Ship a New Application Without Pushing First

ankra application ship now takes a new Ankra Pipelines application to a running URL even when nothing was pushed since it was registered. It asks Ankra for the run a push to the tracked branch would have started, which publishes the image. Starting that run needs the applications.deploy permission.

ankra application ship .

ankra cluster hetzner create prints the server type each role got, now that Ankra picks one the location has in stock for every role you leave without one. ankra cluster addons list shows ok (stale) and says when the advisory data was last read once it is over a day old, and ankra cluster addons list <name> exits 3 on a cluster with no addons. ankra registry robots create --permission works with a token that may create robots but not read them, and its help names the credentials.reveal permission that grants past pull and push need. ankra targets register no longer mentions an API token when it refuses a plain http:// --release-url.Ship from your checkout →

Read One Secret’s Values from the Terminal

Secret values now reach the CLI as sha256: digests, and ankra cluster get secrets says so instead of printing them as if they were values. --reveal reads the values of one named Secret. It needs the kubernetes.secrets_reveal permission, every reveal is written to the audit log, and it exits 7 when your role lacks the permission.

ankra cluster get secrets db-credentials -n default --reveal -o yaml

ankra org ai-review repos list|set|unset turns the AI code review on or off for one repository without the portal. ankra targets register now says which agent release is missing and what to pass instead of failing with a bare 404, checks --label the way the host agent does before installing anything, and restarts the service when run again. ankra cluster addons list <name> prints an upgrade command that names the cluster, and ankra registry robots create refuses an empty --permission.Kubernetes Resources →

Parse the AI’s Answer in CI, and Ship Follows Ankra Pipelines

ankra chat "<question>" -o json (or -o yaml) prints one document when the turn ends: the answer, the tools the AI ran and how each ended, any change it proposed that has not run, and error when the turn failed, with a non-zero exit. A one-shot question no longer hangs after the AI proposes a write.

ankra chat --mode ask -o json "is anything degraded?" | jq -r '.answer'

ankra application ship now follows the Ankra pipeline run that builds the application instead of waiting for a GitHub Actions run. Cluster creates leave machine sizes to the platform’s defaults, ankra cluster ankracloud creates Ankra Cloud clusters (Closed Beta), --force-drain removes a worker whose drain a disruption budget refuses, ankra cluster gitops status shows when GitOps is paused on a merge conflict, and ankra openclaw skill writes a skill OpenClaw loads.Use the ankra CLI in CI →

Run One Command in a Pod

ankra cluster exec <pod> -n <namespace> -- <command> [args...] runs one command in a pod through the platform, passed to the container exactly as given, with its output streamed and its own exit code returned, so scripts and CI can branch on it. --stdin forwards input, -o json returns one {exit_code, stdout, stderr} document, and every run needs the kubernetes.exec permission and is recorded in the audit log like a terminal session. It needs a cluster agent at 2.1.1166 or newer; an older one is refused and nothing runs.

ankra cluster exec my-pod -n default -- cat /etc/os-release

Beside it, ankra pipeline get names who cancelled a run, why and when, and ankra cost savings says whether each saving is measured, billed or estimated, counting only the first two in its total.Pod Terminal →

ankra cluster deprovision (and each provider’s deprovision) now names the persistent volumes a deprovision deletes on Hetzner, OVH, UpCloud, DigitalOcean, Scaleway and AWS, and deletes them only once you accept it - at the [y/N] prompt or with --accept-volume-data-loss. --yes and --force no longer stand in for that consent. Upgrade before the platform starts requiring it: an older CLI’s deprovision of a cluster with volumes will then be refused. power-schedules create|update --stop-mode scale_to_zero asks the same way before data on worker disks is lost (--accept-node-local-data-loss).

ankra cluster deprovision my-cluster                            # names the volumes and asks
ankra cluster deprovision my-cluster --accept-volume-data-loss  # for scripts

The cost commands grow from cost savings into cost trend, cost events, cost ledger, cost budgets, cost autopilot, cost decisions, cost namespaces, cost object and cost reconcile. Also new: stack-profiles deprecate|undeprecate withdraws a published version without deleting it, cluster agent auto-upgrade enable|disable keeps one cluster’s agent out of the fleet rollout, and application demo config set --protected puts an application’s demos behind a password.Terminate a cluster →

Stopping a Cluster Keeps Its State

On Hetzner, OVHcloud, UpCloud, DigitalOcean, Proxmox VE and HPE Morpheus the platform captures an encrypted etcd snapshot before a stop removes the VMs, and the next start restores it: Secrets, ConfigMaps, custom resources and persistent volume claims come back and StatefulSets reattach their disks. --preserve-state and --restore-state steer it, --mode pause powers the servers off and keeps them instead, and power schedules carry the same choices with --stop-mode and --preserve-state.The backups commands grow cluster backups status, backup vaults contents, application backups|protect|backup and cluster stacks clone --with-data; cluster stacks deploy-draft deploys a draft from the terminal; ankra ai remediation policy reads the auto-remediation policy; pipeline validate --ref dry-runs a branch before it is merged; and managed node pools can be handed to a provider autoscaler with --externally-managed.Stop cluster →

Fixes

A retried backup vault upload in ankra migrate up, migrate restore and migrate data now re-reads the file instead of failing on its own body, and reports the error underneath. --force now reaches the Proxmox deprovision, so a cluster whose host is gone can still be torn down.

Self-managed AWS Clusters, Backups, and Where Each Branch Stands

ankra cluster aws creates and operates self-managed k3s or kubeadm clusters on EC2 (closed beta), with a bastion, preflight and deprovision --force. The first backups commands arrive: a backup: block on a stack in the cluster file, stacks protect, and restore points with create|restore and the runs that do them.For pipelines, ankra pipeline branches and pipeline list --latest-per-branch answer where each branch stands, a superseded run reads as superseded rather than cancelled, pipeline get names what a queued run is waiting for, and application pipeline convert moves a workflow-built application onto Ankra Pipelines in one call. Also in this release: registry robots, bucket create|list|get|delete, stack-profiles adopt, cluster mesh up, ankra upgrade refreshing the installed agent skills, and the ankra-ship skill.AWS Clusters →

Choose the Model Each AI Function Runs On

ankra ai lanes is the terminal side of per-function AI model settings: list shows what deploy analysis, troubleshooting, CI/CD generation, stack READMEs and AI code review each run on, set <lane> <model> takes a catalog key or an exact OpenRouter model id, and clear <lane> returns a function to its default tier. Changing one needs organisation admin. ankra application add now says which registry an application will publish to when you did not declare one.Models per function →

Wait on a Pipeline Run You Did Not Start

ankra pipeline get gains --wait, --watch and --exit-code, and they work on the push and pull request runs a webhook creates. A run can also be addressed by the commit a CI job knows, rather than by a run id it cannot know in advance.Also in this release: stack profiles across a fleet (apply --cluster, a deployments table, a decoded diff, rollout), cluster operations list --attention, cluster apply --cluster targeting the cluster you name instead of the file’s metadata.name, and every cluster-scoped command accepting a cluster’s name where it previously accepted only its id.Ankra Pipelines →

Claude Design Import, and Internal Operations on Request

ankra application import claude-design <path> turns a Claude Design export into a static site in a new GitHub repository and registers it as an application, so the setup pull request, build and deploy follow as for any other application (closed beta). ankra cluster operations list --include-internal lists the platform’s own maintenance executions, such as the GitOps snapshot push behind a repository commit.Fixed: ankra cluster deprovision now works on a Scaleway cluster, and ankra support attach accepts PNG, JPEG, GIF and WebP images again.From Claude Design to a live application →

Fix

ankra cluster apply no longer drops a manifest’s force and auto_remediate flags. A key that is absent or null means false, and a value that is not a boolean is refused with an error naming the key.

Ankra Pipelines and the Whole Security Center in the Terminal

ankra pipeline covers the whole pipeline lifecycle: repositories, definitions and their approval gate, runs, validate with the egress tier each step needs, findings, artifacts, and logs that follow a step before it starts or replay what a running one printed. The Security Center is complete in the terminal too: security sbom with licence-risk grading and SBOM export, security stacks, pod and namespaces, and security history and report-schedule.Around those: ankra application ship takes a checkout to a running application in one command, ankra cluster patch corrects one field on a live object without kubectl, ankra chat shows what its tools are doing, and stack-profiles import --as-draft, cluster manifests create, org ci-settings and alerts ingest-credentials are new.Ankra Pipelines →

Backup Vaults and Migrating a Docker Deployment

ankra backup vaults registers an S3-compatible bucket you run, or has Ankra provision one from a provider credential, and ankra migrate up moves a Docker deployment into a cluster in one command: plan, convert, deploy, dump every database and restore it through a vault, rehearse, then cut over with --stop-source. The steps are also separate commands, and conversion modules install like plugins.

ankra migrate up ./app --cluster production --plan
ankra migrate up ./app --cluster production

Around it: a shell in any pod with ankra cluster terminal, debug pods that impersonate a workload, kubectl-style plugins, ankra cluster mesh for Cilium ClusterMesh, Scaleway’s full command set, UpCloud multi-zone clusters, kubeadm as the default distribution, the Security Center from the terminal with ankra security (CISA KEV and EPSS ordering, per-CVE advisories), the Cost centre as ankra cost, and ankra cluster move --organisation.Migrate from Docker →

The AI Board in the Terminal, Registry Robots, and Kubernetes Debugging Without a Kubeconfig

The release that makes the terminal a first-class seat at the platform: debug a cluster without fetching a kubeconfig, work the AI board and answer the decision an agent is blocked on, and run the whole application lane - including the robot account your builds push with.

Work the AI board, and answer what an agent is waiting for

ankra tickets brings the board to the terminal. list shows what needs a person, telling “your decision” apart from a plain block; get prints the agent’s question with every option it offered, its summary and the one it recommends; decide answers it - either an offered option or something else in your own words - and the agent resumes from your answer without re-asking.

ankra tickets list --needs-human
ankra tickets get T-8
ankra tickets decide T-8 --option a
ankra tickets decide T-8 --answer "Publish to both for a week, then decide."

events, comment and transition complete the lane. A ticket is named by number (8, T-8) or UUID, and every command takes -o json|yaml.Answering a choice →

Registry robots, and registries whose layout is not Ankra’s

ankra application registry robot get|ensure|rotate|revoke manages the push robot Ankra mints per application - on your organisation’s Ankra registry, and on a Harbor you operate once you name a project-administrator credential with --admin-credential. Where your registry addresses images differently, --flat-repositories and --component-repository <component>=<repository> describe what your pipeline already pushes, and ankra application credential get|set moves an application onto another GitHub credential instead of deleting and recreating it.

ankra application registry set <application-id> \
  --url oci://artifact.example.com/commerce-images \
  --credential example-harbor-pull \
  --admin-credential example-harbor-admin
ankra application registry robot ensure <application-id>
ankra application registry robot rotate <application-id>

Harbor as your application registry →

Propose and review stack profile changes

The drafts family grew the cross-organisation review lane. ankra stack-profiles drafts create --profile on a profile another organisation owns opens a suggestion draft; drafts submit-suggestion sends it to the owner for review, and ankra stack-profiles suggestions list | get | approve | reject | withdraw works the queue - approving publishes the proposal as the profile’s next version. drafts rebase moves a stale draft of your own profile onto its latest published version, keeping or discarding your edits.

ankra stack-profiles drafts create --profile <profile-id>
ankra stack-profiles drafts submit-suggestion <draft-id> --title "Raise the default replica count"
ankra stack-profiles suggestions approve <profile-id> <suggestion-id>

Stack Profile Suggestions →

Debug a cluster without a kubeconfig

ankra cluster logs reads the log a crash-looping container left behind (--previous), follows or does not (--follow=false), and selects with -l and --all-containers. ankra cluster describe <kind> <name> answers “why is this not ready?”, ankra cluster events --for pod/my-pod scopes an event listing to one object, and ankra cluster top pods|nodes shows live CPU and memory.

ankra cluster logs my-pod -n default --previous
ankra cluster describe pod my-pod -n default
ankra cluster events --for pod/my-pod -n default
ankra cluster top pods -A --sort-by memory

DNS and domains, end to end

ankra org custom-dns-zones serves a zone you own from every cluster in the organisation - the ones running now and every one created afterwards - while ankra cluster custom-dns-zones does the same for a single cluster. ankra org domain get|set reads and writes the organisation’s own Ankra root domain, ankra org dns zones lists every cluster domain, and ankra cluster domain now reports the public domain hostnames actually publish under when that differs from the generated zone.Serving a zone in your own DNS account →

Also in this release

ankra org mcp-servers registers, enables and grants the MCP tool servers agent runs may call.
ankra cluster encrypt --key 'glob:<pattern>' encrypts every key matching a pattern, now and on every later platform re-encrypt.
ankra application env-secrets, auto-deploy, settings, ai-config, publish-addon and manifest-addon complete the application lane.
ankra cluster playground destroy tears down the organisation’s playground.
--sort and --order on the main list commands.
Every per-application command now accepts the application’s name where it used to demand its UUID.

Cloud-init, Visible

Closes the loop on node-group cloud-init: ankra cluster node-group add --user-data-file attaches the document, and ankra cluster <provider> nodes cloud-init-log reads the first-boot output back, so a provisioning script is no longer debugged blind. ankra cluster <provider> bastion status|diagnose report the bastion’s health, ankra demo deploy selects and tunes individual components, ankra cluster reconcile reports the operations it triggered, and ankra application add declares the image registry at create time - which is the moment that matters, because the build workflow is generated from it.

Alerting as Code, and Operations That Explain Themselves

ankra alerts destinations and ankra alerts routes bring alerting as code to the terminal: webhook and chat-channel receivers, a test fire that exits non-zero when the receiver rejects it, and routes deciding which notifications reach which destination by kind, severity, cluster and source.ankra cluster operations steps --results shows what each step actually did - the resources a teardown deleted, skipped or failed to reclaim - instead of a status and a truncated excerpt. ankra cluster logs --follow=false prints the backlog and exits, so piping into grep no longer hangs. ankra stack-profiles drafts edits and publishes profile versions from the terminal, and --force on cloud deprovision and stop reclaims leaked cloud resources on every provider that lets it.

Fix

The OVH availability-zone flags render their type in --help again.

Playgrounds, Power Schedules, and OVH Zones

ankra cluster playground creates a throwaway cluster for an organisation, ankra cluster power-schedules starts and stops clusters on a timetable, and OVH clusters can be placed by availability zone. Demo inspection and repair arrive alongside --allow-repoint on cluster apply and ankra ai openrouter set-key.Earlier in the same line: ankra cluster gitops status shows which GitOps repository a cluster actually syncs from, ankra charts template and charts values render a chart’s manifests and defaults server-side, ankra cluster encrypt encrypts several keys in one run, and paginated listings gained --all so they no longer truncate silently.

Proxmox and Morpheus, AI Agent Runs, and Writes That Ask First

Two new self-managed cluster families, terminal control over what your AI agents are doing, confirmation prompts for the writes agent-mode chat proposes, and a long list of commands that finally show the data the API was sending all along.

Proxmox VE and HPE Morpheus clusters

ankra cluster proxmox and ankra cluster morpheus bring both platforms to the terminal: create and deprovision, stop and start, worker and node-group scaling, labels and taints, autoscaling, control-plane changes, node inspection, SSH keys, and Kubernetes upgrades. Each family also discovers what the platform offers - Proxmox nodes, storages, bridges, and templates; Morpheus groups, clouds, plans, layouts, and networks - and manages its own credentials.

ankra credentials proxmox create --help
ankra cluster proxmox nodes list <cluster_id>
ankra cluster morpheus node-group list <cluster_id>

Proxmox nodes restart with ankra cluster proxmox nodes restart. Morpheus has no restart lane on the platform, so the CLI does not pretend to offer one.Proxmox clusters → | Morpheus clusters →

Managed Kubernetes reaches parity

ankra cluster managed stop | start drives provider-native stop and start where the provider supports it (AKS today). The new ankra cluster managed node-pool update changes node counts and autoscaling settings in place, node pools accept autoscaling bounds at create and add time (--autoscaling, --autoscaling-min, --autoscaling-max), and Scaleway Kapsule joins the provider list as --provider kapsule.Managed Kubernetes →

See and stop what your AI agents are doing

The new ankra agents family lists the organisation’s dispatched agent runs, shows one run in full, reads the session transcript of what the agent actually said and did, and cancels a live run - the platform interrupts the in-flight turn within seconds without pausing the agent itself. Cancelling requires organisation admin rights, and all four commands support -o json|yaml.

ankra agents runs --status running
ankra agents transcript <run_id>
ankra agents cancel <run_id>

agents reference →

Agent-mode chat asks before it writes

In agent mode every mutating tool halts the turn and proposes the write, and the write only runs once the proposal is confirmed. The CLI used to drop that proposal silently, so ankra chat --mode agent "restart node worker-1" appeared to do nothing. The stream now renders each proposal - tool, description, risk, whether it is reversible, parameters, expiry, and the action id - an interactive session prompts to run or discard it, and ankra chat actions confirm | reject | list drives the same decision from a script.If the cluster drifted since the proposal, confirming reports the drift instead of applying it, and prints the ready-to-run --force invocation. A superseded action is not offered a force, because forcing it cannot work.chat actions reference →

Scaleway lifecycle and node commands

ankra cluster scaleway stop | start releases and re-provisions compute while preserving the cluster definition, and ankra cluster scaleway nodes list | get | restart closes the last gap in provider node coverage - a Scaleway node could already be restarted from the portal and from AI chat, but not from the terminal.

Node restarts and bastion resize across the provisioned providers

For Hetzner, OVH, UpCloud, and DigitalOcean, ankra cluster <provider> nodes restart reboots any provisioned node - a control plane node, a worker, or the bastion/gateway - as a tracked operation, and the new bastion resize command changes the bastion instance type with the same submit-or---wait contract as node-group upgrades. nodes list gained a PROVIDER_STATUS column carrying the cloud provider’s live power state, so an externally-stopped VM is visible before you act on it.

Applications from the terminal

ankra application add . detects a local GitHub checkout and starts application setup, and the subcommands cover lifecycle, deployment, workflow, repository, security, publishing, and demo operations.application reference →

Set a secret and encrypt it in one commit

ankra cluster encrypt manifest accepts repeatable --set edits that are applied in memory before encryption, so the new value and its SOPS encryption land in a single commit - the plaintext never reaches git history. The previously documented flow of manifests upgrade --set followed by encrypt manifest committed the plaintext first, leaving it recoverable from the repository history.

ankra cluster encrypt manifest db-secret --key password \
  --set 'data.password=bmV3LXNlY3JldA==' --cluster prod

ankra cluster manifests upgrade --from-file also accepts SOPS-encrypted files now, detecting ENC[...] keys and recording them as encrypted_paths automatically, with --encrypted-path to declare keys explicitly.

Commands that were quietly returning nothing

A batch of listings and readers were decoding JSON keys the API never sends, and showed empty results rather than an error. cluster manifests list always printed “No manifests found”, org members always printed “No members found”, chat health printed an empty status scored 0, and cluster stacks history rendered blank rows. All of them now decode the response the API actually returns.Alongside that: ankra cluster addons uninstall resolves the addon’s resource id through the stack history instead of sending an empty id and failing with a 404; cluster stacks and cluster addons list walk every page instead of stopping at the first 25; every ankra cluster managed subcommand now calls a path the backend serves, instead of failing with “not found”; ankra cluster kubeconfig add my-cluster accepts the cluster as a positional argument; and ankra helm registries create explains the expected file shape up front rather than letting the API answer with an unexplained error.

Your cluster YAML keeps its fields and comments

ankra cluster encrypt -f and ankra cluster clone used to rewrite the file by re-serialising an internal struct, silently dropping anything the struct did not model - deploy_wave on stacks and spec.prometheus_metrics were lost outright, and comments, anchors, and key ordering were destroyed. Both now edit the parsed YAML document in place, touching only the nodes they change.

Deprecated

ankra cluster deprovision --auto-delete is deprecated: the backend parses and discards it, so it never deleted anything. The flag is hidden, prints a warning pointing at ankra delete cluster, and is scheduled for removal in v0.10.0. --force is only honoured by the Hetzner deprovision endpoint, and now says so on stderr for every other cluster type instead of implying a forced teardown.

Real Agent Tokens and Drift Field Paths

A small release fixing two agent commands that reported the wrong thing, plus drift detail in operations.

`agent token` prints the real token

ankra cluster agent token rendered an empty string: it decoded a token/expires_at shape the platform no longer returns. It now decodes every returned field, extracts the ank_cai_… token from the install command when that is all the platform sends, and prints the token together with the full install/update command. Structured output carries token, cluster_id, and command; the never-populated expires_at is gone.

`agent status` no longer calls a stale agent connected

Status was derived from checked_in_at merely being present, so an agent offline for days still displayed Status: connected. The CLI now uses the platform’s is_online verdict when present - the same 30-second threshold that flips clusters offline - and otherwise falls back to a two-minute recency test, rendering a stale check-in as not connected (stale check-in).

Operations show which fields drifted

ankra cluster operations list <id> and operations steps <id> now render each drifting resource with its drift type and the exact field paths the agent compared, for example /spec/template/spec/hostNetwork, instead of only step metadata and timings. Enrichment is best-effort: on platforms without the execution result endpoint the commands work as before.

This release is required to log in. The platform has dropped support for the old localhost-callback login flow and answers pre-v0.7.0 CLIs with 426 Upgrade Required.ankra login used to start a localhost callback server and have the browser redirect the OAuth code to it. The CLI now starts a platform login ticket, drives the whole flow in the browser including sign-in approval and any MFA challenge, and polls for the parked token with a PKCE code verifier that never leaves your machine.

Install with Homebrew

brew install ankraio/tap/ankra

The formula lives in the ankraio/homebrew-tap vendor tap and is bumped automatically on every stable release. A Homebrew-managed binary refuses ankra upgrade and defers to brew upgrade ankra, so brew stays the single owner of the file.

Managed Kubernetes for all six providers

ankra cluster managed previously accepted only doks and uks even though the platform already managed the rest. create, delete, node-pool add | scale | delete, and upgrade now accept doks, uks, gke, ovh_mks, aks, and eks.

Cluster Groups, Scoped Roles, Deploy Waves, and Agent Guardrails

Organisation-level RBAC building blocks, ordered stack deployment, node-group autoscaling, and the agent rules that make Ankra the default Kubernetes workflow in your editor.

Cluster groups and scoped role assignments

ankra org cluster-groups list | create | add-cluster | set-selector | preview manages named sets of clusters, either static or resolved from a label selector, for use as role-assignment scopes. ankra org assign <member-email> then grants a role at organisation, cluster, or cluster-group scope, with ankra org assignments and ankra org unassign to inspect and revoke. ankra org roles create defines custom roles that can bundle Kubernetes access levels provisioned across the assignment’s scope.

Ankra becomes your agent’s default Kubernetes workflow

ankra skills install now also writes an always-applied rule telling Cursor or Claude Code that clusters here are Ankra-managed: route changes through the GitOps repo or ankra cluster apply, inspect freely, never mutate with raw kubectl or helm. Add --with-hooks and cluster-mutating kubectl/helm commands pause for confirmation with a redirect to the Ankra workflow, while read-only inspection and --dry-run pass through untouched. The guard fails open and merges into existing hook configuration without disturbing other entries; --no-rules skips it and ankra skills uninstall cleans everything up.

Stack deploy waves

Stacks in a cluster YAML accept an optional deploy_wave (an integer of 0 or more): stacks in wave N deploy only after every stack in a lower wave finished, and teardown unwinds in reverse. Stacks without a wave keep the existing unordered behaviour. The wave is validated by ankra cluster apply, preserved by partial patches, and shown as a Wave column in ankra cluster stacks list.

Node-group autoscaling

ankra cluster node-group autoscaling get | set reads and writes a node group’s Cluster Autoscaler settings on Hetzner, OVH, and UpCloud. set --enabled --min <n> --max <n> keeps the group within those bounds based on pod demand, installing the autoscaler on first enable.

Scoped tokens and a distinct RBAC exit code

ankra tokens create --scopes pins an API token to a permission allowlist. When the platform denies a request because your role lacks a permission, the CLI now names the missing permission, points at an organisation admin, and exits 7 - distinct from exit 6, which means re-authenticate.

DigitalOcean and Managed Kubernetes

DigitalOcean clusters

ankra cluster digitalocean (alias ankra cluster do) covers create, deprovision, stop and start, scale, upgrade, node groups, regions and sizes discovery, with credentials in ankra credentials digitalocean. The provider-agnostic commands - scale, upgrade, node-group, ssh-keys, deprovision - detect DigitalOcean clusters automatically.

Managed Kubernetes

ankra cluster managed arrives with create, deprovision, upgrade, and node-pool operations for DigitalOcean Kubernetes (doks) and UpCloud Managed Kubernetes (uks).

Long stack writes no longer time out

addons upgrade, manifests upgrade, encrypt … --cluster, and stacks variables set | delete end in a partial-stack PATCH the backend serves synchronously, including a full GitOps commit and push when the cluster has a linked repository. On large clusters that legitimately exceeded the old 60-second command context; the deadline is now five minutes.

kubeadm Upgrades, etcd Topology, and the Generated Reference

kubeadm cluster upgrades

The provider-agnostic ankra cluster upgrade now covers kubeadm clusters alongside k3s. Nodes upgrade one at a time, control plane first: each is cordoned, drained respecting PodDisruptionBudgets, upgraded, and gated on being Ready at the target version, with an etcd snapshot taken before the control plane. --force proceeds when a drain is blocked by a PodDisruptionBudget, where the default aborts safely. ankra cluster kubeadm-versions lists the versions available, as a sibling of ankra cluster k3s-versions.

etcd topology at create time

ankra cluster hetzner | ovh | upcloud create gained --etcd-topology (stacked on the control planes, or external on dedicated VMs), --etcd-node-count (3 or 5), and --etcd-server-type for sizing dedicated etcd nodes.

The generated CLI reference

The full command tree is now rendered as documentation pages straight from the CLI source, and a release-tag workflow opens a sync pull request against these docs - so the reference can never drift from the shipped binary.

Kubeconfig entries pin the owning organisation

Entries written by ankra cluster kubeconfig add embed --org <organisation-id> in the kube-token exec arguments, so kubectl keeps working after you switch your selected organisation. Previously the token mint failed with “Cluster not found” whenever the selection differed from the cluster’s owner.

Cluster Access (RBAC) and Provider-Agnostic Cloud Verbs

Per-user cluster access management, cloud-agnostic lifecycle verbs that auto-detect the provider, and the deprecation of the provider-specific equivalents.

Cluster access (RBAC)

ankra cluster access list | grant | revoke manages who can reach a cluster’s Kubernetes API through the Ankra kube gateway (the access used by cluster kubeconfig and cluster kube-token). A grant maps an organisation member (by email) to a Kubernetes role - view, edit, admin, or cluster-admin - cluster-wide or limited to one namespace with --namespace. list shows each grant’s RBAC reconcile status; revoke accepts a grant ID or an email (revoking every grant that member has on the cluster). Managing access requires organisation admin rights.

ankra cluster access grant user@example.com --cluster prod --role edit --namespace staging
ankra cluster access list --cluster prod
ankra cluster access revoke user@example.com --cluster prod

Provider-agnostic cloud cluster verbs

New cloud-agnostic verbs detect the provider (Hetzner, OVH, UpCloud) automatically from the cluster, so you no longer pick a provider namespace:

ankra cluster upgrade <cluster_id> <target_version> - upgrade the Kubernetes (k3s) version.
ankra cluster scale <cluster_id> <worker_count> - scale the default worker pool.
ankra cluster node-group <list|add|scale|upgrade|delete> - manage node groups.
ankra cluster k3s-versions - list the k3s versions available for cluster upgrade, with the stable channel highlighted.

ankra cluster deprovision now accepts a cluster ID or name (previously name-only) and routes cloud clusters to the provider-specific teardown so cloud resources are released.

Agent Skills for Claude Code

ankra skills install | list | uninstall gained an --editor flag so the curated Agent Skills can target Claude Code as well as Cursor. It defaults to cursor (.cursor/skills, unchanged); pass --editor claude-code to install into .claude/skills, for both the personal (~/…) and --project scopes.

ankra skills install                        # ~/.cursor/skills (default)
ankra skills install --editor claude-code   # ~/.claude/skills

Support review before submit

ankra support create now shows the AI review before submitting: the reasons a request was flagged, clarifying questions that would speed up triage, and any existing ticket that may already track the same problem. When the review flags the request or finds a possible duplicate you’re asked to confirm; --force skips the prompt, and -o json|yaml callers get a --force-guidance error instead of a prompt.

Isolated `--config` state

--config <file> now fully isolates per-invocation state: a config file with an unfamiliar or missing extension is parsed as YAML (instead of reading empty and dropping the saved token), and the active-cluster selection is keyed to the explicit --config path rather than $HOME, so parallel runs against different config files no longer clobber each other. If you previously ran with --config and relied on the $HOME-keyed selection, re-run ankra cluster select once.

Deprecated

The provider-specific ankra cluster {hetzner,ovh,upcloud} upgrade | scale | node-group | deprovision commands are deprecated in favour of the cloud-agnostic verbs above. They still work and now print a runtime warning pointing at the replacement; they are scheduled for removal in v0.5.0. OVH’s node-group labels / node-group taints remain - they have no provider-agnostic equivalent yet.

kubectl, Metrics, Support, Stack Profiles, and Cluster Validation

The first stable v0.3.0 release rounds out end-to-end terminal control of an Ankra cluster: connect kubectl directly, query metrics, file support tickets, manage reusable stack profiles, validate and stage cluster YAML, and self-update the CLI.

Connect kubectl directly

ankra cluster kubeconfig add | remove | list and ankra cluster kube-token wire kubectl straight to an Ankra cluster through the kube gateway. kube-token prints a short-lived Kubernetes ExecCredential for use as a credential plugin; kubeconfig add writes an ankra-* context (exec-based by default, or --embed-token) with atomic 0600 writes that leave foreign entries untouched and use collision-safe context naming.

ankra cluster kubeconfig add --cluster prod --use
kubectl get pods

Cluster metrics

ankra cluster metrics query | query-range proxies a PromQL query (instant or range) to the cluster’s Prometheus metrics source, with table | json | yaml output for ad-hoc inspection and CI.

ankra cluster metrics query 'up'
ankra cluster metrics query-range 'rate(node_cpu_seconds_total[5m])' --range 6h --step 5m

Support requests

Stack profiles

ankra stack-profiles list | export-iac | import manages reusable, organisation-level stack profiles as ClusterInfrastructureAsCode YAML (export a profile version, import one from a file). The family has since grown much further - drafts, suggestions, sharing, demos - see the current reference.

Validate and stage cluster YAML

ankra cluster validate -f cluster.yaml runs the offline apply --dry-run checks plus server-side chart-existence, plaintext-secret, and parent-reference validation, with CI-friendly exit codes and --strict-secrets.
ankra cluster draft -f cluster.yaml stages every stack as a reviewable draft instead of applying it - nothing is deployed by the command.
ankra cluster apply gained offline dependency-tree and referenced-file validation, and --dry-run for apply / delete cluster is fully offline (no token), so it drops into pre-merge CI.

Self-update and beta channel

ankra upgrade downloads, SHA-256-verifies, and atomically swaps the binary, with --version pinning for upgrade, downgrade, and rollback (--allow-unverified for releases that predate published checksums). ankra config beta enable|disable|status opts into pre-release builds with semver-aware precedence (a stable release outranks its release candidates).

Cloud create parity and OVH commands

cluster ovh | upcloud | hetzner create gained --external-cloud-provider (per-cloud CCM + CSI) and --include-networking (Traefik + cert-manager), installed by default and reconciled directly, and committed to Git when --gitops-credential-name / --gitops-repository / --gitops-branch are set.
OVH reached web-UI parity: ovh regions, ovh stop / ovh start, ovh access-info, ovh ssh-keys get|set, ovh node-group labels|taints, and ovh control-plane / ovh nodes.

Operations and machine-readable output

ankra cluster operations list gained --watch / -w (with a configurable --interval), and both operations list and operations steps gained -o json|yaml. A shared -o json|yaml flag now spans the commands that read or return data.

Security

ankra cluster encrypt manifest | addon no longer produces files that only look encrypted: a dotted --key (e.g. data.password) is normalised to its last segment, and after every encryption the CLI verifies the target value is real ENC[...] ciphertext - hard-failing before any write or stack PATCH when SOPS encrypted nothing.

Variables, Live-Cluster SOPS, Dependency Parents, and Multi-Org

Rounds out stack CRUD from the CLI: template variables at every scope, SOPS encryption against live clusters, dependency-parent editing, read/delete commands, a global organisation override, and offline-installable Agent Skills.

Variables (org / cluster / stack scopes)

Full CRUD for the template variables substituted into stack manifests and addon values at deploy time, at three scopes:

ankra org variables list|get|set|delete - organisation-wide, available to every cluster.
ankra cluster variables list|get|set|delete [--cluster <name|id>] - per cluster; shadows org variables on that cluster.
ankra cluster stacks variables list|get|set|delete <stack> - per stack; the most specific scope.

set is an upsert (create or update). Values can be read from stdin with - for piping secrets, list / get support -o json|yaml, and delete prompts for confirmation (--yes to skip). Resolution at deploy time is stack > cluster > organisation - a more specific scope shadows less specific ones for the same name.

SOPS encrypt/decrypt against live clusters

ankra cluster encrypt and ankra cluster decrypt now operate directly on a live cluster, with no local cluster.yaml required.

ankra cluster encrypt manifest <name> --key <key> [--cluster <name|id>]
ankra cluster encrypt addon --name <addon> --key <key> [--cluster <name|id>] [--stack <stack>]
ankra cluster decrypt manifest <name> [--cluster <name|id>]
ankra cluster decrypt addon --name <addon> [--cluster <name|id>] [--stack <stack>]

Cluster mode fetches the current content, runs it through the SOPS API, and (for encrypt) pushes the result back via the partial-stack PATCH with encrypted_paths updated. The -f cluster.yaml file mode is unchanged for GitOps workflows; the two modes are mutually exclusive and cluster mode is the default. decrypt addon is new, bringing the addon variant to parity with manifests.

Dependency parents on upgrade

ankra cluster addons upgrade and ankra cluster manifests upgrade now edit the dependency parents that control deployment ordering inside a stack, without re-applying the whole cluster.yaml:

--add-parent name=<n>,kind=<manifest|addon> - repeatable; kind defaults to manifest.
--remove-parent name=<n>,kind=<manifest|addon> - repeatable; removing the last parent clears the link.
--set-parent name=<n>,kind=<manifest|addon> - replaces ALL parents; mutually exclusive with --add-parent / --remove-parent.

Read and delete

ankra cluster addons values <name> - print an addon’s current Helm values (decoded; -o raw for the base64 form).
ankra cluster manifests get <name> - print a manifest’s current YAML (decoded; -o raw for the base64 form).
ankra cluster manifests delete <name> - disconnect a manifest from its stack and remove its resources; the owning stack is resolved automatically and a confirmation prompt protects the operation (--yes to skip, --dry-run to preview).

Run a command against another organisation

A global --org <name|id> flag (or the ANKRA_ORG environment variable) runs a single command against any organisation you belong to, without changing your selected organisation:

ankra --org "Acme Corp" cluster list
export ANKRA_ORG="Acme Corp"   # scope a whole shell session

The override is per request and never changes the ankra org switch selection. You must be an active member of the target organisation.

Install Ankra Agent Skills

ankra skills installs the curated Ankra Agent Skills into a Cursor/Claude skills directory. The skills are embedded in the binary, so installation works offline and is versioned with the release.

ankra skills list                  # list available skills (marks installed ones)
ankra skills install               # install all into ~/.cursor/skills (personal)
ankra skills install --project .   # install into ./.cursor/skills (project)
ankra skills install ankra-gitops  # install only named skills
ankra skills uninstall             # remove all Ankra skills

Use --force to overwrite existing skills and --source <dir> to install from a local directory instead of the embedded copy. This is separate from ankra openclaw skill, which generates a per-cluster SKILL.md.

Surgical Addon and Manifest Upgrades

Two new subcommands for in-place updates that go through the same partial-stack endpoint as the UI. Atomic, locked, single git commit per invocation.

Addon Upgrade

ankra cluster addons upgrade <addon> --chart-version <version> - bump the chart version.
ankra cluster addons upgrade <addon> --set <key>=<value> - mutate a single Helm values field (helm-style; supports dotted paths, [idx] indexing, and [key=value] list selectors such as env[name=LOG_LEVEL].value).
ankra cluster addons upgrade <addon> --values-from-file <path> - replace the entire values document.
ankra cluster addons upgrade <addon> --registry-name, --registry-url, --registry-credential-name - atomically retag the addon’s registry.
ankra cluster addons upgrade <addon> --namespace <new> - destructive Helm reinstall in a new namespace; requires --yes or an interactive confirmation.

--set and --values-from-file are mutually exclusive: --set* MUTATES the existing values document, --values-from-file REPLACES it. Use --set-string to force a value to remain a string, and --set-file key=path to load a value from a file.

Manifest Upgrade

ankra cluster manifests upgrade <manifest> --from-file <path> - replace the manifest content.
ankra cluster manifests upgrade <manifest> --manifest - - read manifest YAML from stdin.
ankra cluster manifests upgrade <manifest> --set <key>=<value> - mutate a single path in the manifest YAML (helm-style; supports dotted paths, [idx] indexing, and [key=value] list selectors such as containers[name=app].image).
ankra cluster manifests upgrade <manifest> --target-kind <kind> --target-name <name> - with --set, pick which document to edit when the manifest holds multiple Kubernetes resources.
ankra cluster manifests upgrade <manifest> --namespace <new> - change the manifest’s namespace.

--set* MUTATE the existing manifest and are mutually exclusive with --from-file / --manifest -, which REPLACE it. Use --set-string to force a value to remain a string, and --set-file key=path to load a value from a file.

Addon and manifest field selectors

Both addons upgrade and manifests upgrade --set paths can address a list item by a stable field instead of a numeric index - for example env[name=LOG_LEVEL].value=debug or spec.template.spec.containers[name=app].image=nginx:1.27. A selector that matches nothing fails with a clear error rather than guessing.

Common Options

--cluster <name|id> - defaults to the active selection.
--stack <name> - addons only, required when the same addon name exists in multiple stacks. Manifest names are globally unique on a cluster, so manifests upgrade has no --stack flag.
--dry-run - print before/after without writing.
-o json|yaml - machine-readable output (the --dry-run envelope is {before, after, notices}).

Example: bump `image.tag` for the website addon

ankra cluster addons upgrade website \
  --set image.tag=1.0.146 \
  --cluster website-demo

Example: bump a Deployment image tag in a manifest

ankra cluster manifests upgrade web \
  --set 'spec.template.spec.containers[name=app].image=nginx:1.27' \
  --cluster website-demo

Helm, Kubernetes Resources & Security Hardening

Helm management, Kubernetes resource access, direct cluster selection, and client hardening.

Helm Release Commands

Commands for managing Helm releases in the active cluster:

ankra cluster helm releases - List Helm releases (--namespace, --all-namespaces, --output json)
ankra cluster helm uninstall <release> --namespace <ns> - Uninstall a Helm release

Helm Registry Commands

ankra helm registries list - List Helm registries
ankra helm registries get <name> - Get registry details
ankra helm registries create --name <name> --url <url> - Create a registry
ankra helm registries delete <name> - Delete a registry

Helm Credential Commands

ankra helm credentials list - List registry credentials
ankra helm credentials create --name <name> - Create a credential with secure prompts
ankra helm credentials delete <name> - Delete a credential

Kubernetes Resource Commands

Commands for accessing Kubernetes resources in the active cluster:

ankra cluster pods - List pods (--namespace, --all-namespaces, --output json)
ankra cluster resources <kind> - Get resources by kind (--namespace, --name, --output json)
ankra cluster logs <pod> - Stream pod logs (--namespace, --container, --follow, --tail, --previous)

Cluster Selection & Info

ankra cluster select <name> - Select a cluster directly by name without the interactive picker
ankra cluster info [name] - Show cluster details (defaults to selected cluster; replaces cluster get)

Security & Reliability

HTTP client timeouts and response body size limits
URL encoding for all API path and query parameters
Config file permissions restricted to owner-only (0600)
Machine ID hashed with SHA-256
Browser URL validation before opening

Node Groups, UpCloud & OVH

Node group management commands and new UpCloud/OVH commands for cluster and credential management.

Node Group Commands

Available for all three providers (hetzner, ovh, upcloud):

ankra cluster <provider> node-group list <cluster_id> - List node groups
ankra cluster <provider> node-group add <cluster_id> --name <name> --instance-type <type> --count <n> - Add a group
ankra cluster <provider> node-group scale <cluster_id> <group_name> <count> - Scale a group
ankra cluster <provider> node-group upgrade <cluster_id> <group_name> <instance_type> - Upgrade instance type
ankra cluster <provider> node-group delete <cluster_id> <group_name> - Delete a group

UpCloud Commands

Credentials:

ankra credentials upcloud list - List UpCloud API credentials
ankra credentials upcloud create --name <name> - Create credential with secure token prompt
ankra credentials upcloud ssh-key list - List SSH key credentials
ankra credentials upcloud ssh-key create --name <name> --generate - Create SSH key

Clusters:

ankra cluster upcloud create - Create an UpCloud cluster
ankra cluster upcloud deprovision <cluster_id> - Deprovision a cluster
ankra cluster upcloud workers <cluster_id> - Get worker count
ankra cluster upcloud scale <cluster_id> <count> - Scale workers
ankra cluster upcloud k8s-version <cluster_id> - Get Kubernetes version
ankra cluster upcloud upgrade <cluster_id> <version> - Upgrade Kubernetes version

OVH Commands

Credentials:

ankra credentials ovh list - List OVH API credentials
ankra credentials ovh create --name <name> --project-id <id> - Create credential with secure prompts
ankra credentials ovh ssh-key list - List SSH key credentials
ankra credentials ovh ssh-key create --name <name> --generate - Create SSH key

Clusters:

ankra cluster ovh create - Create an OVH cluster
ankra cluster ovh deprovision <cluster_id> - Deprovision a cluster
ankra cluster ovh workers <cluster_id> - Get worker count
ankra cluster ovh scale <cluster_id> <count> - Scale workers
ankra cluster ovh k8s-version <cluster_id> - Get Kubernetes version
ankra cluster ovh upgrade <cluster_id> <version> - Upgrade Kubernetes version

OVH Cloud Support

OVH Cloud commands for cluster and credential management.

OVH Credential Commands

ankra credentials ovh list - List OVH API credentials
ankra credentials ovh create --name <name> --project-id <id> - Create credential with secure prompts
ankra credentials ovh ssh-key list - List SSH key credentials
ankra credentials ovh ssh-key create --name <name> --generate - Create SSH key

OVH Cluster Commands

ankra cluster ovh create - Create an OVH cluster with configurable control planes, workers, networking, and gateway
ankra cluster ovh deprovision <cluster_id> - Deprovision a cluster
ankra cluster ovh workers <cluster_id> - Get worker count
ankra cluster ovh scale <cluster_id> <count> - Scale workers
ankra cluster ovh k8s-version <cluster_id> - Get Kubernetes version
ankra cluster ovh upgrade <cluster_id> <version> - Upgrade Kubernetes version

SOPS Encryption & API Tokens

New SOPS encryption commands and API token management.

SOPS Encryption

ankra cluster sops-config - Display the SOPS encryption configuration
ankra cluster encrypt manifest <name> --key <key> -f <file> - Encrypt a manifest key
ankra cluster encrypt addon --name <addon> --key <key> -f <file> - Encrypt an addon key
ankra cluster decrypt manifest <name> -f <file> - Decrypt a manifest

API Tokens

ankra tokens list - List API tokens
ankra tokens create <name> - Create a token
ankra tokens revoke <id> - Revoke a token
ankra tokens delete <id> - Delete a revoked token

​Ship a New Application Without Pushing First

​Read One Secret’s Values from the Terminal

​Parse the AI’s Answer in CI, and Ship Follows Ankra Pipelines

​Run One Command in a Pod

​Consent Before a Teardown Deletes Data, and the Cost Centre in the Terminal

​Stopping a Cluster Keeps Its State

​Fixes

​Self-managed AWS Clusters, Backups, and Where Each Branch Stands

​Choose the Model Each AI Function Runs On

​Wait on a Pipeline Run You Did Not Start

​Claude Design Import, and Internal Operations on Request

​Fix

​Ankra Pipelines and the Whole Security Center in the Terminal

​Backup Vaults and Migrating a Docker Deployment

​The AI Board in the Terminal, Registry Robots, and Kubernetes Debugging Without a Kubeconfig

​Work the AI board, and answer what an agent is waiting for

​Registry robots, and registries whose layout is not Ankra’s

​Propose and review stack profile changes

​Debug a cluster without a kubeconfig

​DNS and domains, end to end

​Also in this release

​Cloud-init, Visible

​Alerting as Code, and Operations That Explain Themselves

​Fix

​Playgrounds, Power Schedules, and OVH Zones

​Proxmox and Morpheus, AI Agent Runs, and Writes That Ask First

​Proxmox VE and HPE Morpheus clusters

​Managed Kubernetes reaches parity

​See and stop what your AI agents are doing

​Agent-mode chat asks before it writes

​Scaleway lifecycle and node commands

​Node restarts and bastion resize across the provisioned providers

​Applications from the terminal

​Set a secret and encrypt it in one commit

​Commands that were quietly returning nothing

​Your cluster YAML keeps its fields and comments

​Deprecated

​Real Agent Tokens and Drift Field Paths

​agent token prints the real token

​agent status no longer calls a stale agent connected

​Operations show which fields drifted

​Browser Login Without a Local Port, Managed Kubernetes, and Homebrew

​Login no longer opens a local network port

​Install with Homebrew

​Managed Kubernetes for all six providers

​Cluster Groups, Scoped Roles, Deploy Waves, and Agent Guardrails

​Cluster groups and scoped role assignments

​Ankra becomes your agent’s default Kubernetes workflow

​Stack deploy waves

​Node-group autoscaling

​Scoped tokens and a distinct RBAC exit code

​DigitalOcean and Managed Kubernetes

​DigitalOcean clusters

​Managed Kubernetes

​Long stack writes no longer time out

​kubeadm Upgrades, etcd Topology, and the Generated Reference

​kubeadm cluster upgrades

​etcd topology at create time

​The generated CLI reference

​Kubeconfig entries pin the owning organisation

​Cluster Access (RBAC) and Provider-Agnostic Cloud Verbs

​Cluster access (RBAC)

​Provider-agnostic cloud cluster verbs

​Agent Skills for Claude Code

​Support review before submit

​Isolated --config state

​Deprecated

​kubectl, Metrics, Support, Stack Profiles, and Cluster Validation

​Connect kubectl directly

​Cluster metrics

​Support requests

​Stack profiles

​Validate and stage cluster YAML

​Self-update and beta channel

​Cloud create parity and OVH commands

​Operations and machine-readable output

​Security

​Variables, Live-Cluster SOPS, Dependency Parents, and Multi-Org

​Variables (org / cluster / stack scopes)

​SOPS encrypt/decrypt against live clusters

Ship a New Application Without Pushing First

Read One Secret’s Values from the Terminal

Parse the AI’s Answer in CI, and Ship Follows Ankra Pipelines

Run One Command in a Pod

Consent Before a Teardown Deletes Data, and the Cost Centre in the Terminal

Stopping a Cluster Keeps Its State

Fixes

Self-managed AWS Clusters, Backups, and Where Each Branch Stands

Choose the Model Each AI Function Runs On

Wait on a Pipeline Run You Did Not Start

Claude Design Import, and Internal Operations on Request

Fix

Ankra Pipelines and the Whole Security Center in the Terminal

Backup Vaults and Migrating a Docker Deployment

The AI Board in the Terminal, Registry Robots, and Kubernetes Debugging Without a Kubeconfig

Work the AI board, and answer what an agent is waiting for

Registry robots, and registries whose layout is not Ankra’s

Propose and review stack profile changes

Debug a cluster without a kubeconfig

DNS and domains, end to end

Also in this release

Cloud-init, Visible

Alerting as Code, and Operations That Explain Themselves

Fix

Playgrounds, Power Schedules, and OVH Zones

Proxmox and Morpheus, AI Agent Runs, and Writes That Ask First

Proxmox VE and HPE Morpheus clusters

Managed Kubernetes reaches parity

See and stop what your AI agents are doing

Agent-mode chat asks before it writes

Scaleway lifecycle and node commands

Node restarts and bastion resize across the provisioned providers

Applications from the terminal

Set a secret and encrypt it in one commit

Commands that were quietly returning nothing

Your cluster YAML keeps its fields and comments

Deprecated

Real Agent Tokens and Drift Field Paths

`agent token` prints the real token

`agent status` no longer calls a stale agent connected

Operations show which fields drifted

Browser Login Without a Local Port, Managed Kubernetes, and Homebrew

Login no longer opens a local network port

Install with Homebrew

Managed Kubernetes for all six providers

Cluster Groups, Scoped Roles, Deploy Waves, and Agent Guardrails

Cluster groups and scoped role assignments

Ankra becomes your agent’s default Kubernetes workflow

Stack deploy waves

Node-group autoscaling

Scoped tokens and a distinct RBAC exit code

DigitalOcean and Managed Kubernetes

DigitalOcean clusters

Managed Kubernetes

Long stack writes no longer time out

kubeadm Upgrades, etcd Topology, and the Generated Reference

kubeadm cluster upgrades

etcd topology at create time

The generated CLI reference

Kubeconfig entries pin the owning organisation

Cluster Access (RBAC) and Provider-Agnostic Cloud Verbs

Cluster access (RBAC)

Provider-agnostic cloud cluster verbs

Agent Skills for Claude Code

Support review before submit

Isolated `--config` state

Deprecated

kubectl, Metrics, Support, Stack Profiles, and Cluster Validation

Connect kubectl directly

Cluster metrics

Support requests

Stack profiles

Validate and stage cluster YAML

Self-update and beta channel

Cloud create parity and OVH commands

Operations and machine-readable output

Security

Variables, Live-Cluster SOPS, Dependency Parents, and Multi-Org

Variables (org / cluster / stack scopes)

SOPS encrypt/decrypt against live clusters