Enable private clusters

Last updated on Aug 10, 2026

Read the Private clusters section under Networking to understand what private clusters are and how they fit into the overall architecture.

Prerequisites

Before you can enable private clusters in SKE, ensure your setup meets the following requirements:

Your project must be part of an SNA before you can set cluster accessScope: "SNA".
Routing tables must be enabled for your SNA. If your SNA does not have routing tables enabled yet, follow the routing tables documentation to enable them before creating a private SKE cluster.
A public DNS server must be used for the network that your SKE cluster is deployed in.

Configuration

Private clusters can be enabled via CLI or Terraform:

Via CLI
Via Terraform

Generate and fetch a basic cluster configuration using the STACKIT CLI.

Modify the network section of the configuration to enable the private cluster feature. Make sure to include the SNA network id:

{
  "network": {
    "id": "<SNA_NETWORK_ID>",
    "controlPlane": {
      "accessScope": "SNA"
    }
  }
}

Use the following command to create a private SKE cluster using the modified configuration:
Terminal window
```
stackit ske cluster create -p <PROJECT_ID> <CLUSTER_NAME> --payload @cluster-configuration.json
```

resource "stackit_ske_cluster" "example" {
  name       = "example-cluster"
  project_id = "<PROJECT_ID>"

  network = {
    id = var.sna_network_id
    control_plane = {
      access_scope = "SNA"
    }
  }
}

See the Terraform stackit_ske_cluster documentation for the full schema.

Accessing the cluster

After creating a private SKE cluster, kubectl must run from a network path that can reach the SNA. This includes VPN connections, bastion hosts, or workload networks connected to the SNA. Verify that DNS resolution and routing are in place before relying on the cluster. See the SKE networking documentation for background on SNA connectivity.