Preflight Ankra Cloud cluster (browser session)

Browser session authentication; RBAC permission clusters. RBAC permission clusters.create. Checks the create request against the account without creating anything: the credential authenticates, the zone offers compute, every plan and the template exist, an adopted network lives in the zone, and the counts are within bounds. Answers 404 while the organisation's ankra_cloud_providerfeature flag is off. With nocredential_id`, the organisation’s built-in Ankra Cloud credential is used, and the request answers 503 with Retry-After when it cannot be created or renewed right now.

POST /org/clusters/ankracloud/preflight

Preflight Ankra Cloud cluster (browser session)

Python

import requests

url = "https://api.platform.ankra.app/org/clusters/ankracloud/preflight"

payload = {
    "bastion_plan": "c1-2",
    "control_plane_plan": "c2-4",
    "name": "ankra-prod",
    "zone": "de-fsn1"
}
headers = {
    "cookie": "ankra_session=",
    "X-Ankra-CSRF": "<x-ankra-csrf>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

200

{
  "can_proceed": true,
  "items": [
    {
      "check": "<string>",
      "message": "<string>",
      "status": "pass",
      "action_url": "<string>"
    }
  ]
}

Authorizations

ankra_session · string · cookie · required

Browser session. Mutations also require X-Ankra-CSRF.

Headers

X-Ankra-CSRF · string · required

Must match the ankra_csrf browser cookie.

Body

application/json

bastion_plan · string · required

control_plane_plan · string · required

name · string · required

zone · string · required

Ankra Cloud zone (GET /clusters/ankracloud/zones); every server of the cluster is placed there.

bastion_allowed_ips · string[]

IPv4/IPv6 addresses or CIDRs allowed to SSH to the bastion; empty allows any source.

bastion_disk_gibibytes · integer

Root disk size of the bastion in GiB. Omit it for the plan's included disk; Ankra Cloud refuses a size below the plan's and the template's minimum.

Required range: 1 <= x <= 4096

bastion_disk_tier · enum<string>

Storage tier of the bastion's root disk. Omit it for the zone's default_storage_tier. local-nvme is the node's own disks; standard, maxiops and hdd are the zone's Ankra Storage (Ceph) tiers.

Available options: local-nvme, standard, maxiops, hdd

bastion_port · integer · default: 22

Accepted for contract symmetry with the managed-gateway providers and ignored: the bastion listens on 22.

cni · enum<string> · default: cilium

kubeadm supports only cilium on Ankra Cloud.

Available options: flannel, calico, cilium

cni_features · object

Show child attributes

control_plane_count · integer · default: 1

Required range: 1 <= x <= 9

control_plane_disk_gibibytes · integer

Root disk size of each control plane in GiB. Omit it for the plan's included disk.

Required range: 1 <= x <= 4096

control_plane_disk_tier · enum<string>

Storage tier of each control plane's root disk. Omit it for the zone's default_storage_tier. local-nvme is the node's own disks; standard, maxiops and hdd are the zone's Ankra Storage (Ceph) tiers.

Available options: local-nvme, standard, maxiops, hdd

credential_id · string<uuid>

criticality · string | null

description · string | null

distribution · enum<string> · default: kubeadm

Available options: k3s, kubeadm

environment · string | null

etcd_disk_gibibytes · integer

Root disk size of each external etcd node in GiB. Omit it for the plan's included disk.

Required range: 1 <= x <= 4096

etcd_disk_tier · enum<string>

Storage tier of each external etcd node's root disk. Omit it for the zone's default_storage_tier. local-nvme is the node's own disks; standard, maxiops and hdd are the zone's Ankra Storage (Ceph) tiers.

Available options: local-nvme, standard, maxiops, hdd

etcd_node_count · integer · default: 3

etcd_plan · string · default: ""

Required for an external etcd topology.

etcd_topology · enum<string> · default: stacked

Available options: stacked, external

external_cloud_provider · boolean · default: true

gitops_branch · string · default: master

gitops_provider · enum<string> · default: github

GitOps provider of the repository the cluster is bootstrapped onto. Omitted is github, where gitops_repository is owner/name. bitbucket_cloud names the repository by gitops_workspace and gitops_repo_slug (or gitops_repository as workspace/repo_slug) and binds it as a Bitbucket Cloud repository.

Available options: github, bitbucket_cloud

gitops_workspace · string | null

Bitbucket Cloud workspace of the GitOps repository. Only with gitops_provider bitbucket_cloud; provided together with gitops_repo_slug.

gitops_repo_slug · string | null

Bitbucket Cloud repository slug of the GitOps repository. Only with gitops_provider bitbucket_cloud; provided together with gitops_workspace.

gitops_credential_name · string · default: ""

gitops_repository · string · default: ""

include_dns · boolean · default: true

include_networking · boolean · default: true

gateway_api · boolean · default: false

Install the Kubernetes Gateway API beside Traefik's Ingress: the Gateway API standard CRDs, Traefik's Gateway provider with the traefik GatewayClass and a shared traefik-gateway Gateway in the traefik namespace (a plain HTTP listener that accepts routes from every namespace), cert-manager's Gateway support, and external-dns publishing of HTTPRoute hostnames. Ingress keeps working; one Traefik serves both. Requires include_networking.

k3s_disabled_components · string[] | null

kubernetes_version · string | null

network_ip_range · string | null

RFC 1918 CIDR (/16 through /29) of the private network Ankra creates; omitted derives one per cluster.

network_mode · enum<string> · default: ipv6_only

ipv6_only (default; the zone needs capabilities networking.nat64 and networking.port_forward): no router, the nodes reach IPv4 through the zone's NAT64, and the platform reaches the bastion's IPv6 through an Ankra Cloud port forward from the zone's gateway; the bastion admits SSH from that gateway, the private network and IPv6 bastion_allowed_ips only. ipv4_nat, only when asked for: a NAT router for the nodes' IPv4 egress and a bastion with a public IPv4 (a paid add-on counted against the account's public IPv4 quota) the platform dials.

Available options: ipv4_nat, ipv6_only

node_groups · object[]

Show child attributes

private_network_id · string | null

Adopts an existing private network in the zone; mutually exclusive with network_ip_range. An adopted network is never deleted by the cluster.

retention_policy · enum<string> · default: retain

Available options: delete, retain

runtime_credential_id · string<uuid> | null

Credential the running cluster's cloud-controller-manager and CSI use; omitted reuses credential_id.

ssh_key_credential_id · string<uuid>

Optional customer SSH key. When omitted, Ankra uses the cluster-specific managed key, stored encrypted server-side.

template · string · default: debian-13

Public OS template id (GET /clusters/ankracloud/templates).

worker_count · integer · default: 1

Required range: 0 <= x <= 100

worker_disk_gibibytes · integer

Root disk size of each worker in GiB, and of each node group that names no disk_gibibytes of its own. Omit it for the plan's included disk.

Required range: 1 <= x <= 4096

worker_disk_tier · enum<string>

Storage tier of each worker's root disk, and of each node group that names no disk_tier of its own. Omit it for the zone's default_storage_tier. local-nvme is the node's own disks; standard, maxiops and hdd are the zone's Ankra Storage (Ceph) tiers.

Available options: local-nvme, standard, maxiops, hdd

worker_plan · string · default: ""

Required when worker_count is above zero and no node_groups are given.

Response

200

application/json

Successful response

can_proceed · boolean · required

items · object[] · required

Show child attributes