ankra credentials

Commands to list, view, validate, and delete credentials.

ankra credentials ankracloud

List and create Ankra Cloud API credentials. One Ankra Cloud credential serves both self-managed clusters (‘ankra cluster ankracloud create’) and Ankra Cloud Kubernetes (‘ankra cluster managed create --provider ankracloud_k8s’). Ankra Cloud servers take any SSH key credential of the organisation for --ssh-key-credential-id; create one with, for example, ‘ankra credentials hetzner ssh-key create --name my-key --generate’.

ankra credentials ankracloud create

Create an Ankra Cloud API credential from an API token (act_…). The token is never taken from a flag. It is read from stdin with --token-stdin, else from the ANKRA_CLOUD_API_TOKEN environment variable, else from a masked prompt on a terminal. --endpoint names a non-default Ankra Cloud installation (https only); it defaults to https://cloud.ankra.app. Examples:

ankra credentials ankracloud create --name ankra-cloud
ANKRA_CLOUD_API_TOKEN=act_... ankra credentials ankracloud create --name ankra-cloud
cat token.txt | ankra credentials ankracloud create --name dev --endpoint https://cloud.ankra.dev --token-stdin

ankra credentials ankracloud create [flags]

Flags

Flag	Default	Description
`--endpoint`		Ankra Cloud API endpoint, https only (default https://cloud.ankra.app)
`--name`		Credential name (required)
`--token-stdin`	`false`	Read the API token from stdin

ankra credentials ankracloud list

List Ankra Cloud API credentials

ankra credentials ankracloud list [flags]

Flags

Flag	Default	Description
`-o`, `--output`		Output format: json or yaml (default: human-readable)

ankra credentials aws

Connect and list the AWS credentials (access key pairs and assumable roles) the organisation uses for cost reporting, EKS and self-managed EC2 clusters. Connecting a role:

‘onboarding --scope self_managed’ prints the external id the platform generated and the CloudFormation launch-stack URL that creates a role trusting the platform with that id. Open the URL, launch the stack, and copy the role ARN from its outputs.
‘create-role --name <n> --role-arn <arn> --external-id <id> --scope self_managed’ registers the role. The scope must be the one the stack was launched for; a cost-scoped role cannot build clusters.

Connecting an access key pair instead: ‘create-keys --name <n> --access-key-id <id>’ prompts for the secret access key (masked; pipe it on stdin in scripts) - it is never taken on the command line. Once connected, the credential’s id is what ‘ankra cluster aws create --credential-id’ takes; ‘list’ shows the ids. SSH key credentials are shared across providers: create one with any provider’s ssh-key group (for example ‘ankra credentials hetzner ssh-key create --name ops-key --generate’) and pass its id as --ssh-key-credential-id.

ankra credentials aws create-keys

Register an IAM access key pair. The access key id is a flag; the secret access key is collected via a masked prompt (or read from stdin when piped) and never taken on the command line, so it stays out of shell history. Example:

ankra credentials aws create-keys --name aws-prod --access-key-id AKIA... --region eu-north-1
printf '%s' "$AWS_SECRET_ACCESS_KEY" | ankra credentials aws create-keys --name aws-prod --access-key-id AKIA...

ankra credentials aws create-keys [flags]

Flags

Flag	Default	Description
`--access-key-id`		IAM access key id (required); the secret is prompted for
`--name`		Credential name (required)
`-o`, `--output`		Output format: json or yaml (default: human-readable)
`--region`		Default AWS region for the credential (server default: us-east-1)

ankra credentials aws create-role

Register an IAM role the platform can assume. The role has to trust the platform’s principal with the external id ‘onboarding’ handed out, which the launch stack sets up; pass that same external id here. The scope must match the stack the role was created by: a ‘cost’ role cannot build clusters, ‘ankra cluster aws create’ needs ‘provisioning’ or ‘self_managed’. Example:

ankra credentials aws create-role --name aws-prod \
  --role-arn arn:aws:iam::123456789012:role/AnkraSelfManaged \
  --external-id <id from onboarding> --region eu-north-1 --scope self_managed

ankra credentials aws create-role [flags]

Flags

Flag	Default	Description
`--external-id`		External id the role’s trust policy requires - the one ‘onboarding’ printed (required)
`--name`		Credential name (required)
`-o`, `--output`		Output format: json or yaml (default: human-readable)
`--region`		Default AWS region for the credential (server default: us-east-1)
`--role-arn`		ARN of the IAM role the platform assumes (required)
`--scope`		Credential scope the role was onboarded under: cost, provisioning or self_managed (server default: cost)

ankra credentials aws list

List AWS credentials

ankra credentials aws list [flags]

Flags

Flag	Default	Description
`-o`, `--output`		Output format: json or yaml (default: human-readable)

ankra credentials aws onboarding

Print what connecting an AWS account through an assumable role needs: the external id the platform generated for the role’s trust policy, the principal the role has to trust, and the CloudFormation launch-stack URL that creates the role with exactly that trust and the permissions the scope needs. Each call generates a fresh external id; the one you launch the stack with is the one ‘create-role --external-id’ has to be given. Scopes: ‘cost’ (read-only billing access, the default), ‘provisioning’ (EKS) and ‘self_managed’ (EC2 clusters built by ‘ankra cluster aws’). The launch-stack URL and trust principal are null when the platform is not configured for the scope (“configured: no”); the role then has to be created by hand.

ankra credentials aws onboarding [flags]

Flags

Flag	Default	Description
`-o`, `--output`		Output format: json or yaml (default: human-readable)
`--scope`		Credential scope: cost, provisioning or self_managed (server default: cost)

ankra credentials azure

Commands to list and create Azure service principal credentials used for Azure Kubernetes Service (AKS).

ankra credentials azure create

Store an Azure service principal for AKS. The client secret is read from the AZURE_CLIENT_SECRET environment variable when set, and prompted for (masked) otherwise - it is never accepted as a flag.

ankra credentials azure create [flags]

Flags

Flag	Default	Description
`--client-id`		Service principal application (client) ID
`--name`		Credential name
`--subscription-id`		Azure subscription ID the service principal manages
`--tenant-id`		Microsoft Entra tenant ID

ankra credentials azure list

List Azure credentials

ankra credentials azure list [flags]

Flags

Flag	Default	Description
`-o`, `--output`		Output format: json or yaml (default: human-readable)

ankra credentials delete

Delete a credential

ankra credentials delete <credential_id> [flags]

Flags

Flag	Default	Description
`--yes`	`false`	Skip the confirmation prompt

ankra credentials digitalocean

Commands to list and create DigitalOcean API credentials and SSH key credentials.

ankra credentials digitalocean create

Create an DigitalOcean API credential

ankra credentials digitalocean create [flags]

Flags

Flag	Default	Description
`--name`		Credential name (required)

ankra credentials digitalocean list

List DigitalOcean API credentials

ankra credentials digitalocean list [flags]

Flags

Flag	Default	Description
`-o`, `--output`		Output format: json or yaml (default: human-readable)

ankra credentials digitalocean ssh-key

Manage SSH key credentials

ankra credentials digitalocean ssh-key create

Create an SSH key credential. Either provide a public key or generate a new keypair. Examples:

ankra credentials digitalocean ssh-key create --name my-key --generate
ankra credentials digitalocean ssh-key create --name my-key --public-key "ssh-ed25519 AAAA..."

ankra credentials digitalocean ssh-key create [flags]

Flags

Flag	Default	Description
`--generate`	`false`	Generate a new SSH keypair
`--name`		Credential name (required)
`--public-key`		SSH public key

ankra credentials digitalocean ssh-key list

List SSH key credentials

ankra credentials digitalocean ssh-key list [flags]

Flags

Flag	Default	Description
`-o`, `--output`		Output format: json or yaml (default: human-readable)

ankra credentials get

Get details of a credential by its ID or by its name (as shown in ankra credentials list).

ankra credentials get <credential_id|name> [flags]

Flags

Flag	Default	Description
`-o`, `--output`		Output format: json or yaml (default: human-readable)

ankra credentials hetzner

Commands to list and create Hetzner API credentials and SSH key credentials.

ankra credentials hetzner create

Create a Hetzner API credential

ankra credentials hetzner create [flags]

Flags

Flag	Default	Description
`--name`		Credential name (required)

ankra credentials hetzner list

List Hetzner API credentials

ankra credentials hetzner list [flags]

Flags

Flag	Default	Description
`-o`, `--output`		Output format: json or yaml (default: human-readable)

ankra credentials hetzner ssh-key

Manage SSH key credentials

ankra credentials hetzner ssh-key create

Create an SSH key credential. Either provide a public key or generate a new keypair. Examples:

ankra credentials hetzner ssh-key create --name my-key --generate
ankra credentials hetzner ssh-key create --name my-key --public-key "ssh-ed25519 AAAA..."

ankra credentials hetzner ssh-key create [flags]

Flags

Flag	Default	Description
`--generate`	`false`	Generate a new SSH keypair
`--name`		Credential name (required)
`--public-key`		SSH public key

ankra credentials hetzner ssh-key list

List SSH key credentials

ankra credentials hetzner ssh-key list [flags]

Flags

Flag	Default	Description
`-o`, `--output`		Output format: json or yaml (default: human-readable)

ankra credentials list

List all credentials

ankra credentials list [flags]

Flags

Flag	Default	Description
`--order`	`asc`	Sort direction with `--sort`: asc or desc
`-o`, `--output`		Output format: json or yaml (default: human-readable)
`--provider`		Filter by provider (e.g., github)
`--sort`		Sort by column: id, name, provider, state, available, repos, last-synced, created (default: server order)

ankra credentials morpheus

Commands to list and create HPE Morpheus API credentials and SSH key credentials.

ankra credentials morpheus create

Create an HPE Morpheus API credential. The API access token is collected via a masked prompt, never on the command line. An optional SSH jumphost lets the platform reach a Morpheus API that is not directly routable; pass --jumphost-host together with --jumphost-private-key-file (port defaults to 22, username to root). Examples:

ankra credentials morpheus create --name my-morpheus --api-url https://morpheus.example
ankra credentials morpheus create --name my-morpheus --api-url https://morpheus.example \
  --jumphost-host 203.0.113.10 --jumphost-private-key-file ~/.ssh/id_ed25519

ankra credentials morpheus create [flags]

Flags

Flag	Default	Description
`--api-url`		HPE Morpheus API URL, e.g. https://morpheus.example (required)
`--jumphost-host`		SSH jumphost address used to reach the API
`--jumphost-port`	`22`	SSH jumphost port
`--jumphost-private-key-file`		Path to the SSH private key for the jumphost
`--jumphost-username`	`root`	SSH jumphost username
`--name`		Credential name (required)
`--tls-insecure`	`false`	Skip TLS certificate verification for the API URL

ankra credentials morpheus list

List HPE Morpheus API credentials

ankra credentials morpheus list [flags]

Flags

Flag	Default	Description
`-o`, `--output`		Output format: json or yaml (default: human-readable)

ankra credentials morpheus ssh-key

Manage SSH key credentials

ankra credentials morpheus ssh-key create

Create an SSH key credential. Either provide a public key or generate a new keypair. Examples:

ankra credentials morpheus ssh-key create --name my-key --generate
ankra credentials morpheus ssh-key create --name my-key --public-key "ssh-ed25519 AAAA..."

ankra credentials morpheus ssh-key create [flags]

Flags

Flag	Default	Description
`--generate`	`false`	Generate a new SSH keypair
`--name`		Credential name (required)
`--public-key`		SSH public key

ankra credentials morpheus ssh-key list

List SSH key credentials

ankra credentials morpheus ssh-key list [flags]

Flags

Flag	Default	Description
`-o`, `--output`		Output format: json or yaml (default: human-readable)

ankra credentials ovh

Commands to list and create OVH API credentials and SSH key credentials.

ankra credentials ovh create

Create an OVH API credential. You will be prompted for the required secrets. Generate your OVH API credentials at https://api.ovh.com/createToken/ with GET, POST, PUT, DELETE rights on /cloud/project/* and /cloud/project. Examples:

ankra credentials ovh create --name my-ovh-cred --project-id <project-id>

ankra credentials ovh create [flags]

Flags

Flag	Default	Description
`--name`		Credential name (required)
`--project-id`		OVH Cloud project ID (required)

ankra credentials ovh list

List OVH API credentials

ankra credentials ovh list [flags]

Flags

Flag	Default	Description
`-o`, `--output`		Output format: json or yaml (default: human-readable)

ankra credentials ovh ssh-key

Manage SSH key credentials for OVH

ankra credentials ovh ssh-key create

Create an SSH key credential. Either provide a public key or generate a new keypair. Examples:

ankra credentials ovh ssh-key create --name my-key --generate
ankra credentials ovh ssh-key create --name my-key --public-key "ssh-ed25519 AAAA..."

ankra credentials ovh ssh-key create [flags]

Flags

Flag	Default	Description
`--generate`	`false`	Generate a new SSH keypair
`--name`		Credential name (required)
`--public-key`		SSH public key

ankra credentials ovh ssh-key list

List SSH key credentials

ankra credentials ovh ssh-key list [flags]

Flags

Flag	Default	Description
`-o`, `--output`		Output format: json or yaml (default: human-readable)

ankra credentials proxmox

Commands to list and create Proxmox VE API credentials and SSH key credentials.

ankra credentials proxmox create

Create a Proxmox VE API credential. The API token secret is collected via a masked prompt, never on the command line. An optional SSH jumphost lets the platform reach a Proxmox VE API that is not directly routable; pass --jumphost-host together with --jumphost-private-key-file (port defaults to 22, username to root). Examples:

ankra credentials proxmox create --name my-lab --api-url https://pve.example:8006 --token-id root@pam!ankra
ankra credentials proxmox create --name my-lab --api-url https://pve.example:8006 --token-id root@pam!ankra \
  --jumphost-host 203.0.113.10 --jumphost-private-key-file ~/.ssh/id_ed25519

ankra credentials proxmox create [flags]

Flags

Flag	Default	Description
`--api-url`		Proxmox VE API URL, e.g. https://pve.example:8006 (required)
`--jumphost-host`		SSH jumphost address used to reach the API
`--jumphost-port`	`22`	SSH jumphost port
`--jumphost-private-key-file`		Path to the SSH private key for the jumphost
`--jumphost-username`	`root`	SSH jumphost username
`--name`		Credential name (required)
`--tls-insecure`	`false`	Skip TLS certificate verification for the API URL
`--token-id`		Proxmox VE API token ID, e.g. root@pam!ankra (required)

ankra credentials proxmox list

List Proxmox VE API credentials

ankra credentials proxmox list [flags]

Flags

Flag	Default	Description
`-o`, `--output`		Output format: json or yaml (default: human-readable)

ankra credentials proxmox ssh-key

Manage SSH key credentials

ankra credentials proxmox ssh-key create

Create an SSH key credential. Either provide a public key or generate a new keypair. Examples:

ankra credentials proxmox ssh-key create --name my-key --generate
ankra credentials proxmox ssh-key create --name my-key --public-key "ssh-ed25519 AAAA..."

ankra credentials proxmox ssh-key create [flags]

Flags

Flag	Default	Description
`--generate`	`false`	Generate a new SSH keypair
`--name`		Credential name (required)
`--public-key`		SSH public key

ankra credentials proxmox ssh-key list

List SSH key credentials

ankra credentials proxmox ssh-key list [flags]

Flags

Flag	Default	Description
`-o`, `--output`		Output format: json or yaml (default: human-readable)

ankra credentials proxmox tailscale

Commands to set or clear the Tailscale/Headscale settings a Proxmox VE credential passes to the VMs it builds.

ankra credentials proxmox tailscale clear

Remove the Tailscale/Headscale settings from a Proxmox VE credential. VMs built afterwards no longer join the tailnet; VMs already on it stay there.

ankra credentials proxmox tailscale clear <credential-id>

ankra credentials proxmox tailscale set

Set the Tailscale/Headscale settings a Proxmox VE credential passes to the VMs it builds. Every VM - the bastion/gateway included - joins the tailnet through the QEMU guest agent as it is created. Set this before creating a cluster whose bridge is an SDN vnet: a Proxmox SDN is node-local, so the tailnet join is the only way the platform can reach those VMs. The settings apply to VMs built afterwards; VMs that already exist are not joined retrospectively. The auth key is collected via a masked prompt, never on the command line. Examples:

ankra credentials proxmox tailscale set 63fe1425-4ec1-4058-9fef-7e4caec04c79 \
  --login-server https://headscale.example
ankra credentials proxmox tailscale set 63fe1425-4ec1-4058-9fef-7e4caec04c79 \
  --login-server https://headscale.example --advertise-routes 10.20.0.0/16

ankra credentials proxmox tailscale set <credential-id> [flags]

Flags

Flag	Default	Description
`--accept-routes`	`false`	Accept subnet routes advertised on the tailnet
`--advertise-routes`		Comma-separated CIDRs the VMs advertise to the tailnet, e.g. 10.20.0.0/16
`--login-server`		Headscale/Tailscale control server URL, e.g. https://headscale.example (required)

ankra credentials repositories

Read the repositories a GitHub credential’s installation can reach right now, against the repositories Ankra needs from it, and report where they disagree. The accessible list is read live from the provider rather than from the cached count shown in ankra credentials list, because that count is only refreshed while the credential reports healthy - so a credential that has stopped being able to read its repository keeps reporting the count it had before it broke.

ankra credentials repositories <credential_id|name> [flags]

Flags

Flag	Default	Description
`-o`, `--output`		Output format: json or yaml (default: human-readable)

ankra credentials scaleway

Commands to list and create Scaleway API credentials and SSH key credentials.

ankra credentials scaleway create

Create a Scaleway API credential from a project-scoped IAM application key. The secret key is collected via a masked prompt, never on the command line - Scaleway shows it once, so store it in a secret manager. The project id is required: it is not derivable from the key, and every resource Ankra creates is scoped to that one project. Examples:

ankra credentials scaleway create --name scw-production --project-id 11111111-2222-3333-4444-555555555555 --access-key SCWXXXXXXXXXXXXXXXXX

ankra credentials scaleway create [flags]

Flags

Flag	Default	Description
`--access-key`		Scaleway API access key (required)
`--name`		Credential name (required)
`--project-id`		Scaleway Project ID (required)

ankra credentials scaleway list

List Scaleway API credentials

ankra credentials scaleway list [flags]

Flags

Flag	Default	Description
`-o`, `--output`		Output format: json or yaml (default: human-readable)

ankra credentials scaleway ssh-key

Manage SSH key credentials

ankra credentials scaleway ssh-key create

Create an SSH key credential. Either provide a public key or generate a new keypair. Examples:

ankra credentials scaleway ssh-key create --name my-key --generate
ankra credentials scaleway ssh-key create --name my-key --public-key "ssh-ed25519 AAAA..."

ankra credentials scaleway ssh-key create [flags]

Flags

Flag	Default	Description
`--generate`	`false`	Generate a new SSH keypair
`--name`		Credential name (required)
`--public-key`		SSH public key

ankra credentials scaleway ssh-key list

List SSH key credentials

ankra credentials scaleway ssh-key list [flags]

Flags

Flag	Default	Description
`-o`, `--output`		Output format: json or yaml (default: human-readable)

ankra credentials upcloud

Commands to list and create UpCloud API credentials and SSH key credentials.

ankra credentials upcloud create

Create an UpCloud API credential

ankra credentials upcloud create [flags]

Flags

Flag	Default	Description
`--name`		Credential name (required)

ankra credentials upcloud list

List UpCloud API credentials

ankra credentials upcloud list [flags]

Flags

Flag	Default	Description
`-o`, `--output`		Output format: json or yaml (default: human-readable)

ankra credentials upcloud ssh-key

Manage SSH key credentials

ankra credentials upcloud ssh-key create

Create an SSH key credential. Either provide a public key or generate a new keypair. Examples:

ankra credentials upcloud ssh-key create --name my-key --generate
ankra credentials upcloud ssh-key create --name my-key --public-key "ssh-ed25519 AAAA..."

ankra credentials upcloud ssh-key create [flags]

Flags

Flag	Default	Description
`--generate`	`false`	Generate a new SSH keypair
`--name`		Credential name (required)
`--public-key`		SSH public key

ankra credentials upcloud ssh-key list

List SSH key credentials

ankra credentials upcloud ssh-key list [flags]

Flags

Flag	Default	Description
`-o`, `--output`		Output format: json or yaml (default: human-readable)

ankra credentials validate

Validate a credential name

ankra credentials validate <name>

​ankra credentials

​ankra credentials ankracloud

​ankra credentials ankracloud create

​ankra credentials ankracloud list

​ankra credentials aws

​ankra credentials aws create-keys

​ankra credentials aws create-role

​ankra credentials aws list

​ankra credentials aws onboarding

​ankra credentials azure

​ankra credentials azure create

​ankra credentials azure list

​ankra credentials delete

​ankra credentials digitalocean

​ankra credentials digitalocean create

​ankra credentials digitalocean list

​ankra credentials digitalocean ssh-key

​ankra credentials digitalocean ssh-key create

​ankra credentials digitalocean ssh-key list

​ankra credentials get

​ankra credentials hetzner

​ankra credentials hetzner create

​ankra credentials hetzner list

​ankra credentials hetzner ssh-key

​ankra credentials hetzner ssh-key create

​ankra credentials hetzner ssh-key list

​ankra credentials list

​ankra credentials morpheus

​ankra credentials morpheus create

​ankra credentials morpheus list

​ankra credentials morpheus ssh-key

​ankra credentials morpheus ssh-key create

​ankra credentials morpheus ssh-key list

​ankra credentials ovh

​ankra credentials ovh create

​ankra credentials ovh list

​ankra credentials ovh ssh-key

​ankra credentials ovh ssh-key create

​ankra credentials ovh ssh-key list

​ankra credentials proxmox

​ankra credentials proxmox create

​ankra credentials proxmox list

​ankra credentials proxmox ssh-key

​ankra credentials proxmox ssh-key create

​ankra credentials proxmox ssh-key list

​ankra credentials proxmox tailscale

​ankra credentials proxmox tailscale clear

​ankra credentials proxmox tailscale set

​ankra credentials repositories

​ankra credentials scaleway

​ankra credentials scaleway create

​ankra credentials scaleway list

​ankra credentials scaleway ssh-key

​ankra credentials scaleway ssh-key create

​ankra credentials scaleway ssh-key list

​ankra credentials upcloud

​ankra credentials upcloud create

​ankra credentials upcloud list

​ankra credentials upcloud ssh-key

​ankra credentials upcloud ssh-key create

​ankra credentials upcloud ssh-key list

​ankra credentials validate

ankra credentials

ankra credentials ankracloud

ankra credentials ankracloud create

ankra credentials ankracloud list

ankra credentials aws

ankra credentials aws create-keys

ankra credentials aws create-role

ankra credentials aws list

ankra credentials aws onboarding

ankra credentials azure

ankra credentials azure create

ankra credentials azure list

ankra credentials delete

ankra credentials digitalocean

ankra credentials digitalocean create

ankra credentials digitalocean list

ankra credentials digitalocean ssh-key

ankra credentials digitalocean ssh-key create

ankra credentials digitalocean ssh-key list

ankra credentials get

ankra credentials hetzner

ankra credentials hetzner create

ankra credentials hetzner list

ankra credentials hetzner ssh-key

ankra credentials hetzner ssh-key create

ankra credentials hetzner ssh-key list

ankra credentials list

ankra credentials morpheus

ankra credentials morpheus create

ankra credentials morpheus list

ankra credentials morpheus ssh-key

ankra credentials morpheus ssh-key create

ankra credentials morpheus ssh-key list

ankra credentials ovh

ankra credentials ovh create

ankra credentials ovh list

ankra credentials ovh ssh-key

ankra credentials ovh ssh-key create

ankra credentials ovh ssh-key list

ankra credentials proxmox

ankra credentials proxmox create

ankra credentials proxmox list

ankra credentials proxmox ssh-key

ankra credentials proxmox ssh-key create

ankra credentials proxmox ssh-key list

ankra credentials proxmox tailscale

ankra credentials proxmox tailscale clear

ankra credentials proxmox tailscale set

ankra credentials repositories

ankra credentials scaleway

ankra credentials scaleway create

ankra credentials scaleway list

ankra credentials scaleway ssh-key

ankra credentials scaleway ssh-key create

ankra credentials scaleway ssh-key list

ankra credentials upcloud

ankra credentials upcloud create

ankra credentials upcloud list

ankra credentials upcloud ssh-key

ankra credentials upcloud ssh-key create

ankra credentials upcloud ssh-key list

ankra credentials validate