Two ways to put a platform on Kubernetes
Qovery is a capable platform with substantial overlap. It provisions EKS, GKE, AKS or Scaleway Kapsule in your cloud account, then gives developers environments, preview environments, managed database blueprints and AI agents on top. It is French, ships often, and has the compliance paperwork many buyers ask for.
Ankra covers the developer path too, and starts one step lower on more infrastructure. It also builds the Kubernetes control plane and workers on ordinary servers, takes any cluster you already run, and carries tests, scans, workload security, cost and backups into the same product.
If your foundation is EKS, GKE, AKS or Kapsule, evaluate Qovery closely. If you want the product to build and operate Kubernetes on European providers or your own servers, Ankra covers more.
Where the cluster comes from
Qovery’s native provisioning creates provider-managed Kubernetes: EKS with Karpenter, GKE Autopilot, AKS and Kapsule. It includes networking and cluster maintenance on that path, and its EKS Anywhere integration is available on request for private sites. In November 2024 it announced it was decommissioning its EC2 (k3s) offer.
On 4 November 2026 Qovery introduced the Qovery Operator for clusters you already run. It is in preview for organisations on the Enterprise plan. You install it with one Helm command, it only opens outbound connections, and Qovery then installs and updates its own components, including Envoy Gateway, cert-manager, ExternalDNS and Loki. Its requirements are specific: an EKS, GKE or Kapsule cluster on Kubernetes 1.31 or later that does not already run cert-manager, ExternalDNS or Envoy Gateway, and a node with 4 vCPU and 8 GiB free. Observe and the monitoring graphs are not available on these clusters yet. AKS, k3s and on-premises clusters use the older CLI install, and on every connected cluster the lifecycle, storage and upgrades stay with your team.
Ankra builds kubeadm or k3s on AWS EC2, Hetzner, OVHcloud, UpCloud, DigitalOcean and Proxmox VE, with a private network, a bastion and the storage driver. It creates EKS, GKE, AKS, DOKS, OVHcloud MKS and UpCloud UKS, with Scaleway Kapsule in closed beta. It imports any running, conformant cluster as it is, with one Helm command and an outbound-only agent, and it does not ask you to remove the ingress, certificate or DNS tooling you already run. Azure and Google Cloud are reached through AKS and GKE or by import; Ankra does not build kubeadm or k3s on Azure VMs or Google Compute Engine.
Scaling and cost
Qovery’s node scaling uses Karpenter on EKS, GKE Autopilot, and provider autoscaling on AKS and Kapsule. Those mechanisms remove substantial operating work on its native clouds. Its cost controls include spot instances, environment schedules and right-sizing recommendations from historical usage.
Ankra’s node autoscaling connects the upstream Cluster Autoscaler to Ankra’s provisioning, so the same integration adds and removes workers on AWS EC2, Hetzner, OVHcloud, UpCloud and DigitalOcean. You set minimum and maximum counts per node group, from one worker. It scales the group’s existing server type; it does not choose a new instance type per pod the way Karpenter can. On clusters it builds, Ankra also runs upgrades, rolling OS security patching and power schedules.
Ankra’s Cloud Cost estimates spend from list prices per cluster, namespace and stack, recommends savings, and reprices a whole cluster on other providers, or on your own rate card for private capacity. Budgets and the cost autopilot work through the CLI, API and Ankra AI; their portal screen is in closed beta. Estimates still need a separate review of egress, discounts and migration effort before they become a buying decision.
Releases and the security of what runs
Qovery has built-in image builds and ordered deployment stages, lifecycle jobs, external CI integrations and, since October, Deploy by Version to pick a commit, tag or chart per service. By default its builds run on Qovery-operated build workers, and you can run them in your own cluster instead. It documents SSO, custom roles, audit logs and secret managers, and in November it gave custom roles separate shell and port-forward permissions and added cross-account AWS secret access.
Ankra Pipelines declare tests, rootless image builds, Semgrep, Checkov and Trivy scans and a policy gate, then publish the approved digest. A merge train on GitHub tests each pull request as the commit its merge will produce, and verified provenance lets an application refuse images your gate did not sign. Pipeline authority comes from an admin-approved default-branch definition, so a pull request cannot widen its own permissions. Some stage kinds, including in-pipeline approval and verification, do not run yet, and builds can use Ankra’s platform builders unless you set ci_build_fallback: none to keep source inside your infrastructure.
Ankra’s Security Center lists vulnerabilities in running workloads across the fleet and ranks them by CISA’s Known Exploited Vulnerabilities catalogue and FIRST’s EPSS scores, with optional SBOMs and scanner coverage per cluster. Each application’s Security section puts its pipeline findings beside its image CVEs, and backups write volumes and database dumps to a bucket you own. Qovery’s published security material does not describe an equivalent vulnerability view. Qovery claims SOC 2 Type II, GDPR, HIPAA and DORA, and its pricing lists ISO 27001 and HDS on Enterprise. If you need a certified vendor today, that matters; Ankra’s own status is on its trust page.
AI on both sides
Qovery’s AI Copilot, which its documentation calls experimental, works in the Console, Slack and its MCP server. It starts read-only, and read-write needs an admin to turn it on. Agent Tasks run AI agents inside your infrastructure, with templates, run history and cost per run, and its MCP server is read-only unless you enable write access.
Ankra’s assistant answers from your clusters, AI Insights analyses every firing alert, the AI board runs work through role agents with a person approving, and the AI Gateway reviews pull requests on GitHub, GitLab and Bitbucket Cloud and fixes failing ones. Ankra’s own AI asks before every write by default. The MCP server offers more than 500 tools; its writes are audited, and your MCP client decides how it confirms them.
Price
Qovery’s plans:
- Free: $0, with 3 users, one cluster of your own on Kubernetes 1.31 or later, and 1,000 deployment minutes a month. Deployments pause at the limit.
- Starter: $299 a month billed yearly, with 3 users, one cluster and 3,000 deployment minutes.
- Growth: $899 a month billed yearly, with 10 users, two clusters and 8,000 deployment minutes.
- Scale: $2,999 a month billed yearly, with up to 25 users, three clusters at $399 a month for each extra one, and 30,000 deployment minutes.
- Enterprise: custom, with unlimited clusters and a self-hosted control plane, including air-gapped.
Extra deployment minutes on paid plans cost $0.16 each, and the Observe package costs $3,588 per cluster a year, with one cluster included on Growth and Scale. AI agents do not count as users.
Ankra’s Free tier includes 30 worker vCPU. Beyond that, the Startup plan charges €0.01 per worker vCPU an hour, about €7.20 a month. Controller nodes are never billed, and your provider bills the servers. Neither a feature list nor a list-price comparison establishes the savings your team will achieve.
When to choose Ankra, and when to choose Qovery
Choose Ankra when you want the product to build and operate Kubernetes on Hetzner, OVHcloud, UpCloud, DigitalOcean, AWS EC2 or Proxmox VE, need to bring clusters you already run as they are, or want CI scans, workload vulnerability ranking, cost and backups in the same operating workflow. Git-backed stacks and versioned profiles let you reuse a working foundation across clusters.
Choose Qovery when
- EKS, GKE, AKS or Scaleway Kapsule is your preferred foundation, and you want Karpenter or Autopilot scaling handled for you
- you want cloud-managed databases such as RDS created from blueprints
- you need a vendor with SOC 2 Type II, HIPAA or ISO 27001 paperwork today
- you want a self-hosted, air-gapped control plane under an Enterprise contract
Compare the work that remains
Use the same workload, infrastructure requirements and starting point.
- Create the foundation. Record server, cluster, networking and storage work done outside the product.
- Bring what you run. Connect an existing cluster and note what each product asks you to remove or change first.
- Run the next release. Include tests, scan failures, image publication, a preview and a rollback. Verify which failures actually block release.
- Change capacity. Trigger node scale-up and scale-down, and record how a sizing recommendation becomes a safe change.
- Investigate a vulnerability. Find every affected workload, establish scan coverage and carry a fix through release.
- Compare total cost. Include platform fees, deployment minutes, infrastructure, observability, setup effort and recurring operating work. See Qovery’s pricing and Ankra’s pricing.
Reviewed 9 November 2026 against Qovery’s documentation, changelog and pricing. Product scope and plans can change.