Morpheus Clusters

Choose HPE Morpheus when your infrastructure is already governed through a Morpheus appliance and a Kubernetes cluster has to be provisioned the same way. Ankra provisions the instances through your appliance, using the groups, clouds, networks, virtual images and service plans you already manage there, installs Kubernetes, and then operates the cluster for you - this is an Ankra Managed cluster.

Closed beta. Morpheus cluster provisioning is in closed beta. The workflow is stable but the surface may still change, and it is enabled per organisation on request. Contact support to have it turned on for your organisation.

Before you start

A Morpheus API credential: the appliance URL and a long-lived API access token. See Morpheus Credentials.
An SSH key credential for instance access - your own public key, or one Ankra generates. See SSH Key Credentials.
In Morpheus: a group and a cloud the token can provision into, a network with DHCP (instances get their addresses from it), an instance layout based on a Linux cloud image (optionally pinned to a virtual image), and service plans to size the bastion, control plane and workers.
API reachability. The Morpheus API must be reachable from Ankra, directly or through an SSH jumphost.

Hybrid connectivity (SSH jumphost)

If Ankra cannot reach the Morpheus appliance and the instance network directly, attach an SSH jumphost (host, port, username and private key) to the Morpheus credential; Ankra then tunnels both the Morpheus API calls and the SSH connections to your nodes through it. If the appliance uses a self-signed certificate, enable TLS insecure (tls_insecure) on the credential. Both are set on the credential - see Morpheus Credentials.

Create the cluster

Dashboard
CLI
API

Open the create dialog

Go to Clusters, click Create cluster and pick Morpheus under Ankra Managed.

Credential

Pick the Morpheus credential and an SSH key, or add either inline.

Placement

Pick the Morpheus Group, Cloud and Network for the instances, and the Layout they are provisioned from. The network must provide DHCP.

Compute

Pick the bastion’s service plan, the control plane count (1 or 3) and service plan, worker node groups, and for kubeadm the etcd topology. The wizard shows each plan’s vCPUs and memory; cost estimates are not available for Morpheus.

Kubernetes

Keep kubeadm (the default, with Cilium) or pick k3s and its CNI, and optionally the version. See Choices fixed at create time.

Review

Name the cluster and set its environment. Two checkboxes are on by default:

Include Networking Stack - Traefik and cert-manager as Ankra-managed stacks. On k3s they run through the built-in service load balancer; unchecked, k3s keeps its bundled Traefik and no certificate manager (a kubeadm cluster gets no ingress controller or certificate manager at all).
Include Public DNS - a delegated subdomain on ankra.cc with external-dns wired, so an ingress hostname under it gets its DNS record and TLS certificate automatically.

Click Create cluster. A progress view follows the SSH keys, bastion, instances, Kubernetes installation and Ankra Agent.

ankra credentials morpheus create --name my-morpheus --api-url https://morpheus.example   # prompts for the access token
ankra credentials morpheus ssh-key create --name my-ssh-key --generate

# The numeric IDs the create needs
ankra cluster morpheus groups --credential-id <morpheus-credential-id>
ankra cluster morpheus clouds --credential-id <morpheus-credential-id>
ankra cluster morpheus networks --credential-id <morpheus-credential-id>
ankra cluster morpheus layouts --credential-id <morpheus-credential-id>
ankra cluster morpheus plans --credential-id <morpheus-credential-id>

ankra cluster morpheus create \
  --name my-cluster \
  --credential-id <morpheus-credential-id> \
  --ssh-key-credential-id <ssh-key-credential-id> \
  --group-id 1 \
  --cloud-id 1 \
  --network-id 2 \
  --layout-id 42 \
  --bastion-plan-id 101 \
  --control-plane-count 1 \
  --control-plane-plan-id 102 \
  --worker-count 2 \
  --worker-plan-id 102

--virtual-image-id, --distribution k3s, --etcd-topology external with --etcd-node-count and --etcd-plan-id, and --include-networking=false cover the other choices. The credential flags --tls-insecure and --jumphost-* set the options from Hybrid connectivity.

curl -X POST https://platform.ankra.app/api/v1/clusters/morpheus \
  -H "Authorization: Bearer $ANKRA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "my-cluster",
    "credential_id": "<morpheus-credential-id>",
    "ssh_key_credential_id": "<ssh-key-credential-id>",
    "group_id": 1,
    "cloud_id": 1,
    "network_id": 2,
    "layout_id": 42,
    "bastion_plan_id": 101,
    "control_plane_count": 1,
    "control_plane_plan_id": 102,
    "worker_plan_id": 102,
    "node_groups": [
      {"name": "default", "plan_id": 102, "count": 2}
    ],
    "include_networking": true,
    "include_dns": true
  }'

Every Morpheus ID is the numeric ID from your appliance. worker_plan_id is required even when node_groups sizes the workers. Every field is in the Morpheus Reference.

Verify

The cluster moves from Provisioning to Online in the clusters list once the Ankra Agent has connected.
Point kubectl at it through Ankra (this needs a Cluster Access grant) and check the nodes:
ankra cluster kubeconfig add my-cluster --use kubectl get nodes
Every control plane and worker should be Ready. See Accessing Clusters with kubectl.

What Ankra created through your appliance

A bastion instance - the only SSH access point Ankra uses to reach the nodes. It carries no workload or egress traffic. With a jumphost on the credential, Ankra reaches both the Morpheus API and the bastion through it.
Control plane and worker instances in the group, cloud and network you picked, booting from the layout’s image, plus dedicated etcd instances for a kubeadm cluster with external etcd.

Ankra creates no network: the instances attach to your existing Morpheus network and get their addresses from its DHCP, and routing and internet egress follow that network’s own gateway. There is no cloud controller manager: LoadBalancer Services are not provisioned, so expose workloads with NodePort Services, an ingress controller, or a load balancer you deploy yourself. The Morpheus Reference has the full layout.

Morpheus specifics

Numeric IDs everywhere. Groups, clouds, networks, layouts, virtual images and service plans are the numeric IDs from your appliance; node groups are sized by a numeric plan_id.
Resizing a node group moves it to a larger service plan: each instance is powered off, resized and powered on again, with brief downtime for its workloads. Plans only grow; for smaller nodes, create a new group and delete the old one.
Restarting a single node is not available for Morpheus clusters. The bastion is resized from the dashboard or the API; ankra cluster morpheus nodes list|get lists and inspects the nodes.
A stop captures the cluster’s etcd state through the credential’s jump host before the instances are deleted. Terminating deletes every instance Ankra created (bastion, control planes, workers and etcd instances) and leaves your Morpheus groups, clouds, networks and virtual images untouched.
No cost estimate in the create wizard. Cloud Cost prices running clusters once you set a rate card on the Morpheus credential; until then they show as not priced.

Operate it

Day-2 tasks work the same way on every Ankra Managed provider, with the CLI name morpheus:

Troubleshooting

Issue	Solution
Morpheus API unreachable from Ankra	Attach an SSH jumphost to the credential - Ankra tunnels API calls and node SSH through it
TLS certificate errors (self-signed)	Enable the TLS insecure toggle (`tls_insecure`) on the Morpheus credential
Instances never get an IP address	The selected network must provide DHCP - Ankra does not manage IP allocation. Verify a DHCP server answers on that network
Cluster stuck in provisioning	Check that the access token can provision into the selected group and cloud, and that the cloud has free capacity
Instance creation fails	Verify the virtual image is a Linux cloud image available to the selected cloud, and the service plan is valid for it
LoadBalancer service stuck in `Pending`	Morpheus clusters have no cloud controller manager - use `NodePort`, ingress, or your own load balancer
No cost estimate in the wizard, or cluster not priced in Cloud Cost	Expected in the wizard. For Cloud Cost, set a rate card on the Morpheus credential

Get Started

Concepts

Create and Run Clusters

Ship Your App

Stacks and Add-ons

Observe and Troubleshoot

Ankra AI

Connect Tools

Source Control

Security and Access

Cost and Backups

Organisation and Account

Reference

Before you start

Hybrid connectivity (SSH jumphost)

Create the cluster

Verify

What Ankra created through your appliance

Morpheus specifics

Operate it

Troubleshooting

​Before you start

​Hybrid connectivity (SSH jumphost)

​Create the cluster

​Verify

​What Ankra created through your appliance

​Morpheus specifics

​Operate it

​Troubleshooting

Before you start

Hybrid connectivity (SSH jumphost)

Create the cluster

Verify

What Ankra created through your appliance

Morpheus specifics

Operate it

Troubleshooting