Create an AWS EC2 cluster

import requests

url = "https://platform.ankra.app/org/clusters/aws"

payload = {
    "name": "<string>",
    "credential_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "ssh_key_credential_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "region": "<string>",
    "vpc_id": "<string>",
    "node_subnet_ids": ["<string>"],
    "bastion_subnet_id": "<string>",
    "bastion_allowed_ips": ["<string>"]
}
headers = {
    "cookie": "ankra_session=",
    "X-Ankra-CSRF": "<x-ankra-csrf>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    cookie: 'ankra_session=',
    'X-Ankra-CSRF': '<x-ankra-csrf>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    name: '<string>',
    credential_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
    ssh_key_credential_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
    region: '<string>',
    vpc_id: '<string>',
    node_subnet_ids: ['<string>'],
    bastion_subnet_id: '<string>',
    bastion_allowed_ips: ['<string>']
  })
};

fetch('https://platform.ankra.app/org/clusters/aws', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

curl --request POST \
  --url https://platform.ankra.app/org/clusters/aws \
  --header 'Content-Type: application/json' \
  --header 'X-Ankra-CSRF: <x-ankra-csrf>' \
  --cookie ankra_session= \
  --data '
{
  "name": "<string>",
  "credential_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "ssh_key_credential_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "region": "<string>",
  "vpc_id": "<string>",
  "node_subnet_ids": [
    "<string>"
  ],
  "bastion_subnet_id": "<string>",
  "bastion_allowed_ips": [
    "<string>"
  ]
}
'

{
  "cluster_id": "11111111-2222-4333-8444-555555555555",
  "name": "aws-prod",
  "kind": "aws",
  "state": "creating",
  "operation_id": null
}

{
  "detail": "Cluster not found"
}

{
  "detail": "Cluster not found"
}

{
  "detail": "Cluster not found"
}

{
  "detail": "Cluster not found"
}

{
  "detail": "Cluster not found"
}

{
  "detail": [
    {
      "loc": [
        "<string>"
      ],
      "msg": "<string>",
      "type": "<string>"
    }
  ]
}

{
  "detail": "Cluster not found"
}

AWS Clusters

Create an AWS EC2 cluster

Browser session authentication; RBAC permission clusters.create. Creates a self-managed k3s / kubeadm cluster on EC2 in the customer’s VPC (ADR 0015). The preflight runs first and the first error item is the refusal. Defaults: t3.medium nodes, a t3.small bastion, Ubuntu 24.04 on amd64, a 40 GiB encrypted gp3 root volume, one control plane and one worker, Cilium for either distribution. egress_mode omitted is resolved by preflight (existing when every node subnet already has egress, bastion_nat when none has and none carries a foreign instance). Flannel is accepted but cannot enforce the IMDS guard, so the preflight reports a warning for it; the AWS cloud-controller-manager is always installed. Answers 404 while the organisation’s aws_provider feature flag is off.

POST

org

clusters

aws

Create an AWS EC2 cluster

import requests

url = "https://platform.ankra.app/org/clusters/aws"

payload = {
    "name": "<string>",
    "credential_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "ssh_key_credential_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "region": "<string>",
    "vpc_id": "<string>",
    "node_subnet_ids": ["<string>"],
    "bastion_subnet_id": "<string>",
    "bastion_allowed_ips": ["<string>"]
}
headers = {
    "cookie": "ankra_session=",
    "X-Ankra-CSRF": "<x-ankra-csrf>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    cookie: 'ankra_session=',
    'X-Ankra-CSRF': '<x-ankra-csrf>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    name: '<string>',
    credential_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
    ssh_key_credential_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
    region: '<string>',
    vpc_id: '<string>',
    node_subnet_ids: ['<string>'],
    bastion_subnet_id: '<string>',
    bastion_allowed_ips: ['<string>']
  })
};

fetch('https://platform.ankra.app/org/clusters/aws', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

curl --request POST \
  --url https://platform.ankra.app/org/clusters/aws \
  --header 'Content-Type: application/json' \
  --header 'X-Ankra-CSRF: <x-ankra-csrf>' \
  --cookie ankra_session= \
  --data '
{
  "name": "<string>",
  "credential_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "ssh_key_credential_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "region": "<string>",
  "vpc_id": "<string>",
  "node_subnet_ids": [
    "<string>"
  ],
  "bastion_subnet_id": "<string>",
  "bastion_allowed_ips": [
    "<string>"
  ]
}
'

{
  "cluster_id": "11111111-2222-4333-8444-555555555555",
  "name": "aws-prod",
  "kind": "aws",
  "state": "creating",
  "operation_id": null
}

{
  "detail": "Cluster not found"
}

{
  "detail": "Cluster not found"
}

{
  "detail": "Cluster not found"
}

{
  "detail": "Cluster not found"
}

{
  "detail": "Cluster not found"
}

{
  "detail": [
    {
      "loc": [
        "<string>"
      ],
      "msg": "<string>",
      "type": "<string>"
    }
  ]
}

{
  "detail": "Cluster not found"
}

Authorizations

ankra_session

string

required

Browser session. Mutations also require X-Ankra-CSRF.

Headers

X-Ankra-CSRF

string

required

Must match the ankra_csrf browser cookie.

Body

application/json

POST /clusters/aws body. Nodes never receive a public IP; the bastion holds the elastic IP and is the SSH hop (and the NAT instance in bastion_nat mode).

name

string

required

credential_id

string<uuid>

required

An organisation aws credential: a keys credential, or a role onboarded with scope provisioning or self_managed (cost-scoped roles are refused).

ssh_key_credential_id

string<uuid>

required

region

string

required

Region slug, validated against ec2:DescribeRegions.

vpc_id

string

required

node_subnet_ids

string[]

required

Private subnets the nodes spread across; one or more, their zones become the cluster's zone pool.

Minimum array length: 1

bastion_subnet_id

string

required

A public subnet (internet-gateway default route) for the bastion.

bastion_allowed_ips

string[]

required

IPv4 CIDRs allowed to SSH to the bastion; 0.0.0.0/0 and ::/0 are refused.

Minimum array length: 1

description

string | null

egress_mode

enum<string> | null

Omitted: resolved by preflight. existing keeps the subnets' NAT routing; bastion_nat makes the bastion the NAT instance behind one Ankra-owned route table and is refused when a node subnet carries instances Ankra did not create.

Available options:

existing,

bastion_nat

bastion_instance_type

string

default:t3.small

control_plane_count

integer

default:1

At least 3 when the node subnets span more than one availability zone.

Required range: 1 <= x <= 9

control_plane_type

string

default:t3.medium

worker_count

integer

default:1

Required range: 0 <= x <= 100

worker_type

string

default:t3.medium

node_groups

object[] | null

Show child attributes

distribution

enum<string>

default:kubeadm

Available options:

k3s,

kubeadm

kubernetes_version

string | null

etcd_topology

enum<string>

default:stacked

Available options:

stacked,

external

etcd_node_count

integer

default:3

etcd_type

string

default:t3.medium

cni

enum<string>

default:cilium

Defaults to cilium for both distributions: the AWS stack's IMDS guard is a network policy only Cilium and Calico enforce. flannel is accepted with a preflight warning; kubeadm requires cilium.

Available options:

flannel,

calico,

cilium

cni_features

object

Show child attributes

k3s_disabled_components

string[] | null

ubuntu_series

string

default:24.04

architecture

enum<string>

default:amd64

arm64 is refused with a 422 naming the pending image-catalogue audit (ADR 0015 §6).

Available options:

amd64

root_volume_gib

integer

default:40

Encrypted gp3 root volume of every instance.

Required range: 20 <= x <= 2000

gitops_credential_name

string

gitops_repository

string

gitops_branch

string

default:master

include_networking

boolean

default:true

include_dns

boolean

default:true

retention_policy

enum<string>

default:retain

Available options:

delete,

retain

external_cloud_provider

boolean

default:true

Must be true when present: the AWS cloud-controller-manager is mandatory.

environment

string | null

criticality

string | null

Response

Successful response

cluster_id

string<uuid>

required

name

string

required

kind

string

required

Allowed value: "aws"

state

string

required

operation_id

string<uuid> | null

required

API reference

Endpoints

Create an AWS EC2 cluster

Authorizations

Headers

Body

Response