Kubernetes on Proxmox VE

Kubernetes on the Proxmox hosts you already own.

One command clones the VMs, installs kubeadm, spreads the cluster over your hosts and keeps operating it, with upgrades, node groups and GitOps stacks. Behind a firewall works too. There is no cloud bill.

Start freeProxmox guide
zsh · ankra cli
$ ankra cluster proxmox create --name rack-a --node pve01 \    --placement-nodes pve01,pve02,pve03 --bridge ankra --storage local-lvm \    --credential-id $PVE_CRED --ssh-key-credential-id $SSH_KEY \    --control-plane-count 3 --worker-count 3 --worker-instance-type px-large  Proxmox VE cluster 'rack-a' created successfully!    Cluster ID: 7a2d9e14-3b8c-4f05-a6e1-0d5c8b2f9e63 $ ankra cluster select rack-a  Selected cluster: rack-a is now active.$ ankra cluster operations list -w  Watching executions (every 5s, press Ctrl+C to stop)  bastion, control plane and worker VMs cloned over 3 hosts, Traefik, DNS  All executions have reached a terminal state. Stopping watch. $ ankra cluster kubeconfig add rack-a --use  Added context "ankra-rack-a" to ~/.kube/config$ kubectl get nodes  NAME             STATUS   ROLES           AGE   VERSION  rack-a-cp-1      Ready    control-plane   8m    v1.34.1  rack-a-cp-2      Ready    control-plane   8m    v1.34.1  rack-a-cp-3      Ready    control-plane   8m    v1.34.1  rack-a-worker-1  Ready    <none>          6m    v1.34.1  rack-a-worker-2  Ready    <none>          6m    v1.34.1  rack-a-worker-3  Ready    <none>          6m    v1.34.1

Sample session. Commands, flags and output wording are the Ankra CLI's own. Names, IDs, ages and versions are examples.

What one command builds

From bare hosts to a spread cluster.

When you save the credential, Ankra fills in what each Proxmox node is missing. Then one command clones and places the VMs.

  1. 01TemplateAn Ubuntu 24.04 cloud-init template, downloaded and registered on any node without one.
  2. 02Bridge and networkvmbr0 if no bridge exists, and an ankra SDN network, 10.20.0.0/16 with NAT and DHCP.
  3. 03Bastion VMThe SSH jump host, on the primary node.
  4. 04Control plane VMskubeadm with Cilium, stacked etcd or dedicated etcd VMs, spread over your hosts.
  5. 05Worker VMsSizes from px-small to px-xlarge, balanced per node group and labelled with their host.
  6. 06Ingress, TLS and DNSTraefik and cert-manager, plus an ankra.cc subdomain. On by default.

Step by step

From an API token to kubectl get nodes.

The same flow works in the dashboard and the API. These are the CLI steps from the Proxmox VE guide.

Prefer to ask? Your AI client can call create_proxmox_cluster through the Ankra MCP server.
  1. 1

    Prepare each Proxmox node

    Install dnsmasq for the private network's DHCP and leave its own service disabled. The Proxmox API must use HTTPS and be reachable from Ankra, directly or through a jumphost.

    apt install dnsmasq && systemctl disable --now dnsmasq
  2. 2

    Store the Proxmox VE credential

    An API token with VM management privileges. If Ankra should set up storage or networking, it also needs Datastore.Allocate, Sys.Modify and SDN.Use. The CLI prompts for the secret.

    ankra credentials proxmox create --name my-pve \
  --api-url https://pve.example:8006 --token-id 'root@pam!ankra'
  3. 3

    Add an SSH key credential

    A Proxmox cluster takes a single key, your own or one Ankra generates.

    ankra credentials proxmox ssh-key create --name my-key --generate
  4. 4

    See what the credential can use

    Hosts, then storages, bridges and templates per host, and the VM sizes.

    ankra cluster proxmox hosts --credential-id <id>
ankra cluster proxmox sizes
  5. 5

    Create the cluster

    Pick the node, bridge and storage. --placement-nodes spreads over hosts and needs three control planes. Add --distribution k3s for k3s.

    ankra cluster proxmox create --name my-cluster --node pve01 \
  --placement-nodes pve01,pve02,pve03 --bridge ankra --storage local-lvm \
  --credential-id <id> --ssh-key-credential-id <key-id> \
  --control-plane-count 3 --worker-count 3
  6. 6

    Watch it come up, then use kubectl

    The cluster turns Online once the Ankra Agent connects. Kubeconfig access goes through Ankra and needs a Cluster Access grant.

    ankra cluster select my-cluster
ankra cluster operations list -w
ankra cluster kubeconfig add my-cluster --use
kubectl get nodes

Options

Defaults that work. Flags when they don't.

Everything below is a flag on create, a field in the dashboard wizard or a later command.

  • Spread across hosts

    Each control plane, etcd member and worker lands on the host with the fewest members of its role or group. Every node is labelled with its host, so topology spread works out of the box.

  • Behind a firewall

    Attach an SSH jumphost to the credential and Ankra reaches the Proxmox API and the VMs through it. Self-signed certificates work with --tls-insecure.

  • kubeadm or k3s

    kubeadm with Cilium is the default. k3s comes with Flannel, Calico or Cilium. --etcd-topology external gives dedicated etcd VMs on kubeadm.

  • Cluster Mesh with UpCloud

    Join Proxmox and UpCloud clusters into one Cilium ClusterMesh over an encrypted WireGuard overlay.

  • Costs for hardware you own

    Proxmox has no list pricing, so Cloud Cost prices each cluster from a rate card on its credential, starting from default rates you can change.

  • Stacks in Git

    Ingress, cert-manager, monitoring and your apps in versioned Stacks with dependency ordering, committed to a repository you connect.

  • Upgrades and node groups

    Upgrade, add, scale and resize from the CLI, dashboard or API. VM sizes are listed in the Proxmox VE reference.

  • AI operations

    A failing pod gets an analysis from its logs, events and deploy history, with a drafted fix for you to approve.

Compared

Hand-built on Proxmox, or built by Ankra.

Two honest ways to get Kubernetes onto hardware you own.

Your own scripts on ProxmoxProxmox VE + Ankra
Templates and networkingBuilt and kept in sync by handCreated where missing when the credential is saved
DistributionWhatever the scripts installkubeadm with Cilium, or k3s with Flannel, Calico or Cilium
Spread across hostsPlaced by handBalanced per role or node group, labelled by host
Upgrades and node groupsYour runbookUpgrade, add, scale and resize from the CLI, dashboard or API
Ingress and certificatesAssemble it yourselfTraefik and cert-manager, on by default
When it breaksYou, with kubectlAI analysis with a drafted fix for you to approve

Know before you build

Proxmox specifics.

  • There is no cloud controller manager, so LoadBalancer Services are not provisioned. Expose workloads with the ingress stack, NodePort or a load balancer you deploy yourself.
  • Host spread needs at least three control planes, and three or more hosts are recommended. With two hosts, losing the one with the control plane majority still takes the API down.
  • Ankra does not enrol VMs in Proxmox HA groups and never live-migrates them after a failure. Resilience comes from Kubernetes replicas spread across hosts.
  • The bastion runs on the primary node and is not spread. If that host fails, workloads keep running but Ankra cannot manage the cluster until it returns.
  • Node groups grow to larger sizes only. Each VM is powered off, resized and powered on. For smaller VMs, create a new group and delete the old one.

FAQ

Can Proxmox run Kubernetes?

Yes. Kubernetes runs on Proxmox VE as virtual machines. Ankra clones those VMs from a cloud-init template, installs kubeadm or k3s, and operates the cluster afterwards, including upgrades and node groups.

Should I use k3s or kubeadm on Proxmox?

Both are supported. kubeadm is the default, always uses Cilium, offers dedicated etcd VMs and is required for Cluster Mesh. k3s is lighter and lets you pick Flannel, Calico or Cilium as the CNI.

Do LoadBalancer Services work on Proxmox?

Not out of the box. Proxmox has no cloud controller manager, so Ankra does not provision LoadBalancer Services there. Use the ingress stack, NodePort Services or a load balancer you deploy yourself.

Does my Proxmox server need to be on the internet?

No. Attach an SSH jumphost to the Proxmox credential and Ankra tunnels the API calls and node SSH through it. The Ankra agent inside the cluster only makes outbound connections.

What does Ankra cost for a Proxmox cluster?

Ankra bills on worker vCPUs only. Every plan includes 30 worker vCPUs free, control planes are never billed, and the free tier needs no credit card. There is no cloud bill, because the hardware is yours.

Your first Proxmox cluster fits in the free allowance.

30 worker vCPUs included, control planes never billed, no credit card. Bring your Proxmox hosts.

Start free Read the Proxmox guide

Ankra is an independent platform and is not affiliated with or endorsed by Proxmox Server Solutions GmbH. Product details were checked against the Ankra documentation and CLI in October 2026.