Skip to main content
When Ankra provisions a cluster, it does not just create VMs and install Kubernetes - it applies a set of infrastructure defaults that reduce the cluster’s attack surface from the first boot. This page describes what those defaults are.
This page is about clusters Ankra provisions. Imported clusters keep the posture you built them with - Ankra manages their workloads through the agent but does not modify their infrastructure, and they have no Ankra bastion.

​
Network posture

  • Tag-scoped cloud firewalls - each node group and the bastion get their own firewall rules, scoped by provider tags rather than static IP lists, so rules follow nodes as they are added and removed.
  • Private networking with NAT - where the provider supports it, nodes are placed on a private network with no public IPs; their egress is routed through the bastion or gateway.
  • Bastion jump hosts for SSH - the bastion is the only host with a public IP, and SSH to nodes goes through it. See the Hetzner architecture for a concrete example of this layout.

​
SSH keys

Ankra generates a 4096-bit RSA key pair per cluster. The key is held authoritatively in Vault and is never stored in the cluster definition - exporting, cloning, or committing a definition to Git cannot leak key material.

​
Control plane joins

kubeadm join tokens are generated on demand when a node joins and expire after 15 minutes. There are no long-lived join secrets to rotate, leak, or forget about.

​
Security add-ons

The add-on catalog covers the common security building blocks: cert-manager, Kyverno, Trivy Operator, External Secrets, Sealed Secrets, Cilium, Istio, and Vault. They install like any other add-on - visible in the platform, versioned, and removable - so there is no hidden security infrastructure you cannot inspect or take out. A default security baseline for newly provisioned clusters is rolling out, so new clusters can start with a curated set of these add-ons instead of an empty slate.

​
OS-level options at creation

The cluster create flow includes OS-level audit and hardening options. Enable them at creation and they are applied as each node is provisioned, including nodes added later through scaling.

Security at Ankra

The trust model these defaults sit inside.

Cluster Security

Vulnerability posture once the cluster is running.

SOPS Encryption

Encrypt sensitive values in your Stacks.

Ankra Agent

The hardened, outbound-only agent pod.