requirement | Why |
|---|---|
| At least 2 subnets across different AZs/zones | EKS/GKE/AKS all require a multi-AZ control plane |
| At least one subnet tagged as private | Worker nodes go in private subnets |
| NAT egress configured | Worker nodes pull images via NAT |
If a requirement is missing, the validate step fails fast with a specific error. In existing-VPC mode, ZopDay does not silently fix the VPC config, because the VPC is customer-owned infrastructure.
Tear down a cluster
DELETE /provisioning-jobs/{id} triggers cluster teardown, which runs as a deletion job:
- Helm uninstalls every component.
- Drains nodes.
- Submits the EKS/GKE/AKS delete call.
- Tears down the IAM role.
- Tears down the VPC, if ZopDay created it. Existing VPCs are not touched.
Teardown takes 5–10 minutes, and the detail page streams progress. If the job is cancelled partway through, retry resumes from the last successful step. Retry is idempotent: if EKS is already deleted, the delete call returns 404, which counts as success.
Reference
Cost estimate
A cluster’s cost is made up of:
- Control plane fees (cloud list prices as of September 2026: EKS $0.10/hr; GKE $0.10/hr, with a free tier credit that covers one cluster; AKS control plane free on the Free tier, paid on the Standard tier)
- Node pool cost (instance × count × hours)
- NAT gateway data processing, which depends on your traffic
- Load balancer charges
Any cost figure shown before you provision is an estimate. Actual cost varies with traffic.
What ZopDay does NOT provision
| Out of scope | Why |
|---|---|
| Application Helm releases | Releasing applications is deploy work, not provisioning. See Pipelines. |
| Cluster-side observability stack (Prometheus / Loki / Grafana) | Not part of provisioning. The Prometheus Stack (with Grafana) installs before the first deploy as part of the baseline; Loki and Fluent Bit are opt-in components. |
| Custom CNI / Service Mesh (Istio, Linkerd, Cilium) | Not provisioned, and not in the component catalogue today. Install them yourself. |
| Bastion / SSH access | Not configured. Use aws ssm start-session / gcloud compute ssh / Azure Bastion for cluster node access. |
Troubleshooting
A provisioning step failed
Activity → Provisioning Jobs marks the job as failed and shows the failing step with the underlying error. Fix the cause (quota, permissions, or a conflict with an existing resource) and retry. The job resumes from the last successful step.
Validate fails on an existing VPC
The VPC is missing a requirement: two subnets in different zones, a private subnet, or NAT egress. The error names which one. Fix the VPC yourself (ZopDay won’t change a customer-owned VPC), or choose Create new VPC.
The region is rejected
ZopDay checks that the account can reach the cluster API in the region you picked. Some organisations restrict regions at the account level; pick an allowed region or lift the restriction.