First success · v0.0.1

Configure the first cloud provider

Select a provider by maturity, enter write-only credentials, validate once and confirm discovery before lifecycle work.

AudiencePlatform operatorsReading time12 minutesCommands in context1 guided stepsReviewed sourcefcc5871 · 30 July 2026

Exact release scope. This page documents the reviewed v0.0.1 source at fcc5871. Check release status before enabling a gated capability.

Choose by support boundary

Provider	v0.0.1 posture	Recommended use
Hetzner Cloud	Stable · production-gated	Supported controlled path with environment approval
Amazon Web Services	Disabled in v0.0.1	Unavailable in v0.0.1; do not enable
Microsoft Azure	Disabled in v0.0.1	Unavailable in v0.0.1; do not enable
IONOS Cloud	Stable · production-gated	Supported controlled path with environment approval

Prepare a scoped credential

✓
Use a dedicated project, subscription or account boundary
✓
Grant only the documented validation, discovery and lifecycle permissions
✓
Apply provider-side quota and budget alerts
✓
Deliver the credential through the write-only UI/API field
✓
Never place provider secrets in screenshots, plans, OperationRun options or support bundles

Register and validate

01
Settings → Cloud providers → Add account
Select the explicit provider type and a human-readable account name.
02
Enter credential material
The value is accepted write-only. ClusterPilot returns only secret-safe metadata.
03
Validate once
Validation uses the registered adapter. Invalid credentials return typed ProblemDetails; transport failures do not trigger browser retry loops.
04
Review capabilities
Confirm provider maturity, supported operations, regions/images/sizes and warnings before creating infrastructure.

Commands for this step

Validate the provider through the API when automating

UI users complete the same validation in the provider workflow. Integrators use this command and retain the returned account and correlation identifiers.

Use when neededDo not run these commands unless the described condition applies.

01
Changes stateHTTP API
Validate and inspect a provider account
Validate credentials once, then inspect provider detail, regions and infrastructure without browser retry loops.
Before you run it
- Provider account already registered through a write-only secret path
- cloud_providers permissions
HTTP API · api-provider
```
curl --fail-with-body -sS -X POST \
  -H "Authorization: Bearer $CLUSTERPILOT_API_KEY" \
  -H "Idempotency-Key: <uuid>" \
  $CP_URL/api/v1/cloud-providers/<provider-id>/validate | jq .
curl --fail-with-body -sS -H "Authorization: Bearer $CLUSTERPILOT_API_KEY" \
  $CP_URL/api/v1/cloud-providers/<provider-id> | jq .
curl --fail-with-body -sS -H "Authorization: Bearer $CLUSTERPILOT_API_KEY" \
  $CP_URL/api/v1/cloud-providers/<provider-id>/regions | jq .
```
Expected result
Validation and discovery return typed, secret-safe responses.
Reviewed sourcedocs/operations/cloud-provider-rollout-compatibility-runbook.md

When validation fails

Symptom	Likely boundary	Safe response
Invalid credentials	Provider rejected identity	Rotate/re-enter scoped material and validate once
Outbound request blocked	Allowed-host or SSRF policy	Review exact provider endpoint; do not widen to wildcard
Rate limited	Provider quota	Honor Retry-After and stop client retry loops
Circuit open	Repeated provider failure	Repair dependency, then use the serialized reset workflow
Discovery incomplete	Permission, region or provider API	Compare capability warnings and provider audit logs

Configure the first cloud provider

Choose by support boundary

Prepare a scoped credential

Register and validate

Settings → Cloud providers → Add account

Enter credential material

Validate once

Review capabilities

When validation fails