For developers
Your code, reviewed and shipped with the whole system in view.
How developers use Ankra day to day: a review companion that knows the infrastructure, golden paths to deploy from, safe secrets, environments that branch like code, AI agents that work with the same context, and a colleague in every chat.
In this deck
Review with live context
Deploy from golden paths
Add and rotate secrets
Branch whole environments
Know which CVEs matter
Gate AI code in pipelines
Agents that see it all
A colleague in every chat
01 · Review companion
02
Context first, comments second.
The change
The diff, plus every caller of a changed name in the same repository. Lockfiles and generated files are dropped first.
Its neighbours
Repositories deployed on the same cluster, tagged under Settings → AI Context, or paired explicitly. A removed field another service still reads is caught here.
Companion PRs
Up to three linked pull requests, found through Depends-on: owner/repo#n, reviewed as one change across services.
The pipeline
The failing step, findings by tool and severity, the gate verdict, and the image digest the run produced.
Your standards
A second pass against your organisation’s always-active AI skills: your conventions, not generic advice.
What lands on the PR
03
One comment per pull request, kept up to date.
A verdict: looks good, comments, or changes requested.
At most eight findings, rated and pinned to lines.
Fingerprinted, so a finding is never posted twice.
@ankraai on any PR; a red build becomes a fix PR.
ankra-platform[bot] · Ankra AI review
Changes requested
HIGH · billing/serializers.py:42
Removes customer.legacy_id, which acme/orders-api still reads in its invoice export. Both run on eu-prod.
MEDIUM · migrations/0042_add_region.py:9
Adds a NOT NULL column without a default. Existing rows fail this migration on deploy.
LOW · CHANGELOG.md
Your “API changes” skill asks for a changelog entry on a breaking field removal. None found.
Illustrative example
02 · Golden paths
04
Start every deploy from a golden path.
Your organisation’s
Golden paths you own
- Capture any working stack as a stack profile
- Parameters, option sets and secret parameters
- Versioned on channels, with a changelog
- Shared read-only with teams, partners or customers
Ankra’s
Verified paths, ready to launch
- Verified Ankra profiles come first in the catalogue
- Maintained and versioned by Ankra
- Launch as is, or adopt one and extend it
- Backup protection travels with the profile
Production-ready means already decided
Charts, values, deploy order and backups are settled once, in review. Every environment launched from the path inherits them.
Golden paths · lifecycle
05
# capture a stack that already works
ankra stack-profiles drafts create \
--source-cluster prod --source-stack payments
ankra stack-profiles drafts publish <draft-id>
# launch it as a reviewable draft
ankra stack-profiles apply payments \
--cluster acme-dedicated --dry-run
# keep the fleet on one version
ankra stack-profiles rollout payments --all --outdated
# retire a bad version everywhere
ankra stack-profiles deprecate payments 3 \
--reason cve --reference CVE-2026-1234
A golden path has a lifecycle.
Capture
From a stack that already runs.
Launch
On any cluster, as a draft to review.
Roll out
Outdated deployments upgrade in place.
Retire
A deprecated version can’t be deployed.
03 · Secrets
06
Adding a secret never puts plaintext in Git.
On your machine
The CLI seals each value with your organisation’s public AGE key and checks it came out encrypted.
In Git
Only ciphertext, ENC[…], reviewed in the same pull request as the rest of the change.
In your cluster
The Ankra agent decrypts at deploy time, only for the paths you declared.
# a glob keeps covering DB_ keys added later
$ ankra cluster encrypt manifest db-secret --key 'glob:stringData.DB_*'
# application secrets come from stdin, never a flag in your shell history
$ printf '%s' "$STRIPE_KEY" | ankra application env-secrets set storefront STRIPE_KEY
Secrets · rotation
07
Rotating a secret is an edit, not a ceremony.
Stack secrets
Encrypt with --set 'data.password=…': the new value is sealed in memory and only ciphertext is written. Commit it, and Ankra rolls it out.
App secrets
Set the new value from stdin, then env-secrets apply seals it into the workloads and restarts them.
API tokens
ankra tokens rotate --overlap-hours 24 keeps the old token valid while clients move. CI signs in with GitHub OIDC, so there is no stored token at all.
Who can see
Revealing a value needs its own permission, and every reveal is audited. The AI sees key names and counts, never values.
04 · Environments
08
Three ways to get your own environment.
Per pull request
A preview with a URL
A namespace on your staging cluster that expires, an optional throwaway database, and a link to share inside the company or with a customer.
ankra application demo \
deploy storefront \
--pr-number 42
Per customer or feature
A stack from the same path
The same profile version production runs. Only the parameters differ, so nothing drifts between them.
ankra stack-profiles \
apply platform \
--cluster acme
With real data
A clone, data included
Databases come along through your backup vault. The copy lands as a draft you review before it deploys.
ankra cluster stacks \
clone shop --to staging \
--with-data --wait
Why merging back is safe
09
Same path, different parameters.
Stack profile
payments · v3
development
--set replicas=1
feature sandbox
--set flags=new-ledger
production
--set replicas=6
acme, dedicated
--set tier=enterprise
Merge back with confidence
The sandbox ran the same charts, values and deploy order. Publish v4, read the diff against v3, then roll it out.
Promote, never rebuild
Applications move by sha- tag. The image that passed in the sandbox is the image production runs.
05 · CVE scanning
10
Fix what is exploited, not what is loudest.
Rank
CISA KEV first, then FIRST EPSS, the chance of exploitation in the next 30 days, then severity.
Fleet
Trivy Operator scans inside your clusters. Findings roll up by image, workload, stack and cluster.
Decide
Accept a risk until a date, or until a fix ships. Previewed before it applies, and recorded.
Fix
A DevSecOps agent in propose mode opens one pull request per application, listing the CVEs it clears.
$ ankra security findings \
--known-exploited
$ ankra security findings \
--severity critical \
--fixable true --sort epss
$ ankra security advisory \
CVE-2026-1234
$ ankra security sbom export \
<digest> --format cyclonedx
What a blocked release looks like
11
A vulnerable image never gets a tag.
Semgrep reads the source, Checkov the charts and manifests, Trivy the filesystem and the image. The gate applies your image policy, and only the digest it judged is published.
Read it as
Nine HIGH findings blocked this run. Every environment kept its version, and each finding names the release that fixes it.
06 · Ankra Pipelines
12
From AI draft to production, stage by stage.
01
Lint, test
Real services, matrices, recorded results, flaky tests quarantined.
02
Build
Rootless BuildKit in your cluster, with SBOM and provenance.
03
Scan
Semgrep, Checkov and Trivy on source, charts and image.
04
Gate
Your image policy decides. A missing report blocks too.
05
Publish
Only the gated digest gets an immutable sha- tag.
06
Preview
The pull request runs in its own environment, with a URL.
07
Promote
A person moves the same tag to production.
On the roadmap
Verify stages: k6 load tests, latency probes and PromQL assertions against a preview, then canary rollouts. Until then, a run stage can drive your own load tool against the preview URL.
.ankra/pipeline.yaml
13
apiVersion: ankra.io/v1
kind: Pipeline
metadata: { name: "storefront" }
on:
pull_request: { branches: ["main"] }
push: { branches: ["main"] }
stages:
- { name: checkout, kind: checkout }
- name: test
kind: run
needs: [checkout]
run: pnpm lint && pnpm test
- { name: build, kind: build, needs: [test] }
- name: scan
kind: scan
needs: [build]
scan: { scanners: [semgrep, checkov, trivy] }
- { name: gate, kind: gate, needs: [scan] }
- { name: publish, kind: publish, needs: [gate] }
Logic is open. Authority is closed.
An agent may change
Steps, tests, path filters and what runs when.
Only an admin approves
Secrets, permissions, services, network, runners and resources. A pull request that widens them is not honoured.
Fast, not just safe
Affected-only stages, re-tag instead of rebuild, and a merge train.
07 · AI coding agents
14
It checks what a senior engineer checks.
Cost
What it costs
Reads cost per cluster, namespace and object before it adds a node or a replica.
ankra cost
namespaces prod
Security
What is exploited
Checks KEV and EPSS findings, encrypts with SOPS, never sees a secret value.
ankra security
findings --known-
exploited
CI/CD
Whether it passed
Waits on the real run, reads the failing step, fixes it and pushes again.
ankra pipeline get
--head-sha $SHA
--wait
Live
What is running
Reads pods, logs, events, metrics and recent operations instead of guessing.
ankra cluster
logs api -n shop
One session
15
> Ship the rate limiter to staging. What will it cost?
● /ankra-ship-service
$ ankra pipeline get --head-sha 4f2c9a1 --wait
scan · trivy: 1 HIGH, golang.org/x/net 0.38.0
bumping to 0.39.0, pushing to the PR
$ ankra pipeline get --head-sha 9b07e3d --wait
gate passed · published sha-9b07e3d
$ ankra application deploy storefront \
--cluster staging --set image_tag=sha-9b07e3d
$ ankra cluster get pods -n storefront
storefront-api 3/3 Running
$ ankra cost namespaces staging
storefront +€3.10 a month after this change
● Live on staging. Production needs your approval.
Illustrative session
One prompt, end to end.
Skills
Teach it your golden paths and Ankra’s workflows.
Guardrails
Raw kubectl and helm writes are blocked. MCP tokens start read-only.
People decide
Promotion and pipeline authority stay human. One command pauses every AI run.
08 · Ankra in your chat
16
Wherever the team already talks.
Slack
Mention, DM or /ankra
Also in Slack’s assistant pane. Alert cards with Acknowledge and Snooze, and Confirm or Deny on proposed changes.
1-click Add to Slack
Microsoft Teams
A team, a group or 1:1
Bot only: no Graph permissions, no admin consent, and it cannot read channel history.
Teams Store: soon
iOS
Ankra in your pocket
The portal and its AI assistant on the phone. Critical alerts are time-sensitive and break through Focus.
App Store
Android
Same app, same AI
Critical alerts arrive even in Doze, on their own notification channel. A tap opens the page.
Google Play
One AI behind all four
Chat in Slack or Teams uses the same tools as the web assistant, the CLI and MCP, under the same permission checks.
1:1 or the whole room
17
One on one, or in the room.
Direct message
Your own on-call partner
- Always answers, no mention needed
- Scope it: “use cluster eu-prod”
- Debug, explain a finding, draft a fix
- Confirmation cards only you can decide
Group room or channel
A teammate everyone can see
- Answers when @mentioned, or in its thread
- Reads the thread, never the whole channel
- Alert cards and ticket threads in the room
- Its answers are visible to the room
Safe in every room
It acts as the person who asked, with their Ankra role, and the audit log records their name. Ask mode is the default; Agent mode opens fix PRs but never merges.
Getting started
ankra.ai · App Store · Google Play · Azure Marketplace
18
Start with one repository this week.
01
Give your agent Ankra
ankra skills install
--with-hooks
02
Turn on review
ankra org ai-review
repos set acme/api
--review --mentions
03
Launch a golden path
ankra stack-profiles
apply <profile>
--cluster dev
04
Put CI on Ankra
ankra pipeline
repositories connect
One living picture
Review, golden paths, secrets, environments, security, pipelines, agents and chat, all reading one living picture of your organisation.