Kubernetes on OVHcloud
Kubernetes on OVHcloud, across three zones.
One command builds a private kubeadm cluster on Public Cloud instances in your own project, spread over the three zones of a 3-AZ region, with ingress, TLS and DNS, or Ankra creates and runs OVHcloud MKS for you.
OVHcloud bills you for the instances. Ankra is free up to 30 worker vCPUs, and control planes are never billed.
$ ankra cluster ovh create --name prod-par --region EU-WEST-PAR \ --availability-zones eu-west-par-a,eu-west-par-b,eu-west-par-c \ --credential-id $OVH_CRED --ssh-key-credential-id $SSH_KEY \ --control-plane-count 3 --worker-count 3 OVH cluster 'prod-par' created successfully! Cluster ID: 9e4b7d20-1c6a-4f83-b2d5-7a0e3c9f6b14 $ ankra cluster select prod-par Selected cluster: prod-par is now active.$ ankra cluster operations list -w Watching executions (every 5s, press Ctrl+C to stop) vRack network, gateway, bastion, instances in 3 zones, CCM, Cinder CSI, Traefik, DNS All executions have reached a terminal state. Stopping watch. $ ankra cluster kubeconfig add prod-par --use Added context "ankra-prod-par" to ~/.kube/config$ kubectl get nodes -L topology.kubernetes.io/zone NAME STATUS ROLES AGE VERSION ZONE prod-par-cp-1 Ready control-plane 7m v1.34.1 eu-west-par-a prod-par-cp-2 Ready control-plane 7m v1.34.1 eu-west-par-b prod-par-cp-3 Ready control-plane 7m v1.34.1 eu-west-par-c prod-par-worker-1 Ready <none> 5m v1.34.1 eu-west-par-a prod-par-worker-2 Ready <none> 5m v1.34.1 eu-west-par-b prod-par-worker-3 Ready <none> 5m v1.34.1 eu-west-par-cSample session. Commands, flags and output wording are the Ankra CLI's own. Names, IDs and versions are examples.
What one command builds
Private nodes, one public door.
Everything lands in your own Public Cloud project. The bastion is the only instance with a public IP, and it is an SSH jump host, not a router.
Yours
Your Git repositories
Desired state for clusters, stacks and applications.
Ankra
Control plane
UI, API and orchestration at platform.ankra.app. Holds metadata, not your workloads.
Your Public Cloud project
Kubernetes cluster
- Bastion
- Control planes
- Workers
Ankra agent, one per cluster
- vRack networkA private VLAN with a DHCP subnet for every instance.
- Network gatewayA managed OVHcloud gateway for egress, so nodes need no public IP.
- BastionThe only public IP. SSH only, a c3-4 instance by default.
- Control planeskubeadm with Cilium. Three spread over the zones of a 3-AZ region.
- Workersb3-16 by default, each node group spread over the zones or pinned to one.
- CCM and Cinder CSIOpenStack cloud controller manager and the
csi-cinder-sc-topologyStorageClass. - Ingress, TLS and DNSTraefik and cert-manager behind an OVHcloud load balancer, plus an ankra.cc subdomain. On by default.
Step by step
From API keys to kubectl get nodes.
The same flow works in the dashboard and the API. These are the CLI steps from the OVHcloud guide.
Prefer to ask? Your AI client can callcreate_ovh_cluster through the Ankra MCP server.Store your OVHcloud API credentials
Ankra needs an application key, application secret and consumer key, plus your Public Cloud project ID. The CLI prompts for the keys.
ankra credentials ovh create --name my-ovh --project-id <project-id>Add an SSH key credential
Bring your own public key or let Ankra generate one. It goes on every instance.
ankra credentials ovh ssh-key create --name my-key --generateCheck which regions your project can use
Regions differ per project. A region not enabled on the private network fails during network setup.
--with-zonesmarks the 3-AZ regions.ankra cluster ovh regions --credential-id <id> --with-zonesCreate the cluster
Flavors default to b3-16 for control planes and workers and c3-4 for the bastion. Add
--distribution k3sfor k3s.ankra cluster ovh create --name my-cluster --region EU-WEST-PAR \ --availability-zones eu-west-par-a,eu-west-par-b,eu-west-par-c \ --credential-id <id> --ssh-key-credential-id <key-id> \ --control-plane-count 3 --worker-count 3Watch it come up, then use kubectl
The cluster turns Online once the Ankra Agent connects. Kubeconfig access goes through Ankra and needs a Cluster Access grant.
ankra cluster select my-cluster ankra cluster operations list -w ankra cluster kubeconfig add my-cluster --use kubectl get nodes
Options
Defaults that work. Flags when they don't.
Everything below is a flag on create, a field in the dashboard wizard or a later command.
Compared
Public Cloud instances or MKS.
Both run with Ankra. The choice is who runs the control plane and how much placement control you need.
| Compared on | OVHcloud MKS through Ankra | Ankra Managed on OVHcloud instances |
|---|---|---|
| Control plane | Run by OVHcloud, on the free or standard plan | Runs on your instances, operated by Ankra |
| Distribution | MKS | kubeadm with Cilium, or k3s |
| Availability zones | Anti-affinity where OVHcloud supports it | Spread or pin node groups in 3-AZ regions |
| Node autoscaling | Autoscaling bounds per node pool | Autoscaling bounds per node group |
| Already running one | Import the MKS cluster untouched | Build a new cluster |
Know before you build
OVHcloud specifics.
- OVHcloud block storage is zonal. Spread nodes alone do not make a database survive a zone outage. Replicate at the application layer, for example CloudNativePG with one replica per zone.
- Zone placement for volumes is pending on OVHcloud. Until it returns, pin each stateful replica to a node group in one zone so its pod lands where its volume is.
- Node groups move to larger flavors only. Each node is powered off, resized and powered on. For smaller nodes, create a new group and delete the old one.
- Control planes cannot move to new zones in place. A zone-spread control plane on an existing cluster means recreating it. Workers move by adding a pinned node group.
- A stop takes an encrypted etcd snapshot and deletes the instances, bastion and gateway. The private network and Cinder volumes are kept, and the volumes keep billing.
FAQ
Common questions
Does OVHcloud have managed Kubernetes?
Yes. OVHcloud Managed Kubernetes (MKS) runs the control plane on a free or standard plan. Ankra can create MKS clusters, manage their node pools and upgrades, and import MKS clusters you already run. Ankra can also build kubeadm or k3s on Public Cloud instances when you want control over the distribution, the network and zone placement.
Can a Kubernetes cluster on OVHcloud span availability zones?
Yes, in the 3-AZ regions EU-WEST-PAR and EU-SOUTH-MIL. Ankra spreads control planes and each node group across the three zones, and refuses a spread with fewer than three control planes. Every other OVHcloud region is a single failure domain.
Which OVHcloud regions can I use?
The regions enabled on each Public Cloud project differ, so run ankra cluster ovh regions with your credential before you create a cluster. Add --with-zones to see which regions are 3-AZ.
What does Ankra cost on top of OVHcloud?
Ankra bills on worker vCPUs only. Every plan includes 30 worker vCPUs free, control planes are never billed, and a small trial needs no card; adding one unlocks full access and €59 of welcome credit. OVHcloud bills you directly for the instances, storage and network.
Ankra is an independent platform and is not affiliated with or endorsed by OVH SAS. OVHcloud prices and regions can change, so check ovhcloud.com for current terms. Product details were checked against the Ankra documentation and CLI in October 2026.
Your next chapter
Your first OVHcloud cluster fits in the free allowance.
30 worker vCPUs included, control planes never billed, a small trial without a card. Bring your Public Cloud project.
From something you built to something people use.
- Deploy from your repository
- Run on infrastructure you choose
- Operate with your team and agents