First success

Configure the first cloud provider

Select a provider by maturity, enter write-only credentials, validate once and confirm discovery before lifecycle work.

AudiencePlatform operatorsReading time12 minutesCommands in context1 guided stepsReviewed source9552586 · 1 August 2026

Choose a provider

Provider	Status	Workflow
Hetzner Cloud	Available	Connect, validate, discover, plan and operate
IONOS Cloud	Available	Connect, validate, discover, plan and operate

Prepare a scoped credential

✓
Use a dedicated project, subscription or account boundary
✓
Grant only the documented validation, discovery and lifecycle permissions
✓
Apply provider-side quota and budget alerts
✓
Deliver the credential through the write-only UI/API field
✓
Never place provider secrets in screenshots, plans, OperationRun options or support bundles

Register and validate

01
Settings → Cloud providers → Add account
Select the explicit provider type and a human-readable account name.
02
Enter credential material
The value is accepted write-only. ClusterPilot returns only secret-safe metadata.
03
Validate once
Validation uses the registered adapter. Invalid credentials return typed ProblemDetails; transport failures do not trigger browser retry loops.
04
Review capabilities
Confirm provider maturity, supported operations, regions/images/sizes and warnings before creating infrastructure.

Commands for this step

Validate the provider through the API when automating

UI users complete the same validation in the provider workflow. Integrators use this command and retain the returned account and correlation identifiers.

Use when neededDo not run these commands unless the described condition applies.

01
Changes stateHTTP API
Validate and inspect a provider account
Validate credentials once, then inspect provider detail, regions and infrastructure without browser retry loops.
Before you run it
- Provider account already registered through a write-only secret path
- cloud_providers permissions
HTTP API · api-provider
```
curl --fail-with-body -sS -X POST \
  -H "Authorization: Bearer $CLUSTERPILOT_API_KEY" \
  -H "Idempotency-Key: <uuid>" \
  $CP_URL/api/v1/cloud-providers/<provider-id>/validate | jq .
curl --fail-with-body -sS -H "Authorization: Bearer $CLUSTERPILOT_API_KEY" \
  $CP_URL/api/v1/cloud-providers/<provider-id> | jq .
curl --fail-with-body -sS -H "Authorization: Bearer $CLUSTERPILOT_API_KEY" \
  $CP_URL/api/v1/cloud-providers/<provider-id>/regions | jq .
```
Expected result
Validation and discovery return typed, secret-safe responses.
Reviewed sourcedocs/operations/cloud-provider-rollout-compatibility-runbook.md

When validation fails

Symptom	Likely boundary	Safe response
Invalid credentials	Provider rejected identity	Rotate/re-enter scoped material and validate once
Outbound request blocked	Allowed-host or SSRF policy	Review exact provider endpoint; do not widen to wildcard
Rate limited	Provider quota	Honor Retry-After and stop client retry loops
Circuit open	Repeated provider failure	Repair dependency, then use the serialized reset workflow
Discovery incomplete	Permission, region or provider API	Compare capability warnings and provider audit logs

Configure the first cloud provider

Choose a provider

Prepare a scoped credential

Register and validate

Settings → Cloud providers → Add account

Enter credential material

Validate once

Review capabilities

When validation fails