<!-- Generated from the canonical HTML page. Do not edit separately. -->
# Kubernetes on OVHcloud, Across Three Zones | Ankra

Canonical: https://ankra.ai/kubernetes-on-ovhcloud

Kubernetes on OVHcloud in one command. Ankra builds kubeadm or k3s on Public Cloud instances in your own project, spread over a 3-AZ region, or creates and runs OVHcloud MKS.

Kubernetes on OVHcloud

# Kubernetes on OVHcloud,  across three zones.

One command builds a private kubeadm cluster on Public Cloud instances in your own project, spread over the three zones of a 3-AZ region, with ingress, TLS and DNS. Or Ankra creates and runs OVHcloud MKS for you.

[Start free](https://platform.ankra.app/auth/signup)  [OVHcloud guide](https://docs.ankra.ai/guides/ovh-clusters)

zsh · ankra cli

```
$ ankra cluster ovh create --name prod-par --region EU-WEST-PAR \    --availability-zones eu-west-par-a,eu-west-par-b,eu-west-par-c \    --credential-id $OVH_CRED --ssh-key-credential-id $SSH_KEY \    --control-plane-count 3 --worker-count 3  OVH cluster 'prod-par' created successfully!    Cluster ID: 9e4b7d20-1c6a-4f83-b2d5-7a0e3c9f6b14 $ ankra cluster select prod-par  Selected cluster: prod-par is now active.$ ankra cluster operations list -w  Watching executions (every 5s, press Ctrl+C to stop)  vRack network, gateway, bastion, instances in 3 zones, CCM, Cinder CSI, Traefik, DNS  All executions have reached a terminal state. Stopping watch. $ ankra cluster kubeconfig add prod-par --use  Added context "ankra-prod-par" to ~/.kube/config$ kubectl get nodes -L topology.kubernetes.io/zone  NAME               STATUS   ROLES           AGE   VERSION   ZONE  prod-par-cp-1      Ready    control-plane   7m    v1.34.1   eu-west-par-a  prod-par-cp-2      Ready    control-plane   7m    v1.34.1   eu-west-par-b  prod-par-cp-3      Ready    control-plane   7m    v1.34.1   eu-west-par-c  prod-par-worker-1  Ready    <none>          5m    v1.34.1   eu-west-par-a  prod-par-worker-2  Ready    <none>          5m    v1.34.1   eu-west-par-b  prod-par-worker-3  Ready    <none>          5m    v1.34.1   eu-west-par-c
```

Sample session. Commands, flags and output wording are the Ankra CLI's own. Names, IDs and versions are examples.

What one command builds

## Private nodes,  one public door.

Everything lands in your own Public Cloud project. The bastion is the only instance with a public IP, and it is an SSH jump host, not a router.

1. 01  vRack network  A private VLAN with a DHCP subnet for every instance.
2. 02  Network gateway  A managed OVHcloud gateway for egress, so nodes need no public IP.
3. 03  Bastion  The only public IP. SSH only, a c3-4 instance by default.
4. 04  Control planes  kubeadm with Cilium. Three spread over the zones of a 3-AZ region.
5. 05  Workers  b3-16 by default, each node group spread over the zones or pinned to one.
6. 06  CCM and Cinder CSI  OpenStack cloud controller manager and the `csi-cinder-sc-topology` StorageClass.
7. 07  Ingress, TLS and DNS  Traefik and cert-manager behind an OVHcloud load balancer, plus an ankra.cc subdomain. On by default.

Step by step

## From API keys to kubectl get nodes.

The same flow works in the dashboard and the API. These are the CLI steps from the  [OVHcloud guide](https://docs.ankra.ai/guides/ovh-clusters) .

 [Prefer to ask? Your AI client can call `create_ovh_cluster` through the Ankra MCP server.](https://ankra.ai/kubernetes-mcp-server)

1. 1

  ### Store your OVHcloud API credentials

  Ankra needs an application key, application secret and consumer key, plus your Public Cloud project ID. The CLI prompts for the keys.

  ```
  ankra credentials ovh create --name my-ovh --project-id <project-id>
  ```
2. 2

  ### Add an SSH key credential

  Bring your own public key or let Ankra generate one. It goes on every instance.

  ```
  ankra credentials ovh ssh-key create --name my-key --generate
  ```
3. 3

  ### Check which regions your project can use

  Regions differ per project. A region not enabled on the private network fails during network setup. `--with-zones` marks the 3-AZ regions.

  ```
  ankra cluster ovh regions --credential-id <id> --with-zones
  ```
4. 4

  ### Create the cluster

  Flavors default to b3-16 for control planes and workers and c3-4 for the bastion. Add `--distribution k3s` for k3s.

  ```
  ankra cluster ovh create --name my-cluster --region EU-WEST-PAR \
    --availability-zones eu-west-par-a,eu-west-par-b,eu-west-par-c \
    --credential-id <id> --ssh-key-credential-id <key-id> \
    --control-plane-count 3 --worker-count 3
  ```
5. 5

  ### Watch it come up, then use kubectl

  The cluster turns Online once the Ankra Agent connects. Kubeconfig access goes through Ankra and needs a Cluster Access grant.

  ```
  ankra cluster select my-cluster
  ankra cluster operations list -w
  ankra cluster kubeconfig add my-cluster --use
  kubectl get nodes
  ```

Options

## Defaults that work.  Flags when they don't.

Everything below is a flag on create, a field in the dashboard wizard or a later command.

- ### Three zones in one region

  In EU-WEST-PAR and EU-SOUTH-MIL, control planes and each node group spread across the zones. A spread needs three control planes, so etcd keeps quorum when a zone goes down.
- ### kubeadm or k3s

  kubeadm with Cilium is the default. `--distribution k3s` for k3s, `--etcd-topology external` for dedicated etcd instances.
- ### Or MKS, created and operated

  Create MKS on the free or standard plan, run its pools and upgrades from Ankra, or import one you already run. See the  [MKS guide](https://docs.ankra.ai/guides/ovh-mks-clusters) .
- ### First-boot scripts

  A node group can carry a cloud-init document that runs on every instance it creates, replacements included, with labels and taints set when the group is added.
- ### SSH without a VPN

  `ankra cluster ovh access-info` prints the bastion jump and API tunnel commands for a cluster.
- ### GitOps from day one

  Pass a repository at create time and the cluster and its Stacks live in Git, synced by Ankra.
- ### Stacks

  Ingress, cert-manager, monitoring and your apps in versioned Stacks with dependency ordering.
- ### AI operations

  A failing pod gets an analysis from its logs, events and deploy history, with a drafted fix for you to approve.

Compared

## Public Cloud instances or MKS.

Both run with Ankra. The choice is who runs the control plane and how much placement control you need.

|  | OVHcloud MKS through Ankra | Ankra Managed on OVHcloud instances |
| --- | --- | --- |
| Control plane | Run by OVHcloud, on the free or standard plan | Runs on your instances, operated by Ankra |
| Distribution | MKS | kubeadm with Cilium, or k3s |
| Availability zones | Anti-affinity where OVHcloud supports it | Spread or pin node groups in 3-AZ regions |
| Node autoscaling | Autoscaling bounds per node pool | Autoscaling bounds per node group |
| Already running one | Import the MKS cluster untouched | Build a new cluster |

Know before you build

## OVHcloud specifics.

- OVHcloud block storage is zonal. Spread nodes alone do not make a database survive a zone outage. Replicate at the application layer, for example CloudNativePG with one replica per zone.
- Zone placement for volumes is pending on OVHcloud. Until it returns, pin each stateful replica to a node group in one zone so its pod lands where its volume is.
- Node groups move to larger flavors only. Each node is powered off, resized and powered on. For smaller nodes, create a new group and delete the old one.
- Control planes cannot move to new zones in place. A zone-spread control plane on an existing cluster means recreating it. Workers move by adding a pinned node group.
- A stop takes an encrypted etcd snapshot and deletes the instances, bastion and gateway. The private network and Cinder volumes are kept, and the volumes keep billing.

## FAQ

### Does OVHcloud have managed Kubernetes?

Yes. OVHcloud Managed Kubernetes (MKS) runs the control plane on a free or standard plan. Ankra can create MKS clusters, manage their node pools and upgrades, and import MKS clusters you already run. Ankra can also build kubeadm or k3s on Public Cloud instances when you want control over the distribution, the network and zone placement.

### Can a Kubernetes cluster on OVHcloud span availability zones?

Yes, in the 3-AZ regions EU-WEST-PAR and EU-SOUTH-MIL. Ankra spreads control planes and each node group across the three zones, and refuses a spread with fewer than three control planes. Every other OVHcloud region is a single failure domain.

### Which OVHcloud regions can I use?

The regions enabled on each Public Cloud project differ, so run ankra cluster ovh regions with your credential before you create a cluster. Add --with-zones to see which regions are 3-AZ.

### What does Ankra cost on top of OVHcloud?

Ankra bills on worker vCPUs only. Every plan includes 30 worker vCPUs free, control planes are never billed, and a small trial needs no card; adding one unlocks full access and €59 of welcome credit. OVHcloud bills you directly for the instances, storage and network.

## Your first OVHcloud cluster  fits in the free allowance.

30 worker vCPUs included, control planes never billed, a small trial without a card. Bring your Public Cloud project.

[Start free](https://platform.ankra.app/auth/signup)  [Read the OVHcloud guide](https://docs.ankra.ai/guides/ovh-clusters)

Ankra is an independent platform and is not affiliated with or endorsed by OVH SAS. OVHcloud prices and regions can change, so check ovhcloud.com for current terms. Product details were checked against the Ankra documentation and CLI in October 2026.