> ## Documentation Index > Fetch the complete documentation index at: https://docs.ankra.ai/llms.txt > Use this file to discover all available pages before exploring further. # Preflight an AWS EC2 cluster create > Bearer PAT authentication; RBAC permission `clusters.create`. Runs every check the create runs against AWS without creating anything. Each item is three-state: `ok`, `warning` (a read Ankra could not perform, or a caveat such as flannel not enforcing the IMDS guard), or `error`. `resolved_egress_mode` is the mode the create will run under, null when it could not be decided. Answers 404 while the organisation's `aws_provider` feature flag is off. ## OpenAPI ````yaml https://platform.ankra.app/openapi.json post /api/v1/clusters/aws/preflight openapi: 3.1.0 info: title: FastAPI version: 0.1.0 servers: - url: https://platform.ankra.app security: [] tags: - name: Clusters description: Create, inspect and manage clusters, and the stacks deployed on them. - name: Managed Clusters description: Provider-managed control planes, driven through one common surface. - name: Imported Clusters description: Clusters that already existed and were connected to Ankra. - name: Cluster Access description: Kubeconfigs, service-account tokens and per-cluster access grants. - name: Kubernetes description: Read and act on the Kubernetes objects inside a cluster. - name: AWS Clusters description: >- Provision and manage self-managed k3s / kubeadm clusters on AWS EC2 in your own VPC. - name: DigitalOcean Clusters description: Provision and manage DigitalOcean Kubernetes clusters. - name: Hetzner Clusters description: Provision and manage Hetzner Kubernetes clusters. - name: OVH Clusters description: Provision and manage OVH Kubernetes clusters. - name: Scaleway Clusters description: Provision and manage Scaleway Kapsule clusters. - name: UpCloud Clusters description: Provision and manage UpCloud Kubernetes clusters. - name: Applications description: Deploy, configure and observe applications across the fleet. - name: Stack Profiles description: Reusable stack definitions, their versions and sharing. - name: Charts description: Browse the chart catalogue behind stacks and addons. - name: Helm description: Helm registries, credentials and the charts they expose. - name: Executions description: Long-running platform executions and their jobs. - name: Operations description: Cancel in-flight cluster operations and their jobs. - name: Chat description: Conversational sessions, plans and confirmable actions. - name: AI Agent Runs description: Autonomous agent runs and their outcomes. - name: AI Tickets description: The AI ticket board, its sync connections and settings. - name: AI Playbooks description: Reusable playbooks the AI lanes execute. - name: AI Conditions description: Conditions that gate AI autonomy. - name: AI Engineering Handoffs description: Work the AI lanes escalate to a human engineer. - name: AI Environment description: The environment and base stacks AI demos deploy into. - name: Security description: Findings, advisories, SBOMs, compliance and posture. - name: Cost description: Cluster and fleet cost, rate cards and cost settings. - name: Billing description: Subscription and spend caps. - name: Organisation description: Members, invitations, audit logs and organisation settings. - name: Account Tokens description: Personal access tokens for the API and CLI. - name: Credentials description: The shared credential store. - name: AWS Credentials description: >- AWS credentials: access keys or CloudFormation-onboarded STS roles for cost, EKS and self-managed provisioning. - name: Azure Credentials description: Azure credentials and SSH keys. - name: DigitalOcean Credentials description: DigitalOcean credentials and SSH keys. - name: Hetzner Credentials description: Hetzner credentials and SSH keys. - name: OVH Credentials description: OVH credentials and SSH keys. - name: Scaleway Credentials description: Scaleway credentials. - name: UpCloud Credentials description: UpCloud credentials and SSH keys. - name: Data Source Credentials description: Credentials for metrics and log sources. - name: DNS Credentials description: Credentials for DNS providers. - name: DNS description: DNS zones and records, including custom organisation zones. - name: Cloudflare description: Cloudflare domains and the credentials behind them. - name: Variables description: Organisation- and cluster-scoped variables. - name: SOPS description: Encrypt and decrypt values with the organisation SOPS config. - name: Alerts description: Alert integrations and ingest credentials. - name: Notifications description: Notification routes and their delivery targets. - name: Support description: Support tickets. - name: AI Settings description: Organisation AI provider, model catalog and per-function model settings paths: /api/v1/clusters/aws/preflight: post: tags: - AWS Clusters summary: Preflight an AWS EC2 cluster create description: >- Bearer PAT authentication; RBAC permission `clusters.create`. Runs every check the create runs against AWS without creating anything. Each item is three-state: `ok`, `warning` (a read Ankra could not perform, or a caveat such as flannel not enforcing the IMDS guard), or `error`. `resolved_egress_mode` is the mode the create will run under, null when it could not be decided. Answers 404 while the organisation's `aws_provider` feature flag is off. operationId: preflight_aws_cluster_pat parameters: - description: PAT organisation override. in: header name: x-ankra-organisation-id required: false schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/CreateAwsClusterRequest' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/AwsPreflightResult' description: Successful response '201': content: application/json: schema: $ref: '#/components/schemas/AwsCreateClusterResponse' description: Successful response '400': content: application/json: schema: $ref: '#/components/schemas/ContractDetailError' description: Invalid request '401': content: application/json: schema: $ref: '#/components/schemas/ContractDetailError' description: Unauthenticated '403': content: application/json: schema: $ref: '#/components/schemas/ContractDetailError' description: Permission or CSRF check failed '404': content: application/json: schema: $ref: '#/components/schemas/ContractDetailError' description: Resource not found '409': content: application/json: schema: $ref: '#/components/schemas/ContractDetailError' description: Conflicting or unsafe lifecycle state '422': content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' description: Request validation failed '500': content: application/json: schema: $ref: '#/components/schemas/ContractDetailError' description: Provider or internal failure security: - BearerAuth: [] components: schemas: CreateAwsClusterRequest: description: >- POST /clusters/aws body. Nodes never receive a public IP; the bastion holds the elastic IP and is the SSH hop (and the NAT instance in bastion_nat mode). properties: name: type: string description: anyOf: - type: string - type: 'null' credential_id: type: string format: uuid description: >- An organisation aws credential: a keys credential, or a role onboarded with scope provisioning or self_managed (cost-scoped roles are refused). ssh_key_credential_id: format: uuid type: string region: type: string description: Region slug, validated against ec2:DescribeRegions. vpc_id: type: string node_subnet_ids: type: array items: type: string minItems: 1 description: >- Private subnets the nodes spread across; one or more, their zones become the cluster's zone pool. bastion_subnet_id: type: string description: A public subnet (internet-gateway default route) for the bastion. egress_mode: anyOf: - type: string enum: - existing - bastion_nat description: >- Omitted: resolved by preflight. existing keeps the subnets' NAT routing; bastion_nat makes the bastion the NAT instance behind one Ankra-owned route table and is refused when a node subnet carries instances Ankra did not create. - type: 'null' bastion_instance_type: type: string default: t3.small bastion_allowed_ips: type: array items: type: string minItems: 1 description: >- IPv4 CIDRs allowed to SSH to the bastion; 0.0.0.0/0 and ::/0 are refused. control_plane_count: type: integer default: 1 minimum: 1 maximum: 9 description: >- At least 3 when the node subnets span more than one availability zone. control_plane_type: type: string default: t3.medium worker_count: default: 1 maximum: 100 minimum: 0 type: integer worker_type: type: string default: t3.medium node_groups: anyOf: - type: array items: $ref: '#/components/schemas/AwsCreateNodeGroupRequest' - type: 'null' distribution: type: string enum: - k3s - kubeadm default: kubeadm kubernetes_version: anyOf: - type: string - type: 'null' etcd_topology: type: string enum: - stacked - external default: stacked etcd_node_count: type: integer default: 3 etcd_type: type: string default: t3.medium cni: type: string enum: - flannel - calico - cilium default: cilium description: >- Defaults to cilium for both distributions: the AWS stack's IMDS guard is a network policy only Cilium and Calico enforce. flannel is accepted with a preflight warning; kubeadm requires cilium. cni_features: $ref: '#/components/schemas/AwsCNIFeatures' k3s_disabled_components: anyOf: - items: type: string type: array - type: 'null' ubuntu_series: type: string default: '24.04' architecture: type: string enum: - amd64 default: amd64 description: >- arm64 is refused with a 422 naming the pending image-catalogue audit (ADR 0015 ยง6). root_volume_gib: type: integer default: 40 minimum: 20 maximum: 2000 description: Encrypted gp3 root volume of every instance. gitops_credential_name: type: string gitops_repository: type: string gitops_branch: type: string default: master include_networking: type: boolean default: true include_dns: type: boolean default: true retention_policy: type: string enum: - delete - retain default: retain external_cloud_provider: type: boolean default: true description: >- Must be true when present: the AWS cloud-controller-manager is mandatory. environment: anyOf: - type: string - type: 'null' criticality: anyOf: - type: string - type: 'null' required: - name - credential_id - ssh_key_credential_id - region - vpc_id - node_subnet_ids - bastion_subnet_id - bastion_allowed_ips type: object AwsPreflightResult: properties: items: type: array items: $ref: '#/components/schemas/AwsPreflightItem' can_proceed: type: boolean resolved_egress_mode: anyOf: - type: string enum: - existing - bastion_nat - type: 'null' required: - items - can_proceed - resolved_egress_mode type: object AwsCreateClusterResponse: example: cluster_id: 11111111-2222-4333-8444-555555555555 name: aws-prod kind: aws state: creating operation_id: null properties: cluster_id: format: uuid type: string name: type: string kind: type: string const: aws state: type: string operation_id: anyOf: - format: uuid type: string - type: 'null' required: - cluster_id - name - kind - state - operation_id type: object ContractDetailError: example: detail: Cluster not found properties: detail: oneOf: - type: string - additionalProperties: true properties: {} type: object required: - detail type: object HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' title: Detail type: array title: HTTPValidationError type: object AwsCreateNodeGroupRequest: properties: autoscaling: anyOf: - properties: enabled: type: boolean max_count: type: integer min_count: type: integer required: - enabled - min_count - max_count type: object - type: 'null' count: default: 1 maximum: 100 minimum: 0 type: integer instance_type: type: string labels: additionalProperties: type: string type: object name: type: string taints: items: $ref: '#/components/schemas/AwsNodeTaint' type: array availability_zone: anyOf: - type: string description: >- Pins every node of the group to one of the node subnets' zones; omitted spreads the group. - type: 'null' required: - name - instance_type type: object AwsCNIFeatures: properties: ebpf_dataplane: default: false type: boolean hubble: default: false type: boolean kube_proxy_replacement: default: false type: boolean wireguard_encryption: default: false type: boolean type: object AwsPreflightItem: properties: check: type: string status: type: string enum: - ok - warning - error message: type: string required: - check - status - message type: object ValidationError: properties: loc: items: anyOf: - type: string - type: integer title: Location type: array msg: title: Message type: string type: title: Error Type type: string required: - loc - msg - type title: ValidationError type: object AwsNodeTaint: properties: effect: enum: - NoSchedule - PreferNoSchedule - NoExecute type: string key: type: string value: default: '' type: string required: - key - effect type: object securitySchemes: BearerAuth: bearerFormat: PAT scheme: bearer type: http ````