Kubernetes on UpCloud
Kubernetes on UpCloud, the way we run ours.
Ankra's own production runs on UpCloud in Helsinki. One command builds the same private kubeadm cluster in your account, with ingress, TLS and DNS. Or Ankra creates and runs UKS for you.
$ ankra cluster upcloud create --name prod-hel --zone fi-hel1 \ --credential-id $UPCLOUD_CRED --ssh-key-credential-id $SSH_KEY \ --control-plane-count 3 --worker-count 3 UpCloud cluster 'prod-hel' created successfully! Cluster ID: 2c7f4a91-5e0b-4d36-8f12-b9a6e3d0c458 $ ankra cluster select prod-hel Selected cluster: prod-hel is now active.$ ankra cluster operations list -w Watching executions (every 5s, press Ctrl+C to stop) router, network, NAT gateway, bastion, servers, CCM and CSI, Traefik, DNS All executions have reached a terminal state. Stopping watch. $ ankra cluster kubeconfig add prod-hel --use Added context "ankra-prod-hel" to ~/.kube/config$ kubectl get nodes NAME STATUS ROLES AGE VERSION prod-hel-cp-1 Ready control-plane 7m v1.34.1 prod-hel-cp-2 Ready control-plane 7m v1.34.1 prod-hel-cp-3 Ready control-plane 7m v1.34.1 prod-hel-worker-1 Ready <none> 5m v1.34.1 prod-hel-worker-2 Ready <none> 5m v1.34.1 prod-hel-worker-3 Ready <none> 5m v1.34.1Sample session. Commands, flags and output wording are the Ankra CLI's own. Names, IDs, ages and versions are examples.
What one command builds
Private nodes, one public door.
Everything lands in your own UpCloud account. The bastion is the only server with a public IP, and it is an SSH jump host only. Egress goes through a managed NAT gateway.
- 01SDN router and networkA private network in the zone, with its range picked for you unless you pass one.
- 02NAT gatewayA managed UpCloud gateway for egress, so nodes have no public interface.
- 03BastionThe only public IP. SSH only, no traffic routes through it.
- 04Control planeskubeadm with Cilium, 1 or 3, stacked etcd or dedicated etcd servers.
- 05WorkersA default pool, plus node groups you add, scale and pin to a zone later.
- 06CCM and CSIThe UpCloud cloud controller manager for load balancers and the CSI driver for volumes.
- 07Ingress, TLS and DNSTraefik and cert-manager behind an UpCloud load balancer, plus an ankra.cc subdomain. On by default.
Step by step
From an API token to kubectl get nodes.
The same flow works in the dashboard and the API. These are the CLI steps from the UpCloud guide.
Prefer to ask? Your AI client can callcreate_upcloud_cluster through the Ankra MCP server.- 1
Store an UpCloud API token
The token needs permission to manage servers, networking, storage and Kubernetes. The CLI prompts for it.
ankra credentials upcloud create --name my-upcloud - 2
Add an SSH key credential
Bring your own public key or let Ankra generate one. It goes on every server.
ankra credentials upcloud ssh-key create --name my-key --generate - 3
Create the cluster
Pick a zone and the counts. Plans have defaults, and the dashboard wizard shows each plan's monthly price. Add
--distribution k3sfor k3s.ankra cluster upcloud create --name my-cluster --zone fi-hel1 \ --credential-id <id> --ssh-key-credential-id <key-id> \ --control-plane-count 3 --worker-count 3 - 4
Watch it come up, then use kubectl
The cluster turns Online once the Ankra Agent connects. Kubeconfig access goes through Ankra and needs a Cluster Access grant.
ankra cluster select my-cluster ankra cluster operations list -w ankra cluster kubeconfig add my-cluster --use kubectl get nodes
Options
Defaults that work. Flags when they don't.
Everything below is a flag on create, a field in the dashboard wizard or a later command.
kubeadm or k3s
kubeadm with Cilium is the default.
--distribution k3sfor k3s,--etcd-topology externalfor dedicated etcd servers.Or UKS, created and operated
Create UKS on a development or production plan, scale its pools with live pricing, upgrade it, or import one you already run. See the UKS guide.
Across zones, over WireGuard
Stretch a kubeadm cluster over three or more zones, one network and NAT gateway per zone, joined by a WireGuard mesh. Closed beta, switched on per organisation.
Cluster Mesh with Proxmox
Join UpCloud and Proxmox VE clusters into one Cilium ClusterMesh, so a global service resolves to healthy backends in either place.
Thirteen zones
From Helsinki and Stockholm to Chicago, Singapore and Sydney, listed in the UpCloud reference.
GitOps from day one
Pass a repository at create time and the cluster and its Stacks live in Git, synced by Ankra.
Stacks
Ingress, cert-manager, monitoring and your apps in versioned Stacks with dependency ordering.
AI operations
A failing pod gets an analysis from its logs, events and deploy history, with a drafted fix for you to approve.
Compared
UpCloud servers or UKS.
Both run with Ankra. The choice is who runs the control plane and what you need from it.
| UKS through Ankra | Ankra Managed on UpCloud servers | |
|---|---|---|
| Control plane | Run by UpCloud | Runs on your UpCloud servers, operated by Ankra |
| Distribution | UKS, on a development or production plan | kubeadm with Cilium, or k3s |
| Spread across zones | Not managed by Ankra | WireGuard mesh over three or more zones (closed beta) |
| Node autoscaling | UpCloud Cluster Autoscaler, run by you | Autoscaling bounds per node group |
| Cluster Mesh with Proxmox | No | Yes, on kubeadm |
| Already running one | Import the UKS cluster untouched | Build a new cluster |
Know before you build
UpCloud specifics.
- Every UpCloud private network, router and load balancer lives in one zone. Block storage is zone local, so on a multi-zone cluster volumes and load balancers stay in the primary zone.
- Multi-zone needs kubeadm, at least three zones and three control planes, and is decided at create time. A single-zone cluster that may grow is created with
--network-mode wireguard_mesh. - Node groups move to larger plans only. Each node is powered off, resized and powered on. For smaller nodes, create a new group and delete the old one.
- A stop takes an encrypted etcd snapshot and deletes the servers, bastion and NAT gateway. CSI volumes are kept, and UpCloud keeps billing them.
- On UKS you run UpCloud's Cluster Autoscaler yourself. Ankra never fights it once a pool is marked as externally managed.
FAQ
Does UpCloud have managed Kubernetes?
Yes. UpCloud Managed Kubernetes (UKS) runs the control plane for you. Ankra can create UKS clusters, manage their node pools and upgrades, and import UKS clusters you already run. Ankra can also build kubeadm or k3s on plain UpCloud servers when you want control over the distribution and networking.
Which UpCloud zones can I use?
Thirteen: fi-hel1, fi-hel2, de-fra1, nl-ams1, uk-lon1, se-sto1, pl-waw1, es-mad1, us-chi1, us-nyc1, us-sjo1, sg-sin1 and au-syd1. Available plans can vary by zone.
Can a Kubernetes cluster span several UpCloud zones?
UpCloud private networks stay inside one zone, so a cluster is single-zone by default. Ankra can stretch a kubeadm cluster across three or more zones with one network and NAT gateway per zone and a WireGuard mesh between the nodes. It is in closed beta, so contact support to have it switched on.
What does Ankra cost on top of UpCloud?
Ankra bills on worker vCPUs only. Every plan includes 30 worker vCPUs free, control planes are never billed, and the free tier needs no credit card. UpCloud bills you directly for the servers, storage and network.
Is there an UpCloud trial?
UpCloud has offered a 500 euro trial over 30 days through its signup page. Check the current terms on UpCloud's site before you rely on it.
Your first UpCloud cluster fits in the free allowance.
30 worker vCPUs included, control planes never billed, no credit card. Bring your UpCloud account.
Ankra is an independent platform and is not affiliated with or endorsed by UpCloud Ltd. UpCloud prices and offers can change, so check upcloud.com for current terms. Product details were checked against the Ankra documentation and CLI in October 2026.