Preflight an AWS EC2 cluster create

import requests

url = "https://platform.ankra.app/api/v1/clusters/aws/preflight"

payload = {
    "name": "<string>",
    "credential_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "ssh_key_credential_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "region": "<string>",
    "vpc_id": "<string>",
    "node_subnet_ids": ["<string>"],
    "bastion_subnet_id": "<string>",
    "bastion_allowed_ips": ["<string>"]
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    name: '<string>',
    credential_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
    ssh_key_credential_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
    region: '<string>',
    vpc_id: '<string>',
    node_subnet_ids: ['<string>'],
    bastion_subnet_id: '<string>',
    bastion_allowed_ips: ['<string>']
  })
};

fetch('https://platform.ankra.app/api/v1/clusters/aws/preflight', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

curl --request POST \
  --url https://platform.ankra.app/api/v1/clusters/aws/preflight \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "name": "<string>",
  "credential_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "ssh_key_credential_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "region": "<string>",
  "vpc_id": "<string>",
  "node_subnet_ids": [
    "<string>"
  ],
  "bastion_subnet_id": "<string>",
  "bastion_allowed_ips": [
    "<string>"
  ]
}
'

{
  "items": [
    {
      "check": "<string>",
      "status": "ok",
      "message": "<string>"
    }
  ],
  "can_proceed": true,
  "resolved_egress_mode": "existing"
}

{
  "cluster_id": "11111111-2222-4333-8444-555555555555",
  "name": "aws-prod",
  "kind": "aws",
  "state": "creating",
  "operation_id": null
}

{
  "detail": "Cluster not found"
}

{
  "detail": "Cluster not found"
}

{
  "detail": "Cluster not found"
}

{
  "detail": "Cluster not found"
}

{
  "detail": "Cluster not found"
}

{
  "detail": [
    {
      "loc": [
        "<string>"
      ],
      "msg": "<string>",
      "type": "<string>"
    }
  ]
}

{
  "detail": "Cluster not found"
}

AWS Clusters

Preflight an AWS EC2 cluster create

Bearer PAT authentication; RBAC permission clusters.create. Runs every check the create runs against AWS without creating anything. Each item is three-state: ok, warning (a read Ankra could not perform, or a caveat such as flannel not enforcing the IMDS guard), or error. resolved_egress_mode is the mode the create will run under, null when it could not be decided. Answers 404 while the organisation’s aws_provider feature flag is off.

POST

api

clusters

aws

preflight

Preflight an AWS EC2 cluster create

import requests

url = "https://platform.ankra.app/api/v1/clusters/aws/preflight"

payload = {
    "name": "<string>",
    "credential_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "ssh_key_credential_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "region": "<string>",
    "vpc_id": "<string>",
    "node_subnet_ids": ["<string>"],
    "bastion_subnet_id": "<string>",
    "bastion_allowed_ips": ["<string>"]
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    name: '<string>',
    credential_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
    ssh_key_credential_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
    region: '<string>',
    vpc_id: '<string>',
    node_subnet_ids: ['<string>'],
    bastion_subnet_id: '<string>',
    bastion_allowed_ips: ['<string>']
  })
};

fetch('https://platform.ankra.app/api/v1/clusters/aws/preflight', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

curl --request POST \
  --url https://platform.ankra.app/api/v1/clusters/aws/preflight \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "name": "<string>",
  "credential_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "ssh_key_credential_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "region": "<string>",
  "vpc_id": "<string>",
  "node_subnet_ids": [
    "<string>"
  ],
  "bastion_subnet_id": "<string>",
  "bastion_allowed_ips": [
    "<string>"
  ]
}
'

{
  "items": [
    {
      "check": "<string>",
      "status": "ok",
      "message": "<string>"
    }
  ],
  "can_proceed": true,
  "resolved_egress_mode": "existing"
}

{
  "cluster_id": "11111111-2222-4333-8444-555555555555",
  "name": "aws-prod",
  "kind": "aws",
  "state": "creating",
  "operation_id": null
}

{
  "detail": "Cluster not found"
}

{
  "detail": "Cluster not found"
}

{
  "detail": "Cluster not found"
}

{
  "detail": "Cluster not found"
}

{
  "detail": "Cluster not found"
}

{
  "detail": [
    {
      "loc": [
        "<string>"
      ],
      "msg": "<string>",
      "type": "<string>"
    }
  ]
}

{
  "detail": "Cluster not found"
}

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Headers

x-ankra-organisation-id

string

PAT organisation override.

Body

application/json

POST /clusters/aws body. Nodes never receive a public IP; the bastion holds the elastic IP and is the SSH hop (and the NAT instance in bastion_nat mode).

name

string

required

credential_id

string<uuid>

required

An organisation aws credential: a keys credential, or a role onboarded with scope provisioning or self_managed (cost-scoped roles are refused).

ssh_key_credential_id

string<uuid>

required

region

string

required

Region slug, validated against ec2:DescribeRegions.

vpc_id

string

required

node_subnet_ids

string[]

required

Private subnets the nodes spread across; one or more, their zones become the cluster's zone pool.

Minimum array length: 1

bastion_subnet_id

string

required

A public subnet (internet-gateway default route) for the bastion.

bastion_allowed_ips

string[]

required

IPv4 CIDRs allowed to SSH to the bastion; 0.0.0.0/0 and ::/0 are refused.

Minimum array length: 1

description

string | null

egress_mode

enum<string> | null

Omitted: resolved by preflight. existing keeps the subnets' NAT routing; bastion_nat makes the bastion the NAT instance behind one Ankra-owned route table and is refused when a node subnet carries instances Ankra did not create.

Available options:

existing,

bastion_nat

bastion_instance_type

string

default:t3.small

control_plane_count

integer

default:1

At least 3 when the node subnets span more than one availability zone.

Required range: 1 <= x <= 9

control_plane_type

string

default:t3.medium

worker_count

integer

default:1

Required range: 0 <= x <= 100

worker_type

string

default:t3.medium

node_groups

object[] | null

Show child attributes

distribution

enum<string>

default:kubeadm

Available options:

k3s,

kubeadm

kubernetes_version

string | null

etcd_topology

enum<string>

default:stacked

Available options:

stacked,

external

etcd_node_count

integer

default:3

etcd_type

string

default:t3.medium

cni

enum<string>

default:cilium

Defaults to cilium for both distributions: the AWS stack's IMDS guard is a network policy only Cilium and Calico enforce. flannel is accepted with a preflight warning; kubeadm requires cilium.

Available options:

flannel,

calico,

cilium

cni_features

object

Show child attributes

k3s_disabled_components

string[] | null

ubuntu_series

string

default:24.04

architecture

enum<string>

default:amd64

arm64 is refused with a 422 naming the pending image-catalogue audit (ADR 0015 §6).

Available options:

amd64

root_volume_gib

integer

default:40

Encrypted gp3 root volume of every instance.

Required range: 20 <= x <= 2000

gitops_credential_name

string

gitops_repository

string

gitops_branch

string

default:master

include_networking

boolean

default:true

include_dns

boolean

default:true

retention_policy

enum<string>

default:retain

Available options:

delete,

retain

external_cloud_provider

boolean

default:true

Must be true when present: the AWS cloud-controller-manager is mandatory.

environment

string | null

criticality

string | null

Response

Successful response

items

object[]

required

Show child attributes

can_proceed

boolean

required

resolved_egress_mode

enum<string> | null

required

Available options:

existing,

bastion_nat

API reference

Endpoints

Preflight an AWS EC2 cluster create

Authorizations

Headers

Body

Response