DigitalOcean Clusters

​

Before you start

• A DigitalOcean personal access token with read and write scope, stored as a DigitalOcean credential. Tokens start with dop_v1_.
• An SSH key credential - your own public key, or one Ankra generates. See SSH Key Credentials.
• Room in your account limits for the Droplets, a VPC, load balancers and volumes. Check them in the DigitalOcean Control Panel; DigitalOcean support raises them.

​

Create the cluster

ankra credentials digitalocean create --name my-do-token   # prompts for the token
ankra credentials digitalocean ssh-key create --name my-ssh-key --generate

# What your credential can deploy
ankra cluster digitalocean regions --credential-id <digitalocean-credential-id>
ankra cluster digitalocean sizes --credential-id <digitalocean-credential-id> --region nyc3 --available-only

ankra cluster digitalocean create \
  --name my-cluster \
  --credential-id <digitalocean-credential-id> \
  --ssh-key-credential-id <ssh-key-credential-id> \
  --region nyc3 \
  --control-plane-count 1 \
  --control-plane-size s-2vcpu-4gb \
  --worker-count 2 \
  --worker-size s-2vcpu-4gb

curl -X POST https://platform.ankra.app/api/v1/clusters/digitalocean \
  -H "Authorization: Bearer $ANKRA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "my-cluster",
    "credential_id": "<digitalocean-credential-id>",
    "ssh_key_credential_id": "<ssh-key-credential-id>",
    "region": "nyc3",
    "control_plane_count": 1,
    "control_plane_size": "s-2vcpu-4gb",
    "node_groups": [
      {"name": "default", "instance_type": "s-2vcpu-4gb", "count": 2}
    ],
    "include_networking": true,
    "include_dns": true
  }'

​

Verify

1. The cluster moves from Provisioning to Online in the clusters list once the Ankra Agent has connected.
2. Point kubectl at it through Ankra (this needs a Cluster Access grant) and check the nodes:
   ankra cluster kubeconfig add my-cluster --use
   kubectl get nodes
   
   Every control plane and worker should be Ready. See Accessing Clusters with kubectl.

​

What Ankra created in your account

• A VPC for all traffic between the Droplets.
• A VPC NAT gateway, set as the VPC’s default route - the egress path for the nodes. DigitalOcean bills it separately; see VPC NAT gateway pricing.
• A bastion Droplet - the only Droplet with a public IP and the only SSH entry point. It carries no workload or egress traffic.
• Control plane and worker Droplets with private IPs only, and dedicated etcd Droplets for a kubeadm cluster with external etcd.
• Two tag-scoped cloud firewalls, kept as defence in depth.
• The digitalocean-cloud-provider stack: the DigitalOcean cloud controller manager (load balancers for LoadBalancer Services) and CSI driver (block storage through the do-block-storage StorageClass), using your credential.

​

DigitalOcean specifics

• Clusters created before private-Droplet support keep their original layout: every Droplet has a public IP and the tag-scoped cloud firewalls are the ingress boundary. Public networking is fixed when a Droplet is created, so those clusters - including nodes added when you scale them - stay on that model. Only new clusters get private nodes and a NAT gateway.
• Resizing a node group powers each Droplet off, resizes it and powers it on again, with brief downtime for its workloads. Droplet sizes only grow; for smaller nodes, create a new group and delete the old one.
• A stop deletes the node Droplets, the bastion and the VPC NAT gateway, and keeps the cluster’s configuration, network definition and SSH keys. The block storage volumes the CSI driver created are kept and keep billing while the cluster is stopped.
• Terminating deletes the Droplets, NAT gateway, VPC and SSH keys. Anything left over from an earlier teardown can be removed in the DigitalOcean Control Panel.

​

Operate it

• Node groups and legacy worker scaling
• Control plane
• Restart a node and the bastion
• SSH access and keys
• Upgrade Kubernetes
• Stop and start
• Terminate a cluster

​

Troubleshooting