Managed Kubernetes

​

Cloud Managed or Ankra Managed

​

Prerequisites

• DOKS - DigitalOcean API token with read/write
• UKS - UpCloud API credential
• GKE - GCP service account key with the Kubernetes Engine Admin (roles/container.admin) and Service Account User (roles/iam.serviceAccountUser) roles, and the Kubernetes Engine API enabled
• OVH MKS - OVHcloud application keys with a Public Cloud project (project_id)
• AKS - Azure service principal with Contributor on the target subscription
• EKS - AWS credential with permissions for EKS, EC2, and IAM role management
• Kapsule - Scaleway API key with the Kapsule permission sets
• Ankra Cloud Kubernetes - Ankra Cloud API token

​

Live options and pricing

curl "https://platform.ankra.app/org/clusters/managed/eks/options?credential_id=<aws-credential-id>" \
  -H "Authorization: Bearer $ANKRA_API_TOKEN"

​

Creating a managed cluster

​

Via the Platform UI

​

Via the CLI

ankra cluster managed create \
  --provider doks \
  --name my-doks-cluster \
  --credential-id <do-credential-id> \
  --location fra1 \
  --node-pool-name workers \
  --node-pool-size s-2vcpu-4gb \
  --node-pool-count 2

​

Via the API

curl -X POST https://platform.ankra.app/org/clusters/managed/aks \
  -H "Authorization: Bearer $ANKRA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "my-aks-cluster",
    "credential_id": "<azure-credential-id>",
    "location": "westeurope",
    "kubernetes_version": "1.32.3",
    "node_pools": [
      {
        "name": "workers",
        "size": "Standard_D2s_v5",
        "count": 2,
        "autoscaling": {"enabled": true, "min_count": 2, "max_count": 5}
      }
    ],
    "aks": {"network_plugin": "azure", "sku_tier": "Standard"}
  }'

​

Provider-specific options

​

Importing existing clusters

# list clusters at the provider for a credential
ankra cluster managed discover --provider eks --credential-id <aws-credential-id>

# adopt one into Ankra
ankra cluster managed import --provider eks --credential-id <aws-credential-id> \
  --provider-cluster-id <provider-cluster-id> --name imported-prod

# list clusters at the provider for a credential
curl "https://platform.ankra.app/api/v1/clusters/managed/eks/discover?credential_id=<aws-credential-id>" \
  -H "Authorization: Bearer $ANKRA_API_TOKEN"

# adopt one into Ankra
curl -X POST https://platform.ankra.app/api/v1/clusters/managed/eks/import \
  -H "Authorization: Bearer $ANKRA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "credential_id": "<aws-credential-id>",
    "provider_cluster_id": "<provider-cluster-id>",
    "name": "imported-prod"
  }'

​

Scaleway Kapsule (Closed Beta)

• A Scaleway credential whose IAM application carries the Kapsule permission sets.
• An existing Private Network in the same Project and region. Kapsule clusters always attach to one, and Ankra refuses a network that belongs to an Ankra Managed cluster’s own infrastructure (tagged ankra-cluster-<id>), because it is deleted with that cluster.
• For pools without public IPs (public_ip: false), a Public Gateway attached to that Private Network with masquerade on and the default route pushed. Ankra does not create it; preflight checks for it.

ankra cluster managed create \
  --provider kapsule \
  --name my-kapsule \
  --credential-id <scaleway-credential-id> \
  --location fr-par \
  --private-network-id <private-network-id> \
  --node-pool-size <instance-type> \
  --node-pool-count 2

curl -X POST https://platform.ankra.app/api/v1/clusters/managed/kapsule \
  -H "Authorization: Bearer $ANKRA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "my-kapsule",
    "credential_id": "<scaleway-credential-id>",
    "location": "fr-par",
    "cni": "cilium",
    "node_pools": [
      {"name": "default", "size": "<instance-type>", "count": 2, "zone": "fr-par-1",
       "root_volume_type": "sbs_5k", "public_ip": false, "autohealing": true}
    ],
    "kapsule": {"private_network_id": "<private-network-id>", "private_endpoint": false}
  }'

• CNI is one of the available_cnis the chosen Kubernetes version offers (cilium, cilium_native or calico) and cannot be changed later.
• Pools take zone, root_volume_type (l_ssd, b_ssd, sbs_5k, sbs_15k), root_volume_size_gb, security_group_id, public_ip, autohealing and upgrade_policy (surge, unavailable, balanced). Autoscaling needs a minimum of at least 1.
• Private API endpoints are refused; leave private_endpoint false or out.
• Stop and start are not offered for Kapsule.

​

Day-2 operations

​

Node pools

# add a pool
ankra cluster managed node-pool add <cluster_id> --provider doks --name pool-b --size s-4vcpu-8gb --count 2

# scale a pool
ankra cluster managed node-pool scale <cluster_id> workers --provider doks --count 5

# delete a pool
ankra cluster managed node-pool delete <cluster_id> pool-b --provider doks

# update count and/or autoscaling bounds
curl -X PATCH https://platform.ankra.app/org/clusters/managed/doks/<cluster_id>/node-pools/workers \
  -H "Authorization: Bearer $ANKRA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"autoscaling_enabled": true, "autoscaling_min": 2, "autoscaling_max": 10}'

​

Externally managed node pools

curl -X PATCH https://platform.ankra.app/org/clusters/managed/uks/<cluster_id>/node-pools/autoscaled \
  -H "Authorization: Bearer $ANKRA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"externally_managed": true}'

• Scale, a count update, delete and size replacement on that pool are refused with Node pool is externally managed; clear externally_managed before changing it through Ankra. This covers the portal, the CLI, the API and Ankra AI, which has no way to clear the flag itself.
• The pool listing returns externally_managed: true and an observed_count read live from the provider. count stays the last value Ankra wrote, and Ankra never copies the observed count over it.

​

Kubernetes upgrades

ankra cluster managed upgrade <cluster_id> --provider doks --version 1.33.0

​

Stopping and starting

ankra cluster managed stop <cluster_id> --provider aks
ankra cluster managed start <cluster_id> --provider aks

​

Deleting

ankra cluster managed delete <cluster_id> --provider doks

​

What does not apply to managed clusters

• Stop / start - capability-gated and currently available only for AKS, as described above.
• Control-plane topology editing (controller count, control-plane instance type) - the provider sizes and manages the control plane. HA control planes, where offered, are selected at creation.
• Instance-type upgrade in place - change node sizing by editing or replacing a node pool, not by resizing individual nodes.

​

Ankra AI

• “What does a 3-node e2-standard-4 GKE cluster in europe-west1 cost?” - it fetches live options and pricing with your credential
• “Create an AKS cluster in West Europe with autoscaling 2 to 5 nodes” - it proposes the create for your confirmation
• “What EKS clusters exist in our AWS account?” - it discovers clusters at the provider and shows which are already imported
• “Import the staging GKE cluster” - it adopts a discovered cluster after you confirm
• “Stop the development AKS cluster” - it proposes the capability-gated stop operation for your confirmation

​

Troubleshooting