Create Ankra Cloud cluster (browser session)

import requests

url = "https://api.platform.ankra.app/org/clusters/ankracloud"

payload = {
    "bastion_plan": "c1-2",
    "control_plane_plan": "c2-4",
    "name": "ankra-prod",
    "zone": "de-fsn1"
}
headers = {
    "cookie": "ankra_session=",
    "X-Ankra-CSRF": "<x-ankra-csrf>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    cookie: 'ankra_session=',
    'X-Ankra-CSRF': '<x-ankra-csrf>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    bastion_plan: 'c1-2',
    control_plane_plan: 'c2-4',
    name: 'ankra-prod',
    zone: 'de-fsn1'
  })
};

fetch('https://api.platform.ankra.app/org/clusters/ankracloud', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

curl --request POST \
  --url https://api.platform.ankra.app/org/clusters/ankracloud \
  --header 'Content-Type: application/json' \
  --header 'X-Ankra-CSRF: <x-ankra-csrf>' \
  --cookie ankra_session= \
  --data '
{
  "bastion_plan": "c1-2",
  "control_plane_plan": "c2-4",
  "name": "ankra-prod",
  "zone": "de-fsn1"
}
'

{
  "cluster_id": "11111111-2222-4333-8444-555555555555",
  "name": "ankra-prod"
}

{
  "detail": "Cluster not found"
}

{
  "detail": "Cluster not found"
}

{
  "detail": "Cluster not found"
}

{
  "detail": "Cluster not found"
}

{
  "detail": "Cluster not found"
}

{
  "detail": [
    {
      "loc": [
        "<string>"
      ],
      "msg": "<string>",
      "type": "<string>"
    }
  ]
}

{
  "detail": "Cluster not found"
}

{
  "detail": "Cluster not found"
}

Ankra Cloud Clusters

Create Ankra Cloud cluster (browser session)

Browser session authentication; RBAC permission clusters. RBAC permission clusters.create. Creates a self-managed kubeadm / k3s cluster on Ankra Cloud servers: a private RFC 1918 network (network_ip_range, or an adopted private_network_id), a bastion and the cluster nodes on the private network only. By default (network_modeipv6_only) the nodes reach IPv4 through the zone's NAT64 and the bastion holds only its public IPv6;network_mode ipv4_nat adds a router with NAT for IPv4 egress and gives the bastion a public IPv4. Plans replace instance types (bastion_plan, control_plane_plan, worker_plan, etcd_plan; node groups keep instance_type), templateis the OS image (default debian-13). The preflight runs first and the first failing item is the refusal. kubeadm requires Cilium; the ankra-cloud-ccm is always installed.bastion_portis accepted for contract symmetry and ignored: the bastion listens on 22. Answers 404 while the organisation'sankra_cloud_providerfeature flag is off. With nocredential_id`, the organisation’s built-in Ankra Cloud credential is used, and the request answers 503 with Retry-After when it cannot be created or renewed right now.

POST

org

clusters

ankracloud

Create Ankra Cloud cluster (browser session)

import requests

url = "https://api.platform.ankra.app/org/clusters/ankracloud"

payload = {
    "bastion_plan": "c1-2",
    "control_plane_plan": "c2-4",
    "name": "ankra-prod",
    "zone": "de-fsn1"
}
headers = {
    "cookie": "ankra_session=",
    "X-Ankra-CSRF": "<x-ankra-csrf>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    cookie: 'ankra_session=',
    'X-Ankra-CSRF': '<x-ankra-csrf>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    bastion_plan: 'c1-2',
    control_plane_plan: 'c2-4',
    name: 'ankra-prod',
    zone: 'de-fsn1'
  })
};

fetch('https://api.platform.ankra.app/org/clusters/ankracloud', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

curl --request POST \
  --url https://api.platform.ankra.app/org/clusters/ankracloud \
  --header 'Content-Type: application/json' \
  --header 'X-Ankra-CSRF: <x-ankra-csrf>' \
  --cookie ankra_session= \
  --data '
{
  "bastion_plan": "c1-2",
  "control_plane_plan": "c2-4",
  "name": "ankra-prod",
  "zone": "de-fsn1"
}
'

{
  "cluster_id": "11111111-2222-4333-8444-555555555555",
  "name": "ankra-prod"
}

{
  "detail": "Cluster not found"
}

{
  "detail": "Cluster not found"
}

{
  "detail": "Cluster not found"
}

{
  "detail": "Cluster not found"
}

{
  "detail": "Cluster not found"
}

{
  "detail": [
    {
      "loc": [
        "<string>"
      ],
      "msg": "<string>",
      "type": "<string>"
    }
  ]
}

{
  "detail": "Cluster not found"
}

{
  "detail": "Cluster not found"
}

Authorizations

ankra_session

string

required

Browser session. Mutations also require X-Ankra-CSRF.

Headers

X-Ankra-CSRF

string

required

Must match the ankra_csrf browser cookie.

Body

application/json

bastion_plan

string

required

control_plane_plan

string

required

name

string

required

Cluster name: 1 to 53 lowercase letters, digits and hyphens, starting with a letter and ending with a letter or digit (an RFC 1035 DNS label). It prefixes every server hostname of the cluster; a create carrying any other name is refused, and nothing is created.

Required string length: 1 - 53

Pattern: ^[a-z]([-a-z0-9]*[a-z0-9])?$

zone

string

required

Ankra Cloud zone (GET /clusters/ankracloud/zones); every server of the cluster is placed there.

bastion_allowed_ips

string[]

IPv4/IPv6 addresses or CIDRs allowed to SSH to the bastion; empty allows any source.

bastion_disk_gibibytes

integer

Root disk size of the bastion in GiB. Omit it for the plan's included disk; Ankra Cloud refuses a size below the plan's and the template's minimum.

Required range: 1 <= x <= 4096

bastion_disk_tier

enum<string>

Storage tier of the bastion's root disk. Omit it for the zone's default_storage_tier. local-nvme is the node's own disks; standard, maxiops and hdd are the zone's Ankra Storage (Ceph) tiers.

Available options:

local-nvme,

standard,

maxiops,

hdd

bastion_port

integer

default:22

Accepted for contract symmetry with the managed-gateway providers and ignored: the bastion listens on 22.

cni

enum<string>

default:cilium

kubeadm supports only cilium on Ankra Cloud.

Available options:

flannel,

calico,

cilium

cni_features

object

Show child attributes

control_plane_count

integer

default:1

Required range: 1 <= x <= 9

control_plane_disk_gibibytes

integer

Root disk size of each control plane in GiB. Omit it for the plan's included disk.

Required range: 1 <= x <= 4096

control_plane_disk_tier

enum<string>

Storage tier of each control plane's root disk. Omit it for the zone's default_storage_tier. local-nvme is the node's own disks; standard, maxiops and hdd are the zone's Ankra Storage (Ceph) tiers.

Available options:

local-nvme,

standard,

maxiops,

hdd

credential_id

string<uuid>

criticality

string | null

description

string | null

distribution

enum<string>

default:kubeadm

Available options:

k3s,

kubeadm

environment

string | null

etcd_disk_gibibytes

integer

Root disk size of each external etcd node in GiB. Omit it for the plan's included disk.

Required range: 1 <= x <= 4096

etcd_disk_tier

enum<string>

Storage tier of each external etcd node's root disk. Omit it for the zone's default_storage_tier. local-nvme is the node's own disks; standard, maxiops and hdd are the zone's Ankra Storage (Ceph) tiers.

Available options:

local-nvme,

standard,

maxiops,

hdd

etcd_node_count

integer

default:3

etcd_plan

string

default:""

Required for an external etcd topology.

etcd_topology

enum<string>

default:stacked

Available options:

stacked,

external

external_cloud_provider

boolean

default:true

gitops_branch

string

default:master

gitops_provider

enum<string>

default:github

GitOps provider of the repository the cluster is bootstrapped onto. Omitted is github, where gitops_repository is owner/name. bitbucket_cloud names the repository by gitops_workspace and gitops_repo_slug (or gitops_repository as workspace/repo_slug) and binds it as a Bitbucket Cloud repository.

Available options:

github,

bitbucket_cloud

gitops_workspace

string | null

Bitbucket Cloud workspace of the GitOps repository. Only with gitops_provider bitbucket_cloud; provided together with gitops_repo_slug.

gitops_repo_slug

string | null

Bitbucket Cloud repository slug of the GitOps repository. Only with gitops_provider bitbucket_cloud; provided together with gitops_workspace.

gitops_credential_name

string

default:""

gitops_repository

string

default:""

include_dns

boolean

default:true

include_networking

boolean

default:true

gateway_api

boolean

default:false

Install the Kubernetes Gateway API beside Traefik's Ingress: the Gateway API standard CRDs, Traefik's Gateway provider with the traefik GatewayClass and a shared traefik-gateway Gateway in the traefik namespace (a plain HTTP listener that accepts routes from every namespace), cert-manager's Gateway support, and external-dns publishing of HTTPRoute hostnames. Ingress keeps working; one Traefik serves both. Requires include_networking.

k3s_disabled_components

string[] | null

kubernetes_version

string | null

network_ip_range

string | null

RFC 1918 CIDR (/16 through /29) of the private network Ankra creates; omitted derives one per cluster.

network_mode

enum<string>

default:ipv6_only

ipv6_only (default; the zone needs capabilities networking.nat64 and networking.port_forward): no router, the nodes reach IPv4 through the zone's NAT64, and the platform reaches the bastion's IPv6 through an Ankra Cloud port forward from the zone's gateway; the bastion admits SSH from that gateway, the private network and IPv6 bastion_allowed_ips only. ipv4_nat, only when asked for: a NAT router for the nodes' IPv4 egress and a bastion with a public IPv4 (a paid add-on counted against the account's public IPv4 quota) the platform dials.

Available options:

ipv4_nat,

ipv6_only

node_groups

object[]

Show child attributes

private_network_id

string | null

Adopts an existing private network in the zone; mutually exclusive with network_ip_range. An adopted network is never deleted by the cluster.

retention_policy

enum<string>

default:retain

Available options:

delete,

retain

runtime_credential_id

string<uuid> | null

Credential the running cluster's cloud-controller-manager and CSI use; omitted reuses credential_id.

ssh_key_credential_id

string<uuid>

Optional customer SSH key. When omitted, Ankra uses the cluster-specific managed key, stored encrypted server-side.

template

string

default:debian-13

Public OS template id (GET /clusters/ankracloud/templates).

worker_count

integer

default:1

Required range: 0 <= x <= 100

worker_disk_gibibytes

integer

Root disk size of each worker in GiB, and of each node group that names no disk_gibibytes of its own. Omit it for the plan's included disk.

Required range: 1 <= x <= 4096

worker_disk_tier

enum<string>

Storage tier of each worker's root disk, and of each node group that names no disk_tier of its own. Omit it for the zone's default_storage_tier. local-nvme is the node's own disks; standard, maxiops and hdd are the zone's Ankra Storage (Ceph) tiers.

Available options:

local-nvme,

standard,

maxiops,

hdd

worker_plan

string

default:""

Required when worker_count is above zero and no node_groups are given.

Response

Successful response

cluster_id

string<uuid>

required

name

string

required

API reference

Endpoints

Create Ankra Cloud cluster (browser session)

Authorizations

Headers

Body

Response