Northflank alternative
The Northflank alternative where you decide what the platform holds.
Ankra builds Kubernetes on the provider you choose, or imports the cluster you already run in production, ships your code to it through scanned pipelines, and operates it with vulnerability ranking, cost, backups and AI that waits for your approval. Your workloads run in your own cluster, and you decide which secrets the platform holds.
30 worker vCPUs free for life. Controller nodes never billed. Unlimited team members.
- Cluster secrets become digests. The agent replaces every Secret value with a SHA-256 digest before cluster data leaves, and the AI never sees the values. What Ankra can see.
- Pipeline secrets are files, not environment variables. Only the stages that list a secret can read it, and pull requests from forks get none.
- Your production cluster is welcome. Import any conformant cluster with one Helm command, or let Ankra build one on Hetzner, OVHcloud, UpCloud, DigitalOcean, AWS or Proxmox VE.
- €0.01 per worker vCPU an hour. The first 30 are free on every plan, and controller nodes are never billed. Pricing.
On 30 October 2026 Northflank disclosed a security incident and told customers to "Assume all environment variables have been decrypted. Disable/rotate all keys." It later reported unauthorised use of AI API keys supplied to its platform. If you are here because of that, rotate first: revoke each key with the provider that issued it, not only in Northflank, and check your AI providers' usage and billing for activity you did not start.
Then compare platforms by what they hold, and by what they do once your code is running. This page is the short version. The full, sourced comparison is Ankra vs Northflank.
Your workloads run in your cluster.
You decide which secrets Ankra holds.
Your workloads run in a Kubernetes cluster of your own, in your cloud account or on your servers, so their secrets can be created there or synced from your own secret manager with External Secrets or Vault, and Ankra's inventory holds only their digests. Reading a value through Ankra takes its own permission, and every reveal is written to the audit log.
What you do give Ankra, such as cloud, Git and registry credentials and your organisation's SOPS key, is stored encrypted in an OpenBao or HashiCorp Vault secret store in the EU and decrypted only when an action needs it. Ankra's AI runs on Ankra's own model key by default, within your plan's monthly allowance, so you can start without handing the platform an AI key. Values stored with ankra secrets go in and never come out.
# Ankra generates the value. Nobody ever sees it.
ankra secrets create db-password --generate
# Rotated in place, delivered on the next deploy
ankra secrets rotate db-password --generate
# Names, ids and users. Never a value.
ankra secrets listClusters built or imported
kubeadm or k3s on Hetzner, OVHcloud, UpCloud, DigitalOcean, AWS EC2 and Proxmox VE, plus EKS, GKE, AKS, DOKS, MKS and UKS, and import of any cluster, production included.
Pipelines in your cluster
Tests, rootless builds and Semgrep, Checkov and Trivy gates. Build once and promote the tested image, a merge train, signed provenance and pull-request previews.
Stacks across a fleet
Any Helm chart or manifest in dependency order, versioned stack profiles rolled out across clusters, and two-way Git sync.
CVEs ranked by real exploitation
With the security baseline on, the Security Center ranks vulnerabilities in running workloads by CISA KEV and EPSS, with SBOMs and CIS, NSA/CISA and Pod Security compliance evidence.
AI that runs the platform
Alert analysis on every firing alert, an AI board with role agents, PR reviews and fix PRs. Every write waits for a person by default.
Cost and backups
Spend per cluster, namespace and stack, repricing on other providers, and backups of volumes and databases to a bucket you own.
Move from Northflank to Ankra
Rotate first, then move one service and compare with real workloads in front of you.
- 1
Rotate every key
Revoke each key with the provider that issued it and create a new one. Move the new values, not the old ones.
- 2
Create an Ankra account and a cluster
Let Ankra build a cluster on your provider, or import one you already run with one Helm command. The import guide covers the details.
- 3
Connect the repository
Register the service as an Application. Ankra reads the repository and opens a setup pull request with the Dockerfile, chart and pipeline.
- 4
Put the new secrets in your cluster
Create them in the cluster, sync them from your own secret manager, or store them with ankra secrets so the value never lives in Git.
ankra secrets create stripe-key --from-file ./stripe.key - 5
Move the data and cut over
Restore each database into the new cluster, protect the stack into a bucket you own, then point your DNS at the new service.
Northflank and Ankra side by side
Checked on 2 November 2026 against Northflank's documentation, pricing, security page and status page.
| Northflank | Ankra | |
|---|---|---|
| Clusters it builds | EKS, GKE, AKS, Oracle OKE, Civo, CoreWeave, Nebius and AWS European Sovereign Cloud, bare metal on Enterprise, or Northflank's own cloud | kubeadm or k3s on Hetzner, OVHcloud, UpCloud, DigitalOcean, AWS EC2 and Proxmox VE, plus EKS, GKE, AKS, DOKS, MKS and UKS |
| Clusters you already run | Must use Cilium, and the <a href="https://northflank.com/docs/v1/application/bring-your-own-cloud/import-an-existing-cluster-byok" target="_blank" rel="noopener noreferrer" class="text-indigo-600 dark:text-indigo-400 hover:underline">import docs</a> say not to import clusters running production workloads | Any conformant cluster, production included, with one Helm command |
| Secrets | Secret groups injected at runtime. Customers were told to assume all environment variables were decrypted | Ankra's inventory holds digests of cluster secrets. What you give Ankra sits in a Vault store, every reveal audited |
| Build and release | Dockerfile or Buildpacks, visual Workflows with approval nodes, preview environments | Pipelines in your cluster with scan gates, build once and promote, merge train, signed provenance, previews |
| Vulnerabilities | Opt-in scanning of images it builds, automatic with policy on Enterprise | With the security baseline on, running workloads across your clusters, ranked by CISA KEV and EPSS, with SBOMs and compliance evidence |
| AI | Sandboxes for AI-generated code, Cloud Harnesses and an MCP server | Alert analysis, AI board, PR reviews and fix PRs, approval by default, MCP server with 450+ tools |
| Control plane | Google Cloud in London or Amsterdam, or forward-deployed in your VPC with air-gap support on Enterprise | In the EU, in Finland. Self-hosted, including air-gapped, on Enterprise |
| Price in your own cloud | $0.02083 per node vCPU an hour on pay as you go, and one BYOC cluster up to 12 vCPU free on Sandbox | €0.01 per worker vCPU an hour on Startup, first 30 free, controller nodes free |
Where Northflank fits well
Northflank is a good product, and for these teams it may still be the right one.
No cluster of your own
Northflank can run your services on its own cloud, with no cluster to think about. With Ankra, every workload runs on a Kubernetes cluster of your own.
Managed databases first
Northflank's managed PostgreSQL, MySQL, MongoDB, Redis, MinIO and RabbitMQ come with backups. Ankra's own managed services are in closed beta.
Approval nodes in release workflows
Northflank's visual Workflows include approval nodes. Ankra Pipelines gate on tests and scans, and promote a tested image without rebuilding it.
Untrusted code in microVMs
Northflank runs workloads in Kata Containers microVMs by default and offers sandboxes for AI-generated code.
When to stay with Northflank
Ankra is not the right switch for everyone. Northflank may suit you better when one of these is true.
- You want to run on a platform's own cloud, with no cluster of your own.
- Managed databases are the centre of your stack.
- You run untrusted or AI-generated code that needs microVM isolation.
What we know about the incident
Northflank's status page says a threat alert from Wiz arrived at 11:43 UTC on 30 October 2026, followed by network policy patches the same day. At 13:58 UTC it told customers to "Assume all environment variables have been decrypted. Disable/rotate all keys." At 23:38 UTC it wrote that "Users have reported unauthorised use of AI API keys supplied to the Northflank platform." Over 30 and 31 October it added secret rotation for its add-ons, and on 31 October it enabled audit logs for all customers, including free users.
On 2 November Northflank moved the incident to monitoring. It said it believes the attack vector was contained within an hour, that the attack was focused on secrets held in its control plane and did not reach running workloads, that customers on forward-deployed or dedicated control planes were unaffected, and that it had patched CVE-2026-98432 across its fleet. It intends to share a root cause analysis once its findings are confirmed.
Wiz counts it among at least nine incidents at AI developer platforms in October 2026, with attackers hunting stored environment variables that grant AI access. That is why the useful question for any platform, Ankra included, is what it holds. Ankra answers it on one page: What Ankra can see and do.
Guides and comparisons
Questions teams actually ask
What is the best Northflank alternative?+
It depends on why you are leaving. If you want the cluster in your own account or on your own servers, built or imported with production workloads, and security ranking, cost, backups and AI operations in the same product, Ankra covers that. If you want a platform's own cloud with no cluster of your own, a PaaS that hosts the compute may suit you better.
What happened in the Northflank security incident?+
On 30 October 2026 Northflank disclosed a security incident after a threat alert from Wiz, told customers to assume all environment variables had been decrypted and to disable or rotate all keys, and later reported unauthorised use of AI API keys supplied to its platform. On 2 November it said the attack was focused on secrets held in its control plane, that running workloads and customers on forward-deployed or dedicated control planes were unaffected, and that it had patched CVE-2026-98432. It intends to share a root cause analysis once its findings are confirmed.
What does Ankra hold of my secrets?+
Ankra's inventory of your cluster holds SHA-256 digests of Secret values, not the values, the AI never sees them, and reading one through Ankra takes its own permission and is written to the audit log. What you give Ankra itself, such as cloud, Git and registry credentials, values stored with ankra secrets and your organisation's SOPS key, is stored encrypted in an OpenBao or HashiCorp Vault secret store in the EU and decrypted only when an action needs it.
Can I import the cluster Northflank runs in my account?+
Ankra imports any conformant Kubernetes cluster with one Helm command, production clusters included. The agent only makes outbound connections, so the cluster can stay behind a firewall or NAT.
How does Ankra pricing compare with Northflank?+
For clusters in your own cloud, Northflank's pay-as-you-go plan charges $0.02083 per node vCPU an hour. Ankra charges €0.01 per worker vCPU an hour on the Startup plan, the first 30 worker vCPUs are free on every plan, and controller nodes are never billed. Your provider bills the servers.
Run your next platform in your own cloud
30 worker vCPUs free for life, controller nodes never billed, unlimited team members. Build a cluster on your provider or import the one you run.
Ankra is an independent platform and is not affiliated with or endorsed by Northflank. Northflank details, including the incident timeline, were checked on 2 November 2026 against its public documentation, pricing, security page and status page, and can change.