Kubernetes on OVHcloud
Kubernetes on OVHcloud, across three zones.
One command builds a private kubeadm cluster on Public Cloud instances in your own project, spread over the three zones of a 3-AZ region, with ingress, TLS and DNS. Or Ankra creates and runs OVHcloud MKS for you.
$ ankra cluster ovh create --name prod-par --region EU-WEST-PAR \ --availability-zones eu-west-par-a,eu-west-par-b,eu-west-par-c \ --credential-id $OVH_CRED --ssh-key-credential-id $SSH_KEY \ --control-plane-count 3 --worker-count 3 OVH cluster 'prod-par' created successfully! Cluster ID: 9e4b7d20-1c6a-4f83-b2d5-7a0e3c9f6b14 $ ankra cluster select prod-par Selected cluster: prod-par is now active.$ ankra cluster operations list -w Watching executions (every 5s, press Ctrl+C to stop) vRack network, gateway, bastion, instances in 3 zones, CCM, Cinder CSI, Traefik, DNS All executions have reached a terminal state. Stopping watch. $ ankra cluster kubeconfig add prod-par --use Added context "ankra-prod-par" to ~/.kube/config$ kubectl get nodes -L topology.kubernetes.io/zone NAME STATUS ROLES AGE VERSION ZONE prod-par-cp-1 Ready control-plane 7m v1.34.1 eu-west-par-a prod-par-cp-2 Ready control-plane 7m v1.34.1 eu-west-par-b prod-par-cp-3 Ready control-plane 7m v1.34.1 eu-west-par-c prod-par-worker-1 Ready <none> 5m v1.34.1 eu-west-par-a prod-par-worker-2 Ready <none> 5m v1.34.1 eu-west-par-b prod-par-worker-3 Ready <none> 5m v1.34.1 eu-west-par-cSample session. Commands, flags and output wording are the Ankra CLI's own. Names, IDs and versions are examples.
What one command builds
Private nodes, one public door.
Everything lands in your own Public Cloud project. The bastion is the only instance with a public IP, and it is an SSH jump host, not a router.
- 01vRack networkA private VLAN with a DHCP subnet for every instance.
- 02Network gatewayA managed OVHcloud gateway for egress, so nodes need no public IP.
- 03BastionThe only public IP. SSH only, a c3-4 instance by default.
- 04Control planeskubeadm with Cilium. Three spread over the zones of a 3-AZ region.
- 05Workersb3-16 by default, each node group spread over the zones or pinned to one.
- 06CCM and Cinder CSIOpenStack cloud controller manager and the
csi-cinder-sc-topologyStorageClass. - 07Ingress, TLS and DNSTraefik and cert-manager behind an OVHcloud load balancer, plus an ankra.cc subdomain. On by default.
Step by step
From API keys to kubectl get nodes.
The same flow works in the dashboard and the API. These are the CLI steps from the OVHcloud guide.
Prefer to ask? Your AI client can callcreate_ovh_cluster through the Ankra MCP server.- 1
Store your OVHcloud API credentials
Ankra needs an application key, application secret and consumer key, plus your Public Cloud project ID. The CLI prompts for the keys.
ankra credentials ovh create --name my-ovh --project-id <project-id> - 2
Add an SSH key credential
Bring your own public key or let Ankra generate one. It goes on every instance.
ankra credentials ovh ssh-key create --name my-key --generate - 3
Check which regions your project can use
Regions differ per project. A region not enabled on the private network fails during network setup.
--with-zonesmarks the 3-AZ regions.ankra cluster ovh regions --credential-id <id> --with-zones - 4
Create the cluster
Flavors default to b3-16 for control planes and workers and c3-4 for the bastion. Add
--distribution k3sfor k3s.ankra cluster ovh create --name my-cluster --region EU-WEST-PAR \ --availability-zones eu-west-par-a,eu-west-par-b,eu-west-par-c \ --credential-id <id> --ssh-key-credential-id <key-id> \ --control-plane-count 3 --worker-count 3 - 5
Watch it come up, then use kubectl
The cluster turns Online once the Ankra Agent connects. Kubeconfig access goes through Ankra and needs a Cluster Access grant.
ankra cluster select my-cluster ankra cluster operations list -w ankra cluster kubeconfig add my-cluster --use kubectl get nodes
Options
Defaults that work. Flags when they don't.
Everything below is a flag on create, a field in the dashboard wizard or a later command.
Three zones in one region
In EU-WEST-PAR and EU-SOUTH-MIL, control planes and each node group spread across the zones. A spread needs three control planes, so etcd keeps quorum when a zone goes down.
kubeadm or k3s
kubeadm with Cilium is the default.
--distribution k3sfor k3s,--etcd-topology externalfor dedicated etcd instances.Or MKS, created and operated
Create MKS on the free or standard plan, run its pools and upgrades from Ankra, or import one you already run. See the MKS guide.
First-boot scripts
A node group can carry a cloud-init document that runs on every instance it creates, replacements included, with labels and taints set when the group is added.
SSH without a VPN
ankra cluster ovh access-infoprints the bastion jump and API tunnel commands for a cluster.GitOps from day one
Pass a repository at create time and the cluster and its Stacks live in Git, synced by Ankra.
Stacks
Ingress, cert-manager, monitoring and your apps in versioned Stacks with dependency ordering.
AI operations
A failing pod gets an analysis from its logs, events and deploy history, with a drafted fix for you to approve.
Compared
Public Cloud instances or MKS.
Both run with Ankra. The choice is who runs the control plane and how much placement control you need.
| OVHcloud MKS through Ankra | Ankra Managed on OVHcloud instances | |
|---|---|---|
| Control plane | Run by OVHcloud, on the free or standard plan | Runs on your instances, operated by Ankra |
| Distribution | MKS | kubeadm with Cilium, or k3s |
| Availability zones | Anti-affinity where OVHcloud supports it | Spread or pin node groups in 3-AZ regions |
| Node autoscaling | Autoscaling bounds per node pool | Autoscaling bounds per node group |
| Already running one | Import the MKS cluster untouched | Build a new cluster |
Know before you build
OVHcloud specifics.
- OVHcloud block storage is zonal. Spread nodes alone do not make a database survive a zone outage. Replicate at the application layer, for example CloudNativePG with one replica per zone.
- Zone placement for volumes is pending on OVHcloud. Until it returns, pin each stateful replica to a node group in one zone so its pod lands where its volume is.
- Node groups move to larger flavors only. Each node is powered off, resized and powered on. For smaller nodes, create a new group and delete the old one.
- Control planes cannot move to new zones in place. A zone-spread control plane on an existing cluster means recreating it. Workers move by adding a pinned node group.
- A stop takes an encrypted etcd snapshot and deletes the instances, bastion and gateway. The private network and Cinder volumes are kept, and the volumes keep billing.
FAQ
Does OVHcloud have managed Kubernetes?
Yes. OVHcloud Managed Kubernetes (MKS) runs the control plane on a free or standard plan. Ankra can create MKS clusters, manage their node pools and upgrades, and import MKS clusters you already run. Ankra can also build kubeadm or k3s on Public Cloud instances when you want control over the distribution, the network and zone placement.
Can a Kubernetes cluster on OVHcloud span availability zones?
Yes, in the 3-AZ regions EU-WEST-PAR and EU-SOUTH-MIL. Ankra spreads control planes and each node group across the three zones, and refuses a spread with fewer than three control planes. Every other OVHcloud region is a single failure domain.
Which OVHcloud regions can I use?
The regions enabled on each Public Cloud project differ, so run ankra cluster ovh regions with your credential before you create a cluster. Add --with-zones to see which regions are 3-AZ.
What does Ankra cost on top of OVHcloud?
Ankra bills on worker vCPUs only. Every plan includes 30 worker vCPUs free, control planes are never billed, and the free tier needs no credit card. OVHcloud bills you directly for the instances, storage and network.
Your first OVHcloud cluster fits in the free allowance.
30 worker vCPUs included, control planes never billed, no credit card. Bring your Public Cloud project.
Ankra is an independent platform and is not affiliated with or endorsed by OVH SAS. OVHcloud prices and regions can change, so check ovhcloud.com for current terms. Product details were checked against the Ankra documentation and CLI in October 2026.