> ## Documentation Index > Fetch the complete documentation index at: https://docs.ankra.ai/llms.txt > Use this file to discover all available pages before exploring further. # Create a Proxmox VE cluster > Creates a self-managed kubeadm or k3s cluster on Proxmox VE VMs from the request and starts provisioning it in the background, answering 201 with the new cluster's `cluster_id` and `name`. The VMs are cloned on the chosen node (or spread across placement_nodes) and attached to the chosen bridge. An option the provider does not support (such as external_cloud_provider) or a configuration that fails validation answers 400 with the reason, a full network identity pool answers 409, and an organisation whose billing is restricted is refused with 402. Requires `clusters.create`. ## OpenAPI ````yaml https://platform.ankra.app/openapi.json post /api/v1/clusters/proxmox openapi: 3.1.0 info: title: Ankra Platform API version: v1 description: >- The Ankra platform HTTP contract. The /api/v1 surface is the public, bearer-authenticated API used by the Ankra CLI, MCP clients and automation; send a personal or service API token as `Authorization: Bearer `. Browser routes under /org and /chat are served on api.platform.ankra.app (each declares that server); they and /oauth/access authenticate with the ankra_session cookie, and mutations also require the X-Ankra-CSRF header. Every operation declares the credential it accepts, and no operation is served without one. This document is published deliberately: it describes the contract only and carries no organisation data or credentials. Report security issues to security@ankra.ai (see /.well-known/security.txt). servers: - url: https://platform.ankra.app security: - BearerAuth: [] tags: - name: Onboarding description: >- Generate a first website from a prompt and deploy it to a new organisation's cluster. - name: Access Gate description: >- Private service sign-in and membership checks for trusted Ankra proxy relays. - name: Canvas Datasets description: >- Read the fixed, named datasets canvas dashboards bind their charts, tables and stats to. - name: Canvases description: >- Keep dashboards and pages in the organisation's canvas library, with revision history, undo and pins. - name: Canvas Pages description: >- Publish a chat canvas artifact at a public pages address and take it down again. - name: Cloud Delegation description: >- Platform browser consent and organisation-bound connections for Ankra Cloud. - name: Organisation IAM description: >- Custom organisation roles and scoped role assignments for member and service-account identities. - name: Clusters description: Create, inspect and manage clusters, and the stacks deployed on them. - name: Managed Clusters description: Provider-managed control planes, driven through one common surface. - name: Playground description: >- The organisation's playground cluster: order one, read its provisioning status, list the orderable sizes, resize it and destroy it. - name: Imported Clusters description: Clusters that already existed and were connected to Ankra. - name: Cluster Access description: Kubeconfigs, service-account tokens and per-cluster access grants. - name: Cluster Meshes description: >- Cilium ClusterMeshes that join an organisation's clusters into one network: create a mesh, check whether clusters can join, prepare a running cluster, and add or remove members. - name: Kubernetes description: Read and act on the Kubernetes objects inside a cluster. - name: AWS Clusters description: >- Provision and manage self-managed k3s / kubeadm clusters on AWS EC2 in your own VPC. - name: Ankra Cloud Clusters description: >- Provision and manage self-managed kubeadm / k3s clusters on Ankra Cloud servers: a private network, a NAT router and a bastion per cluster. - name: DigitalOcean Clusters description: Provision and manage DigitalOcean Kubernetes clusters. - name: Hetzner Clusters description: Provision and manage Hetzner Kubernetes clusters. - name: OVH Clusters description: Provision and manage OVH Kubernetes clusters. - name: Scaleway Clusters description: Provision and manage Scaleway Kapsule clusters. - name: UpCloud Clusters description: Provision and manage UpCloud Kubernetes clusters. - name: Proxmox Clusters description: >- Self-managed Kubernetes clusters Ankra builds on Proxmox VE VMs: the node, storage, bridge, template and size catalogs, create and teardown, start and stop, node groups, nodes, standalone VMs, upgrades and the bastion. - name: HPE Morpheus Clusters description: >- Self-managed Kubernetes clusters Ankra builds on HPE Morpheus VMs: the group, cloud, plan, layout and network catalogs, create and teardown, start and stop, node groups, nodes, standalone VMs, upgrades and the bastion. - name: Applications description: Deploy, configure and observe applications across the fleet. - name: Pipelines description: >- Pipeline definitions, the approval of the authority they declare, and the caches pipelines keep between runs. - name: Workspaces description: >- Personal workspaces on the organisation's CI pool where a repository's heavy commands run, and the repository profiles they are built from. - name: Deploy Targets description: >- Environments, the hosts registered to receive deployments, and the releases deployed to them. - name: Deploy Provenance description: >- Whether an application's deploys verify signed provenance from the organisation's own pipeline, the keys that provenance is signed with, and a dry-run that verifies images without deploying. - name: Backups description: >- Backup vaults, restore points, protection posture and captures for stacks and application deployments; a completed capture is not a verified restore. - name: Stack Profiles description: Reusable stack definitions, their versions and sharing. - name: Services description: >- Versioned service packages and explicit sharing. Runtime admission is separate from publication. - name: Charts description: Browse the chart catalogue behind stacks and addons. - name: Helm description: Helm registries, credentials and the charts they expose. - name: Executions description: Long-running platform executions and their jobs. - name: Operations description: Cancel in-flight cluster operations and their jobs. - name: Chat description: Conversational sessions, plans and confirmable actions. - name: AI Management description: >- Customer agent lifecycle, authenticated identity and organisation automation controls. - name: AI Agent Runs description: Autonomous agent runs and their outcomes. - name: AI Tickets description: The AI ticket board, its sync connections and settings. - name: AI Playbooks description: Reusable playbooks the AI lanes execute. - name: AI Conditions description: Conditions that gate AI autonomy. - name: AI Remediation description: >- The organisation's auto-remediation policy: what the AI lanes may fix by themselves, and who approves the rest. - name: AI Engineering Handoffs description: Work the AI lanes escalate to a human engineer. - name: AI Environment description: The environment and base stacks AI demos deploy into. - name: AI Memory description: >- What the assistant has learned about you: your cross-session memories and learned profile. - name: MCP Servers description: >- Register the MCP servers the organisation's AI agents can call, choose their tools and grant them to roles. - name: Security description: Findings, advisories, SBOMs, compliance and posture. - name: Cost description: Cluster and fleet cost, rate cards and cost settings. - name: Decisions description: >- The decision ledger behind the Security and Cost queues: proposals a surface computed, the approve and set-aside decisions people took on them, and the receipts of running them. - name: Usage description: >- What your organisation used of Ankra - vCPU-hours, playgrounds, managed services, hosted logs and metrics, and AI - per meter and period, with how completely it was measured and whether a published rate applies. - name: Billing description: Subscription and spend caps. - name: Organisation description: Members, invitations, audit logs and organisation settings. - name: Projects description: >- Projects group an organisation's clusters, applications, credentials and other resources beneath it: list, create, rename and delete them, switch the current project, see who reaches one, and move resources between them. - name: Account description: >- Your own account: the contact email Ankra mails when it differs from your sign-in address, and the AI provider keys your own work runs on. - name: Account Tokens description: Personal access tokens for the API and CLI. - name: Credentials description: The shared credential store. - name: AWS Credentials description: >- AWS credentials: access keys or CloudFormation-onboarded STS roles for cost, EKS and self-managed provisioning. - name: Ankra Cloud Credentials description: >- Ankra Cloud API tokens, shared by the self-managed and managed Ankra Cloud lanes. - name: Azure Credentials description: Azure credentials and SSH keys. - name: DigitalOcean Credentials description: DigitalOcean credentials and SSH keys. - name: Hetzner Credentials description: Hetzner credentials and SSH keys. - name: HPE Morpheus Credentials description: HPE Morpheus credentials and the capacity and quotas behind them. - name: OVH Credentials description: OVH credentials and SSH keys. - name: Proxmox Credentials description: Proxmox VE credentials and the capacity and quotas behind them. - name: Scaleway Credentials description: Scaleway credentials. - name: UpCloud Credentials description: UpCloud credentials and SSH keys. - name: Data Source Credentials description: Credentials for metrics and log sources. - name: DNS Credentials description: Credentials for DNS providers. - name: Object Storage Buckets description: >- Buckets Ankra creates and manages on an organisation's own provider credentials. - name: DNS description: DNS zones and records, including custom organisation zones. - name: Cloudflare description: Cloudflare domains and the credentials behind them. - name: Avura description: >- The linked Avura organization, the domains it shares with Ankra Platform, and their DNS records. - name: Variables description: Organisation- and cluster-scoped variables. - name: Secret Slots description: >- Store secrets in Vault and reference them by ${SECRET_SLOT:} sentinel instead of by value. - name: SOPS description: Encrypt and decrypt values with the organisation SOPS config. - name: Alerts description: Alert integrations and ingest credentials. - name: Notifications description: Notification routes and their delivery targets. - name: Support description: Support tickets. - name: AI Settings description: Organisation AI provider, model catalog and per-function model settings paths: /api/v1/clusters/proxmox: post: tags: - Proxmox Clusters summary: Create a Proxmox VE cluster description: >- Creates a self-managed kubeadm or k3s cluster on Proxmox VE VMs from the request and starts provisioning it in the background, answering 201 with the new cluster's `cluster_id` and `name`. The VMs are cloned on the chosen node (or spread across placement_nodes) and attached to the chosen bridge. An option the provider does not support (such as external_cloud_provider) or a configuration that fails validation answers 400 with the reason, a full network identity pool answers 409, and an organisation whose billing is restricted is refused with 402. Requires `clusters.create`. operationId: create_proxmox_cluster parameters: [] requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/ProxmoxCreateClusterRequest' responses: '201': description: Cluster created; provisioning runs in the background content: application/json: schema: $ref: '#/components/schemas/ProxmoxCreateClusterResponse' '400': description: Invalid configuration or unsupported option content: application/json: schema: $ref: '#/components/schemas/ContractDetailError' '401': content: application/json: schema: $ref: '#/components/schemas/ContractDetailError' description: Unauthenticated '402': description: Billing restricted content: application/json: schema: $ref: '#/components/schemas/ContractDetailError' '403': content: application/json: schema: $ref: '#/components/schemas/ContractDetailError' description: Permission or CSRF check failed '409': description: >- Network identity pool exhausted, or more nodes than the pod range addresses content: application/json: schema: $ref: '#/components/schemas/ContractDetailError' '422': content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' description: Request validation failed '500': content: application/json: schema: $ref: '#/components/schemas/ContractDetailError' description: Provider or internal failure security: - BearerAuth: [] components: schemas: ProxmoxCreateClusterRequest: type: object description: Create a self-managed Kubernetes cluster on Proxmox VE VMs. properties: name: minLength: 1 type: string description: anyOf: - type: string - type: 'null' credential_id: type: string format: uuid ssh_key_credential_id: type: string format: uuid description: The SSH key credential authorised on the cluster's VMs. node: type: string minLength: 1 description: >- The Proxmox VE node the bastion (and, without placement_nodes, every VM) runs on. See the nodes catalog. placement_nodes: type: array items: minLength: 1 type: string description: >- Two or more unique Proxmox VE nodes to spread the Kubernetes VMs across. Omit to keep every VM on node. bridge: type: string minLength: 1 description: The bridge or SDN vnet the VMs attach to. See the bridges catalog. storage: type: string minLength: 1 default: local-lvm description: The storage the VM disks are created on. See the storages catalog. template: type: string description: >- The template (VMID or name) to clone the VMs from. Omit to use Ankra's own template on the node. bastion_instance_type: type: string minLength: 1 default: px-small description: A size preset from the sizes catalog. control_plane_count: default: 1 maximum: 5 minimum: 1 type: integer control_plane_instance_type: type: string minLength: 1 default: px-medium description: A size preset from the sizes catalog. worker_count: default: 1 maximum: 50 minimum: 0 type: integer worker_instance_type: type: string minLength: 1 default: px-medium description: A size preset from the sizes catalog. distribution: default: kubeadm type: string kubernetes_version: anyOf: - type: string - type: 'null' description: >- Version for the chosen distribution (kubeadm unless distribution says k3s). kubeadm takes a plain upstream tag such as v1.36.4; k3s takes a k3s build such as v1.35.7+k3s1, and a bare patch resolves to its newest +k3sN build. A +k3sN build with distribution kubeadm is refused. Omit to install the version catalogue's stable version for the distribution. etcd_topology: default: stacked type: string etcd_node_count: type: integer default: 3 etcd_instance_type: type: string default: px-medium description: >- Size preset of the external etcd nodes; used with etcd_topology external. cni: description: >- Container network. Omitted resolves to cilium on kubeadm (the default distribution) and flannel on k3s. enum: - flannel - calico - cilium type: string network_mode: type: string enum: - private_network - wireguard_mesh description: >- private_network (the default when omitted) keeps the nodes on the SDN alone; wireguard_mesh puts them on the platform WireGuard overlay behind the bastion site gateway (kubeadm only, needs site_public_ip). site_public_ip: type: string description: >- The address other sites dial this cluster's bastion on for the overlay. Required with network_mode wireguard_mesh. node_groups: type: - array - 'null' items: $ref: '#/components/schemas/CreateNodeGroupRequest' description: >- Worker node groups, sized by size preset. Replaces worker_count and worker_instance_type when given. k3s_disabled_components: anyOf: - items: enum: - coredns - servicelb - traefik - local-storage - metrics-server - runtimes type: string type: array - type: 'null' description: >- k3s packaged components to keep disabled (k3s --disable), for example ["traefik"] on a cluster that brings its own ingress. k3s distribution only: the list is rendered into the server config at install and re-asserted by the maintenance pass, so the entries stay off across restarts. external_cloud_provider: type: boolean default: false description: >- Accepted only to be refused: the provider has no cloud controller manager, so true answers 400. include_networking: type: boolean default: true include_dns: type: boolean default: true description: >- Opt the cluster into its delegated DNS subzone, which wires external-dns into the networking stack. gateway_api: type: boolean default: false description: >- Install the Kubernetes Gateway API beside Traefik's Ingress: the Gateway API standard CRDs, Traefik's Gateway provider with the traefik GatewayClass and a shared traefik-gateway Gateway in the traefik namespace (a plain HTTP listener that accepts routes from every namespace), cert-manager's Gateway support, and external-dns publishing of HTTPRoute hostnames. Ingress keeps working; one Traefik serves both. Requires include_networking. environment: anyOf: - maxLength: 50 minLength: 1 type: string - type: 'null' criticality: anyOf: - enum: - production - staging - development - disposable type: string - type: 'null' required: - name - credential_id - ssh_key_credential_id - node - bridge ProxmoxCreateClusterResponse: type: object properties: cluster_id: type: string format: uuid name: type: string required: - cluster_id - name ContractDetailError: example: detail: Cluster not found properties: detail: oneOf: - type: string - additionalProperties: true properties: {} type: object required: - detail type: object HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' title: Detail type: array title: HTTPValidationError type: object CreateNodeGroupRequest: properties: count: default: 1 maximum: 50 minimum: 1 title: Count type: integer instance_type: minLength: 1 title: Instance Type type: string labels: additionalProperties: type: string title: Labels type: object name: minLength: 1 title: Name type: string taints: items: $ref: '#/components/schemas/NodeTaint' title: Taints type: array required: - name - instance_type title: CreateNodeGroupRequest type: object ValidationError: properties: loc: items: anyOf: - type: string - type: integer title: Location type: array msg: title: Message type: string type: title: Error Type type: string required: - loc - msg - type title: ValidationError type: object NodeTaint: properties: effect: enum: - NoSchedule - PreferNoSchedule - NoExecute title: Effect type: string key: type: string title: Key value: default: '' title: Value type: string required: - key - effect title: NodeTaint type: object securitySchemes: BearerAuth: bearerFormat: PAT scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.